@reallyme/crypto 0.1.7 → 0.2.0

package/dist/proto/generated/reallyme/crypto/v1/crypto_pb.d.ts

@@ -1,89 +1,1255 @@
-import type { GenEnum, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
 import type { Message } from "@bufbuild/protobuf";
 /**
  * Describes the file reallyme/crypto/v1/crypto.proto.
  */
 export declare const file_reallyme_crypto_v1_crypto: GenFile;
+/**
+ * CryptoError is the public, non-PII error envelope for crypto boundary
+ * failures. The oneof keeps primitive, provider, and backend failures distinct
+ * while the shared CryptoErrorReason enum provides stable cross-language reason
+ * codes.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoError
+ */
+export type CryptoError = Message<"reallyme.crypto.v1.CryptoError"> & {
+    /**
+     * @generated from oneof reallyme.crypto.v1.CryptoError.error
+     */
+    error: {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoPrimitiveError primitive = 1;
+         */
+        value: CryptoPrimitiveError;
+        case: "primitive";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoProviderError provider = 2;
+         */
+        value: CryptoProviderError;
+        case: "provider";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoBackendError backend = 3;
+         */
+        value: CryptoBackendError;
+        case: "backend";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoError.
+ * Use `create(CryptoErrorSchema)` to create a new message.
+ */
+export declare const CryptoErrorSchema: GenMessage<CryptoError>;
+/**
+ * CryptoPrimitiveError describes failures owned by primitive input validation,
+ * key handling, encryption, decryption, signing, verification, KEM, KDF, MAC,
+ * and key-wrap operations.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoPrimitiveError
+ */
+export type CryptoPrimitiveError = Message<"reallyme.crypto.v1.CryptoPrimitiveError"> & {
+    /**
+     * Reason must be one of the CRYPTO_ERROR_REASON_PRIMITIVE_* values.
+     *
+     * @generated from field: reallyme.crypto.v1.CryptoErrorReason reason = 1;
+     */
+    reason: CryptoErrorReason;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoPrimitiveError.
+ * Use `create(CryptoPrimitiveErrorSchema)` to create a new message.
+ */
+export declare const CryptoPrimitiveErrorSchema: GenMessage<CryptoPrimitiveError>;
+/**
+ * CryptoProviderError describes provider selection and platform-provider
+ * availability failures.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoProviderError
+ */
+export type CryptoProviderError = Message<"reallyme.crypto.v1.CryptoProviderError"> & {
+    /**
+     * Reason must be one of the CRYPTO_ERROR_REASON_PROVIDER_* values.
+     *
+     * @generated from field: reallyme.crypto.v1.CryptoErrorReason reason = 1;
+     */
+    reason: CryptoErrorReason;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoProviderError.
+ * Use `create(CryptoProviderErrorSchema)` to create a new message.
+ */
+export declare const CryptoProviderErrorSchema: GenMessage<CryptoProviderError>;
+/**
+ * CryptoBackendError describes dispatch, FFI, WASM, and internal backend
+ * failures that are not safe to expose as backend exception text.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoBackendError
+ */
+export type CryptoBackendError = Message<"reallyme.crypto.v1.CryptoBackendError"> & {
+    /**
+     * Reason must be one of the CRYPTO_ERROR_REASON_BACKEND_* values.
+     *
+     * @generated from field: reallyme.crypto.v1.CryptoErrorReason reason = 1;
+     */
+    reason: CryptoErrorReason;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoBackendError.
+ * Use `create(CryptoBackendErrorSchema)` to create a new message.
+ */
+export declare const CryptoBackendErrorSchema: GenMessage<CryptoBackendError>;
+/**
+ * CryptoProtoResultEnvelope is the transport-neutral wrapper for protobuf
+ * result lanes that need a single bytes object across FFI, RPC, storage, or
+ * SDK boundaries. `payload` contains either a successful result message or a
+ * CryptoError message according to `status`.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoProtoResultEnvelope
+ */
+export type CryptoProtoResultEnvelope = Message<"reallyme.crypto.v1.CryptoProtoResultEnvelope"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoProtoResultStatus status = 1;
+     */
+    status: CryptoProtoResultStatus;
+    /**
+     * @generated from field: bytes payload = 2;
+     */
+    payload: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoProtoResultEnvelope.
+ * Use `create(CryptoProtoResultEnvelopeSchema)` to create a new message.
+ */
+export declare const CryptoProtoResultEnvelopeSchema: GenMessage<CryptoProtoResultEnvelope>;
+/**
+ * CryptoServiceProcessRequest carries one operation-specific protobuf request. The
+ * selected operation determines the concrete message type in request_payload.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoServiceProcessRequest
+ */
+export type CryptoServiceProcessRequest = Message<"reallyme.crypto.v1.CryptoServiceProcessRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoOperation operation = 1;
+     */
+    operation: CryptoOperation;
+    /**
+     * @generated from field: bytes request_payload = 2;
+     */
+    requestPayload: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoServiceProcessRequest.
+ * Use `create(CryptoServiceProcessRequestSchema)` to create a new message.
+ */
+export declare const CryptoServiceProcessRequestSchema: GenMessage<CryptoServiceProcessRequest>;
+/**
+ * CryptoServiceProcessResponse retains the result/error envelope verbatim so Connect
+ * transports do not reinterpret crypto failures as backend exception text.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoServiceProcessResponse
+ */
+export type CryptoServiceProcessResponse = Message<"reallyme.crypto.v1.CryptoServiceProcessResponse"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoProtoResultEnvelope result = 1;
+     */
+    result?: CryptoProtoResultEnvelope | undefined;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoServiceProcessResponse.
+ * Use `create(CryptoServiceProcessResponseSchema)` to create a new message.
+ */
+export declare const CryptoServiceProcessResponseSchema: GenMessage<CryptoServiceProcessResponse>;
 /**
  * CryptoAlgorithmIdentifier is a oneof wrapper for protocol messages that need
  * to carry a typed algorithm choice without using free-form strings.
