@reallyme/crypto 0.1.0

package/dist/proto.js

@@ -0,0 +1,342 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+import { ReallyMeCryptoError } from "./errors.js";
+export { AeadAlgorithm, AeadAlgorithmSchema, CryptoAlgorithmFamily, CryptoAlgorithmIdentifierSchema, CryptoAlgorithmFamilySchema, HashAlgorithm, HashAlgorithmSchema, HpkeSuite, HpkeSuiteSchema, JsonWebKeySchema, JsonWebKeySetSchema, KdfAlgorithm, KdfAlgorithmSchema, KemAlgorithm, KemAlgorithmSchema, KeyAgreementAlgorithm, KeyAgreementAlgorithmSchema, KeyWrapAlgorithm, KeyWrapAlgorithmSchema, MacAlgorithm, MacAlgorithmSchema, MulticodecKeyAlgorithm, MulticodecKeyAlgorithmSchema, SignatureAlgorithm, SignatureAlgorithmSchema, file_reallyme_crypto_v1_crypto, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+import { AeadAlgorithm, HashAlgorithm, HpkeSuite, KdfAlgorithm, KemAlgorithm, KeyAgreementAlgorithm, KeyWrapAlgorithm, MacAlgorithm, MulticodecKeyAlgorithm, SignatureAlgorithm, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+export const signatureAlgorithmFromProto = (value) => {
+    switch (value) {
+        case SignatureAlgorithm.ED25519:
+            return "Ed25519";
+        case SignatureAlgorithm.ECDSA_P256_SHA256:
+            return "ECDSA-P256-SHA256";
+        case SignatureAlgorithm.ECDSA_P384_SHA384:
+            return "ECDSA-P384-SHA384";
+        case SignatureAlgorithm.ECDSA_P521_SHA512:
+            return "ECDSA-P521-SHA512";
+        case SignatureAlgorithm.ECDSA_SECP256K1_SHA256:
+            return "ECDSA-secp256k1-SHA256";
+        case SignatureAlgorithm.BIP340_SCHNORR_SECP256K1_SHA256:
+            return "BIP340-Schnorr-secp256k1-SHA256";
+        case SignatureAlgorithm.RSA_PKCS1V15_SHA1:
+            return "RSA-PKCS1v15-SHA1";
+        case SignatureAlgorithm.RSA_PKCS1V15_SHA256:
+            return "RSA-PKCS1v15-SHA256";
+        case SignatureAlgorithm.RSA_PKCS1V15_SHA384:
+            return "RSA-PKCS1v15-SHA384";
+        case SignatureAlgorithm.RSA_PKCS1V15_SHA512:
+            return "RSA-PKCS1v15-SHA512";
+        case SignatureAlgorithm.RSA_PSS_SHA1_MGF1_SHA1:
+            return "RSA-PSS-SHA1-MGF1-SHA1";
+        case SignatureAlgorithm.RSA_PSS_SHA256_MGF1_SHA256:
+            return "RSA-PSS-SHA256-MGF1-SHA256";
+        case SignatureAlgorithm.RSA_PSS_SHA384_MGF1_SHA384:
+            return "RSA-PSS-SHA384-MGF1-SHA384";
+        case SignatureAlgorithm.RSA_PSS_SHA512_MGF1_SHA512:
+            return "RSA-PSS-SHA512-MGF1-SHA512";
+        case SignatureAlgorithm.ML_DSA_44:
+            return "ML-DSA-44";
+        case SignatureAlgorithm.ML_DSA_65:
+            return "ML-DSA-65";
+        case SignatureAlgorithm.ML_DSA_87:
+            return "ML-DSA-87";
+        case SignatureAlgorithm.SLH_DSA_SHA2_128S:
+            return "SLH-DSA-SHA2-128s";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const signatureAlgorithmToProto = (value) => {
+    switch (value) {
+        case "Ed25519":
+            return SignatureAlgorithm.ED25519;
+        case "ECDSA-P256-SHA256":
+            return SignatureAlgorithm.ECDSA_P256_SHA256;
+        case "ECDSA-P384-SHA384":
+            return SignatureAlgorithm.ECDSA_P384_SHA384;
+        case "ECDSA-P521-SHA512":
+            return SignatureAlgorithm.ECDSA_P521_SHA512;
+        case "ECDSA-secp256k1-SHA256":
