subtlepq 0.1.1 → 0.2.0

package/README.md

@@ -1,8 +1,13 @@
-# pqfill
+# subtlepq
 
 Post-quantum polyfill for the Web Cryptography API: ML-KEM (FIPS 203) and ML-DSA (FIPS 204) per the [WICG Modern Algorithms draft](https://wicg.github.io/webcrypto-modern-algos/), with native delegation where the platform already supports it.
 
-**Status: P1 — engine + core JS layer.** Raw key formats only (`raw-public`, `raw-seed`); spki/pkcs8/jwk, wrapKey, and DHKEM are on the way.
+**Status: P2 — engine, core JS layer, all key formats, key wrapping.** DHKEM is on the way.
+
+Key formats: `raw-public`, `raw-seed`, `spki`, `pkcs8` (seed-only encoding per the LAMPS
+drafts; the `both` CHOICE is accepted on import and cross-checked), and `jwk` (kty `"AKP"`,
+`pub`/`priv` with `priv` = seed). `wrapKey`/`unwrapKey` compose export/import with the native
+wrapping algorithm, so AES-GCM, AES-KW, and RSA-OAEP wrapping of ML-* keys just work.
 
 ## Use
 
@@ -31,7 +36,7 @@ Known limits (inherent to a script polyfill, made loud rather than silent): ML-*
 
 ## Engine
 
-`wasm/` builds a minimal [liboqs](https://github.com/open-quantum-safe/liboqs) (pinned submodule, ML-KEM + ML-DSA only) plus a thin shim (`pqfill_engine.c`) to WebAssembly:
+`wasm/` builds a minimal [liboqs](https://github.com/open-quantum-safe/liboqs) (pinned submodule, ML-KEM + ML-DSA only) plus a thin shim (`subtlepq_engine.c`) to WebAssembly:
 
 ```
 git submodule update --init
@@ -39,7 +44,7 @@ wasm/build.sh          # needs emsdk; override location with EMSDK=...
 npm test
 ```
 
-Outputs `wasm/dist/pqfill-engine.mjs` (+ `.wasm` sidecar, CSP-clean) and `pqfill-engine.single.mjs` (self-contained, requires `'wasm-unsafe-eval'` under strict CSP). 75 KB wasm covers all six parameter sets.
+Outputs `wasm/dist/subtlepq-engine.mjs` (+ `.wasm` sidecar, CSP-clean) and `subtlepq-engine.single.mjs` (self-contained, requires `'wasm-unsafe-eval'` under strict CSP). 75 KB wasm covers all six parameter sets.
 
 Seeded operations liboqs does not expose publicly (ML-DSA keygen from seed, KAT-deterministic encapsulation/signing) use a bracketed RNG-playback override — the same technique liboqs' own ACVP tests use.
 

package/package.json

@@ -1,25 +1,35 @@
 {
     "name": "subtlepq",
-    "version": "0.1.1",
+    "version": "0.2.0",
     "description": "Post-quantum polyfill for the Web Cryptography API: ML-KEM (FIPS 203) and ML-DSA (FIPS 204) per the WICG Modern Algorithms draft, with native delegation",
     "type": "module",
     "license": "Apache-2.0",
     "author": "VESvault Corp",
     "repository": {
         "type": "git",
-        "url": "git+https://github.com/vesvault/pqfill.git"
+        "url": "git+https://github.com/vesvault/subtlepq.git"
     },
-    "homepage": "https://github.com/vesvault/pqfill#readme",
+    "homepage": "https://github.com/vesvault/subtlepq#readme",
     "bugs": {
-        "url": "https://github.com/vesvault/pqfill/issues"
+        "url": "https://github.com/vesvault/subtlepq/issues"
     },
     "engines": {
         "node": ">=18"
     },
     "sideEffects": false,
     "files": [
-        "src",
-        "wasm/dist"
+        "src/algorithms.js",
+        "src/engine.js",
+        "src/errors.js",
+        "src/formats.js",
+        "src/index.js",
+        "src/install.js",
+        "src/keystore.js",
+        "src/router.js",
+        "src/subtle.js",
+        "wasm/dist/subtlepq-engine.mjs",
+        "wasm/dist/subtlepq-engine.single.mjs",
+        "wasm/dist/subtlepq-engine.wasm"
     ],
     "exports": {
         ".": "./src/index.js",
@@ -27,20 +37,12 @@
     },
     "scripts": {
         "build": "wasm/build.sh",
+        "prepack": "node -e \"const p=require('./package.json'),fs=require('fs');for(const f of p.files)if(!fs.existsSync(f))throw new Error(f+' missing - run wasm/build.sh before packing')\"",
         "test": "node test/engine-test.mjs && node test/polyfill-test.mjs"
     },
     "keywords": [
-        "ml-kem",
-        "ml-dsa",
-        "webcrypto",
-        "polyfill",
-        "post-quantum",
-        "fips203",
-        "fips204",
-        "kyber",
-        "dilithium",
-        "subtlecrypto",
-        "encapsulation",
-        "kem"
+        "ml-kem", "ml-dsa", "webcrypto", "polyfill", "post-quantum",
+        "fips203", "fips204", "kyber", "dilithium", "subtlecrypto",
+        "encapsulation", "kem"
     ]
-}
+}

package/src/algorithms.js

@@ -1,5 +1,5 @@
 /***************************************************************************
- * pqfill: algorithm registry and AlgorithmIdentifier normalization
+ * subtlepq: algorithm registry and AlgorithmIdentifier normalization
  *
  * (c) 2026 VESvault Corp
  * SPDX-License-Identifier: Apache-2.0

package/src/engine.js

@@ -1,5 +1,5 @@
 /***************************************************************************
- * pqfill: lazy wasm engine loader + typed wrappers over pqfill_engine.c
+ * subtlepq: lazy wasm engine loader + typed wrappers over subtlepq_engine.c
  *
  * (c) 2026 VESvault Corp
  * SPDX-License-Identifier: Apache-2.0
@@ -18,7 +18,7 @@ export function getEngine() {
 }
 
