VOLT v2.1.0-hardened

_PRODUCTION_MODE = os.environ.get(
    'VOLT_ALLOW_DEGRADED', '0'
).strip() != '1'

if _PRODUCTION_MODE and not _LIBOQS_AVAILABLE:
    raise RuntimeError(
        "[VOLT-FATAL] liboqs-python est absent."
    )

with SecretBuffer(kem_res.shared_secret) as secret:
    nonce, ct, tag = cipher.encrypt(
        plaintext, bytes(secret)
    )
    with SecretBuffer(sha256(secret)) as mac:
        hmac_val = mac.compute(payload, bytes(mac))
    # mac écrasé par ctypes.memset()
# shared_secret écrasé par ctypes.memset()

_MAX_KEM_CT_SIZE   = 2048  # Kyber768: 1088 B
_MAX_NONCE_SIZE    = 32   # AES-GCM nonce: 12 B
_MAX_AES_TAG_SIZE  = 32   # GCM tag: 16 B
_MAX_SIGNATURE_SIZE = 8192 # Dilithium3: ~3293 B
_MAX_SENDER_PK_SIZE = 2048 # Kyber PK: 1184 B

if chunk_len > MAX_SIZE:
    raise ValueError("Chunk DoS détecté")

def encrypt(self, plaintext: bytes,
            recipient_public_key: bytes):
    if not isinstance(plaintext, (bytes, bytearray)):
        raise TypeError(
            "plaintext doit être bytes ou bytearray."
        )
    if not isinstance(recipient_public_key, bytes):
        raise TypeError(
            "recipient_public_key doit être bytes."
        )

def generate_anchor_key(passphrase: str) -> str:
    if not isinstance(passphrase, str):
        raise TypeError(
            "La passphrase doit être une str."
        )
    if not passphrase.strip():
        raise ValueError(
            "Passphrase vide ou composée d'espaces "
            "— rejetée."
        )