subtlepq 0.1.2 → 0.3.0

package/README.md

@@ -1,8 +1,13 @@
-# pqfill
+# subtlepq
 
 Post-quantum polyfill for the Web Cryptography API: ML-KEM (FIPS 203) and ML-DSA (FIPS 204) per the [WICG Modern Algorithms draft](https://wicg.github.io/webcrypto-modern-algos/), with native delegation where the platform already supports it.
 
-**Status: P1 — engine + core JS layer.** Raw key formats only (`raw-public`, `raw-seed`); spki/pkcs8/jwk, wrapKey, and DHKEM are on the way.
+**Status: P4 — engine, core JS layer, all key formats, key wrapping, native-parity suites, DHKEM extension.**
+
+Key formats: `raw-public`, `raw-seed`, `spki`, `pkcs8` (seed-only encoding per the LAMPS
+drafts; the `both` CHOICE is accepted on import and cross-checked), and `jwk` (kty `"AKP"`,
+`pub`/`priv` with `priv` = seed). `wrapKey`/`unwrapKey` compose export/import with the native
+wrapping algorithm, so AES-GCM, AES-KW, and RSA-OAEP wrapping of ML-* keys just work.
 
 ## Use
 
@@ -29,9 +34,29 @@ const sig = await crypto.subtle.sign({ name: "ML-DSA-65", context: ctx }, kp.pri
 
 Known limits (inherent to a script polyfill, made loud rather than silent): ML-* keys are not structured-cloneable — `postMessage`/IndexedDB throws `DataCloneError`; export the 32–64-byte seed and re-import instead. Key material lives in wasm linear memory: `extractable: false` is API-level enforcement, not platform isolation.
 
+## DHKEM: classical ECDH in the same KEM shape
+
+`subtlepq/dhkem` wraps ephemeral-static ECDH as a KEM per [RFC 9180 §4.1](https://www.rfc-editor.org/rfc/rfc9180#section-4.1) — `DHKEM-X25519-HKDF-SHA256` and `DHKEM-P256-HKDF-SHA256` — so classical and post-quantum key agreement share one calling convention, and migrating to ML-KEM is a name change:
+
+```js
+import * as dhkem from "subtlepq/dhkem";
+dhkem.register();       // before install(), if you use the true polyfill
+import { subtle } from "subtlepq";
+
+const kp = await subtle.generateKey("DHKEM-X25519-HKDF-SHA256", false,
+    ["encapsulateKey", "decapsulateKey"]);
+const { sharedKey, ciphertext } = await subtle.encapsulateKey(
+    "DHKEM-X25519-HKDF-SHA256", kp.publicKey,          // -> "ML-KEM-768" later
+    { name: "AES-GCM", length: 256 }, false, ["encrypt"]);
+```
+
+These names are **not** in the WICG draft — this is a subtlepq extension (if the WG adopts DHKEM identifiers, those will be adopted and these aliased). Underneath it is 100% native WebCrypto (ECDH/X25519 + HKDF): no wasm is involved, and the keys are genuine platform CryptoKeys — structured-cloneable, native usage enforcement (surfaced as `deriveBits`). The ciphertext is the serialized ephemeral public key (32 bytes X25519 / 65 bytes P-256), interoperable with any RFC 9180 DHKEM implementation, and validated against the RFC 9180 Appendix A test vectors.
+
+One asymmetry vs a true KEM: RFC 9180 decapsulation mixes the recipient *public* key into the KDF. subtlepq remembers the public half for keys created through `subtlepq/dhkem`; for private keys from elsewhere (or structured-cloned into another realm) pass it explicitly — `decapsulateBits({ name: "DHKEM-X25519-HKDF-SHA256", publicKey }, key, ct)` — or use an extractable key.
+
 ## Engine
 
-`wasm/` builds a minimal [liboqs](https://github.com/open-quantum-safe/liboqs) (pinned submodule, ML-KEM + ML-DSA only) plus a thin shim (`pqfill_engine.c`) to WebAssembly:
+`wasm/` builds a minimal [liboqs](https://github.com/open-quantum-safe/liboqs) (pinned submodule, ML-KEM + ML-DSA only) plus a thin shim (`subtlepq_engine.c`) to WebAssembly:
 
 ```
 git submodule update --init
@@ -39,11 +64,19 @@ wasm/build.sh          # needs emsdk; override location with EMSDK=...
 npm test
 ```
 
-Outputs `wasm/dist/pqfill-engine.mjs` (+ `.wasm` sidecar, CSP-clean) and `pqfill-engine.single.mjs` (self-contained, requires `'wasm-unsafe-eval'` under strict CSP). 75 KB wasm covers all six parameter sets.
+Outputs `wasm/dist/subtlepq-engine.mjs` (+ `.wasm` sidecar, CSP-clean) and `subtlepq-engine.single.mjs` (self-contained, requires `'wasm-unsafe-eval'` under strict CSP). 75 KB wasm covers all six parameter sets.
 
 Seeded operations liboqs does not expose publicly (ML-DSA keygen from seed, KAT-deterministic encapsulation/signing) use a bracketed RNG-playback override — the same technique liboqs' own ACVP tests use.
 
-Tests run NIST ACVP known-answer vectors (subset, see `test/vectors/acvp-subset.json`) for all six parameter sets, plus roundtrip, implicit-rejection, context, and polyfill-routing checks.
+Tests run NIST ACVP known-answer vectors (subset, see `test/vectors/acvp-subset.json`) for all six parameter sets, plus roundtrip, implicit-rejection, context, and polyfill-routing checks. `test/dhkem-test.mjs` validates the DHKEM extension against the RFC 9180 Appendix A vectors (`test/vectors/rfc9180-subset.json`).
+
+`npm run test:parity` (Node >= 24.7) runs the polyfill side-by-side against the
+platform-native ML-KEM/ML-DSA WebCrypto implementation as an oracle: identical
+spki/pkcs8/jwk bytes, cross-stack encapsulate/decapsulate and sign/verify, identical
+AES-KW/AES-GCM wrapKey output, and matching DOMException names on malformed input.
+`npm run test:libves` cross-checks ML-KEM against [libVES](https://github.com/vesvault/libVES)
+(an independent liboqs build and ASN.1 layer): same-seed keypair equality, SPKI byte
+parity, and mutual key import and encapsulation.
 
 ## License
 

package/package.json

@@ -1,47 +1,52 @@
 {
     "name": "subtlepq",
-    "version": "0.1.2",
+    "version": "0.3.0",
     "description": "Post-quantum polyfill for the Web Cryptography API: ML-KEM (FIPS 203) and ML-DSA (FIPS 204) per the WICG Modern Algorithms draft, with native delegation",
     "type": "module",
     "license": "Apache-2.0",
     "author": "VESvault Corp",
     "repository": {
         "type": "git",
-        "url": "git+https://github.com/vesvault/pqfill.git"
+        "url": "git+https://github.com/vesvault/subtlepq.git"
     },
-    "homepage": "https://github.com/vesvault/pqfill#readme",
+    "homepage": "https://github.com/vesvault/subtlepq#readme",
     "bugs": {
-        "url": "https://github.com/vesvault/pqfill/issues"
+        "url": "https://github.com/vesvault/subtlepq/issues"
     },
     "engines": {
         "node": ">=18"
     },
     "sideEffects": false,
     "files": [
-        "src",
-        "wasm/dist"
+        "src/algorithms.js",
+        "src/dhkem.js",
+        "src/engine.js",
+        "src/errors.js",
+        "src/formats.js",
+        "src/index.js",
+        "src/install.js",
+        "src/keystore.js",
+        "src/router.js",
+        "src/subtle.js",
+        "wasm/dist/subtlepq-engine.mjs",
+        "wasm/dist/subtlepq-engine.single.mjs",
+        "wasm/dist/subtlepq-engine.wasm"
     ],
     "exports": {
         ".": "./src/index.js",
-        "./install": "./src/install.js"
+        "./install": "./src/install.js",
+        "./dhkem": "./src/dhkem.js"
     },
     "scripts": {
         "build": "wasm/build.sh",
-        "test": "node test/engine-test.mjs && node test/polyfill-test.mjs",
-        "prepack": "node -e \"const fs=require('fs');for(const f of ['pqfill-engine.mjs','pqfill-engine.single.mjs','pqfill-engine.wasm'])if(!fs.existsSync('wasm/dist/'+f))throw new Error('wasm/dist/'+f+' missing - run wasm/build.sh before packing')\""
+        "prepack": "node -e \"const p=require('./package.json'),fs=require('fs');for(const f of p.files)if(!fs.existsSync(f))throw new Error(f+' missing - run wasm/build.sh before packing')\"",
+        "test": "node test/engine-test.mjs && node test/polyfill-test.mjs && node test/dhkem-test.mjs",
+        "test:parity": "node test/parity-native.mjs",
+        "test:libves": "node test/parity-libves.mjs"
     },
     "keywords": [
-        "ml-kem",
-        "ml-dsa",
-        "webcrypto",
-        "polyfill",
-        "post-quantum",
-        "fips203",
-        "fips204",
-        "kyber",
-        "dilithium",
-        "subtlecrypto",
-        "encapsulation",
-        "kem"
+        "ml-kem", "ml-dsa", "webcrypto", "polyfill", "post-quantum",
+        "fips203", "fips204", "kyber", "dilithium", "subtlecrypto",
+        "encapsulation", "kem", "dhkem", "hpke", "rfc9180"
     ]
-}
+}

package/src/algorithms.js

@@ -1,5 +1,5 @@
 /***************************************************************************
- * pqfill: algorithm registry and AlgorithmIdentifier normalization
+ * subtlepq: algorithm registry and AlgorithmIdentifier normalization
  *
  * (c) 2026 VESvault Corp
  * SPDX-License-Identifier: Apache-2.0
@@ -13,8 +13,25 @@ const NAMES = [
 export const KEM_PUB_USAGES = ["encapsulateBits", "encapsulateKey"];
 export const KEM_PRIV_USAGES = ["decapsulateBits", "decapsulateKey"];
 
