@reallyme/crypto 0.3.9 → 0.3.11

package/dist/verifyBundledWasmModule.d.ts

@@ -0,0 +1,63 @@
+import { processOperationResponse, processOperationResponseJson, aes128GcmSeal, aes128GcmOpen, aes192GcmSeal, aes192GcmOpen, aes256GcmSeal, aes256GcmOpen, aes256GcmSivSeal, aes256GcmSivOpen, chacha20Poly1305Seal, chacha20Poly1305Open, xchacha20Poly1305Seal, xchacha20Poly1305Open, aes128KwWrapKey, aes128KwUnwrapKey, aes192KwWrapKey, aes192KwUnwrapKey, aes256KwWrapKey, aes256KwUnwrapKey, argon2idDeriveKey, kmac256Derive, hpkeSealBase, hpkeOpenBase, mlDsa44GenerateKeypair, mlDsa44DeriveKeypair, mlDsa44Sign, mlDsa44Verify, mlDsa65GenerateKeypair, mlDsa65DeriveKeypair, mlDsa65Sign, mlDsa65Verify, mlDsa87GenerateKeypair, mlDsa87DeriveKeypair, mlDsa87Sign, mlDsa87Verify, mlKem512GenerateKeypair, mlKem512DeriveKeypair, mlKem512Encapsulate, mlKem512Decapsulate, mlKem768GenerateKeypair, mlKem768DeriveKeypair, mlKem768Encapsulate, mlKem768Decapsulate, mlKem1024GenerateKeypair, mlKem1024DeriveKeypair, mlKem1024Encapsulate, mlKem1024Decapsulate, slhDsaSha2128sGenerateKeypair, slhDsaSha2128sDeriveKeypair, slhDsaSha2128sSign, slhDsaSha2128sVerify, rsaVerifyPkcs1v15, rsaVerifyPss, xWing768GenerateKeypair, xWing768DeriveKeypair, xWing768Encapsulate, xWing768Decapsulate } from "../dist/wasm/reallyme_crypto_wasm.js";
+export declare const bundledWasmFunctions: Readonly<{
+    processOperationResponse: typeof processOperationResponse;
+    processOperationResponseJson: typeof processOperationResponseJson;
+    aes128GcmSeal: typeof aes128GcmSeal;
+    aes128GcmOpen: typeof aes128GcmOpen;
+    aes192GcmSeal: typeof aes192GcmSeal;
+    aes192GcmOpen: typeof aes192GcmOpen;
+    aes256GcmSeal: typeof aes256GcmSeal;
+    aes256GcmOpen: typeof aes256GcmOpen;
+    aes256GcmSivSeal: typeof aes256GcmSivSeal;
+    aes256GcmSivOpen: typeof aes256GcmSivOpen;
+    chacha20Poly1305Seal: typeof chacha20Poly1305Seal;
+    chacha20Poly1305Open: typeof chacha20Poly1305Open;
+    xchacha20Poly1305Seal: typeof xchacha20Poly1305Seal;
+    xchacha20Poly1305Open: typeof xchacha20Poly1305Open;
+    aes128KwWrapKey: typeof aes128KwWrapKey;
+    aes128KwUnwrapKey: typeof aes128KwUnwrapKey;
+    aes192KwWrapKey: typeof aes192KwWrapKey;
+    aes192KwUnwrapKey: typeof aes192KwUnwrapKey;
+    aes256KwWrapKey: typeof aes256KwWrapKey;
+    aes256KwUnwrapKey: typeof aes256KwUnwrapKey;
+    argon2idDeriveKey: typeof argon2idDeriveKey;
+    kmac256Derive: typeof kmac256Derive;
+    hpkeSealBase: typeof hpkeSealBase;
+    hpkeOpenBase: typeof hpkeOpenBase;
+    mlDsa44GenerateKeypair: typeof mlDsa44GenerateKeypair;
+    mlDsa44DeriveKeypair: typeof mlDsa44DeriveKeypair;
+    mlDsa44Sign: typeof mlDsa44Sign;
+    mlDsa44Verify: typeof mlDsa44Verify;
+    mlDsa65GenerateKeypair: typeof mlDsa65GenerateKeypair;
+    mlDsa65DeriveKeypair: typeof mlDsa65DeriveKeypair;
+    mlDsa65Sign: typeof mlDsa65Sign;
