@reallyme/crypto 0.2.0 → 0.3.1

package/dist/jwk.js

@@ -5,6 +5,20 @@ import { p256 } from "@noble/curves/nist.js";
 import { secp256k1 } from "@noble/curves/secp256k1.js";
 import { base64urlDecode as codecBase64urlDecodeValue, base64urlEncode as codecBase64urlEncodeValue, canonicalizeJson as codecCanonicalizeJson, ReallyMeCodecError, } from "@reallyme/codec";
 import { ReallyMeCryptoError } from "./errors.js";
+// JSON and protobuf JWKS ingress routes share this limit so neither boundary
+// can amplify a small public-key record into unbounded curve validation work.
+export const MAX_JWKS_KEYS = 1_024;
+const withJwkBoundaryErrors = (operation) => {
+    try {
+        return operation();
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
 const jwkSpec = (algorithm) => {
     switch (algorithm) {
         case "Ed25519":
@@ -31,8 +45,6 @@ const jwkSpec = (algorithm) => {
             return { alg: "SLH-DSA-SHA2-128s", kty: "AKP", publicKeyLength: 32, use: "sig" };
         case "X-Wing-768":
             return { alg: "X-Wing-768", kty: "AKP", publicKeyLength: 1_216, use: "enc" };
-        case "X-Wing-1024":
-            return { alg: "X-Wing-1024", kty: "AKP", publicKeyLength: 1_600, use: "enc" };
     }
 };
 const ensureLength = (bytes, expectedLength) => {
@@ -44,11 +56,23 @@ const readString = (value, name) => {
     if (typeof value !== "object" || value === null) {
         throw new ReallyMeCryptoError("invalid-input");
     }
-    const property = Reflect.get(value, name);
-    if (typeof property !== "string") {
+    const descriptor = Object.getOwnPropertyDescriptor(value, name);
+    if (descriptor === undefined ||
+        !("value" in descriptor) ||
+        typeof descriptor.value !== "string") {
         throw new ReallyMeCryptoError("invalid-input");
     }
-    return property;
+    return descriptor.value;
+};
+const ensureExactMembers = (value, allowedNames) => {
+    if (typeof value !== "object" || value === null) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    for (const name of Reflect.ownKeys(value)) {
+        if (typeof name !== "string" || !allowedNames.includes(name)) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+    }
 };
 const privateJwkMemberNames = [
     "d",
@@ -77,8 +101,9 @@ const optionalStringMatches = (value, name, expected) => {
     if (typeof value !== "object" || value === null) {
         throw new ReallyMeCryptoError("invalid-input");
     }
-    const property = Reflect.get(value, name);
-    if (property !== undefined && property !== expected) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, name);
+    if (descriptor !== undefined &&
+        (!("value" in descriptor) || descriptor.value !== expected)) {
         throw new ReallyMeCryptoError("invalid-input");
     }
 };
@@ -103,7 +128,6 @@ const specFromAlgorithm = (algorithm) => {
         case "ML-KEM-1024":
         case "SLH-DSA-SHA2-128s":
         case "X-Wing-768":
-        case "X-Wing-1024":
             return jwkSpec(algorithm);
         default:
             throw new ReallyMeCryptoError("unsupported-algorithm");
@@ -212,68 +236,85 @@ export const ReallyMeJwk = {
         };
     },
     fromJwk(value) {
-        rejectPrivateKeyMaterial(value);
-        const kty = readString(value, "kty");
-        const spec = kty === "AKP"
-            ? specFromAlgorithm(readString(value, "alg"))
-            : specFromCurve(readString(value, "crv"));
-        if (kty !== spec.kty) {
-            throw new ReallyMeCryptoError("invalid-input");
-        }
-        optionalStringMatches(value, "alg", spec.alg);
-        optionalStringMatches(value, "use", spec.use);
-        if (spec.kty === "EC") {
-            const ecAlgorithm = spec.crv === "P-256" ? "P-256" : "secp256k1";
-            const x = codecBase64urlDecodeCanonical(readString(value, "x"));
-            const y = codecBase64urlDecodeCanonical(readString(value, "y"));
-            const publicKey = compressEc(ecAlgorithm, x, y);
-            ensureLength(publicKey, spec.publicKeyLength);
-            const jwk = ReallyMeJwk.toJwk(ecAlgorithm, publicKey);
-            return { algorithm: ecAlgorithm, publicKey, jwk };
-        }
-        if (spec.kty === "OKP") {
-            const crv = spec.crv;
-            if (crv !== "Ed25519" && crv !== "X25519") {
-                throw new ReallyMeCryptoError("unsupported-algorithm");
+        return withJwkBoundaryErrors(() => {
+            rejectPrivateKeyMaterial(value);
+            const kty = readString(value, "kty");
+            const spec = kty === "AKP"
+                ? specFromAlgorithm(readString(value, "alg"))
+                : specFromCurve(readString(value, "crv"));
+            if (kty !== spec.kty) {
+                throw new ReallyMeCryptoError("invalid-input");
             }
-            const publicKey = codecBase64urlDecodeCanonical(readString(value, "x"));
