@omnituum/pqc-shared 0.3.0 → 0.4.0

package/dist/crypto/safe/index.d.cts

@@ -0,0 +1,341 @@
+/**
+ * Branded cryptographic types.
+ *
+ * Raw Uint8Array must never cross module boundaries without type branding.
+ * These types make argument inversion a compile-time error.
+ */
+type DilithiumSecretKey = Uint8Array & {
+    readonly __brand: 'DilithiumSecretKey';
+};
+type DilithiumPublicKey = Uint8Array & {
+    readonly __brand: 'DilithiumPublicKey';
+};
+type DilithiumSignature = Uint8Array & {
+    readonly __brand: 'DilithiumSignature';
+};
+interface DilithiumKeyPair {
+    publicKey: DilithiumPublicKey;
+    secretKey: DilithiumSecretKey;
+}
+type KyberEncapsulationKey = Uint8Array & {
+    readonly __brand: 'KyberEncapsulationKey';
+};
+type KyberDecapsulationKey = Uint8Array & {
+    readonly __brand: 'KyberDecapsulationKey';
+};
+type KyberCiphertext = Uint8Array & {
+    readonly __brand: 'KyberCiphertext';
+};
+type SharedSecret = Uint8Array & {
+    readonly __brand: 'SharedSecret';
+};
+interface KyberKeyPair {
+    encapsulationKey: KyberEncapsulationKey;
+    decapsulationKey: KyberDecapsulationKey;
+}
+interface KyberEncapsulation {
+    ciphertext: KyberCiphertext;
+    sharedSecret: SharedSecret;
+}
+type X25519PublicKey = Uint8Array & {
+    readonly __brand: 'X25519PublicKey';
+};
+type X25519SecretKey = Uint8Array & {
+    readonly __brand: 'X25519SecretKey';
+};
+interface X25519KeyPair {
+    publicKey: X25519PublicKey;
+    secretKey: X25519SecretKey;
+}
+type SymmetricKey = Uint8Array & {
+    readonly __brand: 'SymmetricKey';
+};
+type Nonce = Uint8Array & {
+    readonly __brand: 'Nonce';
+};
+type Message = Uint8Array & {
+    readonly __brand: 'Message';
+};
+declare function asMessage(data: Uint8Array): Message;
+declare function asDilithiumSecretKey(data: Uint8Array): DilithiumSecretKey;
+declare function asDilithiumPublicKey(data: Uint8Array): DilithiumPublicKey;
+declare function asKyberEncapsulationKey(data: Uint8Array): KyberEncapsulationKey;
+declare function asKyberDecapsulationKey(data: Uint8Array): KyberDecapsulationKey;
+declare function asX25519PublicKey(data: Uint8Array): X25519PublicKey;
+declare function asX25519SecretKey(data: Uint8Array): X25519SecretKey;
+declare function asSymmetricKey(data: Uint8Array): SymmetricKey;
+declare function asNonce(data: Uint8Array): Nonce;
+
+/**
+ * Safe Dilithium ML-DSA-65 adapter.
+ *
+ * Object parameters + branded types + manifest verification.
+ * - Argument inversion is a compile-time error.
+ * - Primitive identity verified on first use (key/sig sizes match manifest).
+ * - Behavioral roundtrip confirmed before any real operation.
+ */
+
+declare function keygen$2(): Promise<DilithiumKeyPair>;
+declare function sign(params: {
+    message: Message;
+    secretKey: DilithiumSecretKey;
+}): Promise<DilithiumSignature>;
+declare function verify(params: {
+    signature: DilithiumSignature;
+    message: Message;
+    publicKey: DilithiumPublicKey;
+}): Promise<boolean>;
+
+declare const dilithium_sign: typeof sign;
+declare const dilithium_verify: typeof verify;
+declare namespace dilithium {
+  export { keygen$2 as keygen, dilithium_sign as sign, dilithium_verify as verify };
+}
+
+/**
+ * Safe Kyber ML-KEM-768 adapter.
+ *
+ * Object parameters + branded types.
