@pulse-compute/crypto 1.0.0-beta.4 → 1.0.0-beta.6

package/guests/es256-rustcrypto/source/src/lib.rs

@@ -0,0 +1,308 @@
+#![no_std]
+
+use core::{panic::PanicInfo, slice};
+use ecdsa::{
+    hazmat::{bits2field, verify_prehashed},
+    Signature,
+};
+use p256::{
+    elliptic_curve::sec1::FromEncodedPoint,
+    AffinePoint,
+    EncodedPoint,
+    NistP256,
+    ProjectivePoint,
+};
+use sha2::{Digest, Sha256};
+
+type P256Signature = Signature<NistP256>;
+
+const MEMORY_BYTES: u32 = 32 * 65_536;
+const INVOCATION_REGION_START: u32 = 8 * 65_536;
+const FRAME_MAGIC: u32 = 0x3253_4550;
+const FRAME_VERSION: u32 = 2;
+const FRAME_HEADER_BYTES: u32 = 64;
+const FRAME_CAPACITY_BYTES: u32 = 16_640;
+const FRAME_ALIGNMENT_BYTES: u32 = 16;
+const FRAME_ALGORITHM_ES256: u32 = 1;
+const P256_PUBLIC_KEY_BYTES: u32 = 64;
+const ES256_SIGNATURE_BYTES: u32 = 64;
+const ES256_SIGNING_INPUT_BYTES_MAXIMUM: u32 = 16_340;
+
+const STATUS_VALID: i32 = 1;
+const STATUS_INVALID_AUTHENTICATOR: i32 = 0;
+const STATUS_INVALID_KEY: i32 = -1;
+const STATUS_INVALID_INPUT: i32 = -2;
+
+const HEADER_MAGIC: usize = 0;
+const HEADER_VERSION: usize = 4;
+const HEADER_LENGTH: usize = 8;
+const HEADER_TOTAL_LENGTH: usize = 12;
+const HEADER_ALGORITHM: usize = 16;
+const HEADER_FLAGS: usize = 20;
+const HEADER_SIGNING_INPUT_OFFSET: usize = 24;
+const HEADER_SIGNING_INPUT_LENGTH: usize = 28;
+const HEADER_PUBLIC_KEY_OFFSET: usize = 32;
+const HEADER_PUBLIC_KEY_LENGTH: usize = 36;
+const HEADER_SIGNATURE_OFFSET: usize = 40;
+const HEADER_SIGNATURE_LENGTH: usize = 44;
+const HEADER_RESERVED_0: usize = 48;
+const HEADER_RESERVED_1: usize = 52;
+const HEADER_RESERVED_2: usize = 56;
+const HEADER_RESERVED_3: usize = 60;
+
+#[derive(Clone, Copy)]
+struct Span {
+    start: u32,
+    end: u32,
+}
+
+impl Span {
+    fn checked(start: u32, length: u32, total_length: u32) -> Option<Self> {
+        if start < FRAME_HEADER_BYTES
+            || start % FRAME_ALIGNMENT_BYTES != 0
+        {
+            return None;
+        }
+        let end = start.checked_add(length)?;
+        if end > total_length {
+            return None;
+        }
+        Some(Self { start, end })
+    }
+
+    fn overlaps(self, other: Self) -> bool {
+        self.start < other.end && other.start < self.end
+    }
+}
+
+#[panic_handler]
+fn panic(_info: &PanicInfo<'_>) -> ! {
+    loop {
+        core::hint::spin_loop();
+    }
+}
+
+fn read_u32_le(bytes: &[u8], offset: usize) -> u32 {
+    u32::from_le_bytes([
+        bytes[offset],
+        bytes[offset + 1],
+        bytes[offset + 2],
+        bytes[offset + 3],
+    ])
+}
+
+fn outer_frame_is_valid(frame_pointer: u32, frame_capacity: u32) -> bool {
+    if frame_capacity != FRAME_CAPACITY_BYTES
+        || frame_pointer < INVOCATION_REGION_START
+        || frame_pointer % FRAME_ALIGNMENT_BYTES != 0
+    {
+        return false;
+    }
+    match frame_pointer.checked_add(frame_capacity) {
+        Some(end) => end <= MEMORY_BYTES,
+        None => false,
+    }
+}
+
+fn header_is_valid(frame: &[u8], key_bytes: u32) -> Option<(Span, Span, Span)> {
+    signature_header(frame, key_bytes, ES256_SIGNATURE_BYTES, FRAME_ALGORITHM_ES256, ES256_SIGNING_INPUT_BYTES_MAXIMUM)
+}
+
+fn signature_header(frame: &[u8], key_bytes: u32, signature_bytes: u32, algorithm: u32, input_max: u32) -> Option<(Span, Span, Span)> {
+    let total_length = read_u32_le(frame, HEADER_TOTAL_LENGTH);