-            ensureLength(publicKey, spec.publicKeyLength);
-            const jwk = ReallyMeJwk.toJwk(crv, publicKey);
-            return { algorithm: crv, publicKey, jwk };
-        }
-        const algorithm = readString(value, "alg");
-        const akpSpec = specFromAlgorithm(algorithm);
-        const publicKey = codecBase64urlDecodeCanonical(readString(value, "pub"));
-        ensureLength(publicKey, akpSpec.publicKeyLength);
-        switch (algorithm) {
-            case "ML-DSA-44":
-            case "ML-DSA-65":
-            case "ML-DSA-87":
-            case "ML-KEM-512":
-            case "ML-KEM-768":
-            case "ML-KEM-1024":
-            case "SLH-DSA-SHA2-128s":
-            case "X-Wing-768":
-            case "X-Wing-1024": {
-                const jwk = ReallyMeJwk.toJwk(algorithm, publicKey);
-                return { algorithm, publicKey, jwk };
+            if (spec.kty === "EC") {
+                ensureExactMembers(value, ["alg", "crv", "kty", "use", "x", "y"]);
+                if (readString(value, "alg") !== spec.alg ||
+                    readString(value, "use") !== spec.use) {
+                    throw new ReallyMeCryptoError("invalid-input");
+                }
+                const ecAlgorithm = spec.crv === "P-256" ? "P-256" : "secp256k1";
+                const x = codecBase64urlDecodeCanonical(readString(value, "x"));
+                const y = codecBase64urlDecodeCanonical(readString(value, "y"));
+                const publicKey = compressEc(ecAlgorithm, x, y);
+                ensureLength(publicKey, spec.publicKeyLength);
+                const jwk = ReallyMeJwk.toJwk(ecAlgorithm, publicKey);
+                return { algorithm: ecAlgorithm, publicKey, jwk };
             }
-            default:
-                throw new ReallyMeCryptoError("unsupported-algorithm");
-        }
+            if (spec.kty === "OKP") {
+                ensureExactMembers(value, ["alg", "crv", "kty", "use", "x"]);
+                optionalStringMatches(value, "alg", spec.alg);
+                optionalStringMatches(value, "use", spec.use);
+                const crv = spec.crv;
+                if (crv !== "Ed25519" && crv !== "X25519") {
+                    throw new ReallyMeCryptoError("unsupported-algorithm");
+                }
+                const publicKey = codecBase64urlDecodeCanonical(readString(value, "x"));
+                ensureLength(publicKey, spec.publicKeyLength);
+                const jwk = ReallyMeJwk.toJwk(crv, publicKey);
+                return { algorithm: crv, publicKey, jwk };
+            }
+            const algorithm = readString(value, "alg");
+            ensureExactMembers(value, ["alg", "kty", "pub", "use"]);
+            if (readString(value, "use") !== spec.use) {
+                throw new ReallyMeCryptoError("invalid-input");
+            }
+            const akpSpec = specFromAlgorithm(algorithm);
+            const publicKey = codecBase64urlDecodeCanonical(readString(value, "pub"));
+            ensureLength(publicKey, akpSpec.publicKeyLength);
+            switch (algorithm) {
+                case "ML-DSA-44":
+                case "ML-DSA-65":
+                case "ML-DSA-87":
+                case "ML-KEM-512":
+                case "ML-KEM-768":
+                case "ML-KEM-1024":
+                case "SLH-DSA-SHA2-128s":
+                case "X-Wing-768": {
+                    const jwk = ReallyMeJwk.toJwk(algorithm, publicKey);
+                    return { algorithm, publicKey, jwk };
+                }
+                default:
+                    throw new ReallyMeCryptoError("unsupported-algorithm");
+            }
+        });
     },
     toJwks(keys) {
         return { keys: [...keys] };
     },
     fromJwks(value) {
-        if (typeof value !== "object" || value === null) {
-            throw new ReallyMeCryptoError("invalid-input");
-        }
-        const keys = Reflect.get(value, "keys");
-        if (!Array.isArray(keys)) {
-            throw new ReallyMeCryptoError("invalid-input");
-        }
-        return { keys: keys.map((key) => ReallyMeJwk.fromJwk(key)) };
+        return withJwkBoundaryErrors(() => {
+            ensureExactMembers(value, ["keys"]);
+            if (typeof value !== "object" || value === null) {
+                throw new ReallyMeCryptoError("invalid-input");
+            }
+            const descriptor = Object.getOwnPropertyDescriptor(value, "keys");
+            const keys = descriptor !== undefined && "value" in descriptor
+                ? descriptor.value
+                : undefined;
+            if (!Array.isArray(keys) || keys.length > MAX_JWKS_KEYS) {
+                throw new ReallyMeCryptoError("invalid-input");
+            }
+            return { keys: keys.map((key) => ReallyMeJwk.fromJwk(key)) };
+        });
     },
     publicKeyBytes(jwk) {
         return ReallyMeJwk.fromJwk(jwk).publicKey;

