@reallyme/crypto 0.1.7 → 0.2.0

package/dist/proto.js

@@ -1,9 +1,34 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
 // SPDX-License-Identifier: Apache-2.0
+import { create, fromBinary, toBinary } from "@bufbuild/protobuf";
 import { ReallyMeCryptoError } from "./errors.js";
-export { AeadAlgorithm, AeadAlgorithmSchema, CryptoAlgorithmFamily, CryptoAlgorithmIdentifierSchema, CryptoAlgorithmFamilySchema, HashAlgorithm, HashAlgorithmSchema, HpkeSuite, HpkeSuiteSchema, JsonWebKeySchema, JsonWebKeySetSchema, KdfAlgorithm, KdfAlgorithmSchema, KemAlgorithm, KemAlgorithmSchema, KeyAgreementAlgorithm, KeyAgreementAlgorithmSchema, KeyWrapAlgorithm, KeyWrapAlgorithmSchema, MacAlgorithm, MacAlgorithmSchema, MulticodecKeyAlgorithm, MulticodecKeyAlgorithmSchema, SignatureAlgorithm, SignatureAlgorithmSchema, file_reallyme_crypto_v1_crypto, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
-import { AeadAlgorithm, HashAlgorithm, HpkeSuite, KdfAlgorithm, KemAlgorithm, KeyAgreementAlgorithm, KeyWrapAlgorithm, MacAlgorithm, MulticodecKeyAlgorithm, SignatureAlgorithm, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+import { ReallyMeJwk } from "./jwk.js";
+export { AeadAlgorithm, AeadAlgorithmSchema, CryptoAlgorithmFamily, CryptoAlgorithmFamilySchema, CryptoAlgorithmIdentifierSchema, CryptoAeadOpenRequestSchema, CryptoAeadOpenResultSchema, CryptoAeadSealRequestSchema, CryptoAeadSealResultSchema, CryptoBackendErrorSchema, CryptoBip340SchnorrSignRequestSchema, CryptoErrorSchema, CryptoErrorReason, CryptoErrorReasonSchema, CryptoHashRequestSchema, CryptoHashResultSchema, CryptoHkdfDeriveRequestSchema, CryptoHkdfDeriveResultSchema, CryptoHpkeOpenRequestSchema, CryptoHpkeOpenResultSchema, CryptoHpkeSealRequestSchema, CryptoHpkeSealedMessageSchema, CryptoJwaConcatKdfSha256DeriveRequestSchema, CryptoJwaConcatKdfSha256DeriveResultSchema, CryptoKdfDeriveKeyRequestSchema, CryptoKdfDeriveKeyResultSchema, CryptoKemEncapsulationSchema, CryptoKemDecapsulateRequestSchema, CryptoKemDecapsulateResultSchema, CryptoKemEncapsulateRequestSchema, CryptoKemGenerateKeyPairRequestSchema, CryptoKeyAgreementDeriveKeyPairRequestSchema, CryptoKeyAgreementDeriveSharedSecretRequestSchema, CryptoKeyAgreementDeriveSharedSecretResultSchema, CryptoKeyPairSchema, CryptoKeyUnwrapRequestSchema, CryptoKeyUnwrapResultSchema, CryptoKeyWrapRequestSchema, CryptoKeyWrapResultSchema, CryptoMacAuthenticateRequestSchema, CryptoMacAuthenticateResultSchema, CryptoMacVerifyRequestSchema, CryptoPrimitiveErrorSchema, CryptoProviderErrorSchema, CryptoProviderCapabilitySchema, CryptoProviderCapabilitySetSchema, CryptoProviderSupportStatus, CryptoProviderSupportStatusSchema, CryptoRsaVerifyRequestSchema, CryptoSignatureDeriveKeyPairRequestSchema, CryptoSignatureGenerateKeyPairRequestSchema, CryptoSignatureSignRequestSchema, CryptoSignatureSignResultSchema, CryptoSignatureVerifyRequestSchema, CryptoVerificationResultSchema, CryptoVerificationStatus, CryptoVerificationStatusSchema, HashAlgorithm, HashAlgorithmSchema, HpkeSuite, HpkeSuiteSchema, JsonWebKeySchema, JsonWebKeySetSchema, KdfAlgorithm, KdfAlgorithmSchema, KemAlgorithm, KemAlgorithmSchema, KeyAgreementAlgorithm, KeyAgreementAlgorithmSchema, KeyWrapAlgorithm, KeyWrapAlgorithmSchema, MacAlgorithm, MacAlgorithmSchema, MulticodecKeyAlgorithm, MulticodecKeyAlgorithmSchema, SignatureAlgorithm, SignatureAlgorithmSchema, file_reallyme_crypto_v1_crypto, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+import { AeadAlgorithm, HashAlgorithm, HpkeSuite, KdfAlgorithm, KemAlgorithm, KeyAgreementAlgorithm, KeyWrapAlgorithm, MacAlgorithm, MulticodecKeyAlgorithm, SignatureAlgorithm, CryptoAlgorithmIdentifierSchema, CryptoAlgorithmFamily, CryptoBackendErrorSchema, CryptoErrorReason, CryptoErrorSchema, CryptoHpkeSealedMessageSchema, CryptoKemEncapsulationSchema, CryptoKeyPairSchema, CryptoPrimitiveErrorSchema, CryptoProviderCapabilitySchema, CryptoProviderCapabilitySetSchema, CryptoProviderErrorSchema, CryptoProviderSupportStatus, CryptoVerificationResultSchema, CryptoVerificationStatus, JsonWebKeySchema, JsonWebKeySetSchema, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+export class ReallyMeCryptoProtoResult {
