@sebastienrousseau/crypto-sdk 0.0.8 → 0.0.24

package/dist/index.js

@@ -1,35 +1,50 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CryptoApiError = exports.CryptoClient = void 0;
+exports.CryptoClient = exports.CryptoApiError = void 0;
+const negotiation_1 = require("./negotiation");
+const request_1 = require("./request");
+__exportStar(require("./types"), exports);
+__exportStar(require("./key-types"), exports);
+var errors_1 = require("./errors");
+Object.defineProperty(exports, "CryptoApiError", { enumerable: true, get: function () { return errors_1.CryptoApiError; } });
 class CryptoClient {
     baseUrl;
     headers;
     fetchFn;
+    timeout;
+    retry;
+    autoTraceparent = false;
     constructor(options) {
         this.baseUrl = options.baseUrl.replace(/\/$/, "");
         this.fetchFn = options.fetch ?? globalThis.fetch;
-        this.headers = { "Content-Type": "application/json" };
-        if (options.apiKey) {
-            this.headers["x-api-key"] = options.apiKey;
-        }
-        if (options.token) {
-            this.headers["Authorization"] = `Bearer ${options.token}`;
-        }
-    }
-    async request(method, path, body) {
-        const init = {
-            method,
-            headers: this.headers,
-        };
-        if (body) {
-            init.body = JSON.stringify(body);
-        }
-        const res = await this.fetchFn(`${this.baseUrl}${path}`, init);
-        const json = await res.json();
-        if (!res.ok) {
-            throw new CryptoApiError(res.status, json);
-        }
-        return json;
+        this.headers = (0, request_1.buildClientHeaders)(options);
+        this.timeout = options.timeout;
+        this.retry = (0, request_1.resolveRetryConfig)(options.retry);
+        this.autoTraceparent = options.traceparent === true;
+    }
+    async send(method, path, body) {
+        const headers = this.autoTraceparent
+            ? { ...this.headers, traceparent: (0, request_1.generateSdkTraceparent)() }
+            : this.headers;
+        const init = (0, request_1.buildRequestInit)(method, headers, body, this.timeout);
+        return (0, request_1.executeRequest)(this.fetchFn, `${this.baseUrl}${path}`, init, this.retry);
+    }
+    request(method, path, body) {
+        return this.send(method, path, body);
     }
     async encrypt(params) {
         return this.request("POST", "/v2/encrypt", params);
@@ -58,14 +73,26 @@ class CryptoClient {
     async generateKeyPair(params) {
         return this.request("POST", "/v2/keys/generate", params ?? { algorithm: "ed25519" });
     }
+    async exportKey(params) {
+        return this.request("POST", "/v2/keys/export", params);
+    }
     async sign(params) {
         return this.request("POST", "/v2/sign", params);
     }
     async verify(params) {
         return this.request("POST", "/v2/verify", params);
     }
-    async pqGenerateKeyPair() {
-        return this.request("POST", "/v2/pq/hybrid/keygen", {});
+    async mlKemGenerateKeyPair(params = {}) {
+        return this.request("POST", "/v2/pq/keygen", params);
+    }
+    async mlKemEncapsulate(params) {
+        return this.request("POST", "/v2/pq/encapsulate", params);
+    }
+    async mlKemDecapsulate(params) {
+        return this.request("POST", "/v2/pq/decapsulate", params);
+    }
+    async pqGenerateKeyPair(params = {}) {
+        return this.request("POST", "/v2/pq/hybrid/keygen", params);
     }
     async pqEncapsulate(params) {
         return this.request("POST", "/v2/pq/hybrid/encapsulate", params);
@@ -83,13 +110,13 @@ class CryptoClient {
         return this.request("POST", "/v2/pq/dsa/keygen", params);