 async function load() {
-    const { default: init } = await import("../wasm/dist/pqfill-engine.mjs");
+    const { default: init } = await import("../wasm/dist/subtlepq-engine.mjs");
     return new Engine(await init());
 }
 

package/src/errors.js

@@ -1,5 +1,5 @@
 /***************************************************************************
- * pqfill: DOMException helpers with WebCrypto-mandated error names
+ * subtlepq: DOMException helpers with WebCrypto-mandated error names
  *
  * (c) 2026 VESvault Corp
  * SPDX-License-Identifier: Apache-2.0

package/src/formats.js

@@ -0,0 +1,174 @@
+/***************************************************************************
+ * subtlepq: spki / pkcs8 / jwk codecs (fixed ASN.1 templates)
+ *
+ * (c) 2026 VESvault Corp
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * DER shapes per draft-ietf-lamps-kyber/dilithium-certificates as adopted
+ * by the WICG draft: SPKI AlgorithmIdentifier has NO parameters; PKCS#8
+ * privateKey is the seed-only CHOICE, an implicit [0] primitive holding
+ * the seed. Import also accepts the "both" CHOICE (seed + expandedKey,
+ * verified against each other); expandedKey-only is NotSupportedError.
+ ***************************************************************************/
+
+import * as E from "./errors.js";
+
+/* NIST algorithm arc: 2.16.840.1.101.3.4.{4=kem,3=sig}.n */
+const OIDS = {
+    "ML-KEM-512":  [0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x04, 0x01],
+    "ML-KEM-768":  [0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x04, 0x02],
+    "ML-KEM-1024": [0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x04, 0x03],
+    "ML-DSA-44":   [0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x03, 0x11],
+    "ML-DSA-65":   [0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x03, 0x12],
+    "ML-DSA-87":   [0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x03, 0x13],
+};
+
+function oidToName(body) {
+    for (const [name, oid] of Object.entries(OIDS)) {
+        if (oid.length === body.length && oid.every((b, i) => b === body[i])) return name;
+    }
+    return null;
+}
+
+/* ---- DER write ---- */
+
+function tlv(tag, ...parts) {
+    const len = parts.reduce((n, p) => n + p.length, 0);
+    const hdr = [tag];
+    if (len < 0x80) {
+        hdr.push(len);
+    } else {
+        const b = [];
+        for (let n = len; n; n >>>= 8) b.unshift(n & 0xff);
+        hdr.push(0x80 | b.length, ...b);
+    }
+    const out = new Uint8Array(hdr.length + len);
+    out.set(hdr);
+    let p = hdr.length;
+    for (const part of parts) { out.set(part, p); p += part.length; }
+    return out;
+}
+
+function algorithmIdentifier(name) {
+    return tlv(0x30, tlv(0x06, OIDS[name]));
+}
+
+/* ---- DER read ---- */
+
+class Reader {
+    constructor(u8, what) { this.u8 = u8; this.p = 0; this.what = what; }
+    bad(m) { return E.dataError("malformed " + this.what + ": " + m); }
+    tlv() {
+        if (this.p + 2 > this.u8.length) throw this.bad("truncated");
+        const tag = this.u8[this.p++];
+        let len = this.u8[this.p++];
+        if (len & 0x80) {
+            const n = len & 0x7f;
+            if (n < 1 || n > 4) throw this.bad("bad length encoding");
+            len = 0;
+            for (let i = 0; i < n; i++) {
+                if (this.p >= this.u8.length) throw this.bad("truncated");
+                len = len * 256 + this.u8[this.p++];
+            }
+        }
+        if (this.p + len > this.u8.length) throw this.bad("truncated");
+        const val = this.u8.subarray(this.p, this.p + len);
+        this.p += len;
+        return { tag, val };
+    }
+    expect(tag, m) {
+        const t = this.tlv();
+        if (t.tag !== tag) throw this.bad("expected " + m);
+        return t.val;
+    }
+    get done() { return this.p >= this.u8.length; }
+}
+
+function readAlgorithm(r, what) {
+    const seq = new Reader(r.expect(0x30, "AlgorithmIdentifier"), what);
+    const name = oidToName(seq.expect(0x06, "algorithm OID"));
+    if (!name) throw E.dataError(what + " algorithm OID is not an ML-KEM/ML-DSA algorithm");
+    if (!seq.done) throw E.dataError(what + " AlgorithmIdentifier parameters must be absent");
+    return name;
+}
+
+/* ---- SubjectPublicKeyInfo ---- */
+
+export function encodeSpki(name, pub) {
+    const bits = new Uint8Array(pub.length + 1);
+    bits.set(pub, 1);
+    return tlv(0x30, algorithmIdentifier(name), tlv(0x03, bits));
+}
+
+export function decodeSpki(bytes) {
+    const outer = new Reader(bytes, "SPKI");
+    const r = new Reader(outer.expect(0x30, "SubjectPublicKeyInfo"), "SPKI");
+    if (!outer.done) throw outer.bad("trailing bytes");
+    const name = readAlgorithm(r, "SPKI");
+    const bits = r.expect(0x03, "subjectPublicKey BIT STRING");
+    if (!r.done) throw r.bad("trailing bytes");
+    if (bits.length < 1 || bits[0] !== 0) throw r.bad("subjectPublicKey unused bits");
+    return { name, pub: bits.slice(1) };
+}
+
+/* ---- PrivateKeyInfo (seed-only CHOICE) ---- */
+
+export function encodePkcs8(name, seed) {
+    return tlv(0x30,
+        tlv(0x02, [0]),
+        algorithmIdentifier(name),
+        tlv(0x04, tlv(0x80, seed)));
+}
+
+/* Returns { name, seed, expanded? }; expanded (from the "both" CHOICE) is
+ * the caller's to verify against the seed-derived key. */
+export function decodePkcs8(bytes) {
+    const outer = new Reader(bytes, "PKCS#8");
+    const r = new Reader(outer.expect(0x30, "PrivateKeyInfo"), "PKCS#8");
+    if (!outer.done) throw outer.bad("trailing bytes");
+    const ver = r.expect(0x02, "version INTEGER");
+    if (ver.length !== 1 || ver[0] > 1) throw r.bad("unsupported version");
+    const name = readAlgorithm(r, "PKCS#8");
+    const inner = new Reader(r.expect(0x04, "privateKey OCTET STRING"), "PKCS#8");
+    /* anything after privateKey (attributes, [1] publicKey) is ignored */
+    const t = inner.tlv();
+    if (t.tag === 0x80) {                             /* seed [0] */
+        if (!inner.done) throw inner.bad("trailing bytes after seed");
+        return { name, seed: t.val.slice() };
+    }
+    if (t.tag === 0x04) {                             /* expandedKey */
+        throw E.notSupported(
+            "expandedKey-only ML private keys are not supported; provide the seed");
+    }
+    if (t.tag === 0x30) {                             /* both */
+        const b = new Reader(t.val, "PKCS#8");
+        const seed = b.expect(0x04, "seed OCTET STRING");
+        const expanded = b.expect(0x04, "expandedKey OCTET STRING");
+        if (!b.done || !inner.done) throw b.bad("trailing bytes");
+        return { name, seed: seed.slice(), expanded: expanded.slice() };
+    }
+    throw inner.bad("unrecognized private key CHOICE");
+}
+
+/* ---- JWK base64url ---- */
+
+export function b64u(bytes) {
+    let s = "";
+    for (const b of bytes) s += String.fromCharCode(b);
+    return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+export function unb64u(s, what) {
+    if (typeof s !== "string" || /[^A-Za-z0-9_-]/.test(s)) {
+        throw E.dataError("JWK " + what + " is not base64url");
+    }
+    let bin;
+    try {
+        bin = atob(s.replace(/-/g, "+").replace(/_/g, "/"));
+    } catch {
+        throw E.dataError("JWK " + what + " is not base64url");
+    }
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+    return out;
+}