+    #bytes;
+    status;
+    constructor(status, bytes) {
+        this.status = status;
+        this.#bytes = bytes.slice();
+    }
+    get bytes() {
+        return this.#bytes.slice();
+    }
+    get isCryptoError() {
+        return this.status === "crypto-error";
+    }
+    bestEffortClear() {
+        this.#bytes.fill(0);
+    }
+    toString() {
+        return `ReallyMeCryptoProtoResult(status=${this.status}, bytes=<redacted>)`;
+    }
+    toJSON() {
+        return { status: this.status, bytes: "<redacted>" };
+    }
+}
 export const signatureAlgorithmFromProto = (value) => {
     switch (value) {
         case SignatureAlgorithm.ED25519:
@@ -294,6 +319,42 @@ export const hpkeSuiteToProto = (value) => {
             return HpkeSuite.DHKEM_X25519_HKDF_SHA256_HKDF_SHA256_CHACHA20_POLY1305;
     }
 };
+const signatureAlgorithmIdentifierToProto = (value) => create(CryptoAlgorithmIdentifierSchema, {
+    algorithm: { case: "signature", value: signatureAlgorithmToProto(value) },
+});
+const keyAgreementAlgorithmIdentifierToProto = (value) => create(CryptoAlgorithmIdentifierSchema, {
+    algorithm: { case: "keyAgreement", value: keyAgreementAlgorithmToProto(value) },
+});
+const kemAlgorithmIdentifierToProto = (value) => create(CryptoAlgorithmIdentifierSchema, {
+    algorithm: { case: "kem", value: kemAlgorithmToProto(value) },
+});
+const hpkeSuiteIdentifierToProto = (value) => create(CryptoAlgorithmIdentifierSchema, {
+    algorithm: { case: "hpke", value: hpkeSuiteToProto(value) },
+});
+const signatureAlgorithmFromIdentifier = (value) => {
+    if (value?.algorithm.case !== "signature") {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    return signatureAlgorithmFromProto(value.algorithm.value);
+};
+const keyAgreementAlgorithmFromIdentifier = (value) => {
+    if (value?.algorithm.case !== "keyAgreement") {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    return keyAgreementAlgorithmFromProto(value.algorithm.value);
+};
+const kemAlgorithmFromIdentifier = (value) => {
+    if (value?.algorithm.case !== "kem") {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    return kemAlgorithmFromProto(value.algorithm.value);
+};
+const hpkeSuiteFromIdentifier = (value) => {
+    if (value?.algorithm.case !== "hpke") {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    return hpkeSuiteFromProto(value.algorithm.value);
+};
 export const multicodecKeyAlgorithmFromProto = (value) => {
     switch (value) {
         case MulticodecKeyAlgorithm.ED25519_PUB:
@@ -360,3 +421,646 @@ export const multicodecKeyAlgorithmToProto = (value) => {
             return MulticodecKeyAlgorithm.ML_DSA_87_PUB;
     }
 };
+const asciiToBytes = (value) => {
+    const bytes = new Uint8Array(value.length);
+    for (let index = 0; index < value.length; index += 1) {
+        const codeUnit = value.charCodeAt(index);
+        if (codeUnit > 0x7f) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        bytes[index] = codeUnit;
+    }
+    return bytes;
+};
+const asciiFromBytes = (value) => {
+    const codeUnits = [];
+    for (const byte of value) {
+        if (byte > 0x7f) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        codeUnits.push(byte);
+    }
+    return String.fromCharCode(...codeUnits);
+};
+const cryptoErrorReasonToFacadeError = (reason) => {
+    switch (reason) {
+        case CryptoErrorReason.PRIMITIVE_INVALID_SIGNATURE:
+        case CryptoErrorReason.PRIMITIVE_VERIFICATION_FAILED:
+            return new ReallyMeCryptoError("invalid-signature");
