@reallyme/crypto 0.1.8 → 0.2.0

package/dist/cryptoFacade.js

@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import { ReallyMeAead } from "./aead.js";
 import { ReallyMeAesKw } from "./aesKw.js";
-import { ReallyMeArgon2id } from "./argon2id.js";
+import { ARGON2ID_DERIVED_KEY_LENGTH, ReallyMeArgon2id } from "./argon2id.js";
 import { ReallyMeBip340Schnorr } from "./bip340Schnorr.js";
 import { ReallyMeDigest } from "./digest.js";
 import { ReallyMeEd25519 } from "./ed25519.js";
@@ -24,6 +24,7 @@ import { ReallyMePbkdf2 } from "./pbkdf2.js";
 import { ReallyMeRsa } from "./rsa.js";
 import { ReallyMeSecp256k1 } from "./secp256k1.js";
 import { ReallyMeSlhDsa } from "./slhDsa.js";
+import { requireReallyMeWasmProvider } from "./wasmProvider.js";
 import { ReallyMeX25519 } from "./x25519.js";
 import { ReallyMeXWing } from "./xWing.js";
 const SECP256K1_ECDSA = "ECDSA-secp256k1-SHA256";
@@ -37,7 +38,7 @@ const ED25519 = "Ed25519";
  * callers that want direct provider access; this facade gives consumers a
  * stable typed route that fails closed for not-yet-exposed algorithms.
  */
-export const ReallyMeCrypto = {
+const createReallyMeCryptoFacade = (resolveWasmProvider) => ({
     hash(algorithm, bytes) {
         switch (algorithm) {
             case "SHA2-256":
@@ -66,7 +67,7 @@ export const ReallyMeCrypto = {
             case "AES-256-GCM-SIV":
             case "ChaCha20-Poly1305":
             case "XChaCha20-Poly1305":
-                return ReallyMeAead.seal(algorithm, key, nonce, aad, plaintext);
+                return ReallyMeAead.sealWithProvider(resolveWasmProvider(), algorithm, key, nonce, aad, plaintext);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -79,7 +80,7 @@ export const ReallyMeCrypto = {
             case "AES-256-GCM-SIV":
             case "ChaCha20-Poly1305":
             case "XChaCha20-Poly1305":
-                return ReallyMeAead.open(algorithm, key, nonce, aad, ciphertextWithTag);
+                return ReallyMeAead.openWithProvider(resolveWasmProvider(), algorithm, key, nonce, aad, ciphertextWithTag);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -104,10 +105,21 @@ export const ReallyMeCrypto = {
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
     },
+    deriveArgon2id(kdfVersion, secret, salt) {
+        return ReallyMeArgon2id.deriveKeyWithProvider(resolveWasmProvider(), kdfVersion, secret, salt);
+    },
     deriveKey(algorithm, password, salt, iterations, outputLength) {
         switch (algorithm) {
             case "Argon2id":
-                return ReallyMeArgon2id.deriveKey(iterations, password, salt);
+                if (outputLength !== ARGON2ID_DERIVED_KEY_LENGTH) {
+                    throw new ReallyMeCryptoError("invalid-input");
+                }
+                // Argon2id is governed by fixed ReallyMe profile versions, not by
+                // caller-selected iteration counts. This legacy generic KDF shape
+                // preserves the existing facade contract; new code should call
+                // deriveArgon2id(kdfVersion, secret, salt) so the profile selector is
+                // explicit at the API boundary.
+                return ReallyMeArgon2id.deriveKeyWithProvider(resolveWasmProvider(), iterations, password, salt);
             case "PBKDF2-HMAC-SHA-256":
                 return ReallyMePbkdf2.deriveHmacSha256(password, salt, iterations, outputLength);
             case "PBKDF2-HMAC-SHA-512":
@@ -147,7 +159,7 @@ export const ReallyMeCrypto = {
     wrapKey(algorithm, wrappingKey, keyToWrap) {
         switch (algorithm) {
             case "AES-256-KW":
-                return ReallyMeAesKw.wrapKey(wrappingKey, keyToWrap);
+                return ReallyMeAesKw.wrapKeyWithProvider(resolveWasmProvider(), wrappingKey, keyToWrap);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -155,7 +167,7 @@ export const ReallyMeCrypto = {
     unwrapKey(algorithm, wrappingKey, wrappedKey) {
         switch (algorithm) {
             case "AES-256-KW":
-                return ReallyMeAesKw.unwrapKey(wrappingKey, wrappedKey);
+                return ReallyMeAesKw.unwrapKeyWithProvider(resolveWasmProvider(), wrappingKey, wrappedKey);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -178,9 +190,9 @@ export const ReallyMeCrypto = {
             case "ML-DSA-44":
             case "ML-DSA-65":
             case "ML-DSA-87":
-                return ReallyMeMlDsa.generateKeyPair(algorithm);
+                return ReallyMeMlDsa.generateKeyPairWithProvider(resolveWasmProvider(), algorithm);
             case "SLH-DSA-SHA2-128s":
-                return ReallyMeSlhDsa.generateKeyPair(algorithm);
+                return ReallyMeSlhDsa.generateKeyPairWithProvider(resolveWasmProvider(), algorithm);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -206,7 +218,7 @@ export const ReallyMeCrypto = {
             case "ML-DSA-44":
             case "ML-DSA-65":
             case "ML-DSA-87":
-                return ReallyMeMlDsa.deriveKeyPair(algorithm, secretKey);
+                return ReallyMeMlDsa.deriveKeyPairWithProvider(resolveWasmProvider(), algorithm, secretKey);
             case "SLH-DSA-SHA2-128s":
                 // SLH-DSA deterministic derivation uses three FIPS seed components,
                 // so it deliberately does not fit this single-secret import shape.
@@ -231,9 +243,9 @@ export const ReallyMeCrypto = {
             case "ML-DSA-44":
             case "ML-DSA-65":
             case "ML-DSA-87":
-                return ReallyMeMlDsa.sign(algorithm, message, secretKey);
+                return ReallyMeMlDsa.signWithProvider(resolveWasmProvider(), algorithm, message, secretKey);
             case "SLH-DSA-SHA2-128s":
