@reallyme/crypto 0.1.8 → 0.3.0

package/dist/algorithms.d.ts

@@ -4,15 +4,23 @@ export declare const REALLYME_HASH_ALGORITHMS: readonly ["SHA2-256", "SHA2-384",
 export type ReallyMeHashAlgorithm = (typeof REALLYME_HASH_ALGORITHMS)[number];
 export declare const REALLYME_AEAD_ALGORITHMS: readonly ["AES-128-GCM", "AES-192-GCM", "AES-256-GCM", "AES-256-GCM-SIV", "ChaCha20-Poly1305", "XChaCha20-Poly1305"];
 export type ReallyMeAeadAlgorithm = (typeof REALLYME_AEAD_ALGORITHMS)[number];
-export declare const REALLYME_KEM_ALGORITHMS: readonly ["ML-KEM-512", "ML-KEM-768", "ML-KEM-1024", "X-Wing-768", "X-Wing-1024"];
+export declare const REALLYME_KEM_ALGORITHMS: readonly ["ML-KEM-512", "ML-KEM-768", "ML-KEM-1024", "X-Wing-768"];
 export type ReallyMeKemAlgorithm = (typeof REALLYME_KEM_ALGORITHMS)[number];
 export declare const REALLYME_KEY_AGREEMENT_ALGORITHMS: readonly ["X25519", "P-256-ECDH", "P-384-ECDH", "P-521-ECDH"];
 export type ReallyMeKeyAgreementAlgorithm = (typeof REALLYME_KEY_AGREEMENT_ALGORITHMS)[number];
-export declare const REALLYME_MAC_ALGORITHMS: readonly ["HMAC-SHA-256", "HMAC-SHA-512"];
+export declare const REALLYME_MAC_ALGORITHMS: readonly ["HMAC-SHA-256", "HMAC-SHA-384", "HMAC-SHA-512"];
 export type ReallyMeMacAlgorithm = (typeof REALLYME_MAC_ALGORITHMS)[number];
-export declare const REALLYME_KDF_ALGORITHMS: readonly ["HKDF-SHA256", "Argon2id", "PBKDF2-HMAC-SHA-256", "PBKDF2-HMAC-SHA-512", "JWA-CONCAT-KDF-SHA256"];
+export declare const REALLYME_KDF_ALGORITHMS: readonly ["HKDF-SHA256", "HKDF-SHA384", "Argon2id", "KMAC256", "PBKDF2-HMAC-SHA-256", "PBKDF2-HMAC-SHA-512", "JWA-CONCAT-KDF-SHA256"];
 export type ReallyMeKdfAlgorithm = (typeof REALLYME_KDF_ALGORITHMS)[number];
-export declare const REALLYME_KEY_WRAP_ALGORITHMS: readonly ["AES-256-KW"];
+/** PBKDF2 selectors accepted by the password-based `deriveKey` facade. */
+export type ReallyMePbkdf2Algorithm = Extract<ReallyMeKdfAlgorithm, "PBKDF2-HMAC-SHA-256" | "PBKDF2-HMAC-SHA-512">;
+/** HKDF selectors accepted by the `deriveHkdf` facade. */
+export type ReallyMeHkdfAlgorithm = Extract<ReallyMeKdfAlgorithm, "HKDF-SHA256" | "HKDF-SHA384">;
+/** JWA Concat KDF selector accepted by its dedicated facade. */
+export type ReallyMeJwaConcatKdfAlgorithm = Extract<ReallyMeKdfAlgorithm, "JWA-CONCAT-KDF-SHA256">;
+/** KMAC KDF selector accepted by its dedicated facade. */
+export type ReallyMeKmacKdfAlgorithm = Extract<ReallyMeKdfAlgorithm, "KMAC256">;
+export declare const REALLYME_KEY_WRAP_ALGORITHMS: readonly ["AES-128-KW", "AES-192-KW", "AES-256-KW"];
 export type ReallyMeKeyWrapAlgorithm = (typeof REALLYME_KEY_WRAP_ALGORITHMS)[number];
 export declare const REALLYME_HPKE_SUITES: readonly ["DHKEM-P256-HKDF-SHA256-HKDF-SHA256-AES-256-GCM", "DHKEM-X25519-HKDF-SHA256-HKDF-SHA256-CHACHA20-POLY1305"];
 export type ReallyMeHpkeSuite = (typeof REALLYME_HPKE_SUITES)[number];

package/dist/algorithms.js

@@ -43,7 +43,6 @@ export const REALLYME_KEM_ALGORITHMS = [
     "ML-KEM-768",
     "ML-KEM-1024",
     "X-Wing-768",
-    "X-Wing-1024",
 ];
 export const REALLYME_KEY_AGREEMENT_ALGORITHMS = [
     "X25519",
@@ -53,16 +52,23 @@ export const REALLYME_KEY_AGREEMENT_ALGORITHMS = [
 ];
 export const REALLYME_MAC_ALGORITHMS = [
     "HMAC-SHA-256",
+    "HMAC-SHA-384",
     "HMAC-SHA-512",
 ];
 export const REALLYME_KDF_ALGORITHMS = [
     "HKDF-SHA256",
+    "HKDF-SHA384",
     "Argon2id",
+    "KMAC256",
     "PBKDF2-HMAC-SHA-256",
     "PBKDF2-HMAC-SHA-512",
     "JWA-CONCAT-KDF-SHA256",
 ];
-export const REALLYME_KEY_WRAP_ALGORITHMS = ["AES-256-KW"];
+export const REALLYME_KEY_WRAP_ALGORITHMS = [
+    "AES-128-KW",
+    "AES-192-KW",
+    "AES-256-KW",
+];
 export const REALLYME_HPKE_SUITES = [
     "DHKEM-P256-HKDF-SHA256-HKDF-SHA256-AES-256-GCM",
     "DHKEM-X25519-HKDF-SHA256-HKDF-SHA256-CHACHA20-POLY1305",

