@reallyme/crypto 0.1.8 → 0.2.0

package/dist/rsa.d.ts

@@ -1,4 +1,5 @@
 import type { ReallyMeSignatureAlgorithm } from "./algorithms.js";
+import type { ReallyMeWasmProvider } from "./wasmProvider.js";
 export type ReallyMeRsaPublicKeyDerEncoding = "PKCS1" | "SPKI";
 export declare const RSA_PUBLIC_KEY_DER_MAX_LENGTH = 4096;
 export declare const RSA_SIGNATURE_MAX_LENGTH = 1024;
@@ -10,4 +11,5 @@ export declare const RSA_SIGNATURE_MAX_LENGTH = 1024;
  */
 export declare const ReallyMeRsa: {
     readonly verify: (algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKeyDer: Uint8Array, publicKeyEncoding: ReallyMeRsaPublicKeyDerEncoding) => void;
+    readonly verifyWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKeyDer: Uint8Array, publicKeyEncoding: ReallyMeRsaPublicKeyDerEncoding) => void;
 };

package/dist/rsa.js

@@ -75,6 +75,22 @@ const readVoid = (value) => {
         throw new ReallyMeCryptoError("provider-failure");
     }
 };
+const verifyWithProvider = (provider, algorithm, signature, message, publicKeyDer, publicKeyEncoding) => {
+    validateBytes(publicKeyDer, RSA_PUBLIC_KEY_DER_MAX_LENGTH);
+    validateBytes(signature, RSA_SIGNATURE_MAX_LENGTH);
+    const encoding = encodingId(publicKeyEncoding);
+    const pkcs1 = pkcs1v15Suite(algorithm);
+    if (pkcs1 !== undefined) {
+        readVoid(provider.rsaVerifyPkcs1v15(publicKeyDer, encoding, pkcs1.hashSuite, message, signature));
+        return;
+    }
+    const pss = pssSuite(algorithm);
+    if (pss !== undefined) {
+        readVoid(provider.rsaVerifyPss(publicKeyDer, encoding, pss.messageHashSuite, pss.mgf1HashSuite, pss.saltLength, message, signature));
+        return;
+    }
+    throw new ReallyMeCryptoError("unsupported-algorithm");
+};
 /**
  * RSA signature verification through the ReallyMe Rust WASM provider.
  *
@@ -83,20 +99,7 @@ const readVoid = (value) => {
  */
 export const ReallyMeRsa = {
     verify(algorithm, signature, message, publicKeyDer, publicKeyEncoding) {
-        validateBytes(publicKeyDer, RSA_PUBLIC_KEY_DER_MAX_LENGTH);
-        validateBytes(signature, RSA_SIGNATURE_MAX_LENGTH);
-        const encoding = encodingId(publicKeyEncoding);
-        const pkcs1 = pkcs1v15Suite(algorithm);
-        const provider = requireReallyMeWasmProvider();
-        if (pkcs1 !== undefined) {
-            readVoid(provider.rsaVerifyPkcs1v15(publicKeyDer, encoding, pkcs1.hashSuite, message, signature));
-            return;
-        }
-        const pss = pssSuite(algorithm);
-        if (pss !== undefined) {
-            readVoid(provider.rsaVerifyPss(publicKeyDer, encoding, pss.messageHashSuite, pss.mgf1HashSuite, pss.saltLength, message, signature));
-            return;
-        }
-        throw new ReallyMeCryptoError("unsupported-algorithm");
+        verifyWithProvider(requireReallyMeWasmProvider(), algorithm, signature, message, publicKeyDer, publicKeyEncoding);
     },
+    verifyWithProvider,
 };