+        case CryptoErrorReason.PROVIDER_UNSUPPORTED_ALGORITHM:
+        case CryptoErrorReason.PROVIDER_UNSUPPORTED_BACKEND:
+            return new ReallyMeCryptoError("unsupported-algorithm");
+        case CryptoErrorReason.PROVIDER_UNAVAILABLE:
+        case CryptoErrorReason.PROVIDER_RANDOMNESS_UNAVAILABLE:
+        case CryptoErrorReason.BACKEND_INVALID_STATE:
+        case CryptoErrorReason.BACKEND_INTERNAL:
+        case CryptoErrorReason.BACKEND_MALFORMED_PROTOBUF:
+        case CryptoErrorReason.BACKEND_MALFORMED_JSON:
+        case CryptoErrorReason.BACKEND_RESOURCE_LIMIT_EXCEEDED:
+            return new ReallyMeCryptoError("provider-failure");
+        case CryptoErrorReason.PRIMITIVE_INVALID_PARAMETER:
+        case CryptoErrorReason.PRIMITIVE_INVALID_LENGTH:
+        case CryptoErrorReason.PRIMITIVE_INVALID_KEY:
+        case CryptoErrorReason.PRIMITIVE_INVALID_PUBLIC_KEY:
+        case CryptoErrorReason.PRIMITIVE_INVALID_PRIVATE_KEY:
+        case CryptoErrorReason.PRIMITIVE_INVALID_NONCE:
+        case CryptoErrorReason.PRIMITIVE_INVALID_SALT:
+        case CryptoErrorReason.PRIMITIVE_INVALID_PASSWORD:
+        case CryptoErrorReason.PRIMITIVE_INVALID_ENCODING:
+        case CryptoErrorReason.PRIMITIVE_INVALID_SHARED_SECRET:
+        case CryptoErrorReason.PRIMITIVE_MALFORMED_CIPHERTEXT:
+        case CryptoErrorReason.PRIMITIVE_INVALID_TAG:
+            return new ReallyMeCryptoError("invalid-input");
+        case CryptoErrorReason.PRIMITIVE_AUTHENTICATION_FAILED:
+            return new ReallyMeCryptoError("authentication-failed");
+        default:
+            return new ReallyMeCryptoError("invalid-input");
+    }
+};
+const invalidInputReasons = new Set([
+    CryptoErrorReason.PRIMITIVE_INVALID_PARAMETER,
+    CryptoErrorReason.PRIMITIVE_INVALID_LENGTH,
+    CryptoErrorReason.PRIMITIVE_INVALID_KEY,
+    CryptoErrorReason.PRIMITIVE_INVALID_PUBLIC_KEY,
+    CryptoErrorReason.PRIMITIVE_INVALID_PRIVATE_KEY,
+    CryptoErrorReason.PRIMITIVE_INVALID_NONCE,
+    CryptoErrorReason.PRIMITIVE_INVALID_SALT,
+    CryptoErrorReason.PRIMITIVE_INVALID_PASSWORD,
+    CryptoErrorReason.PRIMITIVE_INVALID_ENCODING,
+    CryptoErrorReason.PRIMITIVE_INVALID_SHARED_SECRET,
+    CryptoErrorReason.PRIMITIVE_MALFORMED_CIPHERTEXT,
+    CryptoErrorReason.PRIMITIVE_INVALID_TAG,
+]);
+export const cryptoWireErrorToProto = (error) => {
+    switch (error.branch) {
+        case "primitive":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "primitive",
+                    value: create(CryptoPrimitiveErrorSchema, {
+                        reason: error.reason,
+                    }),
+                },
+            });
+        case "provider":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "provider",
+                    value: create(CryptoProviderErrorSchema, {
+                        reason: error.reason,
+                    }),
+                },
+            });
+        case "backend":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "backend",
+                    value: create(CryptoBackendErrorSchema, {
+                        reason: error.reason,
+                    }),
+                },
+            });
+    }
+};
+export const cryptoWireErrorFromProto = (value) => {
+    switch (value.error.case) {
+        case "primitive":
+            return strictCryptoWireError("primitive", value.error.value.reason);
+        case "provider":
+            return strictCryptoWireError("provider", value.error.value.reason);
+        case "backend":
+            return strictCryptoWireError("backend", value.error.value.reason);
+        default:
+            return malformedCryptoErrorEnvelope();
+    }
+};
+export const cryptoWireErrorToProtoBytes = (error) => toBinary(CryptoErrorSchema, cryptoWireErrorToProto(error));
+export const cryptoWireErrorFromProtoBytes = (bytes) => {
+    try {
