@wishknish/knishio-client-js 0.9.4 → 1.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wishknish/knishio-client-js",
-  "version": "0.9.4",
+  "version": "1.0.0",
   "type": "module",
   "productName": "Knish.IO Javascript SDK Client",
   "description": "JavaScript implementation of the Knish.IO SDK to consume Knish.IO GraphQL APIs.",
@@ -48,16 +48,16 @@
     "quantum-safe",
     "sdk",
     "javascript",
-    "ml-kem768",
+    "ml-kem1024",
     "cryptography",
     "crystals-kyber",
     "fips-202",
     "fips-203"
   ],
   "dependencies": {
-    "@noble/post-quantum": "^0.5.4",
-    "@thumbmarkjs/thumbmarkjs": "^0.19.1",
-    "@urql/core": "^5.2.0",
+    "@noble/post-quantum": "^0.7.1",
+    "@thumbmarkjs/thumbmarkjs": "^1.11.0",
+    "@urql/core": "^6.0.3",
     "graphql": "^16.12.0",
     "graphql-ws": "^6.0.7",
     "isomorphic-fetch": "^3.0.0",
@@ -66,17 +66,13 @@
   },
   "devDependencies": {
     "@jest/globals": "^30.4.1",
-    "@rollup/plugin-babel": "^6.1.0",
-    "@rollup/plugin-commonjs": "^28.0.9",
-    "@rollup/plugin-node-resolve": "^16.0.3",
     "@swc/core": "^1.15.43",
     "@swc/jest": "^0.2.39",
     "buffer": "^6.0.3",
     "eslint": "^9.39.0",
     "jest": "^30.4.2",
     "neostandard": "^0.13.0",
-    "rollup": "^4.57.1",
-    "vite": "^7.3.5"
+    "vite": "^8.2.2"
   },
   "browserslist": [
     "> 1%",
@@ -96,5 +92,8 @@
     "/src",
     "/dist"
   ],
-  "packageManager": "yarn@4.15.0"
+  "packageManager": "yarn@4.15.0",
+  "engines": {
+    "node": ">=20.0.0"
+  }
 }

package/src/AuthToken.js

@@ -83,6 +83,26 @@ export default class AuthToken {
     return authToken
   }
 
+  /**
+   * ML-KEM parameter set a restored session must use, resolved in three tiers:
+   * an explicit snapshot field, then the stored validator key's length, then ML-KEM-768.
+   *
+   * The final tier is deliberately NOT the constructor default. A snapshot with neither an
+   * explicit field nor a recognisable key can only have come from a pre-bump build, and every
+   * pre-bump build was 768-only — defaulting to 1024 would make the restored wallet advertise
+   * a public key the validator never recorded for that token.
+   *
+   * @param {object} snapshot
+   * @return {number}
+   */
+  static resolveMlKemParameterSet (snapshot) {
+    const explicit = snapshot.wallet && snapshot.wallet.mlKemParameterSet
+    if (explicit) {
+      return Number(explicit)
+    }
+    return Wallet.mlKemParameterSetFromPubkey(snapshot.pubkey) || 768
+  }
+
   /**
    *
    * @param {object} snapshot
@@ -94,7 +114,8 @@ export default class AuthToken {
       secret,
       token: 'AUTH',
       position: snapshot.wallet.position,
-      characters: snapshot.wallet.characters
+      characters: snapshot.wallet.characters,
+      mlKemParameterSet: AuthToken.resolveMlKemParameterSet(snapshot)
     })
     return AuthToken.create({
       token: snapshot.token,
@@ -122,7 +143,7 @@ export default class AuthToken {
 
