@wishknish/knishio-client-ts 0.9.7 → 1.0.0

package/dist/index.iife.js

@@ -42562,8 +42562,14 @@ ${operationTypes.join("\n")}
     ...params
   });
   var ml_kem768 = /* @__PURE__ */ (() => mk(PARAMS[768]))();
+  var ml_kem1024 = /* @__PURE__ */ (() => mk(PARAMS[1024]))();
 
   // src/core/Wallet.ts
+  var ML_KEM_PARAMS = {
+    1024: { kem: ml_kem1024, pkBytes: 1568, skBytes: 3168, ctBytes: 1568 },
+    768: { kem: ml_kem768, pkBytes: 1184, skBytes: 2400, ctBytes: 1088 }
+  };
+  var DEFAULT_ML_KEM_PARAMETER_SET = 1024;
   var Wallet = class _Wallet {
     token;
     balance;
@@ -42578,6 +42584,7 @@ ${operationTypes.join("\n")}
     tokenUnits;
     tradeRates;
     molecules;
+    mlKemParameterSet;
     // Token metadata (populated from query responses)
     tokenName;
     tokenAmount;
@@ -42591,8 +42598,14 @@ ${operationTypes.join("\n")}
       address = null,
       position = null,
       batchId = null,
-      characters = null
+      characters = null,
+      mlKemParameterSet = DEFAULT_ML_KEM_PARAMETER_SET
     } = {}) {
+      const paramSetNum = Number(mlKemParameterSet);
+      if (!ML_KEM_PARAMS[paramSetNum]) {
+        throw new Error(`KnishIO: unsupported ML-KEM parameter set ${mlKemParameterSet}; expected 1024 or 768.`);
+      }
+      this.mlKemParameterSet = paramSetNum;
       this.token = token;
       this.balance = "0";
       this.molecules = {};
@@ -42628,7 +42641,8 @@ ${operationTypes.join("\n")}
       bundle = null,
       token = "USER",
       batchId = null,
-      characters = null
+      characters = null,
+      mlKemParameterSet = DEFAULT_ML_KEM_PARAMETER_SET
     }) {
       let position = null;
       if (!secret && !bundle) {
@@ -42644,7 +42658,8 @@ ${operationTypes.join("\n")}
         token,
         position,
         batchId,
-        characters
+        characters,
+        mlKemParameterSet
       });
     }
     /**
@@ -42803,20 +42818,80 @@ ${operationTypes.join("\n")}
       return (typeof this.position === "undefined" || this.position === null) && (typeof this.address === "undefined" || this.address === null);
     }
     // =============================================================================
-    // POST-QUANTUM CRYPTOGRAPHY - ML-KEM768 INTEGRATION
+    // POST-QUANTUM CRYPTOGRAPHY - ML-KEM INTEGRATION
     // =============================================================================
     /**
-     * Initializes the ML-KEM key pair (matches JavaScript SDK exactly)
+     * Derive an ML-KEM keypair for an arbitrary parameter set from the wallet's key seed,
+     * without mutating the wallet. The 64-byte `d‖z` seed takes no parameter-set input — only
+     * the final `keygen` call differs — so one KnishIO wallet owns both an ML-KEM-768 and an
+     * ML-KEM-1024 identity and either can be reconstructed on demand.
+     *
+     * Returns `null` when the wallet holds no key — a secret-less wallet, which is what a molecule
+     * deserializer builds for validation context. `generateSecret(null, …)` does NOT throw, so
+     * without this the wallet would derive a plausible-looking identity from a bogus seed and fail
+     * three layers down at AES-GCM instead of at the missing key. The guard lives here rather than
+     * at each call site so a new caller cannot miss it.