+        return cryptoWireErrorFromProto(fromBinary(CryptoErrorSchema, bytes));
+    }
+    catch {
+        return malformedCryptoErrorEnvelope();
+    }
+};
+const strictCryptoWireError = (branch, reason) => {
+    const result = cryptoWireErrorTryNew(branch, reason);
+    return result.ok ? result.value : malformedCryptoErrorEnvelope();
+};
+export const cryptoWireErrorTryNew = (branch, reason) => {
+    if (reason === CryptoErrorReason.UNSPECIFIED) {
+        return { ok: false, error: "unspecified-reason" };
+    }
+    if (knownCryptoErrorReasons.has(reason) && !cryptoErrorReasonMatchesBranch(branch, reason)) {
+        return { ok: false, error: "branch-reason-mismatch" };
+    }
+    if (!cryptoErrorReasonCodeMatchesBranch(branch, reason)) {
+        return { ok: false, error: "reason-code-out-of-range" };
+    }
+    return { ok: true, value: { branch, reason, reasonCode: reason } };
+};
+const malformedCryptoErrorEnvelope = () => ({
+    branch: "backend",
+    reason: CryptoErrorReason.BACKEND_MALFORMED_PROTOBUF,
+    reasonCode: CryptoErrorReason.BACKEND_MALFORMED_PROTOBUF,
+});
+const cryptoErrorReasonCodeMatchesBranch = (branch, reasonCode) => {
+    switch (branch) {
+        case "primitive":
+            return reasonCode >= 100 && reasonCode <= 199;
+        case "provider":
+            return reasonCode >= 200 && reasonCode <= 299;
+        case "backend":
+            return reasonCode >= 300 && reasonCode <= 399;
+    }
+};
+const cryptoErrorReasonMatchesBranch = (branch, reason) => {
+    switch (branch) {
+        case "primitive":
+            return primitiveCryptoErrorReasons.has(reason);
+        case "provider":
+            return providerCryptoErrorReasons.has(reason);
+        case "backend":
+            return backendCryptoErrorReasons.has(reason);
+    }
+};
+const primitiveCryptoErrorReasons = new Set([
+    CryptoErrorReason.PRIMITIVE_INVALID_PARAMETER,
+    CryptoErrorReason.PRIMITIVE_INVALID_LENGTH,
+    CryptoErrorReason.PRIMITIVE_INVALID_KEY,
+    CryptoErrorReason.PRIMITIVE_INVALID_PUBLIC_KEY,
+    CryptoErrorReason.PRIMITIVE_INVALID_PRIVATE_KEY,
+    CryptoErrorReason.PRIMITIVE_INVALID_NONCE,
+    CryptoErrorReason.PRIMITIVE_INVALID_SALT,
+    CryptoErrorReason.PRIMITIVE_INVALID_PASSWORD,
+    CryptoErrorReason.PRIMITIVE_INVALID_ENCODING,
+    CryptoErrorReason.PRIMITIVE_INVALID_SIGNATURE,
+    CryptoErrorReason.PRIMITIVE_VERIFICATION_FAILED,
+    CryptoErrorReason.PRIMITIVE_AUTHENTICATION_FAILED,
+    CryptoErrorReason.PRIMITIVE_MALFORMED_CIPHERTEXT,
+    CryptoErrorReason.PRIMITIVE_INVALID_TAG,
+    CryptoErrorReason.PRIMITIVE_INVALID_SHARED_SECRET,
+]);
+const providerCryptoErrorReasons = new Set([
+    CryptoErrorReason.PROVIDER_UNSUPPORTED_ALGORITHM,
+    CryptoErrorReason.PROVIDER_UNSUPPORTED_BACKEND,
+    CryptoErrorReason.PROVIDER_UNAVAILABLE,
+    CryptoErrorReason.PROVIDER_RANDOMNESS_UNAVAILABLE,
+]);
+const backendCryptoErrorReasons = new Set([
+    CryptoErrorReason.BACKEND_INVALID_STATE,
+    CryptoErrorReason.BACKEND_INTERNAL,
+    CryptoErrorReason.BACKEND_MALFORMED_PROTOBUF,
+    CryptoErrorReason.BACKEND_MALFORMED_JSON,
+    CryptoErrorReason.BACKEND_RESOURCE_LIMIT_EXCEEDED,
+]);
+const knownCryptoErrorReasons = new Set([
+    ...primitiveCryptoErrorReasons,
+    ...providerCryptoErrorReasons,
+    ...backendCryptoErrorReasons,
+]);
+export const cryptoWireErrorToFacadeError = (error) => {
+    if (!knownCryptoErrorReasons.has(error.reason)) {
+        return new ReallyMeCryptoError("provider-failure");
+    }
+    const facadeError = cryptoErrorReasonToFacadeError(error.reason);
+    if (facadeError.code !== "invalid-input" || invalidInputReasons.has(error.reason)) {
+        return facadeError;
+    }
+    switch (error.branch) {
+        case "primitive":
+            return facadeError;
+        case "provider":
+        case "backend":
