@reallyme/crypto 0.1.0

package/dist/wasmModuleTypes.d.ts

@@ -0,0 +1,72 @@
+export type ReallyMeWasmInitOutput = Readonly<{
+    memory: unknown;
+}>;
+export declare function initSync(module: {
+    module: Uint8Array;
+}): ReallyMeWasmInitOutput;
+export declare function aes256GcmOpen(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ciphertextWithTag: Uint8Array): Uint8Array;
+export declare function aes256GcmSeal(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): Uint8Array;
+export declare function aes256GcmSivOpen(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ciphertextWithTag: Uint8Array): Uint8Array;
+export declare function aes256GcmSivSeal(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): Uint8Array;
+export declare function aes256KwUnwrapKey(wrappingKey: Uint8Array, wrappedKey: Uint8Array): Uint8Array;
+export declare function aes256KwWrapKey(wrappingKey: Uint8Array, keyToWrap: Uint8Array): Uint8Array;
+export declare function argon2idDeriveKey(kdfVersion: number, secret: Uint8Array, salt: Uint8Array): Uint8Array;
+export declare function base64urlDecode(encoded: string): Uint8Array;
+export declare function base64urlEncode(bytes: Uint8Array): string;
+export declare function dagCborComputeCid(bytes: Uint8Array): string;
+export declare function dagCborVerifyCid(cid: string, bytes: Uint8Array): unknown;
+export declare function multibaseBase58btcEncode(bytes: Uint8Array): string;
+export declare function multibaseBase64urlEncode(bytes: Uint8Array): string;
+export declare function multibaseDecode(encoded: string): Uint8Array;
+export declare function multicodecLookupPrefix(bytes: Uint8Array): unknown;
+export declare function multicodecPrefixForName(codecName: string): unknown;
+export declare function multikeyEncode(codecName: string, publicKey: Uint8Array): string;
+export declare function multikeyParse(multikey: string): unknown;
+export declare function hpkeOpenBase(suite: number, recipientSecretKey: Uint8Array, encapsulatedKey: Uint8Array, info: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array): Uint8Array;
+export declare function hpkeSealBase(suite: number, recipientPublicKey: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): unknown;
+export declare function hpkeSealBaseDerand(suite: number, recipientPublicKey: Uint8Array, encapsulationRandomness: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): unknown;
+export declare function mlKem512GenerateKeypair(): unknown;
+export declare function mlKem512DeriveKeypair(secretKey: Uint8Array): unknown;
+export declare function mlKem512Encapsulate(publicKey: Uint8Array): unknown;
+export declare function mlKem512EncapsulateDerand(publicKey: Uint8Array, randomness: Uint8Array): unknown;
+export declare function mlKem512Decapsulate(ciphertext: Uint8Array, secretKey: Uint8Array): Uint8Array;
+export declare function mlKem768GenerateKeypair(): unknown;
+export declare function mlKem768DeriveKeypair(secretKey: Uint8Array): unknown;
+export declare function mlKem768Encapsulate(publicKey: Uint8Array): unknown;
+export declare function mlKem768EncapsulateDerand(publicKey: Uint8Array, randomness: Uint8Array): unknown;
+export declare function mlKem768Decapsulate(ciphertext: Uint8Array, secretKey: Uint8Array): Uint8Array;
+export declare function mlKem1024GenerateKeypair(): unknown;
+export declare function mlKem1024DeriveKeypair(secretKey: Uint8Array): unknown;
+export declare function mlKem1024Encapsulate(publicKey: Uint8Array): unknown;
+export declare function mlKem1024EncapsulateDerand(publicKey: Uint8Array, randomness: Uint8Array): unknown;
+export declare function mlKem1024Decapsulate(ciphertext: Uint8Array, secretKey: Uint8Array): Uint8Array;
+export declare function mlDsa44GenerateKeypair(): unknown;
+export declare function mlDsa44DeriveKeypair(secretKey: Uint8Array): unknown;
+export declare function mlDsa44Sign(secretKey: Uint8Array, message: Uint8Array): Uint8Array;
+export declare function mlDsa44Verify(publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array): void;
+export declare function mlDsa65GenerateKeypair(): unknown;
+export declare function mlDsa65DeriveKeypair(secretKey: Uint8Array): unknown;
+export declare function mlDsa65Sign(secretKey: Uint8Array, message: Uint8Array): Uint8Array;
+export declare function mlDsa65Verify(publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array): void;
+export declare function mlDsa87GenerateKeypair(): unknown;
+export declare function mlDsa87DeriveKeypair(secretKey: Uint8Array): unknown;
+export declare function mlDsa87Sign(secretKey: Uint8Array, message: Uint8Array): Uint8Array;
+export declare function mlDsa87Verify(publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array): void;
+export declare function slhDsaSha2128sGenerateKeypair(): unknown;
+export declare function slhDsaSha2128sDeriveKeypair(skSeed: Uint8Array, skPrf: Uint8Array, pkSeed: Uint8Array): unknown;
+export declare function slhDsaSha2128sSign(secretKey: Uint8Array, message: Uint8Array): Uint8Array;
+export declare function slhDsaSha2128sVerify(publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array): void;
+export declare function chacha20Poly1305Open(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ciphertextWithTag: Uint8Array): Uint8Array;
+export declare function chacha20Poly1305Seal(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): Uint8Array;
+export declare function xchacha20Poly1305Open(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ciphertextWithTag: Uint8Array): Uint8Array;
+export declare function xchacha20Poly1305Seal(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): Uint8Array;
+export declare function xWing1024Decapsulate(ciphertext: Uint8Array, secretKey: Uint8Array): Uint8Array;
+export declare function xWing1024DeriveKeypair(secretKey: Uint8Array): unknown;
+export declare function xWing1024Encapsulate(publicKey: Uint8Array): unknown;
+export declare function xWing1024EncapsulateDerand(publicKey: Uint8Array, seed: Uint8Array): unknown;
+export declare function xWing1024GenerateKeypair(): unknown;
+export declare function xWing768Decapsulate(ciphertext: Uint8Array, secretKey: Uint8Array): Uint8Array;
+export declare function xWing768DeriveKeypair(secretKey: Uint8Array): unknown;
+export declare function xWing768Encapsulate(publicKey: Uint8Array): unknown;
+export declare function xWing768EncapsulateDerand(publicKey: Uint8Array, seed: Uint8Array): unknown;
+export declare function xWing768GenerateKeypair(): unknown;

