@reallyme/crypto 0.3.6 → 0.3.7

package/LICENSE

@@ -1,3 +1,29 @@
+ReallyMe Crypto is licensed, at your option, under either the MIT License or
+the Apache License, Version 2.0. The full text of both licenses follows.
+Third-party components retain their own licenses and notices.
+
+MIT License
+
+Copyright © 2026 ReallyMe LLC.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/

package/README.md

@@ -1,13 +1,11 @@
 <!--
 SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
-
-SPDX-License-Identifier: Apache-2.0
 -->
 
 # @reallyme/crypto
 
 [![npm](https://img.shields.io/npm/v/@reallyme/crypto?label=npm&color=2563eb)](https://www.npmjs.com/package/@reallyme/crypto)
-[![License](https://img.shields.io/badge/license-Apache--2.0-blue)](https://github.com/reallyme/crypto/blob/main/LICENSE)
+[![License](https://img.shields.io/badge/license-MIT%20OR%20Apache--2.0-blue)](https://github.com/reallyme/crypto/blob/main/LICENSE)
 
 `@reallyme/crypto` is the TypeScript SDK for ReallyMe Crypto. It provides typed,
 synchronous APIs for Node.js and browsers, with explicit JavaScript and
@@ -17,16 +15,6 @@ The package shares algorithm identifiers, byte formats, typed failures, and
 conformance vectors with the Rust, Swift, Kotlin, and Android SDKs. Availability
 is provider-specific; unsupported routes fail closed.
 
-## Why
-
-Modern cryptography APIs differ across platforms. Algorithms are exposed
-differently, key formats vary, providers have different capabilities, and error
-behavior is inconsistent.
-
-ReallyMe Crypto makes platform differences explicit while preserving a stable
-contract for every supported route. Applications can share protocol logic
-without silently changing cryptographic providers.
-
 ## Installation
 
 ```sh
@@ -187,18 +175,6 @@ created.
 Do not move private keys, passwords, plaintext, shared secrets, or derived keys
 through strings or JSON paths.
 
-## Features
-
-- Platform-agnostic cryptography APIs.
-- Consistent key formats and protocol identifiers.
-- Shared conformance vectors across Rust, Swift, Kotlin, and TypeScript.
-- Native providers where available, WASM-backed implementations where needed.
-- Typed errors and fail-closed verification behavior.
-- Generated protobuf operations, algorithm identifiers, and typed wire errors
-  via `@reallyme/crypto/proto`.
-- JWK, multikey, multicodec, HPKE, ML-KEM, ML-DSA, Ed25519, secp256k1, X25519,
-  AES-GCM, ChaCha20-Poly1305, and more.
-
 ## Protobuf Process Boundary
 
 `processOperationResponse(request)` accepts one generated binary
@@ -220,3 +196,9 @@ The complete documentation, provider matrix, protocol contracts, and conformance
 specifications are available in the main repository:
 
 https://github.com/reallyme/crypto
+
+## License
+
+Licensed under either the MIT License or the Apache License, Version 2.0,
+at your option. See [LICENSE](https://github.com/reallyme/crypto/blob/main/LICENSE). Third-party components retain
+their own licenses and notices.

package/dist/aead.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
 import { ensureByteArrayAtMost, ensureBytes, ensureIndependentByteArray, MAX_CRYPTO_INPUT_LENGTH, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";

package/dist/aesKw.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
 import { ensureByteArray, ensureBytes, ensureIndependentByteArray, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";

package/dist/algorithms.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 export const REALLYME_SIGNATURE_ALGORITHMS = [
     "Ed25519",
     "ECDSA-P256-SHA256",

package/dist/argon2id.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
 import { ensureByteArrayAtMost, ensureIndependentByteArray, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";

package/dist/bip340Schnorr.js

@@ -1,8 +1,9 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { schnorr, secp256k1 } from "@noble/curves/secp256k1.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray } from "./validateBytes.js";
 export const BIP340_SCHNORR_SECRET_KEY_LENGTH = 32;
 export const BIP340_SCHNORR_PUBLIC_KEY_LENGTH = 32;
 export const BIP340_SCHNORR_MESSAGE_LENGTH = 32;
@@ -27,10 +28,12 @@ export const ReallyMeBip340Schnorr = {
     deriveKeyPair(secretKey) {
         return {
             publicKey: this.derivePublicKey(secretKey),
-            secretKey: secretKey.slice(),
+            // Buffer.slice() aliases its input; the returned key must own its bytes.