     }
     async pqHashSign(params) {
-        return this.request("POST", "/v2/pq/hash-sign/sign", params);
+        return this.request("POST", "/v2/pq/slh-dsa/sign", params);
     }
     async pqHashVerify(params) {
-        return this.request("POST", "/v2/pq/hash-sign/verify", params);
+        return this.request("POST", "/v2/pq/slh-dsa/verify", params);
     }
     async pqHashSignKeygen(params) {
-        return this.request("POST", "/v2/pq/hash-sign/keygen", params);
+        return this.request("POST", "/v2/pq/slh-dsa/keygen", params);
     }
     async secretboxSeal(params) {
         return this.request("POST", "/v2/secretbox/seal", params);
@@ -103,124 +130,71 @@ class CryptoClient {
     async sealedboxOpen(params) {
         return this.request("POST", "/v2/sealedbox/open", params);
     }
+    async sealedboxSealPq(params) {
+        return this.request("POST", "/v2/sealedbox/seal-pq", params);
+    }
+    async sealedboxOpenPq(params) {
+        return this.request("POST", "/v2/sealedbox/open-pq", params);
+    }
+    async streamPqEncrypt(params) {
+        return this.request("POST", "/v2/stream/pq-encrypt", params);
+    }
+    async streamPqDecrypt(params) {
+        return this.request("POST", "/v2/stream/pq-decrypt", params);
+    }
+    async streamMultiPqEncrypt(params) {
+        return this.request("POST", "/v2/stream/multi-pq-encrypt", params);
+    }
+    async streamMultiPqDecrypt(params) {
+        return this.request("POST", "/v2/stream/multi-pq-decrypt", params);
+    }
     async passwordEncrypt(params) {
         return this.request("POST", "/v2/password/encrypt", params);
     }
     async passwordDecrypt(params) {
         return this.request("POST", "/v2/password/decrypt", params);
     }
+    async hpkeGenerateKeyPair(params = {}) {
+        return this.request("POST", "/v2/hpke/keygen", params);
+    }
+    async hpkeSeal(params) {
+        return this.request("POST", "/v2/hpke/seal", params);
+    }
+    async hpkeOpen(params) {
+        return this.request("POST", "/v2/hpke/open", params);
+    }
     async keyWrap(params) {
         return this.request("POST", "/v2/keys/wrap", params);
     }
     async keyUnwrap(params) {
         return this.request("POST", "/v2/keys/unwrap", params);
     }
+    async kmsCreateKey(params = {}) {
+        return this.request("POST", "/v2/kms/create-key", params);
+    }
+    async kmsWrap(params) {
+        return this.request("POST", "/v2/kms/wrap", params);
+    }
+    async kmsUnwrap(params) {
+        return this.request("POST", "/v2/kms/unwrap", params);
+    }
+    async kmsGenerateDataKey(params) {
+        return this.request("POST", "/v2/kms/generate-data-key", params);
+    }
+    async kmsEncrypt(params) {
+        return this.request("POST", "/v2/kms/encrypt", params);
+    }
+    async kmsDecrypt(params) {
+        return this.request("POST", "/v2/kms/decrypt", params);
+    }
     async getDoraCompliance() {
         return this.request("GET", "/v2/compliance/dora");
     }
     async getCbom() {
-        return this.request("GET", "/v2/compliance/cbom");
+        return this.send("GET", "/v2/compliance/cbom");
     }
     negotiateAlgorithm(options = {}) {
-        const minCategory = options.securityCategoryMin ?? 1;
-        const requireHybrid = options.requireHybrid ?? false;
-        const maxBytes = options.maxPayloadBytes ?? Infinity;
-        const clientAlgos = options.clientSupportedAlgorithms;
-        const catalog = [
-            {
-                name: "x448-mlkem1024",
-                category: "hybrid-kem",
-                level: 5,
