@reallyme/crypto 0.1.8 → 0.3.0

package/dist/wasmProvider.d.ts

@@ -1,26 +1,24 @@
 type GenerateKeypairFn = () => unknown;
 type GenerateKeypairFromSeedFn = (seed: Uint8Array) => unknown;
 type Argon2idFn = (kdfVersion: number, secret: Uint8Array, salt: Uint8Array) => unknown;
+type KmacFn = (key: Uint8Array, context: Uint8Array, customization: Uint8Array, outputLength: number) => unknown;
 type AeadFn = (key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, text: Uint8Array) => unknown;
-type KeyWrapFn = (wrappingKey: Uint8Array, keyMaterial: Uint8Array) => unknown;
-type BytesToStringFn = (bytes: Uint8Array) => unknown;
-type BytesToObjectFn = (bytes: Uint8Array) => unknown;
-type StringToBytesFn = (text: string) => unknown;
-type StringToObjectFn = (text: string) => unknown;
-type StringBytesToStringFn = (text: string, bytes: Uint8Array) => unknown;
+type TwoByteArraysFn = (first: Uint8Array, second: Uint8Array) => unknown;
+type KeyWrapFn = TwoByteArraysFn;
 type SignatureSignFn = (secretKey: Uint8Array, message: Uint8Array) => unknown;
 type SignatureVerifyFn = (publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array) => unknown;
 type RsaPkcs1v15VerifyFn = (publicKeyDer: Uint8Array, publicKeyEncoding: number, hashSuite: number, message: Uint8Array, signature: Uint8Array) => unknown;
 type RsaPssVerifyFn = (publicKeyDer: Uint8Array, publicKeyEncoding: number, messageHashSuite: number, mgf1HashSuite: number, saltLength: number, message: Uint8Array, signature: Uint8Array) => unknown;
 type HpkeOpenFn = (suite: number, recipientSecretKey: Uint8Array, encapsulatedKey: Uint8Array, info: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array) => unknown;
 type HpkeSealFn = (suite: number, recipientPublicKey: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array) => unknown;
-type HpkeSealDerandFn = (suite: number, recipientPublicKey: Uint8Array, encapsulationRandomness: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array) => unknown;
 type DeriveKeypairFn = (secretKey: Uint8Array) => unknown;
 type SlhDsaDeriveKeypairFn = (skSeed: Uint8Array, skPrf: Uint8Array, pkSeed: Uint8Array) => unknown;
 type EncapsulateFn = (publicKey: Uint8Array) => unknown;
-type EncapsulateDerandFn = (publicKey: Uint8Array, seed: Uint8Array) => unknown;
 type DecapsulateFn = (ciphertext: Uint8Array, secretKey: Uint8Array) => unknown;
+type BytesToBytesFn = (bytes: Uint8Array) => unknown;
 export type ReallyMeWasmProvider = Readonly<{
+    processOperationResponse: BytesToBytesFn;
+    processOperationResponseJson: BytesToBytesFn;
     aes128GcmSeal: AeadFn;
     aes128GcmOpen: AeadFn;
     aes192GcmSeal: AeadFn;
@@ -33,22 +31,15 @@ export type ReallyMeWasmProvider = Readonly<{
     chacha20Poly1305Open: AeadFn;
     xchacha20Poly1305Seal: AeadFn;
     xchacha20Poly1305Open: AeadFn;
+    aes128KwWrapKey: KeyWrapFn;
+    aes128KwUnwrapKey: KeyWrapFn;
+    aes192KwWrapKey: KeyWrapFn;
+    aes192KwUnwrapKey: KeyWrapFn;
     aes256KwWrapKey: KeyWrapFn;
     aes256KwUnwrapKey: KeyWrapFn;
     argon2idDeriveKey: Argon2idFn;
-    base64urlEncode: BytesToStringFn;
-    base64urlDecode: StringToBytesFn;
-    multibaseBase64urlEncode: BytesToStringFn;
-    multibaseBase58btcEncode: BytesToStringFn;
-    multibaseDecode: StringToBytesFn;
-    multicodecPrefixForName: StringToObjectFn;
-    multicodecLookupPrefix: BytesToObjectFn;
-    multikeyEncode: StringBytesToStringFn;
-    multikeyParse: StringToObjectFn;
-    dagCborComputeCid: BytesToStringFn;
-    dagCborVerifyCid: StringBytesToStringFn;
+    kmac256Derive: KmacFn;
     hpkeSealBase: HpkeSealFn;
-    hpkeSealBaseDerand: HpkeSealDerandFn;