+            return SignatureAlgorithm.ECDSA_SECP256K1_SHA256;
+        case "BIP340-Schnorr-secp256k1-SHA256":
+            return SignatureAlgorithm.BIP340_SCHNORR_SECP256K1_SHA256;
+        case "RSA-PKCS1v15-SHA1":
+            return SignatureAlgorithm.RSA_PKCS1V15_SHA1;
+        case "RSA-PKCS1v15-SHA256":
+            return SignatureAlgorithm.RSA_PKCS1V15_SHA256;
+        case "RSA-PKCS1v15-SHA384":
+            return SignatureAlgorithm.RSA_PKCS1V15_SHA384;
+        case "RSA-PKCS1v15-SHA512":
+            return SignatureAlgorithm.RSA_PKCS1V15_SHA512;
+        case "RSA-PSS-SHA1-MGF1-SHA1":
+            return SignatureAlgorithm.RSA_PSS_SHA1_MGF1_SHA1;
+        case "RSA-PSS-SHA256-MGF1-SHA256":
+            return SignatureAlgorithm.RSA_PSS_SHA256_MGF1_SHA256;
+        case "RSA-PSS-SHA384-MGF1-SHA384":
+            return SignatureAlgorithm.RSA_PSS_SHA384_MGF1_SHA384;
+        case "RSA-PSS-SHA512-MGF1-SHA512":
+            return SignatureAlgorithm.RSA_PSS_SHA512_MGF1_SHA512;
+        case "ML-DSA-44":
+            return SignatureAlgorithm.ML_DSA_44;
+        case "ML-DSA-65":
+            return SignatureAlgorithm.ML_DSA_65;
+        case "ML-DSA-87":
+            return SignatureAlgorithm.ML_DSA_87;
+        case "SLH-DSA-SHA2-128s":
+            return SignatureAlgorithm.SLH_DSA_SHA2_128S;
+    }
+};
+export const hashAlgorithmFromProto = (value) => {
+    switch (value) {
+        case HashAlgorithm.SHA2_256:
+            return "SHA2-256";
+        case HashAlgorithm.SHA2_384:
+            return "SHA2-384";
+        case HashAlgorithm.SHA2_512:
+            return "SHA2-512";
+        case HashAlgorithm.SHA3_224:
+            return "SHA3-224";
+        case HashAlgorithm.SHA3_256:
+            return "SHA3-256";
+        case HashAlgorithm.SHA3_384:
+            return "SHA3-384";
+        case HashAlgorithm.SHA3_512:
+            return "SHA3-512";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const hashAlgorithmToProto = (value) => {
+    switch (value) {
+        case "SHA2-256":
+            return HashAlgorithm.SHA2_256;
+        case "SHA2-384":
+            return HashAlgorithm.SHA2_384;
+        case "SHA2-512":
+            return HashAlgorithm.SHA2_512;
+        case "SHA3-224":
+            return HashAlgorithm.SHA3_224;
+        case "SHA3-256":
+            return HashAlgorithm.SHA3_256;
+        case "SHA3-384":
+            return HashAlgorithm.SHA3_384;
+        case "SHA3-512":
+            return HashAlgorithm.SHA3_512;
+    }
+};
+export const aeadAlgorithmFromProto = (value) => {
+    switch (value) {
+        case AeadAlgorithm.AES_256_GCM:
+            return "AES-256-GCM";
+        case AeadAlgorithm.AES_256_GCM_SIV:
+            return "AES-256-GCM-SIV";
+        case AeadAlgorithm.CHACHA20_POLY1305:
+            return "ChaCha20-Poly1305";
+        case AeadAlgorithm.XCHACHA20_POLY1305:
+            return "XChaCha20-Poly1305";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const aeadAlgorithmToProto = (value) => {
+    switch (value) {
+        case "AES-256-GCM":
+            return AeadAlgorithm.AES_256_GCM;
+        case "AES-256-GCM-SIV":
+            return AeadAlgorithm.AES_256_GCM_SIV;
+        case "ChaCha20-Poly1305":
+            return AeadAlgorithm.CHACHA20_POLY1305;
+        case "XChaCha20-Poly1305":