-                isHybrid: true,
-                pk: 1624,
-                ct: 1624,
-                fips: "FIPS 203 + RFC 7748",
-            },
-            {
-                name: "ml-kem-1024",
-                category: "lattice-kem",
-                level: 5,
-                isHybrid: false,
-                pk: 1568,
-                ct: 1568,
-                fips: "FIPS 203",
-            },
-            {
-                name: "x25519-mlkem768",
-                category: "hybrid-kem",
-                level: 3,
-                isHybrid: true,
-                pk: 1216,
-                ct: 1120,
-                fips: "FIPS 203 + X25519 hybrid",
-            },
-            {
-                name: "ml-kem-768",
-                category: "lattice-kem",
-                level: 3,
-                isHybrid: false,
-                pk: 1184,
-                ct: 1088,
-                fips: "FIPS 203",
-            },
-            {
-                name: "x25519-mlkem512",
-                category: "hybrid-kem",
-                level: 1,
-                isHybrid: true,
-                pk: 832,
-                ct: 800,
-                fips: "FIPS 203 + X25519 hybrid",
-            },
-            {
-                name: "ml-kem-512",
-                category: "lattice-kem",
-                level: 1,
-                isHybrid: false,
-                pk: 800,
-                ct: 768,
-                fips: "FIPS 203",
-            },
-            {
-                name: "x25519",
-                category: "classical-ecdh",
-                level: 1,
-                isHybrid: false,
-                pk: 32,
-                ct: 32,
-                fips: "RFC 7748 (Legacy)",
-            },
-        ];
-        const fallbackChain = catalog.map((c) => c.name);
-        const eligible = catalog.filter((candidate) => {
-            if (candidate.level < minCategory)
-                return false;
-            if (requireHybrid && !candidate.isHybrid)
-                return false;
-            if (clientAlgos && !clientAlgos.includes(candidate.name))
-                return false;
-            return true;
-        });
-        const selected = eligible.find((c) => c.ct <= maxBytes) ??
-            eligible[0] ??
-            catalog[catalog.length - 1];
-        const fitsWithinMtu = selected.ct <= maxBytes;
-        return {
-            selectedAlgorithm: selected.name,
-            cipherCategory: selected.category,
-            securityCategory: selected.level,
-            isHybrid: selected.isHybrid,
-            publicKeyBytes: selected.pk,
-            ciphertextBytes: selected.ct,
-            totalPayloadOverhead: selected.pk + selected.ct,
-            fitsWithinMtu,
-            fallbackChain,
-            compliancePosture: {
-                standard: "NIST Post-Quantum Cryptography Standardization",
-                doraArticle13Compliant: selected.level >= 3 || selected.isHybrid,
-                fipsStandard: selected.fips,
-            },
-        };
+        return (0, negotiation_1.negotiateAlgorithm)(options);
     }
     async algorithms() {
         return this.request("GET", "/v2/algorithms");
@@ -231,15 +205,4 @@ class CryptoClient {
     }
 }
 exports.CryptoClient = CryptoClient;
-class CryptoApiError extends Error {
-    status;
-    body;
-    constructor(status, body) {
-        super(`API Error ${status}: ${body.error}`);
-        this.name = "CryptoApiError";
-        this.status = status;
-        this.body = body;
-    }
-}
-exports.CryptoApiError = CryptoApiError;
 //# sourceMappingURL=index.js.map

