@wishknish/knishio-client-ts 0.9.7 → 1.0.0

package/dist/index.cjs

@@ -3661,6 +3661,11 @@ var TokenUnit = class _TokenUnit {
     };
   }
 };
+var ML_KEM_PARAMS = {
+  1024: { kem: mlKem_js.ml_kem1024, pkBytes: 1568, skBytes: 3168, ctBytes: 1568 },
+  768: { kem: mlKem_js.ml_kem768, pkBytes: 1184, skBytes: 2400, ctBytes: 1088 }
+};
+var DEFAULT_ML_KEM_PARAMETER_SET = 1024;
 var Wallet = class _Wallet {
   token;
   balance;
@@ -3675,6 +3680,7 @@ var Wallet = class _Wallet {
   tokenUnits;
   tradeRates;
   molecules;
+  mlKemParameterSet;
   // Token metadata (populated from query responses)
   tokenName;
   tokenAmount;
@@ -3688,8 +3694,14 @@ var Wallet = class _Wallet {
     address = null,
     position = null,
     batchId = null,
-    characters = null
+    characters = null,
+    mlKemParameterSet = DEFAULT_ML_KEM_PARAMETER_SET
   } = {}) {
+    const paramSetNum = Number(mlKemParameterSet);
+    if (!ML_KEM_PARAMS[paramSetNum]) {
+      throw new Error(`KnishIO: unsupported ML-KEM parameter set ${mlKemParameterSet}; expected 1024 or 768.`);
+    }
+    this.mlKemParameterSet = paramSetNum;
     this.token = token;
     this.balance = "0";
     this.molecules = {};
@@ -3725,7 +3737,8 @@ var Wallet = class _Wallet {
     bundle = null,
     token = "USER",
     batchId = null,
-    characters = null
+    characters = null,
+    mlKemParameterSet = DEFAULT_ML_KEM_PARAMETER_SET
   }) {
     let position = null;
     if (!secret && !bundle) {
@@ -3741,7 +3754,8 @@ var Wallet = class _Wallet {
       token,
       position,
       batchId,
-      characters
+      characters,
+      mlKemParameterSet
     });
   }
   /**
@@ -3900,20 +3914,80 @@ var Wallet = class _Wallet {
     return (typeof this.position === "undefined" || this.position === null) && (typeof this.address === "undefined" || this.address === null);
   }
   // =============================================================================
-  // POST-QUANTUM CRYPTOGRAPHY - ML-KEM768 INTEGRATION
+  // POST-QUANTUM CRYPTOGRAPHY - ML-KEM INTEGRATION
   // =============================================================================
   /**
-   * Initializes the ML-KEM key pair (matches JavaScript SDK exactly)
+   * Derive an ML-KEM keypair for an arbitrary parameter set from the wallet's key seed,
+   * without mutating the wallet. The 64-byte `d‖z` seed takes no parameter-set input — only
+   * the final `keygen` call differs — so one KnishIO wallet owns both an ML-KEM-768 and an
+   * ML-KEM-1024 identity and either can be reconstructed on demand.
+   *
+   * Returns `null` when the wallet holds no key — a secret-less wallet, which is what a molecule
+   * deserializer builds for validation context. `generateSecret(null, …)` does NOT throw, so
+   * without this the wallet would derive a plausible-looking identity from a bogus seed and fail
+   * three layers down at AES-GCM instead of at the missing key. The guard lives here rather than
+   * at each call site so a new caller cannot miss it.