+ */
+
+declare function keygen$1(): Promise<KyberKeyPair | null>;
+declare function encapsulate(params: {
+    encapsulationKey: KyberEncapsulationKey;
+}): Promise<KyberEncapsulation>;
+declare function decapsulate(params: {
+    ciphertext: KyberCiphertext;
+    decapsulationKey: KyberDecapsulationKey;
+}): Promise<SharedSecret>;
+
+declare const kyber_decapsulate: typeof decapsulate;
+declare const kyber_encapsulate: typeof encapsulate;
+declare namespace kyber {
+  export { kyber_decapsulate as decapsulate, kyber_encapsulate as encapsulate, keygen$1 as keygen };
+}
+
+/**
+ * Safe X25519 adapter.
+ *
+ * Object parameters + branded types.
+ */
+
+declare function keygen(): X25519KeyPair;
+declare function sharedSecret(params: {
+    ourSecretKey: X25519SecretKey;
+    theirPublicKey: X25519PublicKey;
+}): SharedSecret;
+
+declare const x25519_keygen: typeof keygen;
+declare const x25519_sharedSecret: typeof sharedSecret;
+declare namespace x25519 {
+  export { x25519_keygen as keygen, x25519_sharedSecret as sharedSecret };
+}
+
+/**
+ * Safe secretbox (xsalsa20-poly1305) adapter.
+ *
+ * Object parameters + branded types.
+ */
+
+declare function seal(params: {
+    key: SymmetricKey;
+    plaintext: Uint8Array;
+    nonce: Nonce;
+}): Uint8Array;
+declare function open(params: {
+    key: SymmetricKey;
+    ciphertext: Uint8Array;
+    nonce: Nonce;
+}): Uint8Array | null;
+
+declare const secretbox_open: typeof open;
+declare const secretbox_seal: typeof seal;
+declare namespace secretbox {
+  export { secretbox_open as open, secretbox_seal as seal };
+}
+
+/**
+ * Primitive identity manifests.
+ *
+ * Each manifest declares the expected algorithm name and byte sizes.
+ * Used by assertPrimitiveIdentity() to verify that the underlying library
+ * is the exact primitive we intended to wrap — not a swapped, compromised,
+ * or silently upgraded implementation.
+ *
+ * This catches:
+ * - wrong algorithm resolved behind the same import
+ * - changed encoding or key format after a dependency update
+ * - supply-chain substitution of a different primitive
+ * - silent API drift in key/signature sizes
+ */
+interface SignatureManifest {
+    readonly algorithm: string;
+    readonly publicKeyBytes: number;
+    readonly secretKeyBytes: number;
+    readonly signatureBytes: number;
+}
+interface KemManifest {
+    readonly algorithm: string;
+    readonly encapsulationKeyBytes: number;
+    readonly decapsulationKeyBytes: number;
+    readonly ciphertextBytes: number;
+    readonly sharedSecretBytes: number;
+}
+interface DhManifest {
+    readonly algorithm: string;
+    readonly publicKeyBytes: number;
+    readonly secretKeyBytes: number;
+    readonly sharedSecretBytes: number;
+}
+interface SecretboxManifest {
+    readonly algorithm: string;
+    readonly keyBytes: number;
+    readonly nonceBytes: number;
+    readonly tagBytes: number;
+}
+declare const ML_DSA_65: SignatureManifest;
+declare const ML_KEM_768: KemManifest;
+declare const X25519: DhManifest;
+declare const XSALSA20_POLY1305: SecretboxManifest;
+declare function assertSignaturePrimitive(noble: {
+    keygen(seed?: Uint8Array): {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+    sign(message: Uint8Array, secretKey: Uint8Array): Uint8Array;
+    verify(signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array): boolean;
+}, manifest: SignatureManifest): void;
+declare function assertKemPrimitive(noble: {
+    keygen(): {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+    encapsulate(publicKey: Uint8Array): {
+        ciphertext: Uint8Array;
+        sharedSecret: Uint8Array;
+    };
+    decapsulate(ciphertext: Uint8Array, secretKey: Uint8Array): Uint8Array;
+}, manifest: KemManifest): void;
+declare function assertDhPrimitive(noble: {
+    getPublicKey(secretKey: Uint8Array): Uint8Array;
+    getSharedSecret(secretKey: Uint8Array, publicKey: Uint8Array): Uint8Array;
+    utils: {
+        randomPrivateKey(): Uint8Array;
+    };
+}, manifest: DhManifest): void;
+
+/**
+ * High-assurance adapter factories.
+ *
+ * Single-boundary, typed, invariant-checked, manifest-verified.