package/dist/key-types.d.ts

@@ -0,0 +1,203 @@
+export type KeyAlgorithm = "ed25519" | "x25519" | "ed448" | "x448" | "p256" | "p384" | "ml-kem-512" | "ml-kem-768" | "ml-kem-1024" | "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87";
+export type MlKemLevel = 512 | 768 | 1024;
+export type MlDsaLevel = 44 | 65 | 87;
+export type SlhDsaVariant = "sha2-128f" | "sha2-128s" | "sha2-192f" | "sha2-192s" | "sha2-256f" | "sha2-256s" | "shake-128f" | "shake-128s" | "shake-192f" | "shake-192s" | "shake-256f" | "shake-256s";
+export interface KeyIdParams {
+    keyId: string;
+}
+export interface SignParams extends KeyIdParams {
+    message: string;
+}
+export interface KeyMetadata {
+    kid?: string;
+    use?: "sig" | "enc";
+    exp?: string;
+}
+export interface ServerKey {
+    keyId: string;
+    algorithm: string;
+}
+export interface KeyGenerateResult extends ServerKey {
+    publicKey: string;
+    kid: string;
+    metadata: KeyMetadata;
+}
+export interface KeyExportResult extends ServerKey {
+    [part: string]: string;
+}
+export interface SignResult {
+    signature: string;
+    algorithm: string;
+}
+export interface VerifyResult {
+    valid: boolean;
+    algorithm: string;
+}
+export interface MlKemKeyPair extends ServerKey {
+    publicKey: string;
+}
+export interface MlKemKeygenParams {
+    level?: MlKemLevel;
+}
+export interface MlKemEncapsulateParams {
+    publicKey: string;
+    level?: MlKemLevel;
+}
+export interface MlKemDecapsulateParams extends KeyIdParams {
+    ciphertext: string;
+    level?: MlKemLevel;
+}
+export interface HybridEncapsulateParams {
+    x25519PublicKey: string;
+    mlKemPublicKey: string;
+    level?: MlKemLevel;
+}
+export interface HybridDecapsulateParams extends KeyIdParams {
+    x25519EphemeralPublic: string;
+    mlKemCiphertext: string;
+    level?: MlKemLevel;
+}
+export interface MlKemEncapsulateResult {
+    ciphertext: string;
+    sharedSecret: string;
+    algorithm: string;
+}
+export interface KemDecapsulateResult {
+    sharedSecret: string;
+    algorithm: string;
+}
+export interface HybridKeyPair extends ServerKey {
+    x25519PublicKey: string;
+    mlKemPublicKey: string;
+}
+export interface HybridEncapsulateResult {
+    x25519EphemeralPublic: string;
+    mlKemCiphertext: string;
+    sharedSecret: string;
+    algorithm: string;
+}
+export interface MlDsaKeyPair extends ServerKey {
+    publicKey: string;
+}
+export interface MlDsaSignResult {
+    signature: string;
+    algorithm: string;
+}
+export interface MlDsaVerifyResult {
+    valid: boolean;
+    algorithm: string;
+}
+export interface SlhDsaKeyPair extends ServerKey {