+    mlDsa65Verify: typeof mlDsa65Verify;
+    mlDsa87GenerateKeypair: typeof mlDsa87GenerateKeypair;
+    mlDsa87DeriveKeypair: typeof mlDsa87DeriveKeypair;
+    mlDsa87Sign: typeof mlDsa87Sign;
+    mlDsa87Verify: typeof mlDsa87Verify;
+    mlKem512GenerateKeypair: typeof mlKem512GenerateKeypair;
+    mlKem512DeriveKeypair: typeof mlKem512DeriveKeypair;
+    mlKem512Encapsulate: typeof mlKem512Encapsulate;
+    mlKem512Decapsulate: typeof mlKem512Decapsulate;
+    mlKem768GenerateKeypair: typeof mlKem768GenerateKeypair;
+    mlKem768DeriveKeypair: typeof mlKem768DeriveKeypair;
+    mlKem768Encapsulate: typeof mlKem768Encapsulate;
+    mlKem768Decapsulate: typeof mlKem768Decapsulate;
+    mlKem1024GenerateKeypair: typeof mlKem1024GenerateKeypair;
+    mlKem1024DeriveKeypair: typeof mlKem1024DeriveKeypair;
+    mlKem1024Encapsulate: typeof mlKem1024Encapsulate;
+    mlKem1024Decapsulate: typeof mlKem1024Decapsulate;
+    slhDsaSha2128sGenerateKeypair: typeof slhDsaSha2128sGenerateKeypair;
+    slhDsaSha2128sDeriveKeypair: typeof slhDsaSha2128sDeriveKeypair;
+    slhDsaSha2128sSign: typeof slhDsaSha2128sSign;
+    slhDsaSha2128sVerify: typeof slhDsaSha2128sVerify;
+    rsaVerifyPkcs1v15: typeof rsaVerifyPkcs1v15;
+    rsaVerifyPss: typeof rsaVerifyPss;
+    xWing768GenerateKeypair: typeof xWing768GenerateKeypair;
+    xWing768DeriveKeypair: typeof xWing768DeriveKeypair;
+    xWing768Encapsulate: typeof xWing768Encapsulate;
+    xWing768Decapsulate: typeof xWing768Decapsulate;
+}>;
+/** Reject any replacement of the package-owned WASM callables before global installation. */
+export declare const verifyBundledWasmModule: (module: object) => boolean;

package/dist/verifyBundledWasmModule.js

@@ -0,0 +1,80 @@
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
+//
+// SPDX-License-Identifier: MIT OR Apache-2.0
+import { processOperationResponse, processOperationResponseJson, aes128GcmSeal, aes128GcmOpen, aes192GcmSeal, aes192GcmOpen, aes256GcmSeal, aes256GcmOpen, aes256GcmSivSeal, aes256GcmSivOpen, chacha20Poly1305Seal, chacha20Poly1305Open, xchacha20Poly1305Seal, xchacha20Poly1305Open, aes128KwWrapKey, aes128KwUnwrapKey, aes192KwWrapKey, aes192KwUnwrapKey, aes256KwWrapKey, aes256KwUnwrapKey, argon2idDeriveKey, kmac256Derive, hpkeSealBase, hpkeOpenBase, mlDsa44GenerateKeypair, mlDsa44DeriveKeypair, mlDsa44Sign, mlDsa44Verify, mlDsa65GenerateKeypair, mlDsa65DeriveKeypair, mlDsa65Sign, mlDsa65Verify, mlDsa87GenerateKeypair, mlDsa87DeriveKeypair, mlDsa87Sign, mlDsa87Verify, mlKem512GenerateKeypair, mlKem512DeriveKeypair, mlKem512Encapsulate, mlKem512Decapsulate, mlKem768GenerateKeypair, mlKem768DeriveKeypair, mlKem768Encapsulate, mlKem768Decapsulate, mlKem1024GenerateKeypair, mlKem1024DeriveKeypair, mlKem1024Encapsulate, mlKem1024Decapsulate, slhDsaSha2128sGenerateKeypair, slhDsaSha2128sDeriveKeypair, slhDsaSha2128sSign, slhDsaSha2128sVerify, rsaVerifyPkcs1v15, rsaVerifyPss, xWing768GenerateKeypair, xWing768DeriveKeypair, xWing768Encapsulate, xWing768Decapsulate, } from "../dist/wasm/reallyme_crypto_wasm.js";