+   *
+   * @param parameterSet - 1024 or 768
    */
-  initializeMLKEM() {
+  deriveMlKemKeypair(parameterSet) {
+    const params = ML_KEM_PARAMS[parameterSet];
+    if (!params) {
+      throw new Error(`KnishIO: unsupported ML-KEM parameter set ${parameterSet}; expected 1024 or 768.`);
+    }
+    if (!this.key) {
+      return null;
+    }
     const seedHex = generateSecret(this.key, 128);
     const seed = new Uint8Array(64);
     for (let i = 0; i < 64; i++) {
       seed[i] = parseInt(seedHex.substr(i * 2, 2), 16);
     }
-    const { publicKey, secretKey } = mlKem_js.ml_kem768.keygen(seed);
-    this.pubkey = this.serializeKey(publicKey);
-    this.privkey = secretKey;
+    const { publicKey, secretKey } = params.kem.keygen(seed);
+    return {
+      pubkey: this.serializeKey(publicKey),
+      privkey: secretKey,
+      params
+    };
+  }
+  /**
+   * ML-KEM parameter set implied by a serialized public key's raw byte length. FIPS 203's key
+   * lengths are disjoint (1568 bytes → ML-KEM-1024, 1184 bytes → ML-KEM-768), so a stored peer
+   * key recovers the parameter set of the session it belongs to without a wire-format change.
+   * Used by AuthToken.restore to resolve a snapshot that predates the field.
+   *
+   * @param pubkey - Base64-serialized ML-KEM public key
+   * @return 1024, 768, or null when the length matches neither
+   */
+  static mlKemParameterSetFromPubkey(pubkey) {
+    if (!pubkey) {
+      return null;
+    }
+    let byteLength;
+    try {
+      byteLength = typeof Buffer !== "undefined" ? Buffer.from(pubkey, "base64").length : atob(pubkey).length;
+    } catch {
+      return null;
+    }
+    if (byteLength === ML_KEM_PARAMS[1024].pkBytes) {
+      return 1024;
+    }
+    if (byteLength === ML_KEM_PARAMS[768].pkBytes) {
+      return 768;
+    }
+    return null;
+  }
+  /**
+   * Initializes the ML-KEM key pair (matches JavaScript SDK exactly). Only ever reached from the
+   * constructor's `secret` branch, so the derivation cannot come back empty here.
+   */
+  initializeMLKEM() {
+    const derived = this.deriveMlKemKeypair(this.mlKemParameterSet);
+    if (!derived) {
+      return;
+    }
+    this.pubkey = derived.pubkey;
+    this.privkey = derived.privkey;
   }
   // =============================================================================
   // HIGH-LEVEL MESSAGE ENCRYPTION (JavaScript SDK Compatibility)
@@ -3922,13 +3996,13 @@ var Wallet = class _Wallet {
     const messageString = JSON.stringify(message);
     const messageUint8 = new TextEncoder().encode(messageString);
     const deserializedPubkey = this.deserializeKey(recipientPubkey);
-    const ML_KEM_768_PUBLIC_KEY_BYTES = 1184;
-    if (deserializedPubkey.length !== ML_KEM_768_PUBLIC_KEY_BYTES) {
+    const params = ML_KEM_PARAMS[this.mlKemParameterSet];
+    if (deserializedPubkey.length !== params.pkBytes) {
       throw new Error(
-        `KnishIO: cannot ML-KEM-encrypt \u2014 recipient public key is ${deserializedPubkey.length} bytes, expected ${ML_KEM_768_PUBLIC_KEY_BYTES} (ML-KEM-768). The node likely did not advertise an ML-KEM public key (upgrade the validator to a PQ-transport build), or authenticate with { encrypt: false }.`
+        `KnishIO: cannot ML-KEM-encrypt \u2014 recipient public key is ${deserializedPubkey.length} bytes, expected ${params.pkBytes} (ML-KEM-${this.mlKemParameterSet}). The peer is not running ML-KEM-${this.mlKemParameterSet}; upgrade the peer, or step this client back to the other parameter set.`
       );
     }
-    const { cipherText, sharedSecret } = mlKem_js.ml_kem768.encapsulate(deserializedPubkey);
+    const { cipherText, sharedSecret } = params.kem.encapsulate(deserializedPubkey);
     const encryptedMessage = await this.encryptWithSharedSecret(messageUint8, sharedSecret);
     return {
       cipherText: this.serializeKey(cipherText),
@@ -3940,15 +4014,37 @@ var Wallet = class _Wallet {
     return decryptedString === null ? null : JSON.parse(decryptedString);
   }
   /**
-   * ML-KEM768 decapsulate + AES-256-GCM decrypt → the RAW decrypted UTF-8 string (no JSON.parse).