package/dist/slhDsa.d.ts

@@ -1,4 +1,5 @@
 import type { ReallyMeSignatureAlgorithm } from "./algorithms.js";
+import type { ReallyMeWasmProvider } from "./wasmProvider.js";
 export declare const SLH_DSA_SHA2_128S_PUBLIC_KEY_LENGTH = 32;
 export declare const SLH_DSA_SHA2_128S_SECRET_KEY_LENGTH = 64;
 export declare const SLH_DSA_SHA2_128S_SIGNATURE_LENGTH = 7856;
@@ -9,7 +10,11 @@ export type ReallyMeSlhDsaKeyPair = Readonly<{
 }>;
 export declare const ReallyMeSlhDsa: {
     readonly generateKeyPair: (algorithm: ReallyMeSignatureAlgorithm) => ReallyMeSlhDsaKeyPair;
+    readonly generateKeyPairWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeSignatureAlgorithm) => ReallyMeSlhDsaKeyPair;
     readonly sign: (algorithm: ReallyMeSignatureAlgorithm, message: Uint8Array, secretKey: Uint8Array) => Uint8Array;
+    readonly signWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeSignatureAlgorithm, message: Uint8Array, secretKey: Uint8Array) => Uint8Array;
     readonly verify: (algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array) => void;
+    readonly verifyWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array) => void;
 };
 export declare const deriveSlhDsaSha2128sKeypairForTest: (skSeed: Uint8Array, skPrf: Uint8Array, pkSeed: Uint8Array) => ReallyMeSlhDsaKeyPair;
+export declare const deriveSlhDsaSha2128sKeypairWithProviderForTest: (provider: ReallyMeWasmProvider, skSeed: Uint8Array, skPrf: Uint8Array, pkSeed: Uint8Array) => ReallyMeSlhDsaKeyPair;

package/dist/slhDsa.js

@@ -34,17 +34,32 @@ export const ReallyMeSlhDsa = {
         assertSlhDsa(algorithm);
         return readKeyPair(requireReallyMeWasmProvider().slhDsaSha2128sGenerateKeypair());
     },
+    generateKeyPairWithProvider(provider, algorithm) {
+        assertSlhDsa(algorithm);
+        return readKeyPair(provider.slhDsaSha2128sGenerateKeypair());
+    },
     sign(algorithm, message, secretKey) {
         assertSlhDsa(algorithm);
         ensureBytes(secretKey, SLH_DSA_SHA2_128S_SECRET_KEY_LENGTH);
         return readSignature(requireReallyMeWasmProvider().slhDsaSha2128sSign(secretKey, message));
     },
+    signWithProvider(provider, algorithm, message, secretKey) {
+        assertSlhDsa(algorithm);
+        ensureBytes(secretKey, SLH_DSA_SHA2_128S_SECRET_KEY_LENGTH);
+        return readSignature(provider.slhDsaSha2128sSign(secretKey, message));
+    },
     verify(algorithm, signature, message, publicKey) {
         assertSlhDsa(algorithm);
         ensureBytes(publicKey, SLH_DSA_SHA2_128S_PUBLIC_KEY_LENGTH);
         ensureBytes(signature, SLH_DSA_SHA2_128S_SIGNATURE_LENGTH);
         readVoid(requireReallyMeWasmProvider().slhDsaSha2128sVerify(publicKey, message, signature));
     },
+    verifyWithProvider(provider, algorithm, signature, message, publicKey) {
+        assertSlhDsa(algorithm);
+        ensureBytes(publicKey, SLH_DSA_SHA2_128S_PUBLIC_KEY_LENGTH);
+        ensureBytes(signature, SLH_DSA_SHA2_128S_SIGNATURE_LENGTH);
+        readVoid(provider.slhDsaSha2128sVerify(publicKey, message, signature));
+    },
 };
 export const deriveSlhDsaSha2128sKeypairForTest = (skSeed, skPrf, pkSeed) => {
     ensureBytes(skSeed, SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH);
@@ -52,3 +67,9 @@ export const deriveSlhDsaSha2128sKeypairForTest = (skSeed, skPrf, pkSeed) => {
     ensureBytes(pkSeed, SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH);
     return readKeyPair(requireReallyMeWasmProvider().slhDsaSha2128sDeriveKeypair(skSeed, skPrf, pkSeed));
 };
+export const deriveSlhDsaSha2128sKeypairWithProviderForTest = (provider, skSeed, skPrf, pkSeed) => {
+    ensureBytes(skSeed, SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH);
+    ensureBytes(skPrf, SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH);
+    ensureBytes(pkSeed, SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH);
+    return readKeyPair(provider.slhDsaSha2128sDeriveKeypair(skSeed, skPrf, pkSeed));
+};

package/dist/validateBytes.d.ts

@@ -1,2 +1,3 @@
+export declare const ensureByteArray: (value: Uint8Array) => void;
 export declare const ensureBytes: (value: Uint8Array, expectedLength: number) => void;
 export declare const readByteArrayProperty: (value: unknown, propertyName: string, expectedLength: number) => Uint8Array;

package/dist/validateBytes.js

@@ -2,7 +2,13 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
+export const ensureByteArray = (value) => {
+    if (!(value instanceof Uint8Array)) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
 export const ensureBytes = (value, expectedLength) => {
+    ensureByteArray(value);
     if (value.length !== expectedLength) {
         throw new ReallyMeCryptoError("invalid-input");
     }

package/dist/wasm/reallyme_crypto_wasm.js

@@ -171,39 +171,6 @@ export function argon2idDeriveKey(kdf_version, secret, salt) {
     return takeFromExternrefTable0(ret[0]);
 }
 
