@sebastienrousseau/crypto-sdk 0.0.8 → 0.0.9

package/README.md

@@ -80,34 +80,71 @@ import { CryptoClient } from "@sebastienrousseau/crypto-sdk";
 
 const client = new CryptoClient({
   baseUrl: "http://localhost:3000",
+  apiKey: "<the server's CRYPTO_API_KEY>",
 });
 
 const { data } = await client.hash({ algorithm: "sha256", data: "hello" });
 console.log(data.digest);
 ```
 
-`CryptoClient` accepts two optional authentication mechanisms:
+`CryptoClient` accepts two authentication mechanisms. The server refuses
+unauthenticated requests unless it runs with `ALLOW_ANONYMOUS=1`, and each
+route needs a scope (`crypto:sign`, `crypto:keys`, ...); an API key holds
+`crypto:admin`, which covers every scope except `crypto:keys:export`.
 
 | Option   | Header sent                     | Description      |
 | :------- | :------------------------------ | :--------------- |
 | `apiKey` | `x-api-key: <value>`            | Static API key   |
 | `token`  | `Authorization: Bearer <value>` | JWT bearer token |
 
-Failed requests throw a `CryptoApiError`:
+### Server-held keys
+
+Private keys never cross the API. Key-generation methods return a `keyId`
+with the public key, and the server keeps the private key; methods that
+need it take the `keyId`. A key is usable only by the principal that
+generated it.
+
+```ts
+const { data: key } = await client.generateKeyPair({ algorithm: "ed25519" });
+const { data: sig } = await client.sign({ keyId: key.keyId, message: "hi" });
+const { data: check } = await client.verify({
+  publicKey: key.publicKey,
+  message: "hi",
+  signature: sig.signature,
+});
+console.log(check.valid); // true
+```
+
+`exportKey({ keyId })` returns the private parts, and only to a principal
+whose token grants `crypto:keys:export` explicitly.
+
+### Errors
+
+Failed requests throw a `CryptoApiError` whose `body` is the server's
+[RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) problem
+(`application/problem+json`):
 
 ```ts
 import { CryptoClient, CryptoApiError } from "@sebastienrousseau/crypto-sdk";
 
 try {
-  await client.hash({ algorithm: "invalid", data: "test" });
+  await client.sign({ keyId: "k_AAAAAAAAAAAAAAAAAAAAAA", message: "x" });
 } catch (err) {
   if (err instanceof CryptoApiError) {
-    console.error(err.status); // HTTP status code (e.g. 400)
-    console.error(err.body.error); // Error message from the server
+    console.error(err.status); // 404
+    console.error(err.body.type); // "urn:crypto-service:problem:key-not-found"
+    console.error(err.body.detail); // "Key not found"
+    console.error(err.body.code); // "KEY_NOT_FOUND"
   }
 }
 ```
 
+`body` has `type`, `title`, `status`, `detail` and `instance`, plus
+`code` for crypto-lib and key-store errors and `errors` (`{ field, message }`
+per failed check) for validation failures. A response without a problem
+body (for example from a proxy) becomes an `about:blank` problem for its
+status code.
+
 <p align="right"><a href="#contents">Back to Top</a></p>
 
 ---
@@ -150,41 +187,54 @@ signature operations.
 
 ## API Reference
 
-Every method returns `Promise<ApiResponse<T>>` where
-`ApiResponse<T>` is `{ data: T }`.