     hpkeOpenBase: HpkeOpenFn;
     mlDsa44GenerateKeypair: GenerateKeypairFn;
     mlDsa44DeriveKeypair: GenerateKeypairFromSeedFn;
@@ -65,17 +56,14 @@ export type ReallyMeWasmProvider = Readonly<{
     mlKem512GenerateKeypair: GenerateKeypairFn;
     mlKem512DeriveKeypair: GenerateKeypairFromSeedFn;
     mlKem512Encapsulate: EncapsulateFn;
-    mlKem512EncapsulateDerand: EncapsulateDerandFn;
     mlKem512Decapsulate: DecapsulateFn;
     mlKem768GenerateKeypair: GenerateKeypairFn;
     mlKem768DeriveKeypair: GenerateKeypairFromSeedFn;
     mlKem768Encapsulate: EncapsulateFn;
-    mlKem768EncapsulateDerand: EncapsulateDerandFn;
     mlKem768Decapsulate: DecapsulateFn;
     mlKem1024GenerateKeypair: GenerateKeypairFn;
     mlKem1024DeriveKeypair: GenerateKeypairFromSeedFn;
     mlKem1024Encapsulate: EncapsulateFn;
-    mlKem1024EncapsulateDerand: EncapsulateDerandFn;
     mlKem1024Decapsulate: DecapsulateFn;
     slhDsaSha2128sGenerateKeypair: GenerateKeypairFn;
     slhDsaSha2128sDeriveKeypair: SlhDsaDeriveKeypairFn;
@@ -86,14 +74,9 @@ export type ReallyMeWasmProvider = Readonly<{
     xWing768GenerateKeypair: GenerateKeypairFn;
     xWing768DeriveKeypair: DeriveKeypairFn;
     xWing768Encapsulate: EncapsulateFn;
-    xWing768EncapsulateDerand: EncapsulateDerandFn;
     xWing768Decapsulate: DecapsulateFn;
-    xWing1024GenerateKeypair: GenerateKeypairFn;
-    xWing1024DeriveKeypair: DeriveKeypairFn;
-    xWing1024Encapsulate: EncapsulateFn;
-    xWing1024EncapsulateDerand: EncapsulateDerandFn;
-    xWing1024Decapsulate: DecapsulateFn;
 }>;
+export declare const createReallyMeWasmProvider: (module: unknown) => ReallyMeWasmProvider;
 export declare const installReallyMeWasmProvider: (module: unknown) => void;
 export declare const requireReallyMeWasmProvider: () => ReallyMeWasmProvider;
 export {};

package/dist/wasmProvider.js

@@ -25,13 +25,15 @@ const requireFunction = (module, name) => {
 };
 const wasmErrorCode = (error) => {
     switch (error) {
-        case "invalid-input":
+        case 1 /* WasmErrorCode.InvalidInput */:
             return "invalid-input";
-        case "invalid-signature":
+        case 2 /* WasmErrorCode.InvalidSignature */:
             return "invalid-signature";
-        case "unsupported-algorithm":
+        case 3 /* WasmErrorCode.AuthenticationFailed */:
+            return "authentication-failed";
+        case 5 /* WasmErrorCode.UnsupportedAlgorithm */:
             return "unsupported-algorithm";
-        case "provider-failure":
+        case 4 /* WasmErrorCode.ProviderFailure */:
         default:
             return "provider-failure";
     }
@@ -48,18 +50,6 @@ const function2 = (module, name) => {
     const callable = requireFunction(module, name);
     return (first, second) => callable(first, second);
 };
-const stringFunction1 = (module, name) => {
-    const callable = requireFunction(module, name);
-    return (text) => callable(text);
-};
-const bytesFunction1 = (module, name) => {
-    const callable = requireFunction(module, name);
-    return (bytes) => callable(bytes);
-};
-const stringBytesFunction2 = (module, name) => {
-    const callable = requireFunction(module, name);
-    return (text, bytes) => callable(text, bytes);
-};
 const function3 = (module, name) => {
     const callable = requireFunction(module, name);
     return (first, second, third) => callable(first, second, third);
@@ -76,13 +66,13 @@ const argon2idFunction = (module, name) => {
     const callable = requireFunction(module, name);
     return (kdfVersion, secret, salt) => callable(kdfVersion, secret, salt);
 };
-const hpkeSealFunction = (module, name) => {