+    if read_u32_le(frame, HEADER_MAGIC) != FRAME_MAGIC
+        || read_u32_le(frame, HEADER_VERSION) != FRAME_VERSION
+        || read_u32_le(frame, HEADER_LENGTH) != FRAME_HEADER_BYTES
+        || total_length < 192
+        || total_length > FRAME_CAPACITY_BYTES
+        || total_length % FRAME_ALIGNMENT_BYTES != 0
+        || read_u32_le(frame, HEADER_ALGORITHM) != algorithm
+        || read_u32_le(frame, HEADER_FLAGS) != 0
+        || read_u32_le(frame, HEADER_RESERVED_0) != 0
+        || read_u32_le(frame, HEADER_RESERVED_1) != 0
+        || read_u32_le(frame, HEADER_RESERVED_2) != 0
+        || read_u32_le(frame, HEADER_RESERVED_3) != 0
+    {
+        return None;
+    }
+
+    let signing_input_length =
+        read_u32_le(frame, HEADER_SIGNING_INPUT_LENGTH);
+    let public_key_length = read_u32_le(frame, HEADER_PUBLIC_KEY_LENGTH);
+    let signature_length = read_u32_le(frame, HEADER_SIGNATURE_LENGTH);
+    if signing_input_length > input_max
+        || public_key_length != key_bytes
+        || signature_length != signature_bytes
+    {
+        return None;
+    }
+
+    let signing_input = Span::checked(
+        read_u32_le(frame, HEADER_SIGNING_INPUT_OFFSET),
+        signing_input_length,
+        total_length,
+    )?;
+    let public_key = Span::checked(
+        read_u32_le(frame, HEADER_PUBLIC_KEY_OFFSET),
+        public_key_length,
+        total_length,
+    )?;
+    let signature = Span::checked(
+        read_u32_le(frame, HEADER_SIGNATURE_OFFSET),
+        signature_length,
+        total_length,
+    )?;
+
+    if signing_input.start == public_key.start
+        || signing_input.start == signature.start
+        || public_key.start == signature.start
+        || signing_input.overlaps(public_key)
+        || signing_input.overlaps(signature)
+        || public_key.overlaps(signature)
+    {
+        return None;
+    }
+
+    Some((signing_input, public_key, signature))
+}
+
+fn verify_es256(
+    signing_input: &[u8],
+    public_key_bytes: &[u8],
+    signature_bytes: &[u8],
+) -> i32 {
+    let mut sec1_key = [0_u8; P256_PUBLIC_KEY_BYTES as usize + 1];
+    sec1_key[0] = 0x04;
+    sec1_key[1..].copy_from_slice(public_key_bytes);
+
+    let encoded_point = match EncodedPoint::from_bytes(sec1_key) {
+        Ok(value) => value,
+        Err(_) => return STATUS_INVALID_KEY,
+    };
+    sec1_key.fill(0);
+
+    let affine_point = match Option::<AffinePoint>::from(
+        AffinePoint::from_encoded_point(&encoded_point),
+    ) {
+        Some(value) => value,
+        None => return STATUS_INVALID_KEY,
+    };
+    let signature = match P256Signature::from_slice(signature_bytes) {
+        Ok(value) => value,
+        Err(_) => return STATUS_INVALID_INPUT,
+    };
+    let digest = Sha256::digest(signing_input);
+    let digest_field = match bits2field::<NistP256>(&digest) {
+        Ok(value) => value,
+        Err(_) => return STATUS_INVALID_INPUT,
+    };
+
+    match verify_prehashed::<NistP256>(
+        &ProjectivePoint::from(affine_point),
+        &digest_field,
+        &signature,
+    ) {
+        Ok(()) => STATUS_VALID,
+        Err(_) => STATUS_INVALID_AUTHENTICATOR,
+    }
+}
+
+/// Verifies one ES256 request encoded in the frozen private invocation frame.
+///
+/// The caller owns and clears the fixed-capacity frame after capturing the
+/// scalar result. This guest does not retain frame pointers or mutate input.