+            secretKey: new Uint8Array(secretKey),
         };
     },
     derivePublicKey(secretKey) {
+        ensureByteArray(secretKey);
         if (secretKey.length !== BIP340_SCHNORR_SECRET_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
@@ -42,6 +45,9 @@ export const ReallyMeBip340Schnorr = {
         }
     },
     sign(message32, secretKey, auxRand32) {
+        ensureByteArray(message32);
+        ensureByteArray(secretKey);
+        ensureByteArray(auxRand32);
         if (message32.length !== BIP340_SCHNORR_MESSAGE_LENGTH ||
             secretKey.length !== BIP340_SCHNORR_SECRET_KEY_LENGTH ||
             auxRand32.length !== BIP340_SCHNORR_AUX_RAND_LENGTH) {
@@ -55,6 +61,9 @@ export const ReallyMeBip340Schnorr = {
         }
     },
     verify(signature, message32, publicKey) {
+        ensureByteArray(signature);
+        ensureByteArray(message32);
+        ensureByteArray(publicKey);
         if (signature.length !== BIP340_SCHNORR_SIGNATURE_LENGTH ||
             message32.length !== BIP340_SCHNORR_MESSAGE_LENGTH ||
             publicKey.length !== BIP340_SCHNORR_PUBLIC_KEY_LENGTH) {

package/dist/cryptoFacade.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeAead } from "./aead.js";
 import { ReallyMeAesKw } from "./aesKw.js";
 import { ReallyMeArgon2id } from "./argon2id.js";

package/dist/digest.js

@@ -1,8 +1,9 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { sha256 as nobleSha256, sha384 as nobleSha384, sha512 as nobleSha512 } from "@noble/hashes/sha2.js";
 import { sha3_224 as nobleSha3_224, sha3_256 as nobleSha3_256, sha3_384 as nobleSha3_384, sha3_512 as nobleSha3_512, } from "@noble/hashes/sha3.js";
+import { ensureByteArray } from "./validateBytes.js";
 /**
  * Small digest surface used by package tests and as the first package API
  * slice while algorithm wrappers are added one at a time. Mirrors the Swift
@@ -10,24 +11,31 @@ import { sha3_224 as nobleSha3_224, sha3_256 as nobleSha3_256, sha3_384 as noble
  */
 export const ReallyMeDigest = {
     sha256(bytes) {
+        ensureByteArray(bytes);
         return nobleSha256(bytes);
     },
     sha384(bytes) {
+        ensureByteArray(bytes);
         return nobleSha384(bytes);
     },
     sha512(bytes) {
+        ensureByteArray(bytes);
         return nobleSha512(bytes);
     },
     sha3_224(bytes) {
+        ensureByteArray(bytes);
         return nobleSha3_224(bytes);
     },
     sha3_256(bytes) {
+        ensureByteArray(bytes);
         return nobleSha3_256(bytes);
     },
     sha3_384(bytes) {
+        ensureByteArray(bytes);
         return nobleSha3_384(bytes);
     },
     sha3_512(bytes) {
+        ensureByteArray(bytes);
         return nobleSha3_512(bytes);
     },
 };

package/dist/ed25519.js

@@ -1,8 +1,9 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { ed25519 } from "@noble/curves/ed25519.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray } from "./validateBytes.js";
 /**
  * Ed25519 signatures backed by @noble/curves — the same pinned implementation
  * the TypeScript conformance lane proves vectors against.
@@ -33,11 +34,13 @@ export const ReallyMeEd25519 = {
     deriveKeyPair(secretKey) {
         return {
             publicKey: this.derivePublicKey(secretKey),
-            secretKey: secretKey.slice(),
+            // Buffer.slice() aliases its input; the returned key must own its bytes.