package/dist/wasmModuleTypes.js

@@ -0,0 +1,4 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+export {};

package/dist/wasmProvider.d.ts

@@ -0,0 +1,94 @@
+type GenerateKeypairFn = () => unknown;
+type GenerateKeypairFromSeedFn = (seed: Uint8Array) => unknown;
+type Argon2idFn = (kdfVersion: number, secret: Uint8Array, salt: Uint8Array) => unknown;
+type AeadFn = (key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, text: Uint8Array) => unknown;
+type KeyWrapFn = (wrappingKey: Uint8Array, keyMaterial: Uint8Array) => unknown;
+type BytesToStringFn = (bytes: Uint8Array) => unknown;
+type BytesToObjectFn = (bytes: Uint8Array) => unknown;
+type StringToBytesFn = (text: string) => unknown;
+type StringToObjectFn = (text: string) => unknown;
+type StringBytesToStringFn = (text: string, bytes: Uint8Array) => unknown;
+type SignatureSignFn = (secretKey: Uint8Array, message: Uint8Array) => unknown;
+type SignatureVerifyFn = (publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array) => unknown;
+type RsaPkcs1v15VerifyFn = (publicKeyDer: Uint8Array, publicKeyEncoding: number, hashSuite: number, message: Uint8Array, signature: Uint8Array) => unknown;
+type RsaPssVerifyFn = (publicKeyDer: Uint8Array, publicKeyEncoding: number, messageHashSuite: number, mgf1HashSuite: number, saltLength: number, message: Uint8Array, signature: Uint8Array) => unknown;
+type HpkeOpenFn = (suite: number, recipientSecretKey: Uint8Array, encapsulatedKey: Uint8Array, info: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array) => unknown;
+type HpkeSealFn = (suite: number, recipientPublicKey: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array) => unknown;
+type HpkeSealDerandFn = (suite: number, recipientPublicKey: Uint8Array, encapsulationRandomness: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array) => unknown;
+type DeriveKeypairFn = (secretKey: Uint8Array) => unknown;
+type EncapsulateFn = (publicKey: Uint8Array) => unknown;
+type EncapsulateDerandFn = (publicKey: Uint8Array, seed: Uint8Array) => unknown;
+type DecapsulateFn = (ciphertext: Uint8Array, secretKey: Uint8Array) => unknown;
+export type ReallyMeWasmProvider = Readonly<{
+    aes256GcmSeal: AeadFn;
+    aes256GcmOpen: AeadFn;
+    aes256GcmSivSeal: AeadFn;
+    aes256GcmSivOpen: AeadFn;
+    chacha20Poly1305Seal: AeadFn;
+    chacha20Poly1305Open: AeadFn;
+    xchacha20Poly1305Seal: AeadFn;
+    xchacha20Poly1305Open: AeadFn;
+    aes256KwWrapKey: KeyWrapFn;
+    aes256KwUnwrapKey: KeyWrapFn;
+    argon2idDeriveKey: Argon2idFn;
+    base64urlEncode: BytesToStringFn;
+    base64urlDecode: StringToBytesFn;
+    multibaseBase64urlEncode: BytesToStringFn;