+///
+/// # Safety
+///
+/// The host must instantiate this module with the declared fixed, unshared
+/// 32-page `env.memory`. This function validates the outer range before its
+/// first dereference and validates every described field before field access.
+#[no_mangle]
+pub unsafe extern "C" fn pulse_crypto_es256_verify(
+    frame_pointer: u32,
+    frame_capacity: u32,
+) -> i32 {
+    if !outer_frame_is_valid(frame_pointer, frame_capacity) {
+        return STATUS_INVALID_INPUT;
+    }
+
+    let frame = slice::from_raw_parts(
+        frame_pointer as *const u8,
+        frame_capacity as usize,
+    );
+    let (signing_input, public_key, signature) =
+        match header_is_valid(frame, P256_PUBLIC_KEY_BYTES) {
+            Some(value) => value,
+            None => return STATUS_INVALID_INPUT,
+        };
+
+    verify_es256(
+        &frame[signing_input.start as usize..signing_input.end as usize],
+        &frame[public_key.start as usize..public_key.end as usize],
+        &frame[signature.start as usize..signature.end as usize],
+    )
+}
+
+
+/// Sign one ES256 request using x || y || d private-key bytes. The frame
+/// follows the verification envelope with a 96-byte key and writable output.
+/// Input spans must not overlap. Callers clear the frame and borrowed Rust
+/// stack after capturing the signature; this function retains no pointers.
+#[no_mangle]
+pub unsafe extern "C" fn pulse_crypto_es256_sign(frame_pointer: u32, frame_capacity: u32) -> i32 {
+    use p256::ecdsa::{signature::hazmat::PrehashSigner, SigningKey};
+    if !outer_frame_is_valid(frame_pointer, frame_capacity) { return STATUS_INVALID_INPUT; }
+    let frame = slice::from_raw_parts_mut(frame_pointer as *mut u8, frame_capacity as usize);
+    let (input, key, output) = match header_is_valid(frame, 96) {
+        Some(value) => value, None => return STATUS_INVALID_INPUT,
+    };
+    // Clear output before validating the key so failed calls cannot expose a
+    // prior signature. Header validation already proved disjoint spans.
+    frame[output.start as usize..output.end as usize].fill(0);
+    let key_start = key.start as usize;
+    let signer = match SigningKey::from_slice(&frame[key_start + 64..key.end as usize]) {
+        Ok(value) => value, Err(_) => return STATUS_INVALID_KEY,
+    };
+    let public = signer.verifying_key().to_encoded_point(false);
+    if public.as_bytes()[1..] != frame[key_start..key_start + 64] { return STATUS_INVALID_KEY; }
+    let digest = Sha256::digest(&frame[input.start as usize..input.end as usize]);
+    // RustCrypto's deterministic RFC6979 signing requires no host randomness.
+    let signature: P256Signature = match signer.sign_prehash(&digest) {
+        Ok(value) => value, Err(_) => return STATUS_INVALID_KEY,
+    };
+    frame[output.start as usize..output.end as usize].copy_from_slice(&signature.to_bytes());
+    STATUS_VALID
+}
+
+
+extern "C" {
+    fn pulse_rs256(key: *const u8, key_len: usize, hash: *const u8,
+        signature: *mut u8, modulus_len: usize, sign: i32) -> i32;
+}
+
+unsafe fn rsa_frame(pointer: u32, capacity: u32, sign: bool) -> i32 {
+    if !outer_frame_is_valid(pointer, capacity) { return STATUS_INVALID_INPUT; }
+    let frame = slice::from_raw_parts_mut(pointer as *mut u8, capacity as usize);
+    let k = read_u32_le(frame, HEADER_SIGNATURE_LENGTH);
+    if !matches!(k, 256 | 384 | 512) { return STATUS_INVALID_INPUT; }
+    let key_len = if sign { 8 + k * 9 / 2 } else { 8 + k };
+    let (input, key, output) = match signature_header(frame, key_len, k, 2, 12_288) {
+        Some(value) => value, None => return STATUS_INVALID_INPUT,
+    };
+    if sign { frame[output.start as usize..output.end as usize].fill(0); }
+    let hash = Sha256::digest(&frame[input.start as usize..input.end as usize]);
+    pulse_rs256(frame.as_ptr().add(key.start as usize), key_len as usize,
+        hash.as_ptr(), frame.as_mut_ptr().add(output.start as usize), k as usize, sign as i32)
+}
+
+/// RS256 uses the same checked v2 envelope, algorithm code 2, variable-width
+/// key/signature spans, and a 12288-byte data bound. Caller clears frame/stack.