   /**
    *
-   * @return {{wallet: {characters, position}, encrypt, expiresAt, token, pubkey}}
+   * @return {{wallet: {characters, position, mlKemParameterSet}, encrypt, expiresAt, token, pubkey}}
    */
   getSnapshot () {
     return {
@@ -132,7 +153,8 @@ export default class AuthToken {
       encrypt: this.$__encrypt,
       wallet: {
         position: this.$__wallet.position,
-        characters: this.$__wallet.characters
+        characters: this.$__wallet.characters,
+        mlKemParameterSet: this.$__wallet.mlKemParameterSet
       }
     }
   }

package/src/KnishIOClient.js

@@ -129,7 +129,8 @@ export default class KnishIOClient {
     serverSdkVersion = 3,
     logging = false,
     defaultRequestPolicy = null,
-    secretStorage = null
+    secretStorage = null,
+    mlKemParameterSet = 1024
   }) {
     this.initialize({
       uri,
@@ -139,7 +140,8 @@ export default class KnishIOClient {
       serverSdkVersion,
       logging,
       defaultRequestPolicy,
-      secretStorage
+      secretStorage,
+      mlKemParameterSet
     })
   }
 
@@ -161,7 +163,8 @@ export default class KnishIOClient {
     serverSdkVersion = 3,
     logging = false,
     defaultRequestPolicy = null,
-    secretStorage = null
+    secretStorage = null,
+    mlKemParameterSet = 1024
   }) {
     this.reset()
 
@@ -171,6 +174,7 @@ export default class KnishIOClient {
     // policy. A long-lived server/sync client set to 'network-only' never serves
     // a stale cache-first read; browser/SPA consumers leave this null (cache-first).
     this.$__defaultRequestPolicy = defaultRequestPolicy
+    this.setMlKemParameterSet(mlKemParameterSet)
     this.$__authTokenObjects = {}
     this.$__authInProcess = false
     this.abortControllers = new Map()
@@ -202,6 +206,30 @@ export default class KnishIOClient {
     this.$__serverSdkVersion = serverSdkVersion
   }
 
+  /**
+   * Get active ML-KEM parameter set (1024 default or 768 step-back)
+   *
+   * @return {number}
+   */
+  getMlKemParameterSet () {
+    return this.$__mlKemParameterSet || 1024
+  }
+
+  /**
+   * Set active ML-KEM parameter set (1024 default or 768 step-back)
+   *
+   * @param {number|string} parameterSet
+   * @return {KnishIOClient}
+   */
+  setMlKemParameterSet (parameterSet) {
+    const paramNum = Number(parameterSet)
+    if (![1024, 768].includes(paramNum)) {
+      throw new Error(`KnishIO: unsupported ML-KEM parameter set ${parameterSet}; expected 1024 or 768.`)
+    }
+    this.$__mlKemParameterSet = paramNum
+    return this
+  }
+
   /**
    * Get random uri from specified this.$__uris
    *
@@ -509,7 +537,8 @@ export default class KnishIOClient {
 
     if (!sourceWallet) {
       sourceWallet = new Wallet({
-        secret: this.getSecret()
+        secret: this.getSecret(),
+        mlKemParameterSet: this.getMlKemParameterSet()
       })
     } else {
       sourceWallet.key = Wallet.generateKey({
@@ -598,7 +627,8 @@ export default class KnishIOClient {
       bundle,
       token: 'USER',
       batchId: sourceWallet.batchId,
-      characters: sourceWallet.characters
+      characters: sourceWallet.characters,
+      mlKemParameterSet: this.getMlKemParameterSet()
     })
 
     return new Molecule({
@@ -608,7 +638,8 @@ export default class KnishIOClient {
       remainderWallet: this.getRemainderWallet(),
       cellSlug: this.getCellSlug(),
       version: this.getServerSdkVersion(),
-      continuIdPosition
+      continuIdPosition,
+      mlKemParameterSet: this.getMlKemParameterSet()
     })
   }
 
@@ -1237,7 +1268,8 @@ export default class KnishIOClient {
   }) {
     const newWallet = new Wallet({
       secret: this.getSecret(),
-      token
+      token,
+      mlKemParameterSet: this.getMlKemParameterSet()
     })
 
     /**
@@ -1369,7 +1401,8 @@ export default class KnishIOClient {
       secret: this.getSecret(),
       bundle: this.getBundle(),
       token,
-      batchId
+      batchId,
+      mlKemParameterSet: this.getMlKemParameterSet()
     })
 