+     *
+     * @param parameterSet - 1024 or 768
      */
-    initializeMLKEM() {
+    deriveMlKemKeypair(parameterSet) {
+      const params = ML_KEM_PARAMS[parameterSet];
+      if (!params) {
+        throw new Error(`KnishIO: unsupported ML-KEM parameter set ${parameterSet}; expected 1024 or 768.`);
+      }
+      if (!this.key) {
+        return null;
+      }
       const seedHex = generateSecret(this.key, 128);
       const seed = new Uint8Array(64);
       for (let i4 = 0; i4 < 64; i4++) {
         seed[i4] = parseInt(seedHex.substr(i4 * 2, 2), 16);
       }
-      const { publicKey, secretKey } = ml_kem768.keygen(seed);
-      this.pubkey = this.serializeKey(publicKey);
-      this.privkey = secretKey;
+      const { publicKey, secretKey } = params.kem.keygen(seed);
+      return {
+        pubkey: this.serializeKey(publicKey),
+        privkey: secretKey,
+        params
+      };
+    }
+    /**
+     * ML-KEM parameter set implied by a serialized public key's raw byte length. FIPS 203's key
+     * lengths are disjoint (1568 bytes → ML-KEM-1024, 1184 bytes → ML-KEM-768), so a stored peer
+     * key recovers the parameter set of the session it belongs to without a wire-format change.
+     * Used by AuthToken.restore to resolve a snapshot that predates the field.
+     *
+     * @param pubkey - Base64-serialized ML-KEM public key
+     * @return 1024, 768, or null when the length matches neither
+     */
+    static mlKemParameterSetFromPubkey(pubkey) {
+      if (!pubkey) {
+        return null;
+      }
+      let byteLength;
+      try {
+        byteLength = typeof Buffer !== "undefined" ? Buffer.from(pubkey, "base64").length : atob(pubkey).length;
+      } catch {
+        return null;
+      }
+      if (byteLength === ML_KEM_PARAMS[1024].pkBytes) {
+        return 1024;
+      }
+      if (byteLength === ML_KEM_PARAMS[768].pkBytes) {
+        return 768;
+      }
+      return null;
+    }
+    /**
+     * Initializes the ML-KEM key pair (matches JavaScript SDK exactly). Only ever reached from the
+     * constructor's `secret` branch, so the derivation cannot come back empty here.
+     */
+    initializeMLKEM() {
+      const derived = this.deriveMlKemKeypair(this.mlKemParameterSet);
+      if (!derived) {
+        return;
+      }
+      this.pubkey = derived.pubkey;
+      this.privkey = derived.privkey;
     }
     // =============================================================================
     // HIGH-LEVEL MESSAGE ENCRYPTION (JavaScript SDK Compatibility)
@@ -42825,13 +42900,13 @@ ${operationTypes.join("\n")}
       const messageString = JSON.stringify(message);
       const messageUint8 = new TextEncoder().encode(messageString);
       const deserializedPubkey = this.deserializeKey(recipientPubkey);
-      const ML_KEM_768_PUBLIC_KEY_BYTES = 1184;
-      if (deserializedPubkey.length !== ML_KEM_768_PUBLIC_KEY_BYTES) {
+      const params = ML_KEM_PARAMS[this.mlKemParameterSet];
+      if (deserializedPubkey.length !== params.pkBytes) {
         throw new Error(
-          `KnishIO: cannot ML-KEM-encrypt \u2014 recipient public key is ${deserializedPubkey.length} bytes, expected ${ML_KEM_768_PUBLIC_KEY_BYTES} (ML-KEM-768). The node likely did not advertise an ML-KEM public key (upgrade the validator to a PQ-transport build), or authenticate with { encrypt: false }.`
+          `KnishIO: cannot ML-KEM-encrypt \u2014 recipient public key is ${deserializedPubkey.length} bytes, expected ${params.pkBytes} (ML-KEM-${this.mlKemParameterSet}). The peer is not running ML-KEM-${this.mlKemParameterSet}; upgrade the peer, or step this client back to the other parameter set.`
         );
       }
-      const { cipherText, sharedSecret } = ml_kem768.encapsulate(deserializedPubkey);
+      const { cipherText, sharedSecret } = params.kem.encapsulate(deserializedPubkey);
       const encryptedMessage = await this.encryptWithSharedSecret(messageUint8, sharedSecret);
       return {
         cipherText: this.serializeKey(cipherText),
@@ -42843,15 +42918,37 @@ ${operationTypes.join("\n")}
       return decryptedString === null ? null : JSON.parse(decryptedString);
     }
     /**
-     * ML-KEM768 decapsulate + AES-256-GCM decrypt → the RAW decrypted UTF-8 string (no JSON.parse).