+#[no_mangle]
+pub unsafe extern "C" fn pulse_crypto_rs256_sign(pointer: u32, capacity: u32) -> i32 {
+    rsa_frame(pointer, capacity, true)
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn pulse_crypto_rs256_verify(pointer: u32, capacity: u32) -> i32 {
+    rsa_frame(pointer, capacity, false)
+}

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@pulse-compute/crypto",
-  "version": "1.0.0-beta.4",
+  "version": "1.0.0-beta.6",
   "license": "Apache-2.0",
   "engines": {
     "node": "^22.14.0 || ^24.0.0"
   },
-  "description": "Provider-neutral cryptographic verification contracts for Pulse.",
+  "description": "Provider-neutral cryptographic verification and bounded exact-text digests for Pulse.",
   "type": "module",
   "sideEffects": false,
   "exports": {
@@ -15,14 +15,22 @@
       "default": "./dist/index.js"
     },
     "./pulsewasm-native": "./pulsewasm.native.cjs",
-    "./provider": "./src/provider.cjs"
+    "./provider": "./src/provider.cjs",
+    "./pulsewasm/manifest": "./pulsewasm.manifest.cjs",
+    "./pulsewasm/compiler": "./pulsewasm.compiler.cjs"
   },
   "files": [
     "as",
+    "guests",
     "dist",
     "pulsewasm.native.cjs",
     "README.md",
     "src/provider.cjs",
+    "src/provider.d.cts",
+    "pulse.package.json",
+    "pulsewasm.manifest.cjs",
+    "pulsewasm.compiler.cjs",
+    "conformance",
     "LICENSE",
     "NOTICE"
   ],
@@ -37,9 +45,19 @@
   "bugs": {
     "url": "https://github.com/pulse-compute/pulse/issues"
   },
-  "homepage": "https://pulsecompute.io/v1.0.0-beta.4/packages/crypto/",
+  "homepage": "https://pulsecompute.io/v1.0.0-beta.6/packages/crypto/",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "pulse": {
+    "contract": "./pulse.package.json"
+  },
+  "pulsewasm": {
+    "manifest": "./pulsewasm.manifest.cjs"
+  },
+  "dependencies": {
+    "@pulse-compute/runtime": "1.0.0-beta.6",
+    "@pulse-compute/wasm-contracts": "1.0.0-beta.6"
+  },
   "scripts": {
     "build": "tsc -b",
     "test": "corepack pnpm --dir ../.. exec vitest run packages/crypto/test",

package/pulse.package.json

@@ -0,0 +1,64 @@
+{
+  "version": "pulse.package-contract.v1",
+  "kind": "pulse.package-contract",
+  "contractId": "pulse.crypto",
+  "npmPackage": "@pulse-compute/crypto",
+  "description": "Bounded exact-text SHA-256 through an execution-owned effect.",
+  "authoring": {
+    "namespace": "crypto",
+    "import": "@pulse-compute/crypto",
+    "symbols": [
+      "digestText"
+    ]
+  },
+  "ownership": {
+    "profileFragment": "crypto",
+    "helperImports": [],
+    "reExportImports": []
+  },
+  "composition": {
+    "status": "reserved",
+    "helperSymbol": "crypto",
+    "profileToken": "opaque-direct-use",
+    "reasonCode": "PULSE_PACKAGE_COMPOSITION_HELPER_NOT_REALIZED"
+  },
+  "targets": {
+    "native": {
+      "status": "provider-dependent",
+      "realization": "canonical-package-lowering",
+      "lowerableSubpath": "@pulse-compute/crypto",
+      "providerRequirements": [
+        "crypto.digestText"
+      ],
+      "reasonCode": "PULSE_PACKAGE_PROVIDER_CAPABILITY_REQUIRED"
+    },
+    "javascript": {
+      "status": "supported",
+      "realization": "javascript-package-runtime",
+      "entry": "./dist/index.js",