-/**
- * Decode strict, unpadded RFC 4648 URL-safe base64.
- * @param {string} encoded
- * @returns {Uint8Array}
- */
-export function base64urlDecode(encoded) {
-    const ptr0 = passStringToWasm0(encoded, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ret = wasm.base64urlDecode(ptr0, len0);
-    if (ret[2]) {
-        throw takeFromExternrefTable0(ret[1]);
-    }
-    return takeFromExternrefTable0(ret[0]);
-}
-
-/**
- * Encode bytes as RFC 4648 URL-safe base64 without padding.
- * @param {Uint8Array} bytes
- * @returns {string}
- */
-export function base64urlEncode(bytes) {
-    let deferred1_0;
-    let deferred1_1;
-    try {
-        const ret = wasm.base64urlEncode(bytes);
-        deferred1_0 = ret[0];
-        deferred1_1 = ret[1];
-        return getStringFromWasm0(ret[0], ret[1]);
-    } finally {
-        wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
-    }
-}
-
 /**
  * Open and authenticate a ChaCha20-Poly1305 `ciphertext || tag`.
  * @param {Uint8Array} key
@@ -236,40 +203,6 @@ export function chacha20Poly1305Seal(key, nonce, aad, plaintext) {
     return takeFromExternrefTable0(ret[0]);
 }
 
-/**
- * Compute a CIDv1 dag-cbor/sha2-256 string for already-canonical DAG-CBOR bytes.
- * @param {Uint8Array} bytes
- * @returns {string}
- */
-export function dagCborComputeCid(bytes) {
-    let deferred1_0;
-    let deferred1_1;
-    try {
-        const ret = wasm.dagCborComputeCid(bytes);
-        deferred1_0 = ret[0];
-        deferred1_1 = ret[1];
-        return getStringFromWasm0(ret[0], ret[1]);
-    } finally {
-        wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
-    }
-}
-
-/**
- * Recompute and compare a CIDv1 dag-cbor/sha2-256 string.
- * @param {string} cid
- * @param {Uint8Array} bytes
- * @returns {any}
- */
-export function dagCborVerifyCid(cid, bytes) {
-    const ptr0 = passStringToWasm0(cid, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ret = wasm.dagCborVerifyCid(ptr0, len0, bytes);
-    if (ret[2]) {
-        throw takeFromExternrefTable0(ret[1]);
-    }
-    return takeFromExternrefTable0(ret[0]);
-}
-
 /**
  * Open one RFC 9180 HPKE Base-mode message.
  * @param {number} suite
@@ -677,127 +610,6 @@ export function mlKem768GenerateKeypair() {
     return takeFromExternrefTable0(ret[0]);
 }
 