+    publicKey: string;
+}
+export interface SlhDsaSignResult {
+    signature: string;
+    algorithm: string;
+}
+export interface SlhDsaVerifyResult {
+    valid: boolean;
+    algorithm: string;
+}
+export interface SealedboxSealResult {
+    sealed: string;
+    algorithm: string;
+}
+export type HpkeKem = "x25519" | "p256" | "x25519-ml-kem-768";
+export type HpkeAead = "chacha20-poly1305" | "aes-128-gcm";
+export interface HpkeGenerateKeyPairParams {
+    kem?: HpkeKem;
+}
+export interface HpkeKeyPair extends ServerKey {
+    publicKey: string;
+}
+export interface HpkeSealParams {
+    recipientPublicKey: string;
+    plaintext: string;
+    kem?: HpkeKem;
+    aead?: HpkeAead;
+    info?: string;
+    aad?: string;
+    psk?: string;
+    pskId?: string;
+}
+export interface HpkeSealResult {
+    ciphertext: string;
+    encapsulatedKey: string;
+}
+export interface HpkeOpenParams {
+    keyId: string;
+    encapsulatedKey: string;
+    ciphertext: string;
+    aead?: HpkeAead;
+    info?: string;
+    aad?: string;
+    psk?: string;
+    pskId?: string;
+}
+export interface HpkeOpenResult {
+    plaintext: string;
+    hex: string;
+}
+export interface KmsCreateKeyParams {
+    provider?: string;
+    algorithm?: string;
+    usage?: "encrypt" | "sign" | "wrap";
+    metadata?: Record<string, string>;
+}
+export interface KmsWrapParams {
+    keyId: string;
+    unwrappedKey: string;
+    provider?: string;
+    context?: Record<string, string>;
+}
+export interface KmsWrapResult {
+    wrappedKey: string;
+    keyId: string;
+    provider: string;
+}
+export interface KmsUnwrapParams {
+    keyId: string;
+    wrappedKey: string;
+    provider?: string;
+    context?: Record<string, string>;
+}
+export interface KmsUnwrapResult {
+    unwrappedKey: string;
+    keyId: string;
+    provider: string;
+}
+export interface KmsGenerateDataKeyParams {
+    keyId: string;
+    provider?: string;
+    keySpec?: string;
+}
+export interface KmsGenerateDataKeyResult {
+    plaintext: string;
+    ciphertext: string;
+    keyId: string;
+    provider: string;
+}
+export interface KmsEncryptParams {
+    keyId: string;
+    plaintext: string;
+    provider?: string;
+    context?: Record<string, string>;
+}
+export interface KmsEncryptResult {
+    ciphertext: string;
+    keyId: string;
+    provider: string;
+}
+export interface KmsDecryptParams {
+    keyId: string;
+    ciphertext: string;
+    provider?: string;
+    context?: Record<string, string>;
+}
+export interface KmsDecryptResult {
+    plaintext: string;
+    hex: string;
+    keyId: string;
+    provider: string;
+}
+//# sourceMappingURL=key-types.d.ts.map