+      "providerRequirements": [
+        "crypto.digestText"
+      ]
+    }
+  },
+  "lowering": {
+    "manifest": "./pulsewasm.manifest.cjs",
+    "trust": "first-party",
+    "canonicalOperationVersion": "pulse.canonical-package-operation.v1",
+    "bundleVersion": "pulse.package-lowering-bundle.v1",
+    "providerRequirementVersion": "pulse.provider-requirement-record.v1"
+  },
+  "conformance": {
+    "status": "target-overlap",
+    "fixtureRoots": [
+      "./conformance"
+    ],
+    "semanticCases": [
+      "crypto.digestText"
+    ]
+  },
+  "docs": {
+    "readme": "./README.md",
+    "contract": "./pulse.package.json"
+  }
+}

package/pulsewasm.compiler.cjs

@@ -0,0 +1,89 @@
+'use strict';
+const { normalizeDiagnostic, sourceLoc } = require('@pulse-compute/wasm-contracts/diagnostics');
+const { CANONICAL_PACKAGE_EFFECT_VERSION } = require('@pulse-compute/wasm-contracts/handler/canonical-runtime');
+const { PACKAGE_CRYPTO_REQUIREMENT_VERSION } = require('@pulse-compute/wasm-contracts/package/package-contract');
+const PACKAGE = '@pulse-compute/crypto';
+function buildCryptoLoweringPlan(input = {}) {
+  const ts = input.typescript || require('typescript');
+  const source = input.sourceFile || ts.createSourceFile(input.sourcePath || 'index.ts', input.sourceText || '', ts.ScriptTarget.ES2022, true);
+  const namespaces = new Set(), direct = new Set(), diagnostics = [], effects = [];
+  const error = (node, suffix, message) => diagnostics.push(normalizeDiagnostic({
+    phase: 'crypto-lowering', severity: 'error', code: `PULSEWASM_CRYPTO_DIGEST_${suffix}`, message,
+    hint: 'Await crypto.digestText(ctx, text) into a local variable or use it as a direct keyed ctx.parallel member.', loc: sourceLoc(source, node)
+  }));
+  for (const statement of source.statements) {
+    if (!ts.isImportDeclaration(statement) || statement.moduleSpecifier.text !== PACKAGE || statement.importClause?.isTypeOnly) continue;
+    if (statement.importClause?.name) namespaces.add(statement.importClause.name.text);
+    const named = statement.importClause?.namedBindings;
+    if (named && ts.isNamedImports(named)) for (const entry of named.elements) {
+      if (entry.isTypeOnly) continue;
+      const name = (entry.propertyName || entry.name).text;
+      if (name === 'crypto') namespaces.add(entry.name.text);
+      if (name === 'digestText') direct.add(entry.name.text);
+    }
+  }
+  function checkBinding(name) {
+    if (ts.isIdentifier(name)) {
+      if (namespaces.has(name.text) || direct.has(name.text)) error(name, 'SHADOWED', 'Imported Crypto bindings cannot be shadowed.');
+    } else if (ts.isObjectBindingPattern(name) || ts.isArrayBindingPattern(name)) {
+      for (const element of name.elements) if (ts.isBindingElement(element)) checkBinding(element.name);
+    }
+  }
+  function isDigest(expression) {
+    return ts.isIdentifier(expression) && direct.has(expression.text)
+      || ts.isPropertyAccessExpression(expression) && expression.name.text === 'digestText'
+        && ts.isIdentifier(expression.expression) && namespaces.has(expression.expression.text);
+  }
+  // Verification remains an ordinary JavaScript API. Its existing facade
+  // aliases and helpers must not acquire digest-specific authoring restrictions.