+            secretKey: new Uint8Array(secretKey),
         };
     },
     /** Derives the 32-byte Ed25519 public key from a 32-byte seed. */
     derivePublicKey(secretKey) {
+        ensureByteArray(secretKey);
         if (secretKey.length !== ED25519_SECRET_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
@@ -50,6 +53,8 @@ export const ReallyMeEd25519 = {
     },
     /** Signs the full message using plain deterministic Ed25519. */
     sign(message, secretKey) {
+        ensureByteArray(message);
+        ensureByteArray(secretKey);
         if (secretKey.length !== ED25519_SECRET_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
@@ -66,6 +71,9 @@ export const ReallyMeEd25519 = {
      * Throws on malformed input shape, undecodable keys, or invalid signatures.
      */
     verify(signature, message, publicKey) {
+        ensureByteArray(signature);
+        ensureByteArray(message);
+        ensureByteArray(publicKey);
         if (signature.length !== ED25519_SIGNATURE_LENGTH ||
             publicKey.length !== ED25519_PUBLIC_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");

package/dist/encodeEcdsaDer.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
 const DER_SEQUENCE_TAG = 0x30;
 const DER_INTEGER_TAG = 0x02;

package/dist/errors.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 export class ReallyMeCryptoError extends Error {
     code;
     constructor(code) {

package/dist/hkdf.js

@@ -1,9 +1,10 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { hkdf } from "@noble/hashes/hkdf.js";
 import { sha256, sha384 } from "@noble/hashes/sha2.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray } from "./validateBytes.js";
 export const HKDF_MIN_INPUT_KEY_MATERIAL_LENGTH = 1;
 export const HKDF_MAX_INPUT_LENGTH = 4096;
 export const HKDF_MIN_OUTPUT_LENGTH = 1;
@@ -19,6 +20,9 @@ export const ReallyMeHkdf = {
     },
 };
 function validate(inputKeyMaterial, salt, info, outputLength) {
+    ensureByteArray(inputKeyMaterial);
+    ensureByteArray(salt);
+    ensureByteArray(info);
     if (inputKeyMaterial.length < HKDF_MIN_INPUT_KEY_MATERIAL_LENGTH ||
         inputKeyMaterial.length > HKDF_MAX_INPUT_LENGTH ||
         salt.length > HKDF_MAX_INPUT_LENGTH ||

package/dist/hmac.js

@@ -1,9 +1,10 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { hmac } from "@noble/hashes/hmac.js";
 import { sha256, sha384, sha512 } from "@noble/hashes/sha2.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray } from "./validateBytes.js";
 export const HMAC_MAX_KEY_LENGTH = 4096;
 export const HMAC_SHA256_TAG_LENGTH = 32;
 export const HMAC_SHA384_TAG_LENGTH = 48;
@@ -11,29 +12,35 @@ export const HMAC_SHA512_TAG_LENGTH = 64;
 export const ReallyMeHmac = {
     authenticateSha256(key, message) {
         validateKey(key);
+        ensureByteArray(message);
         return hmac(sha256, key, message);
     },
     authenticateSha384(key, message) {
         validateKey(key);
+        ensureByteArray(message);
         return hmac(sha384, key, message);
     },
     authenticateSha512(key, message) {
         validateKey(key);
+        ensureByteArray(message);
         return hmac(sha512, key, message);
     },
     verifySha256(tag, key, message) {
+        ensureByteArray(tag);
         if (tag.length !== HMAC_SHA256_TAG_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
         return verifyAndClearExpectedTag(tag, ReallyMeHmac.authenticateSha256(key, message));
     },
     verifySha384(tag, key, message) {
+        ensureByteArray(tag);
         if (tag.length !== HMAC_SHA384_TAG_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
         return verifyAndClearExpectedTag(tag, ReallyMeHmac.authenticateSha384(key, message));
     },
     verifySha512(tag, key, message) {
+        ensureByteArray(tag);
         if (tag.length !== HMAC_SHA512_TAG_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
@@ -41,6 +48,7 @@ export const ReallyMeHmac = {
     },
 };
 function validateKey(key) {
+    ensureByteArray(key);
     if (key.length === 0 || key.length > HMAC_MAX_KEY_LENGTH) {
         throw new ReallyMeCryptoError("invalid-input");
     }