+   * ML-KEM decapsulate + AES-256-GCM decrypt → the RAW decrypted UTF-8 string (no JSON.parse).
    * Shared by {@link decryptMessage} (which JSON.parses the result) and the PQ CipherHash transport
-   * ({@link decryptMyMessageML768}, which needs the raw response JSON text). PQ-transport Phase E.
+   * ({@link decryptMyMessageML}, which needs the raw response JSON text). PQ-transport Phase E.
    */
   async _mlkemDecryptToString(encryptedData) {
     const { cipherText, encryptedMessage } = encryptedData;
+    const configuredParams = ML_KEM_PARAMS[this.mlKemParameterSet];
+    const otherSet = this.mlKemParameterSet === 1024 ? 768 : 1024;
+    const deserializedCipherText = this.deserializeKey(cipherText);
+    let params = configuredParams;
+    let decapsPrivkey = this.privkey;
+    if (deserializedCipherText.length !== configuredParams.ctBytes) {
+      if (deserializedCipherText.length !== ML_KEM_PARAMS[otherSet].ctBytes) {
+        console.error(
+          `Wallet::decryptMessage() - Ciphertext length mismatch: got ${deserializedCipherText.length}, expected ${configuredParams.ctBytes}`
+        );
+        return null;
+      }
+      const derived = this.deriveMlKemKeypair(otherSet);
+      if (!derived) {
+        console.error(
+          `Wallet::decryptMessage() - cannot derive the ML-KEM-${otherSet} identity: wallet has no key`
+        );
+        return null;
+      }
+      params = derived.params;
+      decapsPrivkey = derived.privkey;
+    }
     let sharedSecret;
     try {
-      sharedSecret = mlKem_js.ml_kem768.decapsulate(this.deserializeKey(cipherText), this.privkey);
+      sharedSecret = params.kem.decapsulate(deserializedCipherText, decapsPrivkey);
     } catch (e) {
       console.error("Wallet::decryptMessage() - Decapsulation failed", e);
       console.info("Wallet::decryptMessage() - my public key", this.pubkey);
@@ -3998,11 +4094,11 @@ var Wallet = class _Wallet {
     return this.serializeKey(bytes);
   }
   /**
-   * Post-quantum (ML-KEM768) CipherHash request envelope: a stringified single-recipient map
+   * Post-quantum (ML-KEM) CipherHash request envelope: a stringified single-recipient map
    * `{ "<hashShare(recipientPubkey)>": {cipherText, encryptedMessage} }` (object-valued, via
    * {@link encryptMessage}). Matches the Rust validator's CipherHash handler. PQ-transport Phase E.
    */
-  async encryptStringML768(message, recipientPubkey) {
+  async encryptStringML(message, recipientPubkey) {
     const envelope = await this.encryptMessage(message, recipientPubkey);
     return JSON.stringify({ [this.hashShare(recipientPubkey)]: envelope });
   }
@@ -4010,9 +4106,21 @@ var Wallet = class _Wallet {
    * Decrypt a CipherHash response map addressed to THIS wallet's ML-KEM pubkey
    * (`hashShare(this.pubkey)`) → the RAW decrypted GraphQL response JSON text (NOT JSON.parsed;
    * it replaces the HTTP response body for the normal parser). `null` if no entry / decrypt fails.
+   *
+   * A pre-bump peer addressed its envelope to `hashShare(our_768_pubkey)`, which a wallet
+   * configured at ML-KEM-1024 would never find — so the other identity's share is tried too.
+   * Without this, the permissive length dispatch in {@link _mlkemDecryptToString} is
+   * unreachable on the transport path.