+/* Extension algorithms (subtlepq/dhkem): registered at runtime, carrying
+ * their own ops table; the core ML-* set above stays engine-backed. */
+const EXTENSIONS = new Map();
+
+export function registerExtension(name, kind, ops) {
+    EXTENSIONS.set(name.toLowerCase(), { name, kind, ops });
+}
+
+export function unregisterExtension(name) {
+    EXTENSIONS.delete(name.toLowerCase());
+}
+
+export function hasExtensions() {
+    return EXTENSIONS.size > 0;
+}
+
 /* WebCrypto algorithm names are matched case-insensitively.
- * Returns { name, kind, context? } with the canonical name, or null. */
+ * Returns { name, kind, context?, ops? } with the canonical name, or null;
+ * `ops` marks an extension algorithm handled outside subtle.js. */
 export function normalizeAlg(alg) {
     let name, context;
     if (typeof alg === "string") {
@@ -26,10 +43,14 @@ export function normalizeAlg(alg) {
         return null;
     }
     const canonical = NAMES.find((n) => n.toLowerCase() === name.toLowerCase());
-    if (!canonical) return null;
-    return {
-        name: canonical,
-        kind: canonical.startsWith("ML-KEM") ? "kem" : "sig",
-        context,
-    };
+    if (canonical) {
+        return {
+            name: canonical,
+            kind: canonical.startsWith("ML-KEM") ? "kem" : "sig",
+            context,
+        };
+    }
+    const ext = EXTENSIONS.get(name.toLowerCase());
+    if (!ext) return null;
+    return { name: ext.name, kind: ext.kind, ops: ext.ops, context };
 }

package/src/dhkem.js

@@ -0,0 +1,321 @@
+/***************************************************************************
+ * subtlepq/dhkem: DHKEM over the platform's native ECDH -- RFC 9180 sec 4.1
+ *
+ * (c) 2026 VESvault Corp
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * KEM-shaped classical key agreement: ephemeral-static ECDH wrapped as
+ * encapsulate/decapsulate, so classical and post-quantum share one calling
+ * convention and migrating to ML-KEM is a name change. NOT part of the
+ * WICG draft -- a subtlepq extension; if the WG ever adopts DHKEM
+ * identifiers, those will be adopted here and these names aliased.
+ *
+ * Everything underneath is native WebCrypto (ECDH / X25519 + HKDF-SHA256);
+ * no WASM is involved and all keys are genuine platform CryptoKeys --
+ * structured-cloneable, native usage enforcement (surfaced as
+ * "deriveBits", the underlying native usage).
+ *
+ * Decapsulation needs the recipient PUBLIC key bytes for the RFC 9180
+ * kem_context. They are remembered automatically for private keys made by
+ * generateKey()/importKey() of this module; for foreign or structured-
+ * cloned private keys pass { name, publicKey } (CryptoKey or serialized
+ * bytes) or use an extractable key.
+ ***************************************************************************/
+
+import { registerExtension, unregisterExtension } from "./algorithms.js";
+import { importSharedKey, toBytes } from "./subtle.js";
+import { unb64u } from "./formats.js";
+import * as E from "./errors.js";
+
+const te = new TextEncoder();
+
+function cat(...parts) {
+    const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+    let o = 0;
+    for (const p of parts) { out.set(p, o); o += p.length; }
+    return out;
+}
+
+/* suite_id = "KEM" || I2OSP(kem_id, 2); Nsecret = 32 for both suites.
+ * The RFC serialized public key form is exactly WebCrypto "raw": 32 bytes
+ * for X25519, the 65-byte uncompressed point for P-256. */
+const SUITES = {
+    "DHKEM-X25519-HKDF-SHA256": {
+        nEnc: 32,
+        native: { name: "X25519" },
+        suiteId: cat(te.encode("KEM"), [0x00, 0x20]),
+        jwkPub: (jwk) => (jwk.x === undefined ? null : unb64u(jwk.x, "x")),
+    },
+    "DHKEM-P256-HKDF-SHA256": {
+        nEnc: 65,
+        native: { name: "ECDH", namedCurve: "P-256" },
+        suiteId: cat(te.encode("KEM"), [0x00, 0x10]),
+        jwkPub: (jwk) => (jwk.x === undefined || jwk.y === undefined ? null
+            : cat([0x04], unb64u(jwk.x, "x"), unb64u(jwk.y, "y"))),
+    },
+};
+
+const PUB_USAGES = ["encapsulateBits", "encapsulateKey"];
+const PRIV_USAGES = ["decapsulateBits", "decapsulateKey", "deriveBits", "deriveKey"];
+
+/* key -> its serialized PUBLIC key bytes (for a private key, the public
+ * half): encap serializes pkR and decap mixes it into the kem_context,
+ * and neither can be exported off a non-extractable CryptoKey */
+const pkmap = new WeakMap();
+
+function nativeSubtle() {
+    const ns = globalThis.crypto && globalThis.crypto.subtle;
+    if (!ns) throw E.notSupported("no native SubtleCrypto for DHKEM");
+    return ns;
+}
+
+function requireSuite(alg) {
+    let name, obj;
+    if (typeof alg === "string") {
+        name = alg;
+    } else if (alg && typeof alg.name === "string") {
+        name = alg.name;
+        obj = alg;
+    }
+    const canonical = name === undefined ? undefined :
+        Object.keys(SUITES).find((n) => n.toLowerCase() === name.toLowerCase());
+    if (!canonical) throw E.notSupported("unrecognized DHKEM algorithm");
+    return { name: canonical, s: SUITES[canonical], alg: obj };
+}
+
+function requireKey(key, s, name, type) {
+    const ka = key && key.algorithm;
+    const match = ka && ka.name === s.native.name &&
+        (s.native.namedCurve === undefined || ka.namedCurve === s.native.namedCurve);
+    if (!match) {
+        throw E.invalidAccess("key is not a native " + s.native.name +
+            (s.native.namedCurve ? "/" + s.native.namedCurve : "") +
+            " key usable with " + name);
+    }
+    if (key.type !== type) throw E.invalidAccess("expected a " + type + " key");
+}
+
+function checkUsages(usages, allowed) {
+    for (const u of usages) {
+        if (!allowed.includes(u)) throw E.syntaxError("unsupported key usage " + u);
+    }
+}
+
+/* ExtractAndExpand (RFC 9180 sec 4.1) in one native HKDF deriveBits call:
+ * LabeledExtract("", "eae_prk", dh) + LabeledExpand(prk, "shared_secret",
+ * kem_context, 32) map exactly onto HKDF's extract-then-expand. */
+async function extractAndExpand(ns, s, dh, kemContext) {
+    const ikm = cat(te.encode("HPKE-v1"), s.suiteId, te.encode("eae_prk"), dh);
+    const info = cat([0, 32], te.encode("HPKE-v1"), s.suiteId,
+        te.encode("shared_secret"), kemContext);
+    const k = await ns.importKey("raw", ikm, "HKDF", false, ["deriveBits"]);
+    ikm.fill(0);
+    return new Uint8Array(await ns.deriveBits(
+        { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info }, k, 256));
+}
+
+const dhBits = async (ns, s, priv, pub) => new Uint8Array(
+    await ns.deriveBits({ name: s.native.name, public: pub }, priv, 256));
+
+async function publicBytesFor(ns, key, s, name, alg) {
+    const given = alg && alg.publicKey;
+    if (given !== undefined && given !== null) {
+        if (typeof CryptoKey !== "undefined" && given instanceof CryptoKey) {
+            requireKey(given, s, name, "public");
+            return new Uint8Array(await ns.exportKey("raw", given));
+        }
+        const b = toBytes(given, "publicKey");
+        if (b.length !== s.nEnc) throw E.dataError("bad " + name + " publicKey length");
+        return b;
+    }
+    const known = pkmap.get(key);
+    if (known) return known.slice();
+    if (key.extractable) {
+        const pub = s.jwkPub(await ns.exportKey("jwk", key));
+        if (pub) return pub;
+    }
+    throw E.invalidAccess("cannot determine the recipient public key for " + name +
+        " decapsulation; pass { name, publicKey } or use a key from this module");
+}
+
+/* ---- key management (thin translation onto native ECDH / X25519) ---- */
+
+export async function generateKey(algorithm, extractable, keyUsages = []) {
+    const { s } = requireSuite(algorithm);
+    checkUsages(keyUsages, [...PUB_USAGES, ...PRIV_USAGES]);
+    if (!keyUsages.some((u) => PRIV_USAGES.includes(u))) {
+        throw E.syntaxError("private key usages must not be empty");
+    }
+    const ns = nativeSubtle();
+    const pair = await ns.generateKey(s.native, extractable, ["deriveBits"]);
+    const pub = new Uint8Array(await ns.exportKey("raw", pair.publicKey));
+    pkmap.set(pair.publicKey, pub);
+    pkmap.set(pair.privateKey, pub);
+    return pair;
+}
+
+export async function importKey(format, keyData, algorithm, extractable, keyUsages = []) {
+    const { s, name } = requireSuite(algorithm);
+    const ns = nativeSubtle();
+    const importPriv = async (fmt, data) => {
+        checkUsages(keyUsages, PRIV_USAGES);
+        if (!keyUsages.length) throw E.syntaxError("private key usages must not be empty");
+        return ns.importKey(fmt, data, s.native, extractable, ["deriveBits"]);
+    };
+    if (format === "raw" || format === "raw-public" || format === "spki") {
+        checkUsages(keyUsages, PUB_USAGES);
+        const fmt = format === "raw-public" ? "raw" : format;
+        const bytes = toBytes(keyData, "keyData");
+        const key = await ns.importKey(fmt, bytes, s.native, extractable, []);
+        if (fmt === "raw") {
+            pkmap.set(key, bytes);
+        } else {
+            /* spki: recover the raw form via an extractable twin */
+            try {
+                const twin = extractable ? key
+                    : await ns.importKey("spki", bytes, s.native, true, []);
+                pkmap.set(key, new Uint8Array(await ns.exportKey("raw", twin)));
+            } catch {}
+        }
+        return key;
+    }
+    if (format === "pkcs8") {
+        const bytes = toBytes(keyData, "keyData");
+        const key = await importPriv("pkcs8", bytes);
+        /* recover the public half for decap: from the key if extractable,
+         * else from a throwaway extractable import of the same bytes */
+        try {
+            const twin = extractable ? key
+                : await ns.importKey("pkcs8", bytes, s.native, true, ["deriveBits"]);
+            const pub = s.jwkPub(await ns.exportKey("jwk", twin));
+            if (pub) pkmap.set(key, pub);
+        } catch {}
+        bytes.fill(0);
+        return key;
+    }
+    if (format === "jwk") {
+        if (!keyData || typeof keyData !== "object" || ArrayBuffer.isView(keyData) ||
+                keyData instanceof ArrayBuffer) {
+            throw E.dataError("jwk import expects a JsonWebKey object");
+        }
+        /* alg/key_ops carry DHKEM-level values the native import would
+         * reject; the native usage set is supplied explicitly instead */
+        const clean = { ...keyData };
+        delete clean.alg;
+        delete clean.key_ops;
+        delete clean.use;
+        if (keyData.d === undefined) {
+            checkUsages(keyUsages, PUB_USAGES);
+            const key = await ns.importKey("jwk", clean, s.native, extractable, []);
+            const pub = s.jwkPub(keyData);
+            if (pub) pkmap.set(key, pub);
+            return key;
+        }
+        const key = await importPriv("jwk", clean);
+        const pub = s.jwkPub(keyData);
+        if (pub) pkmap.set(key, pub);
+        return key;
+    }
+    throw E.notSupported("key format " + format + " is not supported");
+}
+
+/* ---- KEM operations (RFC 9180 sec 4.1 Encap / Decap, base mode) ---- */
+
+async function encap(algorithm, encapsulationKey) {
+    const { s, name } = requireSuite(algorithm);
+    requireKey(encapsulationKey, s, name, "public");
+    const ns = nativeSubtle();
+    const eph = await ns.generateKey(s.native, false, ["deriveBits"]);
+    const enc = new Uint8Array(await ns.exportKey("raw", eph.publicKey));
+    const dh = await dhBits(ns, s, eph.privateKey, encapsulationKey);
+    const known = pkmap.get(encapsulationKey);
+    let pkRm;
+    if (known) {
+        pkRm = known;
+    } else {
+        try {
+            pkRm = new Uint8Array(await ns.exportKey("raw", encapsulationKey));
+        } catch {
+            throw E.invalidAccess("cannot serialize the " + name +
+                " encapsulation key: not extractable and not from this module");
+        }
+    }
+    const ss = await extractAndExpand(ns, s, dh, cat(enc, pkRm));
+    dh.fill(0);
+    return { ss, enc };
+}
+
+async function decap(algorithm, decapsulationKey, ciphertext) {
+    const { s, name, alg } = requireSuite(algorithm);
+    requireKey(decapsulationKey, s, name, "private");
+    const enc = toBytes(ciphertext, "ciphertext");
+    if (enc.length !== s.nEnc) throw E.opError("bad " + name + " ciphertext length");
+    const ns = nativeSubtle();
+    let pkE;
+    try {
+        pkE = await ns.importKey("raw", enc, s.native, true, []);
+    } catch {
+        /* unlike ML-KEM implicit rejection, DHKEM decap MAY fail: an
+         * invalid public key raises ValidationError per RFC 9180 */
+        throw E.opError("invalid " + name + " ciphertext");
+    }
+    const dh = await dhBits(ns, s, decapsulationKey, pkE);
+    const pkRm = await publicBytesFor(ns, decapsulationKey, s, name, alg);
+    const ss = await extractAndExpand(ns, s, dh, cat(enc, pkRm));
+    dh.fill(0);
+    return ss;
+}
+
+export async function encapsulateBits(algorithm, encapsulationKey) {
+    const { ss, enc } = await encap(algorithm, encapsulationKey);
+    return { sharedKey: ss.buffer, ciphertext: enc.buffer };
+}
+
+export async function encapsulateKey(algorithm, encapsulationKey,
+                                     sharedKeyAlgorithm, extractable, keyUsages) {
+    const { ss, enc } = await encap(algorithm, encapsulationKey);
+    const sharedKey = await importSharedKey(ss, sharedKeyAlgorithm, extractable, keyUsages);
+    return { sharedKey, ciphertext: enc.buffer };
+}
+
+export async function decapsulateBits(algorithm, decapsulationKey, ciphertext) {
+    return (await decap(algorithm, decapsulationKey, ciphertext)).buffer;
+}
+
+export async function decapsulateKey(algorithm, decapsulationKey, ciphertext,
+                                     sharedKeyAlgorithm, extractable, keyUsages) {
+    const ss = await decap(algorithm, decapsulationKey, ciphertext);
+    return importSharedKey(ss, sharedKeyAlgorithm, extractable, keyUsages);
+}
+
+/* ---- feature detection / registration ---- */
+
+const OPS = ["generateKey", "importKey", "exportKey",
+    "encapsulateBits", "encapsulateKey", "decapsulateBits", "decapsulateKey"];
+
+export function supports(operation, algorithm) {
+    if (algorithm !== undefined) {
+        try {
+            requireSuite(algorithm);
+        } catch {
+            return false;
+        }
+    }
+    return OPS.includes(operation);
+}
+
+const ops = {
+    generateKey, importKey,
+    encapsulateBits, encapsulateKey, decapsulateBits, decapsulateKey,
+    supports: (operation) => OPS.includes(operation),
+};
+
+/* Makes the DHKEM-* names routable through the subtlepq ponyfill `subtle`
+ * and, after install(), through crypto.subtle; call before install(). */
+export function register() {
+    for (const name of Object.keys(SUITES)) registerExtension(name, "kem", ops);
+}
+
+export function unregister() {
+    for (const name of Object.keys(SUITES)) unregisterExtension(name);
+}