@@ -50,9 +58,10 @@ function constantTimeEquals(left, right) {
         return false;
     }
     let difference = 0;
-    for (const [index, leftByte] of left.entries()) {
+    for (let index = 0; index < left.length; index += 1) {
+        const leftByte = left[index];
         const rightByte = right[index];
-        if (rightByte === undefined) {
+        if (leftByte === undefined || rightByte === undefined) {
             return false;
         }
         difference |= leftByte ^ rightByte;

package/dist/hpke.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
 import { ensureByteArrayAtMost, ensureBytes, ensureIndependentByteArray, MAX_CRYPTO_INPUT_LENGTH, readIndependentByteArrayProperty, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";

package/dist/index.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 export { ReallyMeCryptoError } from "./errors.js";
 export { REALLYME_AEAD_ALGORITHMS, REALLYME_HASH_ALGORITHMS, REALLYME_HPKE_SUITES, REALLYME_KDF_ALGORITHMS, REALLYME_KEM_ALGORITHMS, REALLYME_KEY_AGREEMENT_ALGORITHMS, REALLYME_KEY_WRAP_ALGORITHMS, REALLYME_MAC_ALGORITHMS, REALLYME_SIGNATURE_ALGORITHMS, } from "./algorithms.js";
 export { AEAD_KEY_LENGTH, AEAD_NONCE_LENGTH, AEAD_TAG_LENGTH, AES_128_GCM_KEY_LENGTH, AES_192_GCM_KEY_LENGTH, AES_256_GCM_KEY_LENGTH, CHACHA20_POLY1305_KEY_LENGTH, ReallyMeAead, XCHACHA20_POLY1305_NONCE_LENGTH, } from "./aead.js";

package/dist/jwaConcatKdf.js

@@ -1,8 +1,9 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { sha256 } from "@noble/hashes/sha2.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray } from "./validateBytes.js";
 import { bestEffortClear } from "./memory.js";
 export const JWA_CONCAT_KDF_SHA256_DIGEST_LENGTH = 32;
 export const JWA_CONCAT_KDF_MAX_SHARED_SECRET_LENGTH = 4096;
@@ -32,6 +33,10 @@ export const ReallyMeJwaConcatKdf = {
     },
 };
 function validate(sharedSecret, algorithmId, partyUInfo, partyVInfo, outputLength) {
+    ensureByteArray(sharedSecret);
+    ensureByteArray(algorithmId);
+    ensureByteArray(partyUInfo);
+    ensureByteArray(partyVInfo);
     if (sharedSecret.length === 0 ||
         sharedSecret.length > JWA_CONCAT_KDF_MAX_SHARED_SECRET_LENGTH ||
         algorithmId.length === 0 ||

package/dist/jwk.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { p256 } from "@noble/curves/nist.js";
 import { secp256k1 } from "@noble/curves/secp256k1.js";
 import { base64urlDecode as codecBase64urlDecodeValue, base64urlEncode as codecBase64urlEncodeValue, canonicalizeJson as codecCanonicalizeJson, ReallyMeCodecError, } from "@reallyme/codec";

package/dist/kmac.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
 import { ensureByteArray, ensureIndependentByteArray, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";

package/dist/memory.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 /**
  * Best-effort cleanup for caller-owned managed-runtime byte arrays.
  *

package/dist/mlDsa.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
 import { ensureByteArrayAtMost, ensureBytes, ensureIndependentByteArray, MAX_CRYPTO_INPUT_LENGTH, readIndependentByteArrayProperty, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";

package/dist/mlKem.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
 import { ensureBytes, readIndependentByteArrayProperty, readIndependentProviderBytes, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";

package/dist/operationResponse.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
 import { ensureByteArray, ensureIndependentByteArray, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";

package/dist/p256Ecdh.js

@@ -1,8 +1,9 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { p256 } from "@noble/curves/nist.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray } from "./validateBytes.js";
 import { bestEffortClear } from "./memory.js";
 /**
  * P-256 ECDH backed by @noble/curves.
@@ -25,10 +26,12 @@ export const ReallyMeP256Ecdh = {
     deriveKeyPair(secretKey) {
         return {
             publicKey: this.derivePublicKey(secretKey),
-            secretKey: secretKey.slice(),
+            // Buffer.slice() aliases its input; the returned key must own its bytes.