  *
  * @generated from message reallyme.crypto.v1.CryptoAlgorithmIdentifier
  */
-export type CryptoAlgorithmIdentifier = Message<"reallyme.crypto.v1.CryptoAlgorithmIdentifier"> & {
+export type CryptoAlgorithmIdentifier = Message<"reallyme.crypto.v1.CryptoAlgorithmIdentifier"> & {
+    /**
+     * @generated from oneof reallyme.crypto.v1.CryptoAlgorithmIdentifier.algorithm
+     */
+    algorithm: {
+        /**
+         * @generated from field: reallyme.crypto.v1.SignatureAlgorithm signature = 1;
+         */
+        value: SignatureAlgorithm;
+        case: "signature";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.KeyAgreementAlgorithm key_agreement = 2;
+         */
+        value: KeyAgreementAlgorithm;
+        case: "keyAgreement";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.KemAlgorithm kem = 3;
+         */
+        value: KemAlgorithm;
+        case: "kem";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.HpkeSuite hpke = 4;
+         */
+        value: HpkeSuite;
+        case: "hpke";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.AeadAlgorithm aead = 5;
+         */
+        value: AeadAlgorithm;
+        case: "aead";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.HashAlgorithm hash = 6;
+         */
+        value: HashAlgorithm;
+        case: "hash";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.MacAlgorithm mac = 7;
+         */
+        value: MacAlgorithm;
+        case: "mac";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.KdfAlgorithm kdf = 8;
+         */
+        value: KdfAlgorithm;
+        case: "kdf";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.KeyWrapAlgorithm key_wrap = 9;
+         */
+        value: KeyWrapAlgorithm;
+        case: "keyWrap";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.MulticodecKeyAlgorithm multicodec_key = 10;
+         */
+        value: MulticodecKeyAlgorithm;
+        case: "multicodecKey";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoAlgorithmIdentifier.
+ * Use `create(CryptoAlgorithmIdentifierSchema)` to create a new message.
+ */
+export declare const CryptoAlgorithmIdentifierSchema: GenMessage<CryptoAlgorithmIdentifier>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHashRequest
+ */
+export type CryptoHashRequest = Message<"reallyme.crypto.v1.CryptoHashRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes input = 2;
+     */
+    input: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHashRequest.
+ * Use `create(CryptoHashRequestSchema)` to create a new message.
+ */
+export declare const CryptoHashRequestSchema: GenMessage<CryptoHashRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHashResult
+ */
+export type CryptoHashResult = Message<"reallyme.crypto.v1.CryptoHashResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes digest = 2;
+     */
+    digest: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHashResult.
+ * Use `create(CryptoHashResultSchema)` to create a new message.
+ */
+export declare const CryptoHashResultSchema: GenMessage<CryptoHashResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoAeadSealRequest
+ */
+export type CryptoAeadSealRequest = Message<"reallyme.crypto.v1.CryptoAeadSealRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing AEAD key; callers must zeroize copies where platform
+     * semantics permit.
+     *
+     * @generated from field: bytes key = 2;
+     */
+    key: Uint8Array;
+    /**
+     * @generated from field: bytes nonce = 3;
+     */
+    nonce: Uint8Array;
+    /**
+     * @generated from field: bytes aad = 4;
+     */
+    aad: Uint8Array;
+    /**
+     * Plaintext may contain secret or PII-bearing application data.
+     *
+     * @generated from field: bytes plaintext = 5;
+     */
+    plaintext: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoAeadSealRequest.
+ * Use `create(CryptoAeadSealRequestSchema)` to create a new message.
+ */
+export declare const CryptoAeadSealRequestSchema: GenMessage<CryptoAeadSealRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoAeadSealResult
+ */
+export type CryptoAeadSealResult = Message<"reallyme.crypto.v1.CryptoAeadSealResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes ciphertext_with_tag = 2;
+     */
+    ciphertextWithTag: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoAeadSealResult.
+ * Use `create(CryptoAeadSealResultSchema)` to create a new message.
+ */
+export declare const CryptoAeadSealResultSchema: GenMessage<CryptoAeadSealResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoAeadOpenRequest
+ */
+export type CryptoAeadOpenRequest = Message<"reallyme.crypto.v1.CryptoAeadOpenRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing AEAD key; callers must zeroize copies where platform
+     * semantics permit.
+     *
+     * @generated from field: bytes key = 2;
+     */
+    key: Uint8Array;
+    /**
+     * @generated from field: bytes nonce = 3;
+     */
+    nonce: Uint8Array;
+    /**
+     * @generated from field: bytes aad = 4;
+     */
+    aad: Uint8Array;
+    /**
+     * @generated from field: bytes ciphertext_with_tag = 5;
+     */
+    ciphertextWithTag: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoAeadOpenRequest.
+ * Use `create(CryptoAeadOpenRequestSchema)` to create a new message.
+ */
+export declare const CryptoAeadOpenRequestSchema: GenMessage<CryptoAeadOpenRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoAeadOpenResult
+ */
+export type CryptoAeadOpenResult = Message<"reallyme.crypto.v1.CryptoAeadOpenResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Decrypted plaintext may contain secret or PII-bearing application data.
+     *
+     * @generated from field: bytes plaintext = 2;
+     */
+    plaintext: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoAeadOpenResult.
+ * Use `create(CryptoAeadOpenResultSchema)` to create a new message.
+ */
+export declare const CryptoAeadOpenResultSchema: GenMessage<CryptoAeadOpenResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoMacAuthenticateRequest
+ */
+export type CryptoMacAuthenticateRequest = Message<"reallyme.crypto.v1.CryptoMacAuthenticateRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing MAC key.
+     *
+     * @generated from field: bytes key = 2;
+     */
+    key: Uint8Array;
+    /**
+     * @generated from field: bytes message = 3;
+     */
+    message: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoMacAuthenticateRequest.
+ * Use `create(CryptoMacAuthenticateRequestSchema)` to create a new message.
+ */
+export declare const CryptoMacAuthenticateRequestSchema: GenMessage<CryptoMacAuthenticateRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoMacAuthenticateResult
+ */
+export type CryptoMacAuthenticateResult = Message<"reallyme.crypto.v1.CryptoMacAuthenticateResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes tag = 2;
+     */
+    tag: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoMacAuthenticateResult.
+ * Use `create(CryptoMacAuthenticateResultSchema)` to create a new message.
+ */
+export declare const CryptoMacAuthenticateResultSchema: GenMessage<CryptoMacAuthenticateResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoMacVerifyRequest
+ */
+export type CryptoMacVerifyRequest = Message<"reallyme.crypto.v1.CryptoMacVerifyRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes tag = 2;
+     */
+    tag: Uint8Array;
+    /**
+     * Secret-bearing MAC key.
+     *
+     * @generated from field: bytes key = 3;
+     */
+    key: Uint8Array;
+    /**
+     * @generated from field: bytes message = 4;
+     */
+    message: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoMacVerifyRequest.