-
-| Method                   | Endpoint                         | Description                               |
-| :----------------------- | :------------------------------- | :---------------------------------------- |
-| `hash(body)`             | `POST /v2/hash`                  | Compute a cryptographic hash              |
-| `encrypt(body)`          | `POST /v2/encrypt`               | Encrypt plaintext                         |
-| `decrypt(body)`          | `POST /v2/decrypt`               | Decrypt ciphertext                        |
-| `sign(body)`             | `POST /v2/sign`                  | Sign a message                            |
-| `verify(body)`           | `POST /v2/verify`                | Verify a signature                        |
-| `kdf(body)`              | `POST /v2/kdf`                   | Derive a key                              |
-| `mac(body)`              | `POST /v2/hmac`                  | Compute a MAC                             |
-| `macVerify(body)`        | `POST /v2/hmac/verify`           | Verify a MAC                              |
-| `passwordHash(body)`     | `POST /v2/password/hash`         | Hash a password                           |
-| `passwordVerify(body)`   | `POST /v2/password/verify`       | Verify a password hash                    |
-| `passwordEncrypt(body)`  | `POST /v2/password/encrypt`      | Encrypt data with a password              |
-| `passwordDecrypt(body)`  | `POST /v2/password/decrypt`      | Decrypt password-encrypted data           |
-| `generateKeyPair(body?)` | `POST /v2/keys/generate`         | Generate a key pair                       |
-| `keyWrap(body)`          | `POST /v2/keys/wrap`             | Wrap a key                                |
-| `keyUnwrap(body)`        | `POST /v2/keys/unwrap`           | Unwrap a wrapped key                      |
-| `secretboxSeal(body)`    | `POST /v2/secretbox/seal`        | Seal plaintext with a symmetric key       |
-| `secretboxOpen(body)`    | `POST /v2/secretbox/open`        | Open a sealed secretbox                   |
-| `sealedboxSeal(body)`    | `POST /v2/sealedbox/seal`        | Seal plaintext for a recipient public key |
-| `sealedboxOpen(body)`    | `POST /v2/sealedbox/open`        | Open a sealed box                         |
-| `pqGenerateKeyPair()`    | `POST /v2/pq/hybrid/keygen`      | Generate a hybrid key pair                |
-| `pqEncapsulate(body)`    | `POST /v2/pq/hybrid/encapsulate` | Encapsulate a shared secret               |
-| `pqDecapsulate(body)`    | `POST /v2/pq/hybrid/decapsulate` | Decapsulate a shared secret               |
-| `pqSignKeygen(body)`     | `POST /v2/pq/dsa/keygen`         | Generate an ML-DSA key pair               |
-| `pqSign(body)`           | `POST /v2/pq/dsa/sign`           | Sign with ML-DSA                          |
-| `pqVerify(body)`         | `POST /v2/pq/dsa/verify`         | Verify an ML-DSA signature                |
-| `pqHashSignKeygen(body)` | `POST /v2/pq/hash-sign/keygen`   | Generate an SLH-DSA key pair              |
-| `pqHashSign(body)`       | `POST /v2/pq/hash-sign/sign`     | Sign with SLH-DSA                         |
-| `pqHashVerify(body)`     | `POST /v2/pq/hash-sign/verify`   | Verify an SLH-DSA signature               |
-| `algorithms()`           | `GET /v2/algorithms`             | List all supported algorithms             |
-| `health()`               | `GET /health`                    | Server health check                       |
+Methods return `Promise<ApiResponse<T>>` where `ApiResponse<T>` is
+`{ data: T }`, except `getCbom()` (the CycloneDX document itself) and
+`health()`. Methods marked _keyId_ use a server-held key; key-generation
+methods return its `keyId` and public key, never the private key.