+     * ML-KEM decapsulate + AES-256-GCM decrypt → the RAW decrypted UTF-8 string (no JSON.parse).
      * Shared by {@link decryptMessage} (which JSON.parses the result) and the PQ CipherHash transport
-     * ({@link decryptMyMessageML768}, which needs the raw response JSON text). PQ-transport Phase E.
+     * ({@link decryptMyMessageML}, which needs the raw response JSON text). PQ-transport Phase E.
      */
     async _mlkemDecryptToString(encryptedData) {
       const { cipherText, encryptedMessage } = encryptedData;
+      const configuredParams = ML_KEM_PARAMS[this.mlKemParameterSet];
+      const otherSet = this.mlKemParameterSet === 1024 ? 768 : 1024;
+      const deserializedCipherText = this.deserializeKey(cipherText);
+      let params = configuredParams;
+      let decapsPrivkey = this.privkey;
+      if (deserializedCipherText.length !== configuredParams.ctBytes) {
+        if (deserializedCipherText.length !== ML_KEM_PARAMS[otherSet].ctBytes) {
+          console.error(
+            `Wallet::decryptMessage() - Ciphertext length mismatch: got ${deserializedCipherText.length}, expected ${configuredParams.ctBytes}`
+          );
+          return null;
+        }
+        const derived = this.deriveMlKemKeypair(otherSet);
+        if (!derived) {
+          console.error(
+            `Wallet::decryptMessage() - cannot derive the ML-KEM-${otherSet} identity: wallet has no key`
+          );
+          return null;
+        }
+        params = derived.params;
+        decapsPrivkey = derived.privkey;
+      }
       let sharedSecret;
       try {
-        sharedSecret = ml_kem768.decapsulate(this.deserializeKey(cipherText), this.privkey);
+        sharedSecret = params.kem.decapsulate(deserializedCipherText, decapsPrivkey);
       } catch (e4) {
         console.error("Wallet::decryptMessage() - Decapsulation failed", e4);
         console.info("Wallet::decryptMessage() - my public key", this.pubkey);
@@ -42901,11 +42998,11 @@ ${operationTypes.join("\n")}
       return this.serializeKey(bytes);
     }
     /**
-     * Post-quantum (ML-KEM768) CipherHash request envelope: a stringified single-recipient map
+     * Post-quantum (ML-KEM) CipherHash request envelope: a stringified single-recipient map
      * `{ "<hashShare(recipientPubkey)>": {cipherText, encryptedMessage} }` (object-valued, via
      * {@link encryptMessage}). Matches the Rust validator's CipherHash handler. PQ-transport Phase E.
      */
-    async encryptStringML768(message, recipientPubkey) {
+    async encryptStringML(message, recipientPubkey) {
       const envelope = await this.encryptMessage(message, recipientPubkey);
       return JSON.stringify({ [this.hashShare(recipientPubkey)]: envelope });
     }
@@ -42913,9 +43010,21 @@ ${operationTypes.join("\n")}
      * Decrypt a CipherHash response map addressed to THIS wallet's ML-KEM pubkey
      * (`hashShare(this.pubkey)`) → the RAW decrypted GraphQL response JSON text (NOT JSON.parsed;
      * it replaces the HTTP response body for the normal parser). `null` if no entry / decrypt fails.
+     *
+     * A pre-bump peer addressed its envelope to `hashShare(our_768_pubkey)`, which a wallet
+     * configured at ML-KEM-1024 would never find — so the other identity's share is tried too.
+     * Without this, the permissive length dispatch in {@link _mlkemDecryptToString} is
+     * unreachable on the transport path.
