@sebastienrousseau/crypto-server 0.0.8 → 0.0.9

package/dist/routes/v2/mac.js

@@ -35,7 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 const route_helpers_1 = require("../../utils/route-helpers");
 const HMAC_ALGORITHMS = ["sha256", "sha384", "sha512", "sha3-256", "sha3-512"];
-exports.default = (app) => {
+function registerHmac(app) {
     app.post("/v2/hmac", {
         schema: {
             tags: ["MAC"],
@@ -53,7 +53,7 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { computeHmac } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/modern/mac")));
+            const { computeHmac } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/modern")));
             const body = request.body;
             const result = computeHmac({
                 algorithm: body.algorithm,
@@ -66,6 +66,8 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "HMAC computation");
         }
     });
+}
+function registerHmacVerify(app) {
     app.post("/v2/hmac/verify", {
         schema: {
             tags: ["MAC"],
@@ -84,7 +86,7 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { verifyHmac } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/modern/mac")));
+            const { verifyHmac } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/modern")));
             const body = request.body;
             const result = verifyHmac({
                 algorithm: body.algorithm,
@@ -98,5 +100,9 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "HMAC verification");
         }
     });
+}
+exports.default = (app) => {
+    registerHmac(app);
+    registerHmacVerify(app);
 };
 //# sourceMappingURL=mac.js.map

package/dist/routes/v2/multi-recipient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"multi-recipient.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/multi-recipient.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAI/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAgEE"}
+{"version":3,"file":"multi-recipient.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/multi-recipient.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAuB/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAiDE"}

package/dist/routes/v2/multi-recipient.js

@@ -34,6 +34,16 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 const route_helpers_1 = require("../../utils/route-helpers");
+function toLibRecipient(r) {
+    if (r.type === "classical") {
+        return { type: "x25519", publicKey: r.publicKey };
+    }
+    return {
+        type: "x25519-ml-kem-768",
+        x25519PublicKey: r.publicKey,
+        mlKemPublicKey: r.mlKemPublicKey,
+    };
+}
 exports.default = (app) => {
     app.post("/v2/multi-recipient/encrypt", {
         schema: {
@@ -66,18 +76,9 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { multiEncrypt } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/multi-recipient")));
+            const { multiEncrypt } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/high-level")));
             const { plaintext, recipients } = request.body;
-            const libRecipients = recipients.map((r) => {
-                if (r.type === "classical") {
-                    return { type: "x25519", publicKey: r.publicKey };
-                }
-                return {
-                    type: "x25519-ml-kem-768",
-                    x25519PublicKey: r.publicKey,
-                    mlKemPublicKey: r.mlKemPublicKey,
-                };
-            });
+            const libRecipients = recipients.map(toLibRecipient);
             return reply.send({ data: multiEncrypt(libRecipients, plaintext) });
         }
         catch (error) {

package/dist/routes/v2/password-encrypt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-encrypt.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/password-encrypt.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAI/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAsEE"}
+{"version":3,"file":"password-encrypt.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/password-encrypt.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAoF/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAGE"}

package/dist/routes/v2/password-encrypt.js

@@ -1,44 +1,12 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 const route_helpers_1 = require("../../utils/route-helpers");
-exports.default = (app) => {
+function registerEncrypt(app) {
     app.post("/v2/password/encrypt", {
         schema: {
             tags: ["Password Encryption"],
             summary: "Encrypt with password (Argon2id + XChaCha20-Poly1305)",
+            description: "Derives the key with Argon2id (t = 3, m = 64 MiB, p = 4) on a worker thread.",
             body: {
                 type: "object",
                 required: ["password", "plaintext"],
@@ -50,21 +18,17 @@ exports.default = (app) => {
             },
         },
     }, async (request, reply) => {
-        try {
-            const { passwordEncrypt } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/password-encrypt")));
-            const { password, plaintext } = request.body;
-            return reply.send({
-                data: passwordEncrypt({ password, plaintext }),
-            });
-        }
-        catch (error) {
-            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Encryption");
-        }
+        const { password, plaintext } = request.body;
+        const result = await request.server.kdf.run("highLevel", "passwordEncrypt", { password, plaintext });
+        return reply.send({ data: result });
     });
+}
+function registerDecrypt(app) {
     app.post("/v2/password/decrypt", {
         schema: {
             tags: ["Password Encryption"],
             summary: "Decrypt with password (Argon2id + XChaCha20-Poly1305)",
+            description: "Derives the key with the Argon2id parameters stored in the ciphertext, on a worker thread.",
             body: {
                 type: "object",
                 required: ["password", "ciphertext"],
@@ -77,9 +41,8 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { passwordDecrypt } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/password-encrypt")));
             const { password, ciphertext } = request.body;
-            const plaintext = passwordDecrypt(password, ciphertext);
+            const plaintext = await request.server.kdf.run("highLevel", "passwordDecrypt", password, ciphertext);
             return reply.send({
                 data: Buffer.from(plaintext).toString("utf8"),
             });
@@ -88,5 +51,9 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Decryption");
         }
     });
+}
+exports.default = (app) => {
+    registerEncrypt(app);
+    registerDecrypt(app);
 };
 //# sourceMappingURL=password-encrypt.js.map