     /**
@@ -1783,7 +1816,8 @@ export default class KnishIOClient {
         } else {
           to = Wallet.create({
             secret: to,
-            token
+            token,
+            mlKemParameterSet: this.getMlKemParameterSet()
           })
         }
       }
@@ -1935,7 +1969,8 @@ export default class KnishIOClient {
     // Attempt to get the recipient's wallet, if not provided
     const recipientWallet = Wallet.create({
       bundle: bundleHash,
-      token
+      token,
+      mlKemParameterSet: this.getMlKemParameterSet()
     })
 
     // Compute the batch ID for the recipient
@@ -2035,7 +2070,8 @@ export default class KnishIOClient {
     const recipientWallets = recipients.map(recipient => {
       const recipientWallet = Wallet.create({
         bundle: recipient.bundleHash,
-        token
+        token,
+        mlKemParameterSet: this.getMlKemParameterSet()
       })
 
       // Compute the batch ID for the recipient (typically used by stackable tokens)
@@ -2334,7 +2370,8 @@ export default class KnishIOClient {
     // Generate new recipient wallet if only recipient secret has been passed
     const recipientWallet = Wallet.create({
       bundle: bundleHash,
-      token: tokenSlug
+      token: tokenSlug,
+      mlKemParameterSet: this.getMlKemParameterSet()
     })
 
     // Set batch ID
@@ -2390,7 +2427,8 @@ export default class KnishIOClient {
     // Create a wallet for encryption
     const wallet = new Wallet({
       secret: generateSecret(await this.getFingerprint()),
-      token: 'AUTH'
+      token: 'AUTH',
+      mlKemParameterSet: this.getMlKemParameterSet()
     })
 
     /**
@@ -2443,7 +2481,8 @@ export default class KnishIOClient {
     // Generate a signing wallet
     const wallet = new Wallet({
       secret,
-      token: 'AUTH'
+      token: 'AUTH',
+      mlKemParameterSet: this.getMlKemParameterSet()
     })
 
     // Create a wallet with a signing wallet
@@ -2460,7 +2499,7 @@ export default class KnishIOClient {
       molecule
     })
 
-    // PQ-transport Phase E (cycle 163): convey the AUTH source wallet's ML-KEM768 public key as a
+    // PQ-transport Phase E (cycle 163): convey the AUTH source wallet's ML-KEM public key as a
     // SIGNED `walletPubkey` meta on the U-atom (fillMolecule → initAuthorization → sign), so the
     // validator can encrypt CipherHash responses back to THIS wallet (the one that decrypts them).
     // Signed → tamper-proof. Only when present (PQ-capable wallet).

package/src/Molecule.js

@@ -87,8 +87,10 @@ export default class Molecule {
     remainderWallet = null,
     cellSlug = null,
     version = null,
-    continuIdPosition = null
+    continuIdPosition = null,
+    mlKemParameterSet = null
   }) {
+    this.mlKemParameterSet = mlKemParameterSet || (sourceWallet && sourceWallet.mlKemParameterSet) || 1024
     this.status = null
     this.molecularHash = null
     this.createdAt = String(+new Date())
@@ -110,7 +112,8 @@ export default class Molecule {
         bundle,
         token: sourceWallet.token,
         batchId: sourceWallet.batchId,
-        characters: sourceWallet.characters
+        characters: sourceWallet.characters,
+        mlKemParameterSet: this.mlKemParameterSet
       })
     }
   }
@@ -343,7 +346,8 @@ export default class Molecule {
     if (!this.remainderWallet || this.remainderWallet.token !== 'USER') {
       this.remainderWallet = Wallet.create({
         secret: this.secret,
-        bundle: this.bundle
+        bundle: this.bundle,
+        mlKemParameterSet: this.mlKemParameterSet
       })
     }
 
@@ -479,7 +483,8 @@ export default class Molecule {
     // Create burn address wallet (null bundle = token destruction)
     const burnWallet = new Wallet({
       bundle: '0000000000000000000000000000000000000000000000000000000000000000',
-      token: this.sourceWallet.token
+      token: this.sourceWallet.token,
+      mlKemParameterSet: this.mlKemParameterSet
     })
 