-/**
- * Encode bytes with the multibase base58btc prefix.
- * @param {Uint8Array} bytes
- * @returns {string}
- */
-export function multibaseBase58btcEncode(bytes) {
-    let deferred1_0;
-    let deferred1_1;
-    try {
-        const ret = wasm.multibaseBase58btcEncode(bytes);
-        deferred1_0 = ret[0];
-        deferred1_1 = ret[1];
-        return getStringFromWasm0(ret[0], ret[1]);
-    } finally {
-        wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
-    }
-}
-
-/**
- * Encode bytes with the multibase base64url prefix.
- * @param {Uint8Array} bytes
- * @returns {string}
- */
-export function multibaseBase64urlEncode(bytes) {
-    let deferred1_0;
-    let deferred1_1;
-    try {
-        const ret = wasm.multibaseBase64urlEncode(bytes);
-        deferred1_0 = ret[0];
-        deferred1_1 = ret[1];
-        return getStringFromWasm0(ret[0], ret[1]);
-    } finally {
-        wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
-    }
-}
-
-/**
- * Decode a supported multibase string.
- * @param {string} encoded
- * @returns {Uint8Array}
- */
-export function multibaseDecode(encoded) {
-    const ptr0 = passStringToWasm0(encoded, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ret = wasm.multibaseDecode(ptr0, len0);
-    if (ret[2]) {
-        throw takeFromExternrefTable0(ret[1]);
-    }
-    return takeFromExternrefTable0(ret[0]);
-}
-
-/**
- * Resolve a byte slice that starts with a known multicodec prefix.
- * @param {Uint8Array} bytes
- * @returns {any}
- */
-export function multicodecLookupPrefix(bytes) {
-    const ret = wasm.multicodecLookupPrefix(bytes);
-    if (ret[2]) {
-        throw takeFromExternrefTable0(ret[1]);
-    }
-    return takeFromExternrefTable0(ret[0]);
-}
-
-/**
- * Return multicodec metadata for a canonical codec name.
- * @param {string} codec_name
- * @returns {any}
- */
-export function multicodecPrefixForName(codec_name) {
-    const ptr0 = passStringToWasm0(codec_name, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ret = wasm.multicodecPrefixForName(ptr0, len0);
-    if (ret[2]) {
-        throw takeFromExternrefTable0(ret[1]);
-    }
-    return takeFromExternrefTable0(ret[0]);
-}
-
-/**
- * Encode a public key as a multibase base58btc multikey.
- * @param {string} codec_name
- * @param {Uint8Array} public_key
- * @returns {string}
- */
-export function multikeyEncode(codec_name, public_key) {
-    let deferred3_0;
-    let deferred3_1;
-    try {
-        const ptr0 = passStringToWasm0(codec_name, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.multikeyEncode(ptr0, len0, public_key);
-        var ptr2 = ret[0];
-        var len2 = ret[1];
-        if (ret[3]) {
-            ptr2 = 0; len2 = 0;
-            throw takeFromExternrefTable0(ret[2]);
-        }
-        deferred3_0 = ptr2;
-        deferred3_1 = len2;
-        return getStringFromWasm0(ptr2, len2);
-    } finally {
-        wasm.__wbindgen_free(deferred3_0, deferred3_1, 1);
-    }
-}
-
-/**
- * Parse and validate a multikey string.
- * @param {string} multikey
- * @returns {any}
- */
-export function multikeyParse(multikey) {
-    const ptr0 = passStringToWasm0(multikey, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ret = wasm.multikeyParse(ptr0, len0);
-    if (ret[2]) {
-        throw takeFromExternrefTable0(ret[1]);
-    }
-    return takeFromExternrefTable0(ret[0]);
-}
-
 /**
  * Verify an RSASSA-PKCS1-v1_5 signature against a DER RSA public key.
  * @param {Uint8Array} public_key_der
@@ -1075,12 +887,7 @@ function __wbg_get_imports() {
             const ret = Reflect.set(arg0, arg1, arg2);
             return ret;
         }, arguments); },
-        __wbindgen_cast_0000000000000001: function(arg0) {
-            // Cast intrinsic for `F64 -> Externref`.
-            const ret = arg0;
-            return ret;
-        },
-        __wbindgen_cast_0000000000000002: function(arg0, arg1) {
+        __wbindgen_cast_0000000000000001: function(arg0, arg1) {
             // Cast intrinsic for `Ref(String) -> Externref`.
             const ret = getStringFromWasm0(arg0, arg1);
             return ret;
@@ -1133,43 +940,6 @@ function handleError(f, args) {
     }
 }
 
-function passStringToWasm0(arg, malloc, realloc) {
-    if (realloc === undefined) {
-        const buf = cachedTextEncoder.encode(arg);
-        const ptr = malloc(buf.length, 1) >>> 0;
-        getUint8ArrayMemory0().subarray(ptr, ptr + buf.length).set(buf);
-        WASM_VECTOR_LEN = buf.length;
-        return ptr;
-    }
-
-    let len = arg.length;
-    let ptr = malloc(len, 1) >>> 0;
-
-    const mem = getUint8ArrayMemory0();
-
-    let offset = 0;
-
-    for (; offset < len; offset++) {
-        const code = arg.charCodeAt(offset);
-        if (code > 0x7F) break;
-        mem[ptr + offset] = code;
-    }
-    if (offset !== len) {
-        if (offset !== 0) {
-            arg = arg.slice(offset);
-        }
-        ptr = realloc(ptr, len, len = offset + arg.length * 3, 1) >>> 0;
-        const view = getUint8ArrayMemory0().subarray(ptr + offset, ptr + len);
-        const ret = cachedTextEncoder.encodeInto(arg, view);
-
-        offset += ret.written;
-        ptr = realloc(ptr, len, offset, 1) >>> 0;
-    }
-
-    WASM_VECTOR_LEN = offset;
-    return ptr;
-}
-
 function takeFromExternrefTable0(idx) {
     const value = wasm.__wbindgen_externrefs.get(idx);
     wasm.__externref_table_dealloc(idx);
@@ -1190,21 +960,6 @@ function decodeText(ptr, len) {
     return cachedTextDecoder.decode(getUint8ArrayMemory0().subarray(ptr, ptr + len));
 }
 