    */
-  async decryptMyMessageML768(map) {
-    const envelope = map[this.hashShare(this.pubkey)];
+  async decryptMyMessageML(map) {
+    let envelope = map[this.hashShare(this.pubkey)];
+    if (!envelope) {
+      const otherSet = this.mlKemParameterSet === 1024 ? 768 : 1024;
+      const other = this.deriveMlKemKeypair(otherSet);
+      if (other) {
+        envelope = map[this.hashShare(other.pubkey)];
+      }
+    }
     if (!envelope) {
       return null;
     }
@@ -4166,7 +4274,8 @@ zod.z.object({
   serverSdkVersion: zod.z.number().int().min(1).optional(),
   logging: zod.z.boolean().optional(),
   defaultRequestPolicy: zod.z.enum(["cache-first", "cache-only", "network-only", "cache-and-network"]).nullable().optional(),
-  secretStorage: zod.z.unknown().optional()
+  secretStorage: zod.z.unknown().optional(),
+  mlKemParameterSet: zod.z.union([zod.z.literal(1024), zod.z.literal(768)]).optional()
 }).strict();
 zod.z.object({
   token: zod.z.string().min(1, "Auth token cannot be empty"),
@@ -5255,6 +5364,7 @@ var Molecule = class _Molecule {
   continuIdPosition;
   parentHashes;
   local;
+  mlKemParameterSet = 1024;
   /**
    * Create new Molecule instance
    * Matches JavaScript SDK constructor signature
@@ -5266,7 +5376,8 @@ var Molecule = class _Molecule {
     remainderWallet = null,
     cellSlug = null,
     version = null,
-    continuIdPosition = null
+    continuIdPosition = null,
+    mlKemParameterSet = null
   } = {}) {
     this.status = null;
     this.molecularHash = null;
@@ -5278,6 +5389,7 @@ var Molecule = class _Molecule {
     this.continuIdPosition = continuIdPosition;
     this.atoms = [];
     this.parentHashes = [];
+    this.mlKemParameterSet = mlKemParameterSet || sourceWallet?.mlKemParameterSet || 1024;
     const versionRegistry = versions_default;
     if (version !== null && Object.prototype.hasOwnProperty.call(versionRegistry, version)) {
       this.version = String(version);
@@ -5288,7 +5400,8 @@ var Molecule = class _Molecule {
         bundle,
         token: sourceWallet.token,
         batchId: sourceWallet.batchId,
-        characters: sourceWallet.characters
+        characters: sourceWallet.characters,
+        mlKemParameterSet: this.mlKemParameterSet
       });
     } else {
       this.remainderWallet = null;
@@ -5349,7 +5462,8 @@ var Molecule = class _Molecule {
     if (!this.remainderWallet || this.remainderWallet.token !== "USER") {
       this.remainderWallet = Wallet.create({
         secret: this.secret,
-        bundle: this.bundle
+        bundle: this.bundle,
+        mlKemParameterSet: this.mlKemParameterSet
       });
     }
     const continuIdMeta = {};
@@ -5736,7 +5850,8 @@ var Molecule = class _Molecule {
     }
     const burnWallet = new Wallet({
       bundle: "0000000000000000000000000000000000000000000000000000000000000000",
-      token: this.sourceWallet.token
+      token: this.sourceWallet.token,
+      mlKemParameterSet: this.mlKemParameterSet
     });
     this.addAtom(Atom.create({
       isotope: "V",
@@ -6008,7 +6123,8 @@ var Molecule = class _Molecule {
             position: data.sourceWallet.position,
             bundle: data.sourceWallet.bundle,
             batchId: data.sourceWallet.batchId,
-            characters: data.sourceWallet.characters
+            characters: data.sourceWallet.characters,
+            mlKemParameterSet: molecule.mlKemParameterSet
           });
           molecule.sourceWallet.balance = String(data.sourceWallet.balance != null ? data.sourceWallet.balance : 0);
           molecule.sourceWallet.address = data.sourceWallet.address;
@@ -6026,7 +6142,8 @@ var Molecule = class _Molecule {