package/src/index.js

@@ -1,5 +1,5 @@
 /***************************************************************************
- * pqfill: post-quantum polyfill for the Web Cryptography API
+ * subtlepq: post-quantum polyfill for the Web Cryptography API
  * ML-KEM (FIPS 203) + ML-DSA (FIPS 204) per the WICG Modern Algorithms
  * draft, with native delegation.
  *
@@ -12,7 +12,7 @@
  ***************************************************************************/
 
 import * as ours from "./subtle.js";
-import { ROUTES } from "./router.js";
+import { ROUTES, shape } from "./router.js";
 import * as E from "./errors.js";
 
 export { install, uninstall } from "./install.js";
@@ -21,13 +21,12 @@ export { supports } from "./subtle.js";
 const routedFns = {};
 function routed(op) {
     if (!routedFns[op]) {
-        routedFns[op] = function (...args) {
+        routedFns[op] = shape(op, (args) => {
             if (ROUTES[op](args)) return ours[op](...args);
             const ns = globalThis.crypto && globalThis.crypto.subtle;
             if (ns && typeof ns[op] === "function") return ns[op](...args);
-            return Promise.reject(E.notSupported(op + " is not supported"));
-        };
-        Object.defineProperty(routedFns[op], "name", { value: op });
+            throw E.notSupported(op + " is not supported");
+        });
     }
     return routedFns[op];
 }

package/src/install.js

@@ -1,18 +1,18 @@
 /***************************************************************************
- * pqfill: true-polyfill installer -- patches globalThis.crypto.subtle
+ * subtlepq: true-polyfill installer -- patches globalThis.crypto.subtle
  *
  * (c) 2026 VESvault Corp
  * SPDX-License-Identifier: Apache-2.0
  *
  * install() wraps SubtleCrypto.prototype methods so ML-* algorithms and
- * pqfill keys are handled here while every other call reaches the saved
+ * subtlepq keys are handled here while every other call reaches the saved
  * native original with untouched arguments. Methods and algorithms the
  * platform already supports natively are left alone (self-retiring).
  * uninstall() restores the originals.
  ***************************************************************************/
 
 import * as ours from "./subtle.js";
-import { ROUTES } from "./router.js";
+import { ROUTES, shape } from "./router.js";
 import * as E from "./errors.js";
 
 let saved = null;
@@ -30,7 +30,7 @@ export function install() {
     if (saved) return;
     const subtle = globalThis.crypto && globalThis.crypto.subtle;
     if (!subtle) {
-        throw new Error("pqfill: crypto.subtle is unavailable (insecure context?)");
+        throw new Error("subtlepq: crypto.subtle is unavailable (insecure context?)");
     }
     const proto = Object.getPrototypeOf(subtle);
     const ctor = subtle.constructor;
@@ -45,12 +45,11 @@ export function install() {
     for (const [op, isOurs] of Object.entries(ROUTES)) {
         const orig = proto[op];
         saved.methods[op] = Object.getOwnPropertyDescriptor(proto, op);
-        const wrapped = async function (...args) {
+        const wrapped = shape(op, (args, self) => {
             if (isOurs(args)) return ours[op](...args);
-            if (typeof orig === "function") return orig.apply(this, args);
+            if (typeof orig === "function") return orig.apply(self, args);
             throw E.notSupported(op + " is not supported");
-        };
-        Object.defineProperty(wrapped, "name", { value: op });
+        });
         Object.defineProperty(proto, op, {
             value: wrapped, writable: true, configurable: true,
         });