      */
-    async decryptMyMessageML768(map3) {
-      const envelope = map3[this.hashShare(this.pubkey)];
+    async decryptMyMessageML(map3) {
+      let envelope = map3[this.hashShare(this.pubkey)];
+      if (!envelope) {
+        const otherSet = this.mlKemParameterSet === 1024 ? 768 : 1024;
+        const other = this.deriveMlKemKeypair(otherSet);
+        if (other) {
+          envelope = map3[this.hashShare(other.pubkey)];
+        }
+      }
       if (!envelope) {
         return null;
       }
@@ -43072,7 +43181,8 @@ ${operationTypes.join("\n")}
     serverSdkVersion: external_exports.number().int().min(1).optional(),
     logging: external_exports.boolean().optional(),
     defaultRequestPolicy: external_exports.enum(["cache-first", "cache-only", "network-only", "cache-and-network"]).nullable().optional(),
-    secretStorage: external_exports.unknown().optional()
+    secretStorage: external_exports.unknown().optional(),
+    mlKemParameterSet: external_exports.union([external_exports.literal(1024), external_exports.literal(768)]).optional()
   }).strict();
   external_exports.object({
     token: external_exports.string().min(1, "Auth token cannot be empty"),
@@ -44162,6 +44272,7 @@ ${operationTypes.join("\n")}
     continuIdPosition;
     parentHashes;
     local;
+    mlKemParameterSet = 1024;
     /**
      * Create new Molecule instance
      * Matches JavaScript SDK constructor signature
@@ -44173,7 +44284,8 @@ ${operationTypes.join("\n")}
       remainderWallet = null,
       cellSlug = null,
       version: version3 = null,
-      continuIdPosition = null
+      continuIdPosition = null,
+      mlKemParameterSet = null
     } = {}) {
       this.status = null;
       this.molecularHash = null;
@@ -44185,6 +44297,7 @@ ${operationTypes.join("\n")}
       this.continuIdPosition = continuIdPosition;
       this.atoms = [];
       this.parentHashes = [];
+      this.mlKemParameterSet = mlKemParameterSet || sourceWallet?.mlKemParameterSet || 1024;
       const versionRegistry = versions_default;
       if (version3 !== null && Object.prototype.hasOwnProperty.call(versionRegistry, version3)) {
         this.version = String(version3);
@@ -44195,7 +44308,8 @@ ${operationTypes.join("\n")}
           bundle,
           token: sourceWallet.token,
           batchId: sourceWallet.batchId,
-          characters: sourceWallet.characters
+          characters: sourceWallet.characters,
+          mlKemParameterSet: this.mlKemParameterSet
         });
       } else {
         this.remainderWallet = null;
@@ -44256,7 +44370,8 @@ ${operationTypes.join("\n")}
       if (!this.remainderWallet || this.remainderWallet.token !== "USER") {
         this.remainderWallet = Wallet.create({
           secret: this.secret,
-          bundle: this.bundle
+          bundle: this.bundle,
+          mlKemParameterSet: this.mlKemParameterSet
         });
       }
       const continuIdMeta = {};
@@ -44643,7 +44758,8 @@ ${operationTypes.join("\n")}
       }
       const burnWallet = new Wallet({
         bundle: "0000000000000000000000000000000000000000000000000000000000000000",
-        token: this.sourceWallet.token
+        token: this.sourceWallet.token,
+        mlKemParameterSet: this.mlKemParameterSet
       });
       this.addAtom(Atom.create({
         isotope: "V",
@@ -44915,7 +45031,8 @@ ${operationTypes.join("\n")}
               position: data.sourceWallet.position,
               bundle: data.sourceWallet.bundle,
               batchId: data.sourceWallet.batchId,
-              characters: data.sourceWallet.characters
+              characters: data.sourceWallet.characters,
+              mlKemParameterSet: molecule.mlKemParameterSet
             });
             molecule.sourceWallet.balance = String(data.sourceWallet.balance != null ? data.sourceWallet.balance : 0);