+
+| Method                   | Endpoint                         | Description                                    |
+| :----------------------- | :------------------------------- | :--------------------------------------------- |
+| `hash(body)`             | `POST /v2/hash`                  | Compute a cryptographic hash                   |
+| `encrypt(body)`          | `POST /v2/encrypt`               | Encrypt with XChaCha20-Poly1305                |
+| `decrypt(body)`          | `POST /v2/decrypt`               | Decrypt ciphertext                             |
+| `generateKeyPair(body?)` | `POST /v2/keys/generate`         | Generate a server-held key pair                |
+| `exportKey(body)`        | `POST /v2/keys/export`           | Export a key's private parts (_keyId_)         |
+| `sign(body)`             | `POST /v2/sign`                  | Sign with Ed25519 (_keyId_)                    |
+| `verify(body)`           | `POST /v2/verify`                | Verify an Ed25519 signature                    |
+| `kdf(body)`              | `POST /v2/kdf`                   | Derive a key                                   |
+| `mac(body)`              | `POST /v2/hmac`                  | Compute an HMAC                                |
+| `macVerify(body)`        | `POST /v2/hmac/verify`           | Verify an HMAC                                 |
+| `passwordHash(body)`     | `POST /v2/password/hash`         | Hash a password with Argon2id                  |
+| `passwordVerify(body)`   | `POST /v2/password/verify`       | Verify a password hash                         |
+| `passwordEncrypt(body)`  | `POST /v2/password/encrypt`      | Encrypt data with a password                   |
+| `passwordDecrypt(body)`  | `POST /v2/password/decrypt`      | Decrypt password-encrypted data                |
+| `keyWrap(body)`          | `POST /v2/keys/wrap`             | Wrap a key                                     |
+| `keyUnwrap(body)`        | `POST /v2/keys/unwrap`           | Unwrap a wrapped key                           |
+| `secretboxSeal(body)`    | `POST /v2/secretbox/seal`        | Seal plaintext with a symmetric key            |
+| `secretboxOpen(body)`    | `POST /v2/secretbox/open`        | Open a sealed secretbox                        |
+| `sealedboxSeal(body)`    | `POST /v2/sealedbox/seal`        | Seal plaintext for an X25519 public key        |
+| `sealedboxOpen(body)`    | `POST /v2/sealedbox/open`        | Open a sealed box (_keyId_)                    |
+| `sealedboxSealPq(body)`  | `POST /v2/sealedbox/seal-pq`     | Seal plaintext for a hybrid public key pair    |
+| `sealedboxOpenPq(body)`  | `POST /v2/sealedbox/open-pq`     | Open a hybrid sealed box (_keyId_)             |
+| `mlKemGenerateKeyPair()` | `POST /v2/pq/keygen`             | Generate a server-held ML-KEM-768 key pair     |
+| `mlKemEncapsulate(body)` | `POST /v2/pq/encapsulate`        | Encapsulate to an ML-KEM-768 public key        |
+| `mlKemDecapsulate(body)` | `POST /v2/pq/decapsulate`        | Decapsulate (_keyId_)                          |
+| `pqGenerateKeyPair()`    | `POST /v2/pq/hybrid/keygen`      | Generate a server-held hybrid key pair         |
+| `pqEncapsulate(body)`    | `POST /v2/pq/hybrid/encapsulate` | Encapsulate a hybrid shared secret             |
+| `pqDecapsulate(body)`    | `POST /v2/pq/hybrid/decapsulate` | Decapsulate a hybrid shared secret (_keyId_)   |
+| `pqSignKeygen(body)`     | `POST /v2/pq/dsa/keygen`         | Generate a server-held ML-DSA key pair         |
+| `pqSign(body)`           | `POST /v2/pq/dsa/sign`           | Sign with ML-DSA (_keyId_; level from the key) |
+| `pqVerify(body)`         | `POST /v2/pq/dsa/verify`         | Verify an ML-DSA signature                     |
+| `pqHashSignKeygen(body)` | `POST /v2/pq/slh-dsa/keygen`     | Generate a server-held SLH-DSA key pair        |
+| `pqHashSign(body)`       | `POST /v2/pq/slh-dsa/sign`       | Sign with SLH-DSA (_keyId_; variant from key)  |
+| `pqHashVerify(body)`     | `POST /v2/pq/slh-dsa/verify`     | Verify an SLH-DSA signature                    |
+| `getDoraCompliance()`    | `GET /v2/compliance/dora`        | DORA self-assessment                           |
+| `getCbom()`              | `GET /v2/compliance/cbom`        | CycloneDX 1.6 CBOM                             |
+| `algorithms()`           | `GET /v2/algorithms`             | List all supported algorithms                  |
+| `health()`               | `GET /health`                    | Server health check                            |
+
+The stream (`/v2/stream/*`), multi-recipient (`/v2/multi-recipient/encrypt`)
+and v1 OpenPGP routes have no SDK methods yet.