package/src/keystore.js

@@ -1,5 +1,5 @@
 /***************************************************************************
- * pqfill: forged CryptoKey factory + private key-material store
+ * subtlepq: forged CryptoKey factory + private key-material store
  *
  * (c) 2026 VESvault Corp
  * SPDX-License-Identifier: Apache-2.0
@@ -29,8 +29,8 @@ export function forgeKey(type, algName, extractable, usages, material) {
         extractable: { value: !!extractable, enumerable: true },
         algorithm: { value: Object.freeze({ name: algName }), enumerable: true },
         usages: { value: Object.freeze([...usages]), enumerable: true },
-        __pqfill: {
-            value: Symbol("pqfill key: not structured-cloneable; export and re-import instead"),
+        __subtlepq: {
+            value: Symbol("subtlepq key: not structured-cloneable; export and re-import instead"),
             enumerable: true,
         },
     });

package/src/router.js

@@ -1,5 +1,5 @@
 /***************************************************************************
- * pqfill: dispatch rules shared by the ponyfill (index.js) and the
+ * subtlepq: dispatch rules shared by the ponyfill (index.js) and the
  * polyfill installer (install.js)
  *
  * (c) 2026 VESvault Corp
@@ -15,7 +15,7 @@ import { isOurKey } from "./keystore.js";
 
 const ours = (alg) => !!normalizeAlg(alg);
 
-/* args => should pqfill handle this call? -- keyed by SubtleCrypto method */
+/* args => should subtlepq handle this call? -- keyed by SubtleCrypto method */
 export const ROUTES = {
     /* wrapped existing methods */
     generateKey: (args) => ours(args[0]),
@@ -23,6 +23,10 @@ export const ROUTES = {
     exportKey: (args) => isOurKey(args[1]),
     sign: (args) => isOurKey(args[1]) || ours(args[0]),
     verify: (args) => isOurKey(args[1]) || ours(args[0]),
+    /* wrap/unwrap: ours when the wrapped key or either key handle is ours;
+     * (format, key, wrappingKey, ...) / (format, data, unwrappingKey, wrapAlg, keyAlg, ...) */
+    wrapKey: (args) => isOurKey(args[1]) || isOurKey(args[2]),
+    unwrapKey: (args) => ours(args[4]) || isOurKey(args[2]),
     /* methods added by the WICG draft */
     encapsulateBits: (args) => ours(args[0]) || isOurKey(args[1]),
     encapsulateKey: (args) => ours(args[0]) || isOurKey(args[1]),
@@ -30,3 +34,40 @@ export const ROUTES = {
     decapsulateKey: (args) => ours(args[0]) || isOurKey(args[1]),
     getPublicKey: (args) => isOurKey(args[0]),
 };
+
+/* Wrapper factories carrying the spec parameter lists, so consoles show real
+ * argument hints (and fn.length matches native) instead of (...args). Written
+ * out statically -- Function() codegen would break under strict CSP. Each
+ * forwards (arguments, this) to the routing handler; the async wrapper turns
+ * sync throws into rejections, as native SubtleCrypto does. */
+export const shape = (op, h) => SHAPES[op](h);
+
+const SHAPES = {
+    generateKey: (h) => async function generateKey(
+        algorithm, extractable, keyUsages) { return h(arguments, this); },
+    importKey: (h) => async function importKey(
+        format, keyData, algorithm, extractable, keyUsages) { return h(arguments, this); },
+    exportKey: (h) => async function exportKey(
+        format, key) { return h(arguments, this); },
+    sign: (h) => async function sign(
+        algorithm, key, data) { return h(arguments, this); },
+    verify: (h) => async function verify(
+        algorithm, key, signature, data) { return h(arguments, this); },
+    encapsulateBits: (h) => async function encapsulateBits(
+        algorithm, encapsulationKey) { return h(arguments, this); },
+    encapsulateKey: (h) => async function encapsulateKey(
+        algorithm, encapsulationKey, sharedKeyAlgorithm, extractable, keyUsages) {
+        return h(arguments, this); },
+    decapsulateBits: (h) => async function decapsulateBits(
+        algorithm, decapsulationKey, ciphertext) { return h(arguments, this); },
+    decapsulateKey: (h) => async function decapsulateKey(
+        algorithm, decapsulationKey, ciphertext, sharedKeyAlgorithm, extractable, keyUsages) {
+        return h(arguments, this); },
+    getPublicKey: (h) => async function getPublicKey(
+        key, keyUsages) { return h(arguments, this); },
+    wrapKey: (h) => async function wrapKey(
+        format, key, wrappingKey, wrapAlgorithm) { return h(arguments, this); },
+    unwrapKey: (h) => async function unwrapKey(
+        format, wrappedKey, unwrappingKey, unwrapAlgorithm, unwrappedKeyAlgorithm,
+        extractable, keyUsages) { return h(arguments, this); },
+};

package/src/subtle.js

@@ -1,5 +1,5 @@
 /***************************************************************************
- * pqfill: spec-shaped ML-KEM / ML-DSA operations
+ * subtlepq: spec-shaped ML-KEM / ML-DSA operations
  * per https://wicg.github.io/webcrypto-modern-algos/
  *
  * (c) 2026 VESvault Corp
@@ -17,6 +17,9 @@ import {
     normalizeAlg, KEM_PUB_USAGES, KEM_PRIV_USAGES,
 } from "./algorithms.js";
 import { forgeKey, materialOf, isOurKey } from "./keystore.js";
+import {
+    encodeSpki, decodeSpki, encodePkcs8, decodePkcs8, b64u, unb64u,
+} from "./formats.js";
 import * as E from "./errors.js";
 
 const rng = (n) => globalThis.crypto.getRandomValues(new Uint8Array(n));
@@ -113,39 +116,110 @@ export async function importKey(format, keyData, algorithm, extractable, keyUsag
     const pubUsages = a.kind === "kem" ? KEM_PUB_USAGES : ["verify"];
     const privUsages = a.kind === "kem" ? KEM_PRIV_USAGES : ["sign"];
 