+    multibaseBase58btcEncode: BytesToStringFn;
+    multibaseDecode: StringToBytesFn;
+    multicodecPrefixForName: StringToObjectFn;
+    multicodecLookupPrefix: BytesToObjectFn;
+    multikeyEncode: StringBytesToStringFn;
+    multikeyParse: StringToObjectFn;
+    dagCborComputeCid: BytesToStringFn;
+    dagCborVerifyCid: StringBytesToStringFn;
+    hpkeSealBase: HpkeSealFn;
+    hpkeSealBaseDerand: HpkeSealDerandFn;
+    hpkeOpenBase: HpkeOpenFn;
+    mlDsa44GenerateKeypair: GenerateKeypairFn;
+    mlDsa44DeriveKeypair: GenerateKeypairFromSeedFn;
+    mlDsa44Sign: SignatureSignFn;
+    mlDsa44Verify: SignatureVerifyFn;
+    mlDsa65GenerateKeypair: GenerateKeypairFn;
+    mlDsa65DeriveKeypair: GenerateKeypairFromSeedFn;
+    mlDsa65Sign: SignatureSignFn;
+    mlDsa65Verify: SignatureVerifyFn;
+    mlDsa87GenerateKeypair: GenerateKeypairFn;
+    mlDsa87DeriveKeypair: GenerateKeypairFromSeedFn;
+    mlDsa87Sign: SignatureSignFn;
+    mlDsa87Verify: SignatureVerifyFn;
+    mlKem512GenerateKeypair: GenerateKeypairFn;
+    mlKem512DeriveKeypair: GenerateKeypairFromSeedFn;
+    mlKem512Encapsulate: EncapsulateFn;
+    mlKem512EncapsulateDerand: EncapsulateDerandFn;
+    mlKem512Decapsulate: DecapsulateFn;
+    mlKem768GenerateKeypair: GenerateKeypairFn;
+    mlKem768DeriveKeypair: GenerateKeypairFromSeedFn;
+    mlKem768Encapsulate: EncapsulateFn;
+    mlKem768EncapsulateDerand: EncapsulateDerandFn;
+    mlKem768Decapsulate: DecapsulateFn;
+    mlKem1024GenerateKeypair: GenerateKeypairFn;
+    mlKem1024DeriveKeypair: GenerateKeypairFromSeedFn;
+    mlKem1024Encapsulate: EncapsulateFn;
+    mlKem1024EncapsulateDerand: EncapsulateDerandFn;
+    mlKem1024Decapsulate: DecapsulateFn;
+    slhDsaSha2128sGenerateKeypair: GenerateKeypairFn;
+    slhDsaSha2128sDeriveKeypair: SignatureVerifyFn;
+    slhDsaSha2128sSign: SignatureSignFn;
+    slhDsaSha2128sVerify: SignatureVerifyFn;
+    rsaVerifyPkcs1v15: RsaPkcs1v15VerifyFn;
+    rsaVerifyPss: RsaPssVerifyFn;
+    xWing768GenerateKeypair: GenerateKeypairFn;
+    xWing768DeriveKeypair: DeriveKeypairFn;
+    xWing768Encapsulate: EncapsulateFn;
+    xWing768EncapsulateDerand: EncapsulateDerandFn;
+    xWing768Decapsulate: DecapsulateFn;
+    xWing1024GenerateKeypair: GenerateKeypairFn;
+    xWing1024DeriveKeypair: DeriveKeypairFn;
+    xWing1024Encapsulate: EncapsulateFn;
+    xWing1024EncapsulateDerand: EncapsulateDerandFn;
+    xWing1024Decapsulate: DecapsulateFn;
+}>;
+export declare const installReallyMeWasmProvider: (module: unknown) => void;
+export declare const requireReallyMeWasmProvider: () => ReallyMeWasmProvider;
+export {};