+export const bundledWasmFunctions = Object.freeze({
+    processOperationResponse,
+    processOperationResponseJson,
+    aes128GcmSeal,
+    aes128GcmOpen,
+    aes192GcmSeal,
+    aes192GcmOpen,
+    aes256GcmSeal,
+    aes256GcmOpen,
+    aes256GcmSivSeal,
+    aes256GcmSivOpen,
+    chacha20Poly1305Seal,
+    chacha20Poly1305Open,
+    xchacha20Poly1305Seal,
+    xchacha20Poly1305Open,
+    aes128KwWrapKey,
+    aes128KwUnwrapKey,
+    aes192KwWrapKey,
+    aes192KwUnwrapKey,
+    aes256KwWrapKey,
+    aes256KwUnwrapKey,
+    argon2idDeriveKey,
+    kmac256Derive,
+    hpkeSealBase,
+    hpkeOpenBase,
+    mlDsa44GenerateKeypair,
+    mlDsa44DeriveKeypair,
+    mlDsa44Sign,
+    mlDsa44Verify,
+    mlDsa65GenerateKeypair,
+    mlDsa65DeriveKeypair,
+    mlDsa65Sign,
+    mlDsa65Verify,
+    mlDsa87GenerateKeypair,
+    mlDsa87DeriveKeypair,
+    mlDsa87Sign,
+    mlDsa87Verify,
+    mlKem512GenerateKeypair,
+    mlKem512DeriveKeypair,
+    mlKem512Encapsulate,
+    mlKem512Decapsulate,
+    mlKem768GenerateKeypair,
+    mlKem768DeriveKeypair,
+    mlKem768Encapsulate,
+    mlKem768Decapsulate,
+    mlKem1024GenerateKeypair,
+    mlKem1024DeriveKeypair,
+    mlKem1024Encapsulate,
+    mlKem1024Decapsulate,
+    slhDsaSha2128sGenerateKeypair,
+    slhDsaSha2128sDeriveKeypair,
+    slhDsaSha2128sSign,
+    slhDsaSha2128sVerify,
+    rsaVerifyPkcs1v15,
+    rsaVerifyPss,
+    xWing768GenerateKeypair,
+    xWing768DeriveKeypair,
+    xWing768Encapsulate,
+    xWing768Decapsulate,
+});
+/** Reject any replacement of the package-owned WASM callables before global installation. */
+export const verifyBundledWasmModule = (module) => {
+    try {
+        for (const [name, expected] of Object.entries(bundledWasmFunctions)) {
+            const descriptor = Object.getOwnPropertyDescriptor(module, name);
+            const candidate = descriptor?.get === undefined ? descriptor?.value : Reflect.get(module, name);
+            if (candidate !== expected) {
+                return false;
+            }
+        }
+    }
+    catch {
+        return false;
+    }
+    return true;
+};

package/dist/wasm/reallyme_crypto_wasm.d.ts

@@ -0,0 +1,383 @@
+/* tslint:disable */
+/* eslint-disable */
+
+/**
+ * Open and authenticate an AES-128-GCM `ciphertext || tag`.
+ */
+export function aes128GcmOpen(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array): Uint8Array;
+
+/**
+ * Seal plaintext with AES-128-GCM and return `ciphertext || tag`.
+ */
+export function aes128GcmSeal(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): Uint8Array;
+
+/**
+ * Unwrap key material with AES-128-KW.
+ */
+export function aes128KwUnwrapKey(kek: Uint8Array, wrapped_key: Uint8Array): Uint8Array;
+
+/**
+ * Wrap key material with AES-128-KW.