package/src/engine.js

@@ -1,5 +1,5 @@
 /***************************************************************************
- * pqfill: lazy wasm engine loader + typed wrappers over pqfill_engine.c
+ * subtlepq: lazy wasm engine loader + typed wrappers over subtlepq_engine.c
  *
  * (c) 2026 VESvault Corp
  * SPDX-License-Identifier: Apache-2.0
@@ -18,7 +18,7 @@ export function getEngine() {
 }
 
 async function load() {
-    const { default: init } = await import("../wasm/dist/pqfill-engine.mjs");
+    const { default: init } = await import("../wasm/dist/subtlepq-engine.mjs");
     return new Engine(await init());
 }
 

package/src/errors.js

@@ -1,5 +1,5 @@
 /***************************************************************************
- * pqfill: DOMException helpers with WebCrypto-mandated error names
+ * subtlepq: DOMException helpers with WebCrypto-mandated error names
  *
  * (c) 2026 VESvault Corp
  * SPDX-License-Identifier: Apache-2.0

package/src/formats.js

@@ -0,0 +1,174 @@
+/***************************************************************************
+ * subtlepq: spki / pkcs8 / jwk codecs (fixed ASN.1 templates)
+ *
+ * (c) 2026 VESvault Corp
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * DER shapes per draft-ietf-lamps-kyber/dilithium-certificates as adopted
+ * by the WICG draft: SPKI AlgorithmIdentifier has NO parameters; PKCS#8
+ * privateKey is the seed-only CHOICE, an implicit [0] primitive holding
+ * the seed. Import also accepts the "both" CHOICE (seed + expandedKey,
+ * verified against each other); expandedKey-only is NotSupportedError.
+ ***************************************************************************/
+
+import * as E from "./errors.js";
+
+/* NIST algorithm arc: 2.16.840.1.101.3.4.{4=kem,3=sig}.n */
+const OIDS = {
+    "ML-KEM-512":  [0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x04, 0x01],
+    "ML-KEM-768":  [0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x04, 0x02],
+    "ML-KEM-1024": [0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x04, 0x03],
+    "ML-DSA-44":   [0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x03, 0x11],
+    "ML-DSA-65":   [0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x03, 0x12],
+    "ML-DSA-87":   [0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x03, 0x13],
+};
+
+function oidToName(body) {
+    for (const [name, oid] of Object.entries(OIDS)) {
+        if (oid.length === body.length && oid.every((b, i) => b === body[i])) return name;
+    }
+    return null;
+}
+
+/* ---- DER write ---- */
+
+function tlv(tag, ...parts) {
+    const len = parts.reduce((n, p) => n + p.length, 0);
+    const hdr = [tag];
+    if (len < 0x80) {
+        hdr.push(len);
+    } else {
+        const b = [];
+        for (let n = len; n; n >>>= 8) b.unshift(n & 0xff);
+        hdr.push(0x80 | b.length, ...b);
+    }
+    const out = new Uint8Array(hdr.length + len);
+    out.set(hdr);
+    let p = hdr.length;
+    for (const part of parts) { out.set(part, p); p += part.length; }
+    return out;
+}
+
+function algorithmIdentifier(name) {
+    return tlv(0x30, tlv(0x06, OIDS[name]));
+}
+
+/* ---- DER read ---- */
+
+class Reader {
+    constructor(u8, what) { this.u8 = u8; this.p = 0; this.what = what; }
+    bad(m) { return E.dataError("malformed " + this.what + ": " + m); }
+    tlv() {
+        if (this.p + 2 > this.u8.length) throw this.bad("truncated");
+        const tag = this.u8[this.p++];
+        let len = this.u8[this.p++];
+        if (len & 0x80) {
+            const n = len & 0x7f;
+            if (n < 1 || n > 4) throw this.bad("bad length encoding");
+            len = 0;
+            for (let i = 0; i < n; i++) {
+                if (this.p >= this.u8.length) throw this.bad("truncated");
+                len = len * 256 + this.u8[this.p++];
+            }
+        }
+        if (this.p + len > this.u8.length) throw this.bad("truncated");
+        const val = this.u8.subarray(this.p, this.p + len);
+        this.p += len;
+        return { tag, val };
+    }
+    expect(tag, m) {
+        const t = this.tlv();
+        if (t.tag !== tag) throw this.bad("expected " + m);
+        return t.val;
+    }
+    get done() { return this.p >= this.u8.length; }
+}
+
+function readAlgorithm(r, what) {
+    const seq = new Reader(r.expect(0x30, "AlgorithmIdentifier"), what);
+    const name = oidToName(seq.expect(0x06, "algorithm OID"));
+    if (!name) throw E.dataError(what + " algorithm OID is not an ML-KEM/ML-DSA algorithm");
+    if (!seq.done) throw E.dataError(what + " AlgorithmIdentifier parameters must be absent");
+    return name;
+}
+
+/* ---- SubjectPublicKeyInfo ---- */
+
+export function encodeSpki(name, pub) {
+    const bits = new Uint8Array(pub.length + 1);
+    bits.set(pub, 1);
+    return tlv(0x30, algorithmIdentifier(name), tlv(0x03, bits));
+}
+
+export function decodeSpki(bytes) {
+    const outer = new Reader(bytes, "SPKI");
+    const r = new Reader(outer.expect(0x30, "SubjectPublicKeyInfo"), "SPKI");
+    if (!outer.done) throw outer.bad("trailing bytes");
+    const name = readAlgorithm(r, "SPKI");
+    const bits = r.expect(0x03, "subjectPublicKey BIT STRING");
+    if (!r.done) throw r.bad("trailing bytes");
+    if (bits.length < 1 || bits[0] !== 0) throw r.bad("subjectPublicKey unused bits");
+    return { name, pub: bits.slice(1) };
+}
+
+/* ---- PrivateKeyInfo (seed-only CHOICE) ---- */
+
+export function encodePkcs8(name, seed) {
+    return tlv(0x30,
+        tlv(0x02, [0]),
+        algorithmIdentifier(name),
+        tlv(0x04, tlv(0x80, seed)));
+}
+
+/* Returns { name, seed, expanded? }; expanded (from the "both" CHOICE) is
+ * the caller's to verify against the seed-derived key. */
+export function decodePkcs8(bytes) {
+    const outer = new Reader(bytes, "PKCS#8");
+    const r = new Reader(outer.expect(0x30, "PrivateKeyInfo"), "PKCS#8");
+    if (!outer.done) throw outer.bad("trailing bytes");
+    const ver = r.expect(0x02, "version INTEGER");
+    if (ver.length !== 1 || ver[0] > 1) throw r.bad("unsupported version");
+    const name = readAlgorithm(r, "PKCS#8");
+    const inner = new Reader(r.expect(0x04, "privateKey OCTET STRING"), "PKCS#8");
+    /* anything after privateKey (attributes, [1] publicKey) is ignored */
+    const t = inner.tlv();
+    if (t.tag === 0x80) {                             /* seed [0] */
+        if (!inner.done) throw inner.bad("trailing bytes after seed");
+        return { name, seed: t.val.slice() };
+    }
+    if (t.tag === 0x04) {                             /* expandedKey */
+        throw E.notSupported(
+            "expandedKey-only ML private keys are not supported; provide the seed");
+    }
+    if (t.tag === 0x30) {                             /* both */
+        const b = new Reader(t.val, "PKCS#8");
+        const seed = b.expect(0x04, "seed OCTET STRING");
+        const expanded = b.expect(0x04, "expandedKey OCTET STRING");
+        if (!b.done || !inner.done) throw b.bad("trailing bytes");
+        return { name, seed: seed.slice(), expanded: expanded.slice() };
+    }
+    throw inner.bad("unrecognized private key CHOICE");
+}
+
+/* ---- JWK base64url ---- */
+
+export function b64u(bytes) {
+    let s = "";
+    for (const b of bytes) s += String.fromCharCode(b);
+    return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+export function unb64u(s, what) {
+    if (typeof s !== "string" || /[^A-Za-z0-9_-]/.test(s)) {
+        throw E.dataError("JWK " + what + " is not base64url");
+    }
+    let bin;
+    try {
+        bin = atob(s.replace(/-/g, "+").replace(/_/g, "/"));
+    } catch {
+        throw E.dataError("JWK " + what + " is not base64url");
+    }
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+    return out;
+}