package/dist/wasmProvider.js

@@ -0,0 +1,173 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+import { ReallyMeCryptoError } from "./errors.js";
+let installedProvider;
+const requireObject = (module) => {
+    if (typeof module !== "object" || module === null) {
+        throw new ReallyMeCryptoError("provider-failure");
+    }
+    return module;
+};
+const requireFunction = (module, name) => {
+    const candidate = Reflect.get(module, name);
+    if (typeof candidate !== "function") {
+        throw new ReallyMeCryptoError("provider-failure");
+    }
+    return (...args) => {
+        try {
+            return candidate(...args);
+        }
+        catch (error) {
+            throw new ReallyMeCryptoError(wasmErrorCode(error));
+        }
+    };
+};
+const wasmErrorCode = (error) => {
+    switch (error) {
+        case "invalid-input":
+            return "invalid-input";
+        case "invalid-signature":
+            return "invalid-signature";
+        case "unsupported-algorithm":
+            return "unsupported-algorithm";
+        case "provider-failure":
+        default:
+            return "provider-failure";
+    }
+};
+const function0 = (module, name) => {
+    const callable = requireFunction(module, name);
+    return () => callable();
+};
+const function1 = (module, name) => {
+    const callable = requireFunction(module, name);
+    return (first) => callable(first);
+};
+const function2 = (module, name) => {
+    const callable = requireFunction(module, name);
+    return (first, second) => callable(first, second);
+};
+const stringFunction1 = (module, name) => {
+    const callable = requireFunction(module, name);
+    return (text) => callable(text);
+};
+const bytesFunction1 = (module, name) => {
+    const callable = requireFunction(module, name);
+    return (bytes) => callable(bytes);
+};
+const stringBytesFunction2 = (module, name) => {
+    const callable = requireFunction(module, name);
+    return (text, bytes) => callable(text, bytes);
+};
+const function3 = (module, name) => {
+    const callable = requireFunction(module, name);
+    return (first, second, third) => callable(first, second, third);
+};
+const function4 = (module, name) => {
+    const callable = requireFunction(module, name);
+    return (first, second, third, fourth) => callable(first, second, third, fourth);
+};
+const argon2idFunction = (module, name) => {
+    const callable = requireFunction(module, name);
+    return (kdfVersion, secret, salt) => callable(kdfVersion, secret, salt);
+};
+const hpkeSealFunction = (module, name) => {
+    const callable = requireFunction(module, name);
+    return (suite, recipientPublicKey, info, aad, plaintext) => callable(suite, recipientPublicKey, info, aad, plaintext);
+};
+const hpkeSealDerandFunction = (module, name) => {
+    const callable = requireFunction(module, name);
+    return (suite, recipientPublicKey, encapsulationRandomness, info, aad, plaintext) => callable(suite, recipientPublicKey, encapsulationRandomness, info, aad, plaintext);
+};
+const hpkeOpenFunction = (module, name) => {
+    const callable = requireFunction(module, name);
+    return (suite, recipientSecretKey, encapsulatedKey, info, aad, ciphertext) => callable(suite, recipientSecretKey, encapsulatedKey, info, aad, ciphertext);
+};
+const rsaPkcs1v15VerifyFunction = (module, name) => {
+    const callable = requireFunction(module, name);
+    return (publicKeyDer, publicKeyEncoding, hashSuite, message, signature) => callable(publicKeyDer, publicKeyEncoding, hashSuite, message, signature);
+};
+const rsaPssVerifyFunction = (module, name) => {
+    const callable = requireFunction(module, name);
+    return (publicKeyDer, publicKeyEncoding, messageHashSuite, mgf1HashSuite, saltLength, message, signature) => callable(publicKeyDer, publicKeyEncoding, messageHashSuite, mgf1HashSuite, saltLength, message, signature);
+};
+export const installReallyMeWasmProvider = (module) => {
+    const providerModule = requireObject(module);
+    installedProvider = {
+        aes256GcmSeal: function4(providerModule, "aes256GcmSeal"),
+        aes256GcmOpen: function4(providerModule, "aes256GcmOpen"),
+        aes256GcmSivSeal: function4(providerModule, "aes256GcmSivSeal"),
+        aes256GcmSivOpen: function4(providerModule, "aes256GcmSivOpen"),
+        chacha20Poly1305Seal: function4(providerModule, "chacha20Poly1305Seal"),
+        chacha20Poly1305Open: function4(providerModule, "chacha20Poly1305Open"),
+        xchacha20Poly1305Seal: function4(providerModule, "xchacha20Poly1305Seal"),
+        xchacha20Poly1305Open: function4(providerModule, "xchacha20Poly1305Open"),
+        aes256KwWrapKey: function2(providerModule, "aes256KwWrapKey"),
+        aes256KwUnwrapKey: function2(providerModule, "aes256KwUnwrapKey"),
+        argon2idDeriveKey: argon2idFunction(providerModule, "argon2idDeriveKey"),