-const cachedTextEncoder = new TextEncoder();
-
-if (!('encodeInto' in cachedTextEncoder)) {
-    cachedTextEncoder.encodeInto = function (arg, view) {
-        const buf = cachedTextEncoder.encode(arg);
-        view.set(buf);
-        return {
-            read: arg.length,
-            written: buf.length
-        };
-    };
-}
-
-let WASM_VECTOR_LEN = 0;
-
 let wasmModule, wasmInstance, wasm;
 function __wbg_finalize_init(instance, module) {
     wasmInstance = instance;

package/dist/wasmModuleTypes.d.ts

@@ -15,17 +15,6 @@ export declare function aes256GcmSivSeal(key: Uint8Array, nonce: Uint8Array, aad
 export declare function aes256KwUnwrapKey(wrappingKey: Uint8Array, wrappedKey: Uint8Array): Uint8Array;
 export declare function aes256KwWrapKey(wrappingKey: Uint8Array, keyToWrap: Uint8Array): Uint8Array;
 export declare function argon2idDeriveKey(kdfVersion: number, secret: Uint8Array, salt: Uint8Array): Uint8Array;
-export declare function base64urlDecode(encoded: string): Uint8Array;
-export declare function base64urlEncode(bytes: Uint8Array): string;
-export declare function dagCborComputeCid(bytes: Uint8Array): string;
-export declare function dagCborVerifyCid(cid: string, bytes: Uint8Array): unknown;
-export declare function multibaseBase58btcEncode(bytes: Uint8Array): string;
-export declare function multibaseBase64urlEncode(bytes: Uint8Array): string;
-export declare function multibaseDecode(encoded: string): Uint8Array;
-export declare function multicodecLookupPrefix(bytes: Uint8Array): unknown;
-export declare function multicodecPrefixForName(codecName: string): unknown;
-export declare function multikeyEncode(codecName: string, publicKey: Uint8Array): string;
-export declare function multikeyParse(multikey: string): unknown;
 export declare function hpkeOpenBase(suite: number, recipientSecretKey: Uint8Array, encapsulatedKey: Uint8Array, info: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array): Uint8Array;
 export declare function hpkeSealBase(suite: number, recipientPublicKey: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): unknown;
 export declare function hpkeSealBaseDerand(suite: number, recipientPublicKey: Uint8Array, encapsulationRandomness: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): unknown;
@@ -56,6 +45,8 @@ export declare function mlDsa87GenerateKeypair(): unknown;
 export declare function mlDsa87DeriveKeypair(secretKey: Uint8Array): unknown;
 export declare function mlDsa87Sign(secretKey: Uint8Array, message: Uint8Array): Uint8Array;
 export declare function mlDsa87Verify(publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array): void;
+export declare function rsaVerifyPkcs1v15(publicKeyDer: Uint8Array, publicKeyEncoding: number, hashSuite: number, message: Uint8Array, signature: Uint8Array): void;
+export declare function rsaVerifyPss(publicKeyDer: Uint8Array, publicKeyEncoding: number, messageHashSuite: number, mgf1HashSuite: number, saltLength: number, message: Uint8Array, signature: Uint8Array): void;
 export declare function slhDsaSha2128sGenerateKeypair(): unknown;
 export declare function slhDsaSha2128sDeriveKeypair(skSeed: Uint8Array, skPrf: Uint8Array, pkSeed: Uint8Array): unknown;
 export declare function slhDsaSha2128sSign(secretKey: Uint8Array, message: Uint8Array): Uint8Array;