+            return new ReallyMeCryptoError("provider-failure");
+    }
+};
+export const cryptoProtoResult = (bytes) => new ReallyMeCryptoProtoResult("result", bytes);
+export const cryptoProtoErrorResult = (error) => {
+    const bytes = error instanceof ReallyMeCryptoError
+        ? cryptoErrorToProtoBytes(error)
+        : "branch" in error
+            ? cryptoWireErrorToProtoBytes(error)
+            : toBinary(CryptoErrorSchema, error);
+    return new ReallyMeCryptoProtoResult("crypto-error", bytes);
+};
+export const cryptoErrorToProto = (error) => {
+    switch (error.code) {
+        case "invalid-input":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "primitive",
+                    value: create(CryptoPrimitiveErrorSchema, {
+                        reason: CryptoErrorReason.PRIMITIVE_INVALID_PARAMETER,
+                    }),
+                },
+            });
+        case "invalid-signature":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "primitive",
+                    value: create(CryptoPrimitiveErrorSchema, {
+                        reason: CryptoErrorReason.PRIMITIVE_INVALID_SIGNATURE,
+                    }),
+                },
+            });
+        case "authentication-failed":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "primitive",
+                    value: create(CryptoPrimitiveErrorSchema, {
+                        reason: CryptoErrorReason.PRIMITIVE_AUTHENTICATION_FAILED,
+                    }),
+                },
+            });
+        case "provider-failure":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "backend",
+                    value: create(CryptoBackendErrorSchema, {
+                        reason: CryptoErrorReason.BACKEND_INTERNAL,
+                    }),
+                },
+            });
+        case "unsupported-algorithm":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "provider",
+                    value: create(CryptoProviderErrorSchema, {
+                        reason: CryptoErrorReason.PROVIDER_UNSUPPORTED_ALGORITHM,
+                    }),
+                },
+            });
+    }
+};
+export const cryptoErrorToProtoBytes = (error) => toBinary(CryptoErrorSchema, cryptoErrorToProto(error));
+export const cryptoErrorFromProto = (value) => {
+    return cryptoWireErrorToFacadeError(cryptoWireErrorFromProto(value));
+};
+export const cryptoErrorFromProtoBytes = (bytes) => {
+    return cryptoWireErrorToFacadeError(cryptoWireErrorFromProtoBytes(bytes));
+};
+const signatureJwkAlgorithmToProto = (value) => {
+    switch (value) {
+        case "Ed25519":
+            return SignatureAlgorithm.ED25519;
+        case "P-256":
+            return SignatureAlgorithm.ECDSA_P256_SHA256;
+        case "secp256k1":
+            return SignatureAlgorithm.ECDSA_SECP256K1_SHA256;
+        case "ML-DSA-44":
+            return SignatureAlgorithm.ML_DSA_44;
+        case "ML-DSA-65":
+            return SignatureAlgorithm.ML_DSA_65;
+        case "ML-DSA-87":
+            return SignatureAlgorithm.ML_DSA_87;
+        case "SLH-DSA-SHA2-128s":
+            return SignatureAlgorithm.SLH_DSA_SHA2_128S;
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+const jwkAlgorithmToProto = (value) => {
+    switch (value) {
+        case "X25519":
+            return create(CryptoAlgorithmIdentifierSchema, {
+                algorithm: {
+                    case: "keyAgreement",
+                    value: KeyAgreementAlgorithm.X25519,
+                },
+            });
+        case "ML-KEM-512":
+            return create(CryptoAlgorithmIdentifierSchema, {
+                algorithm: {
+                    case: "kem",
+                    value: KemAlgorithm.ML_KEM_512,
+                },
+            });
+        case "ML-KEM-768":
+            return create(CryptoAlgorithmIdentifierSchema, {