-                return ReallyMeSlhDsa.sign(algorithm, message, secretKey);
+                return ReallyMeSlhDsa.signWithProvider(resolveWasmProvider(), algorithm, message, secretKey);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -265,17 +277,30 @@ export const ReallyMeCrypto = {
             case "ML-DSA-44":
             case "ML-DSA-65":
             case "ML-DSA-87":
-                ReallyMeMlDsa.verify(algorithm, signature, message, publicKey);
+                ReallyMeMlDsa.verifyWithProvider(resolveWasmProvider(), algorithm, signature, message, publicKey);
                 return;
             case "SLH-DSA-SHA2-128s":
-                ReallyMeSlhDsa.verify(algorithm, signature, message, publicKey);
+                ReallyMeSlhDsa.verifyWithProvider(resolveWasmProvider(), algorithm, signature, message, publicKey);
                 return;
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
     },
     verifyRsa(algorithm, signature, message, publicKeyDer, publicKeyEncoding) {
-        ReallyMeRsa.verify(algorithm, signature, message, publicKeyDer, publicKeyEncoding);
+        switch (algorithm) {
+            case "RSA-PKCS1v15-SHA1":
+            case "RSA-PKCS1v15-SHA256":
+            case "RSA-PKCS1v15-SHA384":
+            case "RSA-PKCS1v15-SHA512":
+            case "RSA-PSS-SHA1-MGF1-SHA1":
+            case "RSA-PSS-SHA256-MGF1-SHA256":
+            case "RSA-PSS-SHA384-MGF1-SHA384":
+            case "RSA-PSS-SHA512-MGF1-SHA512":
+                ReallyMeRsa.verifyWithProvider(resolveWasmProvider(), algorithm, signature, message, publicKeyDer, publicKeyEncoding);
+                return;
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
     },
     deriveSharedSecret(algorithm, publicKey, secretKey) {
         switch (algorithm) {
@@ -309,11 +334,24 @@ export const ReallyMeCrypto = {
         switch (algorithm) {
             case "X-Wing-768":
             case "X-Wing-1024":
-                return ReallyMeXWing.generateKeyPair(algorithm);
+                return ReallyMeXWing.generateKeyPairWithProvider(resolveWasmProvider(), algorithm);
             case "ML-KEM-512":
             case "ML-KEM-768":
             case "ML-KEM-1024":
-                return ReallyMeMlKem.generateKeyPair(algorithm);
+                return ReallyMeMlKem.generateKeyPairWithProvider(resolveWasmProvider(), algorithm);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    deriveKemKeyPair(algorithm, secretKey) {
+        switch (algorithm) {
+            case "X-Wing-768":
+            case "X-Wing-1024":
+                return ReallyMeXWing.deriveKeyPairWithProvider(resolveWasmProvider(), algorithm, secretKey);
+            case "ML-KEM-512":
+            case "ML-KEM-768":
+            case "ML-KEM-1024":
+                return ReallyMeMlKem.deriveKeyPairWithProvider(resolveWasmProvider(), algorithm, secretKey);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -322,11 +360,11 @@ export const ReallyMeCrypto = {
         switch (algorithm) {
             case "X-Wing-768":
             case "X-Wing-1024":
-                return ReallyMeXWing.encapsulate(algorithm, publicKey);
+                return ReallyMeXWing.encapsulateWithProvider(resolveWasmProvider(), algorithm, publicKey);
             case "ML-KEM-512":
             case "ML-KEM-768":
             case "ML-KEM-1024":
-                return ReallyMeMlKem.encapsulate(algorithm, publicKey);
+                return ReallyMeMlKem.encapsulateWithProvider(resolveWasmProvider(), algorithm, publicKey);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -335,11 +373,11 @@ export const ReallyMeCrypto = {
         switch (algorithm) {
             case "X-Wing-768":
             case "X-Wing-1024":
-                return ReallyMeXWing.decapsulate(algorithm, ciphertext, secretKey);
+                return ReallyMeXWing.decapsulateWithProvider(resolveWasmProvider(), algorithm, ciphertext, secretKey);
             case "ML-KEM-512":
             case "ML-KEM-768":
             case "ML-KEM-1024":
-                return ReallyMeMlKem.decapsulate(algorithm, ciphertext, secretKey);
+                return ReallyMeMlKem.decapsulateWithProvider(resolveWasmProvider(), algorithm, ciphertext, secretKey);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -348,7 +386,7 @@ export const ReallyMeCrypto = {
         switch (suite) {
             case "DHKEM-P256-HKDF-SHA256-HKDF-SHA256-AES-256-GCM":
             case "DHKEM-X25519-HKDF-SHA256-HKDF-SHA256-CHACHA20-POLY1305":
-                return ReallyMeHpke.sealBase(suite, recipientPublicKey, info, aad, plaintext);
+                return ReallyMeHpke.sealBaseWithProvider(resolveWasmProvider(), suite, recipientPublicKey, info, aad, plaintext);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -357,9 +395,19 @@ export const ReallyMeCrypto = {
         switch (suite) {
             case "DHKEM-P256-HKDF-SHA256-HKDF-SHA256-AES-256-GCM":
             case "DHKEM-X25519-HKDF-SHA256-HKDF-SHA256-CHACHA20-POLY1305":
-                return ReallyMeHpke.openBase(suite, recipientSecretKey, encapsulatedKey, info, aad, ciphertext);
+                return ReallyMeHpke.openBaseWithProvider(resolveWasmProvider(), suite, recipientSecretKey, encapsulatedKey, info, aad, ciphertext);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
     },
+});
+export const createReallyMeCrypto = (providers = {}) => {
+    const configuredProvider = providers.wasmProvider;
+    return createReallyMeCryptoFacade(() => {
+        if (configuredProvider === undefined) {
+            throw new ReallyMeCryptoError("provider-failure");
+        }
+        return configuredProvider;
+    });
 };
+export const ReallyMeCrypto = createReallyMeCryptoFacade(requireReallyMeWasmProvider);