package/dist/routes/v2/password.d.ts

@@ -1,4 +1,8 @@
 import type { FastifyInstance } from "fastify";
+export declare const ARGON2_FLOORS: Readonly<{
+    memoryCostKiB: 19456;
+    timeCost: 2;
+}>;
 declare const _default: (app: FastifyInstance) => void;
 export default _default;
 //# sourceMappingURL=password.d.ts.map

package/dist/routes/v2/password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/password.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAI/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAiGE"}
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/password.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAY/C,eAAO,MAAM,aAAa;;;EAGxB,CAAC;yBA2Ga,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAGE"}

package/dist/routes/v2/password.js

@@ -1,78 +1,51 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ARGON2_FLOORS = void 0;
 const route_helpers_1 = require("../../utils/route-helpers");
-exports.default = (app) => {
+exports.ARGON2_FLOORS = Object.freeze({
+    memoryCostKiB: 19456,
+    timeCost: 2,
+});
+function registerHash(app) {
     app.post("/v2/password/hash", {
         config: { rateLimit: { max: 5, timeWindow: "1 minute" } },
         schema: {
             tags: ["Password"],
             summary: "Hash a password with Argon2id",
+            description: "Argon2id with at least 19 MiB of memory and two passes (OWASP); defaults are t = 3, m = 64 MiB, p = 4. Runs on a worker thread.",
             body: {
                 type: "object",
                 required: ["password"],
                 additionalProperties: false,
                 properties: {
                     password: { type: "string", minLength: 1, maxLength: 1024 },
-                    timeCost: { type: "integer", minimum: 1, maximum: 10 },
-                    memoryCost: { type: "integer", minimum: 1024, maximum: 262144 },
+                    timeCost: {
+                        type: "integer",
+                        minimum: exports.ARGON2_FLOORS.timeCost,
+                        maximum: 10,
+                    },
+                    memoryCost: {
+                        type: "integer",
+                        minimum: exports.ARGON2_FLOORS.memoryCostKiB,
+                        maximum: 262144,
+                    },
                     parallelism: { type: "integer", minimum: 1, maximum: 8 },
                 },
             },
         },
     }, async (request, reply) => {
-        try {
-            const { hashPassword } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/modern/password")));
-            const body = request.body;
-            const result = hashPassword({
-                password: body.password,
-                ...(body.timeCost ? { timeCost: body.timeCost } : {}),
-                ...(body.memoryCost ? { memoryCost: body.memoryCost } : {}),
-                ...(body.parallelism ? { parallelism: body.parallelism } : {}),
-            });
-            return reply.send({ data: result });
-        }
-        catch (error) {
-            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Password hashing");
-        }
+        const body = request.body;
+        const result = await request.server.kdf.run("modern", "hashPassword", body);
+        return reply.send({ data: result });
     });
+}
+function registerVerify(app) {
     app.post("/v2/password/verify", {
         config: { rateLimit: { max: 5, timeWindow: "1 minute" } },
         schema: {
             tags: ["Password"],
             summary: "Verify a password against an Argon2id hash",
+            description: "Accepts the parameters of existing hashes, including ones below the floor for new hashes. Runs on a worker thread.",
             body: {
                 type: "object",
                 required: ["password", "hash", "salt", "params"],
@@ -96,14 +69,16 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { verifyPassword } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/modern/password")));
-            const body = request.body;
-            const result = verifyPassword(body);
+            const result = await request.server.kdf.run("modern", "verifyPassword", request.body);
             return reply.send({ data: result });
         }
         catch (error) {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Password verification");
         }
     });
+}
+exports.default = (app) => {
+    registerHash(app);
+    registerVerify(app);
 };
 //# sourceMappingURL=password.js.map