 
 <p align="right"><a href="#contents">Back to Top</a></p>
 
@@ -192,28 +242,34 @@ Every method returns `Promise<ApiResponse<T>>` where
 
 All examples are self-contained TypeScript files in the `examples/`
 directory. Each requires the crypto-server running on
-`http://localhost:3000` (override via `CRYPTO_SERVER_URL`).
+`http://localhost:3000` (override via `CRYPTO_SERVER_URL`) and sends
+`CRYPTO_API_KEY` (or the JWT in `CRYPTO_TOKEN`) when set.
+`pnpm run examples:check` type-checks them against the SDK.
 
 ```bash
-npx ts-node examples/<name>.ts
+CRYPTO_API_KEY=<key> npx ts-node examples/<name>.ts
 ```
 
-| Category     | Example                                 | Purpose                                |
-| :----------- | :-------------------------------------- | :------------------------------------- |
-| Algorithms   | [algorithms.ts](examples/algorithms.ts) | List all supported algorithms          |
-| Encryption   | [encrypt.ts](examples/encrypt.ts)       | AES-256-GCM encrypt and decrypt        |
-| Hashing      | [hash.ts](examples/hash.ts)             | Compute SHA-256 and BLAKE2b digests    |
-| KDF          | [kdf.ts](examples/kdf.ts)               | Key derivation with HKDF-SHA256        |
-| Key Gen      | [keygen.ts](examples/keygen.ts)         | Generate key pairs                     |
-| Key Wrap     | [keywrap.ts](examples/keywrap.ts)       | AES key wrapping and unwrapping        |
-| MAC          | [mac.ts](examples/mac.ts)               | HMAC-SHA256 compute and verify         |
-| Passwords    | [password.ts](examples/password.ts)     | Argon2 hashing and password encryption |
-| PQ KEM       | [pqkem.ts](examples/pqkem.ts)           | Hybrid X25519 + ML-KEM key exchange    |
-| PQ Sign      | [pqsign.ts](examples/pqsign.ts)         | ML-DSA post-quantum signing            |
-| PQ Hash Sign | [pqhashsign.ts](examples/pqhashsign.ts) | SLH-DSA post-quantum signing           |
-| Sealed Box   | [sealedbox.ts](examples/sealedbox.ts)   | Anonymous public-key encryption        |
-| Secretbox    | [secretbox.ts](examples/secretbox.ts)   | Symmetric authenticated encryption     |
-| Signing      | [sign.ts](examples/sign.ts)             | Ed25519 signing and verification       |
+| Category     | Example                                 | Purpose                                        |
+| :----------- | :-------------------------------------- | :--------------------------------------------- |
+| Algorithms   | [algorithms.ts](examples/algorithms.ts) | List all supported algorithms                  |
+| Encryption   | [encrypt.ts](examples/encrypt.ts)       | XChaCha20-Poly1305 encrypt and decrypt         |
+| Hashing      | [hash.ts](examples/hash.ts)             | Compute SHA-256, SHA-512 and BLAKE2b digests   |
+| KDF          | [kdf.ts](examples/kdf.ts)               | Key derivation with HKDF-SHA256                |
+| Key Gen      | [keygen.ts](examples/keygen.ts)         | Generate server-held key pairs                 |
+| Key Wrap     | [keywrap.ts](examples/keywrap.ts)       | AES key wrapping and unwrapping                |
+| MAC          | [mac.ts](examples/mac.ts)               | HMAC-SHA256 compute and verify                 |
+| Passwords    | [password.ts](examples/password.ts)     | Argon2 hashing and password encryption         |
+| PQ KEM       | [pqkem.ts](examples/pqkem.ts)           | Hybrid X25519 + ML-KEM key exchange by keyId   |
+| PQ Sign      | [pqsign.ts](examples/pqsign.ts)         | ML-DSA post-quantum signing by keyId           |
+| PQ Hash Sign | [pqhashsign.ts](examples/pqhashsign.ts) | SLH-DSA post-quantum signing by keyId          |
+| Sealed Box   | [sealedbox.ts](examples/sealedbox.ts)   | Anonymous public-key encryption, open by keyId |
+| Secretbox    | [secretbox.ts](examples/secretbox.ts)   | Symmetric authenticated encryption             |
+| Signing      | [sign.ts](examples/sign.ts)             | Ed25519 signing by keyId and verification      |
+
+`__tests__/contract.test.ts` runs the SDK against the real crypto-server
+in process (its `fetch` forwards to Fastify's `inject`), so a drift
+between a method and its route fails the test suite.