     // V-atom 1: Debit full balance from source
@@ -685,7 +690,8 @@ export default class Molecule {
       secret: this.secret,
       bundle: this.bundle,
       token: this.sourceWallet.token,
-      batchId: this.sourceWallet.batchId
+      batchId: this.sourceWallet.batchId,
+      mlKemParameterSet: this.mlKemParameterSet
     })
     bufferWallet.tradeRates = tradeRates
 
@@ -1329,7 +1335,8 @@ export default class Molecule {
             position: data.sourceWallet.position,
             bundle: data.sourceWallet.bundle,
             batchId: data.sourceWallet.batchId,
-            characters: data.sourceWallet.characters
+            characters: data.sourceWallet.characters,
+            mlKemParameterSet: molecule.mlKemParameterSet
           })
 
           // Set additional properties for validation context
@@ -1351,7 +1358,8 @@ export default class Molecule {
             position: data.remainderWallet.position,
             bundle: data.remainderWallet.bundle,
             batchId: data.remainderWallet.batchId,
-            characters: data.remainderWallet.characters
+            characters: data.remainderWallet.characters,
+            mlKemParameterSet: molecule.mlKemParameterSet
           })
 
           // Set additional properties for validation context

package/src/Wallet.js

@@ -59,7 +59,13 @@ import {
 } from './libraries/crypto.js'
 import TokenUnit from './TokenUnit.js'
 import WalletCredentialException from './exception/WalletCredentialException.js'
-import { ml_kem768 as MlKEM768 } from '@noble/post-quantum/ml-kem.js'
+import { ml_kem768 as MlKEM768, ml_kem1024 as MlKEM1024 } from '@noble/post-quantum/ml-kem.js'
+
+const ML_KEM_PARAMS = {
+  1024: { kem: MlKEM1024, pkBytes: 1568, skBytes: 3168, ctBytes: 1568 },
+  768: { kem: MlKEM768, pkBytes: 1184, skBytes: 2400, ctBytes: 1088 }
+}
+const DEFAULT_ML_KEM_PARAMETER_SET = 1024
 
 /**
  * Wallet class represents the set of public and private
@@ -84,8 +90,14 @@ export default class Wallet {
     address = null,
     position = null,
     batchId = null,
-    characters = null
+    characters = null,
+    mlKemParameterSet = DEFAULT_ML_KEM_PARAMETER_SET
   }) {
+    const paramSetNum = Number(mlKemParameterSet)
+    if (!ML_KEM_PARAMS[paramSetNum]) {
+      throw new Error(`KnishIO: unsupported ML-KEM parameter set ${mlKemParameterSet}; expected 1024 or 768.`)
+    }
+    this.mlKemParameterSet = paramSetNum
     this.token = token
     this.balance = '0'
     this.molecules = {}
@@ -141,7 +153,8 @@ export default class Wallet {
     bundle = null,
     token,
     batchId = null,
-    characters = null
+    characters = null,
+    mlKemParameterSet = DEFAULT_ML_KEM_PARAMETER_SET
   }) {
     let position = null
 
@@ -163,7 +176,8 @@ export default class Wallet {
       token,
       position,
       batchId,
-      characters
+      characters,
+      mlKemParameterSet
     })
   }
 