package/dist/routes/v2/pq-hash-sign.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pq-hash-sign.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/pq-hash-sign.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAqB/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAiHE"}
+{"version":3,"file":"pq-hash-sign.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/pq-hash-sign.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAmJ/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAKE"}

package/dist/routes/v2/pq-hash-sign.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 const route_helpers_1 = require("../../utils/route-helpers");
+const keys_1 = require("../../utils/keys");
 const SLH_DSA_VARIANTS = [
     "sha2-128f",
     "sha2-128s",
@@ -48,11 +49,13 @@ const SLH_DSA_VARIANTS = [
     "shake-256f",
     "shake-256s",
 ];
-exports.default = (app) => {
+const SLH_DSA_ALGORITHMS = SLH_DSA_VARIANTS.map((v) => `slh-dsa-${v}`);
+function registerKeygen(app) {
     app.post("/v2/pq/slh-dsa/keygen", {
         schema: {
             tags: ["Post-Quantum Hash-Based Signatures"],
-            summary: "Generate SLH-DSA key pair (FIPS 205)",
+            summary: "Generate a server-held SLH-DSA key pair (FIPS 205)",
+            description: "Generates an SLH-DSA key pair, keeps the secret key on the server and returns its keyId with the public key.",
             body: {
                 type: "object",
                 required: ["variant"],
@@ -63,42 +66,40 @@ exports.default = (app) => {
             },
         },
     }, async (request, reply) => {
-        try {
-            const { slhDsaKeygen } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/modern/pq-hash-sign")));
-            const { variant } = request.body;
-            return reply.send({ data: slhDsaKeygen(variant) });
-        }
-        catch (error) {
-            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Key generation");
-        }
+        const { slhDsaKeygen } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/modern")));
+        const { variant } = request.body;
+        const { publicKey, secretKey, algorithm } = slhDsaKeygen(variant);
+        const stored = await (0, keys_1.storeKey)(request, algorithm, { publicKey }, { secretKey });
+        return reply.send({ data: (0, keys_1.publicView)(stored) });
     });
+}
+function registerSign(app) {
     app.post("/v2/pq/slh-dsa/sign", {
         schema: {
             tags: ["Post-Quantum Hash-Based Signatures"],
             summary: "Sign with SLH-DSA (FIPS 205)",
+            description: "Signs with a server-held SLH-DSA key (keyId from POST /v2/pq/slh-dsa/keygen); the variant comes from the key.",
             body: {
                 type: "object",
-                required: ["variant", "secretKey", "message"],
+                required: ["keyId", "message"],
                 additionalProperties: false,
                 properties: {
-                    variant: { type: "string", enum: SLH_DSA_VARIANTS },
-                    secretKey: { type: "string", minLength: 1 },
+                    keyId: keys_1.KEY_ID_SCHEMA,
                     message: { type: "string", minLength: 1 },
                 },
             },
         },
     }, async (request, reply) => {
-        try {
-            const { slhDsaSign } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/modern/pq-hash-sign")));
-            const body = request.body;
-            return reply.send({
-                data: slhDsaSign(body.variant, body.secretKey, body.message),
-            });
-        }
-        catch (error) {
-            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Signing");
-        }
+        const { slhDsaSign } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/modern")));
+        const body = request.body;
+        const key = await (0, keys_1.resolveKey)(request, body.keyId, SLH_DSA_ALGORITHMS);
+        const variant = key.algorithm.slice("slh-dsa-".length);
+        return reply.send({
+            data: slhDsaSign(variant, key.privateParts["secretKey"], body.message),
+        });
     });
+}
+function registerVerify(app) {
     app.post("/v2/pq/slh-dsa/verify", {
         schema: {
             tags: ["Post-Quantum Hash-Based Signatures"],
@@ -117,7 +118,7 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { slhDsaVerify } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/modern/pq-hash-sign")));
+            const { slhDsaVerify } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/modern")));
             const body = request.body;
             return reply.send({
                 data: slhDsaVerify(body.variant, body.publicKey, body.message, body.signature),
@@ -127,5 +128,10 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Verification");
         }
     });
+}
+exports.default = (app) => {
+    registerKeygen(app);
+    registerSign(app);
+    registerVerify(app);
 };
 //# sourceMappingURL=pq-hash-sign.js.map