package/dist/wasmProvider.d.ts

@@ -3,11 +3,6 @@ type GenerateKeypairFromSeedFn = (seed: Uint8Array) => unknown;
 type Argon2idFn = (kdfVersion: number, secret: Uint8Array, salt: Uint8Array) => unknown;
 type AeadFn = (key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, text: Uint8Array) => unknown;
 type KeyWrapFn = (wrappingKey: Uint8Array, keyMaterial: Uint8Array) => unknown;
-type BytesToStringFn = (bytes: Uint8Array) => unknown;
-type BytesToObjectFn = (bytes: Uint8Array) => unknown;
-type StringToBytesFn = (text: string) => unknown;
-type StringToObjectFn = (text: string) => unknown;
-type StringBytesToStringFn = (text: string, bytes: Uint8Array) => unknown;
 type SignatureSignFn = (secretKey: Uint8Array, message: Uint8Array) => unknown;
 type SignatureVerifyFn = (publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array) => unknown;
 type RsaPkcs1v15VerifyFn = (publicKeyDer: Uint8Array, publicKeyEncoding: number, hashSuite: number, message: Uint8Array, signature: Uint8Array) => unknown;
@@ -36,17 +31,6 @@ export type ReallyMeWasmProvider = Readonly<{
     aes256KwWrapKey: KeyWrapFn;
     aes256KwUnwrapKey: KeyWrapFn;
     argon2idDeriveKey: Argon2idFn;
-    base64urlEncode: BytesToStringFn;
-    base64urlDecode: StringToBytesFn;
-    multibaseBase64urlEncode: BytesToStringFn;
-    multibaseBase58btcEncode: BytesToStringFn;
-    multibaseDecode: StringToBytesFn;
-    multicodecPrefixForName: StringToObjectFn;
-    multicodecLookupPrefix: BytesToObjectFn;
-    multikeyEncode: StringBytesToStringFn;
-    multikeyParse: StringToObjectFn;
-    dagCborComputeCid: BytesToStringFn;
-    dagCborVerifyCid: StringBytesToStringFn;
     hpkeSealBase: HpkeSealFn;
     hpkeSealBaseDerand: HpkeSealDerandFn;
     hpkeOpenBase: HpkeOpenFn;
@@ -94,6 +78,7 @@ export type ReallyMeWasmProvider = Readonly<{
     xWing1024EncapsulateDerand: EncapsulateDerandFn;
     xWing1024Decapsulate: DecapsulateFn;
 }>;
+export declare const createReallyMeWasmProvider: (module: unknown) => ReallyMeWasmProvider;
 export declare const installReallyMeWasmProvider: (module: unknown) => void;
 export declare const requireReallyMeWasmProvider: () => ReallyMeWasmProvider;
 export {};