package/src/index.js

@@ -1,5 +1,5 @@
 /***************************************************************************
- * pqfill: post-quantum polyfill for the Web Cryptography API
+ * subtlepq: post-quantum polyfill for the Web Cryptography API
  * ML-KEM (FIPS 203) + ML-DSA (FIPS 204) per the WICG Modern Algorithms
  * draft, with native delegation.
  *
@@ -12,7 +12,7 @@
  ***************************************************************************/
 
 import * as ours from "./subtle.js";
-import { ROUTES } from "./router.js";
+import { ROUTES, shape } from "./router.js";
 import * as E from "./errors.js";
 
 export { install, uninstall } from "./install.js";
@@ -21,13 +21,12 @@ export { supports } from "./subtle.js";
 const routedFns = {};
 function routed(op) {
     if (!routedFns[op]) {
-        routedFns[op] = function (...args) {
+        routedFns[op] = shape(op, (args) => {
             if (ROUTES[op](args)) return ours[op](...args);
             const ns = globalThis.crypto && globalThis.crypto.subtle;
             if (ns && typeof ns[op] === "function") return ns[op](...args);
-            return Promise.reject(E.notSupported(op + " is not supported"));
-        };
-        Object.defineProperty(routedFns[op], "name", { value: op });
+            throw E.notSupported(op + " is not supported");
+        });
     }
     return routedFns[op];
 }

package/src/install.js

@@ -1,18 +1,19 @@
 /***************************************************************************
- * pqfill: true-polyfill installer -- patches globalThis.crypto.subtle
+ * subtlepq: true-polyfill installer -- patches globalThis.crypto.subtle
  *
  * (c) 2026 VESvault Corp
  * SPDX-License-Identifier: Apache-2.0
  *
  * install() wraps SubtleCrypto.prototype methods so ML-* algorithms and
- * pqfill keys are handled here while every other call reaches the saved
+ * subtlepq keys are handled here while every other call reaches the saved
  * native original with untouched arguments. Methods and algorithms the
  * platform already supports natively are left alone (self-retiring).
  * uninstall() restores the originals.
  ***************************************************************************/
 
 import * as ours from "./subtle.js";
-import { ROUTES } from "./router.js";
+import { ROUTES, shape } from "./router.js";
+import { hasExtensions } from "./algorithms.js";
 import * as E from "./errors.js";
 
 let saved = null;
@@ -30,14 +31,17 @@ export function install() {
     if (saved) return;
     const subtle = globalThis.crypto && globalThis.crypto.subtle;
     if (!subtle) {
-        throw new Error("pqfill: crypto.subtle is unavailable (insecure context?)");
+        throw new Error("subtlepq: crypto.subtle is unavailable (insecure context?)");
     }
     const proto = Object.getPrototypeOf(subtle);
     const ctor = subtle.constructor;
     saved = { proto, ctor, methods: {}, supports: Object.getOwnPropertyDescriptor(ctor, "supports") };
 
-    /* nothing to do on platforms that already do ML-KEM + ML-DSA natively */
-    if (nativeSupports(ctor, "encapsulateBits", "ML-KEM-768") &&
+    /* nothing to do on platforms that already do ML-KEM + ML-DSA natively --
+     * unless extension algorithms (subtlepq/dhkem) are registered, which no
+     * native implementation covers; register() before install() */
+    if (!hasExtensions() &&
+        nativeSupports(ctor, "encapsulateBits", "ML-KEM-768") &&
         nativeSupports(ctor, "sign", "ML-DSA-65")) {
         return;
     }
@@ -45,12 +49,11 @@ export function install() {
     for (const [op, isOurs] of Object.entries(ROUTES)) {
         const orig = proto[op];
         saved.methods[op] = Object.getOwnPropertyDescriptor(proto, op);
-        const wrapped = async function (...args) {
+        const wrapped = shape(op, (args, self) => {
             if (isOurs(args)) return ours[op](...args);
-            if (typeof orig === "function") return orig.apply(this, args);
+            if (typeof orig === "function") return orig.apply(self, args);
             throw E.notSupported(op + " is not supported");
-        };
-        Object.defineProperty(wrapped, "name", { value: op });
+        });
         Object.defineProperty(proto, op, {
             value: wrapped, writable: true, configurable: true,
         });

package/src/keystore.js

@@ -1,5 +1,5 @@
 /***************************************************************************
- * pqfill: forged CryptoKey factory + private key-material store
+ * subtlepq: forged CryptoKey factory + private key-material store
  *
  * (c) 2026 VESvault Corp
  * SPDX-License-Identifier: Apache-2.0
@@ -29,8 +29,8 @@ export function forgeKey(type, algName, extractable, usages, material) {
         extractable: { value: !!extractable, enumerable: true },
         algorithm: { value: Object.freeze({ name: algName }), enumerable: true },
         usages: { value: Object.freeze([...usages]), enumerable: true },
-        __pqfill: {
-            value: Symbol("pqfill key: not structured-cloneable; export and re-import instead"),
+        __subtlepq: {
+            value: Symbol("subtlepq key: not structured-cloneable; export and re-import instead"),
             enumerable: true,
         },
     });

package/src/router.js

@@ -1,5 +1,5 @@
 /***************************************************************************
- * pqfill: dispatch rules shared by the ponyfill (index.js) and the
+ * subtlepq: dispatch rules shared by the ponyfill (index.js) and the
  * polyfill installer (install.js)
  *
  * (c) 2026 VESvault Corp
@@ -15,7 +15,7 @@ import { isOurKey } from "./keystore.js";
 
 const ours = (alg) => !!normalizeAlg(alg);
 
-/* args => should pqfill handle this call? -- keyed by SubtleCrypto method */
+/* args => should subtlepq handle this call? -- keyed by SubtleCrypto method */
 export const ROUTES = {
     /* wrapped existing methods */
     generateKey: (args) => ours(args[0]),
@@ -23,6 +23,10 @@ export const ROUTES = {
     exportKey: (args) => isOurKey(args[1]),
     sign: (args) => isOurKey(args[1]) || ours(args[0]),
     verify: (args) => isOurKey(args[1]) || ours(args[0]),
+    /* wrap/unwrap: ours when the wrapped key or either key handle is ours;
+     * (format, key, wrappingKey, ...) / (format, data, unwrappingKey, wrapAlg, keyAlg, ...) */
+    wrapKey: (args) => isOurKey(args[1]) || isOurKey(args[2]),
+    unwrapKey: (args) => ours(args[4]) || isOurKey(args[2]),
     /* methods added by the WICG draft */
     encapsulateBits: (args) => ours(args[0]) || isOurKey(args[1]),
     encapsulateKey: (args) => ours(args[0]) || isOurKey(args[1]),
@@ -30,3 +34,40 @@ export const ROUTES = {
     decapsulateKey: (args) => ours(args[0]) || isOurKey(args[1]),
     getPublicKey: (args) => isOurKey(args[0]),
 };
+
+/* Wrapper factories carrying the spec parameter lists, so consoles show real
+ * argument hints (and fn.length matches native) instead of (...args). Written
+ * out statically -- Function() codegen would break under strict CSP. Each
+ * forwards (arguments, this) to the routing handler; the async wrapper turns
+ * sync throws into rejections, as native SubtleCrypto does. */
+export const shape = (op, h) => SHAPES[op](h);
+
+const SHAPES = {
+    generateKey: (h) => async function generateKey(
+        algorithm, extractable, keyUsages) { return h(arguments, this); },
+    importKey: (h) => async function importKey(
+        format, keyData, algorithm, extractable, keyUsages) { return h(arguments, this); },
+    exportKey: (h) => async function exportKey(
+        format, key) { return h(arguments, this); },
+    sign: (h) => async function sign(
+        algorithm, key, data) { return h(arguments, this); },
+    verify: (h) => async function verify(
+        algorithm, key, signature, data) { return h(arguments, this); },
+    encapsulateBits: (h) => async function encapsulateBits(
+        algorithm, encapsulationKey) { return h(arguments, this); },
+    encapsulateKey: (h) => async function encapsulateKey(
+        algorithm, encapsulationKey, sharedKeyAlgorithm, extractable, keyUsages) {
+        return h(arguments, this); },
+    decapsulateBits: (h) => async function decapsulateBits(
+        algorithm, decapsulationKey, ciphertext) { return h(arguments, this); },
+    decapsulateKey: (h) => async function decapsulateKey(
+        algorithm, decapsulationKey, ciphertext, sharedKeyAlgorithm, extractable, keyUsages) {
+        return h(arguments, this); },
+    getPublicKey: (h) => async function getPublicKey(
+        key, keyUsages) { return h(arguments, this); },
+    wrapKey: (h) => async function wrapKey(
+        format, key, wrappingKey, wrapAlgorithm) { return h(arguments, this); },
+    unwrapKey: (h) => async function unwrapKey(
+        format, wrappedKey, unwrappingKey, unwrapAlgorithm, unwrappedKeyAlgorithm,
+        extractable, keyUsages) { return h(arguments, this); },
+};

package/src/subtle.js

@@ -1,5 +1,5 @@
 /***************************************************************************
- * pqfill: spec-shaped ML-KEM / ML-DSA operations
+ * subtlepq: spec-shaped ML-KEM / ML-DSA operations
  * per https://wicg.github.io/webcrypto-modern-algos/
  *
  * (c) 2026 VESvault Corp
@@ -17,11 +17,14 @@ import {
     normalizeAlg, KEM_PUB_USAGES, KEM_PRIV_USAGES,
 } from "./algorithms.js";
 import { forgeKey, materialOf, isOurKey } from "./keystore.js";
+import {
+    encodeSpki, decodeSpki, encodePkcs8, decodePkcs8, b64u, unb64u,
+} from "./formats.js";
 import * as E from "./errors.js";
 
 const rng = (n) => globalThis.crypto.getRandomValues(new Uint8Array(n));
 