+            return AeadAlgorithm.XCHACHA20_POLY1305;
+    }
+};
+export const kemAlgorithmFromProto = (value) => {
+    switch (value) {
+        case KemAlgorithm.ML_KEM_512:
+            return "ML-KEM-512";
+        case KemAlgorithm.ML_KEM_768:
+            return "ML-KEM-768";
+        case KemAlgorithm.ML_KEM_1024:
+            return "ML-KEM-1024";
+        case KemAlgorithm.X_WING_768:
+            return "X-Wing-768";
+        case KemAlgorithm.X_WING_1024:
+            return "X-Wing-1024";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const kemAlgorithmToProto = (value) => {
+    switch (value) {
+        case "ML-KEM-512":
+            return KemAlgorithm.ML_KEM_512;
+        case "ML-KEM-768":
+            return KemAlgorithm.ML_KEM_768;
+        case "ML-KEM-1024":
+            return KemAlgorithm.ML_KEM_1024;
+        case "X-Wing-768":
+            return KemAlgorithm.X_WING_768;
+        case "X-Wing-1024":
+            return KemAlgorithm.X_WING_1024;
+    }
+};
+export const keyAgreementAlgorithmFromProto = (value) => {
+    switch (value) {
+        case KeyAgreementAlgorithm.X25519:
+            return "X25519";
+        case KeyAgreementAlgorithm.P256_ECDH:
+            return "P-256-ECDH";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const keyAgreementAlgorithmToProto = (value) => {
+    switch (value) {
+        case "X25519":
+            return KeyAgreementAlgorithm.X25519;
+        case "P-256-ECDH":
+            return KeyAgreementAlgorithm.P256_ECDH;
+    }
+};
+export const macAlgorithmFromProto = (value) => {
+    switch (value) {
+        case MacAlgorithm.HMAC_SHA256:
+            return "HMAC-SHA-256";
+        case MacAlgorithm.HMAC_SHA512:
+            return "HMAC-SHA-512";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const macAlgorithmToProto = (value) => {
+    switch (value) {
+        case "HMAC-SHA-256":
+            return MacAlgorithm.HMAC_SHA256;
+        case "HMAC-SHA-512":
+            return MacAlgorithm.HMAC_SHA512;
+    }
+};
+export const kdfAlgorithmFromProto = (value) => {
+    switch (value) {
+        case KdfAlgorithm.HKDF_SHA256:
+            return "HKDF-SHA256";
+        case KdfAlgorithm.ARGON2ID:
+            return "Argon2id";
+        case KdfAlgorithm.PBKDF2_HMAC_SHA256:
+            return "PBKDF2-HMAC-SHA-256";
+        case KdfAlgorithm.PBKDF2_HMAC_SHA512:
+            return "PBKDF2-HMAC-SHA-512";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const kdfAlgorithmToProto = (value) => {
+    switch (value) {
+        case "HKDF-SHA256":
+            return KdfAlgorithm.HKDF_SHA256;
+        case "Argon2id":
+            return KdfAlgorithm.ARGON2ID;
+        case "PBKDF2-HMAC-SHA-256":
+            return KdfAlgorithm.PBKDF2_HMAC_SHA256;
+        case "PBKDF2-HMAC-SHA-512":
+            return KdfAlgorithm.PBKDF2_HMAC_SHA512;
+    }
+};
+export const keyWrapAlgorithmFromProto = (value) => {
+    switch (value) {
+        case KeyWrapAlgorithm.AES_256_KW:
+            return "AES-256-KW";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const keyWrapAlgorithmToProto = (value) => {
+    switch (value) {
+        case "AES-256-KW":
+            return KeyWrapAlgorithm.AES_256_KW;
+    }
+};
+export const hpkeSuiteFromProto = (value) => {
+    switch (value) {
