@reallyme/crypto 0.1.8 → 0.3.0

package/dist/proto/generated/reallyme/crypto/v1/crypto_pb.d.ts

@@ -102,6 +102,502 @@ export type CryptoBackendError = Message<"reallyme.crypto.v1.CryptoBackendError"
  * Use `create(CryptoBackendErrorSchema)` to create a new message.
  */
 export declare const CryptoBackendErrorSchema: GenMessage<CryptoBackendError>;
+/**
+ * CryptoOperationRequest is the single executable protobuf request for FFI,
+ * WASM, generated-SDK, CLI, and transport adapters. Native SDK callers should
+ * keep using typed methods. Sparse field bands keep related operations
+ * together without creating a second out-of-band operation namespace.
+ *
+ * Provider-owned platform keys use the standalone platform-key messages
+ * below and the native Swift or Android SDK boundary. They are deliberately
+ * outside this Rust-executable transport because native handle identity,
+ * authentication, attestation, and lifetime cannot be delegated to Rust.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoOperationRequest
+ */
+export type CryptoOperationRequest = Message<"reallyme.crypto.v1.CryptoOperationRequest"> & {
+    /**
+     * @generated from oneof reallyme.crypto.v1.CryptoOperationRequest.operation
+     */
+    operation: {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoHashRequest hash = 1;
+         */
+        value: CryptoHashRequest;
+        case: "hash";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoAeadSealRequest aead_seal = 2;
+         */
+        value: CryptoAeadSealRequest;
+        case: "aeadSeal";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoAeadOpenRequest aead_open = 3;
+         */
+        value: CryptoAeadOpenRequest;
+        case: "aeadOpen";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoMacAuthenticateRequest mac_authenticate = 4;
+         */
+        value: CryptoMacAuthenticateRequest;
+        case: "macAuthenticate";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoMacVerifyRequest mac_verify = 5;
+         */
+        value: CryptoMacVerifyRequest;
+        case: "macVerify";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoSignatureGenerateKeyPairRequest signature_generate_key_pair = 10;
+         */
+        value: CryptoSignatureGenerateKeyPairRequest;
+        case: "signatureGenerateKeyPair";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoSignatureDeriveKeyPairRequest signature_derive_key_pair = 11;
+         */
+        value: CryptoSignatureDeriveKeyPairRequest;
+        case: "signatureDeriveKeyPair";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoSignatureSignRequest signature_sign = 12;
+         */
+        value: CryptoSignatureSignRequest;
+        case: "signatureSign";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoSignatureVerifyRequest signature_verify = 13;
+         */
+        value: CryptoSignatureVerifyRequest;
+        case: "signatureVerify";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoBip340SchnorrSignRequest bip340_schnorr_sign = 14;
+         */
+        value: CryptoBip340SchnorrSignRequest;
+        case: "bip340SchnorrSign";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoRsaVerifyRequest rsa_verify = 15;
+         */
+        value: CryptoRsaVerifyRequest;
+        case: "rsaVerify";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKeyAgreementDeriveSharedSecretRequest key_agreement_derive_shared_secret = 20;
+         */
+        value: CryptoKeyAgreementDeriveSharedSecretRequest;
+        case: "keyAgreementDeriveSharedSecret";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKeyAgreementDeriveKeyPairRequest key_agreement_derive_key_pair = 21;
+         */
+        value: CryptoKeyAgreementDeriveKeyPairRequest;
+        case: "keyAgreementDeriveKeyPair";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKemGenerateKeyPairRequest kem_generate_key_pair = 30;
+         */
+        value: CryptoKemGenerateKeyPairRequest;
+        case: "kemGenerateKeyPair";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKemEncapsulateRequest kem_encapsulate = 31;
+         */
+        value: CryptoKemEncapsulateRequest;
+        case: "kemEncapsulate";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKemDecapsulateRequest kem_decapsulate = 32;
+         */
+        value: CryptoKemDecapsulateRequest;
+        case: "kemDecapsulate";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKemDeriveKeyPairRequest kem_derive_key_pair = 33;