+const kmacFunction = (module, name) => {
     const callable = requireFunction(module, name);
-    return (suite, recipientPublicKey, info, aad, plaintext) => callable(suite, recipientPublicKey, info, aad, plaintext);
+    return (key, context, customization, outputLength) => callable(key, context, customization, outputLength);
 };
-const hpkeSealDerandFunction = (module, name) => {
+const hpkeSealFunction = (module, name) => {
     const callable = requireFunction(module, name);
-    return (suite, recipientPublicKey, encapsulationRandomness, info, aad, plaintext) => callable(suite, recipientPublicKey, encapsulationRandomness, info, aad, plaintext);
+    return (suite, recipientPublicKey, info, aad, plaintext) => callable(suite, recipientPublicKey, info, aad, plaintext);
 };
 const hpkeOpenFunction = (module, name) => {
     const callable = requireFunction(module, name);
@@ -96,9 +86,11 @@ const rsaPssVerifyFunction = (module, name) => {
     const callable = requireFunction(module, name);
     return (publicKeyDer, publicKeyEncoding, messageHashSuite, mgf1HashSuite, saltLength, message, signature) => callable(publicKeyDer, publicKeyEncoding, messageHashSuite, mgf1HashSuite, saltLength, message, signature);
 };
-export const installReallyMeWasmProvider = (module) => {
+export const createReallyMeWasmProvider = (module) => {
     const providerModule = requireObject(module);
-    installedProvider = {
+    return {
+        processOperationResponse: function1(providerModule, "processOperationResponse"),
+        processOperationResponseJson: function1(providerModule, "processOperationResponseJson"),
         aes128GcmSeal: function4(providerModule, "aes128GcmSeal"),
         aes128GcmOpen: function4(providerModule, "aes128GcmOpen"),
         aes192GcmSeal: function4(providerModule, "aes192GcmSeal"),
@@ -111,22 +103,15 @@ export const installReallyMeWasmProvider = (module) => {
         chacha20Poly1305Open: function4(providerModule, "chacha20Poly1305Open"),
         xchacha20Poly1305Seal: function4(providerModule, "xchacha20Poly1305Seal"),
         xchacha20Poly1305Open: function4(providerModule, "xchacha20Poly1305Open"),
+        aes128KwWrapKey: function2(providerModule, "aes128KwWrapKey"),
+        aes128KwUnwrapKey: function2(providerModule, "aes128KwUnwrapKey"),
+        aes192KwWrapKey: function2(providerModule, "aes192KwWrapKey"),
+        aes192KwUnwrapKey: function2(providerModule, "aes192KwUnwrapKey"),
         aes256KwWrapKey: function2(providerModule, "aes256KwWrapKey"),
         aes256KwUnwrapKey: function2(providerModule, "aes256KwUnwrapKey"),
         argon2idDeriveKey: argon2idFunction(providerModule, "argon2idDeriveKey"),
-        base64urlEncode: bytesFunction1(providerModule, "base64urlEncode"),
-        base64urlDecode: stringFunction1(providerModule, "base64urlDecode"),
-        multibaseBase64urlEncode: bytesFunction1(providerModule, "multibaseBase64urlEncode"),
-        multibaseBase58btcEncode: bytesFunction1(providerModule, "multibaseBase58btcEncode"),
-        multibaseDecode: stringFunction1(providerModule, "multibaseDecode"),
-        multicodecPrefixForName: stringFunction1(providerModule, "multicodecPrefixForName"),
-        multicodecLookupPrefix: bytesFunction1(providerModule, "multicodecLookupPrefix"),
-        multikeyEncode: stringBytesFunction2(providerModule, "multikeyEncode"),
-        multikeyParse: stringFunction1(providerModule, "multikeyParse"),
-        dagCborComputeCid: bytesFunction1(providerModule, "dagCborComputeCid"),
-        dagCborVerifyCid: stringBytesFunction2(providerModule, "dagCborVerifyCid"),
+        kmac256Derive: kmacFunction(providerModule, "kmac256Derive"),