 
 <p align="right"><a href="#contents">Back to Top</a></p>
 

package/dist/errors.d.ts

@@ -0,0 +1,8 @@
+import type { ApiError } from "./types";
+export declare class CryptoApiError extends Error {
+    readonly status: number;
+    readonly body: ApiError;
+    constructor(status: number, body: ApiError);
+}
+export declare function readProblem(res: Response): Promise<ApiError>;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAiBxC,qBAAa,cAAe,SAAQ,KAAK;IAEvC,SAAgB,MAAM,EAAE,MAAM,CAAC;IAE/B,SAAgB,IAAI,EAAE,QAAQ,CAAC;gBAEnB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ;CAM3C;AAiBD,wBAAsB,WAAW,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CASlE"}

package/dist/errors.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CryptoApiError = void 0;
+exports.readProblem = readProblem;
+class CryptoApiError extends Error {
+    status;
+    body;
+    constructor(status, body) {
+        super(`API Error ${status}: ${body.detail}`);
+        this.name = "CryptoApiError";
+        this.status = status;
+        this.body = body;
+    }
+}
+exports.CryptoApiError = CryptoApiError;
+function isProblem(body) {
+    return (typeof body === "object" &&
+        body !== null &&
+        typeof body.detail === "string");
+}
+async function readProblem(res) {
+    const body = await res.json().catch(() => undefined);
+    if (isProblem(body))
+        return body;
+    return {
+        type: "about:blank",
+        title: res.statusText || "HTTP error",
+        status: res.status,
+        detail: `The server answered ${res.status} without a problem body`,
+    };
+}
+//# sourceMappingURL=errors.js.map

package/dist/index.d.ts

@@ -1,176 +1,14 @@
-export interface ClientOptions {
-    baseUrl: string;
-    apiKey?: string;
-    token?: string;
-    fetch?: typeof globalThis.fetch;
-}
-export interface ApiResponse<T> {
-    data: T;
-}
-export interface ApiError {
-    error: string;
-    details?: Array<{
-        field: string;
-        message: string;
-    }>;
-}
-export interface HashResult {
-    digest: string;
-    algorithm: string;
-    length: number;
-}
-export interface AeadResult {
-    ciphertext: string;
-    algorithm: string;
-}
-export interface KdfResult {
-    derivedKey: string;
-    salt: string;
-    algorithm: string;
-    keyLength: number;
-}
-export interface Ed25519KeyPair {
-    privateKey: string;
-    publicKey: string;
-}
-export interface SignResult {
-    signature: string;
-    algorithm: string;
-}
-export interface VerifyResult {
-    valid: boolean;
-    algorithm: string;
-}
-export interface HybridKeyPair {
-    x25519PrivateKey: string;
-    x25519PublicKey: string;
-    mlKemPublicKey: string;
-    mlKemSecretKey: string;
-    algorithm: string;
-}
-export interface HybridEncapsulateResult {
-    x25519EphemeralPublic: string;
-    mlKemCiphertext: string;
-    sharedSecret: string;
-    algorithm: string;
-}
-export interface MlDsaKeyPair {
-    publicKey: string;
-    secretKey: string;
-    algorithm: string;
-}
-export interface MlDsaSignResult {
-    signature: string;
-    algorithm: string;
-}
-export interface MlDsaVerifyResult {
-    valid: boolean;
-    algorithm: string;
-}
-export interface SlhDsaKeyPair {
-    publicKey: string;
-    secretKey: string;
-    algorithm: string;
-}
-export interface SlhDsaSignResult {
-    signature: string;
-    algorithm: string;