+ * Use `create(CryptoMacVerifyRequestSchema)` to create a new message.
+ */
+export declare const CryptoMacVerifyRequestSchema: GenMessage<CryptoMacVerifyRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKdfDeriveKeyRequest
+ */
+export type CryptoKdfDeriveKeyRequest = Message<"reallyme.crypto.v1.CryptoKdfDeriveKeyRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing password or input secret for the selected KDF.
+     *
+     * @generated from field: bytes password = 2;
+     */
+    password: Uint8Array;
+    /**
+     * Salt is commonly public but may be privacy-impacting in application
+     * contexts; treat it according to the protocol using this message.
+     *
+     * @generated from field: bytes salt = 3;
+     */
+    salt: Uint8Array;
+    /**
+     * @generated from field: uint32 iterations = 4;
+     */
+    iterations: number;
+    /**
+     * @generated from field: uint32 output_length = 5;
+     */
+    outputLength: number;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKdfDeriveKeyRequest.
+ * Use `create(CryptoKdfDeriveKeyRequestSchema)` to create a new message.
+ */
+export declare const CryptoKdfDeriveKeyRequestSchema: GenMessage<CryptoKdfDeriveKeyRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKdfDeriveKeyResult
+ */
+export type CryptoKdfDeriveKeyResult = Message<"reallyme.crypto.v1.CryptoKdfDeriveKeyResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing derived key material.
+     *
+     * @generated from field: bytes derived_key = 2;
+     */
+    derivedKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKdfDeriveKeyResult.
+ * Use `create(CryptoKdfDeriveKeyResultSchema)` to create a new message.
+ */
+export declare const CryptoKdfDeriveKeyResultSchema: GenMessage<CryptoKdfDeriveKeyResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHkdfDeriveRequest
+ */
+export type CryptoHkdfDeriveRequest = Message<"reallyme.crypto.v1.CryptoHkdfDeriveRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing input key material.
+     *
+     * @generated from field: bytes input_key_material = 2;
+     */
+    inputKeyMaterial: Uint8Array;
+    /**
+     * Salt is commonly public but can be privacy-impacting in some protocols.
+     *
+     * @generated from field: bytes salt = 3;
+     */
+    salt: Uint8Array;
+    /**
+     * @generated from field: bytes info = 4;
+     */
+    info: Uint8Array;
+    /**
+     * @generated from field: uint32 output_length = 5;
+     */
+    outputLength: number;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHkdfDeriveRequest.
+ * Use `create(CryptoHkdfDeriveRequestSchema)` to create a new message.
+ */
+export declare const CryptoHkdfDeriveRequestSchema: GenMessage<CryptoHkdfDeriveRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHkdfDeriveResult
+ */
+export type CryptoHkdfDeriveResult = Message<"reallyme.crypto.v1.CryptoHkdfDeriveResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing HKDF output key material.
+     *
+     * @generated from field: bytes output_key_material = 2;
+     */
+    outputKeyMaterial: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHkdfDeriveResult.
+ * Use `create(CryptoHkdfDeriveResultSchema)` to create a new message.
+ */
+export declare const CryptoHkdfDeriveResultSchema: GenMessage<CryptoHkdfDeriveResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoJwaConcatKdfSha256DeriveRequest
+ */
+export type CryptoJwaConcatKdfSha256DeriveRequest = Message<"reallyme.crypto.v1.CryptoJwaConcatKdfSha256DeriveRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing shared secret input.
+     *
+     * @generated from field: bytes shared_secret = 2;
+     */
+    sharedSecret: Uint8Array;
+    /**
+     * @generated from field: bytes algorithm_id = 3;
+     */
+    algorithmId: Uint8Array;
+    /**
+     * @generated from field: bytes party_u_info = 4;
+     */
+    partyUInfo: Uint8Array;
+    /**
+     * @generated from field: bytes party_v_info = 5;
+     */
+    partyVInfo: Uint8Array;
+    /**
+     * @generated from field: uint32 output_length = 6;
+     */
+    outputLength: number;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoJwaConcatKdfSha256DeriveRequest.
+ * Use `create(CryptoJwaConcatKdfSha256DeriveRequestSchema)` to create a new message.
+ */
+export declare const CryptoJwaConcatKdfSha256DeriveRequestSchema: GenMessage<CryptoJwaConcatKdfSha256DeriveRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoJwaConcatKdfSha256DeriveResult
+ */
+export type CryptoJwaConcatKdfSha256DeriveResult = Message<"reallyme.crypto.v1.CryptoJwaConcatKdfSha256DeriveResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing derived key material.
+     *
+     * @generated from field: bytes derived_key = 2;
+     */
+    derivedKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoJwaConcatKdfSha256DeriveResult.
+ * Use `create(CryptoJwaConcatKdfSha256DeriveResultSchema)` to create a new message.
+ */
+export declare const CryptoJwaConcatKdfSha256DeriveResultSchema: GenMessage<CryptoJwaConcatKdfSha256DeriveResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKeyWrapRequest
+ */
+export type CryptoKeyWrapRequest = Message<"reallyme.crypto.v1.CryptoKeyWrapRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing key-encryption key.
+     *
+     * @generated from field: bytes wrapping_key = 2;
+     */
+    wrappingKey: Uint8Array;
+    /**
+     * Secret-bearing key material to wrap.
+     *
+     * @generated from field: bytes key_to_wrap = 3;
+     */
+    keyToWrap: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKeyWrapRequest.
+ * Use `create(CryptoKeyWrapRequestSchema)` to create a new message.
+ */
+export declare const CryptoKeyWrapRequestSchema: GenMessage<CryptoKeyWrapRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKeyWrapResult
+ */
+export type CryptoKeyWrapResult = Message<"reallyme.crypto.v1.CryptoKeyWrapResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes wrapped_key = 2;
+     */
+    wrappedKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKeyWrapResult.
+ * Use `create(CryptoKeyWrapResultSchema)` to create a new message.
+ */
+export declare const CryptoKeyWrapResultSchema: GenMessage<CryptoKeyWrapResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKeyUnwrapRequest
+ */
+export type CryptoKeyUnwrapRequest = Message<"reallyme.crypto.v1.CryptoKeyUnwrapRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing key-encryption key.
+     *
+     * @generated from field: bytes wrapping_key = 2;
+     */
+    wrappingKey: Uint8Array;
+    /**
+     * @generated from field: bytes wrapped_key = 3;
+     */
+    wrappedKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKeyUnwrapRequest.