+ */
+export function aes128KwWrapKey(kek: Uint8Array, key_data: Uint8Array): Uint8Array;
+
+/**
+ * Open and authenticate an AES-192-GCM `ciphertext || tag`.
+ */
+export function aes192GcmOpen(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array): Uint8Array;
+
+/**
+ * Seal plaintext with AES-192-GCM and return `ciphertext || tag`.
+ */
+export function aes192GcmSeal(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): Uint8Array;
+
+/**
+ * Unwrap key material with AES-192-KW.
+ */
+export function aes192KwUnwrapKey(kek: Uint8Array, wrapped_key: Uint8Array): Uint8Array;
+
+/**
+ * Wrap key material with AES-192-KW.
+ */
+export function aes192KwWrapKey(kek: Uint8Array, key_data: Uint8Array): Uint8Array;
+
+/**
+ * Open and authenticate an AES-256-GCM `ciphertext || tag`.
+ */
+export function aes256GcmOpen(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array): Uint8Array;
+
+/**
+ * Seal plaintext with AES-256-GCM and return `ciphertext || tag`.
+ */
+export function aes256GcmSeal(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): Uint8Array;
+
+/**
+ * Open and authenticate an AES-256-GCM-SIV `ciphertext || tag`.
+ */
+export function aes256GcmSivOpen(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array): Uint8Array;
+
+/**
+ * Seal plaintext with AES-256-GCM-SIV and return `ciphertext || tag`.
+ */
+export function aes256GcmSivSeal(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): Uint8Array;
+
+/**
+ * Unwrap key material with AES-256-KW.
+ */
+export function aes256KwUnwrapKey(kek: Uint8Array, wrapped_key: Uint8Array): Uint8Array;
+
+/**
+ * Wrap key material with AES-256-KW.
+ */
+export function aes256KwWrapKey(kek: Uint8Array, key_data: Uint8Array): Uint8Array;
+
+/**
+ * Derive the fixed 32-byte Argon2id key for a versioned ReallyMe profile.
+ */
+export function argon2idDeriveKey(kdf_version: number, secret: Uint8Array, salt: Uint8Array): Uint8Array;
+
+/**
+ * Open and authenticate a ChaCha20-Poly1305 `ciphertext || tag`.
+ */
+export function chacha20Poly1305Open(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array): Uint8Array;
+
+/**
+ * Seal plaintext with ChaCha20-Poly1305 and return `ciphertext || tag`.
+ */
+export function chacha20Poly1305Seal(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): Uint8Array;
+
+/**
+ * Open one RFC 9180 HPKE Base-mode message.
+ */
+export function hpkeOpenBase(suite: number, recipient_secret_key: Uint8Array, encapsulated_key: Uint8Array, info: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array): Uint8Array;
+
+/**
+ * Seal one RFC 9180 HPKE Base-mode message.
+ */
+export function hpkeSealBase(suite: number, recipient_public_key: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): any;
+
+/**
+ * Derive key material with KMAC256.
+ */
+export function kmac256Derive(key: Uint8Array, context: Uint8Array, customization: Uint8Array, output_length: number): Uint8Array;
+
+/**
+ * Derive an ML-DSA-44 keypair from a 32-byte seed.
+ */
+export function mlDsa44DeriveKeypair(secret_key: Uint8Array): any;
+
+/**
+ * Generate an ML-DSA-44 keypair.
+ */
+export function mlDsa44GenerateKeypair(): any;
+
+/**
+ * Sign a message with ML-DSA-44.
+ */
+export function mlDsa44Sign(secret_key: Uint8Array, message: Uint8Array): Uint8Array;
+
+/**
+ * Verify an ML-DSA-44 detached signature.
+ */
+export function mlDsa44Verify(public_key: Uint8Array, message: Uint8Array, signature: Uint8Array): void;
+
+/**
+ * Derive an ML-DSA-65 keypair from a 32-byte seed.
+ */
+export function mlDsa65DeriveKeypair(secret_key: Uint8Array): any;
+
+/**
+ * Generate an ML-DSA-65 keypair.
+ */
+export function mlDsa65GenerateKeypair(): any;
+
+/**
+ * Sign a message with ML-DSA-65.