-function toBytes(src, what) {
+export function toBytes(src, what) {
     if (ArrayBuffer.isView(src)) {
         return new Uint8Array(
             src.buffer.slice(src.byteOffset, src.byteOffset + src.byteLength));
@@ -66,7 +69,7 @@ function signContext(a) {
     return ctx;
 }
 
-async function importSharedKey(ssBytes, sharedKeyAlgorithm, extractable, keyUsages) {
+export async function importSharedKey(ssBytes, sharedKeyAlgorithm, extractable, keyUsages) {
     const ns = globalThis.crypto && globalThis.crypto.subtle;
     if (!ns) throw E.notSupported("no native SubtleCrypto to hold the shared key");
     try {
@@ -80,6 +83,7 @@ async function importSharedKey(ssBytes, sharedKeyAlgorithm, extractable, keyUsag
 
 export async function generateKey(algorithm, extractable, keyUsages = []) {
     const a = requireAlg(algorithm);
+    if (a.ops) return a.ops.generateKey(algorithm, extractable, keyUsages);
     const eng = await getEngine();
     if (a.kind === "kem") {
         checkUsages(keyUsages, [...KEM_PUB_USAGES, ...KEM_PRIV_USAGES]);
@@ -108,44 +112,116 @@ export async function generateKey(algorithm, extractable, keyUsages = []) {
 
 export async function importKey(format, keyData, algorithm, extractable, keyUsages = []) {
     const a = requireAlg(algorithm);
+    if (a.ops) return a.ops.importKey(format, keyData, algorithm, extractable, keyUsages);
     const eng = await getEngine();
     const L = a.kind === "kem" ? eng.kemLengths(a.name) : eng.sigLengths(a.name);
     const pubUsages = a.kind === "kem" ? KEM_PUB_USAGES : ["verify"];
     const privUsages = a.kind === "kem" ? KEM_PRIV_USAGES : ["sign"];
 
-    if (format === "raw-public") {
+    const importPub = (pub) => {
         checkUsages(keyUsages, pubUsages);
-        const pub = toBytes(keyData, "keyData");
         if (pub.length !== L.pk) throw E.dataError("bad " + a.name + " public key length");
         return forgeKey("public", a.name, extractable, keyUsages, { pub });
-    }
-    if (format === "raw-seed") {
+    };
+    /* expanded (pkcs8 "both" / jwk pub): must agree with the seed-derived value */
+    const importSeed = (seed, expanded, expect) => {
         checkUsages(keyUsages, privUsages);
         if (!keyUsages.length) throw E.syntaxError("private key usages must not be empty");
-        const seed = toBytes(keyData, "keyData");
         if (seed.length !== L.seed) throw E.dataError("bad " + a.name + " seed length");
         const { pub, sk } = a.kind === "kem"
             ? eng.kemKeypairDerand(a.name, seed)
             : eng.sigKeypairDerand(a.name, seed);
+        if (expanded && !bytesEqual(expanded, expect === "pub" ? pub : sk)) {
+            throw E.dataError(a.name + " seed and " +
+                (expect === "pub" ? "public key" : "expandedKey") + " do not match");
+        }
         return forgeKey("private", a.name, extractable, keyUsages, { pub, seed, sk });
+    };
+
+    if (format === "raw-public") return importPub(toBytes(keyData, "keyData"));
+    if (format === "raw-seed") return importSeed(toBytes(keyData, "keyData"));
+    if (format === "spki") {
+        const { name, pub } = decodeSpki(toBytes(keyData, "keyData"));
+        if (name !== a.name) throw E.dataError("SPKI algorithm is " + name + ", not " + a.name);
+        return importPub(pub);
+    }
+    if (format === "pkcs8") {
+        const { name, seed, expanded } = decodePkcs8(toBytes(keyData, "keyData"));
+        if (name !== a.name) throw E.dataError("PKCS#8 algorithm is " + name + ", not " + a.name);
+        return importSeed(seed, expanded, "sk");
+    }
+    if (format === "jwk") return importJwk(keyData, a, extractable, importPub, importSeed);
+    throw E.notSupported("key format " + format + " is not supported");
+}
+
+function bytesEqual(x, y) {
+    if (x.length !== y.length) return false;
+    let d = 0;
+    for (let i = 0; i < x.length; i++) d |= x[i] ^ y[i];
+    return d === 0;
+}
+
+function importJwk(jwk, a, extractable, importPub, importSeed) {
+    if (!jwk || typeof jwk !== "object" || ArrayBuffer.isView(jwk) ||
+            jwk instanceof ArrayBuffer) {
+        throw E.dataError("jwk import expects a JsonWebKey object");
     }
-    /* spki / pkcs8 / jwk land in P2 */
-    throw E.notSupported("key format " + format + " is not supported yet");
+    if (jwk.kty !== "AKP") throw E.dataError('JWK kty must be "AKP"');
+    if (jwk.alg !== undefined && jwk.alg !== a.name) {
+        throw E.dataError("JWK alg does not match " + a.name);
+    }
+    if (jwk.ext === false && extractable) {
+        throw E.dataError("JWK ext forbids an extractable key");
+    }
+    const checkOps = (usages) => {
+        if (jwk.key_ops === undefined) return;
+        if (!Array.isArray(jwk.key_ops)) throw E.dataError("JWK key_ops must be an array");
+        for (const u of usages) {
+            if (!jwk.key_ops.includes(u)) {
+                throw E.dataError("JWK key_ops does not permit " + u);
+            }
+        }
+    };
+    if (jwk.priv !== undefined) {
+        const key = importSeed(unb64u(jwk.priv, "priv"),
+            jwk.pub === undefined ? null : unb64u(jwk.pub, "pub"), "pub");
+        checkOps(key.usages);
+        return key;
+    }
+    if (jwk.pub === undefined) throw E.dataError("JWK has neither pub nor priv");
+    const key = importPub(unb64u(jwk.pub, "pub"));
+    checkOps(key.usages);
+    return key;
 }
 
 export async function exportKey(format, key) {
     const a = requireAlg(key && key.algorithm && key.algorithm.name);
     const m = requireKey(key, a, key.type, null);
     if (!key.extractable) throw E.invalidAccess("key is not extractable");
-    if (format === "raw-public") {
-        if (key.type !== "public") throw E.invalidAccess("raw-public exports public keys");
-        return m.pub.slice().buffer;
-    }
-    if (format === "raw-seed") {
-        if (key.type !== "private") throw E.invalidAccess("raw-seed exports private keys");
-        return m.seed.slice().buffer;
+    const pub = () => {
+        if (key.type !== "public") throw E.invalidAccess(format + " exports public keys");
+        return m.pub;
+    };
+    const seed = () => {
+        if (key.type !== "private") throw E.invalidAccess(format + " exports private keys");
+        return m.seed;
+    };
+    if (format === "raw-public") return pub().slice().buffer;
+    if (format === "raw-seed") return seed().slice().buffer;
+    if (format === "spki") return encodeSpki(a.name, pub()).buffer;
+    if (format === "pkcs8") return encodePkcs8(a.name, seed()).buffer;
+    if (format === "jwk") {
+        const jwk = {
+            kty: "AKP",
+            alg: a.name,
+            pub: b64u(m.pub),
+            key_ops: [...key.usages],
+            ext: key.extractable,
+        };
+        if (key.type === "private") jwk.priv = b64u(seed());
+        return jwk;
     }
-    throw E.notSupported("key format " + format + " is not supported yet");
+    throw E.notSupported("key format " + format + " is not supported");
 }
 
 export async function getPublicKey(key, keyUsages = []) {
@@ -160,6 +236,7 @@ export async function getPublicKey(key, keyUsages = []) {
 
 export async function encapsulateBits(algorithm, encapsulationKey) {
     const a = requireAlg(algorithm, "kem");
+    if (a.ops) return a.ops.encapsulateBits(algorithm, encapsulationKey);
     const m = requireKey(encapsulationKey, a, "public", "encapsulateBits");
     const { ct, ss } = (await getEngine()).kemEncaps(a.name, m.pub);
     return { sharedKey: ss.buffer, ciphertext: ct.buffer };
@@ -168,6 +245,10 @@ export async function encapsulateBits(algorithm, encapsulationKey) {
 export async function encapsulateKey(algorithm, encapsulationKey,
                                      sharedKeyAlgorithm, extractable, keyUsages) {
     const a = requireAlg(algorithm, "kem");
+    if (a.ops) {
+        return a.ops.encapsulateKey(algorithm, encapsulationKey,
+            sharedKeyAlgorithm, extractable, keyUsages);
+    }
     const m = requireKey(encapsulationKey, a, "public", "encapsulateKey");
     const { ct, ss } = (await getEngine()).kemEncaps(a.name, m.pub);
     const sharedKey = await importSharedKey(ss, sharedKeyAlgorithm, extractable, keyUsages);
@@ -176,6 +257,7 @@ export async function encapsulateKey(algorithm, encapsulationKey,
 
 export async function decapsulateBits(algorithm, decapsulationKey, ciphertext) {
     const a = requireAlg(algorithm, "kem");
+    if (a.ops) return a.ops.decapsulateBits(algorithm, decapsulationKey, ciphertext);
     const m = requireKey(decapsulationKey, a, "private", "decapsulateBits");
     const eng = await getEngine();
     const ct = toBytes(ciphertext, "ciphertext");
@@ -188,6 +270,10 @@ export async function decapsulateBits(algorithm, decapsulationKey, ciphertext) {
 export async function decapsulateKey(algorithm, decapsulationKey, ciphertext,
                                      sharedKeyAlgorithm, extractable, keyUsages) {
     const a = requireAlg(algorithm, "kem");
+    if (a.ops) {
+        return a.ops.decapsulateKey(algorithm, decapsulationKey, ciphertext,
+            sharedKeyAlgorithm, extractable, keyUsages);
+    }
     const m = requireKey(decapsulationKey, a, "private", "decapsulateKey");
     const eng = await getEngine();
     const ct = toBytes(ciphertext, "ciphertext");
@@ -216,6 +302,77 @@ export async function verify(algorithm, key, signature, data) {
         a.name, m.pub, toBytes(data, "data"), ctx, toBytes(signature, "signature"));
 }
 