package/dist/errors.d.ts

@@ -3,7 +3,7 @@
  * user-provided bytes so callers can log them without leaking key material
  * or PII.
  */
-export type ReallyMeCryptoErrorCode = "invalid-input" | "invalid-signature" | "provider-failure" | "unsupported-algorithm";
+export type ReallyMeCryptoErrorCode = "invalid-input" | "invalid-signature" | "authentication-failed" | "provider-failure" | "unsupported-algorithm";
 export declare class ReallyMeCryptoError extends Error {
     readonly code: ReallyMeCryptoErrorCode;
     constructor(code: ReallyMeCryptoErrorCode);

package/dist/hpke.d.ts

@@ -1,4 +1,5 @@
 import type { ReallyMeHpkeSuite } from "./algorithms.js";
+import type { ReallyMeWasmProvider } from "./wasmProvider.js";
 export declare const HPKE_P256_PRIVATE_KEY_LENGTH = 32;
 export declare const HPKE_P256_PUBLIC_KEY_LENGTH = 65;
 export declare const HPKE_X25519_PRIVATE_KEY_LENGTH = 32;
@@ -10,6 +11,9 @@ export type ReallyMeHpkeSealedMessage = Readonly<{
 }>;
 export declare const ReallyMeHpke: {
     readonly sealBase: (suite: ReallyMeHpkeSuite, recipientPublicKey: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array) => ReallyMeHpkeSealedMessage;
+    readonly sealBaseWithProvider: (provider: ReallyMeWasmProvider, suite: ReallyMeHpkeSuite, recipientPublicKey: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array) => ReallyMeHpkeSealedMessage;
     readonly openBase: (suite: ReallyMeHpkeSuite, recipientSecretKey: Uint8Array, encapsulatedKey: Uint8Array, info: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array) => Uint8Array;
+    readonly openBaseWithProvider: (provider: ReallyMeWasmProvider, suite: ReallyMeHpkeSuite, recipientSecretKey: Uint8Array, encapsulatedKey: Uint8Array, info: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array) => Uint8Array;
 };
 export declare const sealHpkeBaseDeterministicallyForTest: (suite: ReallyMeHpkeSuite, recipientPublicKey: Uint8Array, encapsulationRandomness: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array) => ReallyMeHpkeSealedMessage;
+export declare const sealHpkeBaseDeterministicallyWithProviderForTest: (provider: ReallyMeWasmProvider, suite: ReallyMeHpkeSuite, recipientPublicKey: Uint8Array, encapsulationRandomness: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array) => ReallyMeHpkeSealedMessage;

package/dist/hpke.js

@@ -41,6 +41,11 @@ export const ReallyMeHpke = {
         ensureBytes(recipientPublicKey, config.publicKeyLength);
         return readSealedMessage(requireReallyMeWasmProvider().hpkeSealBase(config.id, recipientPublicKey, info, aad, plaintext), config, plaintext.length);
     },
+    sealBaseWithProvider(provider, suite, recipientPublicKey, info, aad, plaintext) {
+        const config = hpkeSuite(suite);
+        ensureBytes(recipientPublicKey, config.publicKeyLength);
+        return readSealedMessage(provider.hpkeSealBase(config.id, recipientPublicKey, info, aad, plaintext), config, plaintext.length);
+    },
     openBase(suite, recipientSecretKey, encapsulatedKey, info, aad, ciphertext) {
         const config = hpkeSuite(suite);
         ensureBytes(recipientSecretKey, config.privateKeyLength);
@@ -50,6 +55,15 @@ export const ReallyMeHpke = {
         }
         return requirePlaintext(requireReallyMeWasmProvider().hpkeOpenBase(config.id, recipientSecretKey, encapsulatedKey, info, aad, ciphertext));
     },
+    openBaseWithProvider(provider, suite, recipientSecretKey, encapsulatedKey, info, aad, ciphertext) {
+        const config = hpkeSuite(suite);
+        ensureBytes(recipientSecretKey, config.privateKeyLength);
+        ensureBytes(encapsulatedKey, config.publicKeyLength);
+        if (ciphertext.length < HPKE_AEAD_TAG_LENGTH) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        return requirePlaintext(provider.hpkeOpenBase(config.id, recipientSecretKey, encapsulatedKey, info, aad, ciphertext));
+    },
 };
 export const sealHpkeBaseDeterministicallyForTest = (suite, recipientPublicKey, encapsulationRandomness, info, aad, plaintext) => {
     const config = hpkeSuite(suite);
@@ -57,3 +71,9 @@ export const sealHpkeBaseDeterministicallyForTest = (suite, recipientPublicKey,
     ensureBytes(encapsulationRandomness, config.privateKeyLength);
     return readSealedMessage(requireReallyMeWasmProvider().hpkeSealBaseDerand(config.id, recipientPublicKey, encapsulationRandomness, info, aad, plaintext), config, plaintext.length);
 };
+export const sealHpkeBaseDeterministicallyWithProviderForTest = (provider, suite, recipientPublicKey, encapsulationRandomness, info, aad, plaintext) => {
+    const config = hpkeSuite(suite);
+    ensureBytes(recipientPublicKey, config.publicKeyLength);
+    ensureBytes(encapsulationRandomness, config.privateKeyLength);
+    return readSealedMessage(provider.hpkeSealBaseDerand(config.id, recipientPublicKey, encapsulationRandomness, info, aad, plaintext), config, plaintext.length);
+};