+ */
+export function mlDsa65Sign(secret_key: Uint8Array, message: Uint8Array): Uint8Array;
+
+/**
+ * Verify an ML-DSA-65 detached signature.
+ */
+export function mlDsa65Verify(public_key: Uint8Array, message: Uint8Array, signature: Uint8Array): void;
+
+/**
+ * Derive an ML-DSA-87 keypair from a 32-byte seed.
+ */
+export function mlDsa87DeriveKeypair(secret_key: Uint8Array): any;
+
+/**
+ * Generate an ML-DSA-87 keypair.
+ */
+export function mlDsa87GenerateKeypair(): any;
+
+/**
+ * Sign a message with ML-DSA-87.
+ */
+export function mlDsa87Sign(secret_key: Uint8Array, message: Uint8Array): Uint8Array;
+
+/**
+ * Verify an ML-DSA-87 detached signature.
+ */
+export function mlDsa87Verify(public_key: Uint8Array, message: Uint8Array, signature: Uint8Array): void;
+
+/**
+ * Decapsulate an ML-KEM-1024 ciphertext.
+ */
+export function mlKem1024Decapsulate(ciphertext: Uint8Array, secret_key: Uint8Array): Uint8Array;
+
+/**
+ * Derive an ML-KEM-1024 keypair from a 64-byte FIPS 203 seed.
+ */
+export function mlKem1024DeriveKeypair(secret_key: Uint8Array): any;
+
+/**
+ * Encapsulate to an ML-KEM-1024 public key.
+ */
+export function mlKem1024Encapsulate(public_key: Uint8Array): any;
+
+/**
+ * Generate an ML-KEM-1024 keypair.
+ */
+export function mlKem1024GenerateKeypair(): any;
+
+/**
+ * Decapsulate an ML-KEM-512 ciphertext.
+ */
+export function mlKem512Decapsulate(ciphertext: Uint8Array, secret_key: Uint8Array): Uint8Array;
+
+/**
+ * Derive an ML-KEM-512 keypair from a 64-byte FIPS 203 seed.
+ */
+export function mlKem512DeriveKeypair(secret_key: Uint8Array): any;
+
+/**
+ * Encapsulate to an ML-KEM-512 public key.
+ */
+export function mlKem512Encapsulate(public_key: Uint8Array): any;
+
+/**
+ * Generate an ML-KEM-512 keypair.
+ */
+export function mlKem512GenerateKeypair(): any;
+
+/**
+ * Decapsulate an ML-KEM-768 ciphertext.
+ */
+export function mlKem768Decapsulate(ciphertext: Uint8Array, secret_key: Uint8Array): Uint8Array;
+
+/**
+ * Derive an ML-KEM-768 keypair from a 64-byte FIPS 203 seed.
+ */
+export function mlKem768DeriveKeypair(secret_key: Uint8Array): any;
+
+/**
+ * Encapsulate to an ML-KEM-768 public key.
+ */
+export function mlKem768Encapsulate(public_key: Uint8Array): any;
+
+/**
+ * Generate an ML-KEM-768 keypair.
+ */
+export function mlKem768GenerateKeypair(): any;
+
+/**
+ * Execute one generated binary protobuf request and return a binary `CryptoOperationResponse`.
+ */
+export function processOperationResponse(request: Uint8Array): Uint8Array;
+
+/**
+ * Execute one generated ProtoJSON request and return a binary `CryptoOperationResponse`.
+ */
+export function processOperationResponseJson(request_json: Uint8Array): Uint8Array;
+
+/**
+ * Verify an RSASSA-PKCS1-v1_5 signature against a DER RSA public key.
+ */
+export function rsaVerifyPkcs1v15(public_key_der: Uint8Array, public_key_encoding: number, hash_suite: number, message: Uint8Array, signature: Uint8Array): void;
+
+/**
+ * Verify an RSASSA-PSS signature against a DER RSA public key.
+ */
+export function rsaVerifyPss(public_key_der: Uint8Array, public_key_encoding: number, message_hash_suite: number, mgf1_hash_suite: number, salt_len: number, message: Uint8Array, signature: Uint8Array): void;
+
+/**
+ * Derive an SLH-DSA-SHA2-128s keypair from the three FIPS 205 seeds.