+/* ---- wrapKey / unwrapKey: exportKey + native wrap composition ----
+ *
+ * The exported bytes ride through the native wrapKey/unwrapKey inside a
+ * throwaway raw-imported HMAC key, so the wrap algorithm gets the native
+ * spec-defined treatment (encrypt for AES-GCM/RSA-OAEP, key wrap for
+ * AES-KW) and the wrapping key's own usages are enforced natively. */
+
+function nativeSubtle() {
+    const ns = globalThis.crypto && globalThis.crypto.subtle;
+    if (!ns) throw E.notSupported("no native SubtleCrypto for key wrapping");
+    return ns;
+}
+
+const CARRIER = { name: "HMAC", hash: "SHA-256" };
+
+export async function wrapKey(format, key, wrappingKey, wrapAlgorithm) {
+    if (isOurKey(wrappingKey)) {
+        throw E.invalidAccess("ML-KEM/ML-DSA keys cannot wrap other keys");
+    }
+    if (!isOurKey(key)) {
+        throw E.invalidAccess("key is not from this polyfill");
+    }
+    const exported = await exportKey(format, key);
+    let bytes = format === "jwk"
+        ? new TextEncoder().encode(JSON.stringify(exported))
+        : new Uint8Array(exported);
+    /* WebCrypto pads JWK JSON with spaces to the AES-KW 8-byte multiple */
+    const wrapName = wrapAlgorithm && wrapAlgorithm.name || wrapAlgorithm;
+    if (format === "jwk" && bytes.length % 8 &&
+            String(wrapName).toUpperCase() === "AES-KW") {
+        const padded = new Uint8Array(Math.ceil(bytes.length / 8) * 8).fill(0x20);
+        padded.set(bytes);
+        bytes.fill(0);
+        bytes = padded;
+    }
+    const ns = nativeSubtle();
+    try {
+        const carrier = await ns.importKey("raw", bytes, CARRIER, true, ["sign"]);
+        return await ns.wrapKey("raw", carrier, wrappingKey, wrapAlgorithm);
+    } finally {
+        bytes.fill(0);
+    }
+}
+
+export async function unwrapKey(format, wrappedKey, unwrappingKey, unwrapAlgorithm,
+                                unwrappedKeyAlgorithm, extractable, keyUsages) {
+    if (isOurKey(unwrappingKey)) {
+        throw E.invalidAccess("ML-KEM/ML-DSA keys cannot unwrap other keys");
+    }
+    requireAlg(unwrappedKeyAlgorithm);
+    const ns = nativeSubtle();
+    const carrier = await ns.unwrapKey("raw", wrappedKey, unwrappingKey,
+        unwrapAlgorithm, CARRIER, true, ["sign"]);
+    const bytes = new Uint8Array(await ns.exportKey("raw", carrier));
+    let keyData = bytes;
+    if (format === "jwk") {
+        try {
+            keyData = JSON.parse(new TextDecoder().decode(bytes));
+        } catch {
+            throw E.dataError("unwrapped data is not JWK JSON");
+        } finally {
+            bytes.fill(0);
+        }
+    }
+    try {
+        return await importKey(format, keyData, unwrappedKeyAlgorithm, extractable, keyUsages);
+    } finally {
+        if (keyData instanceof Uint8Array) keyData.fill(0);
+    }
+}
+
 /* ---- feature detection ---- */
 
 const OPS = {
@@ -226,5 +383,7 @@ const OPS = {
 
 export function supports(operation, algorithm) {
     const a = normalizeAlg(algorithm);
-    return a ? OPS[a.kind].includes(operation) : false;
+    if (!a) return false;
+    if (a.ops) return a.ops.supports(operation);
+    return OPS[a.kind].includes(operation);
 }