package/dist/kmac.d.ts

@@ -0,0 +1,11 @@
+import type { ReallyMeWasmProvider } from "./wasmProvider.js";
+export declare const KMAC256_MIN_KEY_LENGTH = 32;
+export declare const KMAC256_MAX_KEY_LENGTH = 4096;
+export declare const KMAC256_MAX_CONTEXT_LENGTH = 65536;
+export declare const KMAC256_MAX_CUSTOMIZATION_LENGTH = 4096;
+export declare const KMAC256_MIN_OUTPUT_LENGTH = 1;
+export declare const KMAC256_MAX_OUTPUT_LENGTH = 65536;
+export declare const ReallyMeKmac: {
+    readonly deriveKmac256: (key: Uint8Array, context: Uint8Array, customization: Uint8Array, outputLength: number) => Uint8Array;
+    readonly deriveKmac256WithProvider: (provider: ReallyMeWasmProvider, key: Uint8Array, context: Uint8Array, customization: Uint8Array, outputLength: number) => Uint8Array;
+};

package/dist/kmac.js

@@ -0,0 +1,49 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray, ensureIndependentByteArray, } from "./validateBytes.js";
+import { requireReallyMeWasmProvider } from "./wasmProvider.js";
+export const KMAC256_MIN_KEY_LENGTH = 32;
+export const KMAC256_MAX_KEY_LENGTH = 4_096;
+export const KMAC256_MAX_CONTEXT_LENGTH = 65_536;
+export const KMAC256_MAX_CUSTOMIZATION_LENGTH = 4_096;
+export const KMAC256_MIN_OUTPUT_LENGTH = 1;
+export const KMAC256_MAX_OUTPUT_LENGTH = 65_536;
+const validate = (key, context, customization, outputLength) => {
+    ensureByteArray(key);
+    ensureByteArray(context);
+    ensureByteArray(customization);
+    if (key.length < KMAC256_MIN_KEY_LENGTH ||
+        key.length > KMAC256_MAX_KEY_LENGTH ||
+        context.length > KMAC256_MAX_CONTEXT_LENGTH ||
+        customization.length > KMAC256_MAX_CUSTOMIZATION_LENGTH ||
+        !Number.isInteger(outputLength) ||
+        outputLength < KMAC256_MIN_OUTPUT_LENGTH ||
+        outputLength > KMAC256_MAX_OUTPUT_LENGTH) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+const requireDerivedKey = (value, outputLength, inputs) => {
+    if (!(value instanceof Uint8Array)) {
+        throw new ReallyMeCryptoError("provider-failure");
+    }
+    // A provider result must have independent ownership. Check overlap before
+    // clearing malformed output so validation cannot erase caller-owned input.
+    ensureIndependentByteArray(value, inputs);
+    if (value.length !== outputLength) {
+        value.fill(0);
+        throw new ReallyMeCryptoError("provider-failure");
+    }
+    return value;
+};
+export const ReallyMeKmac = {
+    deriveKmac256(key, context, customization, outputLength) {
+        validate(key, context, customization, outputLength);
+        return requireDerivedKey(requireReallyMeWasmProvider().kmac256Derive(key, context, customization, outputLength), outputLength, [key, context, customization]);
+    },
+    deriveKmac256WithProvider(provider, key, context, customization, outputLength) {
+        validate(key, context, customization, outputLength);
+        return requireDerivedKey(provider.kmac256Derive(key, context, customization, outputLength), outputLength, [key, context, customization]);
+    },
+};

package/dist/mlDsa.js

@@ -2,7 +2,7 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
-import { ensureBytes, readByteArrayProperty } from "./validateBytes.js";
+import { ensureByteArrayAtMost, ensureBytes, ensureIndependentByteArray, MAX_CRYPTO_INPUT_LENGTH, readIndependentByteArrayProperty, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";
 export const ML_DSA_44_PUBLIC_KEY_LENGTH = 1_312;
 export const ML_DSA_44_SIGNATURE_LENGTH = 2_420;
@@ -48,15 +48,22 @@ const mlDsaSuiteWithProvider = (algorithm, provider) => {