package/dist/argon2id.d.ts

@@ -1,8 +1,11 @@
+import type { ReallyMeWasmProvider } from "./wasmProvider.js";
 export declare const ARGON2ID_DERIVED_KEY_LENGTH = 32;
 export declare const ARGON2ID_SALT_MIN_LENGTH = 16;
 export declare const ARGON2ID_SALT_MAX_LENGTH = 32;
+export declare const ARGON2ID_SECRET_MAX_LENGTH = 1048576;
 export declare const ARGON2ID_V1 = 1;
 export declare const ARGON2ID_V2 = 2;
 export declare const ReallyMeArgon2id: {
     readonly deriveKey: (kdfVersion: number, secret: Uint8Array, salt: Uint8Array) => Uint8Array;
+    readonly deriveKeyWithProvider: (provider: ReallyMeWasmProvider, kdfVersion: number, secret: Uint8Array, salt: Uint8Array) => Uint8Array;
 };

package/dist/argon2id.js

@@ -2,10 +2,12 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArrayAtMost, ensureIndependentByteArray, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";
 export const ARGON2ID_DERIVED_KEY_LENGTH = 32;
 export const ARGON2ID_SALT_MIN_LENGTH = 16;
 export const ARGON2ID_SALT_MAX_LENGTH = 32;
+export const ARGON2ID_SECRET_MAX_LENGTH = 1_048_576;
 export const ARGON2ID_V1 = 1;
 export const ARGON2ID_V2 = 2;
 const validateVersion = (kdfVersion) => {
@@ -15,17 +17,24 @@ const validateVersion = (kdfVersion) => {
     }
 };
 const validateSecret = (secret) => {
+    ensureByteArrayAtMost(secret, ARGON2ID_SECRET_MAX_LENGTH);
     if (secret.length === 0) {
         throw new ReallyMeCryptoError("invalid-input");
     }
 };
 const validateSalt = (salt) => {
+    ensureByteArrayAtMost(salt, ARGON2ID_SALT_MAX_LENGTH);
     if (salt.length < ARGON2ID_SALT_MIN_LENGTH || salt.length > ARGON2ID_SALT_MAX_LENGTH) {
         throw new ReallyMeCryptoError("invalid-input");
     }
 };
-const requireDerivedKey = (value) => {
-    if (!(value instanceof Uint8Array) || value.length !== ARGON2ID_DERIVED_KEY_LENGTH) {
+const requireDerivedKey = (value, inputs) => {
+    if (!(value instanceof Uint8Array)) {
+        throw new ReallyMeCryptoError("provider-failure");
+    }
+    ensureIndependentByteArray(value, inputs);
+    if (value.length !== ARGON2ID_DERIVED_KEY_LENGTH) {
+        value.fill(0);
         throw new ReallyMeCryptoError("provider-failure");
     }
     return value;
@@ -35,6 +44,12 @@ export const ReallyMeArgon2id = {
         validateVersion(kdfVersion);
         validateSecret(secret);
         validateSalt(salt);
-        return requireDerivedKey(requireReallyMeWasmProvider().argon2idDeriveKey(kdfVersion, secret, salt));
+        return requireDerivedKey(requireReallyMeWasmProvider().argon2idDeriveKey(kdfVersion, secret, salt), [secret, salt]);
+    },
+    deriveKeyWithProvider(provider, kdfVersion, secret, salt) {
+        validateVersion(kdfVersion);
+        validateSecret(secret);
+        validateSalt(salt);
+        return requireDerivedKey(provider.argon2idDeriveKey(kdfVersion, secret, salt), [secret, salt]);
     },
 };