+        base64urlEncode: bytesFunction1(providerModule, "base64urlEncode"),
+        base64urlDecode: stringFunction1(providerModule, "base64urlDecode"),
+        multibaseBase64urlEncode: bytesFunction1(providerModule, "multibaseBase64urlEncode"),
+        multibaseBase58btcEncode: bytesFunction1(providerModule, "multibaseBase58btcEncode"),
+        multibaseDecode: stringFunction1(providerModule, "multibaseDecode"),
+        multicodecPrefixForName: stringFunction1(providerModule, "multicodecPrefixForName"),
+        multicodecLookupPrefix: bytesFunction1(providerModule, "multicodecLookupPrefix"),
+        multikeyEncode: stringBytesFunction2(providerModule, "multikeyEncode"),
+        multikeyParse: stringFunction1(providerModule, "multikeyParse"),
+        dagCborComputeCid: bytesFunction1(providerModule, "dagCborComputeCid"),
+        dagCborVerifyCid: stringBytesFunction2(providerModule, "dagCborVerifyCid"),
+        hpkeSealBase: hpkeSealFunction(providerModule, "hpkeSealBase"),
+        hpkeSealBaseDerand: hpkeSealDerandFunction(providerModule, "hpkeSealBaseDerand"),
+        hpkeOpenBase: hpkeOpenFunction(providerModule, "hpkeOpenBase"),
+        mlDsa44GenerateKeypair: function0(providerModule, "mlDsa44GenerateKeypair"),
+        mlDsa44DeriveKeypair: function1(providerModule, "mlDsa44DeriveKeypair"),
+        mlDsa44Sign: function2(providerModule, "mlDsa44Sign"),
+        mlDsa44Verify: function3(providerModule, "mlDsa44Verify"),
+        mlDsa65GenerateKeypair: function0(providerModule, "mlDsa65GenerateKeypair"),
+        mlDsa65DeriveKeypair: function1(providerModule, "mlDsa65DeriveKeypair"),
+        mlDsa65Sign: function2(providerModule, "mlDsa65Sign"),
+        mlDsa65Verify: function3(providerModule, "mlDsa65Verify"),
+        mlDsa87GenerateKeypair: function0(providerModule, "mlDsa87GenerateKeypair"),
+        mlDsa87DeriveKeypair: function1(providerModule, "mlDsa87DeriveKeypair"),
+        mlDsa87Sign: function2(providerModule, "mlDsa87Sign"),
+        mlDsa87Verify: function3(providerModule, "mlDsa87Verify"),
+        mlKem512GenerateKeypair: function0(providerModule, "mlKem512GenerateKeypair"),
+        mlKem512DeriveKeypair: function1(providerModule, "mlKem512DeriveKeypair"),
+        mlKem512Encapsulate: function1(providerModule, "mlKem512Encapsulate"),
+        mlKem512EncapsulateDerand: function2(providerModule, "mlKem512EncapsulateDerand"),
+        mlKem512Decapsulate: function2(providerModule, "mlKem512Decapsulate"),
+        mlKem768GenerateKeypair: function0(providerModule, "mlKem768GenerateKeypair"),
+        mlKem768DeriveKeypair: function1(providerModule, "mlKem768DeriveKeypair"),
+        mlKem768Encapsulate: function1(providerModule, "mlKem768Encapsulate"),
+        mlKem768EncapsulateDerand: function2(providerModule, "mlKem768EncapsulateDerand"),
+        mlKem768Decapsulate: function2(providerModule, "mlKem768Decapsulate"),
+        mlKem1024GenerateKeypair: function0(providerModule, "mlKem1024GenerateKeypair"),
+        mlKem1024DeriveKeypair: function1(providerModule, "mlKem1024DeriveKeypair"),
+        mlKem1024Encapsulate: function1(providerModule, "mlKem1024Encapsulate"),
+        mlKem1024EncapsulateDerand: function2(providerModule, "mlKem1024EncapsulateDerand"),
+        mlKem1024Decapsulate: function2(providerModule, "mlKem1024Decapsulate"),
+        slhDsaSha2128sGenerateKeypair: function0(providerModule, "slhDsaSha2128sGenerateKeypair"),
+        slhDsaSha2128sDeriveKeypair: function3(providerModule, "slhDsaSha2128sDeriveKeypair"),
+        slhDsaSha2128sSign: function2(providerModule, "slhDsaSha2128sSign"),
+        slhDsaSha2128sVerify: function3(providerModule, "slhDsaSha2128sVerify"),
+        rsaVerifyPkcs1v15: rsaPkcs1v15VerifyFunction(providerModule, "rsaVerifyPkcs1v15"),
+        rsaVerifyPss: rsaPssVerifyFunction(providerModule, "rsaVerifyPss"),
+        xWing768GenerateKeypair: function0(providerModule, "xWing768GenerateKeypair"),
+        xWing768DeriveKeypair: function1(providerModule, "xWing768DeriveKeypair"),
+        xWing768Encapsulate: function1(providerModule, "xWing768Encapsulate"),
+        xWing768EncapsulateDerand: function2(providerModule, "xWing768EncapsulateDerand"),
+        xWing768Decapsulate: function2(providerModule, "xWing768Decapsulate"),
+        xWing1024GenerateKeypair: function0(providerModule, "xWing1024GenerateKeypair"),
+        xWing1024DeriveKeypair: function1(providerModule, "xWing1024DeriveKeypair"),
+        xWing1024Encapsulate: function1(providerModule, "xWing1024Encapsulate"),
+        xWing1024EncapsulateDerand: function2(providerModule, "xWing1024EncapsulateDerand"),
+        xWing1024Decapsulate: function2(providerModule, "xWing1024Decapsulate"),
+    };
+};
+export const requireReallyMeWasmProvider = () => {
+    if (installedProvider === undefined) {
+        throw new ReallyMeCryptoError("provider-failure");
+    }
+    return installedProvider;
+};