+  let hasDigestUse = false;
+  function findDigestUse(node) {
+    if (ts.isImportDeclaration(node) || ts.isTypeNode(node)) return;
+    if (isDigest(node)
+      || ts.isPropertyAccessExpression(node) && node.name.text === 'digestText'
+      || ts.isElementAccessExpression(node) && node.argumentExpression && ts.isStringLiteralLike(node.argumentExpression) && node.argumentExpression.text === 'digestText') hasDigestUse = true;
+    ts.forEachChild(node, findDigestUse);
+  }
+  findDigestUse(source);
+  function visit(node) {
+    if (ts.isTypeNode(node)) return;
+    if ((ts.isVariableDeclaration(node) || ts.isParameter(node) || ts.isFunctionDeclaration(node) || ts.isClassDeclaration(node)) && node.name) checkBinding(node.name);
+    if (ts.isIdentifier(node) && namespaces.has(node.text)
+      && !ts.isImportClause(node.parent) && !ts.isImportSpecifier(node.parent)
+      && !(ts.isPropertyAccessExpression(node.parent))) error(node, 'DETACHED', 'The Crypto facade cannot be detached or accessed dynamically.');
+    if (isDigest(node) && !ts.isImportSpecifier(node.parent)
+      && !(ts.isPropertyAccessExpression(node.parent) && node.parent.name === node)
+      && (!ts.isCallExpression(node.parent) || node.parent.expression !== node)) error(node, 'DETACHED', 'Digest operations cannot be detached or aliased.');
+    if (ts.isCallExpression(node) && isDigest(node.expression)) {
+      let fn = node.parent;
+      while (fn && !ts.isArrowFunction(fn) && !ts.isFunctionExpression(fn)) fn = fn.parent;
+      const ctx = fn && fn.parameters[0] && fn.parameters[0].name;
+      if (node.arguments.length !== 2 || !ctx || !ts.isIdentifier(ctx)
+        || !ts.isIdentifier(node.arguments[0]) || node.arguments[0].text !== ctx.text) {
+        error(node, 'ARGUMENTS', 'Digest requires the current handler context and one text input.'); return;
+      }
+      let placement = '';
+      const parent = node.parent;
+      if (ts.isAwaitExpression(parent) && ts.isVariableDeclaration(parent.parent)) placement = 'variable';
+      if (ts.isPropertyAssignment(parent) && ts.isObjectLiteralExpression(parent.parent)) {
+        const call = parent.parent.parent;
+        if (ts.isCallExpression(call) && ts.isPropertyAccessExpression(call.expression)
+          && ts.isIdentifier(call.expression.expression) && call.expression.expression.text === ctx.text
+          && call.expression.name.text === 'parallel' && ts.isAwaitExpression(call.parent)) placement = 'statement';
+      }
+      if (!placement) { error(node, 'PLACEMENT', 'Digest must be directly awaited or grouped.'); return; }
+      effects.push({ version: CANONICAL_PACKAGE_EFFECT_VERSION, contractId: 'pulse.crypto', package: PACKAGE, import: PACKAGE,
+        kind: 'crypto.digestText', capability: 'crypto.digestText', result: 'text-digest-result', providerKind: 'crypto', operation: 'digestText', placement,
+        range: { start: node.getStart(source), end: node.getEnd() }, resource: {}, payload: {},
+        runtimeInputs: [{ name: 'text', argumentIndex: 1, source: 'package-call-argument' }],
+        providerRequirements: ['crypto.digestText'], schemaReferences: [], redaction: ['text', 'sha256'], loc: sourceLoc(source, node) });
+    }
+    ts.forEachChild(node, visit);
+  }
+  if (hasDigestUse) visit(source);
+  const cryptoRequirements = effects.length ? [{ version: PACKAGE_CRYPTO_REQUIREMENT_VERSION, algorithms: ['SHA-256'], reachable: true, requestedBy: PACKAGE, semanticOwner: PACKAGE }] : [];
+  return { artifact: { version: 'pulse.crypto-text-lowering-plan.v1', contractId: 'pulse.crypto', package: PACKAGE, lowerableSubpath: PACKAGE,
+    status: diagnostics.length ? 'error' : 'ok', canonicalEffects: effects, cryptoRequirements },
+    canonicalEffects: effects, cryptoRequirements, diagnostics, hasErrors: diagnostics.length > 0 };
+}
+module.exports = { buildCryptoLoweringPlan };

package/pulsewasm.manifest.cjs

@@ -0,0 +1,15 @@
+'use strict';
+module.exports = Object.freeze({
+  version: 'pulsewasm.lowerable-library-manifest.v2', kind: 'pulsewasm.lowerable-library-manifest',