+            secretKey: new Uint8Array(secretKey),
         };
     },
     derivePublicKey(secretKey) {
+        ensureByteArray(secretKey);
         if (secretKey.length !== P256_ECDH_SECRET_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
@@ -40,6 +43,8 @@ export const ReallyMeP256Ecdh = {
         }
     },
     deriveSharedSecret(publicKey, secretKey) {
+        ensureByteArray(publicKey);
+        ensureByteArray(secretKey);
         if (publicKey.length !== P256_ECDH_COMPRESSED_PUBLIC_KEY_LENGTH ||
             secretKey.length !== P256_ECDH_SECRET_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");

package/dist/p256Ecdsa.js

@@ -1,10 +1,11 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { p256 } from "@noble/curves/nist.js";
 import { sha256 } from "@noble/hashes/sha2.js";
 import { decodeEcdsaDerSignature, encodeEcdsaDerSignature, } from "./encodeEcdsaDer.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray } from "./validateBytes.js";
 export const P256_ECDSA_SECRET_KEY_LENGTH = 32;
 export const P256_ECDSA_COMPRESSED_PUBLIC_KEY_LENGTH = 33;
 export const P256_ECDSA_COMPACT_SIGNATURE_LENGTH = 64;
@@ -28,10 +29,12 @@ export const ReallyMeP256Ecdsa = {
     deriveKeyPair(secretKey) {
         return {
             publicKey: this.derivePublicKey(secretKey),
-            secretKey: secretKey.slice(),
+            // Buffer.slice() aliases its input; the returned key must own its bytes.
+            secretKey: new Uint8Array(secretKey),
         };
     },
     derivePublicKey(secretKey) {
+        ensureByteArray(secretKey);
         if (secretKey.length !== P256_ECDSA_SECRET_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
@@ -43,6 +46,8 @@ export const ReallyMeP256Ecdsa = {
         }
     },
     sign(message, secretKey) {
+        ensureByteArray(message);
+        ensureByteArray(secretKey);
         if (secretKey.length !== P256_ECDSA_SECRET_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
@@ -58,6 +63,9 @@ export const ReallyMeP256Ecdsa = {
         }
     },
     verify(signature, message, publicKey) {
+        ensureByteArray(signature);
+        ensureByteArray(message);
+        ensureByteArray(publicKey);
         if (publicKey.length !== P256_ECDSA_COMPRESSED_PUBLIC_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }

package/dist/p384Ecdh.js

@@ -1,8 +1,9 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { p384 } from "@noble/curves/nist.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray } from "./validateBytes.js";
 import { bestEffortClear } from "./memory.js";
 /**
  * P-384 ECDH backed by @noble/curves.
@@ -25,10 +26,12 @@ export const ReallyMeP384Ecdh = {
     deriveKeyPair(secretKey) {
         return {
             publicKey: this.derivePublicKey(secretKey),
-            secretKey: secretKey.slice(),
+            // Buffer.slice() aliases its input; the returned key must own its bytes.
+            secretKey: new Uint8Array(secretKey),
         };
     },
     derivePublicKey(secretKey) {
+        ensureByteArray(secretKey);
         if (secretKey.length !== P384_ECDH_SECRET_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
@@ -40,6 +43,8 @@ export const ReallyMeP384Ecdh = {
         }
     },
     deriveSharedSecret(publicKey, secretKey) {
+        ensureByteArray(publicKey);
+        ensureByteArray(secretKey);
         if (publicKey.length !== P384_ECDH_COMPRESSED_PUBLIC_KEY_LENGTH ||
             secretKey.length !== P384_ECDH_SECRET_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");

package/dist/p384Ecdsa.js

@@ -1,10 +1,11 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { p384 } from "@noble/curves/nist.js";
 import { sha384 } from "@noble/hashes/sha2.js";
 import { decodeEcdsaDerSignature, encodeEcdsaDerSignature, } from "./encodeEcdsaDer.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray } from "./validateBytes.js";
 export const P384_ECDSA_SECRET_KEY_LENGTH = 48;
 export const P384_ECDSA_COMPRESSED_PUBLIC_KEY_LENGTH = 49;
 export const P384_ECDSA_COMPACT_SIGNATURE_LENGTH = 96;
@@ -26,10 +27,12 @@ export const ReallyMeP384Ecdsa = {
     deriveKeyPair(secretKey) {
         return {
             publicKey: this.derivePublicKey(secretKey),
-            secretKey: secretKey.slice(),
+            // Buffer.slice() aliases its input; the returned key must own its bytes.