+ * Use `create(CryptoKeyUnwrapRequestSchema)` to create a new message.
+ */
+export declare const CryptoKeyUnwrapRequestSchema: GenMessage<CryptoKeyUnwrapRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKeyUnwrapResult
+ */
+export type CryptoKeyUnwrapResult = Message<"reallyme.crypto.v1.CryptoKeyUnwrapResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing unwrapped key material.
+     *
+     * @generated from field: bytes key = 2;
+     */
+    key: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKeyUnwrapResult.
+ * Use `create(CryptoKeyUnwrapResultSchema)` to create a new message.
+ */
+export declare const CryptoKeyUnwrapResultSchema: GenMessage<CryptoKeyUnwrapResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoSignatureGenerateKeyPairRequest
+ */
+export type CryptoSignatureGenerateKeyPairRequest = Message<"reallyme.crypto.v1.CryptoSignatureGenerateKeyPairRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoSignatureGenerateKeyPairRequest.
+ * Use `create(CryptoSignatureGenerateKeyPairRequestSchema)` to create a new message.
+ */
+export declare const CryptoSignatureGenerateKeyPairRequestSchema: GenMessage<CryptoSignatureGenerateKeyPairRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoSignatureDeriveKeyPairRequest
+ */
+export type CryptoSignatureDeriveKeyPairRequest = Message<"reallyme.crypto.v1.CryptoSignatureDeriveKeyPairRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing seed or private key input, depending on the algorithm.
+     *
+     * @generated from field: bytes secret_key = 2;
+     */
+    secretKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoSignatureDeriveKeyPairRequest.
+ * Use `create(CryptoSignatureDeriveKeyPairRequestSchema)` to create a new message.
+ */
+export declare const CryptoSignatureDeriveKeyPairRequestSchema: GenMessage<CryptoSignatureDeriveKeyPairRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoSignatureSignRequest
+ */
+export type CryptoSignatureSignRequest = Message<"reallyme.crypto.v1.CryptoSignatureSignRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes message = 2;
+     */
+    message: Uint8Array;
+    /**
+     * Secret-bearing signing key material.
+     *
+     * @generated from field: bytes secret_key = 3;
+     */
+    secretKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoSignatureSignRequest.
+ * Use `create(CryptoSignatureSignRequestSchema)` to create a new message.
+ */
+export declare const CryptoSignatureSignRequestSchema: GenMessage<CryptoSignatureSignRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoSignatureSignResult
+ */
+export type CryptoSignatureSignResult = Message<"reallyme.crypto.v1.CryptoSignatureSignResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes signature = 2;
+     */
+    signature: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoSignatureSignResult.
+ * Use `create(CryptoSignatureSignResultSchema)` to create a new message.
+ */
+export declare const CryptoSignatureSignResultSchema: GenMessage<CryptoSignatureSignResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoBip340SchnorrSignRequest
+ */
+export type CryptoBip340SchnorrSignRequest = Message<"reallyme.crypto.v1.CryptoBip340SchnorrSignRequest"> & {
+    /**
+     * @generated from field: bytes message32 = 1;
+     */
+    message32: Uint8Array;
+    /**
+     * Secret-bearing secp256k1 signing key material.
+     *
+     * @generated from field: bytes secret_key = 2;
+     */
+    secretKey: Uint8Array;
+    /**
+     * Secret-bearing auxiliary randomness used for deterministic nonce hardening.
+     *
+     * @generated from field: bytes aux_rand32 = 3;
+     */
+    auxRand32: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoBip340SchnorrSignRequest.
+ * Use `create(CryptoBip340SchnorrSignRequestSchema)` to create a new message.
+ */
+export declare const CryptoBip340SchnorrSignRequestSchema: GenMessage<CryptoBip340SchnorrSignRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoSignatureVerifyRequest
+ */
+export type CryptoSignatureVerifyRequest = Message<"reallyme.crypto.v1.CryptoSignatureVerifyRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes signature = 2;
+     */
+    signature: Uint8Array;
+    /**
+     * @generated from field: bytes message = 3;
+     */
+    message: Uint8Array;
+    /**
+     * @generated from field: bytes public_key = 4;
+     */
+    publicKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoSignatureVerifyRequest.
+ * Use `create(CryptoSignatureVerifyRequestSchema)` to create a new message.
+ */
+export declare const CryptoSignatureVerifyRequestSchema: GenMessage<CryptoSignatureVerifyRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoRsaVerifyRequest
+ */
+export type CryptoRsaVerifyRequest = Message<"reallyme.crypto.v1.CryptoRsaVerifyRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes signature = 2;
+     */
+    signature: Uint8Array;
+    /**
+     * @generated from field: bytes message = 3;
+     */
+    message: Uint8Array;
+    /**
+     * @generated from field: bytes public_key_der = 4;
+     */
+    publicKeyDer: Uint8Array;
+    /**
+     * @generated from field: reallyme.crypto.v1.RsaPublicKeyDerEncoding public_key_encoding = 5;
+     */
+    publicKeyEncoding: RsaPublicKeyDerEncoding;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoRsaVerifyRequest.
+ * Use `create(CryptoRsaVerifyRequestSchema)` to create a new message.
+ */
+export declare const CryptoRsaVerifyRequestSchema: GenMessage<CryptoRsaVerifyRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKeyAgreementDeriveSharedSecretRequest
+ */
+export type CryptoKeyAgreementDeriveSharedSecretRequest = Message<"reallyme.crypto.v1.CryptoKeyAgreementDeriveSharedSecretRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes public_key = 2;
+     */
+    publicKey: Uint8Array;
+    /**
+     * Secret-bearing private key material.
+     *
+     * @generated from field: bytes secret_key = 3;
+     */
+    secretKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKeyAgreementDeriveSharedSecretRequest.
+ * Use `create(CryptoKeyAgreementDeriveSharedSecretRequestSchema)` to create a new message.
+ */
+export declare const CryptoKeyAgreementDeriveSharedSecretRequestSchema: GenMessage<CryptoKeyAgreementDeriveSharedSecretRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKeyAgreementDeriveSharedSecretResult
+ */
+export type CryptoKeyAgreementDeriveSharedSecretResult = Message<"reallyme.crypto.v1.CryptoKeyAgreementDeriveSharedSecretResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing shared secret; callers must feed it into a protocol KDF.
+     *
+     * @generated from field: bytes shared_secret = 2;
+     */
+    sharedSecret: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKeyAgreementDeriveSharedSecretResult.
