[satran004]

ZeroJ's Java APIs can now run through experimental TypeScript/JavaScript wrappers in browser workers and Node worker threads. Applications select only the physical Wasm images they need, or an optional shared image when using many capabilities. ADR-0057 r2 records the architecture, security boundaries and measured scope.

Implemented in this PR:

• Opt-in Gradle composite and npm workspace; default Java builds/BOM/publication remain independent.
• Typed runtime, lazy checked asset loading, bounded calls, explicit lifecycle and worker-local handles.
• SHA-256/SHA-512/BLAKE2b and a named Poseidon profile; both Pedersen curves; both BBS suites.
• Strict BLS12-381 Groth16 verification and supplied-key proving for a compiled cubic tutorial, with a Java circuit extension point. No setup in consumer images.
• Exponential ElGamal, proof-bound object imports, DKG participant state/threshold decryption, and confidential-note delivery/opening.
• Seven browser examples, shared Node examples, an interactive docsite guide, reproducible benchmarks, local npm tarball consumer tests and review reports.

Core changes are limited to a guarded default-RNG factory and existing default-construction sites, public access to existing unkeyed BLAKE2b methods, and a tightening-only zkey allocation-limits overload. Cryptographic equations, profiles and parameters are unchanged. WebCrypto supplies entropy; actual-image tests reject missing/failing entropy and the compiler's unapproved default with no observed Math.random calls. Native blst and setup paths have reachability guards.

Validation:

• Node SDK suite: 17 top-level tests plus a separate DKG resource-abort regression; 44 independent Pedersen vectors, 50 official BBS fixtures, 53 independent note-opening cases and 3 Sage Poseidon pairs.
• Groth16 interoperability with snarkjs in both directions, including exact ElGamal relation proof fixtures and negative statement/key tests.
• Core: 122 API, 89 BBS, 138 selected BLS, 48 crypto and 601 executed selected circuit-library tests passed (11 additional opt-in skips).
• Chromium 156 and Firefox 157 pass all example scenarios. Fifteen local tarballs install offline outside the workspace; declarations compile and installed assets execute.
• Docsite checks/build and desktop/mobile illustration QA passed.

Measured on M4 Max: separate images ~3.3–3.4 MiB Brotli each; optional combined image ~3.52 MiB. The 3-constraint Node tutorial proof plus self-check has a three-sample median of 265 ms. These are experimental examples, not large-circuit or mobile performance claims. See bindings/REPORT.md for measurement boundaries and reproduction.

Limits and release gates are explicit: browser/Node secret paths remain unassessed for side channels; the proving transport is bounded; DKG network transport, durable restart and external context admission are not provided; note opening is not a complete private ledger. Safari, WASI, native C ABI and automatic framework bundler integration are unvalidated. No production or post-quantum claim is made.

The supplied Oracle GraalVM runtime introduces terms beyond ZeroJ's MIT license. Generated physical bundles are private pending distribution/corresponding-source review; no npm publication is performed. bindings/DISTRIBUTION.md records the finding and unvalidated source-build alternative. Generated images, keys, raw logs and tarballs remain out of Git.

Main 65412c40 is merged and was re-fetched unchanged before completion. All milestones and implementation self-reviews remain in this PR. External cryptographic/security review remains a release gate.