package/dist/index.d.ts

@@ -2,14 +2,12 @@ export { ReallyMeCryptoError } from "./errors.js";
 export type { ReallyMeCryptoErrorCode } from "./errors.js";
 export { REALLYME_AEAD_ALGORITHMS, REALLYME_HASH_ALGORITHMS, REALLYME_HPKE_SUITES, REALLYME_KDF_ALGORITHMS, REALLYME_KEM_ALGORITHMS, REALLYME_KEY_AGREEMENT_ALGORITHMS, REALLYME_KEY_WRAP_ALGORITHMS, REALLYME_MAC_ALGORITHMS, REALLYME_SIGNATURE_ALGORITHMS, } from "./algorithms.js";
 export type { ReallyMeAeadAlgorithm, ReallyMeHashAlgorithm, ReallyMeHpkeSuite, ReallyMeKdfAlgorithm, ReallyMeKemAlgorithm, ReallyMeKeyAgreementAlgorithm, ReallyMeKeyWrapAlgorithm, ReallyMeMacAlgorithm, ReallyMeSignatureAlgorithm, } from "./algorithms.js";
-export { AEAD_KEY_LENGTH, AEAD_NONCE_LENGTH, AEAD_TAG_LENGTH, AES_128_GCM_KEY_LENGTH, AES_192_GCM_KEY_LENGTH, AES_256_GCM_KEY_LENGTH, ReallyMeAead, XCHACHA20_POLY1305_NONCE_LENGTH, } from "./aead.js";
+export { AEAD_KEY_LENGTH, AEAD_NONCE_LENGTH, AEAD_TAG_LENGTH, AES_128_GCM_KEY_LENGTH, AES_192_GCM_KEY_LENGTH, AES_256_GCM_KEY_LENGTH, CHACHA20_POLY1305_KEY_LENGTH, ReallyMeAead, XCHACHA20_POLY1305_NONCE_LENGTH, } from "./aead.js";
 export { AES_256_KW_KEK_LENGTH, AES_KW_BLOCK_LENGTH, AES_KW_INTEGRITY_CHECK_LENGTH, AES_KW_MAX_KEY_DATA_LENGTH, AES_KW_MIN_KEY_DATA_LENGTH, AES_KW_MIN_WRAPPED_KEY_LENGTH, ReallyMeAesKw, } from "./aesKw.js";
 export { ARGON2ID_DERIVED_KEY_LENGTH, ARGON2ID_SALT_MAX_LENGTH, ARGON2ID_SALT_MIN_LENGTH, ARGON2ID_V1, ARGON2ID_V2, ReallyMeArgon2id, } from "./argon2id.js";
 export { BIP340_SCHNORR_AUX_RAND_LENGTH, BIP340_SCHNORR_MESSAGE_LENGTH, BIP340_SCHNORR_PUBLIC_KEY_LENGTH, BIP340_SCHNORR_SECRET_KEY_LENGTH, BIP340_SCHNORR_SIGNATURE_LENGTH, ReallyMeBip340Schnorr, } from "./bip340Schnorr.js";
 export { HPKE_AEAD_TAG_LENGTH, HPKE_P256_PRIVATE_KEY_LENGTH, HPKE_P256_PUBLIC_KEY_LENGTH, HPKE_X25519_PRIVATE_KEY_LENGTH, HPKE_X25519_PUBLIC_KEY_LENGTH, ReallyMeHpke, } from "./hpke.js";
 export type { ReallyMeHpkeSealedMessage as ReallyMeHpkeProviderSealedMessage } from "./hpke.js";
-export { ReallyMeCodecs } from "./codecs.js";
-export type { ReallyMeDagCborCidVerification, ReallyMeKeyMaterialKind, ReallyMeMulticodecMetadata, ReallyMeMulticodecTag, ReallyMeParsedMultikey, } from "./codecs.js";
 export { ReallyMeJwk } from "./jwk.js";
 export type { ReallyMeAkpJwk, ReallyMeEcJwk, ReallyMeJwk as ReallyMeJsonWebKey, ReallyMeJwkAlgorithm, ReallyMeJwkKey, ReallyMeJwks, ReallyMeJwksKeySet, ReallyMeOkpJwk, } from "./jwk.js";
 export { ML_KEM_1024_CIPHERTEXT_LENGTH, ML_KEM_1024_PUBLIC_KEY_LENGTH, ML_KEM_512_CIPHERTEXT_LENGTH, ML_KEM_512_PUBLIC_KEY_LENGTH, ML_KEM_768_CIPHERTEXT_LENGTH, ML_KEM_768_PUBLIC_KEY_LENGTH, ML_KEM_ENCAPSULATION_RANDOMNESS_LENGTH, ML_KEM_SECRET_KEY_LENGTH, ML_KEM_SHARED_SECRET_LENGTH, ReallyMeMlKem, } from "./mlKem.js";
@@ -20,12 +18,13 @@ export { ReallyMeSlhDsa, SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH, SLH_DSA_SHA2_128S
 export type { ReallyMeSlhDsaKeyPair } from "./slhDsa.js";
 export { compiledProviders, REALLYME_CRYPTO_PROVIDERS } from "./providerCatalog.js";
 export type { ReallyMeCryptoProvider } from "./providerCatalog.js";
-export { ReallyMeCrypto } from "./cryptoFacade.js";
-export type { ReallyMeHpkeSealedMessage, ReallyMeKeyAgreementKeyPair, ReallyMeKemEncapsulation, ReallyMeKemKeyPair, ReallyMeSignatureKeyPair, } from "./cryptoFacade.js";
+export { createReallyMeCrypto, ReallyMeCrypto } from "./cryptoFacade.js";
+export type { ReallyMeCryptoFacade, ReallyMeCryptoProviders, ReallyMeHpkeSealedMessage, ReallyMeKeyAgreementKeyPair, ReallyMeKemEncapsulation, ReallyMeKemKeyPair, ReallyMeSignatureKeyPair, } from "./cryptoFacade.js";
 export { ReallyMeDigest } from "./digest.js";
 export { ED25519_PUBLIC_KEY_LENGTH, ED25519_SECRET_KEY_LENGTH, ED25519_SIGNATURE_LENGTH, ReallyMeEd25519, } from "./ed25519.js";
 export { HKDF_MAX_INPUT_LENGTH, HKDF_MAX_OUTPUT_LENGTH, HKDF_MIN_INPUT_KEY_MATERIAL_LENGTH, HKDF_MIN_OUTPUT_LENGTH, ReallyMeHkdf, } from "./hkdf.js";
 export { JWA_CONCAT_KDF_MAX_INFO_LENGTH, JWA_CONCAT_KDF_MAX_OUTPUT_LENGTH, JWA_CONCAT_KDF_MAX_SHARED_SECRET_LENGTH, JWA_CONCAT_KDF_MIN_OUTPUT_LENGTH, JWA_CONCAT_KDF_SHA256_DIGEST_LENGTH, ReallyMeJwaConcatKdf, } from "./jwaConcatKdf.js";
+export { bestEffortClear } from "./memory.js";
 export { HMAC_MAX_KEY_LENGTH, HMAC_SHA256_TAG_LENGTH, HMAC_SHA512_TAG_LENGTH, ReallyMeHmac, } from "./hmac.js";
 export { P256_ECDH_COMPRESSED_PUBLIC_KEY_LENGTH, P256_ECDH_SECRET_KEY_LENGTH, P256_ECDH_SHARED_SECRET_LENGTH, ReallyMeP256Ecdh, } from "./p256Ecdh.js";
 export { P256_ECDSA_COMPACT_SIGNATURE_LENGTH, P256_ECDSA_COMPRESSED_PUBLIC_KEY_LENGTH, P256_ECDSA_DER_SIGNATURE_MAX_LENGTH, P256_ECDSA_SECRET_KEY_LENGTH, ReallyMeP256Ecdsa, } from "./p256Ecdsa.js";
@@ -38,7 +37,7 @@ export { ReallyMeSecp256k1, SECP256K1_COMPRESSED_PUBLIC_KEY_LENGTH, SECP256K1_SE
 export { ReallyMeRsa, RSA_PUBLIC_KEY_DER_MAX_LENGTH, RSA_SIGNATURE_MAX_LENGTH, } from "./rsa.js";
 export type { ReallyMeRsaPublicKeyDerEncoding } from "./rsa.js";
 export { ReallyMeX25519, X25519_PUBLIC_KEY_LENGTH, X25519_SECRET_KEY_LENGTH, X25519_SHARED_SECRET_LENGTH, } from "./x25519.js";
-export { installReallyMeWasmProvider } from "./wasmProvider.js";
+export { createReallyMeWasmProvider, installReallyMeWasmProvider } from "./wasmProvider.js";
 export type { ReallyMeWasmProvider } from "./wasmProvider.js";
 export { ReallyMeXWing, X_WING_1024_CIPHERTEXT_LENGTH, X_WING_1024_PUBLIC_KEY_LENGTH, X_WING_768_CIPHERTEXT_LENGTH, X_WING_768_PUBLIC_KEY_LENGTH, X_WING_ENCAPSULATION_SEED_LENGTH, X_WING_SECRET_KEY_LENGTH, X_WING_SHARED_SECRET_LENGTH, } from "./xWing.js";
 export type { ReallyMeXWingEncapsulation, ReallyMeXWingKeyPair } from "./xWing.js";