-}
-export interface SlhDsaVerifyResult {
-    valid: boolean;
-    algorithm: string;
-}
-export interface SecretboxSealResult {
-    sealed: string;
-}
-export interface SealedboxSealResult {
-    sealed: string;
-    ephemeralPublicKey: string;
-}
-export interface PasswordEncryptResult {
-    ciphertext: string;
-}
-export interface KeyWrapResult {
-    wrappedKey: string;
-}
-export interface KeyGenerateResult {
-    publicKey: string;
-    privateKey: string;
-    algorithm: string;
-    kid: string;
-}
-export interface DoraComplianceScorecard {
-    standard: string;
-    article: string;
-    status: string;
-    disclaimer: string;
-    quantumResistanceRatio: number;
-    activePrimitivesCount: number;
-    postQuantumPrimitivesCount: number;
-    algorithmDeprecationSchedule: Array<{
-        algorithm: string;
-        category: string;
-        sunsetDate: string;
-        recommendedMigration: string;
-    }>;
-    cryptographicInventory: Array<{
-        package: string;
-        version: string;
-        status: string;
-        fipsCompliance: string;
-    }>;
-    timestamp: string;
-}
-export interface CbomExportPayload {
-    bomFormat: string;
-    specVersion: string;
-    serialNumber: string;
-    version: number;
-    metadata: Record<string, unknown>;
-    components: Array<Record<string, unknown>>;
-}
-export interface AlgorithmNegotiationOptions {
-    maxPayloadBytes?: number;
-    securityCategoryMin?: 1 | 3 | 5;
-    requireHybrid?: boolean;
-    clientSupportedAlgorithms?: string[];
-}
-export interface AlgorithmNegotiationResult {
-    selectedAlgorithm: string;
-    cipherCategory: "lattice-kem" | "hybrid-kem" | "classical-ecdh";
-    securityCategory: 1 | 3 | 5;
-    isHybrid: boolean;
-    publicKeyBytes: number;
-    ciphertextBytes: number;
-    totalPayloadOverhead: number;
-    fitsWithinMtu: boolean;
-    fallbackChain: string[];
-    compliancePosture: {
-        standard: string;
-        doraArticle13Compliant: boolean;
-        fipsStandard: string;
-    };
-}
-export interface MacResult {
-    mac: string;
-    algorithm: string;
-}
-export interface PasswordHashResult {
-    hash: string;
-    salt: string;
-    params: {
-        t: number;
-        m: number;
-        p: number;
-    };
-    algorithm: string;
-    phc: string;
-}
+import type { ClientOptions, ApiResponse, HashAlgorithm, HashResult, AeadResult, KdfAlgorithm, KdfResult, SecretboxSealResult, PasswordEncryptResult, KeyWrapAlgorithm, KeyWrapResult, HealthResult, DoraComplianceScorecard, CbomExportPayload, AlgorithmNegotiationOptions, AlgorithmNegotiationResult, HmacAlgorithm, MacResult, MacVerifyResult, Argon2Params, PasswordHashResult } from "./types";
+import type { KeyAlgorithm, KeyIdParams, SignParams, KeyMetadata, KeyGenerateResult, KeyExportResult, SignResult, VerifyResult, MlKemKeyPair, MlKemEncapsulateResult, KemDecapsulateResult, HybridKeyPair, HybridEncapsulateResult, MlDsaLevel, MlDsaKeyPair, MlDsaSignResult, MlDsaVerifyResult, SlhDsaVariant, SlhDsaKeyPair, SlhDsaSignResult, SlhDsaVerifyResult, SealedboxSealResult } from "./key-types";
+export * from "./types";
+export * from "./key-types";
+export { CryptoApiError } from "./errors";
 export declare class CryptoClient {
     private baseUrl;
     private headers;
     private fetchFn;
     constructor(options: ClientOptions);
+    private send;