-    if (format === "raw-public") {
+    const importPub = (pub) => {
         checkUsages(keyUsages, pubUsages);
-        const pub = toBytes(keyData, "keyData");
         if (pub.length !== L.pk) throw E.dataError("bad " + a.name + " public key length");
         return forgeKey("public", a.name, extractable, keyUsages, { pub });
-    }
-    if (format === "raw-seed") {
+    };
+    /* expanded (pkcs8 "both" / jwk pub): must agree with the seed-derived value */
+    const importSeed = (seed, expanded, expect) => {
         checkUsages(keyUsages, privUsages);
         if (!keyUsages.length) throw E.syntaxError("private key usages must not be empty");
-        const seed = toBytes(keyData, "keyData");
         if (seed.length !== L.seed) throw E.dataError("bad " + a.name + " seed length");
         const { pub, sk } = a.kind === "kem"
             ? eng.kemKeypairDerand(a.name, seed)
             : eng.sigKeypairDerand(a.name, seed);
+        if (expanded && !bytesEqual(expanded, expect === "pub" ? pub : sk)) {
+            throw E.dataError(a.name + " seed and " +
+                (expect === "pub" ? "public key" : "expandedKey") + " do not match");
+        }
         return forgeKey("private", a.name, extractable, keyUsages, { pub, seed, sk });
+    };
+
+    if (format === "raw-public") return importPub(toBytes(keyData, "keyData"));
+    if (format === "raw-seed") return importSeed(toBytes(keyData, "keyData"));
+    if (format === "spki") {
+        const { name, pub } = decodeSpki(toBytes(keyData, "keyData"));
+        if (name !== a.name) throw E.dataError("SPKI algorithm is " + name + ", not " + a.name);
+        return importPub(pub);
+    }
+    if (format === "pkcs8") {
+        const { name, seed, expanded } = decodePkcs8(toBytes(keyData, "keyData"));
+        if (name !== a.name) throw E.dataError("PKCS#8 algorithm is " + name + ", not " + a.name);
+        return importSeed(seed, expanded, "sk");
     }
-    /* spki / pkcs8 / jwk land in P2 */
-    throw E.notSupported("key format " + format + " is not supported yet");
+    if (format === "jwk") return importJwk(keyData, a, extractable, importPub, importSeed);
+    throw E.notSupported("key format " + format + " is not supported");
+}
+
+function bytesEqual(x, y) {
+    if (x.length !== y.length) return false;
+    let d = 0;
+    for (let i = 0; i < x.length; i++) d |= x[i] ^ y[i];
+    return d === 0;
+}
+
+function importJwk(jwk, a, extractable, importPub, importSeed) {
+    if (!jwk || typeof jwk !== "object" || ArrayBuffer.isView(jwk) ||
+            jwk instanceof ArrayBuffer) {
+        throw E.dataError("jwk import expects a JsonWebKey object");
+    }
+    if (jwk.kty !== "AKP") throw E.dataError('JWK kty must be "AKP"');
+    if (jwk.alg !== undefined && jwk.alg !== a.name) {
+        throw E.dataError("JWK alg does not match " + a.name);
+    }
+    if (jwk.ext === false && extractable) {
+        throw E.dataError("JWK ext forbids an extractable key");
+    }
+    const checkOps = (usages) => {
+        if (jwk.key_ops === undefined) return;
+        if (!Array.isArray(jwk.key_ops)) throw E.dataError("JWK key_ops must be an array");
+        for (const u of usages) {
+            if (!jwk.key_ops.includes(u)) {
+                throw E.dataError("JWK key_ops does not permit " + u);
+            }
+        }
+    };
+    if (jwk.priv !== undefined) {
+        const key = importSeed(unb64u(jwk.priv, "priv"),
+            jwk.pub === undefined ? null : unb64u(jwk.pub, "pub"), "pub");
+        checkOps(key.usages);
+        return key;
+    }
+    if (jwk.pub === undefined) throw E.dataError("JWK has neither pub nor priv");
+    const key = importPub(unb64u(jwk.pub, "pub"));
+    checkOps(key.usages);
+    return key;
 }
 
 export async function exportKey(format, key) {
     const a = requireAlg(key && key.algorithm && key.algorithm.name);
     const m = requireKey(key, a, key.type, null);
     if (!key.extractable) throw E.invalidAccess("key is not extractable");
-    if (format === "raw-public") {
-        if (key.type !== "public") throw E.invalidAccess("raw-public exports public keys");
-        return m.pub.slice().buffer;
-    }
-    if (format === "raw-seed") {
-        if (key.type !== "private") throw E.invalidAccess("raw-seed exports private keys");
-        return m.seed.slice().buffer;
+    const pub = () => {
+        if (key.type !== "public") throw E.invalidAccess(format + " exports public keys");
+        return m.pub;
+    };
+    const seed = () => {
+        if (key.type !== "private") throw E.invalidAccess(format + " exports private keys");
+        return m.seed;
+    };
+    if (format === "raw-public") return pub().slice().buffer;
+    if (format === "raw-seed") return seed().slice().buffer;
+    if (format === "spki") return encodeSpki(a.name, pub()).buffer;
+    if (format === "pkcs8") return encodePkcs8(a.name, seed()).buffer;
+    if (format === "jwk") {
+        const jwk = {
+            kty: "AKP",
+            alg: a.name,
+            pub: b64u(m.pub),
+            key_ops: [...key.usages],
+            ext: key.extractable,
+        };
+        if (key.type === "private") jwk.priv = b64u(seed());
+        return jwk;
     }
-    throw E.notSupported("key format " + format + " is not supported yet");
+    throw E.notSupported("key format " + format + " is not supported");
 }
 
 export async function getPublicKey(key, keyUsages = []) {
@@ -216,6 +290,77 @@ export async function verify(algorithm, key, signature, data) {
         a.name, m.pub, toBytes(data, "data"), ctx, toBytes(signature, "signature"));
 }
 