package/dist/x25519.d.ts

@@ -0,0 +1,28 @@
+/**
+ * X25519 key agreement backed by @noble/curves — the same pinned
+ * implementation the TypeScript conformance lane proves vectors against.
+ *
+ * The package returns the raw 32-byte Diffie-Hellman output. Higher-level
+ * protocols must bind it through their own KDF transcript; this primitive does
+ * not apply HKDF implicitly because HPKE, MLS, and ratchets label transcripts
+ * differently.
+ */
+export declare const X25519_SECRET_KEY_LENGTH = 32;
+export declare const X25519_PUBLIC_KEY_LENGTH = 32;
+export declare const X25519_SHARED_SECRET_LENGTH = 32;
+export declare const ReallyMeX25519: {
+    /** Generates a random X25519 keypair: 32-byte public key, 32-byte secret. */
+    readonly generateKeyPair: () => {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+    /** Derives the X25519 keypair from a 32-byte secret. */
+    readonly deriveKeyPair: (secretKey: Uint8Array) => {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+    /** Derives the 32-byte X25519 public key from a 32-byte secret. */
+    readonly derivePublicKey: (secretKey: Uint8Array) => Uint8Array;
+    /** Derives the raw 32-byte X25519 shared secret. */
+    readonly deriveSharedSecret: (publicKey: Uint8Array, secretKey: Uint8Array) => Uint8Array;
+};