package/dist/index.js

@@ -3,22 +3,22 @@
 // SPDX-License-Identifier: Apache-2.0
 export { ReallyMeCryptoError } from "./errors.js";
 export { REALLYME_AEAD_ALGORITHMS, REALLYME_HASH_ALGORITHMS, REALLYME_HPKE_SUITES, REALLYME_KDF_ALGORITHMS, REALLYME_KEM_ALGORITHMS, REALLYME_KEY_AGREEMENT_ALGORITHMS, REALLYME_KEY_WRAP_ALGORITHMS, REALLYME_MAC_ALGORITHMS, REALLYME_SIGNATURE_ALGORITHMS, } from "./algorithms.js";
-export { AEAD_KEY_LENGTH, AEAD_NONCE_LENGTH, AEAD_TAG_LENGTH, AES_128_GCM_KEY_LENGTH, AES_192_GCM_KEY_LENGTH, AES_256_GCM_KEY_LENGTH, ReallyMeAead, XCHACHA20_POLY1305_NONCE_LENGTH, } from "./aead.js";
+export { AEAD_KEY_LENGTH, AEAD_NONCE_LENGTH, AEAD_TAG_LENGTH, AES_128_GCM_KEY_LENGTH, AES_192_GCM_KEY_LENGTH, AES_256_GCM_KEY_LENGTH, CHACHA20_POLY1305_KEY_LENGTH, ReallyMeAead, XCHACHA20_POLY1305_NONCE_LENGTH, } from "./aead.js";
 export { AES_256_KW_KEK_LENGTH, AES_KW_BLOCK_LENGTH, AES_KW_INTEGRITY_CHECK_LENGTH, AES_KW_MAX_KEY_DATA_LENGTH, AES_KW_MIN_KEY_DATA_LENGTH, AES_KW_MIN_WRAPPED_KEY_LENGTH, ReallyMeAesKw, } from "./aesKw.js";
 export { ARGON2ID_DERIVED_KEY_LENGTH, ARGON2ID_SALT_MAX_LENGTH, ARGON2ID_SALT_MIN_LENGTH, ARGON2ID_V1, ARGON2ID_V2, ReallyMeArgon2id, } from "./argon2id.js";
 export { BIP340_SCHNORR_AUX_RAND_LENGTH, BIP340_SCHNORR_MESSAGE_LENGTH, BIP340_SCHNORR_PUBLIC_KEY_LENGTH, BIP340_SCHNORR_SECRET_KEY_LENGTH, BIP340_SCHNORR_SIGNATURE_LENGTH, ReallyMeBip340Schnorr, } from "./bip340Schnorr.js";
 export { HPKE_AEAD_TAG_LENGTH, HPKE_P256_PRIVATE_KEY_LENGTH, HPKE_P256_PUBLIC_KEY_LENGTH, HPKE_X25519_PRIVATE_KEY_LENGTH, HPKE_X25519_PUBLIC_KEY_LENGTH, ReallyMeHpke, } from "./hpke.js";
-export { ReallyMeCodecs } from "./codecs.js";
 export { ReallyMeJwk } from "./jwk.js";
 export { ML_KEM_1024_CIPHERTEXT_LENGTH, ML_KEM_1024_PUBLIC_KEY_LENGTH, ML_KEM_512_CIPHERTEXT_LENGTH, ML_KEM_512_PUBLIC_KEY_LENGTH, ML_KEM_768_CIPHERTEXT_LENGTH, ML_KEM_768_PUBLIC_KEY_LENGTH, ML_KEM_ENCAPSULATION_RANDOMNESS_LENGTH, ML_KEM_SECRET_KEY_LENGTH, ML_KEM_SHARED_SECRET_LENGTH, ReallyMeMlKem, } from "./mlKem.js";
 export { ML_DSA_44_PUBLIC_KEY_LENGTH, ML_DSA_44_SIGNATURE_LENGTH, ML_DSA_65_PUBLIC_KEY_LENGTH, ML_DSA_65_SIGNATURE_LENGTH, ML_DSA_87_PUBLIC_KEY_LENGTH, ML_DSA_87_SIGNATURE_LENGTH, ML_DSA_SECRET_KEY_LENGTH, ReallyMeMlDsa, } from "./mlDsa.js";
 export { ReallyMeSlhDsa, SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH, SLH_DSA_SHA2_128S_PUBLIC_KEY_LENGTH, SLH_DSA_SHA2_128S_SECRET_KEY_LENGTH, SLH_DSA_SHA2_128S_SIGNATURE_LENGTH, } from "./slhDsa.js";
 export { compiledProviders, REALLYME_CRYPTO_PROVIDERS } from "./providerCatalog.js";
-export { ReallyMeCrypto } from "./cryptoFacade.js";
+export { createReallyMeCrypto, ReallyMeCrypto } from "./cryptoFacade.js";
 export { ReallyMeDigest } from "./digest.js";
 export { ED25519_PUBLIC_KEY_LENGTH, ED25519_SECRET_KEY_LENGTH, ED25519_SIGNATURE_LENGTH, ReallyMeEd25519, } from "./ed25519.js";
 export { HKDF_MAX_INPUT_LENGTH, HKDF_MAX_OUTPUT_LENGTH, HKDF_MIN_INPUT_KEY_MATERIAL_LENGTH, HKDF_MIN_OUTPUT_LENGTH, ReallyMeHkdf, } from "./hkdf.js";
 export { JWA_CONCAT_KDF_MAX_INFO_LENGTH, JWA_CONCAT_KDF_MAX_OUTPUT_LENGTH, JWA_CONCAT_KDF_MAX_SHARED_SECRET_LENGTH, JWA_CONCAT_KDF_MIN_OUTPUT_LENGTH, JWA_CONCAT_KDF_SHA256_DIGEST_LENGTH, ReallyMeJwaConcatKdf, } from "./jwaConcatKdf.js";
+export { bestEffortClear } from "./memory.js";
 export { HMAC_MAX_KEY_LENGTH, HMAC_SHA256_TAG_LENGTH, HMAC_SHA512_TAG_LENGTH, ReallyMeHmac, } from "./hmac.js";
 export { P256_ECDH_COMPRESSED_PUBLIC_KEY_LENGTH, P256_ECDH_SECRET_KEY_LENGTH, P256_ECDH_SHARED_SECRET_LENGTH, ReallyMeP256Ecdh, } from "./p256Ecdh.js";
 export { P256_ECDSA_COMPACT_SIGNATURE_LENGTH, P256_ECDSA_COMPRESSED_PUBLIC_KEY_LENGTH, P256_ECDSA_DER_SIGNATURE_MAX_LENGTH, P256_ECDSA_SECRET_KEY_LENGTH, ReallyMeP256Ecdsa, } from "./p256Ecdsa.js";
@@ -30,5 +30,5 @@ export { PBKDF2_MAX_INPUT_LENGTH, PBKDF2_MAX_OUTPUT_LENGTH, PBKDF2_MIN_INPUT_LEN
 export { ReallyMeSecp256k1, SECP256K1_COMPRESSED_PUBLIC_KEY_LENGTH, SECP256K1_SECRET_KEY_LENGTH, SECP256K1_SIGNATURE_LENGTH, } from "./secp256k1.js";
 export { ReallyMeRsa, RSA_PUBLIC_KEY_DER_MAX_LENGTH, RSA_SIGNATURE_MAX_LENGTH, } from "./rsa.js";
 export { ReallyMeX25519, X25519_PUBLIC_KEY_LENGTH, X25519_SECRET_KEY_LENGTH, X25519_SHARED_SECRET_LENGTH, } from "./x25519.js";
-export { installReallyMeWasmProvider } from "./wasmProvider.js";
+export { createReallyMeWasmProvider, installReallyMeWasmProvider } from "./wasmProvider.js";
 export { ReallyMeXWing, X_WING_1024_CIPHERTEXT_LENGTH, X_WING_1024_PUBLIC_KEY_LENGTH, X_WING_768_CIPHERTEXT_LENGTH, X_WING_768_PUBLIC_KEY_LENGTH, X_WING_ENCAPSULATION_SEED_LENGTH, X_WING_SECRET_KEY_LENGTH, X_WING_SHARED_SECRET_LENGTH, } from "./xWing.js";