+/* ---- wrapKey / unwrapKey: exportKey + native wrap composition ----
+ *
+ * The exported bytes ride through the native wrapKey/unwrapKey inside a
+ * throwaway raw-imported HMAC key, so the wrap algorithm gets the native
+ * spec-defined treatment (encrypt for AES-GCM/RSA-OAEP, key wrap for
+ * AES-KW) and the wrapping key's own usages are enforced natively. */
+
+function nativeSubtle() {
+    const ns = globalThis.crypto && globalThis.crypto.subtle;
+    if (!ns) throw E.notSupported("no native SubtleCrypto for key wrapping");
+    return ns;
+}
+
+const CARRIER = { name: "HMAC", hash: "SHA-256" };
+
+export async function wrapKey(format, key, wrappingKey, wrapAlgorithm) {
+    if (isOurKey(wrappingKey)) {
+        throw E.invalidAccess("ML-KEM/ML-DSA keys cannot wrap other keys");
+    }
+    if (!isOurKey(key)) {
+        throw E.invalidAccess("key is not from this polyfill");
+    }
+    const exported = await exportKey(format, key);
+    let bytes = format === "jwk"
+        ? new TextEncoder().encode(JSON.stringify(exported))
+        : new Uint8Array(exported);
+    /* WebCrypto pads JWK JSON with spaces to the AES-KW 8-byte multiple */
+    const wrapName = wrapAlgorithm && wrapAlgorithm.name || wrapAlgorithm;
+    if (format === "jwk" && bytes.length % 8 &&
+            String(wrapName).toUpperCase() === "AES-KW") {
+        const padded = new Uint8Array(Math.ceil(bytes.length / 8) * 8).fill(0x20);
+        padded.set(bytes);
+        bytes.fill(0);
+        bytes = padded;
+    }
+    const ns = nativeSubtle();
+    try {
+        const carrier = await ns.importKey("raw", bytes, CARRIER, true, ["sign"]);
+        return await ns.wrapKey("raw", carrier, wrappingKey, wrapAlgorithm);
+    } finally {
+        bytes.fill(0);
+    }
+}
+
+export async function unwrapKey(format, wrappedKey, unwrappingKey, unwrapAlgorithm,
+                                unwrappedKeyAlgorithm, extractable, keyUsages) {
+    if (isOurKey(unwrappingKey)) {
+        throw E.invalidAccess("ML-KEM/ML-DSA keys cannot unwrap other keys");
+    }
+    requireAlg(unwrappedKeyAlgorithm);
+    const ns = nativeSubtle();
+    const carrier = await ns.unwrapKey("raw", wrappedKey, unwrappingKey,
+        unwrapAlgorithm, CARRIER, true, ["sign"]);
+    const bytes = new Uint8Array(await ns.exportKey("raw", carrier));
+    let keyData = bytes;
+    if (format === "jwk") {
+        try {
+            keyData = JSON.parse(new TextDecoder().decode(bytes));
+        } catch {
+            throw E.dataError("unwrapped data is not JWK JSON");
+        } finally {
+            bytes.fill(0);
+        }
+    }
+    try {
+        return await importKey(format, keyData, unwrappedKeyAlgorithm, extractable, keyUsages);
+    } finally {
+        if (keyData instanceof Uint8Array) keyData.fill(0);
+    }
+}
+
 /* ---- feature detection ---- */
 