             position: data.remainderWallet.position,
             bundle: data.remainderWallet.bundle,
             batchId: data.remainderWallet.batchId,
-            characters: data.remainderWallet.characters
+            characters: data.remainderWallet.characters,
+            mlKemParameterSet: molecule.mlKemParameterSet
           });
           molecule.remainderWallet.balance = String(data.remainderWallet.balance != null ? data.remainderWallet.balance : 0);
           molecule.remainderWallet.address = data.remainderWallet.address;
@@ -6124,7 +6241,8 @@ var Molecule = class _Molecule {
       secret: this.secret,
       bundle: this.bundle,
       token: this.sourceWallet.token,
-      batchId: this.sourceWallet.batchId
+      batchId: this.sourceWallet.batchId,
+      mlKemParameterSet: this.mlKemParameterSet
     });
     if (tradeRates) {
       bufferWallet.tradeRates = tradeRates;
@@ -6395,7 +6513,7 @@ var GraphQLClient = class {
     let encryptedRequest = false;
     let requestInit = init;
     if (wallet && serverPubkey && init && typeof init.body === "string" && this.shouldEncrypt(init.body)) {
-      const hashVar = await wallet.encryptStringML768(init.body, serverPubkey);
+      const hashVar = await wallet.encryptStringML(init.body, serverPubkey);
       requestInit = { ...init, body: JSON.stringify({ query: CIPHER_HASH_QUERY, variables: { Hash: hashVar } }) };
       encryptedRequest = true;
     }
@@ -6415,7 +6533,7 @@ var GraphQLClient = class {
     if (typeof hash !== "string") {
       return new Response(text, init2);
     }
-    const decrypted = await wallet.decryptMyMessageML768(JSON.parse(hash));
+    const decrypted = await wallet.decryptMyMessageML(JSON.parse(hash));
     return new Response(decrypted != null ? decrypted : text, init2);
   }
   setAuthData({
@@ -6584,6 +6702,22 @@ var AuthToken = class _AuthToken {
     authToken.setWallet(wallet);
     return authToken;
   }
+  /**
+   * ML-KEM parameter set a restored session must use, resolved in three tiers:
+   * an explicit snapshot field, then the stored validator key's length, then ML-KEM-768.
+   *
+   * The final tier is deliberately NOT the constructor default. A snapshot with neither an
+   * explicit field nor a recognisable key can only have come from a pre-bump build, and every
+   * pre-bump build was 768-only — defaulting to 1024 would make the restored wallet advertise
+   * a public key the validator never recorded for that token.
+   */
+  static resolveMlKemParameterSet(snapshot) {
+    const explicit = snapshot.wallet?.mlKemParameterSet;
+    if (explicit) {
+      return Number(explicit) === 768 ? 768 : 1024;
+    }
+    return Wallet.mlKemParameterSetFromPubkey(snapshot.pubkey) ?? 768;
+  }
   /**
    * Restore AuthToken from snapshot
    */
@@ -6591,8 +6725,9 @@ var AuthToken = class _AuthToken {
     const wallet = new Wallet({
       secret,
       token: "AUTH",
-      position: snapshot.wallet.position,
-      characters: snapshot.wallet.characters
+      position: snapshot.wallet?.position ?? null,
+      characters: snapshot.wallet?.characters ?? null,
+      mlKemParameterSet: _AuthToken.resolveMlKemParameterSet(snapshot)
     });
     return _AuthToken.create({
       token: snapshot.token,
@@ -6660,7 +6795,9 @@ var AuthToken = class _AuthToken {
     };
   }
   /**
-   * Create snapshot for persistence
+   * Create snapshot for persistence. The wallet's ML-KEM parameter set is recorded beside its
+   * position and characters so a stepped-back ML-KEM-768 session restores as 768 rather than
+   * silently taking the constructor default.