package/dist/jwaConcatKdf.js

@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import { sha256 } from "@noble/hashes/sha2.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { bestEffortClear } from "./memory.js";
 export const JWA_CONCAT_KDF_SHA256_DIGEST_LENGTH = 32;
 export const JWA_CONCAT_KDF_MAX_SHARED_SECRET_LENGTH = 4096;
 export const JWA_CONCAT_KDF_MAX_INFO_LENGTH = 4096;
@@ -17,13 +18,16 @@ export const ReallyMeJwaConcatKdf = {
         const derived = new Uint8Array(reps * JWA_CONCAT_KDF_SHA256_DIGEST_LENGTH);
         for (let counter = 1; counter <= reps; counter += 1) {
             const counterBytes = uint32be(counter);
-            const digest = sha256(concatBytes(counterBytes, sharedSecret, otherInfo));
+            const hashInput = concatBytes(counterBytes, sharedSecret, otherInfo);
+            const digest = sha256(hashInput);
             derived.set(digest, (counter - 1) * JWA_CONCAT_KDF_SHA256_DIGEST_LENGTH);
-            counterBytes.fill(0);
+            bestEffortClear(digest);
+            bestEffortClear(hashInput);
+            bestEffortClear(counterBytes);
         }
         const output = derived.slice(0, outputLength);
-        derived.fill(0);
-        otherInfo.fill(0);
+        bestEffortClear(derived);
+        bestEffortClear(otherInfo);
         return output;
     },
 };