+        case HpkeSuite.DHKEM_P256_HKDF_SHA256_HKDF_SHA256_AES_256_GCM:
+            return "DHKEM-P256-HKDF-SHA256-HKDF-SHA256-AES-256-GCM";
+        case HpkeSuite.DHKEM_X25519_HKDF_SHA256_HKDF_SHA256_CHACHA20_POLY1305:
+            return "DHKEM-X25519-HKDF-SHA256-HKDF-SHA256-CHACHA20-POLY1305";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const hpkeSuiteToProto = (value) => {
+    switch (value) {
+        case "DHKEM-P256-HKDF-SHA256-HKDF-SHA256-AES-256-GCM":
+            return HpkeSuite.DHKEM_P256_HKDF_SHA256_HKDF_SHA256_AES_256_GCM;
+        case "DHKEM-X25519-HKDF-SHA256-HKDF-SHA256-CHACHA20-POLY1305":
+            return HpkeSuite.DHKEM_X25519_HKDF_SHA256_HKDF_SHA256_CHACHA20_POLY1305;
+    }
+};
+export const multicodecKeyAlgorithmFromProto = (value) => {
+    switch (value) {
+        case MulticodecKeyAlgorithm.ED25519_PUB:
+            return "ed25519-pub";
+        case MulticodecKeyAlgorithm.X25519_PUB:
+            return "x25519-pub";
+        case MulticodecKeyAlgorithm.SECP256K1_PUB:
+            return "secp256k1-pub";
+        case MulticodecKeyAlgorithm.P256_PUB:
+            return "p256-pub";
+        case MulticodecKeyAlgorithm.P384_PUB:
+            return "p384-pub";
+        case MulticodecKeyAlgorithm.P521_PUB:
+            return "p521-pub";
+        case MulticodecKeyAlgorithm.ED448_PUB:
+            return "ed448-pub";
+        case MulticodecKeyAlgorithm.RSA_PUB:
+            return "rsa-pub";
+        case MulticodecKeyAlgorithm.ML_KEM_512_PUB:
+            return "mlkem-512-pub";
+        case MulticodecKeyAlgorithm.ML_KEM_768_PUB:
+            return "mlkem-768-pub";
+        case MulticodecKeyAlgorithm.ML_KEM_1024_PUB:
+            return "mlkem-1024-pub";
+        case MulticodecKeyAlgorithm.ML_DSA_44_PUB:
+            return "mldsa-44-pub";
+        case MulticodecKeyAlgorithm.ML_DSA_65_PUB:
+            return "mldsa-65-pub";
+        case MulticodecKeyAlgorithm.ML_DSA_87_PUB:
+            return "mldsa-87-pub";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const multicodecKeyAlgorithmToProto = (value) => {
+    switch (value) {
+        case "ed25519-pub":
+            return MulticodecKeyAlgorithm.ED25519_PUB;
+        case "x25519-pub":
+            return MulticodecKeyAlgorithm.X25519_PUB;
+        case "secp256k1-pub":
+            return MulticodecKeyAlgorithm.SECP256K1_PUB;
+        case "p256-pub":
+            return MulticodecKeyAlgorithm.P256_PUB;
+        case "p384-pub":
+            return MulticodecKeyAlgorithm.P384_PUB;
+        case "p521-pub":
+            return MulticodecKeyAlgorithm.P521_PUB;
+        case "ed448-pub":
+            return MulticodecKeyAlgorithm.ED448_PUB;
+        case "rsa-pub":
+            return MulticodecKeyAlgorithm.RSA_PUB;
+        case "mlkem-512-pub":
+            return MulticodecKeyAlgorithm.ML_KEM_512_PUB;
+        case "mlkem-768-pub":
+            return MulticodecKeyAlgorithm.ML_KEM_768_PUB;
+        case "mlkem-1024-pub":
+            return MulticodecKeyAlgorithm.ML_KEM_1024_PUB;
+        case "mldsa-44-pub":
+            return MulticodecKeyAlgorithm.ML_DSA_44_PUB;
+        case "mldsa-65-pub":
+            return MulticodecKeyAlgorithm.ML_DSA_65_PUB;
+        case "mldsa-87-pub":
+            return MulticodecKeyAlgorithm.ML_DSA_87_PUB;
+    }
+};