+         */
+        value: CryptoKemDeriveKeyPairRequest;
+        case: "kemDeriveKeyPair";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoHkdfDeriveRequest hkdf_derive = 40;
+         */
+        value: CryptoHkdfDeriveRequest;
+        case: "hkdfDerive";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKdfDeriveKeyRequest kdf_derive_key = 41;
+         */
+        value: CryptoKdfDeriveKeyRequest;
+        case: "kdfDeriveKey";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoJwaConcatKdfSha256DeriveRequest jwa_concat_kdf_sha256_derive = 42;
+         */
+        value: CryptoJwaConcatKdfSha256DeriveRequest;
+        case: "jwaConcatKdfSha256Derive";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKmac256DeriveRequest kmac256_derive = 43;
+         */
+        value: CryptoKmac256DeriveRequest;
+        case: "kmac256Derive";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoArgon2idDeriveRequest argon2id_derive = 44;
+         */
+        value: CryptoArgon2idDeriveRequest;
+        case: "argon2idDerive";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKeyWrapRequest key_wrap = 50;
+         */
+        value: CryptoKeyWrapRequest;
+        case: "keyWrap";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKeyUnwrapRequest key_unwrap = 51;
+         */
+        value: CryptoKeyUnwrapRequest;
+        case: "keyUnwrap";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoHpkeSealRequest hpke_seal = 60;
+         */
+        value: CryptoHpkeSealRequest;
+        case: "hpkeSeal";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoHpkeOpenRequest hpke_open = 61;
+         */
+        value: CryptoHpkeOpenRequest;
+        case: "hpkeOpen";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoHpkeGenerateKeyPairRequest hpke_generate_key_pair = 62;
+         */
+        value: CryptoHpkeGenerateKeyPairRequest;
+        case: "hpkeGenerateKeyPair";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoHpkeDeriveKeyPairRequest hpke_derive_key_pair = 63;
+         */
+        value: CryptoHpkeDeriveKeyPairRequest;
+        case: "hpkeDeriveKeyPair";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoHpkeSenderExportRequest hpke_sender_export = 64;
+         */
+        value: CryptoHpkeSenderExportRequest;
+        case: "hpkeSenderExport";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoHpkeReceiverExportRequest hpke_receiver_export = 65;
+         */
+        value: CryptoHpkeReceiverExportRequest;
+        case: "hpkeReceiverExport";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoHpkePskSealRequest hpke_psk_seal = 66;
+         */
+        value: CryptoHpkePskSealRequest;
+        case: "hpkePskSeal";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoHpkePskOpenRequest hpke_psk_open = 67;
+         */
+        value: CryptoHpkePskOpenRequest;
+        case: "hpkePskOpen";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoOperationRequest.
+ * Use `create(CryptoOperationRequestSchema)` to create a new message.
+ */
+export declare const CryptoOperationRequestSchema: GenMessage<CryptoOperationRequest>;
+/**
+ * CryptoOperationResponse is the primary generated response contract for
+ * `CryptoOperationRequest`. Structured operation boundaries return this
+ * generated result-or-error shape.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoOperationResponse
+ */
+export type CryptoOperationResponse = Message<"reallyme.crypto.v1.CryptoOperationResponse"> & {
+    /**
+     * @generated from oneof reallyme.crypto.v1.CryptoOperationResponse.outcome
+     */
+    outcome: {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoOperationResult result = 1;
+         */
+        value: CryptoOperationResult;
+        case: "result";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoError error = 2;
+         */
+        value: CryptoError;
+        case: "error";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoOperationResponse.
+ * Use `create(CryptoOperationResponseSchema)` to create a new message.
+ */
+export declare const CryptoOperationResponseSchema: GenMessage<CryptoOperationResponse>;
+/**
+ * CryptoOperationResult makes each successful operation result explicit instead
+ * of returning opaque result bytes. Verification operations share
+ * `CryptoVerificationResult` so invalid signatures/MACs stay distinct from
+ * malformed inputs, provider failures, and backend failures.