package/dist/jwk.js

@@ -3,9 +3,8 @@
 // SPDX-License-Identifier: Apache-2.0
 import { p256 } from "@noble/curves/nist.js";
 import { secp256k1 } from "@noble/curves/secp256k1.js";
+import { base64urlDecode as codecBase64urlDecodeValue, base64urlEncode as codecBase64urlEncodeValue, canonicalizeJson as codecCanonicalizeJson, ReallyMeCodecError, } from "@reallyme/codec";
 import { ReallyMeCryptoError } from "./errors.js";
-const BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-const DECODE_TABLE = new Map([...BASE64URL_ALPHABET].map((char, index) => [char, index]));
 const jwkSpec = (algorithm) => {
     switch (algorithm) {
         case "Ed25519":
@@ -41,63 +40,6 @@ const ensureLength = (bytes, expectedLength) => {
         throw new ReallyMeCryptoError("invalid-input");
     }
 };
-const byteAt = (bytes, index) => {
-    const value = bytes[index];
-    if (value === undefined) {
-        throw new ReallyMeCryptoError("invalid-input");
-    }
-    return value;
-};
-const base64urlEncode = (bytes) => {
-    let encoded = "";
-    let index = 0;
-    while (index < bytes.length) {
-        const first = byteAt(bytes, index);
-        const second = index + 1 < bytes.length ? byteAt(bytes, index + 1) : 0;
-        const third = index + 2 < bytes.length ? byteAt(bytes, index + 2) : 0;
-        const triple = (first << 16) | (second << 8) | third;
-        encoded += BASE64URL_ALPHABET[(triple >> 18) & 0x3f];
-        encoded += BASE64URL_ALPHABET[(triple >> 12) & 0x3f];
-        if (index + 1 < bytes.length) {
-            encoded += BASE64URL_ALPHABET[(triple >> 6) & 0x3f];
-        }
-        if (index + 2 < bytes.length) {
-            encoded += BASE64URL_ALPHABET[triple & 0x3f];
-        }
-        index += 3;
-    }
-    return encoded;
-};
-const decodeChar = (char) => {
-    const value = DECODE_TABLE.get(char);
-    if (value === undefined) {
-        throw new ReallyMeCryptoError("invalid-input");
-    }
-    return value;
-};
-const base64urlDecode = (encoded) => {
-    if (encoded.length % 4 === 1) {
-        throw new ReallyMeCryptoError("invalid-input");
-    }
-    const outputLength = Math.floor((encoded.length * 6) / 8);
-    const output = new Uint8Array(outputLength);
-    let buffer = 0;
-    let bits = 0;
-    let offset = 0;
-    for (const char of encoded) {
-        buffer = (buffer << 6) | decodeChar(char);
-        bits += 6;
-        if (bits >= 8) {
-            bits -= 8;
-            output[offset] = (buffer >> bits) & 0xff;
-            offset += 1;
-        }
-    }
-    if (offset !== output.length) {
-        throw new ReallyMeCryptoError("invalid-input");
-    }
-    return output;
-};
 const readString = (value, name) => {
     if (typeof value !== "object" || value === null) {
         throw new ReallyMeCryptoError("invalid-input");
@@ -108,6 +50,29 @@ const readString = (value, name) => {
     }
     return property;
 };
+const privateJwkMemberNames = [
+    "d",
+    "p",
+    "q",
+    "dp",
+    "dq",
+    "qi",
+    "oth",
+    "k",
+    "priv",
+    "privateKey",
+    "secretKey",
+];
+const rejectPrivateKeyMaterial = (value) => {
+    if (typeof value !== "object" || value === null) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    for (const name of privateJwkMemberNames) {
+        if (Reflect.has(value, name)) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+    }
+};
 const optionalStringMatches = (value, name, expected) => {
     if (typeof value !== "object" || value === null) {
         throw new ReallyMeCryptoError("invalid-input");
@@ -172,14 +137,43 @@ const compressEc = (algorithm, x, y) => {
         throw new ReallyMeCryptoError("invalid-input");
     }
 };
+const mapCodecError = (error) => {
+    if (error instanceof ReallyMeCodecError && error.code === "provider-failure") {
+        return new ReallyMeCryptoError("provider-failure");
+    }
+    return new ReallyMeCryptoError("invalid-input");
+};
+const codecBase64urlEncode = (bytes) => {
+    try {
+        return codecBase64urlEncodeValue(bytes);
+    }
+    catch (error) {
+        throw mapCodecError(error);
+    }
+};
+const codecBase64urlDecode = (encoded) => {
+    try {
+        return codecBase64urlDecodeValue(encoded);
+    }
+    catch (error) {
+        throw mapCodecError(error);
+    }
+};
+const codecBase64urlDecodeCanonical = (encoded) => {
+    const bytes = codecBase64urlDecode(encoded);
+    if (codecBase64urlEncode(bytes) !== encoded) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    return bytes;