+            secretKey: new Uint8Array(secretKey),
         };
     },
     derivePublicKey(secretKey) {
+        ensureByteArray(secretKey);
         if (secretKey.length !== P384_ECDSA_SECRET_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
@@ -41,6 +44,8 @@ export const ReallyMeP384Ecdsa = {
         }
     },
     sign(message, secretKey) {
+        ensureByteArray(message);
+        ensureByteArray(secretKey);
         if (secretKey.length !== P384_ECDSA_SECRET_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
@@ -56,6 +61,9 @@ export const ReallyMeP384Ecdsa = {
         }
     },
     verify(signature, message, publicKey) {
+        ensureByteArray(signature);
+        ensureByteArray(message);
+        ensureByteArray(publicKey);
         if (publicKey.length !== P384_ECDSA_COMPRESSED_PUBLIC_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }

package/dist/p521Ecdh.js

@@ -1,8 +1,9 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { p521 } from "@noble/curves/nist.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray } from "./validateBytes.js";
 import { bestEffortClear } from "./memory.js";
 /**
  * P-521 ECDH backed by @noble/curves.
@@ -25,10 +26,12 @@ export const ReallyMeP521Ecdh = {
     deriveKeyPair(secretKey) {
         return {
             publicKey: this.derivePublicKey(secretKey),
-            secretKey: secretKey.slice(),
+            // Buffer.slice() aliases its input; the returned key must own its bytes.
+            secretKey: new Uint8Array(secretKey),
         };
     },
     derivePublicKey(secretKey) {
+        ensureByteArray(secretKey);
         if (secretKey.length !== P521_ECDH_SECRET_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
@@ -40,6 +43,8 @@ export const ReallyMeP521Ecdh = {
         }
     },
     deriveSharedSecret(publicKey, secretKey) {
+        ensureByteArray(publicKey);
+        ensureByteArray(secretKey);
         if (publicKey.length !== P521_ECDH_COMPRESSED_PUBLIC_KEY_LENGTH ||
             secretKey.length !== P521_ECDH_SECRET_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");

package/dist/p521Ecdsa.js

@@ -1,10 +1,11 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { p521 } from "@noble/curves/nist.js";
 import { sha512 } from "@noble/hashes/sha2.js";
 import { decodeEcdsaDerSignature, encodeEcdsaDerSignature, } from "./encodeEcdsaDer.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray } from "./validateBytes.js";
 export const P521_ECDSA_SECRET_KEY_LENGTH = 66;
 export const P521_ECDSA_COMPRESSED_PUBLIC_KEY_LENGTH = 67;
 export const P521_ECDSA_COMPACT_SIGNATURE_LENGTH = 132;
@@ -26,10 +27,12 @@ export const ReallyMeP521Ecdsa = {
     deriveKeyPair(secretKey) {
         return {
             publicKey: this.derivePublicKey(secretKey),
-            secretKey: secretKey.slice(),
+            // Buffer.slice() aliases its input; the returned key must own its bytes.