package/dist/cryptoFacade.d.ts

@@ -1,5 +1,6 @@
-import type { ReallyMeAeadAlgorithm, ReallyMeHashAlgorithm, ReallyMeHpkeSuite, ReallyMeKdfAlgorithm, ReallyMeKemAlgorithm, ReallyMeKeyAgreementAlgorithm, ReallyMeKeyWrapAlgorithm, ReallyMeMacAlgorithm, ReallyMeSignatureAlgorithm } from "./algorithms.js";
+import type { ReallyMeAeadAlgorithm, ReallyMeHashAlgorithm, ReallyMeHkdfAlgorithm, ReallyMeHpkeSuite, ReallyMeJwaConcatKdfAlgorithm, ReallyMeKemAlgorithm, ReallyMeKeyAgreementAlgorithm, ReallyMeKeyWrapAlgorithm, ReallyMeKmacKdfAlgorithm, ReallyMeMacAlgorithm, ReallyMePbkdf2Algorithm, ReallyMeSignatureAlgorithm } from "./algorithms.js";
 import type { ReallyMeRsaPublicKeyDerEncoding } from "./rsa.js";
+import type { ReallyMeWasmProvider } from "./wasmProvider.js";
 export type ReallyMeSignatureKeyPair = Readonly<{
     publicKey: Uint8Array;
     secretKey: Uint8Array;
@@ -20,20 +21,78 @@ export type ReallyMeHpkeSealedMessage = Readonly<{
     encapsulatedKey: Uint8Array;
     ciphertext: Uint8Array;
 }>;
+export type ReallyMeCryptoProviders = Readonly<{
+    wasmProvider?: ReallyMeWasmProvider;
+}>;
 /**
  * Generic package facade. Algorithm-specific objects remain available for
  * callers that want direct provider access; this facade gives consumers a
- * stable typed route that fails closed for not-yet-exposed algorithms.
+ * stable typed route and rejects algorithm/operation combinations that the
+ * selected method does not define.
  */
+declare const createReallyMeCryptoFacade: (resolveWasmProvider: () => ReallyMeWasmProvider) => {
+    /**
+     * Executes a generated binary request and returns a binary
+     * `CryptoOperationResponse`.
+     */
+    readonly processOperationResponse: (request: Uint8Array) => Uint8Array;
+    /**
+     * Executes a permitted non-secret generated ProtoJSON request and returns
+     * the same binary `CryptoOperationResponse`. Secret-bearing selectors fail
+     * before JSON value deserialization.
+     */
+    readonly processOperationResponseJson: (requestJson: Uint8Array) => Uint8Array;
+    readonly hash: (algorithm: ReallyMeHashAlgorithm, bytes: Uint8Array) => Uint8Array;
+    readonly seal: (algorithm: ReallyMeAeadAlgorithm, key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array) => Uint8Array;
+    readonly open: (algorithm: ReallyMeAeadAlgorithm, key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ciphertextWithTag: Uint8Array) => Uint8Array;
+    readonly authenticate: (algorithm: ReallyMeMacAlgorithm, key: Uint8Array, message: Uint8Array) => Uint8Array;
+    readonly verifyMac: (algorithm: ReallyMeMacAlgorithm, tag: Uint8Array, key: Uint8Array, message: Uint8Array) => boolean;
+    readonly deriveArgon2id: (kdfVersion: number, secret: Uint8Array, salt: Uint8Array) => Uint8Array;
+    readonly deriveKey: (algorithm: ReallyMePbkdf2Algorithm, password: Uint8Array, salt: Uint8Array, iterations: number, outputLength: number) => Uint8Array;
+    readonly deriveHkdf: (algorithm: ReallyMeHkdfAlgorithm, inputKeyMaterial: Uint8Array, salt: Uint8Array, info: Uint8Array, outputLength: number) => Uint8Array;
+    readonly deriveJwaConcatKdfSha256: (algorithm: ReallyMeJwaConcatKdfAlgorithm, sharedSecret: Uint8Array, algorithmId: Uint8Array, partyUInfo: Uint8Array, partyVInfo: Uint8Array, outputLength: number) => Uint8Array;
+    readonly deriveKmac256: (algorithm: ReallyMeKmacKdfAlgorithm, key: Uint8Array, context: Uint8Array, customization: Uint8Array, outputLength: number) => Uint8Array;
+    readonly wrapKey: (algorithm: ReallyMeKeyWrapAlgorithm, wrappingKey: Uint8Array, keyToWrap: Uint8Array) => Uint8Array;
+    readonly unwrapKey: (algorithm: ReallyMeKeyWrapAlgorithm, wrappingKey: Uint8Array, wrappedKey: Uint8Array) => Uint8Array;
+    readonly generateKeyPair: (algorithm: ReallyMeSignatureAlgorithm) => ReallyMeSignatureKeyPair;
+    readonly deriveKeyPair: (algorithm: ReallyMeSignatureAlgorithm, secretKey: Uint8Array) => ReallyMeSignatureKeyPair;
+    readonly sign: (algorithm: ReallyMeSignatureAlgorithm, message: Uint8Array, secretKey: Uint8Array) => Uint8Array;
+    readonly signBip340Schnorr: (message32: Uint8Array, secretKey: Uint8Array, auxRand32: Uint8Array) => Uint8Array;
+    readonly verify: (algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array) => void;
+    readonly verifyRsa: (algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKeyDer: Uint8Array, publicKeyEncoding: ReallyMeRsaPublicKeyDerEncoding) => void;
+    readonly deriveSharedSecret: (algorithm: ReallyMeKeyAgreementAlgorithm, publicKey: Uint8Array, secretKey: Uint8Array) => Uint8Array;
+    readonly deriveKeyAgreementKeyPair: (algorithm: ReallyMeKeyAgreementAlgorithm, secretKey: Uint8Array) => ReallyMeKeyAgreementKeyPair;
+    readonly generateKemKeyPair: (algorithm: ReallyMeKemAlgorithm) => ReallyMeKemKeyPair;