             throw new ReallyMeCryptoError("unsupported-algorithm");
     }
 };
-const readKeyPair = (value, suite) => ({
-    publicKey: readByteArrayProperty(value, "publicKey", suite.publicKeyLength),
-    secretKey: readByteArrayProperty(value, "secretKey", ML_DSA_SECRET_KEY_LENGTH),
-});
-const readSignature = (value, suite) => {
+const readKeyPair = (value, suite, inputs = []) => {
+    const publicKey = readIndependentByteArrayProperty(value, "publicKey", suite.publicKeyLength, inputs);
+    const secretKey = readIndependentByteArrayProperty(value, "secretKey", ML_DSA_SECRET_KEY_LENGTH, [...inputs, publicKey]);
+    return { publicKey, secretKey };
+};
+const readSignature = (value, suite, inputs) => {
     if (!(value instanceof Uint8Array)) {
         throw new ReallyMeCryptoError("provider-failure");
     }
-    ensureBytes(value, suite.signatureLength);
+    // Signature bytes are public, but their shape and ownership are provider
+    // postconditions. A malformed provider must never be reported as bad caller
+    // input, and an aliased result must not be mistaken for provider-owned data.
+    ensureIndependentByteArray(value, inputs);
+    if (value.length !== suite.signatureLength) {
+        throw new ReallyMeCryptoError("provider-failure");
+    }
     return value;
 };
 const readVoid = (value) => {
@@ -78,31 +85,35 @@ export const ReallyMeMlDsa = {
         // feed passwords or other low-entropy material here.
         const suite = mlDsaSuite(algorithm);
         ensureBytes(secretKey, ML_DSA_SECRET_KEY_LENGTH);
-        return readKeyPair(suite.deriveKeyPair(secretKey), suite);
+        return readKeyPair(suite.deriveKeyPair(secretKey), suite, [secretKey]);
     },
     deriveKeyPairWithProvider(provider, algorithm, secretKey) {
         const suite = mlDsaSuiteWithProvider(algorithm, provider);
         ensureBytes(secretKey, ML_DSA_SECRET_KEY_LENGTH);
-        return readKeyPair(suite.deriveKeyPair(secretKey), suite);
+        return readKeyPair(suite.deriveKeyPair(secretKey), suite, [secretKey]);
     },
     sign(algorithm, message, secretKey) {
         const suite = mlDsaSuite(algorithm);
+        ensureByteArrayAtMost(message, MAX_CRYPTO_INPUT_LENGTH);
         ensureBytes(secretKey, ML_DSA_SECRET_KEY_LENGTH);
-        return readSignature(suite.sign(secretKey, message), suite);
+        return readSignature(suite.sign(secretKey, message), suite, [secretKey, message]);
     },
     signWithProvider(provider, algorithm, message, secretKey) {
         const suite = mlDsaSuiteWithProvider(algorithm, provider);
+        ensureByteArrayAtMost(message, MAX_CRYPTO_INPUT_LENGTH);
         ensureBytes(secretKey, ML_DSA_SECRET_KEY_LENGTH);
-        return readSignature(suite.sign(secretKey, message), suite);
+        return readSignature(suite.sign(secretKey, message), suite, [secretKey, message]);
     },
     verify(algorithm, signature, message, publicKey) {
         const suite = mlDsaSuite(algorithm);
+        ensureByteArrayAtMost(message, MAX_CRYPTO_INPUT_LENGTH);
         ensureBytes(publicKey, suite.publicKeyLength);
         ensureBytes(signature, suite.signatureLength);
         readVoid(suite.verify(publicKey, message, signature));
     },
     verifyWithProvider(provider, algorithm, signature, message, publicKey) {
         const suite = mlDsaSuiteWithProvider(algorithm, provider);
+        ensureByteArrayAtMost(message, MAX_CRYPTO_INPUT_LENGTH);
         ensureBytes(publicKey, suite.publicKeyLength);
         ensureBytes(signature, suite.signatureLength);
         readVoid(suite.verify(publicKey, message, signature));