@@ -280,23 +294,49 @@ export default class Wallet {
   }
 
   /**
-   * Initializes the ML-KEM key pair
+   * Derive an ML-KEM keypair for an arbitrary parameter set from the wallet's key seed.
+   *
+   * Returns `null` when the wallet holds no key — a secret-less wallet, which is what
+   * {@link Molecule.fromJSON} builds for validation context. `generateSecret(null, …)` does NOT
+   * throw, so without this the wallet would derive a plausible-looking identity from a bogus seed
+   * and fail three layers down at AES-GCM instead of at the missing key. The guard lives here
+   * rather than at each call site so a new caller cannot miss it.
+   *
+   * @param {number} parameterSet - 1024 or 768
+   * @return {{pubkey: string, privkey: Uint8Array, params: object}|null}
    */
-  initializeMLKEM () {
-    // Generate a 64-byte (512-bit) seed from the Knish.IO private key
-    // Use deterministic approach: generateSecret(key, 128) → 128 hex chars = 64 bytes
+  _deriveMlKemKeypair (parameterSet) {
+    const params = ML_KEM_PARAMS[parameterSet]
+    if (!params) {
+      throw new Error(`KnishIO: unsupported ML-KEM parameter set ${parameterSet}; expected 1024 or 768.`)
+    }
+    if (!this.key) {
+      return null
+    }
     const seedHex = generateSecret(this.key, 128) // 128 hex chars = 64 bytes
-
-    // Convert the hex string to a Uint8Array
     const seed = new Uint8Array(64)
     for (let i = 0; i < 64; i++) {
       seed[i] = parseInt(seedHex.substr(i * 2, 2), 16)
     }
+    const { publicKey, secretKey } = params.kem.keygen(seed)
+    return {
+      pubkey: this.serializeKey(publicKey),
+      privkey: secretKey,
+      params
+    }
+  }
 
-    const { publicKey, secretKey } = MlKEM768.keygen(seed)
-
-    this.pubkey = this.serializeKey(publicKey)
-    this.privkey = secretKey // Note: We're keeping privkey as UInt8Array for security
+  /**
+   * Initializes the ML-KEM key pair. Only ever reached from the constructor's `secret` branch,
+   * so the derivation cannot come back empty here.
+   */
+  initializeMLKEM () {
+    const derived = this._deriveMlKemKeypair(this.mlKemParameterSet)
+    if (!derived) {
+      return
+    }
+    this.pubkey = derived.pubkey
+    this.privkey = derived.privkey
   }
 
   serializeKey (key) {
@@ -321,6 +361,35 @@ export default class Wallet {
     return new Uint8Array(binaryString.length).map((_, i) => binaryString.charCodeAt(i))
   }
 
+  /**
+   * ML-KEM parameter set implied by a serialized public key's raw byte length. FIPS 203's
+   * key lengths are disjoint (1568 bytes → ML-KEM-1024, 1184 bytes → ML-KEM-768), so a stored
+   * peer key recovers the parameter set of the session it belongs to without a wire-format
+   * change. Used by {@link AuthToken.restore} to resolve a snapshot that predates the field.
+   *
+   * @param {string|null} pubkey - Base64-serialized ML-KEM public key
+   * @return {number|null} 1024, 768, or null when the length matches neither
+   */
+  static mlKemParameterSetFromPubkey (pubkey) {
+    if (!pubkey) {
+      return null
+    }
+    let byteLength
+    try {
+      byteLength = typeof Buffer !== 'undefined'
+        ? Buffer.from(pubkey, 'base64').length
+        : atob(pubkey).length
+    } catch (e) {
+      return null
+    }
+    for (const [set, params] of Object.entries(ML_KEM_PARAMS)) {
+      if (params.pkBytes === byteLength) {
+        return Number(set)
+      }
+    }
+    return null
+  }
+
   /**
    * Returns balance as a Number for arithmetic operations.
    * WARNING: Precision loss for values > 2^53.
@@ -499,19 +568,19 @@ export default class Wallet {
     const messageString = JSON.stringify(message)
     const messageUint8 = new TextEncoder().encode(messageString)
     const deserializedPubkey = this.deserializeKey(recipientPubkey)
-    // ML-KEM-768 public keys are exactly 1184 bytes. A wrong-length key here almost always means the
-    // node did not advertise an ML-KEM public key in its auth `key` field (e.g. a validator predating
-    // the PQ-transport build). Fail with an actionable message rather than the crypto lib's cryptic
-    // `"publicKey" expected Uint8Array of length 1184, got length=N` assertion.
-    const ML_KEM_768_PUBLIC_KEY_BYTES = 1184
-    if (deserializedPubkey.length !== ML_KEM_768_PUBLIC_KEY_BYTES) {
+    // ML-KEM public keys are exactly 1568 bytes (ML-KEM-1024) or 1184 bytes (ML-KEM-768). A wrong-length key here
+    // almost always means the node did not advertise an ML-KEM public key in its auth `key` field (e.g. a validator
+    // predating the PQ-transport build). Fail with an actionable message rather than the crypto lib's cryptic
+    // `"publicKey" expected Uint8Array of length N, got length=M` assertion.
+    const params = ML_KEM_PARAMS[this.mlKemParameterSet]
+    if (deserializedPubkey.length !== params.pkBytes) {
       throw new Error(
         `KnishIO: cannot ML-KEM-encrypt — recipient public key is ${deserializedPubkey.length} bytes, ` +
-        `expected ${ML_KEM_768_PUBLIC_KEY_BYTES} (ML-KEM-768). The node likely did not advertise an ML-KEM ` +
-        'public key (upgrade the validator to a PQ-transport build), or authenticate with { encrypt: false }.'
+        `expected ${params.pkBytes} (ML-KEM-${this.mlKemParameterSet}). The peer is not running ML-KEM-${this.mlKemParameterSet}; ` +
+        'upgrade the peer, or step this client back to the other parameter set.'
       )
     }
-    const { cipherText, sharedSecret } = MlKEM768.encapsulate(deserializedPubkey)
+    const { cipherText, sharedSecret } = params.kem.encapsulate(deserializedPubkey)
     const encryptedMessage = await this.encryptWithSharedSecret(messageUint8, sharedSecret)
     return {
       cipherText: this.serializeKey(cipherText),
@@ -525,17 +594,46 @@ export default class Wallet {
   }
 