+    readonly deriveKemKeyPair: (algorithm: ReallyMeKemAlgorithm, secretKey: Uint8Array) => ReallyMeKemKeyPair;
+    readonly encapsulate: (algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array) => ReallyMeKemEncapsulation;
+    readonly decapsulate: (algorithm: ReallyMeKemAlgorithm, ciphertext: Uint8Array, secretKey: Uint8Array) => Uint8Array;
+    readonly sealHpke: (suite: ReallyMeHpkeSuite, recipientPublicKey: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array) => ReallyMeHpkeSealedMessage;
+    readonly openHpke: (suite: ReallyMeHpkeSuite, recipientSecretKey: Uint8Array, encapsulatedKey: Uint8Array, info: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array) => Uint8Array;
+};
+export type ReallyMeCryptoFacade = ReturnType<typeof createReallyMeCryptoFacade>;
+export declare const createReallyMeCrypto: (providers?: ReallyMeCryptoProviders) => ReallyMeCryptoFacade;
 export declare const ReallyMeCrypto: {
+    /**
+     * Executes a generated binary request and returns a binary
+     * `CryptoOperationResponse`.
+     */
+    readonly processOperationResponse: (request: Uint8Array) => Uint8Array;
+    /**
+     * Executes a permitted non-secret generated ProtoJSON request and returns
+     * the same binary `CryptoOperationResponse`. Secret-bearing selectors fail
+     * before JSON value deserialization.
+     */
+    readonly processOperationResponseJson: (requestJson: Uint8Array) => Uint8Array;
     readonly hash: (algorithm: ReallyMeHashAlgorithm, bytes: Uint8Array) => Uint8Array;
     readonly seal: (algorithm: ReallyMeAeadAlgorithm, key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array) => Uint8Array;
     readonly open: (algorithm: ReallyMeAeadAlgorithm, key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ciphertextWithTag: Uint8Array) => Uint8Array;
     readonly authenticate: (algorithm: ReallyMeMacAlgorithm, key: Uint8Array, message: Uint8Array) => Uint8Array;
     readonly verifyMac: (algorithm: ReallyMeMacAlgorithm, tag: Uint8Array, key: Uint8Array, message: Uint8Array) => boolean;
-    readonly deriveKey: (algorithm: ReallyMeKdfAlgorithm, password: Uint8Array, salt: Uint8Array, iterations: number, outputLength: number) => Uint8Array;
-    readonly deriveHkdf: (algorithm: ReallyMeKdfAlgorithm, inputKeyMaterial: Uint8Array, salt: Uint8Array, info: Uint8Array, outputLength: number) => Uint8Array;
-    readonly deriveJwaConcatKdfSha256: (algorithm: ReallyMeKdfAlgorithm, sharedSecret: Uint8Array, algorithmId: Uint8Array, partyUInfo: Uint8Array, partyVInfo: Uint8Array, outputLength: number) => Uint8Array;
+    readonly deriveArgon2id: (kdfVersion: number, secret: Uint8Array, salt: Uint8Array) => Uint8Array;
+    readonly deriveKey: (algorithm: ReallyMePbkdf2Algorithm, password: Uint8Array, salt: Uint8Array, iterations: number, outputLength: number) => Uint8Array;
+    readonly deriveHkdf: (algorithm: ReallyMeHkdfAlgorithm, inputKeyMaterial: Uint8Array, salt: Uint8Array, info: Uint8Array, outputLength: number) => Uint8Array;
+    readonly deriveJwaConcatKdfSha256: (algorithm: ReallyMeJwaConcatKdfAlgorithm, sharedSecret: Uint8Array, algorithmId: Uint8Array, partyUInfo: Uint8Array, partyVInfo: Uint8Array, outputLength: number) => Uint8Array;
+    readonly deriveKmac256: (algorithm: ReallyMeKmacKdfAlgorithm, key: Uint8Array, context: Uint8Array, customization: Uint8Array, outputLength: number) => Uint8Array;
     readonly wrapKey: (algorithm: ReallyMeKeyWrapAlgorithm, wrappingKey: Uint8Array, keyToWrap: Uint8Array) => Uint8Array;
     readonly unwrapKey: (algorithm: ReallyMeKeyWrapAlgorithm, wrappingKey: Uint8Array, wrappedKey: Uint8Array) => Uint8Array;
     readonly generateKeyPair: (algorithm: ReallyMeSignatureAlgorithm) => ReallyMeSignatureKeyPair;
@@ -45,8 +104,10 @@ export declare const ReallyMeCrypto: {
     readonly deriveSharedSecret: (algorithm: ReallyMeKeyAgreementAlgorithm, publicKey: Uint8Array, secretKey: Uint8Array) => Uint8Array;
     readonly deriveKeyAgreementKeyPair: (algorithm: ReallyMeKeyAgreementAlgorithm, secretKey: Uint8Array) => ReallyMeKeyAgreementKeyPair;
     readonly generateKemKeyPair: (algorithm: ReallyMeKemAlgorithm) => ReallyMeKemKeyPair;
+    readonly deriveKemKeyPair: (algorithm: ReallyMeKemAlgorithm, secretKey: Uint8Array) => ReallyMeKemKeyPair;
     readonly encapsulate: (algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array) => ReallyMeKemEncapsulation;
     readonly decapsulate: (algorithm: ReallyMeKemAlgorithm, ciphertext: Uint8Array, secretKey: Uint8Array) => Uint8Array;
     readonly sealHpke: (suite: ReallyMeHpkeSuite, recipientPublicKey: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array) => ReallyMeHpkeSealedMessage;
     readonly openHpke: (suite: ReallyMeHpkeSuite, recipientSecretKey: Uint8Array, encapsulatedKey: Uint8Array, info: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array) => Uint8Array;
 };
+export {};