package/dist/providerCatalog.d.ts

@@ -0,0 +1,9 @@
+/** Providers compiled into the TypeScript package. */
+export declare const REALLYME_CRYPTO_PROVIDERS: readonly ["@noble/curves", "@noble/hashes", "ReallyMe Rust WASM"];
+export type ReallyMeCryptoProvider = (typeof REALLYME_CRYPTO_PROVIDERS)[number];
+/**
+ * Compile-time provider catalog used by package consumers and conformance
+ * tests to assert that TypeScript crypto is backed by explicit provider
+ * packages.
+ */
+export declare const compiledProviders: readonly ReallyMeCryptoProvider[];

package/dist/providerCatalog.js

@@ -0,0 +1,15 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+/** Providers compiled into the TypeScript package. */
+export const REALLYME_CRYPTO_PROVIDERS = [
+    "@noble/curves",
+    "@noble/hashes",
+    "ReallyMe Rust WASM",
+];
+/**
+ * Compile-time provider catalog used by package consumers and conformance
+ * tests to assert that TypeScript crypto is backed by explicit provider
+ * packages.
+ */
+export const compiledProviders = REALLYME_CRYPTO_PROVIDERS;

package/dist/rsa.d.ts

@@ -0,0 +1,13 @@
+import type { ReallyMeSignatureAlgorithm } from "./algorithms.js";
+export type ReallyMeRsaPublicKeyDerEncoding = "PKCS1" | "SPKI";
+export declare const RSA_PUBLIC_KEY_DER_MAX_LENGTH = 4096;
+export declare const RSA_SIGNATURE_MAX_LENGTH = 1024;
+/**
+ * RSA signature verification through the ReallyMe Rust WASM provider.
+ *
+ * RSA is verification-only in this SDK. It exists for X.509, eMRTD passive
+ * authentication, and legacy interoperability; no RSA signing API is exposed.
+ */
+export declare const ReallyMeRsa: {
+    readonly verify: (algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKeyDer: Uint8Array, publicKeyEncoding: ReallyMeRsaPublicKeyDerEncoding) => void;
+};

package/dist/rsa.js

@@ -0,0 +1,102 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+import { ReallyMeCryptoError } from "./errors.js";
+import { requireReallyMeWasmProvider } from "./wasmProvider.js";
+export const RSA_PUBLIC_KEY_DER_MAX_LENGTH = 4_096;
+export const RSA_SIGNATURE_MAX_LENGTH = 1_024;
+const RSA_HASH_SHA1 = 1;
+const RSA_HASH_SHA256 = 2;
+const RSA_HASH_SHA384 = 3;
+const RSA_HASH_SHA512 = 4;
+const RSA_PUBLIC_KEY_ENCODING_PKCS1_DER = 1;
+const RSA_PUBLIC_KEY_ENCODING_SPKI_DER = 2;
+const validateBytes = (bytes, maxLength) => {
+    if (bytes.length === 0 || bytes.length > maxLength) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+const encodingId = (encoding) => {
+    switch (encoding) {
+        case "PKCS1":
+            return RSA_PUBLIC_KEY_ENCODING_PKCS1_DER;
+        case "SPKI":
+            return RSA_PUBLIC_KEY_ENCODING_SPKI_DER;
+        default:
+            throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+const pkcs1v15Suite = (algorithm) => {
+    switch (algorithm) {
+        case "RSA-PKCS1v15-SHA1":
+            return { hashSuite: RSA_HASH_SHA1 };
+        case "RSA-PKCS1v15-SHA256":
+            return { hashSuite: RSA_HASH_SHA256 };
+        case "RSA-PKCS1v15-SHA384":
+            return { hashSuite: RSA_HASH_SHA384 };
+        case "RSA-PKCS1v15-SHA512":
+            return { hashSuite: RSA_HASH_SHA512 };
+        default:
+            return undefined;
+    }
+};
+const pssSuite = (algorithm) => {
+    switch (algorithm) {
+        case "RSA-PSS-SHA1-MGF1-SHA1":
+            return {
+                messageHashSuite: RSA_HASH_SHA1,
+                mgf1HashSuite: RSA_HASH_SHA1,
+                saltLength: 20,
+            };
+        case "RSA-PSS-SHA256-MGF1-SHA256":
+            return {
+                messageHashSuite: RSA_HASH_SHA256,
+                mgf1HashSuite: RSA_HASH_SHA256,
+                saltLength: 32,
+            };
+        case "RSA-PSS-SHA384-MGF1-SHA384":
+            return {
+                messageHashSuite: RSA_HASH_SHA384,
+                mgf1HashSuite: RSA_HASH_SHA384,
+                saltLength: 48,
+            };
+        case "RSA-PSS-SHA512-MGF1-SHA512":
+            return {
+                messageHashSuite: RSA_HASH_SHA512,
+                mgf1HashSuite: RSA_HASH_SHA512,
+                saltLength: 64,
+            };
+        default:
+            return undefined;
+    }
+};
+const readVoid = (value) => {
+    if (value !== undefined) {
+        throw new ReallyMeCryptoError("provider-failure");
+    }
+};
+/**
+ * RSA signature verification through the ReallyMe Rust WASM provider.
+ *
+ * RSA is verification-only in this SDK. It exists for X.509, eMRTD passive
+ * authentication, and legacy interoperability; no RSA signing API is exposed.
+ */
+export const ReallyMeRsa = {
+    verify(algorithm, signature, message, publicKeyDer, publicKeyEncoding) {
+        validateBytes(publicKeyDer, RSA_PUBLIC_KEY_DER_MAX_LENGTH);
+        validateBytes(signature, RSA_SIGNATURE_MAX_LENGTH);
+        const encoding = encodingId(publicKeyEncoding);
+        const pkcs1 = pkcs1v15Suite(algorithm);
+        const provider = requireReallyMeWasmProvider();
+        if (pkcs1 !== undefined) {
+            readVoid(provider.rsaVerifyPkcs1v15(publicKeyDer, encoding, pkcs1.hashSuite, message, signature));
+            return;
+        }
+        const pss = pssSuite(algorithm);
+        if (pss !== undefined) {
+            readVoid(provider.rsaVerifyPss(publicKeyDer, encoding, pss.messageHashSuite, pss.mgf1HashSuite, pss.saltLength, message, signature));
+            return;
+        }
+        throw new ReallyMeCryptoError("unsupported-algorithm");
+    },
+};