+  contractId: 'pulse.crypto', npmPackage: '@pulse-compute/crypto', lowerableSubpath: '@pulse-compute/crypto',
+  facade: { namespace: 'crypto', import: '@pulse-compute/crypto', symbols: ['digestText'] },
+  publicApi: { package: '@pulse-compute/crypto', symbols: ['crypto', 'digestText'], compatibilitySubpaths: [], loweringIntentionallyNarrow: true },
+  compiler: { version: 'pulsewasm.lowerable-compiler-builder.v1', entry: './pulsewasm.compiler.cjs', export: 'buildCryptoLoweringPlan', artifact: 'crypto-lowering-plan.json', builderOwner: '@pulse-compute/crypto', trust: 'first-party', inputs: ['typescript.SourceFile'] },
+  modes: {
+    typescript: { entry: './dist/index.js' }, jsEngine: { entry: './dist/index.js', behavior: 'provider-dependent' },
+    wasm: { mode: 'wasm-sidecar', sidecar: './as/digest-text.as.ts',
+      lowerings: [{ tsSymbol: 'crypto.digestText', asSymbol: '__pulse_crypto_digest_text', callShape: 'context-runtime-text', hostCapabilities: ['result'] }],
+      hostCapabilities: ['result'] }
+  },
+  policy: { packageOwnsFacadeMapping: true, canonicalRootLowering: true, automaticFallback: false }
+});

package/pulsewasm.native.cjs

@@ -45,6 +45,7 @@ function pulseHmacAssemblyScriptSource(algorithm = 'HS256') {
       'pulse_crypto_hs256_verify',
       'pulse_crypto_sha256_digest',
       'pulse_crypto_bytes_frame_v1',
+      'pulse_crypto_digest_frame_v1',
       'pulse_crypto_sha256_bytes_v1',
       'pulse_crypto_hmac_sha256_bytes_v1'
     ]),
@@ -55,8 +56,10 @@ function pulseHmacAssemblyScriptSource(algorithm = 'HS256') {
       hs256TagBytes: 32,
       byteOperationKeyBytesMaximum: 8192,
       byteOperationDataBytesMaximum: 32768,
+      digestDataBytesMaximum: 2097152,
       byteOperationOutputBytes: 32,
-      byteOperationFrameBytes: 40992
+      byteOperationFrameBytes: 40992,
+      digestFrameBytes: 2097184
     }),
     resultCodes: Object.freeze({
       valid: 1,
@@ -76,20 +79,23 @@ function pulseHmacAssemblyScriptSource(algorithm = 'HS256') {
 
 function bindNativeDigestMac(moduleExports) {
   const memory = moduleExports && moduleExports.memory;
-  const names = ['pulse_crypto_bytes_frame_v1', 'pulse_crypto_sha256_bytes_v1', 'pulse_crypto_hmac_sha256_bytes_v1'];
+  const names = ['pulse_crypto_bytes_frame_v1', 'pulse_crypto_digest_frame_v1', 'pulse_crypto_sha256_bytes_v1', 'pulse_crypto_hmac_sha256_bytes_v1'];
   if (!(memory instanceof WebAssembly.Memory) || names.some((name) => typeof moduleExports[name] !== 'function')) {
     throw new TypeError('Native Crypto digest/MAC exports are unavailable.');
   }
-  const frameBytes = 8192 + 32768 + 32;
   function run(data, key) {
-    if (!(data instanceof Uint8Array) || data.length > 32768
+    if (!(data instanceof Uint8Array) || data.length > (key === undefined ? 2097152 : 32768)
       || (key !== undefined && (!(key instanceof Uint8Array) || key.length > 8192))) {
       throw new TypeError('Native Crypto digest/MAC input exceeds its byte contract.');
     }
-    const pointer = moduleExports.pulse_crypto_bytes_frame_v1() >>> 0;
+    const largeDigest = key === undefined && data.length > 32768;
+    const dataBytes = largeDigest ? 2097152 : 32768;
+    const keyBytes = largeDigest ? 0 : 8192;
+    const frameBytes = keyBytes + dataBytes + 32;
+    const pointer = (largeDigest ? moduleExports.pulse_crypto_digest_frame_v1() : moduleExports.pulse_crypto_bytes_frame_v1()) >>> 0;
     if (pointer + frameBytes > memory.buffer.byteLength) throw new TypeError('Native Crypto frame is outside memory.');
-    const dataPointer = pointer + 8192;
-    const outputPointer = dataPointer + 32768;
+    const dataPointer = pointer + keyBytes;
+    const outputPointer = dataPointer + dataBytes;
     try {
       const view = new Uint8Array(memory.buffer);
       view.set(data, dataPointer);
@@ -118,7 +124,73 @@ function pulseEs256GuestUnit() {
   });
 }
 
+
+function bindNativeEs256Signer(moduleExports) {
+  const memory = moduleExports && moduleExports.memory;