package/dist/x25519.js

@@ -0,0 +1,66 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+import { x25519 } from "@noble/curves/ed25519.js";
+import { ReallyMeCryptoError } from "./errors.js";
+/**
+ * X25519 key agreement backed by @noble/curves — the same pinned
+ * implementation the TypeScript conformance lane proves vectors against.
+ *
+ * The package returns the raw 32-byte Diffie-Hellman output. Higher-level
+ * protocols must bind it through their own KDF transcript; this primitive does
+ * not apply HKDF implicitly because HPKE, MLS, and ratchets label transcripts
+ * differently.
+ */
+export const X25519_SECRET_KEY_LENGTH = 32;
+export const X25519_PUBLIC_KEY_LENGTH = 32;
+export const X25519_SHARED_SECRET_LENGTH = 32;
+export const ReallyMeX25519 = {
+    /** Generates a random X25519 keypair: 32-byte public key, 32-byte secret. */
+    generateKeyPair() {
+        const secretKey = x25519.utils.randomSecretKey();
+        return {
+            publicKey: x25519.getPublicKey(secretKey),
+            secretKey,
+        };
+    },
+    /** Derives the X25519 keypair from a 32-byte secret. */
+    deriveKeyPair(secretKey) {
+        return {
+            publicKey: this.derivePublicKey(secretKey),
+            secretKey: secretKey.slice(),
+        };
+    },
+    /** Derives the 32-byte X25519 public key from a 32-byte secret. */
+    derivePublicKey(secretKey) {
+        if (secretKey.length !== X25519_SECRET_KEY_LENGTH) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        try {
+            return x25519.getPublicKey(secretKey);
+        }
+        catch {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+    },
+    /** Derives the raw 32-byte X25519 shared secret. */
+    deriveSharedSecret(publicKey, secretKey) {
+        if (publicKey.length !== X25519_PUBLIC_KEY_LENGTH ||
+            secretKey.length !== X25519_SECRET_KEY_LENGTH) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        try {
+            const sharedSecret = x25519.getSharedSecret(secretKey, publicKey);
+            if (!sharedSecret.some((byte) => byte !== 0)) {
+                throw new ReallyMeCryptoError("invalid-input");
+            }
+            return sharedSecret;
+        }
+        catch (error) {
+            if (error instanceof ReallyMeCryptoError) {
+                throw error;
+            }
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+    },
+};

package/dist/xWing.d.ts

@@ -0,0 +1,23 @@
+import type { ReallyMeKemAlgorithm } from "./algorithms.js";
+export declare const X_WING_SECRET_KEY_LENGTH = 32;
+export declare const X_WING_ENCAPSULATION_SEED_LENGTH = 64;
+export declare const X_WING_SHARED_SECRET_LENGTH = 32;
+export declare const X_WING_768_PUBLIC_KEY_LENGTH = 1216;
+export declare const X_WING_768_CIPHERTEXT_LENGTH = 1120;
+export declare const X_WING_1024_PUBLIC_KEY_LENGTH = 1600;
+export declare const X_WING_1024_CIPHERTEXT_LENGTH = 1600;
+export type ReallyMeXWingKeyPair = Readonly<{
+    publicKey: Uint8Array;
+    secretKey: Uint8Array;
+}>;
+export type ReallyMeXWingEncapsulation = Readonly<{
+    sharedSecret: Uint8Array;
+    ciphertext: Uint8Array;
+}>;
+export declare const ReallyMeXWing: {
+    readonly generateKeyPair: (algorithm: ReallyMeKemAlgorithm) => ReallyMeXWingKeyPair;
+    readonly deriveKeyPair: (algorithm: ReallyMeKemAlgorithm, secretKey: Uint8Array) => ReallyMeXWingKeyPair;
+    readonly encapsulate: (algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array) => ReallyMeXWingEncapsulation;
+    readonly decapsulate: (algorithm: ReallyMeKemAlgorithm, ciphertext: Uint8Array, secretKey: Uint8Array) => Uint8Array;
+};
+export declare const encapsulateXWingDeterministicallyForTest: (algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array, seed: Uint8Array) => ReallyMeXWingEncapsulation;