package/dist/secp256k1.d.ts

@@ -0,0 +1,47 @@
+/**
+ * secp256k1 ECDSA backed by @noble/curves — the same pinned implementation
+ * the TypeScript conformance lane proves vectors against.
+ *
+ * The API follows the workspace secp256k1 contract exactly, so signatures
+ * interoperate byte-for-byte with the Rust, Swift, and Kotlin lanes:
+ *
+ * - Secret keys are 32 bytes; public keys are 33-byte compressed SEC1.
+ * - `sign` hashes the full message internally with SHA-256 (callers pass the
+ *   message, not a digest), derives the nonce deterministically (RFC 6979),
+ *   and emits the 64-byte compact `r ‖ s` form normalized to low-S
+ *   (BIP 0062).
+ * - `verify` accepts only the 64-byte compact form, rejects the malleated
+ *   high-S twin, and throws `invalid-signature` for a well-formed-but-wrong
+ *   signature so callers cannot accidentally ignore a failed check.
+ */
+export declare const SECP256K1_SECRET_KEY_LENGTH = 32;
+export declare const SECP256K1_COMPRESSED_PUBLIC_KEY_LENGTH = 33;
+export declare const SECP256K1_SIGNATURE_LENGTH = 64;
+export declare const ReallyMeSecp256k1: {
+    /** Generates a random keypair: 33-byte compressed public, 32-byte secret. */
+    readonly generateKeyPair: () => {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+    /** Derives the secp256k1 ECDSA keypair from a 32-byte secret scalar. */
+    readonly deriveKeyPair: (secretKey: Uint8Array) => {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+    /** Derives the 33-byte compressed SEC1 public key for a 32-byte secret. */
+    readonly derivePublicKey: (secretKey: Uint8Array) => Uint8Array;
+    /**
+     * Signs `message` with deterministic (RFC 6979) ECDSA over
+     * SHA-256(message), returning the 64-byte compact low-S signature.
+     */
+    readonly sign: (message: Uint8Array, secretKey: Uint8Array) => Uint8Array;
+    /**
+     * Verifies a 64-byte compact signature over SHA-256(message) against a
+     * 33-byte compressed SEC1 public key.
+     *
+     * Throws on malformed input (wrong lengths, undecodable key); returns
+     * Throws for a signature that does not verify, including the malleated
+     * high-S twin (BIP 0062), which every workspace lane rejects.
+     */
+    readonly verify: (signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array) => void;
+};