package/dist/cryptoFacade.js

@@ -12,6 +12,7 @@ import { ReallyMeHkdf } from "./hkdf.js";
 import { ReallyMeHmac } from "./hmac.js";
 import { ReallyMeHpke } from "./hpke.js";
 import { ReallyMeJwaConcatKdf } from "./jwaConcatKdf.js";
+import { ReallyMeKmac } from "./kmac.js";
 import { ReallyMeMlDsa } from "./mlDsa.js";
 import { ReallyMeMlKem } from "./mlKem.js";
 import { ReallyMeP256Ecdsa } from "./p256Ecdsa.js";
@@ -24,6 +25,9 @@ import { ReallyMePbkdf2 } from "./pbkdf2.js";
 import { ReallyMeRsa } from "./rsa.js";
 import { ReallyMeSecp256k1 } from "./secp256k1.js";
 import { ReallyMeSlhDsa } from "./slhDsa.js";
+import { requireReallyMeWasmProvider } from "./wasmProvider.js";
+import { processOperationResponseJsonWithProvider, processOperationResponseWithProvider, } from "./operationResponse.js";
+import { ensureByteArray } from "./validateBytes.js";
 import { ReallyMeX25519 } from "./x25519.js";
 import { ReallyMeXWing } from "./xWing.js";
 const SECP256K1_ECDSA = "ECDSA-secp256k1-SHA256";
@@ -35,9 +39,27 @@ const ED25519 = "Ed25519";
 /**
  * Generic package facade. Algorithm-specific objects remain available for
  * callers that want direct provider access; this facade gives consumers a
- * stable typed route that fails closed for not-yet-exposed algorithms.
+ * stable typed route and rejects algorithm/operation combinations that the
+ * selected method does not define.
  */
-export const ReallyMeCrypto = {
+const createReallyMeCryptoFacade = (resolveWasmProvider) => ({
+    /**
+     * Executes a generated binary request and returns a binary
+     * `CryptoOperationResponse`.
+     */
+    processOperationResponse(request) {
+        ensureByteArray(request);
+        return processOperationResponseWithProvider(resolveWasmProvider(), request);
+    },
+    /**
+     * Executes a permitted non-secret generated ProtoJSON request and returns
+     * the same binary `CryptoOperationResponse`. Secret-bearing selectors fail
+     * before JSON value deserialization.
+     */
+    processOperationResponseJson(requestJson) {
+        ensureByteArray(requestJson);
+        return processOperationResponseJsonWithProvider(resolveWasmProvider(), requestJson);
+    },
     hash(algorithm, bytes) {
         switch (algorithm) {
             case "SHA2-256":
@@ -66,7 +88,7 @@ export const ReallyMeCrypto = {
             case "AES-256-GCM-SIV":
             case "ChaCha20-Poly1305":
             case "XChaCha20-Poly1305":
-                return ReallyMeAead.seal(algorithm, key, nonce, aad, plaintext);
+                return ReallyMeAead.sealWithProvider(resolveWasmProvider(), algorithm, key, nonce, aad, plaintext);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -79,7 +101,7 @@ export const ReallyMeCrypto = {
             case "AES-256-GCM-SIV":
             case "ChaCha20-Poly1305":
             case "XChaCha20-Poly1305":
-                return ReallyMeAead.open(algorithm, key, nonce, aad, ciphertextWithTag);
+                return ReallyMeAead.openWithProvider(resolveWasmProvider(), algorithm, key, nonce, aad, ciphertextWithTag);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -88,6 +110,8 @@ export const ReallyMeCrypto = {
         switch (algorithm) {
             case "HMAC-SHA-256":
                 return ReallyMeHmac.authenticateSha256(key, message);
+            case "HMAC-SHA-384":
+                return ReallyMeHmac.authenticateSha384(key, message);
             case "HMAC-SHA-512":
                 return ReallyMeHmac.authenticateSha512(key, message);
             default:
@@ -98,22 +122,23 @@ export const ReallyMeCrypto = {
         switch (algorithm) {
             case "HMAC-SHA-256":
                 return ReallyMeHmac.verifySha256(tag, key, message);
+            case "HMAC-SHA-384":
+                return ReallyMeHmac.verifySha384(tag, key, message);
             case "HMAC-SHA-512":
                 return ReallyMeHmac.verifySha512(tag, key, message);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
     },
+    deriveArgon2id(kdfVersion, secret, salt) {
+        return ReallyMeArgon2id.deriveKeyWithProvider(resolveWasmProvider(), kdfVersion, secret, salt);
+    },
     deriveKey(algorithm, password, salt, iterations, outputLength) {
         switch (algorithm) {
-            case "Argon2id":
-                return ReallyMeArgon2id.deriveKey(iterations, password, salt);
             case "PBKDF2-HMAC-SHA-256":
                 return ReallyMePbkdf2.deriveHmacSha256(password, salt, iterations, outputLength);
             case "PBKDF2-HMAC-SHA-512":
                 return ReallyMePbkdf2.deriveHmacSha512(password, salt, iterations, outputLength);
-            case "HKDF-SHA256":
-                throw new ReallyMeCryptoError("unsupported-algorithm");
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -122,11 +147,8 @@ export const ReallyMeCrypto = {