         hpkeSealBase: hpkeSealFunction(providerModule, "hpkeSealBase"),
-        hpkeSealBaseDerand: hpkeSealDerandFunction(providerModule, "hpkeSealBaseDerand"),
         hpkeOpenBase: hpkeOpenFunction(providerModule, "hpkeOpenBase"),
         mlDsa44GenerateKeypair: function0(providerModule, "mlDsa44GenerateKeypair"),
         mlDsa44DeriveKeypair: function1(providerModule, "mlDsa44DeriveKeypair"),
@@ -143,17 +128,14 @@ export const installReallyMeWasmProvider = (module) => {
         mlKem512GenerateKeypair: function0(providerModule, "mlKem512GenerateKeypair"),
         mlKem512DeriveKeypair: function1(providerModule, "mlKem512DeriveKeypair"),
         mlKem512Encapsulate: function1(providerModule, "mlKem512Encapsulate"),
-        mlKem512EncapsulateDerand: function2(providerModule, "mlKem512EncapsulateDerand"),
         mlKem512Decapsulate: function2(providerModule, "mlKem512Decapsulate"),
         mlKem768GenerateKeypair: function0(providerModule, "mlKem768GenerateKeypair"),
         mlKem768DeriveKeypair: function1(providerModule, "mlKem768DeriveKeypair"),
         mlKem768Encapsulate: function1(providerModule, "mlKem768Encapsulate"),
-        mlKem768EncapsulateDerand: function2(providerModule, "mlKem768EncapsulateDerand"),
         mlKem768Decapsulate: function2(providerModule, "mlKem768Decapsulate"),
         mlKem1024GenerateKeypair: function0(providerModule, "mlKem1024GenerateKeypair"),
         mlKem1024DeriveKeypair: function1(providerModule, "mlKem1024DeriveKeypair"),
         mlKem1024Encapsulate: function1(providerModule, "mlKem1024Encapsulate"),
-        mlKem1024EncapsulateDerand: function2(providerModule, "mlKem1024EncapsulateDerand"),
         mlKem1024Decapsulate: function2(providerModule, "mlKem1024Decapsulate"),
         slhDsaSha2128sGenerateKeypair: function0(providerModule, "slhDsaSha2128sGenerateKeypair"),
         slhDsaSha2128sDeriveKeypair: deriveSlhDsaFunction3(providerModule, "slhDsaSha2128sDeriveKeypair"),
@@ -164,15 +146,15 @@ export const installReallyMeWasmProvider = (module) => {
         xWing768GenerateKeypair: function0(providerModule, "xWing768GenerateKeypair"),
         xWing768DeriveKeypair: function1(providerModule, "xWing768DeriveKeypair"),
         xWing768Encapsulate: function1(providerModule, "xWing768Encapsulate"),
-        xWing768EncapsulateDerand: function2(providerModule, "xWing768EncapsulateDerand"),
         xWing768Decapsulate: function2(providerModule, "xWing768Decapsulate"),
-        xWing1024GenerateKeypair: function0(providerModule, "xWing1024GenerateKeypair"),
-        xWing1024DeriveKeypair: function1(providerModule, "xWing1024DeriveKeypair"),
-        xWing1024Encapsulate: function1(providerModule, "xWing1024Encapsulate"),
-        xWing1024EncapsulateDerand: function2(providerModule, "xWing1024EncapsulateDerand"),
-        xWing1024Decapsulate: function2(providerModule, "xWing1024Decapsulate"),
     };
 };
+export const installReallyMeWasmProvider = (module) => {
+    if (installedProvider !== undefined) {
+        throw new ReallyMeCryptoError("provider-failure");
+    }
+    installedProvider = createReallyMeWasmProvider(module);
+};
 export const requireReallyMeWasmProvider = () => {
     if (installedProvider === undefined) {
         throw new ReallyMeCryptoError("provider-failure");

package/dist/xWing.d.ts

@@ -1,11 +1,9 @@
 import type { ReallyMeKemAlgorithm } from "./algorithms.js";
+import type { ReallyMeWasmProvider } from "./wasmProvider.js";
 export declare const X_WING_SECRET_KEY_LENGTH = 32;
-export declare const X_WING_ENCAPSULATION_SEED_LENGTH = 64;