package/dist/key-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-types.d.ts","sourceRoot":"","sources":["../src/key-types.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,QAAQ,GACR,OAAO,GACP,MAAM,GACN,MAAM,GACN,MAAM,GACN,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,WAAW,GACX,WAAW,GACX,WAAW,CAAC;AAGhB,MAAM,MAAM,UAAU,GAAG,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC;AAG1C,MAAM,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAGtC,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,WAAW,GACX,WAAW,GACX,WAAW,GACX,WAAW,GACX,WAAW,GACX,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,YAAY,CAAC;AAGjB,MAAM,WAAW,WAAW;IAE1B,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,MAAM,WAAW,UAAW,SAAQ,WAAW;IAE7C,OAAO,EAAE,MAAM,CAAC;CACjB;AAGD,MAAM,WAAW,WAAW;IAE1B,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IAEpB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAGD,MAAM,WAAW,SAAS;IAExB,KAAK,EAAE,MAAM,CAAC;IAEd,SAAS,EAAE,MAAM,CAAC;CACnB;AAaD,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAElD,SAAS,EAAE,MAAM,CAAC;IAElB,GAAG,EAAE,MAAM,CAAC;IAEZ,QAAQ,EAAE,WAAW,CAAC;CACvB;AAUD,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAEhD,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CACxB;AAWD,MAAM,WAAW,UAAU;IAEzB,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,YAAY;IAE3B,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,YAAa,SAAQ,SAAS;IAE7C,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,iBAAiB;IAEhC,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAGD,MAAM,WAAW,sBAAsB;IAErC,SAAS,EAAE,MAAM,CAAC;IAElB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAGD,MAAM,WAAW,sBAAuB,SAAQ,WAAW;IAEzD,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAGD,MAAM,WAAW,uBAAuB;IAEtC,eAAe,EAAE,MAAM,CAAC;IAExB,cAAc,EAAE,MAAM,CAAC;IAEvB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAGD,MAAM,WAAW,uBAAwB,SAAQ,WAAW;IAE1D,qBAAqB,EAAE,MAAM,CAAC;IAE9B,eAAe,EAAE,MAAM,CAAC;IAExB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAGD,MAAM,WAAW,sBAAsB;IAErC,UAAU,EAAE,MAAM,CAAC;IAEnB,YAAY,EAAE,MAAM,CAAC;IAErB,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,oBAAoB;IAEnC,YAAY,EAAE,MAAM,CAAC;IAErB,SAAS,EAAE,MAAM,CAAC;CACnB;AAaD,MAAM,WAAW,aAAc,SAAQ,SAAS;IAE9C,eAAe,EAAE,MAAM,CAAC;IAExB,cAAc,EAAE,MAAM,CAAC;CACxB;AAGD,MAAM,WAAW,uBAAuB;IAEtC,qBAAqB,EAAE,MAAM,CAAC;IAE9B,eAAe,EAAE,MAAM,CAAC;IAExB,YAAY,EAAE,MAAM,CAAC;IAErB,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,YAAa,SAAQ,SAAS;IAE7C,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,eAAe;IAE9B,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,iBAAiB;IAEhC,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,aAAc,SAAQ,SAAS;IAE9C,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,gBAAgB;IAE/B,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,kBAAkB;IAEjC,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,MAAM,CAAC;CACnB;AAYD,MAAM,WAAW,mBAAmB;IAElC,MAAM,EAAE,MAAM,CAAC;IAEf,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,mBAAmB,CAAC;AAG9D,MAAM,MAAM,QAAQ,GAAG,mBAAmB,GAAG,aAAa,CAAC;AAG3D,MAAM,WAAW,yBAAyB;IAExC,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAGD,MAAM,WAAW,WAAY,SAAQ,SAAS;IAE5C,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,cAAc;IAE7B,kBAAkB,EAAE,MAAM,CAAC;IAE3B,SAAS,EAAE,MAAM,CAAC;IAElB,GAAG,CAAC,EAAE,OAAO,CAAC;IAEd,IAAI,CAAC,EAAE,QAAQ,CAAC;IAEhB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAGD,MAAM,WAAW,cAAc;IAE7B,UAAU,EAAE,MAAM,CAAC;IAEnB,eAAe,EAAE,MAAM,CAAC;CACzB;AAGD,MAAM,WAAW,cAAc;IAE7B,KAAK,EAAE,MAAM,CAAC;IAEd,eAAe,EAAE,MAAM,CAAC;IAExB,UAAU,EAAE,MAAM,CAAC;IAEnB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAEhB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAGD,MAAM,WAAW,cAAc;IAE7B,SAAS,EAAE,MAAM,CAAC;IAElB,GAAG,EAAE,MAAM,CAAC;CACb;AAKD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAGD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAGD,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAGD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAGD,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAGD,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAGD,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAGD,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAGD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAGD,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAGD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB"}