+ *
+ * Each factory wraps a low-level positional API into a safe object-parameter API.
+ * - Branded types prevent argument confusion at compile time.
+ * - Lazy invariant checks catch API drift at runtime.
+ * - Manifest checks verify primitive identity (key/signature sizes) to catch
+ *   supply-chain substitution or silent dependency upgrades.
+ */
+
+type Brand<T, B extends string> = T & {
+    readonly __brand: B;
+};
+type SigMessage = Brand<Uint8Array, 'SigMessage'>;
+type SigPublicKey<Alg extends string> = Brand<Uint8Array, `${Alg}PublicKey`>;
+type SigSecretKey<Alg extends string> = Brand<Uint8Array, `${Alg}SecretKey`>;
+type SigSignature<Alg extends string> = Brand<Uint8Array, `${Alg}Signature`>;
+type NobleSigLike = {
+    keygen(seed?: Uint8Array): {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+    sign(message: Uint8Array, secretKey: Uint8Array): Uint8Array;
+    verify(signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array): boolean;
+};
+declare function makeSignatureAdapter<Alg extends string>(noble: NobleSigLike, manifest: SignatureManifest): {
+    keygen(): {
+        publicKey: SigPublicKey<Alg>;
+        secretKey: SigSecretKey<Alg>;
+    };
+    sign(params: {
+        message: SigMessage;
+        secretKey: SigSecretKey<Alg>;
+    }): SigSignature<Alg>;
+    verify(params: {
+        signature: SigSignature<Alg>;
+        message: SigMessage;
+        publicKey: SigPublicKey<Alg>;
+    }): boolean;
+};
+declare function asSigMessage(v: Uint8Array): SigMessage;
+type KemEncapsKey<Alg extends string> = Brand<Uint8Array, `${Alg}EncapsKey`>;
+type KemDecapsKey<Alg extends string> = Brand<Uint8Array, `${Alg}DecapsKey`>;
+type KemCiphertext<Alg extends string> = Brand<Uint8Array, `${Alg}Ciphertext`>;
+type KemSharedSecret = Brand<Uint8Array, 'KemSharedSecret'>;
+type NobleKemLike = {
+    keygen(): {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+    encapsulate(publicKey: Uint8Array): {
+        ciphertext: Uint8Array;
+        sharedSecret: Uint8Array;
+    };
+    decapsulate(ciphertext: Uint8Array, secretKey: Uint8Array): Uint8Array;
+};
+declare function makeKemAdapter<Alg extends string>(noble: NobleKemLike, manifest: KemManifest): {
+    keygen(): {
+        encapsulationKey: KemEncapsKey<Alg>;
+        decapsulationKey: KemDecapsKey<Alg>;
+    };
+    encapsulate(params: {
+        encapsulationKey: KemEncapsKey<Alg>;
+    }): {
+        ciphertext: KemCiphertext<Alg>;
+        sharedSecret: KemSharedSecret;
+    };
+    decapsulate(params: {
+        ciphertext: KemCiphertext<Alg>;
+        decapsulationKey: KemDecapsKey<Alg>;
+    }): KemSharedSecret;
+};
+type DhPublicKey<Alg extends string> = Brand<Uint8Array, `${Alg}PublicKey`>;
+type DhSecretKey<Alg extends string> = Brand<Uint8Array, `${Alg}SecretKey`>;
+type DhSharedSecret = Brand<Uint8Array, 'DhSharedSecret'>;
+type NobleDhLike = {
+    getPublicKey(secretKey: Uint8Array): Uint8Array;
+    getSharedSecret(secretKey: Uint8Array, publicKey: Uint8Array): Uint8Array;
+    utils: {
+        randomPrivateKey(): Uint8Array;
+    };
+};
+declare function makeDhAdapter<Alg extends string>(noble: NobleDhLike, manifest: DhManifest): {
+    keygen(): {
+        publicKey: DhPublicKey<Alg>;
+        secretKey: DhSecretKey<Alg>;
+    };
+    sharedSecret(params: {
+        ourSecretKey: DhSecretKey<Alg>;
+        theirPublicKey: DhPublicKey<Alg>;
+    }): DhSharedSecret;
+};
+type BoxKey = Brand<Uint8Array, 'BoxKey'>;
+type BoxNonce = Brand<Uint8Array, 'BoxNonce'>;
+declare function makeSecretboxAdapter(impl: {
+    seal: (key: Uint8Array, plaintext: Uint8Array, nonce: Uint8Array) => Uint8Array;
+    open: (key: Uint8Array, ciphertext: Uint8Array, nonce: Uint8Array) => Uint8Array | null;
+}, manifest: SecretboxManifest): {
+    seal(params: {
+        key: BoxKey;