 export declare const X_WING_SHARED_SECRET_LENGTH = 32;
 export declare const X_WING_768_PUBLIC_KEY_LENGTH = 1216;
 export declare const X_WING_768_CIPHERTEXT_LENGTH = 1120;
-export declare const X_WING_1024_PUBLIC_KEY_LENGTH = 1600;
-export declare const X_WING_1024_CIPHERTEXT_LENGTH = 1600;
 export type ReallyMeXWingKeyPair = Readonly<{
     publicKey: Uint8Array;
     secretKey: Uint8Array;
@@ -16,8 +14,11 @@ export type ReallyMeXWingEncapsulation = Readonly<{
 }>;
 export declare const ReallyMeXWing: {
     readonly generateKeyPair: (algorithm: ReallyMeKemAlgorithm) => ReallyMeXWingKeyPair;
+    readonly generateKeyPairWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm) => ReallyMeXWingKeyPair;
     readonly deriveKeyPair: (algorithm: ReallyMeKemAlgorithm, secretKey: Uint8Array) => ReallyMeXWingKeyPair;
+    readonly deriveKeyPairWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm, secretKey: Uint8Array) => ReallyMeXWingKeyPair;
     readonly encapsulate: (algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array) => ReallyMeXWingEncapsulation;
+    readonly encapsulateWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array) => ReallyMeXWingEncapsulation;
     readonly decapsulate: (algorithm: ReallyMeKemAlgorithm, ciphertext: Uint8Array, secretKey: Uint8Array) => Uint8Array;
+    readonly decapsulateWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm, ciphertext: Uint8Array, secretKey: Uint8Array) => Uint8Array;
 };
-export declare const encapsulateXWingDeterministicallyForTest: (algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array, seed: Uint8Array) => ReallyMeXWingEncapsulation;

package/dist/xWing.js

@@ -2,85 +2,85 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
-import { ensureBytes, readByteArrayProperty } from "./validateBytes.js";
+import { ensureBytes, readIndependentByteArrayProperty, readIndependentProviderBytes, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";
 export const X_WING_SECRET_KEY_LENGTH = 32;
-export const X_WING_ENCAPSULATION_SEED_LENGTH = 64;
 export const X_WING_SHARED_SECRET_LENGTH = 32;
 export const X_WING_768_PUBLIC_KEY_LENGTH = 1_216;
 export const X_WING_768_CIPHERTEXT_LENGTH = 1_120;
-export const X_WING_1024_PUBLIC_KEY_LENGTH = 1_600;
-export const X_WING_1024_CIPHERTEXT_LENGTH = 1_600;
 const xWingSuite = (algorithm) => {
+    return xWingSuiteWithProvider(algorithm, requireReallyMeWasmProvider());
+};
+const xWingSuiteWithProvider = (algorithm, provider) => {
     switch (algorithm) {
         case "ML-KEM-512":
         case "ML-KEM-768":
         case "ML-KEM-1024":
             throw new ReallyMeCryptoError("unsupported-algorithm");
         case "X-Wing-768": {
-            const provider = requireReallyMeWasmProvider();
             return {
                 publicKeyLength: X_WING_768_PUBLIC_KEY_LENGTH,
                 ciphertextLength: X_WING_768_CIPHERTEXT_LENGTH,
                 generateKeypair: provider.xWing768GenerateKeypair,
                 deriveKeypair: provider.xWing768DeriveKeypair,
                 encapsulate: provider.xWing768Encapsulate,
-                encapsulateDerand: provider.xWing768EncapsulateDerand,
                 decapsulate: provider.xWing768Decapsulate,
             };
         }
-        case "X-Wing-1024": {
-            const provider = requireReallyMeWasmProvider();
-            return {
-                publicKeyLength: X_WING_1024_PUBLIC_KEY_LENGTH,
-                ciphertextLength: X_WING_1024_CIPHERTEXT_LENGTH,
-                generateKeypair: provider.xWing1024GenerateKeypair,
-                deriveKeypair: provider.xWing1024DeriveKeypair,
-                encapsulate: provider.xWing1024Encapsulate,