package/dist/mlKem.d.ts

@@ -7,7 +7,6 @@ export declare const ML_KEM_768_CIPHERTEXT_LENGTH = 1088;
 export declare const ML_KEM_1024_PUBLIC_KEY_LENGTH = 1568;
 export declare const ML_KEM_1024_CIPHERTEXT_LENGTH = 1568;
 export declare const ML_KEM_SECRET_KEY_LENGTH = 64;
-export declare const ML_KEM_ENCAPSULATION_RANDOMNESS_LENGTH = 32;
 export declare const ML_KEM_SHARED_SECRET_LENGTH = 32;
 export type ReallyMeMlKemKeyPair = Readonly<{
     publicKey: Uint8Array;
@@ -24,8 +23,6 @@ export declare const ReallyMeMlKem: {
     readonly deriveKeyPairWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm, secretKey: Uint8Array) => ReallyMeMlKemKeyPair;
     readonly encapsulate: (algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array) => ReallyMeMlKemEncapsulation;
     readonly encapsulateWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array) => ReallyMeMlKemEncapsulation;
-    readonly encapsulateDeterministicallyForTest: (algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array, randomness: Uint8Array) => ReallyMeMlKemEncapsulation;
-    readonly encapsulateDeterministicallyWithProviderForTest: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array, randomness: Uint8Array) => ReallyMeMlKemEncapsulation;
     readonly decapsulate: (algorithm: ReallyMeKemAlgorithm, ciphertext: Uint8Array, secretKey: Uint8Array) => Uint8Array;
     readonly decapsulateWithProvider: (provider: ReallyMeWasmProvider, algorithm: ReallyMeKemAlgorithm, ciphertext: Uint8Array, secretKey: Uint8Array) => Uint8Array;
 };