package/dist/secp256k1.js

@@ -0,0 +1,106 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+import { secp256k1 } from "@noble/curves/secp256k1.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { ReallyMeCryptoError } from "./errors.js";
+/**
+ * secp256k1 ECDSA backed by @noble/curves — the same pinned implementation
+ * the TypeScript conformance lane proves vectors against.
+ *
+ * The API follows the workspace secp256k1 contract exactly, so signatures
+ * interoperate byte-for-byte with the Rust, Swift, and Kotlin lanes:
+ *
+ * - Secret keys are 32 bytes; public keys are 33-byte compressed SEC1.
+ * - `sign` hashes the full message internally with SHA-256 (callers pass the
+ *   message, not a digest), derives the nonce deterministically (RFC 6979),
+ *   and emits the 64-byte compact `r ‖ s` form normalized to low-S
+ *   (BIP 0062).
+ * - `verify` accepts only the 64-byte compact form, rejects the malleated
+ *   high-S twin, and throws `invalid-signature` for a well-formed-but-wrong
+ *   signature so callers cannot accidentally ignore a failed check.
+ */
+export const SECP256K1_SECRET_KEY_LENGTH = 32;
+export const SECP256K1_COMPRESSED_PUBLIC_KEY_LENGTH = 33;
+export const SECP256K1_SIGNATURE_LENGTH = 64;
+export const ReallyMeSecp256k1 = {
+    /** Generates a random keypair: 33-byte compressed public, 32-byte secret. */
+    generateKeyPair() {
+        const secretKey = secp256k1.utils.randomSecretKey();
+        return {
+            publicKey: secp256k1.getPublicKey(secretKey, true),
+            secretKey,
+        };
+    },
+    /** Derives the secp256k1 ECDSA keypair from a 32-byte secret scalar. */
+    deriveKeyPair(secretKey) {
+        return {
+            publicKey: this.derivePublicKey(secretKey),
+            secretKey: secretKey.slice(),
+        };
+    },
+    /** Derives the 33-byte compressed SEC1 public key for a 32-byte secret. */
+    derivePublicKey(secretKey) {
+        if (secretKey.length !== SECP256K1_SECRET_KEY_LENGTH) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        try {
+            return secp256k1.getPublicKey(secretKey, true);
+        }
+        catch {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+    },
+    /**
+     * Signs `message` with deterministic (RFC 6979) ECDSA over
+     * SHA-256(message), returning the 64-byte compact low-S signature.
+     */
+    sign(message, secretKey) {
+        if (secretKey.length !== SECP256K1_SECRET_KEY_LENGTH) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        try {
+            // Hash exactly once ourselves; prehash: false stops noble from
+            // hashing the digest a second time.
+            return secp256k1.sign(sha256(message), secretKey, {
+                lowS: true,
+                prehash: false,
+            });
+        }
+        catch {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+    },
+    /**
+     * Verifies a 64-byte compact signature over SHA-256(message) against a
+     * 33-byte compressed SEC1 public key.
+     *
+     * Throws on malformed input (wrong lengths, undecodable key); returns
+     * Throws for a signature that does not verify, including the malleated
+     * high-S twin (BIP 0062), which every workspace lane rejects.
+     */
+    verify(signature, message, publicKey) {
+        if (signature.length !== SECP256K1_SIGNATURE_LENGTH ||
+            publicKey.length !== SECP256K1_COMPRESSED_PUBLIC_KEY_LENGTH) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        try {
+            secp256k1.Point.fromBytes(publicKey);
+        }
+        catch {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        try {
+            const valid = secp256k1.verify(signature, sha256(message), publicKey, {
+                lowS: true,
+                prehash: false,
+            });
+            if (!valid) {
+                throw new ReallyMeCryptoError("invalid-signature");
+            }
+        }
+        catch {
+            throw new ReallyMeCryptoError("invalid-signature");
+        }
+    },
+};

package/dist/slhDsa.d.ts

@@ -0,0 +1,15 @@
+import type { ReallyMeSignatureAlgorithm } from "./algorithms.js";
+export declare const SLH_DSA_SHA2_128S_PUBLIC_KEY_LENGTH = 32;
+export declare const SLH_DSA_SHA2_128S_SECRET_KEY_LENGTH = 64;
+export declare const SLH_DSA_SHA2_128S_SIGNATURE_LENGTH = 7856;
+export declare const SLH_DSA_SHA2_128S_KEYGEN_SEED_LENGTH = 16;
+export type ReallyMeSlhDsaKeyPair = Readonly<{
+    publicKey: Uint8Array;
+    secretKey: Uint8Array;
+}>;
+export declare const ReallyMeSlhDsa: {
+    readonly generateKeyPair: (algorithm: ReallyMeSignatureAlgorithm) => ReallyMeSlhDsaKeyPair;
+    readonly sign: (algorithm: ReallyMeSignatureAlgorithm, message: Uint8Array, secretKey: Uint8Array) => Uint8Array;
+    readonly verify: (algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array) => void;
+};
+export declare const deriveSlhDsaSha2128sKeypairForTest: (skSeed: Uint8Array, skPrf: Uint8Array, pkSeed: Uint8Array) => ReallyMeSlhDsaKeyPair;