-                encapsulateDerand: provider.xWing1024EncapsulateDerand,
-                decapsulate: provider.xWing1024Decapsulate,
-            };
-        }
     }
 };
-const readKeyPair = (value, suite) => ({
-    publicKey: readByteArrayProperty(value, "publicKey", suite.publicKeyLength),
-    secretKey: readByteArrayProperty(value, "secretKey", X_WING_SECRET_KEY_LENGTH),
-});
-const readEncapsulation = (value, suite) => ({
-    ciphertext: readByteArrayProperty(value, "ciphertext", suite.ciphertextLength),
-    sharedSecret: readByteArrayProperty(value, "sharedSecret", X_WING_SHARED_SECRET_LENGTH),
-});
+const readKeyPair = (value, suite, inputs = []) => {
+    const publicKey = readIndependentByteArrayProperty(value, "publicKey", suite.publicKeyLength, inputs);
+    const secretKey = readIndependentByteArrayProperty(value, "secretKey", X_WING_SECRET_KEY_LENGTH, [...inputs, publicKey]);
+    return { publicKey, secretKey };
+};
+const readEncapsulation = (value, suite, inputs) => {
+    const ciphertext = readIndependentByteArrayProperty(value, "ciphertext", suite.ciphertextLength, inputs);
+    const sharedSecret = readIndependentByteArrayProperty(value, "sharedSecret", X_WING_SHARED_SECRET_LENGTH, [...inputs, ciphertext]);
+    return { ciphertext, sharedSecret };
+};
+const readSharedSecret = (value, inputs) => {
+    return readIndependentProviderBytes(value, X_WING_SHARED_SECRET_LENGTH, inputs);
+};
 export const ReallyMeXWing = {
     generateKeyPair(algorithm) {
         const suite = xWingSuite(algorithm);
         return readKeyPair(suite.generateKeypair(), suite);
     },
+    generateKeyPairWithProvider(provider, algorithm) {
+        const suite = xWingSuiteWithProvider(algorithm, provider);
+        return readKeyPair(suite.generateKeypair(), suite);
+    },
     deriveKeyPair(algorithm, secretKey) {
         ensureBytes(secretKey, X_WING_SECRET_KEY_LENGTH);
         const suite = xWingSuite(algorithm);
-        return readKeyPair(suite.deriveKeypair(secretKey), suite);
+        return readKeyPair(suite.deriveKeypair(secretKey), suite, [secretKey]);
+    },
+    deriveKeyPairWithProvider(provider, algorithm, secretKey) {
+        ensureBytes(secretKey, X_WING_SECRET_KEY_LENGTH);
+        const suite = xWingSuiteWithProvider(algorithm, provider);
+        return readKeyPair(suite.deriveKeypair(secretKey), suite, [secretKey]);
     },
     encapsulate(algorithm, publicKey) {
         const suite = xWingSuite(algorithm);
         ensureBytes(publicKey, suite.publicKeyLength);
-        return readEncapsulation(suite.encapsulate(publicKey), suite);
+        return readEncapsulation(suite.encapsulate(publicKey), suite, [publicKey]);
+    },
+    encapsulateWithProvider(provider, algorithm, publicKey) {
+        const suite = xWingSuiteWithProvider(algorithm, provider);
+        ensureBytes(publicKey, suite.publicKeyLength);
+        return readEncapsulation(suite.encapsulate(publicKey), suite, [publicKey]);
     },
     decapsulate(algorithm, ciphertext, secretKey) {
         const suite = xWingSuite(algorithm);
         ensureBytes(ciphertext, suite.ciphertextLength);
         ensureBytes(secretKey, X_WING_SECRET_KEY_LENGTH);
-        const sharedSecret = suite.decapsulate(ciphertext, secretKey);
-        if (!(sharedSecret instanceof Uint8Array)) {
-            throw new ReallyMeCryptoError("provider-failure");
-        }
-        ensureBytes(sharedSecret, X_WING_SHARED_SECRET_LENGTH);
-        return sharedSecret;
+        return readSharedSecret(suite.decapsulate(ciphertext, secretKey), [ciphertext, secretKey]);
+    },