             molecule.sourceWallet.address = data.sourceWallet.address;
@@ -44933,7 +45050,8 @@ ${operationTypes.join("\n")}
               position: data.remainderWallet.position,
               bundle: data.remainderWallet.bundle,
               batchId: data.remainderWallet.batchId,
-              characters: data.remainderWallet.characters
+              characters: data.remainderWallet.characters,
+              mlKemParameterSet: molecule.mlKemParameterSet
             });
             molecule.remainderWallet.balance = String(data.remainderWallet.balance != null ? data.remainderWallet.balance : 0);
             molecule.remainderWallet.address = data.remainderWallet.address;
@@ -45031,7 +45149,8 @@ ${operationTypes.join("\n")}
         secret: this.secret,
         bundle: this.bundle,
         token: this.sourceWallet.token,
-        batchId: this.sourceWallet.batchId
+        batchId: this.sourceWallet.batchId,
+        mlKemParameterSet: this.mlKemParameterSet
       });
       if (tradeRates) {
         bufferWallet.tradeRates = tradeRates;
@@ -47728,7 +47847,7 @@ ${operationTypes.join("\n")}
       let encryptedRequest = false;
       let requestInit = init;
       if (wallet && serverPubkey && init && typeof init.body === "string" && this.shouldEncrypt(init.body)) {
-        const hashVar = await wallet.encryptStringML768(init.body, serverPubkey);
+        const hashVar = await wallet.encryptStringML(init.body, serverPubkey);
         requestInit = { ...init, body: JSON.stringify({ query: CIPHER_HASH_QUERY, variables: { Hash: hashVar } }) };
         encryptedRequest = true;
       }
@@ -47748,7 +47867,7 @@ ${operationTypes.join("\n")}
       if (typeof hash2 !== "string") {
         return new Response(text, init2);
       }
-      const decrypted = await wallet.decryptMyMessageML768(JSON.parse(hash2));
+      const decrypted = await wallet.decryptMyMessageML(JSON.parse(hash2));
       return new Response(decrypted != null ? decrypted : text, init2);
     }
     setAuthData({
@@ -47917,6 +48036,22 @@ ${operationTypes.join("\n")}
       authToken.setWallet(wallet);
       return authToken;
     }
+    /**
+     * ML-KEM parameter set a restored session must use, resolved in three tiers:
+     * an explicit snapshot field, then the stored validator key's length, then ML-KEM-768.
+     *
+     * The final tier is deliberately NOT the constructor default. A snapshot with neither an
+     * explicit field nor a recognisable key can only have come from a pre-bump build, and every
+     * pre-bump build was 768-only — defaulting to 1024 would make the restored wallet advertise
+     * a public key the validator never recorded for that token.
+     */
+    static resolveMlKemParameterSet(snapshot) {
+      const explicit = snapshot.wallet?.mlKemParameterSet;
+      if (explicit) {
+        return Number(explicit) === 768 ? 768 : 1024;
+      }
+      return Wallet.mlKemParameterSetFromPubkey(snapshot.pubkey) ?? 768;
+    }
     /**
      * Restore AuthToken from snapshot
      */
@@ -47924,8 +48059,9 @@ ${operationTypes.join("\n")}
       const wallet = new Wallet({
         secret,
         token: "AUTH",
-        position: snapshot.wallet.position,
-        characters: snapshot.wallet.characters
+        position: snapshot.wallet?.position ?? null,
+        characters: snapshot.wallet?.characters ?? null,
+        mlKemParameterSet: _AuthToken.resolveMlKemParameterSet(snapshot)
       });
       return _AuthToken.create({
         token: snapshot.token,
@@ -47993,7 +48129,9 @@ ${operationTypes.join("\n")}
       };
     }
     /**
-     * Create snapshot for persistence
+     * Create snapshot for persistence. The wallet's ML-KEM parameter set is recorded beside its
+     * position and characters so a stepped-back ML-KEM-768 session restores as 768 rather than
+     * silently taking the constructor default.