     private request;
     encrypt(params: {
         key: string;
@@ -183,32 +21,35 @@ export declare class CryptoClient {
         plaintext: string;
     }>>;
     hash(params: {
-        algorithm: string;
+        algorithm: HashAlgorithm;
         data: string;
     }): Promise<ApiResponse<HashResult>>;
     kdf(params: {
-        algorithm: string;
+        algorithm: KdfAlgorithm;
         password: string;
         salt?: string;
         keyLength?: number;
-        params?: Record<string, unknown>;
+        params?: {
+            N?: number;
+            r?: number;
+            p?: number;
+            iterations?: number;
+            info?: string;
+        };
     }): Promise<ApiResponse<KdfResult>>;
     mac(params: {
-        algorithm: string;
+        algorithm: HmacAlgorithm;
         key: string;
         data: string;
     }): Promise<ApiResponse<MacResult>>;
     macVerify(params: {
-        algorithm: string;
+        algorithm: HmacAlgorithm;
         key: string;
         data: string;
         mac: string;
-    }): Promise<ApiResponse<{
-        valid: boolean;
-    }>>;
+    }): Promise<ApiResponse<MacVerifyResult>>;
     passwordHash(params: {
         password: string;
-        variant?: string;
         timeCost?: number;
         memoryCost?: number;
         parallelism?: number;
@@ -217,69 +58,56 @@ export declare class CryptoClient {
         password: string;
         hash: string;
         salt: string;
-        params: {
-            t: number;
-            m: number;
-            p: number;
-        };
-        variant?: string;
+        params: Argon2Params;
     }): Promise<ApiResponse<{
         valid: boolean;
     }>>;
     generateKeyPair(params?: {
-        algorithm?: string;
-        metadata?: Record<string, string>;
+        algorithm?: KeyAlgorithm;
+        metadata?: KeyMetadata;
     }): Promise<ApiResponse<KeyGenerateResult>>;
-    sign(params: {
-        privateKey: string;
-        message: string;
-    }): Promise<ApiResponse<SignResult>>;
+    exportKey(params: KeyIdParams): Promise<ApiResponse<KeyExportResult>>;
+    sign(params: SignParams): Promise<ApiResponse<SignResult>>;
     verify(params: {
         publicKey: string;
         message: string;
         signature: string;
     }): Promise<ApiResponse<VerifyResult>>;
+    mlKemGenerateKeyPair(): Promise<ApiResponse<MlKemKeyPair>>;
+    mlKemEncapsulate(params: {
+        publicKey: string;
+    }): Promise<ApiResponse<MlKemEncapsulateResult>>;
+    mlKemDecapsulate(params: KeyIdParams & {
+        ciphertext: string;
+    }): Promise<ApiResponse<KemDecapsulateResult>>;
     pqGenerateKeyPair(): Promise<ApiResponse<HybridKeyPair>>;
     pqEncapsulate(params: {
         x25519PublicKey: string;
         mlKemPublicKey: string;
     }): Promise<ApiResponse<HybridEncapsulateResult>>;
-    pqDecapsulate(params: {
-        x25519PrivateKey: string;
-        mlKemSecretKey: string;
+    pqDecapsulate(params: KeyIdParams & {
         x25519EphemeralPublic: string;
         mlKemCiphertext: string;
-    }): Promise<ApiResponse<{
-        sharedSecret: string;
-        algorithm: string;
-    }>>;
-    pqSign(params: {
-        level: 44 | 65 | 87;
-        secretKey: string;
-        message: string;
-    }): Promise<ApiResponse<MlDsaSignResult>>;
+    }): Promise<ApiResponse<KemDecapsulateResult>>;