+                algorithm: {
+                    case: "kem",
+                    value: KemAlgorithm.ML_KEM_768,
+                },
+            });
+        case "ML-KEM-1024":
+            return create(CryptoAlgorithmIdentifierSchema, {
+                algorithm: {
+                    case: "kem",
+                    value: KemAlgorithm.ML_KEM_1024,
+                },
+            });
+        case "X-Wing-768":
+            return create(CryptoAlgorithmIdentifierSchema, {
+                algorithm: {
+                    case: "kem",
+                    value: KemAlgorithm.X_WING_768,
+                },
+            });
+        case "X-Wing-1024":
+            return create(CryptoAlgorithmIdentifierSchema, {
+                algorithm: {
+                    case: "kem",
+                    value: KemAlgorithm.X_WING_1024,
+                },
+            });
+        default:
+            return create(CryptoAlgorithmIdentifierSchema, {
+                algorithm: {
+                    case: "signature",
+                    value: signatureJwkAlgorithmToProto(value),
+                },
+            });
+    }
+};
+const signatureJwkAlgorithmFromProto = (value) => {
+    switch (value) {
+        case SignatureAlgorithm.ED25519:
+            return "Ed25519";
+        case SignatureAlgorithm.ECDSA_P256_SHA256:
+            return "P-256";
+        case SignatureAlgorithm.ECDSA_SECP256K1_SHA256:
+            return "secp256k1";
+        case SignatureAlgorithm.ML_DSA_44:
+            return "ML-DSA-44";
+        case SignatureAlgorithm.ML_DSA_65:
+            return "ML-DSA-65";
+        case SignatureAlgorithm.ML_DSA_87:
+            return "ML-DSA-87";
+        case SignatureAlgorithm.SLH_DSA_SHA2_128S:
+            return "SLH-DSA-SHA2-128s";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+const jwkAlgorithmFromProto = (value) => {
+    switch (value.algorithm.case) {
+        case "signature":
+            return signatureJwkAlgorithmFromProto(value.algorithm.value);
+        case "keyAgreement":
+            if (value.algorithm.value === KeyAgreementAlgorithm.X25519) {
+                return "X25519";
+            }
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+        case "kem":
+            switch (value.algorithm.value) {
+                case KemAlgorithm.ML_KEM_512:
+                    return "ML-KEM-512";
+                case KemAlgorithm.ML_KEM_768:
+                    return "ML-KEM-768";
+                case KemAlgorithm.ML_KEM_1024:
+                    return "ML-KEM-1024";
+                case KemAlgorithm.X_WING_768:
+                    return "X-Wing-768";
+                case KemAlgorithm.X_WING_1024:
+                    return "X-Wing-1024";
+                default:
+                    throw new ReallyMeCryptoError("unsupported-algorithm");
+            }
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const jsonWebKeyToProto = (key) => create(JsonWebKeySchema, {
+    algorithm: jwkAlgorithmToProto(key.algorithm),
+    publicKey: key.publicKey,
+    canonicalJcs: asciiToBytes(ReallyMeJwk.toJcs(key.jwk)),
+});
+export const jsonWebKeyToProtoBytes = (key) => toBinary(JsonWebKeySchema, jsonWebKeyToProto(key));
+export const jsonWebKeyFromProto = (value) => {
+    const algorithm = value.algorithm === undefined
+        ? undefined
+        : jwkAlgorithmFromProto(value.algorithm);
+    if (algorithm === undefined) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    const jwk = ReallyMeJwk.toJwk(algorithm, value.publicKey);
+    if (value.canonicalJcs.length > 0) {
+        const expected = ReallyMeJwk.toJcs(jwk);
+        if (asciiFromBytes(value.canonicalJcs) !== expected) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+    }
+    return { algorithm, publicKey: value.publicKey, jwk };
+};
+export const jsonWebKeyFromProtoBytes = (bytes) => {