   /**
-   * ML-KEM768 decapsulate + AES-256-GCM decrypt → the RAW decrypted UTF-8 string
+   * ML-KEM decapsulate + AES-256-GCM decrypt → the RAW decrypted UTF-8 string
    * (no JSON.parse). Shared by {@link decryptMessage} (which JSON.parses the result)
-   * and the PQ CipherHash transport ({@link decryptMyMessageML768}, which needs the raw
+   * and the PQ CipherHash transport ({@link decryptMyMessageML}, which needs the raw
    * response JSON text). PQ-transport Phase E (cycle 163).
    */
   async _mlkemDecryptToString (encryptedData) {
     const { cipherText, encryptedMessage } = encryptedData
 
+    const deserializedCipherText = this.deserializeKey(cipherText)
+    const configuredParams = ML_KEM_PARAMS[this.mlKemParameterSet]
+    const otherSet = this.mlKemParameterSet === 1024 ? 768 : 1024
+
+    // Inbound is PERMISSIVE: a ciphertext at either parameter set decrypts, provided it is addressed
+    // to one of THIS wallet's own ML-KEM identities. The 64-byte seed is parameter-set-independent,
+    // so the other identity is derived on demand and its private key is released with this call's
+    // scope — never cached on the wallet. Outbound encapsulation stays STRICT (see encryptMessage);
+    // reading a 768 record we own downgrades nothing, but encapsulating at 768 would.
+    let decapsParams = configuredParams
+    let decapsPrivkey = this.privkey
+    if (deserializedCipherText.length !== configuredParams.ctBytes) {
+      if (deserializedCipherText.length !== ML_KEM_PARAMS[otherSet].ctBytes) {
+        console.error(
+          `Wallet::decryptMessage() - Ciphertext length mismatch: got ${deserializedCipherText.length}, expected ${configuredParams.ctBytes}`
+        )
+        return null
+      }
+      // `null` here means the wallet holds no key to derive from (a secret-less validation
+      // wallet); preserve the existing failure observable rather than decapsulating with nothing.
+      const derived = this._deriveMlKemKeypair(otherSet)
+      if (!derived) {
+        console.error(`Wallet::decryptMessage() - cannot derive the ML-KEM-${otherSet} identity: wallet has no key`)
+        return null
+      }
+      decapsParams = derived.params
+      decapsPrivkey = derived.privkey
+    }
+
     let sharedSecret
     try {
-      sharedSecret = MlKEM768.decapsulate(this.deserializeKey(cipherText), this.privkey)
+      sharedSecret = decapsParams.kem.decapsulate(deserializedCipherText, decapsPrivkey)
     } catch (e) {
       console.error('Wallet::decryptMessage() - Decapsulation failed', e)
       console.info('Wallet::decryptMessage() - my public key', this.pubkey)
@@ -587,11 +685,11 @@ export default class Wallet {
   }
 