+        plaintext: Uint8Array;
+        nonce: BoxNonce;
+    }): Uint8Array;
+    open(params: {
+        key: BoxKey;
+        ciphertext: Uint8Array;
+        nonce: BoxNonce;
+    }): Uint8Array | null;
+};
+declare function asBoxKey(v: Uint8Array): BoxKey;
+declare function asBoxNonce(v: Uint8Array): BoxNonce;
+
+export { type BoxKey, type BoxNonce, type DhManifest, type DhPublicKey, type DhSecretKey, type DhSharedSecret, type DilithiumKeyPair, type DilithiumPublicKey, type DilithiumSecretKey, type DilithiumSignature, type KemCiphertext, type KemDecapsKey, type KemEncapsKey, type KemManifest, type KemSharedSecret, type KyberCiphertext, type KyberDecapsulationKey, type KyberEncapsulation, type KyberEncapsulationKey, type KyberKeyPair, ML_DSA_65, ML_KEM_768, type Message, type NobleDhLike, type NobleKemLike, type NobleSigLike, type Nonce, type SecretboxManifest, type SharedSecret, type SigMessage, type SigPublicKey, type SigSecretKey, type SigSignature, type SignatureManifest, type SymmetricKey, X25519, type X25519KeyPair, type X25519PublicKey, type X25519SecretKey, XSALSA20_POLY1305, asBoxKey, asBoxNonce, asDilithiumPublicKey, asDilithiumSecretKey, asKyberDecapsulationKey, asKyberEncapsulationKey, asMessage, asNonce, asSigMessage, asSymmetricKey, asX25519PublicKey, asX25519SecretKey, assertDhPrimitive, assertKemPrimitive, assertSignaturePrimitive, dilithium, kyber, makeDhAdapter, makeKemAdapter, makeSecretboxAdapter, makeSignatureAdapter, secretbox, x25519 };

package/dist/crypto/safe/index.d.ts

@@ -0,0 +1,341 @@
+/**
+ * Branded cryptographic types.
+ *
+ * Raw Uint8Array must never cross module boundaries without type branding.
+ * These types make argument inversion a compile-time error.
+ */
+type DilithiumSecretKey = Uint8Array & {
+    readonly __brand: 'DilithiumSecretKey';
+};
+type DilithiumPublicKey = Uint8Array & {
+    readonly __brand: 'DilithiumPublicKey';
+};
+type DilithiumSignature = Uint8Array & {
+    readonly __brand: 'DilithiumSignature';
+};
+interface DilithiumKeyPair {
+    publicKey: DilithiumPublicKey;
+    secretKey: DilithiumSecretKey;
+}
+type KyberEncapsulationKey = Uint8Array & {
+    readonly __brand: 'KyberEncapsulationKey';
+};
+type KyberDecapsulationKey = Uint8Array & {
+    readonly __brand: 'KyberDecapsulationKey';
+};
+type KyberCiphertext = Uint8Array & {
+    readonly __brand: 'KyberCiphertext';
+};
+type SharedSecret = Uint8Array & {
+    readonly __brand: 'SharedSecret';
+};
+interface KyberKeyPair {
+    encapsulationKey: KyberEncapsulationKey;
+    decapsulationKey: KyberDecapsulationKey;
+}
+interface KyberEncapsulation {
+    ciphertext: KyberCiphertext;
+    sharedSecret: SharedSecret;
+}
+type X25519PublicKey = Uint8Array & {
+    readonly __brand: 'X25519PublicKey';
+};
+type X25519SecretKey = Uint8Array & {
+    readonly __brand: 'X25519SecretKey';
+};
+interface X25519KeyPair {
+    publicKey: X25519PublicKey;
+    secretKey: X25519SecretKey;
+}
+type SymmetricKey = Uint8Array & {
+    readonly __brand: 'SymmetricKey';
+};
+type Nonce = Uint8Array & {
+    readonly __brand: 'Nonce';
+};
+type Message = Uint8Array & {
+    readonly __brand: 'Message';
+};
+declare function asMessage(data: Uint8Array): Message;
+declare function asDilithiumSecretKey(data: Uint8Array): DilithiumSecretKey;
+declare function asDilithiumPublicKey(data: Uint8Array): DilithiumPublicKey;
+declare function asKyberEncapsulationKey(data: Uint8Array): KyberEncapsulationKey;
+declare function asKyberDecapsulationKey(data: Uint8Array): KyberDecapsulationKey;
+declare function asX25519PublicKey(data: Uint8Array): X25519PublicKey;
+declare function asX25519SecretKey(data: Uint8Array): X25519SecretKey;
+declare function asSymmetricKey(data: Uint8Array): SymmetricKey;
+declare function asNonce(data: Uint8Array): Nonce;
+
+/**
+ * Safe Dilithium ML-DSA-65 adapter.
