spec: scaffold for DSPX-3229

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

lib/package.json

@@ -90,6 +90,7 @@
   "dependencies": {
     "@connectrpc/connect": "^2.0.2",
     "@connectrpc/connect-web": "^2.0.2",
+    "@noble/post-quantum": "^0.6.1",
     "buffer-crc32": "^1.0.0",
     "jose": "6.0.8",
     "json-canonicalize": "^1.0.6",

lib/src/access.ts

@@ -87,15 +87,21 @@ export const rewrapAdditionalContextHeader = (
   return base64.encode(JSON.stringify(context));
 };
 
-export type KasPublicKeyAlgorithm =
-  | 'ec:secp256r1'
-  | 'ec:secp384r1'
-  | 'ec:secp521r1'
-  | 'rsa:2048'
-  | 'rsa:4096';
+const PUBLIC_KEY_ALGORITHMS = [
+  'ec:secp256r1',
+  'ec:secp384r1',
+  'ec:secp521r1',
+  'rsa:2048',
+  'rsa:4096',
+  'mlkem:512',
+  'mlkem:768',
+  'mlkem:1024',
+] as const;
+
+export type KasPublicKeyAlgorithm = (typeof PUBLIC_KEY_ALGORITHMS)[number];
 
 export const isPublicKeyAlgorithm = (a: string): a is KasPublicKeyAlgorithm => {
-  return a === 'ec:secp256r1' || a === 'rsa:2048';
+  return PUBLIC_KEY_ALGORITHMS.includes(a as KasPublicKeyAlgorithm);
 };
 
 export const keyAlgorithmToPublicKeyAlgorithm = (k: CryptoKey): KasPublicKeyAlgorithm => {
@@ -142,6 +148,10 @@ export const publicKeyAlgorithmToJwa = (a: KasPublicKeyAlgorithm): string => {
       return 'ES384';
     case 'ec:secp521r1':
       return 'ES512';
+    case 'mlkem:512':
+    case 'mlkem:768':
+    case 'mlkem:1024':
+      throw new Error(`unsupported public key algorithm for JWA conversion: ${a}`);
     default:
       throw new Error(`unsupported public key algorithm: ${a}`);
   }
@@ -161,7 +171,7 @@ export type KasPublicKeyInfo = {
   /** If present, an identifier which is tied to this specific key. */
   kid?: string;
 
-  /** The key value, encoded within a PEM envelope */
+  /** The key value, encoded as PEM for classical keys or raw base64 for ML-KEM. */
   publicKey: string;
 };
 
@@ -212,7 +222,10 @@ export async function fetchKasPubKey(
   algorithm?: KasPublicKeyAlgorithm
 ): Promise<KasPublicKeyInfo> {
   try {
-    return await fetchKasBasePubKey(kasEndpoint);
+    const baseKey = await fetchKasBasePubKey(kasEndpoint);
+    if (!algorithm || baseKey.algorithm === algorithm) {
+      return baseKey;
+    }
   } catch (e) {
     console.log(e);
   }

lib/src/opentdf.ts

@@ -190,7 +190,7 @@ export type OpenTDFOptions = {
   authProvider?: AuthProvider;
 
   /** Default settings for 'encrypt' type requests. */
-  defaultCreateOptions?: Omit<CreateOptions, 'source'>;
+  defaultCreateOptions?: Omit<CreateTDFOptions, 'source'>;
 
   /** Default settings for 'decrypt' type requests. */
   defaultReadOptions?: Omit<ReadOptions, 'source'>;
@@ -285,7 +285,7 @@ export class OpenTDF {
   /** If DPoP is enabled for this instance. */
   readonly dpopEnabled: boolean;
   /** Default options for creating TDF objects. */
-  defaultCreateOptions: Omit<CreateOptions, 'source'>;
+  defaultCreateOptions: Omit<CreateTDFOptions, 'source'>;
   /** Default options for reading TDF objects. */
   defaultReadOptions: Omit<ReadOptions, 'source'>;
   /** The DPoP keys for this instance, if any. */

lib/tdf3/index.ts

@@ -24,6 +24,7 @@ import {
   type KeyPair,
   type KeyOptions,
   type KeyAlgorithm,
+  type MlKemLevel,
   type PemKeyPair,
   type PrivateKey,
   type PublicKey,
@@ -65,6 +66,7 @@ export type {
   KeyPair,
   KeyOptions,
   KeyAlgorithm,
+  MlKemLevel,
   PemKeyPair,
   PrivateKey,
   PublicKey,

lib/tdf3/src/client/index.ts

@@ -733,6 +733,9 @@ export class Client {
         switch (algorithm) {
           case 'rsa:2048':
           case 'rsa:4096':
+          case 'mlkem:512':
+          case 'mlkem:768':
+          case 'mlkem:1024':
             type = 'wrapped';
             break;
           case 'ec:secp384r1':