         switch (algorithm) {
             case "HKDF-SHA256":
                 return ReallyMeHkdf.deriveSha256(inputKeyMaterial, salt, info, outputLength);
-            case "Argon2id":
-            case "PBKDF2-HMAC-SHA-256":
-            case "PBKDF2-HMAC-SHA-512":
-            case "JWA-CONCAT-KDF-SHA256":
-                throw new ReallyMeCryptoError("unsupported-algorithm");
+            case "HKDF-SHA384":
+                return ReallyMeHkdf.deriveSha384(inputKeyMaterial, salt, info, outputLength);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -135,27 +157,34 @@ export const ReallyMeCrypto = {
         switch (algorithm) {
             case "JWA-CONCAT-KDF-SHA256":
                 return ReallyMeJwaConcatKdf.deriveSha256(sharedSecret, algorithmId, partyUInfo, partyVInfo, outputLength);
-            case "Argon2id":
-            case "HKDF-SHA256":
-            case "PBKDF2-HMAC-SHA-256":
-            case "PBKDF2-HMAC-SHA-512":
+            default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    deriveKmac256(algorithm, key, context, customization, outputLength) {
+        switch (algorithm) {
+            case "KMAC256":
+                return ReallyMeKmac.deriveKmac256WithProvider(resolveWasmProvider(), key, context, customization, outputLength);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
     },
     wrapKey(algorithm, wrappingKey, keyToWrap) {
         switch (algorithm) {
+            case "AES-128-KW":
+            case "AES-192-KW":
             case "AES-256-KW":
-                return ReallyMeAesKw.wrapKey(wrappingKey, keyToWrap);
+                return ReallyMeAesKw.wrapKeyWithProvider(algorithm, resolveWasmProvider(), wrappingKey, keyToWrap);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
     },
     unwrapKey(algorithm, wrappingKey, wrappedKey) {
         switch (algorithm) {
+            case "AES-128-KW":
+            case "AES-192-KW":
             case "AES-256-KW":
-                return ReallyMeAesKw.unwrapKey(wrappingKey, wrappedKey);
+                return ReallyMeAesKw.unwrapKeyWithProvider(algorithm, resolveWasmProvider(), wrappingKey, wrappedKey);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -178,9 +207,9 @@ export const ReallyMeCrypto = {
             case "ML-DSA-44":
             case "ML-DSA-65":
             case "ML-DSA-87":
-                return ReallyMeMlDsa.generateKeyPair(algorithm);
+                return ReallyMeMlDsa.generateKeyPairWithProvider(resolveWasmProvider(), algorithm);
             case "SLH-DSA-SHA2-128s":
-                return ReallyMeSlhDsa.generateKeyPair(algorithm);
+                return ReallyMeSlhDsa.generateKeyPairWithProvider(resolveWasmProvider(), algorithm);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -206,7 +235,7 @@ export const ReallyMeCrypto = {
             case "ML-DSA-44":
             case "ML-DSA-65":
             case "ML-DSA-87":
-                return ReallyMeMlDsa.deriveKeyPair(algorithm, secretKey);
+                return ReallyMeMlDsa.deriveKeyPairWithProvider(resolveWasmProvider(), algorithm, secretKey);
             case "SLH-DSA-SHA2-128s":
                 // SLH-DSA deterministic derivation uses three FIPS seed components,
                 // so it deliberately does not fit this single-secret import shape.
@@ -231,9 +260,9 @@ export const ReallyMeCrypto = {
             case "ML-DSA-44":
             case "ML-DSA-65":
             case "ML-DSA-87":
-                return ReallyMeMlDsa.sign(algorithm, message, secretKey);
+                return ReallyMeMlDsa.signWithProvider(resolveWasmProvider(), algorithm, message, secretKey);
             case "SLH-DSA-SHA2-128s":
-                return ReallyMeSlhDsa.sign(algorithm, message, secretKey);
+                return ReallyMeSlhDsa.signWithProvider(resolveWasmProvider(), algorithm, message, secretKey);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -265,17 +294,30 @@ export const ReallyMeCrypto = {
             case "ML-DSA-44":
             case "ML-DSA-65":
             case "ML-DSA-87":
-                ReallyMeMlDsa.verify(algorithm, signature, message, publicKey);
+                ReallyMeMlDsa.verifyWithProvider(resolveWasmProvider(), algorithm, signature, message, publicKey);
                 return;
             case "SLH-DSA-SHA2-128s":
-                ReallyMeSlhDsa.verify(algorithm, signature, message, publicKey);
+                ReallyMeSlhDsa.verifyWithProvider(resolveWasmProvider(), algorithm, signature, message, publicKey);
                 return;
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
     },
     verifyRsa(algorithm, signature, message, publicKeyDer, publicKeyEncoding) {
-        ReallyMeRsa.verify(algorithm, signature, message, publicKeyDer, publicKeyEncoding);