+    pqSign(params: SignParams): Promise<ApiResponse<MlDsaSignResult>>;
     pqVerify(params: {
-        level: 44 | 65 | 87;
+        level: MlDsaLevel;
         publicKey: string;
         message: string;
         signature: string;
     }): Promise<ApiResponse<MlDsaVerifyResult>>;
     pqSignKeygen(params: {
-        level: 44 | 65 | 87;
+        level: MlDsaLevel;
     }): Promise<ApiResponse<MlDsaKeyPair>>;
-    pqHashSign(params: {
-        variant: string;
-        secretKey: string;
-        message: string;
-    }): Promise<ApiResponse<SlhDsaSignResult>>;
+    pqHashSign(params: SignParams): Promise<ApiResponse<SlhDsaSignResult>>;
     pqHashVerify(params: {
-        variant: string;
+        variant: SlhDsaVariant;
         publicKey: string;
         message: string;
         signature: string;
     }): Promise<ApiResponse<SlhDsaVerifyResult>>;
     pqHashSignKeygen(params: {
-        variant: string;
+        variant: SlhDsaVariant;
     }): Promise<ApiResponse<SlhDsaKeyPair>>;
     secretboxSeal(params: {
         key: string;
@@ -290,19 +118,22 @@ export declare class CryptoClient {
         key: string;
         ciphertext: string;
         aad?: string;
-    }): Promise<ApiResponse<{
-        plaintext: string;
-    }>>;
+    }): Promise<ApiResponse<string>>;
     sealedboxSeal(params: {
         recipientPublicKey: string;
         plaintext: string;
     }): Promise<ApiResponse<SealedboxSealResult>>;
-    sealedboxOpen(params: {
-        recipientSecretKey: string;
+    sealedboxOpen(params: KeyIdParams & {
         sealed: string;
-    }): Promise<ApiResponse<{
+    }): Promise<ApiResponse<string>>;
+    sealedboxSealPq(params: {
+        x25519PublicKey: string;
+        mlKemPublicKey: string;
         plaintext: string;
-    }>>;
+    }): Promise<ApiResponse<SealedboxSealResult>>;
+    sealedboxOpenPq(params: KeyIdParams & {
+        sealed: string;
+    }): Promise<ApiResponse<string>>;
     passwordEncrypt(params: {
         password: string;
         plaintext: string;
@@ -310,32 +141,21 @@ export declare class CryptoClient {
     passwordDecrypt(params: {
         password: string;
         ciphertext: string;
-    }): Promise<ApiResponse<{
-        plaintext: string;
-    }>>;
+    }): Promise<ApiResponse<string>>;
     keyWrap(params: {
         kek: string;
         keyToWrap: string;
-        algorithm?: "aes-kw" | "aes-kwp";
+        algorithm?: KeyWrapAlgorithm;
     }): Promise<ApiResponse<KeyWrapResult>>;
     keyUnwrap(params: {
         kek: string;
         wrappedKey: string;
-        algorithm?: "aes-kw" | "aes-kwp";
-    }): Promise<ApiResponse<{
-        key: string;
-    }>>;
+        algorithm?: KeyWrapAlgorithm;
+    }): Promise<ApiResponse<string>>;
     getDoraCompliance(): Promise<ApiResponse<DoraComplianceScorecard>>;
-    getCbom(): Promise<ApiResponse<CbomExportPayload>>;
+    getCbom(): Promise<CbomExportPayload>;
     negotiateAlgorithm(options?: AlgorithmNegotiationOptions): AlgorithmNegotiationResult;
     algorithms(): Promise<ApiResponse<Record<string, string[]>>>;
-    health(): Promise<{
-        statusCode: number;
-    }>;
-}
-export declare class CryptoApiError extends Error {
-    readonly status: number;
-    readonly body: ApiError;
-    constructor(status: number, body: ApiError);
+    health(): Promise<HealthResult>;
 }
 //# sourceMappingURL=index.d.ts.map