package/wasm/dist/subtlepq-engine.mjs

@@ -0,0 +1,2 @@
+async function SubtlePQEngine(moduleArg={}){var moduleRtn;var Module=moduleArg;var ENVIRONMENT_IS_WEB=!!globalThis.window;var ENVIRONMENT_IS_WORKER=!!globalThis.WorkerGlobalScope;var ENVIRONMENT_IS_NODE=globalThis.process?.versions?.node&&globalThis.process?.type!="renderer";if(ENVIRONMENT_IS_NODE){const{createRequire}=await import("node:module");var require=createRequire(import.meta.url)}var arguments_=[];var thisProgram="./this.program";var quit_=(status,toThrow)=>{throw toThrow};var _scriptName=import.meta.url;var scriptDirectory="";function locateFile(path){if(Module["locateFile"]){return Module["locateFile"](path,scriptDirectory)}return scriptDirectory+path}var readAsync,readBinary;if(ENVIRONMENT_IS_NODE){var fs=require("node:fs");if(_scriptName.startsWith("file:")){scriptDirectory=require("node:path").dirname(require("node:url").fileURLToPath(_scriptName))+"/"}readBinary=filename=>{filename=isFileURI(filename)?new URL(filename):filename;var ret=fs.readFileSync(filename);return ret};readAsync=async(filename,binary=true)=>{filename=isFileURI(filename)?new URL(filename):filename;var ret=fs.readFileSync(filename,binary?undefined:"utf8");return ret};if(process.argv.length>1){thisProgram=process.argv[1].replace(/\\/g,"/")}arguments_=process.argv.slice(2);quit_=(status,toThrow)=>{process.exitCode=status;throw toThrow}}else if(ENVIRONMENT_IS_WEB||ENVIRONMENT_IS_WORKER){try{scriptDirectory=new URL(".",_scriptName).href}catch{}{if(ENVIRONMENT_IS_WORKER){readBinary=url=>{var xhr=new XMLHttpRequest;xhr.open("GET",url,false);xhr.responseType="arraybuffer";xhr.send(null);return new Uint8Array(xhr.response)}}readAsync=async url=>{if(isFileURI(url)){return new Promise((resolve,reject)=>{var xhr=new XMLHttpRequest;xhr.open("GET",url,true);xhr.responseType="arraybuffer";xhr.onload=()=>{if(xhr.status==200||xhr.status==0&&xhr.response){resolve(xhr.response);return}reject(xhr.status)};xhr.onerror=reject;xhr.send(null)})}var response=await fetch(url,{credentials:"same-origin"});if(response.ok){return response.arrayBuffer()}throw new Error(response.status+" : "+response.url)}}}else{}var out=console.log.bind(console);var err=console.error.bind(console);var wasmBinary;var ABORT=false;var EXITSTATUS;var isFileURI=filename=>filename.startsWith("file://");class EmscriptenEH{}class EmscriptenSjLj extends EmscriptenEH{}var readyPromiseResolve,readyPromiseReject;var runtimeInitialized=false;function updateMemoryViews(){var b=wasmMemory.buffer;HEAP8=new Int8Array(b);HEAP16=new Int16Array(b);Module["HEAPU8"]=HEAPU8=new Uint8Array(b);HEAPU16=new Uint16Array(b);HEAP32=new Int32Array(b);HEAPU32=new Uint32Array(b);HEAPF32=new Float32Array(b);HEAPF64=new Float64Array(b);HEAP64=new BigInt64Array(b);HEAPU64=new BigUint64Array(b)}function preRun(){if(Module["preRun"]){if(typeof Module["preRun"]=="function")Module["preRun"]=[Module["preRun"]];while(Module["preRun"].length){addOnPreRun(Module["preRun"].shift())}}callRuntimeCallbacks(onPreRuns)}function initRuntime(){runtimeInitialized=true;wasmExports["f"]()}function postRun(){if(Module["postRun"]){if(typeof Module["postRun"]=="function")Module["postRun"]=[Module["postRun"]];while(Module["postRun"].length){addOnPostRun(Module["postRun"].shift())}}callRuntimeCallbacks(onPostRuns)}function abort(what){Module["onAbort"]?.(what);what=`Aborted(${what})`;err(what);ABORT=true;what+=". Build with -sASSERTIONS for more info.";var e=new WebAssembly.RuntimeError(what);readyPromiseReject?.(e);throw e}var wasmBinaryFile;function findWasmBinary(){if(Module["locateFile"]){return locateFile("subtlepq-engine.wasm")}return new URL("subtlepq-engine.wasm",import.meta.url).href}function getBinarySync(file){if(file==wasmBinaryFile&&wasmBinary){return new Uint8Array(wasmBinary)}if(readBinary){return readBinary(file)}throw"both async and sync fetching of the wasm failed"}async function getWasmBinary(binaryFile){if(!wasmBinary){try{var response=await readAsync(binaryFile);return new Uint8Array(response)}catch{}}return getBinarySync(binaryFile)}async function instantiateArrayBuffer(binaryFile,imports){try{var binary=await getWasmBinary(binaryFile);var instance=await WebAssembly.instantiate(binary,imports);return instance}catch(reason){err(`failed to asynchronously prepare wasm: ${reason}`);abort(reason)}}async function instantiateAsync(binary,binaryFile,imports){if(!binary&&!isFileURI(binaryFile)&&!ENVIRONMENT_IS_NODE){try{var response=fetch(binaryFile,{credentials:"same-origin"});var instantiationResult=await WebAssembly.instantiateStreaming(response,imports);return instantiationResult}catch(reason){err(`wasm streaming compile failed: ${reason}`);err("falling back to ArrayBuffer instantiation")}}return instantiateArrayBuffer(binaryFile,imports)}function getWasmImports(){var imports={a:wasmImports};return imports}async function createWasm(){function receiveInstance(instance,module){wasmExports=instance.exports;assignWasmExports(wasmExports);updateMemoryViews();return wasmExports}function receiveInstantiationResult(result){return receiveInstance(result["instance"])}var info=getWasmImports();if(Module["instantiateWasm"]){return new Promise((resolve,reject)=>{Module["instantiateWasm"](info,(inst,mod)=>{resolve(receiveInstance(inst,mod))})})}wasmBinaryFile??=findWasmBinary();var result=await instantiateAsync(wasmBinary,wasmBinaryFile,info);var exports=receiveInstantiationResult(result);return exports}class ExitStatus{name="ExitStatus";constructor(status){this.message=`Program terminated with exit(${status})`;this.status=status}}var HEAP16;var HEAP32;var HEAP64;var HEAP8;var HEAPF32;var HEAPF64;var HEAPU16;var HEAPU32;var HEAPU64;var HEAPU8;var callRuntimeCallbacks=callbacks=>{while(callbacks.length>0){callbacks.shift()(Module)}};var onPostRuns=[];var addOnPostRun=cb=>onPostRuns.push(cb);var onPreRuns=[];var addOnPreRun=cb=>onPreRuns.push(cb);var noExitRuntime=true;var getHeapMax=()=>2147483648;var alignMemory=(size,alignment)=>Math.ceil(size/alignment)*alignment;var growMemory=size=>{var oldHeapSize=wasmMemory.buffer.byteLength;var pages=(size-oldHeapSize+65535)/65536|0;try{wasmMemory.grow(pages);updateMemoryViews();return 1}catch(e){}};var _emscripten_resize_heap=requestedSize=>{var oldSize=HEAPU8.length;requestedSize>>>=0;var maxHeapSize=getHeapMax();if(requestedSize>maxHeapSize){return false}for(var cutDown=1;cutDown<=4;cutDown*=2){var overGrownHeapSize=oldSize*(1+.2/cutDown);overGrownHeapSize=Math.min(overGrownHeapSize,requestedSize+100663296);var newSize=Math.min(maxHeapSize,alignMemory(Math.max(requestedSize,overGrownHeapSize),65536));var replacement=growMemory(newSize);if(replacement){return true}}return false};var runtimeKeepaliveCounter=0;var keepRuntimeAlive=()=>noExitRuntime||runtimeKeepaliveCounter>0;var _proc_exit=code=>{EXITSTATUS=code;if(!keepRuntimeAlive()){Module["onExit"]?.(code);ABORT=true}quit_(code,new ExitStatus(code))};var exitJS=(status,implicit)=>{EXITSTATUS=status;_proc_exit(status)};var _exit=exitJS;var printCharBuffers=[null,[],[]];var UTF8Decoder=globalThis.TextDecoder&&new TextDecoder;var findStringEnd=(heapOrArray,idx,maxBytesToRead,ignoreNul)=>{var maxIdx=idx+maxBytesToRead;if(ignoreNul)return maxIdx;while(heapOrArray[idx]&&!(idx>=maxIdx))++idx;return idx};var UTF8ArrayToString=(heapOrArray,idx=0,maxBytesToRead,ignoreNul)=>{var endPtr=findStringEnd(heapOrArray,idx,maxBytesToRead,ignoreNul);if(endPtr-idx>16&&heapOrArray.buffer&&UTF8Decoder){return UTF8Decoder.decode(heapOrArray.subarray(idx,endPtr))}var str="";while(idx<endPtr){var u0=heapOrArray[idx++];if(!(u0&128)){str+=String.fromCharCode(u0);continue}var u1=heapOrArray[idx++]&63;if((u0&224)==192){str+=String.fromCharCode((u0&31)<<6|u1);continue}var u2=heapOrArray[idx++]&63;if((u0&240)==224){u0=(u0&15)<<12|u1<<6|u2}else{u0=(u0&7)<<18|u1<<12|u2<<6|heapOrArray[idx++]&63}if(u0<65536){str+=String.fromCharCode(u0)}else{var ch=u0-65536;str+=String.fromCharCode(55296|ch>>10,56320|ch&1023)}}return str};var printChar=(stream,curr)=>{var buffer=printCharBuffers[stream];if(curr===0||curr===10){(stream===1?out:err)(UTF8ArrayToString(buffer));buffer.length=0}else{buffer.push(curr)}};var _fd_write=(fd,iov,iovcnt,pnum)=>{var num=0;for(var i=0;i<iovcnt;i++){var ptr=HEAPU32[iov>>2];var len=HEAPU32[iov+4>>2];iov+=8;for(var j=0;j<len;j++){printChar(fd,HEAPU8[ptr+j])}num+=len}HEAPU32[pnum>>2]=num;return 0};var initRandomFill=()=>{if(ENVIRONMENT_IS_NODE){var nodeCrypto=require("node:crypto");return view=>nodeCrypto.randomFillSync(view)}return view=>(crypto.getRandomValues(view),0)};var randomFill=view=>(randomFill=initRandomFill())(view);var _random_get=(buffer,size)=>randomFill(HEAPU8.subarray(buffer,buffer+size));{if(Module["noExitRuntime"])noExitRuntime=Module["noExitRuntime"];if(Module["print"])out=Module["print"];if(Module["printErr"])err=Module["printErr"];if(Module["wasmBinary"])wasmBinary=Module["wasmBinary"];if(Module["arguments"])arguments_=Module["arguments"];if(Module["thisProgram"])thisProgram=Module["thisProgram"];if(Module["preInit"]){if(typeof Module["preInit"]=="function")Module["preInit"]=[Module["preInit"]];while(Module["preInit"].length>0){Module["preInit"].shift()()}}}var _pqf_kem_lengths,_free,_malloc,_pqf_kem_keypair,_pqf_kem_keypair_derand,_pqf_kem_encaps,_pqf_kem_encaps_derand,_pqf_kem_decaps,_pqf_sig_lengths,_pqf_sig_keypair,_pqf_sig_keypair_derand,_pqf_sig_sign,_pqf_sig_sign_derand,_pqf_sig_verify,_pqf_liboqs_version,memory,__indirect_function_table,wasmMemory;function assignWasmExports(wasmExports){_pqf_kem_lengths=Module["_pqf_kem_lengths"]=wasmExports["g"];_free=Module["_free"]=wasmExports["h"];_malloc=Module["_malloc"]=wasmExports["i"];_pqf_kem_keypair=Module["_pqf_kem_keypair"]=wasmExports["j"];_pqf_kem_keypair_derand=Module["_pqf_kem_keypair_derand"]=wasmExports["k"];_pqf_kem_encaps=Module["_pqf_kem_encaps"]=wasmExports["l"];_pqf_kem_encaps_derand=Module["_pqf_kem_encaps_derand"]=wasmExports["m"];_pqf_kem_decaps=Module["_pqf_kem_decaps"]=wasmExports["n"];_pqf_sig_lengths=Module["_pqf_sig_lengths"]=wasmExports["o"];_pqf_sig_keypair=Module["_pqf_sig_keypair"]=wasmExports["p"];_pqf_sig_keypair_derand=Module["_pqf_sig_keypair_derand"]=wasmExports["q"];_pqf_sig_sign=Module["_pqf_sig_sign"]=wasmExports["r"];_pqf_sig_sign_derand=Module["_pqf_sig_sign_derand"]=wasmExports["s"];_pqf_sig_verify=Module["_pqf_sig_verify"]=wasmExports["t"];_pqf_liboqs_version=Module["_pqf_liboqs_version"]=wasmExports["u"];memory=wasmMemory=wasmExports["e"];__indirect_function_table=wasmExports["__indirect_function_table"]}var wasmImports={c:_emscripten_resize_heap,a:_exit,b:_fd_write,d:_random_get};function run(){preRun();function doRun(){Module["calledRun"]=true;if(ABORT)return;initRuntime();readyPromiseResolve?.(Module);Module["onRuntimeInitialized"]?.();postRun()}if(Module["setStatus"]){Module["setStatus"]("Running...");setTimeout(()=>{setTimeout(()=>Module["setStatus"](""),1);doRun()},1)}else{doRun()}}var wasmExports;wasmExports=await (createWasm());run();if(runtimeInitialized){moduleRtn=Module}else{moduleRtn=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=reject})}
+;return moduleRtn}export default SubtlePQEngine;