+ * Use `create(CryptoKeyAgreementDeriveSharedSecretResultSchema)` to create a new message.
+ */
+export declare const CryptoKeyAgreementDeriveSharedSecretResultSchema: GenMessage<CryptoKeyAgreementDeriveSharedSecretResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKeyAgreementDeriveKeyPairRequest
+ */
+export type CryptoKeyAgreementDeriveKeyPairRequest = Message<"reallyme.crypto.v1.CryptoKeyAgreementDeriveKeyPairRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing seed or private key input, depending on the algorithm.
+     *
+     * @generated from field: bytes secret_key = 2;
+     */
+    secretKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKeyAgreementDeriveKeyPairRequest.
+ * Use `create(CryptoKeyAgreementDeriveKeyPairRequestSchema)` to create a new message.
+ */
+export declare const CryptoKeyAgreementDeriveKeyPairRequestSchema: GenMessage<CryptoKeyAgreementDeriveKeyPairRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKemGenerateKeyPairRequest
+ */
+export type CryptoKemGenerateKeyPairRequest = Message<"reallyme.crypto.v1.CryptoKemGenerateKeyPairRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKemGenerateKeyPairRequest.
+ * Use `create(CryptoKemGenerateKeyPairRequestSchema)` to create a new message.
+ */
+export declare const CryptoKemGenerateKeyPairRequestSchema: GenMessage<CryptoKemGenerateKeyPairRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKemEncapsulateRequest
+ */
+export type CryptoKemEncapsulateRequest = Message<"reallyme.crypto.v1.CryptoKemEncapsulateRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes public_key = 2;
+     */
+    publicKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKemEncapsulateRequest.
+ * Use `create(CryptoKemEncapsulateRequestSchema)` to create a new message.
+ */
+export declare const CryptoKemEncapsulateRequestSchema: GenMessage<CryptoKemEncapsulateRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKemDecapsulateRequest
+ */
+export type CryptoKemDecapsulateRequest = Message<"reallyme.crypto.v1.CryptoKemDecapsulateRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes ciphertext = 2;
+     */
+    ciphertext: Uint8Array;
+    /**
+     * Secret-bearing KEM private key material.
+     *
+     * @generated from field: bytes secret_key = 3;
+     */
+    secretKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKemDecapsulateRequest.
+ * Use `create(CryptoKemDecapsulateRequestSchema)` to create a new message.
+ */
+export declare const CryptoKemDecapsulateRequestSchema: GenMessage<CryptoKemDecapsulateRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKemDecapsulateResult
+ */
+export type CryptoKemDecapsulateResult = Message<"reallyme.crypto.v1.CryptoKemDecapsulateResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing KEM shared secret.
+     *
+     * @generated from field: bytes shared_secret = 2;
+     */
+    sharedSecret: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKemDecapsulateResult.
+ * Use `create(CryptoKemDecapsulateResultSchema)` to create a new message.
+ */
+export declare const CryptoKemDecapsulateResultSchema: GenMessage<CryptoKemDecapsulateResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHpkeSealRequest
+ */
+export type CryptoHpkeSealRequest = Message<"reallyme.crypto.v1.CryptoHpkeSealRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes recipient_public_key = 2;
+     */
+    recipientPublicKey: Uint8Array;
+    /**
+     * @generated from field: bytes info = 3;
+     */
+    info: Uint8Array;
+    /**
+     * @generated from field: bytes aad = 4;
+     */
+    aad: Uint8Array;
+    /**
+     * Plaintext may contain secret or PII-bearing application data.
+     *
+     * @generated from field: bytes plaintext = 5;
+     */
+    plaintext: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHpkeSealRequest.
+ * Use `create(CryptoHpkeSealRequestSchema)` to create a new message.
+ */
+export declare const CryptoHpkeSealRequestSchema: GenMessage<CryptoHpkeSealRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHpkeOpenRequest
+ */
+export type CryptoHpkeOpenRequest = Message<"reallyme.crypto.v1.CryptoHpkeOpenRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing HPKE recipient private key material.
+     *
+     * @generated from field: bytes recipient_secret_key = 2;
+     */
+    recipientSecretKey: Uint8Array;
+    /**
+     * @generated from field: bytes encapsulated_key = 3;
+     */
+    encapsulatedKey: Uint8Array;
+    /**
+     * @generated from field: bytes info = 4;
+     */
+    info: Uint8Array;
+    /**
+     * @generated from field: bytes aad = 5;
+     */
+    aad: Uint8Array;
+    /**
+     * @generated from field: bytes ciphertext = 6;
+     */
+    ciphertext: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHpkeOpenRequest.
+ * Use `create(CryptoHpkeOpenRequestSchema)` to create a new message.
+ */
+export declare const CryptoHpkeOpenRequestSchema: GenMessage<CryptoHpkeOpenRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHpkeOpenResult
+ */
+export type CryptoHpkeOpenResult = Message<"reallyme.crypto.v1.CryptoHpkeOpenResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Decrypted plaintext may contain secret or PII-bearing application data.
+     *
+     * @generated from field: bytes plaintext = 2;
+     */
+    plaintext: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHpkeOpenResult.
+ * Use `create(CryptoHpkeOpenResultSchema)` to create a new message.
+ */
+export declare const CryptoHpkeOpenResultSchema: GenMessage<CryptoHpkeOpenResult>;
+/**
+ * CryptoKeyPair is the protobuf boundary envelope for generated or derived
+ * keypairs. Secret-key bytes are included only for APIs whose public facade
+ * already returns exportable secret-key material; non-exportable platform keys
+ * must use a separate handle-specific protocol.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoKeyPair
+ */
+export type CryptoKeyPair = Message<"reallyme.crypto.v1.CryptoKeyPair"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes public_key = 2;
+     */
+    publicKey: Uint8Array;
+    /**
+     * Secret-bearing exportable private key material.
+     *
+     * @generated from field: bytes secret_key = 3;
+     */
+    secretKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKeyPair.
+ * Use `create(CryptoKeyPairSchema)` to create a new message.
+ */
+export declare const CryptoKeyPairSchema: GenMessage<CryptoKeyPair>;
+/**
+ * CryptoKemEncapsulation is the protobuf boundary envelope for KEM
+ * encapsulation results. `shared_secret` is secret-bearing material; callers
+ * must keep it in binary/protobuf channels and zeroize it when possible.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoKemEncapsulation
+ */
+export type CryptoKemEncapsulation = Message<"reallyme.crypto.v1.CryptoKemEncapsulation"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes ciphertext = 2;
+     */
+    ciphertext: Uint8Array;
+    /**
+     * Secret-bearing KEM shared secret.