package/dist/wasmProvider.js

@@ -29,6 +29,8 @@ const wasmErrorCode = (error) => {
             return "invalid-input";
         case "invalid-signature":
             return "invalid-signature";
+        case "authentication-failed":
+            return "authentication-failed";
         case "unsupported-algorithm":
             return "unsupported-algorithm";
         case "provider-failure":
@@ -48,18 +50,6 @@ const function2 = (module, name) => {
     const callable = requireFunction(module, name);
     return (first, second) => callable(first, second);
 };
-const stringFunction1 = (module, name) => {
-    const callable = requireFunction(module, name);
-    return (text) => callable(text);
-};
-const bytesFunction1 = (module, name) => {
-    const callable = requireFunction(module, name);
-    return (bytes) => callable(bytes);
-};
-const stringBytesFunction2 = (module, name) => {
-    const callable = requireFunction(module, name);
-    return (text, bytes) => callable(text, bytes);
-};
 const function3 = (module, name) => {
     const callable = requireFunction(module, name);
     return (first, second, third) => callable(first, second, third);
@@ -96,9 +86,9 @@ const rsaPssVerifyFunction = (module, name) => {
     const callable = requireFunction(module, name);
     return (publicKeyDer, publicKeyEncoding, messageHashSuite, mgf1HashSuite, saltLength, message, signature) => callable(publicKeyDer, publicKeyEncoding, messageHashSuite, mgf1HashSuite, saltLength, message, signature);
 };
-export const installReallyMeWasmProvider = (module) => {
+export const createReallyMeWasmProvider = (module) => {
     const providerModule = requireObject(module);
-    installedProvider = {
+    return {
         aes128GcmSeal: function4(providerModule, "aes128GcmSeal"),
         aes128GcmOpen: function4(providerModule, "aes128GcmOpen"),
         aes192GcmSeal: function4(providerModule, "aes192GcmSeal"),
@@ -114,17 +104,6 @@ export const installReallyMeWasmProvider = (module) => {
         aes256KwWrapKey: function2(providerModule, "aes256KwWrapKey"),
         aes256KwUnwrapKey: function2(providerModule, "aes256KwUnwrapKey"),
         argon2idDeriveKey: argon2idFunction(providerModule, "argon2idDeriveKey"),
-        base64urlEncode: bytesFunction1(providerModule, "base64urlEncode"),
-        base64urlDecode: stringFunction1(providerModule, "base64urlDecode"),
-        multibaseBase64urlEncode: bytesFunction1(providerModule, "multibaseBase64urlEncode"),
-        multibaseBase58btcEncode: bytesFunction1(providerModule, "multibaseBase58btcEncode"),
-        multibaseDecode: stringFunction1(providerModule, "multibaseDecode"),
-        multicodecPrefixForName: stringFunction1(providerModule, "multicodecPrefixForName"),
-        multicodecLookupPrefix: bytesFunction1(providerModule, "multicodecLookupPrefix"),
-        multikeyEncode: stringBytesFunction2(providerModule, "multikeyEncode"),
-        multikeyParse: stringFunction1(providerModule, "multikeyParse"),
-        dagCborComputeCid: bytesFunction1(providerModule, "dagCborComputeCid"),
-        dagCborVerifyCid: stringBytesFunction2(providerModule, "dagCborVerifyCid"),
         hpkeSealBase: hpkeSealFunction(providerModule, "hpkeSealBase"),
         hpkeSealBaseDerand: hpkeSealDerandFunction(providerModule, "hpkeSealBaseDerand"),
         hpkeOpenBase: hpkeOpenFunction(providerModule, "hpkeOpenBase"),
@@ -173,6 +152,12 @@ export const installReallyMeWasmProvider = (module) => {
         xWing1024Decapsulate: function2(providerModule, "xWing1024Decapsulate"),
     };
 };
+export const installReallyMeWasmProvider = (module) => {
+    if (installedProvider !== undefined) {
+        throw new ReallyMeCryptoError("provider-failure");
+    }
+    installedProvider = createReallyMeWasmProvider(module);
+};
 export const requireReallyMeWasmProvider = () => {
     if (installedProvider === undefined) {
         throw new ReallyMeCryptoError("provider-failure");

package/dist/xWing.d.ts

@@ -1,4 +1,5 @@
 import type { ReallyMeKemAlgorithm } from "./algorithms.js";
+import type { ReallyMeWasmProvider } from "./wasmProvider.js";
 export declare const X_WING_SECRET_KEY_LENGTH = 32;
 export declare const X_WING_ENCAPSULATION_SEED_LENGTH = 64;
 export declare const X_WING_SHARED_SECRET_LENGTH = 32;
@@ -16,8 +17,13 @@ export type ReallyMeXWingEncapsulation = Readonly<{
 }>;
 export declare const ReallyMeXWing: {
     readonly generateKeyPair: (algorithm: ReallyMeKemAlgorithm) => ReallyMeXWingKeyPair;
+    readonly generateKeyPairWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm) => ReallyMeXWingKeyPair;
     readonly deriveKeyPair: (algorithm: ReallyMeKemAlgorithm, secretKey: Uint8Array) => ReallyMeXWingKeyPair;
+    readonly deriveKeyPairWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm, secretKey: Uint8Array) => ReallyMeXWingKeyPair;
     readonly encapsulate: (algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array) => ReallyMeXWingEncapsulation;
+    readonly encapsulateWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array) => ReallyMeXWingEncapsulation;
     readonly decapsulate: (algorithm: ReallyMeKemAlgorithm, ciphertext: Uint8Array, secretKey: Uint8Array) => Uint8Array;
+    readonly decapsulateWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm, ciphertext: Uint8Array, secretKey: Uint8Array) => Uint8Array;
 };
 export declare const encapsulateXWingDeterministicallyForTest: (algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array, seed: Uint8Array) => ReallyMeXWingEncapsulation;
+export declare const encapsulateXWingDeterministicallyWithProviderForTest: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array, seed: Uint8Array) => ReallyMeXWingEncapsulation;