package/dist/mlKem.js

@@ -2,7 +2,7 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
-import { ensureBytes, readByteArrayProperty } from "./validateBytes.js";
+import { ensureBytes, readIndependentByteArrayProperty, readIndependentProviderBytes, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";
 export const ML_KEM_512_PUBLIC_KEY_LENGTH = 800;
 export const ML_KEM_512_CIPHERTEXT_LENGTH = 768;
@@ -11,7 +11,6 @@ export const ML_KEM_768_CIPHERTEXT_LENGTH = 1_088;
 export const ML_KEM_1024_PUBLIC_KEY_LENGTH = 1_568;
 export const ML_KEM_1024_CIPHERTEXT_LENGTH = 1_568;
 export const ML_KEM_SECRET_KEY_LENGTH = 64;
-export const ML_KEM_ENCAPSULATION_RANDOMNESS_LENGTH = 32;
 export const ML_KEM_SHARED_SECRET_LENGTH = 32;
 const mlKemSuite = (algorithm) => {
     const provider = requireReallyMeWasmProvider();
@@ -26,7 +25,6 @@ const mlKemSuiteWithProvider = (algorithm, provider) => {
                 generateKeyPair: provider.mlKem512GenerateKeypair,
                 deriveKeyPair: provider.mlKem512DeriveKeypair,
                 encapsulate: provider.mlKem512Encapsulate,
-                encapsulateDerand: provider.mlKem512EncapsulateDerand,
                 decapsulate: provider.mlKem512Decapsulate,
             };
         case "ML-KEM-768":
@@ -36,7 +34,6 @@ const mlKemSuiteWithProvider = (algorithm, provider) => {
                 generateKeyPair: provider.mlKem768GenerateKeypair,
                 deriveKeyPair: provider.mlKem768DeriveKeypair,
                 encapsulate: provider.mlKem768Encapsulate,
-                encapsulateDerand: provider.mlKem768EncapsulateDerand,
                 decapsulate: provider.mlKem768Decapsulate,
             };
         case "ML-KEM-1024":
@@ -46,27 +43,24 @@ const mlKemSuiteWithProvider = (algorithm, provider) => {
                 generateKeyPair: provider.mlKem1024GenerateKeypair,
                 deriveKeyPair: provider.mlKem1024DeriveKeypair,
                 encapsulate: provider.mlKem1024Encapsulate,
-                encapsulateDerand: provider.mlKem1024EncapsulateDerand,
                 decapsulate: provider.mlKem1024Decapsulate,
             };
         default:
             throw new ReallyMeCryptoError("unsupported-algorithm");
     }
 };
-const readKeyPair = (value, suite) => ({
-    publicKey: readByteArrayProperty(value, "publicKey", suite.publicKeyLength),
-    secretKey: readByteArrayProperty(value, "secretKey", ML_KEM_SECRET_KEY_LENGTH),
-});
-const readEncapsulation = (value, suite) => ({
-    ciphertext: readByteArrayProperty(value, "ciphertext", suite.ciphertextLength),
-    sharedSecret: readByteArrayProperty(value, "sharedSecret", ML_KEM_SHARED_SECRET_LENGTH),
-});
-const readSharedSecret = (value) => {
-    if (!(value instanceof Uint8Array)) {
-        throw new ReallyMeCryptoError("provider-failure");
-    }
-    ensureBytes(value, ML_KEM_SHARED_SECRET_LENGTH);
-    return value;
+const readKeyPair = (value, suite, inputs = []) => {
+    const publicKey = readIndependentByteArrayProperty(value, "publicKey", suite.publicKeyLength, inputs);
+    const secretKey = readIndependentByteArrayProperty(value, "secretKey", ML_KEM_SECRET_KEY_LENGTH, [...inputs, publicKey]);
+    return { publicKey, secretKey };
+};
+const readEncapsulation = (value, suite, inputs) => {
+    const ciphertext = readIndependentByteArrayProperty(value, "ciphertext", suite.ciphertextLength, inputs);