+     *
+     * @generated from field: bytes shared_secret = 3;
+     */
+    sharedSecret: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKemEncapsulation.
+ * Use `create(CryptoKemEncapsulationSchema)` to create a new message.
+ */
+export declare const CryptoKemEncapsulationSchema: GenMessage<CryptoKemEncapsulation>;
+/**
+ * CryptoHpkeSealedMessage is the protobuf boundary envelope for HPKE Base-mode
+ * sender output.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoHpkeSealedMessage
+ */
+export type CryptoHpkeSealedMessage = Message<"reallyme.crypto.v1.CryptoHpkeSealedMessage"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes encapsulated_key = 2;
+     */
+    encapsulatedKey: Uint8Array;
+    /**
+     * @generated from field: bytes ciphertext = 3;
+     */
+    ciphertext: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHpkeSealedMessage.
+ * Use `create(CryptoHpkeSealedMessageSchema)` to create a new message.
+ */
+export declare const CryptoHpkeSealedMessageSchema: GenMessage<CryptoHpkeSealedMessage>;
+/**
+ * CryptoVerificationResult is for protocol layers that need a stable,
+ * serializable verification status. Ordinary facade calls should continue to
+ * fail closed with typed errors.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoVerificationResult
+ */
+export type CryptoVerificationResult = Message<"reallyme.crypto.v1.CryptoVerificationResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoVerificationStatus status = 2;
+     */
+    status: CryptoVerificationStatus;
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoError error = 3;
+     */
+    error?: CryptoError | undefined;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoVerificationResult.
+ * Use `create(CryptoVerificationResultSchema)` to create a new message.
+ */
+export declare const CryptoVerificationResultSchema: GenMessage<CryptoVerificationResult>;
+/**
+ * CryptoProviderCapability describes the package/provider posture for one
+ * algorithm in one published lane. Provider names are non-secret identifiers
+ * such as "CryptoKit", "BouncyCastle", or "ReallyMe Rust WASM".
+ *
+ * @generated from message reallyme.crypto.v1.CryptoProviderCapability
+ */
+export type CryptoProviderCapability = Message<"reallyme.crypto.v1.CryptoProviderCapability"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmFamily family = 2;
+     */
+    family: CryptoAlgorithmFamily;
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoProviderSupportStatus status = 3;
+     */
+    status: CryptoProviderSupportStatus;
+    /**
+     * @generated from field: repeated string provider_names = 4;
+     */
+    providerNames: string[];
+    /**
+     * @generated from field: bool uses_rust = 5;
+     */
+    usesRust: boolean;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoProviderCapability.
+ * Use `create(CryptoProviderCapabilitySchema)` to create a new message.
+ */
+export declare const CryptoProviderCapabilitySchema: GenMessage<CryptoProviderCapability>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoProviderCapabilitySet
+ */
+export type CryptoProviderCapabilitySet = Message<"reallyme.crypto.v1.CryptoProviderCapabilitySet"> & {
     /**
-     * @generated from oneof reallyme.crypto.v1.CryptoAlgorithmIdentifier.algorithm
+     * @generated from field: repeated reallyme.crypto.v1.CryptoProviderCapability capabilities = 1;
      */
-    algorithm: {
-        /**
-         * @generated from field: reallyme.crypto.v1.SignatureAlgorithm signature = 1;
-         */
-        value: SignatureAlgorithm;
-        case: "signature";
-    } | {
-        /**
-         * @generated from field: reallyme.crypto.v1.KeyAgreementAlgorithm key_agreement = 2;
-         */
-        value: KeyAgreementAlgorithm;
-        case: "keyAgreement";
-    } | {
-        /**
-         * @generated from field: reallyme.crypto.v1.KemAlgorithm kem = 3;
-         */
-        value: KemAlgorithm;
-        case: "kem";
-    } | {
-        /**
-         * @generated from field: reallyme.crypto.v1.HpkeSuite hpke = 4;
-         */
-        value: HpkeSuite;
-        case: "hpke";
-    } | {
-        /**
-         * @generated from field: reallyme.crypto.v1.AeadAlgorithm aead = 5;
-         */
-        value: AeadAlgorithm;
-        case: "aead";
-    } | {
-        /**
-         * @generated from field: reallyme.crypto.v1.HashAlgorithm hash = 6;
-         */
-        value: HashAlgorithm;
-        case: "hash";
-    } | {
-        /**
-         * @generated from field: reallyme.crypto.v1.MacAlgorithm mac = 7;
-         */
-        value: MacAlgorithm;
-        case: "mac";
-    } | {
-        /**
-         * @generated from field: reallyme.crypto.v1.KdfAlgorithm kdf = 8;
-         */
-        value: KdfAlgorithm;
-        case: "kdf";
-    } | {
-        /**
-         * @generated from field: reallyme.crypto.v1.KeyWrapAlgorithm key_wrap = 9;
-         */
-        value: KeyWrapAlgorithm;
-        case: "keyWrap";
-    } | {
-        /**
-         * @generated from field: reallyme.crypto.v1.MulticodecKeyAlgorithm multicodec_key = 10;
-         */
-        value: MulticodecKeyAlgorithm;
-        case: "multicodecKey";
-    } | {
-        case: undefined;
-        value?: undefined;
-    };
+    capabilities: CryptoProviderCapability[];
 };
 /**
- * Describes the message reallyme.crypto.v1.CryptoAlgorithmIdentifier.
- * Use `create(CryptoAlgorithmIdentifierSchema)` to create a new message.
+ * Describes the message reallyme.crypto.v1.CryptoProviderCapabilitySet.
+ * Use `create(CryptoProviderCapabilitySetSchema)` to create a new message.
  */
-export declare const CryptoAlgorithmIdentifierSchema: GenMessage<CryptoAlgorithmIdentifier>;
+export declare const CryptoProviderCapabilitySetSchema: GenMessage<CryptoProviderCapabilitySet>;
 /**
  * JsonWebKey carries a public JWK document at API/storage boundaries. The JSON
  * member is the canonical JCS form used by the package vectors; private key
@@ -127,6 +1293,265 @@ export type JsonWebKeySet = Message<"reallyme.crypto.v1.JsonWebKeySet"> & {
  * Use `create(JsonWebKeySetSchema)` to create a new message.
  */
 export declare const JsonWebKeySetSchema: GenMessage<JsonWebKeySet>;
+/**
+ * CryptoProtoResultStatus marks whether a result-envelope payload contains an
+ * operation-specific result protobuf or a structured CryptoError protobuf.