+    try {
+        return jsonWebKeyFromProto(fromBinary(JsonWebKeySchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const jsonWebKeySetToProto = (keySet) => create(JsonWebKeySetSchema, {
+    keys: keySet.keys.map((key) => jsonWebKeyToProto(key)),
+});
+export const jsonWebKeySetToProtoBytes = (keySet) => toBinary(JsonWebKeySetSchema, jsonWebKeySetToProto(keySet));
+export const jsonWebKeySetFromProto = (value) => ({
+    keys: value.keys.map((key) => jsonWebKeyFromProto(key)),
+});
+export const jsonWebKeySetFromProtoBytes = (bytes) => {
+    try {
+        return jsonWebKeySetFromProto(fromBinary(JsonWebKeySetSchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+const keyPairToProto = (algorithm, keyPair) => create(CryptoKeyPairSchema, {
+    algorithm,
+    publicKey: keyPair.publicKey,
+    secretKey: keyPair.secretKey,
+});
+export const signatureKeyPairToProto = (algorithm, keyPair) => keyPairToProto(signatureAlgorithmIdentifierToProto(algorithm), keyPair);
+export const signatureKeyPairToProtoBytes = (algorithm, keyPair) => toBinary(CryptoKeyPairSchema, signatureKeyPairToProto(algorithm, keyPair));
+export const signatureKeyPairFromProto = (value) => ({
+    algorithm: signatureAlgorithmFromIdentifier(value.algorithm),
+    keyPair: {
+        publicKey: value.publicKey,
+        secretKey: value.secretKey,
+    },
+});
+export const signatureKeyPairFromProtoBytes = (bytes) => {
+    try {
+        return signatureKeyPairFromProto(fromBinary(CryptoKeyPairSchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const keyAgreementKeyPairToProto = (algorithm, keyPair) => keyPairToProto(keyAgreementAlgorithmIdentifierToProto(algorithm), keyPair);
+export const keyAgreementKeyPairToProtoBytes = (algorithm, keyPair) => toBinary(CryptoKeyPairSchema, keyAgreementKeyPairToProto(algorithm, keyPair));
+export const keyAgreementKeyPairFromProto = (value) => ({
+    algorithm: keyAgreementAlgorithmFromIdentifier(value.algorithm),
+    keyPair: {
+        publicKey: value.publicKey,
+        secretKey: value.secretKey,
+    },
+});
+export const keyAgreementKeyPairFromProtoBytes = (bytes) => {
+    try {
+        return keyAgreementKeyPairFromProto(fromBinary(CryptoKeyPairSchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const kemKeyPairToProto = (algorithm, keyPair) => keyPairToProto(kemAlgorithmIdentifierToProto(algorithm), keyPair);
+export const kemKeyPairToProtoBytes = (algorithm, keyPair) => toBinary(CryptoKeyPairSchema, kemKeyPairToProto(algorithm, keyPair));
+export const kemKeyPairFromProto = (value) => ({
+    algorithm: kemAlgorithmFromIdentifier(value.algorithm),
+    keyPair: {
+        publicKey: value.publicKey,
+        secretKey: value.secretKey,
+    },
+});
+export const kemKeyPairFromProtoBytes = (bytes) => {
+    try {
+        return kemKeyPairFromProto(fromBinary(CryptoKeyPairSchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const kemEncapsulationToProto = (algorithm, encapsulation) => create(CryptoKemEncapsulationSchema, {
+    algorithm: kemAlgorithmIdentifierToProto(algorithm),
+    ciphertext: encapsulation.ciphertext,
+    sharedSecret: encapsulation.sharedSecret,
+});
+export const kemEncapsulationToProtoBytes = (algorithm, encapsulation) => toBinary(CryptoKemEncapsulationSchema, kemEncapsulationToProto(algorithm, encapsulation));
+export const kemEncapsulationFromProto = (value) => ({
+    algorithm: kemAlgorithmFromIdentifier(value.algorithm),
+    encapsulation: {
+        ciphertext: value.ciphertext,
+        sharedSecret: value.sharedSecret,
+    },
+});
+export const kemEncapsulationFromProtoBytes = (bytes) => {
+    try {
+        return kemEncapsulationFromProto(fromBinary(CryptoKemEncapsulationSchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const hpkeSealedMessageToProto = (suite, sealedMessage) => create(CryptoHpkeSealedMessageSchema, {