package/wasm/dist/pqfill-engine.mjs

@@ -1,2 +0,0 @@
-async function PQFillEngine(moduleArg={}){var moduleRtn;var Module=moduleArg;var ENVIRONMENT_IS_WEB=!!globalThis.window;var ENVIRONMENT_IS_WORKER=!!globalThis.WorkerGlobalScope;var ENVIRONMENT_IS_NODE=globalThis.process?.versions?.node&&globalThis.process?.type!="renderer";if(ENVIRONMENT_IS_NODE){const{createRequire}=await import("node:module");var require=createRequire(import.meta.url)}var arguments_=[];var thisProgram="./this.program";var quit_=(status,toThrow)=>{throw toThrow};var _scriptName=import.meta.url;var scriptDirectory="";function locateFile(path){if(Module["locateFile"]){return Module["locateFile"](path,scriptDirectory)}return scriptDirectory+path}var readAsync,readBinary;if(ENVIRONMENT_IS_NODE){var fs=require("node:fs");if(_scriptName.startsWith("file:")){scriptDirectory=require("node:path").dirname(require("node:url").fileURLToPath(_scriptName))+"/"}readBinary=filename=>{filename=isFileURI(filename)?new URL(filename):filename;var ret=fs.readFileSync(filename);return ret};readAsync=async(filename,binary=true)=>{filename=isFileURI(filename)?new URL(filename):filename;var ret=fs.readFileSync(filename,binary?undefined:"utf8");return ret};if(process.argv.length>1){thisProgram=process.argv[1].replace(/\\/g,"/")}arguments_=process.argv.slice(2);quit_=(status,toThrow)=>{process.exitCode=status;throw toThrow}}else if(ENVIRONMENT_IS_WEB||ENVIRONMENT_IS_WORKER){try{scriptDirectory=new URL(".",_scriptName).href}catch{}{if(ENVIRONMENT_IS_WORKER){readBinary=url=>{var xhr=new XMLHttpRequest;xhr.open("GET",url,false);xhr.responseType="arraybuffer";xhr.send(null);return new Uint8Array(xhr.response)}}readAsync=async url=>{if(isFileURI(url)){return new Promise((resolve,reject)=>{var xhr=new XMLHttpRequest;xhr.open("GET",url,true);xhr.responseType="arraybuffer";xhr.onload=()=>{if(xhr.status==200||xhr.status==0&&xhr.response){resolve(xhr.response);return}reject(xhr.status)};xhr.onerror=reject;xhr.send(null)})}var response=await fetch(url,{credentials:"same-origin"});if(response.ok){return response.arrayBuffer()}throw new Error(response.status+" : "+response.url)}}}else{}var out=console.log.bind(console);var err=console.error.bind(console);var wasmBinary;var ABORT=false;var EXITSTATUS;var isFileURI=filename=>filename.startsWith("file://");class EmscriptenEH{}class EmscriptenSjLj extends EmscriptenEH{}var readyPromiseResolve,readyPromiseReject;var runtimeInitialized=false;function updateMemoryViews(){var b=wasmMemory.buffer;HEAP8=new Int8Array(b);HEAP16=new Int16Array(b);Module["HEAPU8"]=HEAPU8=new Uint8Array(b);HEAPU16=new Uint16Array(b);HEAP32=new Int32Array(b);HEAPU32=new Uint32Array(b);HEAPF32=new Float32Array(b);HEAPF64=new Float64Array(b);HEAP64=new BigInt64Array(b);HEAPU64=new BigUint64Array(b)}function preRun(){if(Module["preRun"]){if(typeof Module["preRun"]=="function")Module["preRun"]=[Module["preRun"]];while(Module["preRun"].length){addOnPreRun(Module["preRun"].shift())}}callRuntimeCallbacks(onPreRuns)}function initRuntime(){runtimeInitialized=true;wasmExports["f"]()}function postRun(){if(Module["postRun"]){if(typeof Module["postRun"]=="function")Module["postRun"]=[Module["postRun"]];while(Module["postRun"].length){addOnPostRun(Module["postRun"].shift())}}callRuntimeCallbacks(onPostRuns)}function abort(what){Module["onAbort"]?.(what);what=`Aborted(${what})`;err(what);ABORT=true;what+=". Build with -sASSERTIONS for more info.";var e=new WebAssembly.RuntimeError(what);readyPromiseReject?.(e);throw e}var wasmBinaryFile;function findWasmBinary(){if(Module["locateFile"]){return locateFile("pqfill-engine.wasm")}return new URL("pqfill-engine.wasm",import.meta.url).href}function getBinarySync(file){if(file==wasmBinaryFile&&wasmBinary){return new Uint8Array(wasmBinary)}if(readBinary){return readBinary(file)}throw"both async and sync fetching of the wasm failed"}async function getWasmBinary(binaryFile){if(!wasmBinary){try{var response=await readAsync(binaryFile);return new Uint8Array(response)}catch{}}return getBinarySync(binaryFile)}async function instantiateArrayBuffer(binaryFile,imports){try{var binary=await getWasmBinary(binaryFile);var instance=await WebAssembly.instantiate(binary,imports);return instance}catch(reason){err(`failed to asynchronously prepare wasm: ${reason}`);abort(reason)}}async function instantiateAsync(binary,binaryFile,imports){if(!binary&&!isFileURI(binaryFile)&&!ENVIRONMENT_IS_NODE){try{var response=fetch(binaryFile,{credentials:"same-origin"});var instantiationResult=await WebAssembly.instantiateStreaming(response,imports);return instantiationResult}catch(reason){err(`wasm streaming compile failed: ${reason}`);err("falling back to ArrayBuffer instantiation")}}return instantiateArrayBuffer(binaryFile,imports)}function getWasmImports(){var imports={a:wasmImports};return imports}async function createWasm(){function receiveInstance(instance,module){wasmExports=instance.exports;assignWasmExports(wasmExports);updateMemoryViews();return wasmExports}function receiveInstantiationResult(result){return receiveInstance(result["instance"])}var info=getWasmImports();if(Module["instantiateWasm"]){return new Promise((resolve,reject)=>{Module["instantiateWasm"](info,(inst,mod)=>{resolve(receiveInstance(inst,mod))})})}wasmBinaryFile??=findWasmBinary();var result=await instantiateAsync(wasmBinary,wasmBinaryFile,info);var exports=receiveInstantiationResult(result);return exports}class ExitStatus{name="ExitStatus";constructor(status){this.message=`Program terminated with exit(${status})`;this.status=status}}var HEAP16;var HEAP32;var HEAP64;var HEAP8;var HEAPF32;var HEAPF64;var HEAPU16;var HEAPU32;var HEAPU64;var HEAPU8;var callRuntimeCallbacks=callbacks=>{while(callbacks.length>0){callbacks.shift()(Module)}};var onPostRuns=[];var addOnPostRun=cb=>onPostRuns.push(cb);var onPreRuns=[];var addOnPreRun=cb=>onPreRuns.push(cb);var noExitRuntime=true;var getHeapMax=()=>2147483648;var alignMemory=(size,alignment)=>Math.ceil(size/alignment)*alignment;var growMemory=size=>{var oldHeapSize=wasmMemory.buffer.byteLength;var pages=(size-oldHeapSize+65535)/65536|0;try{wasmMemory.grow(pages);updateMemoryViews();return 1}catch(e){}};var _emscripten_resize_heap=requestedSize=>{var oldSize=HEAPU8.length;requestedSize>>>=0;var maxHeapSize=getHeapMax();if(requestedSize>maxHeapSize){return false}for(var cutDown=1;cutDown<=4;cutDown*=2){var overGrownHeapSize=oldSize*(1+.2/cutDown);overGrownHeapSize=Math.min(overGrownHeapSize,requestedSize+100663296);var newSize=Math.min(maxHeapSize,alignMemory(Math.max(requestedSize,overGrownHeapSize),65536));var replacement=growMemory(newSize);if(replacement){return true}}return false};var runtimeKeepaliveCounter=0;var keepRuntimeAlive=()=>noExitRuntime||runtimeKeepaliveCounter>0;var _proc_exit=code=>{EXITSTATUS=code;if(!keepRuntimeAlive()){Module["onExit"]?.(code);ABORT=true}quit_(code,new ExitStatus(code))};var exitJS=(status,implicit)=>{EXITSTATUS=status;_proc_exit(status)};var _exit=exitJS;var printCharBuffers=[null,[],[]];var UTF8Decoder=globalThis.TextDecoder&&new TextDecoder;var findStringEnd=(heapOrArray,idx,maxBytesToRead,ignoreNul)=>{var maxIdx=idx+maxBytesToRead;if(ignoreNul)return maxIdx;while(heapOrArray[idx]&&!(idx>=maxIdx))++idx;return idx};var UTF8ArrayToString=(heapOrArray,idx=0,maxBytesToRead,ignoreNul)=>{var endPtr=findStringEnd(heapOrArray,idx,maxBytesToRead,ignoreNul);if(endPtr-idx>16&&heapOrArray.buffer&&UTF8Decoder){return UTF8Decoder.decode(heapOrArray.subarray(idx,endPtr))}var str="";while(idx<endPtr){var u0=heapOrArray[idx++];if(!(u0&128)){str+=String.fromCharCode(u0);continue}var u1=heapOrArray[idx++]&63;if((u0&224)==192){str+=String.fromCharCode((u0&31)<<6|u1);continue}var u2=heapOrArray[idx++]&63;if((u0&240)==224){u0=(u0&15)<<12|u1<<6|u2}else{u0=(u0&7)<<18|u1<<12|u2<<6|heapOrArray[idx++]&63}if(u0<65536){str+=String.fromCharCode(u0)}else{var ch=u0-65536;str+=String.fromCharCode(55296|ch>>10,56320|ch&1023)}}return str};var printChar=(stream,curr)=>{var buffer=printCharBuffers[stream];if(curr===0||curr===10){(stream===1?out:err)(UTF8ArrayToString(buffer));buffer.length=0}else{buffer.push(curr)}};var _fd_write=(fd,iov,iovcnt,pnum)=>{var num=0;for(var i=0;i<iovcnt;i++){var ptr=HEAPU32[iov>>2];var len=HEAPU32[iov+4>>2];iov+=8;for(var j=0;j<len;j++){printChar(fd,HEAPU8[ptr+j])}num+=len}HEAPU32[pnum>>2]=num;return 0};var initRandomFill=()=>{if(ENVIRONMENT_IS_NODE){var nodeCrypto=require("node:crypto");return view=>nodeCrypto.randomFillSync(view)}return view=>(crypto.getRandomValues(view),0)};var randomFill=view=>(randomFill=initRandomFill())(view);var _random_get=(buffer,size)=>randomFill(HEAPU8.subarray(buffer,buffer+size));{if(Module["noExitRuntime"])noExitRuntime=Module["noExitRuntime"];if(Module["print"])out=Module["print"];if(Module["printErr"])err=Module["printErr"];if(Module["wasmBinary"])wasmBinary=Module["wasmBinary"];if(Module["arguments"])arguments_=Module["arguments"];if(Module["thisProgram"])thisProgram=Module["thisProgram"];if(Module["preInit"]){if(typeof Module["preInit"]=="function")Module["preInit"]=[Module["preInit"]];while(Module["preInit"].length>0){Module["preInit"].shift()()}}}var _pqf_kem_lengths,_free,_malloc,_pqf_kem_keypair,_pqf_kem_keypair_derand,_pqf_kem_encaps,_pqf_kem_encaps_derand,_pqf_kem_decaps,_pqf_sig_lengths,_pqf_sig_keypair,_pqf_sig_keypair_derand,_pqf_sig_sign,_pqf_sig_sign_derand,_pqf_sig_verify,_pqf_liboqs_version,memory,__indirect_function_table,wasmMemory;function assignWasmExports(wasmExports){_pqf_kem_lengths=Module["_pqf_kem_lengths"]=wasmExports["g"];_free=Module["_free"]=wasmExports["h"];_malloc=Module["_malloc"]=wasmExports["i"];_pqf_kem_keypair=Module["_pqf_kem_keypair"]=wasmExports["j"];_pqf_kem_keypair_derand=Module["_pqf_kem_keypair_derand"]=wasmExports["k"];_pqf_kem_encaps=Module["_pqf_kem_encaps"]=wasmExports["l"];_pqf_kem_encaps_derand=Module["_pqf_kem_encaps_derand"]=wasmExports["m"];_pqf_kem_decaps=Module["_pqf_kem_decaps"]=wasmExports["n"];_pqf_sig_lengths=Module["_pqf_sig_lengths"]=wasmExports["o"];_pqf_sig_keypair=Module["_pqf_sig_keypair"]=wasmExports["p"];_pqf_sig_keypair_derand=Module["_pqf_sig_keypair_derand"]=wasmExports["q"];_pqf_sig_sign=Module["_pqf_sig_sign"]=wasmExports["r"];_pqf_sig_sign_derand=Module["_pqf_sig_sign_derand"]=wasmExports["s"];_pqf_sig_verify=Module["_pqf_sig_verify"]=wasmExports["t"];_pqf_liboqs_version=Module["_pqf_liboqs_version"]=wasmExports["u"];memory=wasmMemory=wasmExports["e"];__indirect_function_table=wasmExports["__indirect_function_table"]}var wasmImports={c:_emscripten_resize_heap,a:_exit,b:_fd_write,d:_random_get};function run(){preRun();function doRun(){Module["calledRun"]=true;if(ABORT)return;initRuntime();readyPromiseResolve?.(Module);Module["onRuntimeInitialized"]?.();postRun()}if(Module["setStatus"]){Module["setStatus"]("Running...");setTimeout(()=>{setTimeout(()=>Module["setStatus"](""),1);doRun()},1)}else{doRun()}}var wasmExports;wasmExports=await (createWasm());run();if(runtimeInitialized){moduleRtn=Module}else{moduleRtn=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=reject})}
-;return moduleRtn}export default PQFillEngine;