+ *
+ * Object parameters + branded types + manifest verification.
+ * - Argument inversion is a compile-time error.
+ * - Primitive identity verified on first use (key/sig sizes match manifest).
+ * - Behavioral roundtrip confirmed before any real operation.
+ */
+
+declare function keygen$2(): Promise<DilithiumKeyPair>;
+declare function sign(params: {
+    message: Message;
+    secretKey: DilithiumSecretKey;
+}): Promise<DilithiumSignature>;
+declare function verify(params: {
+    signature: DilithiumSignature;
+    message: Message;
+    publicKey: DilithiumPublicKey;
+}): Promise<boolean>;
+
+declare const dilithium_sign: typeof sign;
+declare const dilithium_verify: typeof verify;
+declare namespace dilithium {
+  export { keygen$2 as keygen, dilithium_sign as sign, dilithium_verify as verify };
+}
+
+/**
+ * Safe Kyber ML-KEM-768 adapter.
+ *
+ * Object parameters + branded types.
+ */
+
+declare function keygen$1(): Promise<KyberKeyPair | null>;
+declare function encapsulate(params: {
+    encapsulationKey: KyberEncapsulationKey;
+}): Promise<KyberEncapsulation>;
+declare function decapsulate(params: {
+    ciphertext: KyberCiphertext;
+    decapsulationKey: KyberDecapsulationKey;
+}): Promise<SharedSecret>;
+
+declare const kyber_decapsulate: typeof decapsulate;
+declare const kyber_encapsulate: typeof encapsulate;
+declare namespace kyber {
+  export { kyber_decapsulate as decapsulate, kyber_encapsulate as encapsulate, keygen$1 as keygen };
+}
+
+/**
+ * Safe X25519 adapter.
+ *
+ * Object parameters + branded types.
+ */
+
+declare function keygen(): X25519KeyPair;
+declare function sharedSecret(params: {
+    ourSecretKey: X25519SecretKey;
+    theirPublicKey: X25519PublicKey;
+}): SharedSecret;
+
+declare const x25519_keygen: typeof keygen;
+declare const x25519_sharedSecret: typeof sharedSecret;
+declare namespace x25519 {
+  export { x25519_keygen as keygen, x25519_sharedSecret as sharedSecret };
+}
+
+/**
+ * Safe secretbox (xsalsa20-poly1305) adapter.
+ *
+ * Object parameters + branded types.
+ */
+
+declare function seal(params: {
+    key: SymmetricKey;
+    plaintext: Uint8Array;
+    nonce: Nonce;
+}): Uint8Array;
+declare function open(params: {
+    key: SymmetricKey;
+    ciphertext: Uint8Array;
+    nonce: Nonce;
+}): Uint8Array | null;
+
+declare const secretbox_open: typeof open;
+declare const secretbox_seal: typeof seal;
+declare namespace secretbox {
+  export { secretbox_open as open, secretbox_seal as seal };
+}
+
+/**
+ * Primitive identity manifests.
+ *
+ * Each manifest declares the expected algorithm name and byte sizes.
+ * Used by assertPrimitiveIdentity() to verify that the underlying library
+ * is the exact primitive we intended to wrap — not a swapped, compromised,
+ * or silently upgraded implementation.