+    decapsulateWithProvider(provider, algorithm, ciphertext, secretKey) {
+        const suite = xWingSuiteWithProvider(algorithm, provider);
+        ensureBytes(ciphertext, suite.ciphertextLength);
+        ensureBytes(secretKey, X_WING_SECRET_KEY_LENGTH);
+        return readSharedSecret(suite.decapsulate(ciphertext, secretKey), [ciphertext, secretKey]);
     },
-};
-export const encapsulateXWingDeterministicallyForTest = (algorithm, publicKey, seed) => {
-    const suite = xWingSuite(algorithm);
-    ensureBytes(publicKey, suite.publicKeyLength);
-    ensureBytes(seed, X_WING_ENCAPSULATION_SEED_LENGTH);
-    return readEncapsulation(suite.encapsulateDerand(publicKey, seed), suite);
 };

package/package.json

@@ -1,8 +1,21 @@
 {
   "name": "@reallyme/crypto",
-  "version": "0.1.8",
+  "version": "0.3.0",
   "description": "ReallyMe crypto SDK for TypeScript/JavaScript with an explicit, pinned provider set.",
   "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/reallyme/crypto.git",
+    "directory": "packages/ts"
+  },
+  "homepage": "https://github.com/reallyme/crypto#readme",
+  "bugs": {
+    "url": "https://github.com/reallyme/crypto/issues"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -25,19 +38,24 @@
   },
   "files": [
     "dist",
+    "LICENSE",
     "README.md"
   ],
   "scripts": {
     "build": "node scripts/clean-dist.mjs && npm run build:wasm && tsc",
     "build:ts": "tsc",
     "build:wasm": "node scripts/build-wasm.mjs",
+    "pack:check": "node scripts/check-pack.mjs",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm test && npm run pack:check",
     "typecheck": "tsc --noEmit",
     "test": "npm run build && node --test \"test/*.test.mjs\""
   },
   "dependencies": {
     "@bufbuild/protobuf": "2.12.1",
     "@noble/curves": "2.2.0",
-    "@noble/hashes": "2.2.0"
+    "@noble/hashes": "2.2.0",
+    "@reallyme/codec": "0.2.0"
   },
   "devDependencies": {
     "typescript": "5.8.3"

package/dist/codecs.d.ts

@@ -1,35 +0,0 @@
-export type ReallyMeMulticodecTag = "encryption" | "hash" | "key" | "multihash" | "multikey";
-export type ReallyMeKeyMaterialKind = "not-key" | "public-key" | "private-key" | "symmetric-key";
-export type ReallyMeMulticodecMetadata = Readonly<{
-    name: string;
-    alg: string;
-    tag: ReallyMeMulticodecTag;
-    keyMaterial: ReallyMeKeyMaterialKind;
-    prefix: Uint8Array;
-    expectedKeyLength?: number;
-}>;
-export type ReallyMeParsedMultikey = Readonly<{
-    codecName: string;
-    algorithmName: string;
-    publicKey: Uint8Array;
-    expectedPublicKeyLength?: number;
-}>;
-export type ReallyMeDagCborCidVerification = Readonly<{
-    valid: boolean;
-    expectedCid: string;
-    actualCid: string;
-}>;
-export declare const ReallyMeCodecs: {
-    readonly base64urlEncode: (bytes: Uint8Array) => string;
-    readonly base64urlDecode: (encoded: string) => Uint8Array;
-    readonly base64urlDecodeBytes: (encoded: Uint8Array) => Uint8Array;
-    readonly multibaseBase64urlEncode: (bytes: Uint8Array) => string;
-    readonly multibaseBase58btcEncode: (bytes: Uint8Array) => string;
-    readonly multibaseDecode: (encoded: string) => Uint8Array;
-    readonly multicodecPrefixForName: (codecName: string) => ReallyMeMulticodecMetadata;
-    readonly multicodecLookupPrefix: (bytes: Uint8Array) => ReallyMeMulticodecMetadata;
-    readonly multikeyEncode: (codecName: string, publicKey: Uint8Array) => string;
-    readonly multikeyParse: (multikey: string) => ReallyMeParsedMultikey;
-    readonly dagCborComputeCid: (bytes: Uint8Array) => string;
-    readonly dagCborVerifyCid: (cid: string, bytes: Uint8Array) => ReallyMeDagCborCidVerification;
-};