+ *
+ * @generated from enum reallyme.crypto.v1.CryptoProtoResultStatus
+ */
+export declare enum CryptoProtoResultStatus {
+    /**
+     * @generated from enum value: CRYPTO_PROTO_RESULT_STATUS_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: CRYPTO_PROTO_RESULT_STATUS_RESULT = 1;
+     */
+    RESULT = 1,
+    /**
+     * @generated from enum value: CRYPTO_PROTO_RESULT_STATUS_CRYPTO_ERROR = 2;
+     */
+    CRYPTO_ERROR = 2
+}
+/**
+ * Describes the enum reallyme.crypto.v1.CryptoProtoResultStatus.
+ */
+export declare const CryptoProtoResultStatusSchema: GenEnum<CryptoProtoResultStatus>;
+/**
+ * CryptoOperation is the stable dispatch identifier used by protobuf, Connect,
+ * FFI, and package adapters. Values are append-only and intentionally grouped
+ * by primitive family so a numeric id has one meaning across every lane.
+ *
+ * @generated from enum reallyme.crypto.v1.CryptoOperation
+ */
+export declare enum CryptoOperation {
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_HASH = 1;
+     */
+    HASH = 1,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_AEAD_SEAL = 2;
+     */
+    AEAD_SEAL = 2,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_AEAD_OPEN = 3;
+     */
+    AEAD_OPEN = 3,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_MAC_AUTHENTICATE = 4;
+     */
+    MAC_AUTHENTICATE = 4,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_MAC_VERIFY = 5;
+     */
+    MAC_VERIFY = 5,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_SIGNATURE_GENERATE_KEY_PAIR = 10;
+     */
+    SIGNATURE_GENERATE_KEY_PAIR = 10,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_SIGNATURE_DERIVE_KEY_PAIR = 11;
+     */
+    SIGNATURE_DERIVE_KEY_PAIR = 11,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_SIGNATURE_SIGN = 12;
+     */
+    SIGNATURE_SIGN = 12,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_SIGNATURE_VERIFY = 13;
+     */
+    SIGNATURE_VERIFY = 13,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_BIP340_SCHNORR_SIGN = 14;
+     */
+    BIP340_SCHNORR_SIGN = 14,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_RSA_VERIFY = 15;
+     */
+    RSA_VERIFY = 15,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_KEY_AGREEMENT_DERIVE_SHARED_SECRET = 20;
+     */
+    KEY_AGREEMENT_DERIVE_SHARED_SECRET = 20,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_KEY_AGREEMENT_DERIVE_KEY_PAIR = 21;
+     */
+    KEY_AGREEMENT_DERIVE_KEY_PAIR = 21,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_KEM_GENERATE_KEY_PAIR = 30;
+     */
+    KEM_GENERATE_KEY_PAIR = 30,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_KEM_ENCAPSULATE = 31;
+     */
+    KEM_ENCAPSULATE = 31,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_KEM_DECAPSULATE = 32;
+     */
+    KEM_DECAPSULATE = 32,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_HKDF_DERIVE = 40;
+     */
+    HKDF_DERIVE = 40,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_KDF_DERIVE_KEY = 41;
+     */
+    KDF_DERIVE_KEY = 41,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_JWA_CONCAT_KDF_SHA256_DERIVE = 42;
+     */
+    JWA_CONCAT_KDF_SHA256_DERIVE = 42,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_KEY_WRAP = 50;
+     */
+    KEY_WRAP = 50,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_KEY_UNWRAP = 51;
+     */
+    KEY_UNWRAP = 51,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_HPKE_SEAL = 60;
+     */
+    HPKE_SEAL = 60,
+    /**
+     * @generated from enum value: CRYPTO_OPERATION_HPKE_OPEN = 61;
+     */
+    HPKE_OPEN = 61
+}
+/**
+ * Describes the enum reallyme.crypto.v1.CryptoOperation.
+ */
+export declare const CryptoOperationSchema: GenEnum<CryptoOperation>;
+/**
+ * CryptoErrorReason is the component-owned reason-code enum for reallyme/crypto.
+ * Values are stable public boundary codes; internal Rust, Swift, Kotlin, and
+ * TypeScript errors must map into one of these before crossing RPC, SDK, FFI,
+ * storage, audit, or telemetry boundaries. Numeric ranges are intentionally
+ * split by crypto subpart:
+ *   100-199: primitive operations and validation
+ *   200-299: provider selection and availability
+ *   300-399: backend dispatch and internal failures
+ *
+ * @generated from enum reallyme.crypto.v1.CryptoErrorReason
+ */
+export declare enum CryptoErrorReason {
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * Primitive input, key material, and byte-format validation.
+     *
+     * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_INVALID_PARAMETER = 100;
+     */
+    PRIMITIVE_INVALID_PARAMETER = 100,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_INVALID_LENGTH = 101;
+     */
+    PRIMITIVE_INVALID_LENGTH = 101,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_INVALID_KEY = 102;
+     */
+    PRIMITIVE_INVALID_KEY = 102,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_INVALID_PUBLIC_KEY = 103;
+     */
+    PRIMITIVE_INVALID_PUBLIC_KEY = 103,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_INVALID_PRIVATE_KEY = 104;
+     */
+    PRIMITIVE_INVALID_PRIVATE_KEY = 104,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_INVALID_NONCE = 105;
+     */
+    PRIMITIVE_INVALID_NONCE = 105,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_INVALID_SALT = 106;
+     */
+    PRIMITIVE_INVALID_SALT = 106,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_INVALID_PASSWORD = 107;
+     */
+    PRIMITIVE_INVALID_PASSWORD = 107,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_INVALID_ENCODING = 108;
+     */
+    PRIMITIVE_INVALID_ENCODING = 108,
+    /**
+     * Primitive operation failures.
+     *
+     * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_INVALID_SIGNATURE = 120;
+     */
+    PRIMITIVE_INVALID_SIGNATURE = 120,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_VERIFICATION_FAILED = 121;
+     */
+    PRIMITIVE_VERIFICATION_FAILED = 121,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_AUTHENTICATION_FAILED = 122;
+     */
+    PRIMITIVE_AUTHENTICATION_FAILED = 122,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_MALFORMED_CIPHERTEXT = 123;
+     */
+    PRIMITIVE_MALFORMED_CIPHERTEXT = 123,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_INVALID_TAG = 124;
+     */
+    PRIMITIVE_INVALID_TAG = 124,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_INVALID_SHARED_SECRET = 125;
+     */
+    PRIMITIVE_INVALID_SHARED_SECRET = 125,
+    /**
+     * Provider policy and availability.