+            secretKey: new Uint8Array(secretKey),
         };
     },
     derivePublicKey(secretKey) {
+        ensureByteArray(secretKey);
         if (secretKey.length !== P521_ECDSA_SECRET_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
@@ -41,6 +44,8 @@ export const ReallyMeP521Ecdsa = {
         }
     },
     sign(message, secretKey) {
+        ensureByteArray(message);
+        ensureByteArray(secretKey);
         if (secretKey.length !== P521_ECDSA_SECRET_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
@@ -56,6 +61,9 @@ export const ReallyMeP521Ecdsa = {
         }
     },
     verify(signature, message, publicKey) {
+        ensureByteArray(signature);
+        ensureByteArray(message);
+        ensureByteArray(publicKey);
         if (publicKey.length !== P521_ECDSA_COMPRESSED_PUBLIC_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }

package/dist/pbkdf2.js

@@ -1,9 +1,10 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { pbkdf2 } from "@noble/hashes/pbkdf2.js";
 import { sha256, sha512 } from "@noble/hashes/sha2.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray } from "./validateBytes.js";
 export const PBKDF2_MIN_INPUT_LENGTH = 1;
 export const PBKDF2_MAX_INPUT_LENGTH = 4096;
 // Public derivation routes enforce a modern baseline. Historical hashes with a
@@ -42,6 +43,8 @@ export const ReallyMePbkdf2 = {
     },
 };
 function validate(password, salt, iterations, outputLength) {
+    ensureByteArray(password);
+    ensureByteArray(salt);
     if (password.length < PBKDF2_MIN_INPUT_LENGTH ||
         password.length > PBKDF2_MAX_INPUT_LENGTH ||
         salt.length < PBKDF2_MIN_INPUT_LENGTH ||

package/dist/proto/generated/reallyme/crypto/v1/crypto_pb.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { enumDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
 /**
  * Describes the file reallyme/crypto/v1/crypto.proto.

package/dist/proto.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { create, fromBinary, toBinary } from "@bufbuild/protobuf";
 import { ReallyMeCryptoError } from "./errors.js";
 import { MAX_JWKS_KEYS, ReallyMeJwk } from "./jwk.js";

package/dist/providerCatalog.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 /** Providers compiled into the TypeScript package. */
 export const REALLYME_CRYPTO_PROVIDERS = [
     "@noble/curves",

package/dist/rsa.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
 import { ensureByteArray, ensureByteArrayAtMost, MAX_CRYPTO_INPUT_LENGTH, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";

package/dist/secp256k1.js

@@ -1,9 +1,10 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { secp256k1 } from "@noble/curves/secp256k1.js";
 import { sha256 } from "@noble/hashes/sha2.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray } from "./validateBytes.js";
 /**
  * secp256k1 ECDSA backed by @noble/curves — the same pinned implementation
  * the TypeScript conformance lane proves vectors against.
@@ -36,11 +37,13 @@ export const ReallyMeSecp256k1 = {
     deriveKeyPair(secretKey) {
         return {
             publicKey: this.derivePublicKey(secretKey),
-            secretKey: secretKey.slice(),
+            // Buffer.slice() aliases its input; the returned key must own its bytes.
+            secretKey: new Uint8Array(secretKey),
         };
     },
     /** Derives the 33-byte compressed SEC1 public key for a 32-byte secret. */
     derivePublicKey(secretKey) {
+        ensureByteArray(secretKey);
         if (secretKey.length !== SECP256K1_SECRET_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
@@ -56,6 +59,8 @@ export const ReallyMeSecp256k1 = {
      * SHA-256(message), returning the 64-byte compact low-S signature.
      */
     sign(message, secretKey) {
+        ensureByteArray(message);
+        ensureByteArray(secretKey);
         if (secretKey.length !== SECP256K1_SECRET_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
@@ -80,6 +85,9 @@ export const ReallyMeSecp256k1 = {
      * high-S twin (BIP 0062), which every workspace lane rejects.
      */
     verify(signature, message, publicKey) {
+        ensureByteArray(signature);
+        ensureByteArray(message);
+        ensureByteArray(publicKey);
         if (signature.length !== SECP256K1_SIGNATURE_LENGTH ||
             publicKey.length !== SECP256K1_COMPRESSED_PUBLIC_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");

package/dist/slhDsa.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
 import { ensureByteArrayAtMost, ensureBytes, ensureIndependentByteArray, MAX_CRYPTO_INPUT_LENGTH, readIndependentByteArrayProperty, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";

package/dist/validateBytes.d.ts

@@ -1,5 +1,5 @@
 export declare const MAX_CRYPTO_INPUT_LENGTH = 1048576;
-export declare const ensureByteArray: (value: Uint8Array) => void;
+export declare function ensureByteArray(value: unknown): asserts value is Uint8Array;
 export declare const ensureByteArrayAtMost: (value: Uint8Array, maximumLength: number) => void;
 export declare const ensureBytes: (value: Uint8Array, expectedLength: number) => void;
 export declare const byteArraysOverlap: (left: Uint8Array, right: Uint8Array) => boolean;

package/dist/validateBytes.js

@@ -1,15 +1,31 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
 // Match the structured operation boundary so direct primitive facades cannot
 // ask a provider to copy or allocate an attacker-controlled unbounded buffer.
 export const MAX_CRYPTO_INPUT_LENGTH = 1_048_576;
-export const ensureByteArray = (value) => {
-    if (!(value instanceof Uint8Array)) {
+// The intrinsic getter reads the typed-array element kind from internal slots.