+ *
+ * This catches:
+ * - wrong algorithm resolved behind the same import
+ * - changed encoding or key format after a dependency update
+ * - supply-chain substitution of a different primitive
+ * - silent API drift in key/signature sizes
+ */
+interface SignatureManifest {
+    readonly algorithm: string;
+    readonly publicKeyBytes: number;
+    readonly secretKeyBytes: number;
+    readonly signatureBytes: number;
+}
+interface KemManifest {
+    readonly algorithm: string;
+    readonly encapsulationKeyBytes: number;
+    readonly decapsulationKeyBytes: number;
+    readonly ciphertextBytes: number;
+    readonly sharedSecretBytes: number;
+}
+interface DhManifest {
+    readonly algorithm: string;
+    readonly publicKeyBytes: number;
+    readonly secretKeyBytes: number;
+    readonly sharedSecretBytes: number;
+}
+interface SecretboxManifest {
+    readonly algorithm: string;
+    readonly keyBytes: number;
+    readonly nonceBytes: number;
+    readonly tagBytes: number;
+}
+declare const ML_DSA_65: SignatureManifest;
+declare const ML_KEM_768: KemManifest;
+declare const X25519: DhManifest;
+declare const XSALSA20_POLY1305: SecretboxManifest;
+declare function assertSignaturePrimitive(noble: {
+    keygen(seed?: Uint8Array): {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+    sign(message: Uint8Array, secretKey: Uint8Array): Uint8Array;
+    verify(signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array): boolean;
+}, manifest: SignatureManifest): void;
+declare function assertKemPrimitive(noble: {
+    keygen(): {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+    encapsulate(publicKey: Uint8Array): {
+        ciphertext: Uint8Array;
+        sharedSecret: Uint8Array;
+    };
+    decapsulate(ciphertext: Uint8Array, secretKey: Uint8Array): Uint8Array;
+}, manifest: KemManifest): void;
+declare function assertDhPrimitive(noble: {
+    getPublicKey(secretKey: Uint8Array): Uint8Array;
+    getSharedSecret(secretKey: Uint8Array, publicKey: Uint8Array): Uint8Array;
+    utils: {
+        randomPrivateKey(): Uint8Array;
+    };
+}, manifest: DhManifest): void;
+
+/**
+ * High-assurance adapter factories.
+ *
+ * Single-boundary, typed, invariant-checked, manifest-verified.
+ *
+ * Each factory wraps a low-level positional API into a safe object-parameter API.
+ * - Branded types prevent argument confusion at compile time.
+ * - Lazy invariant checks catch API drift at runtime.
+ * - Manifest checks verify primitive identity (key/signature sizes) to catch
+ *   supply-chain substitution or silent dependency upgrades.
+ */
+
+type Brand<T, B extends string> = T & {
+    readonly __brand: B;
+};
+type SigMessage = Brand<Uint8Array, 'SigMessage'>;
+type SigPublicKey<Alg extends string> = Brand<Uint8Array, `${Alg}PublicKey`>;
+type SigSecretKey<Alg extends string> = Brand<Uint8Array, `${Alg}SecretKey`>;
+type SigSignature<Alg extends string> = Brand<Uint8Array, `${Alg}Signature`>;
+type NobleSigLike = {
+    keygen(seed?: Uint8Array): {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+    sign(message: Uint8Array, secretKey: Uint8Array): Uint8Array;
+    verify(signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array): boolean;
+};
+declare function makeSignatureAdapter<Alg extends string>(noble: NobleSigLike, manifest: SignatureManifest): {
+    keygen(): {
+        publicKey: SigPublicKey<Alg>;
+        secretKey: SigSecretKey<Alg>;
+    };
+    sign(params: {
+        message: SigMessage;
+        secretKey: SigSecretKey<Alg>;
+    }): SigSignature<Alg>;
+    verify(params: {
+        signature: SigSignature<Alg>;
+        message: SigMessage;
+        publicKey: SigPublicKey<Alg>;
+    }): boolean;
+};
+declare function asSigMessage(v: Uint8Array): SigMessage;