+     *
+     * @generated from enum value: CRYPTO_ERROR_REASON_PROVIDER_UNSUPPORTED_ALGORITHM = 200;
+     */
+    PROVIDER_UNSUPPORTED_ALGORITHM = 200,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PROVIDER_UNSUPPORTED_BACKEND = 201;
+     */
+    PROVIDER_UNSUPPORTED_BACKEND = 201,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PROVIDER_UNAVAILABLE = 202;
+     */
+    PROVIDER_UNAVAILABLE = 202,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PROVIDER_RANDOMNESS_UNAVAILABLE = 203;
+     */
+    PROVIDER_RANDOMNESS_UNAVAILABLE = 203,
+    /**
+     * Backend dispatch and internal state.
+     *
+     * @generated from enum value: CRYPTO_ERROR_REASON_BACKEND_INVALID_STATE = 300;
+     */
+    BACKEND_INVALID_STATE = 300,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_BACKEND_INTERNAL = 301;
+     */
+    BACKEND_INTERNAL = 301,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_BACKEND_MALFORMED_PROTOBUF = 302;
+     */
+    BACKEND_MALFORMED_PROTOBUF = 302,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_BACKEND_MALFORMED_JSON = 303;
+     */
+    BACKEND_MALFORMED_JSON = 303,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_BACKEND_RESOURCE_LIMIT_EXCEEDED = 304;
+     */
+    BACKEND_RESOURCE_LIMIT_EXCEEDED = 304
+}
+/**
+ * Describes the enum reallyme.crypto.v1.CryptoErrorReason.
+ */
+export declare const CryptoErrorReasonSchema: GenEnum<CryptoErrorReason>;
 /**
  * CryptoAlgorithmFamily classifies an algorithm identifier without implying
  * that the identifier is valid for a specific operation.
@@ -636,3 +2061,110 @@ export declare enum MulticodecKeyAlgorithm {
  * Describes the enum reallyme.crypto.v1.MulticodecKeyAlgorithm.
  */
 export declare const MulticodecKeyAlgorithmSchema: GenEnum<MulticodecKeyAlgorithm>;
+/**
+ * RsaPublicKeyDerEncoding identifies the accepted DER wrapper for RSA public
+ * keys at verification boundaries.
+ *
+ * @generated from enum reallyme.crypto.v1.RsaPublicKeyDerEncoding
+ */
+export declare enum RsaPublicKeyDerEncoding {
+    /**
+     * @generated from enum value: RSA_PUBLIC_KEY_DER_ENCODING_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: RSA_PUBLIC_KEY_DER_ENCODING_PKCS1 = 1;
+     */
+    PKCS1 = 1,
+    /**
+     * @generated from enum value: RSA_PUBLIC_KEY_DER_ENCODING_SPKI = 2;
+     */
+    SPKI = 2
+}
+/**
+ * Describes the enum reallyme.crypto.v1.RsaPublicKeyDerEncoding.
+ */
+export declare const RsaPublicKeyDerEncodingSchema: GenEnum<RsaPublicKeyDerEncoding>;
+/**
+ * CryptoVerificationStatus avoids using a bare bool in protocol results where
+ * "unset" and "false" need to remain distinguishable.
+ *
+ * @generated from enum reallyme.crypto.v1.CryptoVerificationStatus
+ */
+export declare enum CryptoVerificationStatus {
+    /**
+     * @generated from enum value: CRYPTO_VERIFICATION_STATUS_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: CRYPTO_VERIFICATION_STATUS_VALID = 1;
+     */
+    VALID = 1,
+    /**
+     * Well-formed verification input was processed, but the MAC, signature,
+     * proof, or comparison did not verify. Malformed input, unsupported
+     * algorithms, provider failures, and backend failures use ERROR plus the
+     * structured CryptoError field instead.
+     *
+     * @generated from enum value: CRYPTO_VERIFICATION_STATUS_INVALID = 2;
+     */
+    INVALID = 2,
+    /**
+     * @generated from enum value: CRYPTO_VERIFICATION_STATUS_ERROR = 3;
+     */
+    ERROR = 3
+}
+/**
+ * Describes the enum reallyme.crypto.v1.CryptoVerificationStatus.
+ */
+export declare const CryptoVerificationStatusSchema: GenEnum<CryptoVerificationStatus>;
+/**
+ * CryptoProviderSupportStatus mirrors the release provider matrix at a stable
+ * wire boundary without exposing backend exception text or dynamic logs.
+ *
+ * @generated from enum reallyme.crypto.v1.CryptoProviderSupportStatus
+ */
+export declare enum CryptoProviderSupportStatus {
+    /**
+     * @generated from enum value: CRYPTO_PROVIDER_SUPPORT_STATUS_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: CRYPTO_PROVIDER_SUPPORT_STATUS_SUPPORTED = 1;
+     */
+    SUPPORTED = 1,
+    /**
+     * @generated from enum value: CRYPTO_PROVIDER_SUPPORT_STATUS_PROVIDER_AWARE = 2;
+     */
+    PROVIDER_AWARE = 2,
+    /**
+     * @generated from enum value: CRYPTO_PROVIDER_SUPPORT_STATUS_PARTIAL = 3;
+     */
+    PARTIAL = 3,
+    /**
+     * @generated from enum value: CRYPTO_PROVIDER_SUPPORT_STATUS_UNSUPPORTED = 4;
+     */
+    UNSUPPORTED = 4
+}
+/**
+ * Describes the enum reallyme.crypto.v1.CryptoProviderSupportStatus.
+ */
+export declare const CryptoProviderSupportStatusSchema: GenEnum<CryptoProviderSupportStatus>;
+/**
+ * CryptoService is the transport schema for Connect-compatible adapters.
+ * Implementations must apply the same provider policy and size limits as the
+ * local process-proto and FFI lanes; the service definition does not authorize
+ * fallback to a different provider.
+ *
+ * @generated from service reallyme.crypto.v1.CryptoService
+ */
+export declare const CryptoService: GenService<{
+    /**
+     * @generated from rpc reallyme.crypto.v1.CryptoService.Process
+     */
+    process: {
+        methodKind: "unary";
+        input: typeof CryptoServiceProcessRequestSchema;
+        output: typeof CryptoServiceProcessResponseSchema;
+    };
+}>;