package/dist/key-types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=key-types.js.map

package/dist/negotiation.d.ts

@@ -0,0 +1,3 @@
+import type { AlgorithmNegotiationOptions, AlgorithmNegotiationResult } from "./types";
+export declare function negotiateAlgorithm(options?: AlgorithmNegotiationOptions): AlgorithmNegotiationResult;
+//# sourceMappingURL=negotiation.d.ts.map

package/dist/negotiation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"negotiation.d.ts","sourceRoot":"","sources":["../src/negotiation.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,2BAA2B,EAC3B,0BAA0B,EAC3B,MAAM,SAAS,CAAC;AAmFjB,wBAAgB,kBAAkB,CAChC,OAAO,GAAE,2BAAgC,GACxC,0BAA0B,CAwC5B"}

package/dist/negotiation.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.negotiateAlgorithm = negotiateAlgorithm;
+const KEM_CATALOG = [
+    {
+        name: "x448-mlkem1024",
+        category: "hybrid-kem",
+        level: 5,
+        isHybrid: true,
+        pk: 1624,
+        ct: 1624,
+        fips: "FIPS 203 + RFC 7748",
+    },
+    {
+        name: "ml-kem-1024",
+        category: "lattice-kem",
+        level: 5,
+        isHybrid: false,
+        pk: 1568,
+        ct: 1568,
+        fips: "FIPS 203",
+    },
+    {
+        name: "x25519-mlkem768",
+        category: "hybrid-kem",
+        level: 3,
+        isHybrid: true,
+        pk: 1216,
+        ct: 1120,
+        fips: "FIPS 203 + X25519 hybrid",
+    },
+    {
+        name: "ml-kem-768",
+        category: "lattice-kem",
+        level: 3,
+        isHybrid: false,
+        pk: 1184,
+        ct: 1088,
+        fips: "FIPS 203",
+    },
+    {
+        name: "x25519-mlkem512",
+        category: "hybrid-kem",
+        level: 1,
+        isHybrid: true,
+        pk: 832,
+        ct: 800,
+        fips: "FIPS 203 + X25519 hybrid",
+    },
+    {
+        name: "ml-kem-512",
+        category: "lattice-kem",
+        level: 1,
+        isHybrid: false,
+        pk: 800,
+        ct: 768,
+        fips: "FIPS 203",
+    },
+    {
+        name: "x25519",
+        category: "classical-ecdh",
+        level: 1,
+        isHybrid: false,
+        pk: 32,
+        ct: 32,
+        fips: "RFC 7748 (Legacy)",
+    },
+];
+function negotiateAlgorithm(options = {}) {
+    const minCategory = options.securityCategoryMin ?? 1;
+    const requireHybrid = options.requireHybrid ?? false;
+    const maxBytes = options.maxPayloadBytes ?? Infinity;
+    const clientAlgos = options.clientSupportedAlgorithms;
+    const fallbackChain = KEM_CATALOG.map((c) => c.name);
+    const eligible = KEM_CATALOG.filter((candidate) => {
+        if (candidate.level < minCategory)
+            return false;
+        if (requireHybrid && !candidate.isHybrid)
+            return false;
+        if (clientAlgos && !clientAlgos.includes(candidate.name))
+            return false;
+        return true;
+    });
+    const selected = eligible.find((c) => c.ct <= maxBytes) ??
+        eligible[0] ??
+        KEM_CATALOG[KEM_CATALOG.length - 1];
+    const fitsWithinMtu = selected.ct <= maxBytes;
+    return {
+        selectedAlgorithm: selected.name,
+        cipherCategory: selected.category,
+        securityCategory: selected.level,
+        isHybrid: selected.isHybrid,
+        publicKeyBytes: selected.pk,
+        ciphertextBytes: selected.ct,
+        totalPayloadOverhead: selected.pk + selected.ct,
+        fitsWithinMtu,
+        fallbackChain,
+        compliancePosture: {
+            standard: "NIST Post-Quantum Cryptography Standardization",
+            doraArticle13Compliant: selected.level >= 3 || selected.isHybrid,
+            fipsStandard: selected.fips,
+        },
+    };
+}
+//# sourceMappingURL=negotiation.js.map

package/dist/request.d.ts

@@ -0,0 +1,15 @@
+import type { ClientOptions, RetryOptions } from "./types";
+export interface RetryConfig {
+    maxRetries: number;
+    initialDelayMs: number;
+    maxDelayMs: number;
+}
+export declare function resolveRetryConfig(retry?: RetryOptions): RetryConfig;
+export declare function buildClientHeaders(options: ClientOptions): Record<string, string>;
+export declare function isTransientStatus(status: number): boolean;
+export declare function computeBackoffDelay(attempt: number, config: RetryConfig, retryAfterHeader?: string | null): number;
+export declare function buildRequestInit(method: string, headers: Record<string, string>, body?: unknown, timeout?: number): RequestInit;
+export declare function executeRequest<T>(fetchFn: typeof globalThis.fetch, url: string, init: RequestInit, retry: RetryConfig): Promise<T>;
+export declare function generateSdkTraceparent(): string;
+export declare function resolveTraceparentHeader(traceparent?: string | boolean): string | undefined;
+//# sourceMappingURL=request.d.ts.map

package/dist/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG3D,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAGD,wBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE,YAAY,GAAG,WAAW,CAMpE;AAGD,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,GACrB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAaxB;AAGD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzD;AAGD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,WAAW,EACnB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,GAC/B,MAAM,CAWR;AAGD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,MAAM,GACf,WAAW,CAcb;AAGD,wBAAsB,cAAc,CAAC,CAAC,EACpC,OAAO,EAAE,OAAO,UAAU,CAAC,KAAK,EAChC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,CAAC,CAAC,CAkCZ;AAGD,wBAAgB,sBAAsB,IAAI,MAAM,CAoB/C;AAGD,wBAAgB,wBAAwB,CACtC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,GAC7B,MAAM,GAAG,SAAS,CAKpB"}