      */
     toSnapshot() {
       return {
@@ -48004,7 +48142,8 @@ ${operationTypes.join("\n")}
         ...this.$__wallet ? {
           wallet: {
             position: this.$__wallet.position,
-            characters: this.$__wallet.characters
+            characters: this.$__wallet.characters,
+            mlKemParameterSet: this.$__wallet.mlKemParameterSet
           }
         } : {}
       };
@@ -48304,7 +48443,8 @@ ${operationTypes.join("\n")}
     // isn't rejected.
     defaultRequestPolicy: external_exports.enum(["cache-first", "cache-only", "network-only", "cache-and-network"]).nullable().optional(),
     // Pluggable hardware envelope encryption secret storage provider
-    secretStorage: external_exports.unknown().optional()
+    secretStorage: external_exports.unknown().optional(),
+    mlKemParameterSet: external_exports.union([external_exports.literal(1024), external_exports.literal(768)]).optional()
   }).strict();
   var EnvironmentConfigSchema = external_exports.object({
     NODE_ENV: external_exports.enum(["development", "production", "test"]).optional(),
@@ -50902,6 +51042,13 @@ ${operationTypes.join("\n")}
     molecule() {
       return this.$__molecule.toJSON ? this.$__molecule.toJSON() : this.$__molecule;
     }
+    /**
+     * Fills the molecule with specific mutation data.
+     * Subclasses override to build domain-specific atoms.
+     * Default implementation is a no-op for pre-assembled molecules.
+     */
+    fillMolecule(_params) {
+    }
   };
 
   // src/response/ResponseCreateToken.ts
@@ -52021,6 +52168,7 @@ ${operationTypes.join("\n")}
     $__authTokenObjects = {};
     $__authToken = null;
     $__authInProcess = false;
+    $__mlKemParameterSet = 1024;
     $__remainderWallet = null;
     lastMoleculeQuery = null;
     abortControllers = /* @__PURE__ */ new Map();
@@ -52065,7 +52213,8 @@ ${operationTypes.join("\n")}
         client,
         serverSdkVersion,
         logging,
-        defaultRequestPolicy
+        defaultRequestPolicy,
+        mlKemParameterSet: config2.mlKemParameterSet ?? 1024
       });
       if (config2.secretStorage) {
         this.$__secretStorage = config2.secretStorage;
@@ -52081,10 +52230,12 @@ ${operationTypes.join("\n")}
       client = null,
       serverSdkVersion = 3,
       logging = false,
-      defaultRequestPolicy = null
+      defaultRequestPolicy = null,
+      mlKemParameterSet = 1024
     }) {
       this.reset();
       this.$__logging = logging;
+      this.setMlKemParameterSet(mlKemParameterSet);
       this.$__authTokenObjects = {};
       this.setUri(uri);
       if (cellSlug) {
@@ -52105,6 +52256,17 @@ ${operationTypes.join("\n")}
       this.$__serverSdkVersion = serverSdkVersion;
       this.$__defaultRequestPolicy = defaultRequestPolicy;
     }
+    getMlKemParameterSet() {
+      return this.$__mlKemParameterSet || 1024;
+    }
+    setMlKemParameterSet(parameterSet) {
+      const paramNum = Number(parameterSet);
+      if (![1024, 768].includes(paramNum)) {
+        throw new Error(`KnishIO: unsupported ML-KEM parameter set ${parameterSet}; expected 1024 or 768.`);
+      }
+      this.$__mlKemParameterSet = paramNum;
+      return this;
+    }
     /**
      * Get random uri from specified this.$__uris
      */
@@ -52341,7 +52503,8 @@ ${operationTypes.join("\n")}
         bundle,
         token: "USER",
         batchId: sourceWallet.batchId,
-        characters: sourceWallet.characters
+        characters: sourceWallet.characters,
+        mlKemParameterSet: this.getMlKemParameterSet()
       }));
       return new Molecule({
         secret,
@@ -52350,7 +52513,8 @@ ${operationTypes.join("\n")}
         remainderWallet: this.getRemainderWallet(),
         cellSlug: this.getCellSlug(),
         version: this.getServerSdkVersion(),
-        continuIdPosition
+        continuIdPosition,
+        mlKemParameterSet: this.getMlKemParameterSet()
       });
     }
     /**
@@ -52462,7 +52626,8 @@ ${operationTypes.join("\n")}
       }))?.payload();
       if (!sourceWallet) {