+        switch (algorithm) {
+            case "RSA-PKCS1v15-SHA1":
+            case "RSA-PKCS1v15-SHA256":
+            case "RSA-PKCS1v15-SHA384":
+            case "RSA-PKCS1v15-SHA512":
+            case "RSA-PSS-SHA1-MGF1-SHA1":
+            case "RSA-PSS-SHA256-MGF1-SHA256":
+            case "RSA-PSS-SHA384-MGF1-SHA384":
+            case "RSA-PSS-SHA512-MGF1-SHA512":
+                ReallyMeRsa.verifyWithProvider(resolveWasmProvider(), algorithm, signature, message, publicKeyDer, publicKeyEncoding);
+                return;
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
     },
     deriveSharedSecret(algorithm, publicKey, secretKey) {
         switch (algorithm) {
@@ -308,12 +350,23 @@ export const ReallyMeCrypto = {
     generateKemKeyPair(algorithm) {
         switch (algorithm) {
             case "X-Wing-768":
-            case "X-Wing-1024":
-                return ReallyMeXWing.generateKeyPair(algorithm);
+                return ReallyMeXWing.generateKeyPairWithProvider(resolveWasmProvider(), algorithm);
             case "ML-KEM-512":
             case "ML-KEM-768":
             case "ML-KEM-1024":
-                return ReallyMeMlKem.generateKeyPair(algorithm);
+                return ReallyMeMlKem.generateKeyPairWithProvider(resolveWasmProvider(), algorithm);
+            default:
+                throw new ReallyMeCryptoError("unsupported-algorithm");
+        }
+    },
+    deriveKemKeyPair(algorithm, secretKey) {
+        switch (algorithm) {
+            case "X-Wing-768":
+                return ReallyMeXWing.deriveKeyPairWithProvider(resolveWasmProvider(), algorithm, secretKey);
+            case "ML-KEM-512":
+            case "ML-KEM-768":
+            case "ML-KEM-1024":
+                return ReallyMeMlKem.deriveKeyPairWithProvider(resolveWasmProvider(), algorithm, secretKey);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -321,12 +374,11 @@ export const ReallyMeCrypto = {
     encapsulate(algorithm, publicKey) {
         switch (algorithm) {
             case "X-Wing-768":
-            case "X-Wing-1024":
-                return ReallyMeXWing.encapsulate(algorithm, publicKey);
+                return ReallyMeXWing.encapsulateWithProvider(resolveWasmProvider(), algorithm, publicKey);
             case "ML-KEM-512":
             case "ML-KEM-768":
             case "ML-KEM-1024":
-                return ReallyMeMlKem.encapsulate(algorithm, publicKey);
+                return ReallyMeMlKem.encapsulateWithProvider(resolveWasmProvider(), algorithm, publicKey);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -334,12 +386,11 @@ export const ReallyMeCrypto = {
     decapsulate(algorithm, ciphertext, secretKey) {
         switch (algorithm) {
             case "X-Wing-768":
-            case "X-Wing-1024":
-                return ReallyMeXWing.decapsulate(algorithm, ciphertext, secretKey);
+                return ReallyMeXWing.decapsulateWithProvider(resolveWasmProvider(), algorithm, ciphertext, secretKey);
             case "ML-KEM-512":
             case "ML-KEM-768":
             case "ML-KEM-1024":
-                return ReallyMeMlKem.decapsulate(algorithm, ciphertext, secretKey);
+                return ReallyMeMlKem.decapsulateWithProvider(resolveWasmProvider(), algorithm, ciphertext, secretKey);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -348,7 +399,7 @@ export const ReallyMeCrypto = {
         switch (suite) {
             case "DHKEM-P256-HKDF-SHA256-HKDF-SHA256-AES-256-GCM":
             case "DHKEM-X25519-HKDF-SHA256-HKDF-SHA256-CHACHA20-POLY1305":
-                return ReallyMeHpke.sealBase(suite, recipientPublicKey, info, aad, plaintext);
+                return ReallyMeHpke.sealBaseWithProvider(resolveWasmProvider(), suite, recipientPublicKey, info, aad, plaintext);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
@@ -357,9 +408,19 @@ export const ReallyMeCrypto = {
         switch (suite) {
             case "DHKEM-P256-HKDF-SHA256-HKDF-SHA256-AES-256-GCM":
             case "DHKEM-X25519-HKDF-SHA256-HKDF-SHA256-CHACHA20-POLY1305":
-                return ReallyMeHpke.openBase(suite, recipientSecretKey, encapsulatedKey, info, aad, ciphertext);
+                return ReallyMeHpke.openBaseWithProvider(resolveWasmProvider(), suite, recipientSecretKey, encapsulatedKey, info, aad, ciphertext);
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }
     },
+});
+export const createReallyMeCrypto = (providers = {}) => {
+    const configuredProvider = providers.wasmProvider;
+    return createReallyMeCryptoFacade(() => {
+        if (configuredProvider === undefined) {
+            throw new ReallyMeCryptoError("provider-failure");
+        }
+        return configuredProvider;
+    });
 };
+export const ReallyMeCrypto = createReallyMeCryptoFacade(requireReallyMeWasmProvider);