 const OPS = {

package/wasm/dist/subtlepq-engine.mjs

@@ -0,0 +1,2 @@
+async function SubtlePQEngine(moduleArg={}){var moduleRtn;var Module=moduleArg;var ENVIRONMENT_IS_WEB=!!globalThis.window;var ENVIRONMENT_IS_WORKER=!!globalThis.WorkerGlobalScope;var ENVIRONMENT_IS_NODE=globalThis.process?.versions?.node&&globalThis.process?.type!="renderer";if(ENVIRONMENT_IS_NODE){const{createRequire}=await import("node:module");var require=createRequire(import.meta.url)}var arguments_=[];var thisProgram="./this.program";var quit_=(status,toThrow)=>{throw toThrow};var _scriptName=import.meta.url;var scriptDirectory="";function locateFile(path){if(Module["locateFile"]){return Module["locateFile"](path,scriptDirectory)}return scriptDirectory+path}var readAsync,readBinary;if(ENVIRONMENT_IS_NODE){var fs=require("node:fs");if(_scriptName.startsWith("file:")){scriptDirectory=require("node:path").dirname(require("node:url").fileURLToPath(_scriptName))+"/"}readBinary=filename=>{filename=isFileURI(filename)?new URL(filename):filename;var ret=fs.readFileSync(filename);return ret};readAsync=async(filename,binary=true)=>{filename=isFileURI(filename)?new URL(filename):filename;var ret=fs.readFileSync(filename,binary?undefined:"utf8");return ret};if(process.argv.length>1){thisProgram=process.argv[1].replace(/\\/g,"/")}arguments_=process.argv.slice(2);quit_=(status,toThrow)=>{process.exitCode=status;throw toThrow}}else if(ENVIRONMENT_IS_WEB||ENVIRONMENT_IS_WORKER){try{scriptDirectory=new URL(".",_scriptName).href}catch{}{if(ENVIRONMENT_IS_WORKER){readBinary=url=>{var xhr=new XMLHttpRequest;xhr.open("GET",url,false);xhr.responseType="arraybuffer";xhr.send(null);return new Uint8Array(xhr.response)}}readAsync=async url=>{if(isFileURI(url)){return new Promise((resolve,reject)=>{var xhr=new XMLHttpRequest;xhr.open("GET",url,true);xhr.responseType="arraybuffer";xhr.onload=()=>{if(xhr.status==200||xhr.status==0&&xhr.response){resolve(xhr.response);return}reject(xhr.status)};xhr.onerror=reject;xhr.send(null)})}var response=await fetch(url,{credentials:"same-origin"});if(response.ok){return response.arrayBuffer()}throw new Error(response.status+" : "+response.url)}}}else{}var out=console.log.bind(console);var err=console.error.bind(console);var wasmBinary;var ABORT=false;var EXITSTATUS;var isFileURI=filename=>filename.startsWith("file://");class EmscriptenEH{}class EmscriptenSjLj extends EmscriptenEH{}var readyPromiseResolve,readyPromiseReject;var runtimeInitialized=false;function updateMemoryViews(){var b=wasmMemory.buffer;HEAP8=new Int8Array(b);HEAP16=new Int16Array(b);Module["HEAPU8"]=HEAPU8=new Uint8Array(b);HEAPU16=new Uint16Array(b);HEAP32=new Int32Array(b);HEAPU32=new Uint32Array(b);HEAPF32=new Float32Array(b);HEAPF64=new Float64Array(b);HEAP64=new BigInt64Array(b);HEAPU64=new BigUint64Array(b)}function preRun(){if(Module["preRun"]){if(typeof Module["preRun"]=="function")Module["preRun"]=[Module["preRun"]];while(Module["preRun"].length){addOnPreRun(Module["preRun"].shift())}}callRuntimeCallbacks(onPreRuns)}function initRuntime(){runtimeInitialized=true;wasmExports["f"]()}function postRun(){if(Module["postRun"]){if(typeof Module["postRun"]=="function")Module["postRun"]=[Module["postRun"]];while(Module["postRun"].length){addOnPostRun(Module["postRun"].shift())}}callRuntimeCallbacks(onPostRuns)}function abort(what){Module["onAbort"]?.(what);what=`Aborted(${what})`;err(what);ABORT=true;what+=". Build with -sASSERTIONS for more info.";var e=new WebAssembly.RuntimeError(what);readyPromiseReject?.(e);throw e}var wasmBinaryFile;function findWasmBinary(){if(Module["locateFile"]){return locateFile("subtlepq-engine.wasm")}return new URL("subtlepq-engine.wasm",import.meta.url).href}function getBinarySync(file){if(file==wasmBinaryFile&&wasmBinary){return new Uint8Array(wasmBinary)}if(readBinary){return readBinary(file)}throw"both async and sync fetching of the wasm failed"}async function getWasmBinary(binaryFile){if(!wasmBinary){try{var response=await readAsync(binaryFile);return new Uint8Array(response)}catch{}}return getBinarySync(binaryFile)}async function instantiateArrayBuffer(binaryFile,imports){try{var binary=await getWasmBinary(binaryFile);var instance=await WebAssembly.instantiate(binary,imports);return instance}catch(reason){err(`failed to asynchronously prepare wasm: ${reason}`);abort(reason)}}async function instantiateAsync(binary,binaryFile,imports){if(!binary&&!isFileURI(binaryFile)&&!ENVIRONMENT_IS_NODE){try{var response=fetch(binaryFile,{credentials:"same-origin"});var instantiationResult=await WebAssembly.instantiateStreaming(response,imports);return instantiationResult}catch(reason){err(`wasm streaming compile failed: ${reason}`);err("falling back to ArrayBuffer instantiation")}}return instantiateArrayBuffer(binaryFile,imports)}function getWasmImports(){var imports={a:wasmImports};return imports}async function createWasm(){function receiveInstance(instance,module){wasmExports=instance.exports;assignWasmExports(wasmExports);updateMemoryViews();return wasmExports}function receiveInstantiationResult(result){return receiveInstance(result["instance"])}var info=getWasmImports();if(Module["instantiateWasm"]){return new Promise((resolve,reject)=>{Module["instantiateWasm"](info,(inst,mod)=>{resolve(receiveInstance(inst,mod))})})}wasmBinaryFile??