package/dist/routes/v2/pq-sign.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pq-sign.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/pq-sign.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAI/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBA6GE"}
+{"version":3,"file":"pq-sign.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/pq-sign.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAmI/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAKE"}

package/dist/routes/v2/pq-sign.js

@@ -34,11 +34,14 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 const route_helpers_1 = require("../../utils/route-helpers");
-exports.default = (app) => {
+const keys_1 = require("../../utils/keys");
+const ML_DSA_ALGORITHMS = ["ml-dsa-44", "ml-dsa-65", "ml-dsa-87"];
+function registerKeygen(app) {
     app.post("/v2/pq/dsa/keygen", {
         schema: {
             tags: ["Post-Quantum Signatures"],
-            summary: "Generate ML-DSA key pair (FIPS 204)",
+            summary: "Generate a server-held ML-DSA key pair (FIPS 204)",
+            description: "Generates an ML-DSA key pair, keeps the secret key on the server and returns its keyId with the public key.",
             body: {
                 type: "object",
                 required: ["level"],
@@ -49,42 +52,40 @@ exports.default = (app) => {
             },
         },
     }, async (request, reply) => {
-        try {
-            const { mlDsaKeygen } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/modern/pq-sign")));
-            const { level } = request.body;
-            return reply.send({ data: mlDsaKeygen(level) });
-        }
-        catch (error) {
-            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Key generation");
-        }
+        const { mlDsaKeygen } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/modern")));
+        const { level } = request.body;
+        const { publicKey, secretKey, algorithm } = mlDsaKeygen(level);
+        const stored = await (0, keys_1.storeKey)(request, algorithm, { publicKey }, { secretKey });
+        return reply.send({ data: (0, keys_1.publicView)(stored) });
     });
+}
+function registerSign(app) {
     app.post("/v2/pq/dsa/sign", {
         schema: {
             tags: ["Post-Quantum Signatures"],
             summary: "Sign with ML-DSA (FIPS 204)",
+            description: "Signs with a server-held ML-DSA key (keyId from POST /v2/pq/dsa/keygen or POST /v2/keys/generate); the level comes from the key.",
             body: {
                 type: "object",
-                required: ["level", "secretKey", "message"],
+                required: ["keyId", "message"],
                 additionalProperties: false,
                 properties: {
-                    level: { type: "number", enum: [44, 65, 87] },
-                    secretKey: { type: "string", minLength: 1 },
+                    keyId: keys_1.KEY_ID_SCHEMA,
                     message: { type: "string", minLength: 1 },
                 },
             },
         },
     }, async (request, reply) => {
-        try {
-            const { mlDsaSign } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/modern/pq-sign")));
-            const body = request.body;
-            return reply.send({
-                data: mlDsaSign(body.level, body.secretKey, body.message),
-            });
-        }
-        catch (error) {
-            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Signing");
-        }
+        const { mlDsaSign } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/modern")));
+        const body = request.body;
+        const key = await (0, keys_1.resolveKey)(request, body.keyId, ML_DSA_ALGORITHMS);
+        const level = Number(key.algorithm.slice("ml-dsa-".length));
+        return reply.send({
+            data: mlDsaSign(level, key.privateParts["secretKey"], body.message),
+        });
     });
+}
+function registerVerify(app) {
     app.post("/v2/pq/dsa/verify", {
         schema: {
             tags: ["Post-Quantum Signatures"],
@@ -103,7 +104,7 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { mlDsaVerify } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/modern/pq-sign")));
+            const { mlDsaVerify } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/modern")));
             const body = request.body;
             return reply.send({
                 data: mlDsaVerify(body.level, body.publicKey, body.message, body.signature),
@@ -113,5 +114,10 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Verification");
         }
     });
+}
+exports.default = (app) => {
+    registerKeygen(app);
+    registerSign(app);
+    registerVerify(app);
 };
 //# sourceMappingURL=pq-sign.js.map

package/dist/routes/v2/pq.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pq.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/pq.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAY/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBA4ME"}
+{"version":3,"file":"pq.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/pq.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBA0P/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAUE"}