+// instanceof rejects legitimate arrays from other realms, while an object's
+// constructor name or own toStringTag can be spoofed.
+const typedArrayTagGetter = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), Symbol.toStringTag)?.get;
+export function ensureByteArray(value) {
+    if (!ArrayBuffer.isView(value) || typedArrayTagGetter === undefined) {
         throw new ReallyMeCryptoError("invalid-input");
     }
-};
+    try {
+        const elementKind = Reflect.apply(typedArrayTagGetter, value, []);
+        if (elementKind !== "Uint8Array") {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        // Detached views report zero length; validate the backing store before a
+        // provider can confuse them with an intentionally empty message.
+        Uint8Array.prototype.values.call(value);
+    }
+    catch {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+}
 export const ensureByteArrayAtMost = (value, maximumLength) => {
     ensureByteArray(value);
     if (value.length > maximumLength) {

package/dist/wasm/LICENSE

@@ -1,3 +1,29 @@
+ReallyMe Crypto is licensed, at your option, under either the MIT License or
+the Apache License, Version 2.0. The full text of both licenses follows.
+Third-party components retain their own licenses and notices.
+
+MIT License
+
+Copyright © 2026 ReallyMe LLC.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/

package/dist/wasmModuleTypes.js

@@ -1,4 +1,4 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 export {};

package/dist/wasmProvider.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
 let installedProvider;
 const requireObject = (module) => {

package/dist/x25519.js

@@ -1,8 +1,9 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { x25519 } from "@noble/curves/ed25519.js";
 import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArray } from "./validateBytes.js";
 /**
  * X25519 key agreement backed by @noble/curves — the same pinned
  * implementation the TypeScript conformance lane proves vectors against.
@@ -28,11 +29,13 @@ export const ReallyMeX25519 = {
     deriveKeyPair(secretKey) {
         return {
             publicKey: this.derivePublicKey(secretKey),
-            secretKey: secretKey.slice(),
+            // Buffer.slice() aliases its input; the returned key must own its bytes.
+            secretKey: new Uint8Array(secretKey),
         };
     },
     /** Derives the 32-byte X25519 public key from a 32-byte secret. */
     derivePublicKey(secretKey) {
+        ensureByteArray(secretKey);
         if (secretKey.length !== X25519_SECRET_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");
         }
@@ -45,6 +48,8 @@ export const ReallyMeX25519 = {
     },
     /** Derives the raw 32-byte X25519 shared secret. */
     deriveSharedSecret(publicKey, secretKey) {
+        ensureByteArray(publicKey);
+        ensureByteArray(secretKey);
         if (publicKey.length !== X25519_PUBLIC_KEY_LENGTH ||
             secretKey.length !== X25519_SECRET_KEY_LENGTH) {
             throw new ReallyMeCryptoError("invalid-input");

package/dist/xWing.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";
 import { ensureBytes, readIndependentByteArrayProperty, readIndependentProviderBytes, } from "./validateBytes.js";
 import { requireReallyMeWasmProvider } from "./wasmProvider.js";

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@reallyme/crypto",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "ReallyMe crypto SDK for TypeScript/JavaScript with an explicit, pinned provider set.",
-  "license": "Apache-2.0",
+  "license": "MIT OR Apache-2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/reallyme/crypto.git",
@@ -55,7 +55,7 @@
     "@bufbuild/protobuf": "2.14.1",
     "@noble/curves": "2.4.0",
     "@noble/hashes": "2.4.0",
-    "@reallyme/codec": "0.2.2"
+    "@reallyme/codec": "0.2.3"
   },
   "devDependencies": {
     "typescript": "7.0.2"