=findWasmBinary();var result=await instantiateAsync(wasmBinary,wasmBinaryFile,info);var exports=receiveInstantiationResult(result);return exports}class ExitStatus{name="ExitStatus";constructor(status){this.message=`Program terminated with exit(${status})`;this.status=status}}var HEAP16;var HEAP32;var HEAP64;var HEAP8;var HEAPF32;var HEAPF64;var HEAPU16;var HEAPU32;var HEAPU64;var HEAPU8;var callRuntimeCallbacks=callbacks=>{while(callbacks.length>0){callbacks.shift()(Module)}};var onPostRuns=[];var addOnPostRun=cb=>onPostRuns.push(cb);var onPreRuns=[];var addOnPreRun=cb=>onPreRuns.push(cb);var noExitRuntime=true;var getHeapMax=()=>2147483648;var alignMemory=(size,alignment)=>Math.ceil(size/alignment)*alignment;var growMemory=size=>{var oldHeapSize=wasmMemory.buffer.byteLength;var pages=(size-oldHeapSize+65535)/65536|0;try{wasmMemory.grow(pages);updateMemoryViews();return 1}catch(e){}};var _emscripten_resize_heap=requestedSize=>{var oldSize=HEAPU8.length;requestedSize>>>=0;var maxHeapSize=getHeapMax();if(requestedSize>maxHeapSize){return false}for(var cutDown=1;cutDown<=4;cutDown*=2){var overGrownHeapSize=oldSize*(1+.2/cutDown);overGrownHeapSize=Math.min(overGrownHeapSize,requestedSize+100663296);var newSize=Math.min(maxHeapSize,alignMemory(Math.max(requestedSize,overGrownHeapSize),65536));var replacement=growMemory(newSize);if(replacement){return true}}return false};var runtimeKeepaliveCounter=0;var keepRuntimeAlive=()=>noExitRuntime||runtimeKeepaliveCounter>0;var _proc_exit=code=>{EXITSTATUS=code;if(!keepRuntimeAlive()){Module["onExit"]?.(code);ABORT=true}quit_(code,new ExitStatus(code))};var exitJS=(status,implicit)=>{EXITSTATUS=status;_proc_exit(status)};var _exit=exitJS;var printCharBuffers=[null,[],[]];var UTF8Decoder=globalThis.TextDecoder&&new TextDecoder;var findStringEnd=(heapOrArray,idx,maxBytesToRead,ignoreNul)=>{var maxIdx=idx+maxBytesToRead;if(ignoreNul)return maxIdx;while(heapOrArray[idx]&&!(idx>=maxIdx))++idx;return idx};var UTF8ArrayToString=(heapOrArray,idx=0,maxBytesToRead,ignoreNul)=>{var endPtr=findStringEnd(heapOrArray,idx,maxBytesToRead,ignoreNul);if(endPtr-idx>16&&heapOrArray.buffer&&UTF8Decoder){return UTF8Decoder.decode(heapOrArray.subarray(idx,endPtr))}var str="";while(idx<endPtr){var u0=heapOrArray[idx++];if(!(u0&128)){str+=String.fromCharCode(u0);continue}var u1=heapOrArray[idx++]&63;if((u0&224)==192){str+=String.fromCharCode((u0&31)<<6|u1);continue}var u2=heapOrArray[idx++]&63;if((u0&240)==224){u0=(u0&15)<<12|u1<<6|u2}else{u0=(u0&7)<<18|u1<<12|u2<<6|heapOrArray[idx++]&63}if(u0<65536){str+=String.fromCharCode(u0)}else{var ch=u0-65536;str+=String.fromCharCode(55296|ch>>10,56320|ch&1023)}}return str};var printChar=(stream,curr)=>{var buffer=printCharBuffers[stream];if(curr===0||curr===10){(stream===1?out:err)(UTF8ArrayToString(buffer));buffer.length=0}else{buffer.push(curr)}};var _fd_write=(fd,iov,iovcnt,pnum)=>{var num=0;for(var i=0;i<iovcnt;i++){var ptr=HEAPU32[iov>>2];var len=HEAPU32[iov+4>>2];iov+=8;for(var j=0;j<len;j++){printChar(fd,HEAPU8[ptr+j])}num+=len}HEAPU32[pnum>>2]=num;return 0};var initRandomFill=()=>{if(ENVIRONMENT_IS_NODE){var nodeCrypto=require("node:crypto");return view=>nodeCrypto.randomFillSync(view)}return view=>(crypto.getRandomValues(view),0)};var randomFill=view=>(randomFill=initRandomFill())(view);var _random_get=(buffer,size)=>randomFill(HEAPU8.subarray(buffer,buffer+size));{if(Module["noExitRuntime"])noExitRuntime=Module["noExitRuntime"];if(Module["print"])out=Module["print"];if(Module["printErr"])err=Module["printErr"];if(Module["wasmBinary"])wasmBinary=Module["wasmBinary"];if(Module["arguments"])arguments_=Module["arguments"];if(Module["thisProgram"])thisProgram=Module["thisProgram"];if(Module["preInit"]){if(typeof Module["preInit"]=="function")Module["preInit"]=[Module["preInit"]];while(Module["preInit"].length>0){Module["preInit"].shift()()}}}var _pqf_kem_lengths,_free,_malloc,_pqf_kem_keypair,_pqf_kem_keypair_derand,_pqf_kem_encaps,_pqf_kem_encaps_derand,_pqf_kem_decaps,_pqf_sig_lengths,_pqf_sig_keypair,_pqf_sig_keypair_derand,_pqf_sig_sign,_pqf_sig_sign_derand,_pqf_sig_verify,_pqf_liboqs_version,memory,__indirect_function_table,wasmMemory;function assignWasmExports(wasmExports){_pqf_kem_lengths=Module["_pqf_kem_lengths"]=wasmExports["g"];_free=Module["_free"]=wasmExports["h"];_malloc=Module["_malloc"]=wasmExports["i"];_pqf_kem_keypair=Module["_pqf_kem_keypair"]=wasmExports["j"];_pqf_kem_keypair_derand=Module["_pqf_kem_keypair_derand"]=wasmExports["k"];_pqf_kem_encaps=Module["_pqf_kem_encaps"]=wasmExports["l"];_pqf_kem_encaps_derand=Module["_pqf_kem_encaps_derand"]=wasmExports["m"];_pqf_kem_decaps=Module["_pqf_kem_decaps"]=wasmExports["n"];_pqf_sig_lengths=Module["_pqf_sig_lengths"]=wasmExports["o"];_pqf_sig_keypair=Module["_pqf_sig_keypair"]=wasmExports["p"];_pqf_sig_keypair_derand=Module["_pqf_sig_keypair_derand"]=wasmExports["q"];_pqf_sig_sign=Module["_pqf_sig_sign"]=wasmExports["r"];_pqf_sig_sign_derand=Module["_pqf_sig_sign_derand"]=wasmExports["s"];_pqf_sig_verify=Module["_pqf_sig_verify"]=wasmExports["t"];_pqf_liboqs_version=Module["_pqf_liboqs_version"]=wasmExports["u"];memory=wasmMemory=wasmExports["e"];__indirect_function_table=wasmExports["__indirect_function_table"]}var wasmImports={c:_emscripten_resize_heap,a:_exit,b:_fd_write,d:_random_get};function run(){preRun();function doRun(){Module["calledRun"]=true;if(ABORT)return;initRuntime();readyPromiseResolve?.(Module);Module["onRuntimeInitialized"]?.();postRun()}if(Module["setStatus"]){Module["setStatus"]("Running...");setTimeout(()=>{setTimeout(()=>Module["setStatus"](""),1);doRun()},1)}else{doRun()}}var wasmExports;wasmExports=await (createWasm());run();if(runtimeInitialized){moduleRtn=Module}else{moduleRtn=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=reject})}
+;return moduleRtn}export default SubtlePQEngine;