+    const sharedSecret = readIndependentByteArrayProperty(value, "sharedSecret", ML_KEM_SHARED_SECRET_LENGTH, [...inputs, ciphertext]);
+    return { ciphertext, sharedSecret };
+};
+const readSharedSecret = (value, inputs) => {
+    return readIndependentProviderBytes(value, ML_KEM_SHARED_SECRET_LENGTH, inputs);
 };
 export const ReallyMeMlKem = {
     generateKeyPair(algorithm) {
@@ -82,45 +76,33 @@ export const ReallyMeMlKem = {
         // key. Do not feed passwords or other low-entropy material here.
         const suite = mlKemSuite(algorithm);
         ensureBytes(secretKey, ML_KEM_SECRET_KEY_LENGTH);
-        return readKeyPair(suite.deriveKeyPair(secretKey), suite);
+        return readKeyPair(suite.deriveKeyPair(secretKey), suite, [secretKey]);
     },
     deriveKeyPairWithProvider(provider, algorithm, secretKey) {
         const suite = mlKemSuiteWithProvider(algorithm, provider);
         ensureBytes(secretKey, ML_KEM_SECRET_KEY_LENGTH);
-        return readKeyPair(suite.deriveKeyPair(secretKey), suite);
+        return readKeyPair(suite.deriveKeyPair(secretKey), suite, [secretKey]);
     },
     encapsulate(algorithm, publicKey) {
         const suite = mlKemSuite(algorithm);
         ensureBytes(publicKey, suite.publicKeyLength);
-        return readEncapsulation(suite.encapsulate(publicKey), suite);
+        return readEncapsulation(suite.encapsulate(publicKey), suite, [publicKey]);
     },
     encapsulateWithProvider(provider, algorithm, publicKey) {
         const suite = mlKemSuiteWithProvider(algorithm, provider);
         ensureBytes(publicKey, suite.publicKeyLength);
-        return readEncapsulation(suite.encapsulate(publicKey), suite);
-    },
-    encapsulateDeterministicallyForTest(algorithm, publicKey, randomness) {
-        const suite = mlKemSuite(algorithm);
-        ensureBytes(publicKey, suite.publicKeyLength);
-        ensureBytes(randomness, ML_KEM_ENCAPSULATION_RANDOMNESS_LENGTH);
-        return readEncapsulation(suite.encapsulateDerand(publicKey, randomness), suite);
-    },
-    encapsulateDeterministicallyWithProviderForTest(provider, algorithm, publicKey, randomness) {
-        const suite = mlKemSuiteWithProvider(algorithm, provider);
-        ensureBytes(publicKey, suite.publicKeyLength);
-        ensureBytes(randomness, ML_KEM_ENCAPSULATION_RANDOMNESS_LENGTH);
-        return readEncapsulation(suite.encapsulateDerand(publicKey, randomness), suite);
+        return readEncapsulation(suite.encapsulate(publicKey), suite, [publicKey]);
     },
     decapsulate(algorithm, ciphertext, secretKey) {
         const suite = mlKemSuite(algorithm);
         ensureBytes(ciphertext, suite.ciphertextLength);
         ensureBytes(secretKey, ML_KEM_SECRET_KEY_LENGTH);
-        return readSharedSecret(suite.decapsulate(ciphertext, secretKey));
+        return readSharedSecret(suite.decapsulate(ciphertext, secretKey), [ciphertext, secretKey]);
     },
     decapsulateWithProvider(provider, algorithm, ciphertext, secretKey) {
         const suite = mlKemSuiteWithProvider(algorithm, provider);
         ensureBytes(ciphertext, suite.ciphertextLength);
         ensureBytes(secretKey, ML_KEM_SECRET_KEY_LENGTH);
-        return readSharedSecret(suite.decapsulate(ciphertext, secretKey));
+        return readSharedSecret(suite.decapsulate(ciphertext, secretKey), [ciphertext, secretKey]);
     },
 };