         sourceWallet = new Wallet({
-          secret: this.getSecret()
+          secret: this.getSecret(),
+          mlKemParameterSet: this.getMlKemParameterSet()
         });
       } else {
         sourceWallet.key = Wallet.generateKey({
@@ -52505,7 +52670,8 @@ ${operationTypes.join("\n")}
       }
       const recipientWallet = Wallet.create({
         bundle: bundleHash,
-        token
+        token,
+        mlKemParameterSet: this.getMlKemParameterSet()
       });
       if (batchId !== null) {
         recipientWallet.batchId = batchId;
@@ -52572,7 +52738,8 @@ ${operationTypes.join("\n")}
       const recipientWallets = recipients.map((recipient) => {
         const recipientWallet = Wallet.create({
           bundle: recipient.bundleHash,
-          token
+          token,
+          mlKemParameterSet: this.getMlKemParameterSet()
         });
         if (recipient.batchId !== null && recipient.batchId !== void 0) {
           recipientWallet.batchId = recipient.batchId;
@@ -53196,7 +53363,8 @@ ${operationTypes.join("\n")}
         secret: this.getSecret(),
         bundle: this.getBundle(),
         token,
-        batchId
+        batchId,
+        mlKemParameterSet: this.getMlKemParameterSet()
       });
       await mutation.fillMolecule({
         recipientWallet,
@@ -53264,7 +53432,8 @@ ${operationTypes.join("\n")}
       const recipientWallet = new Wallet({
         secret: this.getSecret(),
         bundle: "0000000000000000000000000000000000000000000000000000000000000000",
-        token
+        token,
+        mlKemParameterSet: this.getMlKemParameterSet()
       });
       await mutation.fillMolecule({
         recipientWallet,
@@ -53341,7 +53510,8 @@ ${operationTypes.join("\n")}
       const newWallet = new Wallet({
         secret: this.getSecret(),
         bundle: this.getBundle(),
-        token
+        token,
+        mlKemParameterSet: this.getMlKemParameterSet()
       });
       await mutation.fillMolecule(newWallet);
       const response = await this.executeQuery(mutation);
@@ -53472,15 +53642,30 @@ ${operationTypes.join("\n")}
     async createPolicy({
       metaType,
       metaId,
-      policy = null
+      policy = {}
     }) {
       this.log("info", `KnishIOClient::createPolicy() - Creating policy for ${metaType}:${metaId}...`);
-      return this.createMeta({
+      const molecule = await this.createMolecule({});
+      molecule.addPolicyAtom({
         metaType,
         metaId,
-        meta: null,
-        policy
+        meta: {},
+        policy: policy || {}
       });
+      molecule.addContinuIdAtom();
+      molecule.sign({
+        bundle: this.getBundle()
+      });
+      molecule.check();
+      const query = await this.createMoleculeMutation({
+        mutationClass: MutationProposeMolecule,
+        molecule
+      });
+      const response = await this.executeQuery(query);
+      if (!response) {
+        throw new CodeException("Policy creation failed");
+      }
+      return response;
     }
     /**
      * Create an identifier
@@ -53654,7 +53839,8 @@ ${operationTypes.join("\n")}
       this.setSecret(secret);
       const wallet = new Wallet({
         secret,
-        token: "AUTH"
+        token: "AUTH",
+        mlKemParameterSet: this.getMlKemParameterSet()
       });
       const molecule = await this.createMolecule({
         secret,
@@ -54054,7 +54240,7 @@ ${operationTypes.join("\n")}
   }
 
   // src/index.ts
-  var SDK_VERSION = "0.9.7";
+  var SDK_VERSION = "1.0.0";
   var SDK_NAME = "KnishIO-Client-TS";
   var COMPATIBLE_SERVER_VERSIONS = [4, 5];
   var SDK_INFO = {
@@ -54063,7 +54249,7 @@ ${operationTypes.join("\n")}
     description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger",
     compatibleServerVersions: COMPATIBLE_SERVER_VERSIONS,
     features: [
-      "Post-quantum cryptography (XMSS, ML-KEM768)",
+      "Post-quantum cryptography (XMSS, ML-KEM-1024)",
       "Cross-platform compatibility",
       "Type-safe APIs",
       "DAG-based transaction processing",