+ */
+export function slhDsaSha2128sDeriveKeypair(sk_seed: Uint8Array, sk_prf: Uint8Array, pk_seed: Uint8Array): any;
+
+/**
+ * Generate an SLH-DSA-SHA2-128s keypair.
+ */
+export function slhDsaSha2128sGenerateKeypair(): any;
+
+/**
+ * Sign a message with SLH-DSA-SHA2-128s.
+ */
+export function slhDsaSha2128sSign(secret_key: Uint8Array, message: Uint8Array): Uint8Array;
+
+/**
+ * Verify an SLH-DSA-SHA2-128s detached signature.
+ */
+export function slhDsaSha2128sVerify(public_key: Uint8Array, message: Uint8Array, signature: Uint8Array): void;
+
+/**
+ * Decapsulate an X-Wing-768 ciphertext with a 32-byte secret seed.
+ */
+export function xWing768Decapsulate(ciphertext: Uint8Array, secret_key: Uint8Array): Uint8Array;
+
+/**
+ * Derive an X-Wing-768 public key from a 32-byte secret seed.
+ */
+export function xWing768DeriveKeypair(secret_key: Uint8Array): any;
+
+/**
+ * Randomly encapsulate to an X-Wing-768 public key.
+ */
+export function xWing768Encapsulate(public_key: Uint8Array): any;
+
+/**
+ * Generate a random X-Wing-768 keypair for the TypeScript WASM provider.
+ */
+export function xWing768GenerateKeypair(): any;
+
+/**
+ * Open and authenticate an XChaCha20-Poly1305 `ciphertext || tag`.
+ */
+export function xchacha20Poly1305Open(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array): Uint8Array;
+
+/**
+ * Seal plaintext with XChaCha20-Poly1305 and return `ciphertext || tag`.
+ */
+export function xchacha20Poly1305Seal(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): Uint8Array;
+
+export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembly.Module;
+
+export interface InitOutput {
+    readonly memory: WebAssembly.Memory;
+    readonly aes128GcmOpen: (a: any, b: any, c: any, d: any) => [number, number, number];
+    readonly aes128GcmSeal: (a: any, b: any, c: any, d: any) => [number, number, number];
+    readonly aes128KwUnwrapKey: (a: any, b: any) => [number, number, number];
+    readonly aes128KwWrapKey: (a: any, b: any) => [number, number, number];
+    readonly aes192GcmOpen: (a: any, b: any, c: any, d: any) => [number, number, number];
+    readonly aes192GcmSeal: (a: any, b: any, c: any, d: any) => [number, number, number];
+    readonly aes192KwUnwrapKey: (a: any, b: any) => [number, number, number];
+    readonly aes192KwWrapKey: (a: any, b: any) => [number, number, number];
+    readonly aes256GcmOpen: (a: any, b: any, c: any, d: any) => [number, number, number];
+    readonly aes256GcmSeal: (a: any, b: any, c: any, d: any) => [number, number, number];
+    readonly aes256GcmSivOpen: (a: any, b: any, c: any, d: any) => [number, number, number];
+    readonly aes256GcmSivSeal: (a: any, b: any, c: any, d: any) => [number, number, number];
+    readonly aes256KwUnwrapKey: (a: any, b: any) => [number, number, number];
+    readonly aes256KwWrapKey: (a: any, b: any) => [number, number, number];
+    readonly argon2idDeriveKey: (a: number, b: any, c: any) => [number, number, number];
+    readonly chacha20Poly1305Open: (a: any, b: any, c: any, d: any) => [number, number, number];
+    readonly chacha20Poly1305Seal: (a: any, b: any, c: any, d: any) => [number, number, number];
+    readonly hpkeOpenBase: (a: number, b: any, c: any, d: any, e: any, f: any) => [number, number, number];
+    readonly hpkeSealBase: (a: number, b: any, c: any, d: any, e: any) => [number, number, number];
+    readonly kmac256Derive: (a: any, b: any, c: any, d: number) => [number, number, number];
+    readonly mlDsa44DeriveKeypair: (a: any) => [number, number, number];
+    readonly mlDsa44GenerateKeypair: () => [number, number, number];