package/dist/errors.d.ts

@@ -3,7 +3,7 @@
  * user-provided bytes so callers can log them without leaking key material
  * or PII.
  */
-export type ReallyMeCryptoErrorCode = "invalid-input" | "invalid-signature" | "provider-failure" | "unsupported-algorithm";
+export type ReallyMeCryptoErrorCode = "invalid-input" | "invalid-signature" | "authentication-failed" | "provider-failure" | "unsupported-algorithm";
 export declare class ReallyMeCryptoError extends Error {
     readonly code: ReallyMeCryptoErrorCode;
     constructor(code: ReallyMeCryptoErrorCode);

package/dist/hkdf.d.ts

@@ -4,4 +4,5 @@ export declare const HKDF_MIN_OUTPUT_LENGTH = 1;
 export declare const HKDF_MAX_OUTPUT_LENGTH = 4096;
 export declare const ReallyMeHkdf: {
     readonly deriveSha256: (inputKeyMaterial: Uint8Array, salt: Uint8Array, info: Uint8Array, outputLength: number) => Uint8Array;
+    readonly deriveSha384: (inputKeyMaterial: Uint8Array, salt: Uint8Array, info: Uint8Array, outputLength: number) => Uint8Array;
 };

package/dist/hkdf.js

@@ -2,7 +2,7 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 import { hkdf } from "@noble/hashes/hkdf.js";
-import { sha256 } from "@noble/hashes/sha2.js";
+import { sha256, sha384 } from "@noble/hashes/sha2.js";
 import { ReallyMeCryptoError } from "./errors.js";
 export const HKDF_MIN_INPUT_KEY_MATERIAL_LENGTH = 1;
 export const HKDF_MAX_INPUT_LENGTH = 4096;
@@ -13,6 +13,10 @@ export const ReallyMeHkdf = {
         validate(inputKeyMaterial, salt, info, outputLength);
         return hkdf(sha256, inputKeyMaterial, salt, info, outputLength);
     },
+    deriveSha384(inputKeyMaterial, salt, info, outputLength) {
+        validate(inputKeyMaterial, salt, info, outputLength);
+        return hkdf(sha384, inputKeyMaterial, salt, info, outputLength);
+    },
 };
 function validate(inputKeyMaterial, salt, info, outputLength) {
     if (inputKeyMaterial.length < HKDF_MIN_INPUT_KEY_MATERIAL_LENGTH ||

package/dist/hmac.d.ts

@@ -1,9 +1,12 @@
 export declare const HMAC_MAX_KEY_LENGTH = 4096;
 export declare const HMAC_SHA256_TAG_LENGTH = 32;
+export declare const HMAC_SHA384_TAG_LENGTH = 48;
 export declare const HMAC_SHA512_TAG_LENGTH = 64;
 export declare const ReallyMeHmac: {
     readonly authenticateSha256: (key: Uint8Array, message: Uint8Array) => Uint8Array;
+    readonly authenticateSha384: (key: Uint8Array, message: Uint8Array) => Uint8Array;
     readonly authenticateSha512: (key: Uint8Array, message: Uint8Array) => Uint8Array;
     readonly verifySha256: (tag: Uint8Array, key: Uint8Array, message: Uint8Array) => boolean;
+    readonly verifySha384: (tag: Uint8Array, key: Uint8Array, message: Uint8Array) => boolean;
     readonly verifySha512: (tag: Uint8Array, key: Uint8Array, message: Uint8Array) => boolean;
 };

package/dist/hmac.js

@@ -2,16 +2,21 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 import { hmac } from "@noble/hashes/hmac.js";
-import { sha256, sha512 } from "@noble/hashes/sha2.js";
+import { sha256, sha384, sha512 } from "@noble/hashes/sha2.js";
 import { ReallyMeCryptoError } from "./errors.js";
 export const HMAC_MAX_KEY_LENGTH = 4096;
 export const HMAC_SHA256_TAG_LENGTH = 32;
+export const HMAC_SHA384_TAG_LENGTH = 48;
 export const HMAC_SHA512_TAG_LENGTH = 64;
 export const ReallyMeHmac = {
     authenticateSha256(key, message) {
         validateKey(key);
         return hmac(sha256, key, message);
     },
+    authenticateSha384(key, message) {
+        validateKey(key);
+        return hmac(sha384, key, message);
+    },
     authenticateSha512(key, message) {
         validateKey(key);
         return hmac(sha512, key, message);
@@ -20,13 +25,19 @@ export const ReallyMeHmac = {
         if (tag.length !== HMAC_SHA256_TAG_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
-        return constantTimeEquals(tag, ReallyMeHmac.authenticateSha256(key, message));
+        return verifyAndClearExpectedTag(tag, ReallyMeHmac.authenticateSha256(key, message));
+    },
+    verifySha384(tag, key, message) {
+        if (tag.length !== HMAC_SHA384_TAG_LENGTH) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        return verifyAndClearExpectedTag(tag, ReallyMeHmac.authenticateSha384(key, message));
     },
     verifySha512(tag, key, message) {
         if (tag.length !== HMAC_SHA512_TAG_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
-        return constantTimeEquals(tag, ReallyMeHmac.authenticateSha512(key, message));
+        return verifyAndClearExpectedTag(tag, ReallyMeHmac.authenticateSha512(key, message));
     },
 };
 function validateKey(key) {
@@ -48,3 +59,13 @@ function constantTimeEquals(left, right) {
     }
     return difference === 0;
 }
+function verifyAndClearExpectedTag(tag, expectedTag) {
+    try {
+        return constantTimeEquals(tag, expectedTag);
+    }
+    finally {
+        // Noble returns a new typed array. Clear it immediately so verification
+        // does not retain key-derived authentication material until a GC cycle.
+        expectedTag.fill(0);
+    }
+}