+    algorithm: hpkeSuiteIdentifierToProto(suite),
+    encapsulatedKey: sealedMessage.encapsulatedKey,
+    ciphertext: sealedMessage.ciphertext,
+});
+export const hpkeSealedMessageToProtoBytes = (suite, sealedMessage) => toBinary(CryptoHpkeSealedMessageSchema, hpkeSealedMessageToProto(suite, sealedMessage));
+export const hpkeSealedMessageFromProto = (value) => ({
+    suite: hpkeSuiteFromIdentifier(value.algorithm),
+    sealedMessage: {
+        encapsulatedKey: value.encapsulatedKey,
+        ciphertext: value.ciphertext,
+    },
+});
+export const hpkeSealedMessageFromProtoBytes = (bytes) => {
+    try {
+        return hpkeSealedMessageFromProto(fromBinary(CryptoHpkeSealedMessageSchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const verificationResultToProto = (algorithm, valid) => create(CryptoVerificationResultSchema, {
+    algorithm,
+    status: valid ? CryptoVerificationStatus.VALID : CryptoVerificationStatus.INVALID,
+});
+export const verificationErrorToProto = (algorithm, error) => create(CryptoVerificationResultSchema, {
+    algorithm,
+    status: CryptoVerificationStatus.ERROR,
+    error: cryptoErrorToProto(error),
+});
+export const verificationResultToProtoBytes = (value) => toBinary(CryptoVerificationResultSchema, value);
+export const verificationResultFromProtoBytes = (bytes) => {
+    try {
+        return fromBinary(CryptoVerificationResultSchema, bytes);
+    }
+    catch {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+const providerSupportStatusToProto = (value) => {
+    switch (value) {
+        case "partial":
+            return CryptoProviderSupportStatus.PARTIAL;
+        case "provider-aware":
+            return CryptoProviderSupportStatus.PROVIDER_AWARE;
+        case "supported":
+            return CryptoProviderSupportStatus.SUPPORTED;
+        case "unsupported":
+            return CryptoProviderSupportStatus.UNSUPPORTED;
+    }
+};
+const providerSupportStatusFromProto = (value) => {
+    switch (value) {
+        case CryptoProviderSupportStatus.PARTIAL:
+            return "partial";
+        case CryptoProviderSupportStatus.PROVIDER_AWARE:
+            return "provider-aware";
+        case CryptoProviderSupportStatus.SUPPORTED:
+            return "supported";
+        case CryptoProviderSupportStatus.UNSUPPORTED:
+            return "unsupported";
+        default:
+            throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const providerCapabilityToProto = (value) => create(CryptoProviderCapabilitySchema, {
+    algorithm: value.algorithm,
+    family: value.family,
+    providerNames: [...value.providerNames],
+    status: providerSupportStatusToProto(value.status),
+    usesRust: value.usesRust,
+});
+export const providerCapabilityFromProto = (value) => {
+    if (value.algorithm === undefined || value.family === CryptoAlgorithmFamily.UNSPECIFIED) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    return {
+        algorithm: value.algorithm,
+        family: value.family,
+        providerNames: [...value.providerNames],
+        status: providerSupportStatusFromProto(value.status),
+        usesRust: value.usesRust,
+    };
+};
+export const providerCapabilitySetToProto = (values) => create(CryptoProviderCapabilitySetSchema, {
+    capabilities: values.map((value) => providerCapabilityToProto(value)),
+});
+export const providerCapabilitySetToProtoBytes = (values) => toBinary(CryptoProviderCapabilitySetSchema, providerCapabilitySetToProto(values));
+export const providerCapabilitySetFromProto = (value) => value.capabilities.map((capability) => providerCapabilityFromProto(capability));
+export const providerCapabilitySetFromProtoBytes = (bytes) => {
+    try {
+        return providerCapabilitySetFromProto(fromBinary(CryptoProviderCapabilitySetSchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};