+    readonly mlDsa44Sign: (a: any, b: any) => [number, number, number];
+    readonly mlDsa44Verify: (a: any, b: any, c: any) => [number, number];
+    readonly mlDsa65DeriveKeypair: (a: any) => [number, number, number];
+    readonly mlDsa65GenerateKeypair: () => [number, number, number];
+    readonly mlDsa65Sign: (a: any, b: any) => [number, number, number];
+    readonly mlDsa65Verify: (a: any, b: any, c: any) => [number, number];
+    readonly mlDsa87DeriveKeypair: (a: any) => [number, number, number];
+    readonly mlDsa87GenerateKeypair: () => [number, number, number];
+    readonly mlDsa87Sign: (a: any, b: any) => [number, number, number];
+    readonly mlDsa87Verify: (a: any, b: any, c: any) => [number, number];
+    readonly mlKem1024Decapsulate: (a: any, b: any) => [number, number, number];
+    readonly mlKem1024DeriveKeypair: (a: any) => [number, number, number];
+    readonly mlKem1024Encapsulate: (a: any) => [number, number, number];
+    readonly mlKem1024GenerateKeypair: () => [number, number, number];
+    readonly mlKem512Decapsulate: (a: any, b: any) => [number, number, number];
+    readonly mlKem512DeriveKeypair: (a: any) => [number, number, number];
+    readonly mlKem512Encapsulate: (a: any) => [number, number, number];
+    readonly mlKem512GenerateKeypair: () => [number, number, number];
+    readonly mlKem768Decapsulate: (a: any, b: any) => [number, number, number];
+    readonly mlKem768DeriveKeypair: (a: any) => [number, number, number];
+    readonly mlKem768Encapsulate: (a: any) => [number, number, number];
+    readonly mlKem768GenerateKeypair: () => [number, number, number];
+    readonly processOperationResponse: (a: any) => any;
+    readonly processOperationResponseJson: (a: any) => any;
+    readonly rsaVerifyPkcs1v15: (a: any, b: number, c: number, d: any, e: any) => [number, number];
+    readonly rsaVerifyPss: (a: any, b: number, c: number, d: number, e: number, f: any, g: any) => [number, number];
+    readonly slhDsaSha2128sDeriveKeypair: (a: any, b: any, c: any) => [number, number, number];
+    readonly slhDsaSha2128sGenerateKeypair: () => [number, number, number];
+    readonly slhDsaSha2128sSign: (a: any, b: any) => [number, number, number];
+    readonly slhDsaSha2128sVerify: (a: any, b: any, c: any) => [number, number];
+    readonly xWing768Decapsulate: (a: any, b: any) => [number, number, number];
+    readonly xWing768DeriveKeypair: (a: any) => [number, number, number];
+    readonly xWing768Encapsulate: (a: any) => [number, number, number];
+    readonly xWing768GenerateKeypair: () => [number, number, number];
+    readonly xchacha20Poly1305Open: (a: any, b: any, c: any, d: any) => [number, number, number];
+    readonly xchacha20Poly1305Seal: (a: any, b: any, c: any, d: any) => [number, number, number];
+    readonly __wbindgen_exn_store: (a: number) => void;
+    readonly __externref_table_alloc: () => number;
+    readonly __wbindgen_externrefs: WebAssembly.Table;
+    readonly __externref_table_dealloc: (a: number) => void;
+    readonly __wbindgen_start: () => void;
+}
+
+export type SyncInitInput = BufferSource | WebAssembly.Module;
+
+/**
+ * Instantiates the given `module`, which can either be bytes or
+ * a precompiled `WebAssembly.Module`.
+ *
+ * @param {{ module: SyncInitInput }} module - Passing `SyncInitInput` directly is deprecated.
+ *
+ * @returns {InitOutput}
+ */
+export function initSync(module: { module: SyncInitInput } | SyncInitInput): InitOutput;
+
+/**
+ * If `module_or_path` is {RequestInfo} or {URL}, makes a request and
+ * for everything else, calls `WebAssembly.instantiate` directly.