+type KemEncapsKey<Alg extends string> = Brand<Uint8Array, `${Alg}EncapsKey`>;
+type KemDecapsKey<Alg extends string> = Brand<Uint8Array, `${Alg}DecapsKey`>;
+type KemCiphertext<Alg extends string> = Brand<Uint8Array, `${Alg}Ciphertext`>;
+type KemSharedSecret = Brand<Uint8Array, 'KemSharedSecret'>;
+type NobleKemLike = {
+    keygen(): {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+    encapsulate(publicKey: Uint8Array): {
+        ciphertext: Uint8Array;
+        sharedSecret: Uint8Array;
+    };
+    decapsulate(ciphertext: Uint8Array, secretKey: Uint8Array): Uint8Array;
+};
+declare function makeKemAdapter<Alg extends string>(noble: NobleKemLike, manifest: KemManifest): {
+    keygen(): {
+        encapsulationKey: KemEncapsKey<Alg>;
+        decapsulationKey: KemDecapsKey<Alg>;
+    };
+    encapsulate(params: {
+        encapsulationKey: KemEncapsKey<Alg>;
+    }): {
+        ciphertext: KemCiphertext<Alg>;
+        sharedSecret: KemSharedSecret;
+    };
+    decapsulate(params: {
+        ciphertext: KemCiphertext<Alg>;
+        decapsulationKey: KemDecapsKey<Alg>;
+    }): KemSharedSecret;
+};
+type DhPublicKey<Alg extends string> = Brand<Uint8Array, `${Alg}PublicKey`>;
+type DhSecretKey<Alg extends string> = Brand<Uint8Array, `${Alg}SecretKey`>;
+type DhSharedSecret = Brand<Uint8Array, 'DhSharedSecret'>;
+type NobleDhLike = {
+    getPublicKey(secretKey: Uint8Array): Uint8Array;
+    getSharedSecret(secretKey: Uint8Array, publicKey: Uint8Array): Uint8Array;
+    utils: {
+        randomPrivateKey(): Uint8Array;
+    };
+};
+declare function makeDhAdapter<Alg extends string>(noble: NobleDhLike, manifest: DhManifest): {
+    keygen(): {
+        publicKey: DhPublicKey<Alg>;
+        secretKey: DhSecretKey<Alg>;
+    };
+    sharedSecret(params: {
+        ourSecretKey: DhSecretKey<Alg>;
+        theirPublicKey: DhPublicKey<Alg>;
+    }): DhSharedSecret;
+};
+type BoxKey = Brand<Uint8Array, 'BoxKey'>;
+type BoxNonce = Brand<Uint8Array, 'BoxNonce'>;
+declare function makeSecretboxAdapter(impl: {
+    seal: (key: Uint8Array, plaintext: Uint8Array, nonce: Uint8Array) => Uint8Array;
+    open: (key: Uint8Array, ciphertext: Uint8Array, nonce: Uint8Array) => Uint8Array | null;
+}, manifest: SecretboxManifest): {
+    seal(params: {
+        key: BoxKey;
+        plaintext: Uint8Array;
+        nonce: BoxNonce;
+    }): Uint8Array;
+    open(params: {
+        key: BoxKey;
+        ciphertext: Uint8Array;
+        nonce: BoxNonce;
+    }): Uint8Array | null;
+};
+declare function asBoxKey(v: Uint8Array): BoxKey;
+declare function asBoxNonce(v: Uint8Array): BoxNonce;
+
+export { type BoxKey, type BoxNonce, type DhManifest, type DhPublicKey, type DhSecretKey, type DhSharedSecret, type DilithiumKeyPair, type DilithiumPublicKey, type DilithiumSecretKey, type DilithiumSignature, type KemCiphertext, type KemDecapsKey, type KemEncapsKey, type KemManifest, type KemSharedSecret, type KyberCiphertext, type KyberDecapsulationKey, type KyberEncapsulation, type KyberEncapsulationKey, type KyberKeyPair, ML_DSA_65, ML_KEM_768, type Message, type NobleDhLike, type NobleKemLike, type NobleSigLike, type Nonce, type SecretboxManifest, type SharedSecret, type SigMessage, type SigPublicKey, type SigSecretKey, type SigSignature, type SignatureManifest, type SymmetricKey, X25519, type X25519KeyPair, type X25519PublicKey, type X25519SecretKey, XSALSA20_POLY1305, asBoxKey, asBoxNonce, asDilithiumPublicKey, asDilithiumSecretKey, asKyberDecapsulationKey, asKyberEncapsulationKey, asMessage, asNonce, asSigMessage, asSymmetricKey, asX25519PublicKey, asX25519SecretKey, assertDhPrimitive, assertKemPrimitive, assertSignaturePrimitive, dilithium, kyber, makeDhAdapter, makeKemAdapter, makeSecretboxAdapter, makeSignatureAdapter, secretbox, x25519 };