+};
 const toJcs = (jwk) => {
-    if (jwk.kty === "EC") {
-        return `{"alg":${JSON.stringify(jwk.alg)},"crv":${JSON.stringify(jwk.crv)},"kty":"EC","use":"sig","x":${JSON.stringify(jwk.x)},"y":${JSON.stringify(jwk.y)}}`;
+    const key = ReallyMeJwk.fromJwk(jwk);
+    try {
+        return codecCanonicalizeJson(key.jwk);
     }
-    if (jwk.kty === "AKP") {
-        return `{"alg":${JSON.stringify(jwk.alg)},"kty":"AKP","pub":${JSON.stringify(jwk.pub)},"use":${JSON.stringify(jwk.use)}}`;
+    catch (error) {
+        throw mapCodecError(error);
     }
-    return `{"alg":${JSON.stringify(jwk.alg)},"crv":${JSON.stringify(jwk.crv)},"kty":"OKP","use":${JSON.stringify(jwk.use)},"x":${JSON.stringify(jwk.x)}}`;
 };
 export const ReallyMeJwk = {
     toJwk(algorithm, publicKey) {
@@ -193,15 +187,15 @@ export const ReallyMeJwk = {
                 crv: ecAlgorithm,
                 kty: "EC",
                 use: "sig",
-                x: base64urlEncode(uncompressed.slice(1, 33)),
-                y: base64urlEncode(uncompressed.slice(33, 65)),
+                x: codecBase64urlEncode(uncompressed.slice(1, 33)),
+                y: codecBase64urlEncode(uncompressed.slice(33, 65)),
             };
         }
         if (spec.kty === "AKP") {
             return {
                 alg: spec.alg,
                 kty: "AKP",
-                pub: base64urlEncode(publicKey),
+                pub: codecBase64urlEncode(publicKey),
                 use: spec.use,
             };
         }
@@ -214,10 +208,11 @@ export const ReallyMeJwk = {
             crv,
             kty: "OKP",
             use: spec.use,
-            x: base64urlEncode(publicKey),
+            x: codecBase64urlEncode(publicKey),
         };
     },
     fromJwk(value) {
+        rejectPrivateKeyMaterial(value);
         const kty = readString(value, "kty");
         const spec = kty === "AKP"
             ? specFromAlgorithm(readString(value, "alg"))
@@ -229,8 +224,8 @@ export const ReallyMeJwk = {
         optionalStringMatches(value, "use", spec.use);
         if (spec.kty === "EC") {
             const ecAlgorithm = spec.crv === "P-256" ? "P-256" : "secp256k1";
-            const x = base64urlDecode(readString(value, "x"));
-            const y = base64urlDecode(readString(value, "y"));
+            const x = codecBase64urlDecodeCanonical(readString(value, "x"));
+            const y = codecBase64urlDecodeCanonical(readString(value, "y"));
             const publicKey = compressEc(ecAlgorithm, x, y);
             ensureLength(publicKey, spec.publicKeyLength);
             const jwk = ReallyMeJwk.toJwk(ecAlgorithm, publicKey);
@@ -241,14 +236,14 @@ export const ReallyMeJwk = {
             if (crv !== "Ed25519" && crv !== "X25519") {
                 throw new ReallyMeCryptoError("unsupported-algorithm");
             }
-            const publicKey = base64urlDecode(readString(value, "x"));
+            const publicKey = codecBase64urlDecodeCanonical(readString(value, "x"));
             ensureLength(publicKey, spec.publicKeyLength);
             const jwk = ReallyMeJwk.toJwk(crv, publicKey);
             return { algorithm: crv, publicKey, jwk };
         }
         const algorithm = readString(value, "alg");
         const akpSpec = specFromAlgorithm(algorithm);
-        const publicKey = base64urlDecode(readString(value, "pub"));
+        const publicKey = codecBase64urlDecodeCanonical(readString(value, "pub"));
         ensureLength(publicKey, akpSpec.publicKeyLength);
         switch (algorithm) {
             case "ML-DSA-44":

package/dist/memory.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Best-effort cleanup for caller-owned managed-runtime byte arrays.
+ *
+ * This overwrites the supplied `Uint8Array` view in place. It does not and
+ * cannot clear copies already made by JavaScript engines, WebAssembly
+ * marshalling, snapshots, browser developer tools, or native providers.
+ */
+export declare const bestEffortClear: (bytes: Uint8Array) => void;

package/dist/memory.js

@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Best-effort cleanup for caller-owned managed-runtime byte arrays.
+ *
+ * This overwrites the supplied `Uint8Array` view in place. It does not and
+ * cannot clear copies already made by JavaScript engines, WebAssembly
+ * marshalling, snapshots, browser developer tools, or native providers.
+ */
+export const bestEffortClear = (bytes) => {
+    bytes.fill(0);
+};