+ *
+ * @param {{ module_or_path: InitInput | Promise<InitInput> }} module_or_path - Passing `InitInput` directly is deprecated.
+ *
+ * @returns {Promise<InitOutput>}
+ */
+export default function __wbg_init (module_or_path?: { module_or_path: InitInput | Promise<InitInput> } | InitInput | Promise<InitInput>): Promise<InitOutput>;

package/dist/wasm/reallyme_crypto_wasm.js

@@ -814,37 +814,37 @@ export function xchacha20Poly1305Seal(key, nonce, aad, plaintext) {
 function __wbg_get_imports() {
     const import0 = {
         __proto__: null,
-        __wbg___wbindgen_throw_bb96b2010945f0bc: function(arg0, arg1) {
+        __wbg___wbindgen_throw_41e9ee4f547fc59a: function(arg0, arg1) {
             throw new Error(getStringFromWasm0(arg0, arg1));
         },
         __wbg_getRandomValues_436a51d0629d84e1: function() { return handleError(function (arg0, arg1) {
             globalThis.crypto.getRandomValues(getArrayU8FromWasm0(arg0, arg1));
         }, arguments); },
-        __wbg_length_36bd29c6848c2144: function(arg0) {
+        __wbg_length_7f3c00c40364105e: function(arg0) {
             const ret = arg0.length;
             return ret;
         },
-        __wbg_new_ebe3e0f6837f0879: function() {
+        __wbg_new_617a8cdb8bb1130e: function() {
             const ret = new Object();
             return ret;
         },
-        __wbg_new_from_slice_3eea173078478cfe: function(arg0, arg1) {
+        __wbg_new_from_slice_9a868026ffa4208a: function(arg0, arg1) {
             const ret = new Uint8Array(getArrayU8FromWasm0(arg0, arg1));
             return ret;
         },
-        __wbg_prototypesetcall_de8e0d9553586985: function(arg0, arg1, arg2) {
+        __wbg_prototypesetcall_bc27214492979395: function(arg0, arg1, arg2) {
             Uint8Array.prototype.set.call(getArrayU8FromWasm0(arg0, arg1), arg2);
         },
-        __wbg_set_8155bb79a948541b: function() { return handleError(function (arg0, arg1, arg2) {
+        __wbg_set_145a351398b48c65: function() { return handleError(function (arg0, arg1, arg2) {
             const ret = Reflect.set(arg0, arg1, arg2);
             return ret;
         }, arguments); },
-        __wbindgen_cast_0000000000000001: function(arg0) {
+        __wbindgen_generic_0000000000000001: function(arg0) {
             // Cast intrinsic for `F64 -> Externref`.
             const ret = arg0;
             return ret;
         },
-        __wbindgen_cast_0000000000000002: function(arg0, arg1) {
+        __wbindgen_generic_0000000000000002: function(arg0, arg1) {
             // Cast intrinsic for `Ref(String) -> Externref`.
             const ret = getStringFromWasm0(arg0, arg1);
             return ret;

package/dist/wasmModuleTypes.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 export {};

package/dist/wasmProvider.d.ts

@@ -76,7 +76,12 @@ export type ReallyMeWasmProvider = Readonly<{
     xWing768Encapsulate: EncapsulateFn;
     xWing768Decapsulate: DecapsulateFn;
 }>;
+/** Bind callables after the caller establishes module ownership; tests exercise this boundary directly. */
+export declare const createWasmProviderFromModule: (module: unknown) => ReallyMeWasmProvider;
+/** Build a provider only from the package-owned and initialized WASM module. */
 export declare const createReallyMeWasmProvider: (module: unknown) => ReallyMeWasmProvider;
+/** A structural copy cannot be used as an explicit facade provider. */
+export declare const requireTrustedReallyMeWasmProvider: (provider: ReallyMeWasmProvider) => ReallyMeWasmProvider;
 export declare const installReallyMeWasmProvider: (module: unknown) => void;
 export declare const requireReallyMeWasmProvider: () => ReallyMeWasmProvider;
 export {};