package/dist/operationResponse.d.ts

@@ -0,0 +1,16 @@
+import type { ReallyMeWasmProvider } from "./wasmProvider.js";
+/**
+ * Execute one generated binary protobuf request.
+ *
+ * The returned bytes are always a generated `CryptoOperationResponse` with a
+ * typed `result` or typed `error` outcome.
+ */
+export declare const processOperationResponse: (requestBytes: Uint8Array) => Uint8Array;
+export declare const processOperationResponseWithProvider: (provider: ReallyMeWasmProvider, requestBytes: Uint8Array) => Uint8Array;
+/**
+ * Execute one permitted non-secret generated ProtoJSON request and return the
+ * same binary `CryptoOperationResponse` used by `processOperationResponse`.
+ * Secret-bearing selectors fail before JSON value deserialization.
+ */
+export declare const processOperationResponseJson: (requestJson: Uint8Array) => Uint8Array;
+export declare const processOperationResponseJsonWithProvider: (provider: ReallyMeWasmProvider, requestJson: Uint8Array) => Uint8Array;

package/dist/operationResponse.js

@@ -0,0 +1,46 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray, ensureIndependentByteArray, } from "./validateBytes.js";
+import { requireReallyMeWasmProvider } from "./wasmProvider.js";
+const MAX_CRYPTO_OPERATION_RESPONSE_BYTES = 1_048_608;
+const readOperationResponse = (value, request) => {
+    if (!(value instanceof Uint8Array)) {
+        throw new ReallyMeCryptoError("provider-failure");
+    }
+    ensureIndependentByteArray(value, [request]);
+    if (value.length === 0 ||
+        value.length > MAX_CRYPTO_OPERATION_RESPONSE_BYTES) {
+        value.fill(0);
+        throw new ReallyMeCryptoError("provider-failure");
+    }
+    return value;
+};
+/**
+ * Execute one generated binary protobuf request.
+ *
+ * The returned bytes are always a generated `CryptoOperationResponse` with a
+ * typed `result` or typed `error` outcome.
+ */
+export const processOperationResponse = (requestBytes) => {
+    ensureByteArray(requestBytes);
+    return processOperationResponseWithProvider(requireReallyMeWasmProvider(), requestBytes);
+};
+export const processOperationResponseWithProvider = (provider, requestBytes) => {
+    ensureByteArray(requestBytes);
+    return readOperationResponse(provider.processOperationResponse(requestBytes), requestBytes);
+};
+/**
+ * Execute one permitted non-secret generated ProtoJSON request and return the
+ * same binary `CryptoOperationResponse` used by `processOperationResponse`.
+ * Secret-bearing selectors fail before JSON value deserialization.
+ */
+export const processOperationResponseJson = (requestJson) => {
+    ensureByteArray(requestJson);
+    return processOperationResponseJsonWithProvider(requireReallyMeWasmProvider(), requestJson);
+};
+export const processOperationResponseJsonWithProvider = (provider, requestJson) => {
+    ensureByteArray(requestJson);
+    return readOperationResponse(provider.processOperationResponseJson(requestJson), requestJson);
+};

package/dist/pbkdf2.d.ts

@@ -1,28 +1,26 @@
 export declare const PBKDF2_MIN_INPUT_LENGTH = 1;
 export declare const PBKDF2_MAX_INPUT_LENGTH = 4096;
-export declare const PBKDF2_MIN_ITERATIONS = 1;
+export declare const PBKDF2_MIN_ITERATIONS = 100000;
+export declare const PBKDF2_MAX_ITERATIONS = 10000000;
 export declare const PBKDF2_MIN_OUTPUT_LENGTH = 1;
 export declare const PBKDF2_MAX_OUTPUT_LENGTH = 4096;
 /**
  * OWASP Password Storage Cheat Sheet minimum iteration counts for deriving a
  * *new* password key.
- * The primitive does not enforce these (it must remain able to verify
- * externally created hashes), so callers creating new key material SHOULD
- * pass at least the value for their PRF.
+ * These stronger profile recommendations remain above the enforced public
+ * baseline and should be selected when protocol latency budgets permit.
  */
 export declare const PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA256 = 600000;
 export declare const PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA512 = 220000;
 export declare const ReallyMePbkdf2: {
     /**
      * PBKDF2-HMAC-SHA-256. For a new password key pass at least
-     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA256} iterations; lower counts
-     * are accepted only to verify hashes created elsewhere.
+     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA256} iterations.
      */
     readonly deriveHmacSha256: (password: Uint8Array, salt: Uint8Array, iterations: number, outputLength: number) => Uint8Array;
     /**
      * PBKDF2-HMAC-SHA-512. For a new password key pass at least
-     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA512} iterations; lower counts
-     * are accepted only to verify hashes created elsewhere.
+     * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA512} iterations.
      */
     readonly deriveHmacSha512: (password: Uint8Array, salt: Uint8Array, iterations: number, outputLength: number) => Uint8Array;
 };