    */
   toSnapshot() {
     return {
@@ -6671,7 +6808,8 @@ var AuthToken = class _AuthToken {
       ...this.$__wallet ? {
         wallet: {
           position: this.$__wallet.position,
-          characters: this.$__wallet.characters
+          characters: this.$__wallet.characters,
+          mlKemParameterSet: this.$__wallet.mlKemParameterSet
         }
       } : {}
     };
@@ -6968,7 +7106,8 @@ var KnishIOClientConfigSchema2 = zod.z.object({
   // isn't rejected.
   defaultRequestPolicy: zod.z.enum(["cache-first", "cache-only", "network-only", "cache-and-network"]).nullable().optional(),
   // Pluggable hardware envelope encryption secret storage provider
-  secretStorage: zod.z.unknown().optional()
+  secretStorage: zod.z.unknown().optional(),
+  mlKemParameterSet: zod.z.union([zod.z.literal(1024), zod.z.literal(768)]).optional()
 }).strict();
 var EnvironmentConfigSchema = zod.z.object({
   NODE_ENV: zod.z.enum(["development", "production", "test"]).optional(),
@@ -9542,6 +9681,13 @@ var MutationProposeMolecule = class extends Mutation {
   molecule() {
     return this.$__molecule.toJSON ? this.$__molecule.toJSON() : this.$__molecule;
   }
+  /**
+   * Fills the molecule with specific mutation data.
+   * Subclasses override to build domain-specific atoms.
+   * Default implementation is a no-op for pre-assembled molecules.
+   */
+  fillMolecule(_params) {
+  }
 };
 
 // src/response/ResponseCreateToken.ts
@@ -10647,6 +10793,7 @@ var KnishIOClient = class {
   $__authTokenObjects = {};
   $__authToken = null;
   $__authInProcess = false;
+  $__mlKemParameterSet = 1024;
   $__remainderWallet = null;
   lastMoleculeQuery = null;
   abortControllers = /* @__PURE__ */ new Map();
@@ -10691,7 +10838,8 @@ var KnishIOClient = class {
       client,
       serverSdkVersion,
       logging,
-      defaultRequestPolicy
+      defaultRequestPolicy,
+      mlKemParameterSet: config.mlKemParameterSet ?? 1024
     });
     if (config.secretStorage) {
       this.$__secretStorage = config.secretStorage;
@@ -10707,10 +10855,12 @@ var KnishIOClient = class {
     client = null,
     serverSdkVersion = 3,
     logging = false,
-    defaultRequestPolicy = null
+    defaultRequestPolicy = null,
+    mlKemParameterSet = 1024
   }) {
     this.reset();
     this.$__logging = logging;
+    this.setMlKemParameterSet(mlKemParameterSet);
     this.$__authTokenObjects = {};
     this.setUri(uri);
     if (cellSlug) {
@@ -10731,6 +10881,17 @@ var KnishIOClient = class {
     this.$__serverSdkVersion = serverSdkVersion;
     this.$__defaultRequestPolicy = defaultRequestPolicy;
   }
+  getMlKemParameterSet() {
+    return this.$__mlKemParameterSet || 1024;
+  }
+  setMlKemParameterSet(parameterSet) {
+    const paramNum = Number(parameterSet);
+    if (![1024, 768].includes(paramNum)) {
+      throw new Error(`KnishIO: unsupported ML-KEM parameter set ${parameterSet}; expected 1024 or 768.`);
+    }
+    this.$__mlKemParameterSet = paramNum;
+    return this;
+  }
   /**
    * Get random uri from specified this.$__uris
    */
@@ -10967,7 +11128,8 @@ var KnishIOClient = class {
       bundle,
       token: "USER",
       batchId: sourceWallet.batchId,
-      characters: sourceWallet.characters
+      characters: sourceWallet.characters,
+      mlKemParameterSet: this.getMlKemParameterSet()
     }));
     return new Molecule({
       secret,
@@ -10976,7 +11138,8 @@ var KnishIOClient = class {
       remainderWallet: this.getRemainderWallet(),
       cellSlug: this.getCellSlug(),
       version: this.getServerSdkVersion(),
-      continuIdPosition
+      continuIdPosition,
+      mlKemParameterSet: this.getMlKemParameterSet()
     });
   }
   /**
@@ -11088,7 +11251,8 @@ var KnishIOClient = class {
     }))?.payload();
     if (!sourceWallet) {