package/dist/xWing.js

@@ -0,0 +1,86 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+import { ReallyMeCryptoError } from "./errors.js";
+import { ensureBytes, readByteArrayProperty } from "./validateBytes.js";
+import { requireReallyMeWasmProvider } from "./wasmProvider.js";
+export const X_WING_SECRET_KEY_LENGTH = 32;
+export const X_WING_ENCAPSULATION_SEED_LENGTH = 64;
+export const X_WING_SHARED_SECRET_LENGTH = 32;
+export const X_WING_768_PUBLIC_KEY_LENGTH = 1_216;
+export const X_WING_768_CIPHERTEXT_LENGTH = 1_120;
+export const X_WING_1024_PUBLIC_KEY_LENGTH = 1_600;
+export const X_WING_1024_CIPHERTEXT_LENGTH = 1_600;
+const xWingSuite = (algorithm) => {
+    switch (algorithm) {
+        case "ML-KEM-512":
+        case "ML-KEM-768":
+        case "ML-KEM-1024":
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+        case "X-Wing-768": {
+            const provider = requireReallyMeWasmProvider();
+            return {
+                publicKeyLength: X_WING_768_PUBLIC_KEY_LENGTH,
+                ciphertextLength: X_WING_768_CIPHERTEXT_LENGTH,
+                generateKeypair: provider.xWing768GenerateKeypair,
+                deriveKeypair: provider.xWing768DeriveKeypair,
+                encapsulate: provider.xWing768Encapsulate,
+                encapsulateDerand: provider.xWing768EncapsulateDerand,
+                decapsulate: provider.xWing768Decapsulate,
+            };
+        }
+        case "X-Wing-1024": {
+            const provider = requireReallyMeWasmProvider();
+            return {
+                publicKeyLength: X_WING_1024_PUBLIC_KEY_LENGTH,
+                ciphertextLength: X_WING_1024_CIPHERTEXT_LENGTH,
+                generateKeypair: provider.xWing1024GenerateKeypair,
+                deriveKeypair: provider.xWing1024DeriveKeypair,
+                encapsulate: provider.xWing1024Encapsulate,
+                encapsulateDerand: provider.xWing1024EncapsulateDerand,
+                decapsulate: provider.xWing1024Decapsulate,
+            };
+        }
+    }
+};
+const readKeyPair = (value, suite) => ({
+    publicKey: readByteArrayProperty(value, "publicKey", suite.publicKeyLength),
+    secretKey: readByteArrayProperty(value, "secretKey", X_WING_SECRET_KEY_LENGTH),
+});
+const readEncapsulation = (value, suite) => ({
+    ciphertext: readByteArrayProperty(value, "ciphertext", suite.ciphertextLength),
+    sharedSecret: readByteArrayProperty(value, "sharedSecret", X_WING_SHARED_SECRET_LENGTH),
+});
+export const ReallyMeXWing = {
+    generateKeyPair(algorithm) {
+        const suite = xWingSuite(algorithm);
+        return readKeyPair(suite.generateKeypair(), suite);
+    },
+    deriveKeyPair(algorithm, secretKey) {
+        ensureBytes(secretKey, X_WING_SECRET_KEY_LENGTH);
+        const suite = xWingSuite(algorithm);
+        return readKeyPair(suite.deriveKeypair(secretKey), suite);
+    },
+    encapsulate(algorithm, publicKey) {
+        const suite = xWingSuite(algorithm);
+        ensureBytes(publicKey, suite.publicKeyLength);
+        return readEncapsulation(suite.encapsulate(publicKey), suite);
+    },
+    decapsulate(algorithm, ciphertext, secretKey) {
+        const suite = xWingSuite(algorithm);
+        ensureBytes(ciphertext, suite.ciphertextLength);
+        ensureBytes(secretKey, X_WING_SECRET_KEY_LENGTH);
+        const sharedSecret = suite.decapsulate(ciphertext, secretKey);
+        if (!(sharedSecret instanceof Uint8Array)) {
+            throw new ReallyMeCryptoError("provider-failure");
+        }
+        ensureBytes(sharedSecret, X_WING_SHARED_SECRET_LENGTH);
+        return sharedSecret;
+    },
+};
+export const encapsulateXWingDeterministicallyForTest = (algorithm, publicKey, seed) => {
+    const suite = xWingSuite(algorithm);
+    ensureBytes(publicKey, suite.publicKeyLength);
+    ensureBytes(seed, X_WING_ENCAPSULATION_SEED_LENGTH);
+    return readEncapsulation(suite.encapsulateDerand(publicKey, seed), suite);
+};

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@reallyme/crypto",
+  "version": "0.1.0",
+  "description": "ReallyMe crypto SDK for TypeScript/JavaScript with an explicit, pinned provider set.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./proto": {
+      "types": "./dist/proto.d.ts",
+      "default": "./dist/proto.js"
+    },
+    "./wasm/reallyme_crypto_wasm.js": {
+      "types": "./dist/wasmModuleTypes.d.ts",
+      "default": "./dist/wasm/reallyme_crypto_wasm.js"
+    },
+    "./wasm/reallyme_crypto_wasm_bg.wasm": {
+      "default": "./dist/wasm/reallyme_crypto_wasm_bg.wasm"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "npm run build:wasm && tsc",
+    "build:ts": "tsc",
+    "build:wasm": "node scripts/build-wasm.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "npm run build && node --test \"test/*.test.mjs\""
+  },
+  "dependencies": {
+    "@bufbuild/protobuf": "2.12.1",
+    "@noble/curves": "2.2.0",
+    "@noble/hashes": "2.2.0"
+  },
+  "devDependencies": {
+    "typescript": "5.8.3"
+  },
+  "engines": {
+    "node": ">=20.19.0"
+  }
+}