+  const sign = moduleExports && moduleExports.pulse_crypto_es256_sign;
+  if (!(memory instanceof WebAssembly.Memory) || memory.buffer.byteLength !== 2097152 || typeof sign !== 'function') {
+    throw new TypeError('Native ES256 signing exports are unavailable.');
+  }
+  return (key, data) => {
+    if (!(key instanceof Uint8Array) || key.length !== 96 || !(data instanceof Uint8Array) || data.length > 16340) {
+      throw new TypeError('Invalid ES256 signing byte request.');
+    }
+    const pointer = 524288, capacity = 16640;
+    const frame = new Uint8Array(memory.buffer, pointer, capacity);
+    frame.fill(0);
+    try {
+      const header = new DataView(memory.buffer, pointer, 64);
+      for (const [offset, value] of [[0, 0x32534550], [4, 2], [8, 64], [12, (224 + data.length + 15) & ~15],
+        [16, 1], [24, 224], [28, data.length], [32, 64], [36, 96], [40, 160], [44, 64]]) header.setUint32(offset, value, true);
+      frame.set(key, 64); frame.set(data, 224);
+      const status = sign(pointer, capacity);
+      if (status === -1) throw Object.assign(new TypeError('Invalid P-256 signing key.'), { code: 'PULSE_CRYPTO_KEY_INVALID' });
+      if (status !== 1) throw new TypeError('Native ES256 signing failed.');
+      return frame.slice(160, 224);
+    } finally {
+      frame.fill(0);
+      // The synchronous guest has returned: clear its borrowed stack as well.
+      new Uint8Array(memory.buffer, 0, 65536).fill(0);
+    }
+  };
+}
+
+function bindNativeRs256(moduleExports) {
+  const memory = moduleExports && moduleExports.memory;
+  if (!(memory instanceof WebAssembly.Memory) || memory.buffer.byteLength !== 2097152
+    || typeof moduleExports.pulse_crypto_rs256_sign !== 'function' || typeof moduleExports.pulse_crypto_rs256_verify !== 'function') {
+    throw new TypeError('Native RS256 exports are unavailable.');
+  }
+  const invalidKey = () => Object.assign(new TypeError('Invalid RSA signing key.'), { code: 'PULSE_CRYPTO_KEY_INVALID' });
+  function run(key, data, signature) {
+    const signing = signature === undefined;
+    if (!(key instanceof Uint8Array) || key.length < 8) throw invalidKey();
+    const k = new DataView(key.buffer, key.byteOffset, 4).getUint32(0, true);
+    if (![256, 384, 512].includes(k) || key.length !== (signing ? 8 + k * 9 / 2 : 8 + k)) throw invalidKey();
+    if (!(data instanceof Uint8Array) || data.length > 12288
+      || !signing && (!(signature instanceof Uint8Array) || signature.length !== k)) throw new TypeError('Invalid RS256 byte request.');
+    const pointer = 524288, capacity = 16640, output = (64 + key.length + 15) & ~15, input = output + k;
+    const frame = new Uint8Array(memory.buffer, pointer, capacity);
+    frame.fill(0);
+    try {
+      const header = new DataView(memory.buffer, pointer, 64);
+      for (const [offset, value] of [[0, 0x32534550], [4, 2], [8, 64], [12, (input + data.length + 15) & ~15],
+        [16, 2], [24, input], [28, data.length], [32, 64], [36, key.length], [40, output], [44, k]]) header.setUint32(offset, value, true);
+      frame.set(key, 64); frame.set(data, input);
+      if (!signing) frame.set(signature, output);
+      const status = moduleExports[signing ? 'pulse_crypto_rs256_sign' : 'pulse_crypto_rs256_verify'](pointer, capacity);
+      if (!signing) return Object.freeze({ status: ({ 1: 'valid', 0: 'invalid-authenticator', '-1': 'invalid-key', '-2': 'invalid-input' })[status] || 'realization-failure' });
+      if (status === -1) throw invalidKey();
+      if (status !== 1) throw new TypeError('Native RS256 signing failed.');
+      return frame.slice(output, output + k);
+    } finally { frame.fill(0); new Uint8Array(memory.buffer, 0, 65536).fill(0); }
+  }
+  return Object.freeze({ sign: (key, data) => run(key, data), verify: (key, data, signature) => run(key, data, signature) });
+}
+
 module.exports = Object.freeze({
+  bindNativeEs256Signer,
+  bindNativeRs256,
   CRYPTO_GUEST_SOURCE_CONTRACT_VERSION,
   GUEST_UNIT_CONTRIBUTION_VERSION,
   pulseHmacAssemblyScriptSource,