       sourceWallet = new Wallet({
-        secret: this.getSecret()
+        secret: this.getSecret(),
+        mlKemParameterSet: this.getMlKemParameterSet()
       });
     } else {
       sourceWallet.key = Wallet.generateKey({
@@ -11131,7 +11295,8 @@ var KnishIOClient = class {
     }
     const recipientWallet = Wallet.create({
       bundle: bundleHash,
-      token
+      token,
+      mlKemParameterSet: this.getMlKemParameterSet()
     });
     if (batchId !== null) {
       recipientWallet.batchId = batchId;
@@ -11198,7 +11363,8 @@ var KnishIOClient = class {
     const recipientWallets = recipients.map((recipient) => {
       const recipientWallet = Wallet.create({
         bundle: recipient.bundleHash,
-        token
+        token,
+        mlKemParameterSet: this.getMlKemParameterSet()
       });
       if (recipient.batchId !== null && recipient.batchId !== void 0) {
         recipientWallet.batchId = recipient.batchId;
@@ -11822,7 +11988,8 @@ var KnishIOClient = class {
       secret: this.getSecret(),
       bundle: this.getBundle(),
       token,
-      batchId
+      batchId,
+      mlKemParameterSet: this.getMlKemParameterSet()
     });
     await mutation.fillMolecule({
       recipientWallet,
@@ -11890,7 +12057,8 @@ var KnishIOClient = class {
     const recipientWallet = new Wallet({
       secret: this.getSecret(),
       bundle: "0000000000000000000000000000000000000000000000000000000000000000",
-      token
+      token,
+      mlKemParameterSet: this.getMlKemParameterSet()
     });
     await mutation.fillMolecule({
       recipientWallet,
@@ -11967,7 +12135,8 @@ var KnishIOClient = class {
     const newWallet = new Wallet({
       secret: this.getSecret(),
       bundle: this.getBundle(),
-      token
+      token,
+      mlKemParameterSet: this.getMlKemParameterSet()
     });
     await mutation.fillMolecule(newWallet);
     const response = await this.executeQuery(mutation);
@@ -12098,15 +12267,30 @@ var KnishIOClient = class {
   async createPolicy({
     metaType,
     metaId,
-    policy = null
+    policy = {}
   }) {
     this.log("info", `KnishIOClient::createPolicy() - Creating policy for ${metaType}:${metaId}...`);
-    return this.createMeta({
+    const molecule = await this.createMolecule({});
+    molecule.addPolicyAtom({
       metaType,
       metaId,
-      meta: null,
-      policy
+      meta: {},
+      policy: policy || {}
     });
+    molecule.addContinuIdAtom();
+    molecule.sign({
+      bundle: this.getBundle()
+    });
+    molecule.check();
+    const query = await this.createMoleculeMutation({
+      mutationClass: MutationProposeMolecule,
+      molecule
+    });
+    const response = await this.executeQuery(query);
+    if (!response) {
+      throw new CodeException("Policy creation failed");
+    }
+    return response;
   }
   /**
    * Create an identifier
@@ -12280,7 +12464,8 @@ var KnishIOClient = class {
     this.setSecret(secret);
     const wallet = new Wallet({
       secret,
-      token: "AUTH"
+      token: "AUTH",
+      mlKemParameterSet: this.getMlKemParameterSet()
     });
     const molecule = await this.createMolecule({
       secret,
@@ -12680,7 +12865,7 @@ function createDefaultSecretStorage(options = {}) {
 }
 
 // src/index.ts
-var SDK_VERSION = "0.9.7";
+var SDK_VERSION = "1.0.0";
 var SDK_NAME = "KnishIO-Client-TS";
 var COMPATIBLE_SERVER_VERSIONS = [4, 5];
 var SDK_INFO = {
@@ -12689,7 +12874,7 @@ var SDK_INFO = {
   description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger",
   compatibleServerVersions: COMPATIBLE_SERVER_VERSIONS,
   features: [
-    "Post-quantum cryptography (XMSS, ML-KEM768)",
+    "Post-quantum cryptography (XMSS, ML-KEM-1024)",
     "Cross-platform compatibility",
     "Type-safe APIs",
     "DAG-based transaction processing",