package/dist/xWing.js

@@ -12,13 +12,15 @@ export const X_WING_768_CIPHERTEXT_LENGTH = 1_120;
 export const X_WING_1024_PUBLIC_KEY_LENGTH = 1_600;
 export const X_WING_1024_CIPHERTEXT_LENGTH = 1_600;
 const xWingSuite = (algorithm) => {
+    return xWingSuiteWithProvider(algorithm, requireReallyMeWasmProvider());
+};
+const xWingSuiteWithProvider = (algorithm, provider) => {
     switch (algorithm) {
         case "ML-KEM-512":
         case "ML-KEM-768":
         case "ML-KEM-1024":
             throw new ReallyMeCryptoError("unsupported-algorithm");
         case "X-Wing-768": {
-            const provider = requireReallyMeWasmProvider();
             return {
                 publicKeyLength: X_WING_768_PUBLIC_KEY_LENGTH,
                 ciphertextLength: X_WING_768_CIPHERTEXT_LENGTH,
@@ -30,7 +32,6 @@ const xWingSuite = (algorithm) => {
             };
         }
         case "X-Wing-1024": {
-            const provider = requireReallyMeWasmProvider();
             return {
                 publicKeyLength: X_WING_1024_PUBLIC_KEY_LENGTH,
                 ciphertextLength: X_WING_1024_CIPHERTEXT_LENGTH,
@@ -56,16 +57,30 @@ export const ReallyMeXWing = {
         const suite = xWingSuite(algorithm);
         return readKeyPair(suite.generateKeypair(), suite);
     },
+    generateKeyPairWithProvider(provider, algorithm) {
+        const suite = xWingSuiteWithProvider(algorithm, provider);
+        return readKeyPair(suite.generateKeypair(), suite);
+    },
     deriveKeyPair(algorithm, secretKey) {
         ensureBytes(secretKey, X_WING_SECRET_KEY_LENGTH);
         const suite = xWingSuite(algorithm);
         return readKeyPair(suite.deriveKeypair(secretKey), suite);
     },
+    deriveKeyPairWithProvider(provider, algorithm, secretKey) {
+        ensureBytes(secretKey, X_WING_SECRET_KEY_LENGTH);
+        const suite = xWingSuiteWithProvider(algorithm, provider);
+        return readKeyPair(suite.deriveKeypair(secretKey), suite);
+    },
     encapsulate(algorithm, publicKey) {
         const suite = xWingSuite(algorithm);
         ensureBytes(publicKey, suite.publicKeyLength);
         return readEncapsulation(suite.encapsulate(publicKey), suite);
     },
+    encapsulateWithProvider(provider, algorithm, publicKey) {
+        const suite = xWingSuiteWithProvider(algorithm, provider);
+        ensureBytes(publicKey, suite.publicKeyLength);
+        return readEncapsulation(suite.encapsulate(publicKey), suite);
+    },
     decapsulate(algorithm, ciphertext, secretKey) {
         const suite = xWingSuite(algorithm);
         ensureBytes(ciphertext, suite.ciphertextLength);
@@ -77,6 +92,17 @@ export const ReallyMeXWing = {
         ensureBytes(sharedSecret, X_WING_SHARED_SECRET_LENGTH);
         return sharedSecret;
     },
+    decapsulateWithProvider(provider, algorithm, ciphertext, secretKey) {
+        const suite = xWingSuiteWithProvider(algorithm, provider);
+        ensureBytes(ciphertext, suite.ciphertextLength);
+        ensureBytes(secretKey, X_WING_SECRET_KEY_LENGTH);
+        const sharedSecret = suite.decapsulate(ciphertext, secretKey);
+        if (!(sharedSecret instanceof Uint8Array)) {
+            throw new ReallyMeCryptoError("provider-failure");
+        }
+        ensureBytes(sharedSecret, X_WING_SHARED_SECRET_LENGTH);
+        return sharedSecret;
+    },
 };
 export const encapsulateXWingDeterministicallyForTest = (algorithm, publicKey, seed) => {
     const suite = xWingSuite(algorithm);
@@ -84,3 +110,9 @@ export const encapsulateXWingDeterministicallyForTest = (algorithm, publicKey, s
     ensureBytes(seed, X_WING_ENCAPSULATION_SEED_LENGTH);
     return readEncapsulation(suite.encapsulateDerand(publicKey, seed), suite);
 };
+export const encapsulateXWingDeterministicallyWithProviderForTest = (provider, algorithm, publicKey, seed) => {
+    const suite = xWingSuiteWithProvider(algorithm, provider);
+    ensureBytes(publicKey, suite.publicKeyLength);
+    ensureBytes(seed, X_WING_ENCAPSULATION_SEED_LENGTH);
+    return readEncapsulation(suite.encapsulateDerand(publicKey, seed), suite);
+};