   /**
-   * Post-quantum (ML-KEM768) `CipherHash` request envelope: a stringified single-recipient
+   * Post-quantum (ML-KEM) `CipherHash` request envelope: a stringified single-recipient
    * map `{ "<hashShare(recipientPubkey)>": {cipherText, encryptedMessage} }` (object-valued,
    * via {@link encryptMessage}). Matches the Rust validator's CipherHash handler. PQ Phase E.
    */
-  async encryptStringML768 (message, recipientPubkey) {
+  async encryptStringML (message, recipientPubkey) {
     const envelope = await this.encryptMessage(message, recipientPubkey)
     return JSON.stringify({ [this.hashShare(recipientPubkey)]: envelope })
   }
@@ -601,8 +699,17 @@ export default class Wallet {
    * (`hashShare(this.pubkey)`) → the RAW decrypted GraphQL response JSON text (NOT JSON.parsed;
    * it replaces the HTTP response body for the normal parser). `null` if no entry / decrypt fails.
    */
-  async decryptMyMessageML768 (map) {
-    const envelope = map[this.hashShare(this.pubkey)]
+  async decryptMyMessageML (map) {
+    let envelope = map[this.hashShare(this.pubkey)]
+    if (!envelope) {
+      // Inbound permissive: try the hash share of the on-demand derived other-set pubkey.
+      // A secret-less wallet derives nothing, so the lookup is simply skipped.
+      const otherSet = this.mlKemParameterSet === 1024 ? 768 : 1024
+      const other = this._deriveMlKemKeypair(otherSet)
+      if (other) {
+        envelope = map[this.hashShare(other.pubkey)]
+      }
+    }
     if (!envelope) {
       return null
     }

package/src/libraries/urql/UrqlClientWrapper.js

@@ -63,6 +63,11 @@ class UrqlClientWrapper {
     return createClient({
       url: serverUri,
       exchanges,
+      // urql 5 had no default and always POSTed; urql 6 defaults to 'within-url-limit', which
+      // URL-encodes short queries and sends NO body. That would silently disable the CipherHash
+      // envelope below — cipherFetch's `typeof init.body === 'string'` guard fails on a GET, so
+      // the query would leave as plaintext URL parameters with no error. Pin POST explicitly.
+      preferGetMethod: false,
       // PQ-transport Phase E: when encryption is on, route fetch through the CipherHash
       // wrapper (encrypt the request body to the validator's ML-KEM pubkey, decrypt the
       // response). Undefined → urql uses the global fetch (plaintext).
@@ -114,7 +119,7 @@ class UrqlClientWrapper {
     let requestInit = init
 
     if (wallet && serverPubkey && init && typeof init.body === 'string' && this.shouldEncrypt(init.body)) {
-      const hashVar = await wallet.encryptStringML768(init.body, serverPubkey)
+      const hashVar = await wallet.encryptStringML(init.body, serverPubkey)
       requestInit = { ...init, body: JSON.stringify({ query: CIPHER_HASH_QUERY, variables: { Hash: hashVar } }) }
       encryptedRequest = true
     }
@@ -138,7 +143,7 @@ class UrqlClientWrapper {
       // Plaintext (e.g. a validator-side error response) — pass through unchanged.
       return new Response(text, init2)
     }
-    const decrypted = await wallet.decryptMyMessageML768(JSON.parse(hash))
+    const decrypted = await wallet.decryptMyMessageML(JSON.parse(hash))
     return new Response(decrypted != null ? decrypted : text, init2)
   }