+ *
+ * Provider-owned platform-key results remain standalone messages returned
+ * by their native Swift or Android SDK operations, not by this Rust
+ * transport result.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoOperationResult
+ */
+export type CryptoOperationResult = Message<"reallyme.crypto.v1.CryptoOperationResult"> & {
+    /**
+     * @generated from oneof reallyme.crypto.v1.CryptoOperationResult.result
+     */
+    result: {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoHashResult hash = 1;
+         */
+        value: CryptoHashResult;
+        case: "hash";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoAeadSealResult aead_seal = 2;
+         */
+        value: CryptoAeadSealResult;
+        case: "aeadSeal";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoAeadOpenResult aead_open = 3;
+         */
+        value: CryptoAeadOpenResult;
+        case: "aeadOpen";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoMacAuthenticateResult mac_authenticate = 4;
+         */
+        value: CryptoMacAuthenticateResult;
+        case: "macAuthenticate";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoVerificationResult mac_verify = 5;
+         */
+        value: CryptoVerificationResult;
+        case: "macVerify";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKeyPair signature_generate_key_pair = 10;
+         */
+        value: CryptoKeyPair;
+        case: "signatureGenerateKeyPair";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKeyPair signature_derive_key_pair = 11;
+         */
+        value: CryptoKeyPair;
+        case: "signatureDeriveKeyPair";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoSignatureSignResult signature_sign = 12;
+         */
+        value: CryptoSignatureSignResult;
+        case: "signatureSign";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoVerificationResult signature_verify = 13;
+         */
+        value: CryptoVerificationResult;
+        case: "signatureVerify";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoSignatureSignResult bip340_schnorr_sign = 14;
+         */
+        value: CryptoSignatureSignResult;
+        case: "bip340SchnorrSign";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoVerificationResult rsa_verify = 15;
+         */
+        value: CryptoVerificationResult;
+        case: "rsaVerify";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKeyAgreementDeriveSharedSecretResult key_agreement_derive_shared_secret = 20;
+         */
+        value: CryptoKeyAgreementDeriveSharedSecretResult;
+        case: "keyAgreementDeriveSharedSecret";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKeyPair key_agreement_derive_key_pair = 21;
+         */
+        value: CryptoKeyPair;
+        case: "keyAgreementDeriveKeyPair";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKeyPair kem_generate_key_pair = 30;
+         */
+        value: CryptoKeyPair;
+        case: "kemGenerateKeyPair";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKemEncapsulation kem_encapsulate = 31;
+         */
+        value: CryptoKemEncapsulation;
+        case: "kemEncapsulate";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKemDecapsulateResult kem_decapsulate = 32;
+         */
+        value: CryptoKemDecapsulateResult;
+        case: "kemDecapsulate";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKeyPair kem_derive_key_pair = 33;
+         */
+        value: CryptoKeyPair;
+        case: "kemDeriveKeyPair";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoHkdfDeriveResult hkdf_derive = 40;
+         */
+        value: CryptoHkdfDeriveResult;
+        case: "hkdfDerive";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKdfDeriveKeyResult kdf_derive_key = 41;
+         */
+        value: CryptoKdfDeriveKeyResult;
+        case: "kdfDeriveKey";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoJwaConcatKdfSha256DeriveResult jwa_concat_kdf_sha256_derive = 42;
+         */
+        value: CryptoJwaConcatKdfSha256DeriveResult;
+        case: "jwaConcatKdfSha256Derive";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKmac256DeriveResult kmac256_derive = 43;
+         */
+        value: CryptoKmac256DeriveResult;
+        case: "kmac256Derive";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKdfDeriveKeyResult argon2id_derive = 44;
+         */
+        value: CryptoKdfDeriveKeyResult;
+        case: "argon2idDerive";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKeyWrapResult key_wrap = 50;
+         */
+        value: CryptoKeyWrapResult;
+        case: "keyWrap";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKeyUnwrapResult key_unwrap = 51;
+         */
+        value: CryptoKeyUnwrapResult;
+        case: "keyUnwrap";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoHpkeSealedMessage hpke_seal = 60;
+         */
+        value: CryptoHpkeSealedMessage;
+        case: "hpkeSeal";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoHpkeOpenResult hpke_open = 61;
+         */
+        value: CryptoHpkeOpenResult;
+        case: "hpkeOpen";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKeyPair hpke_generate_key_pair = 62;
+         */
+        value: CryptoKeyPair;
+        case: "hpkeGenerateKeyPair";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoKeyPair hpke_derive_key_pair = 63;
+         */
+        value: CryptoKeyPair;
+        case: "hpkeDeriveKeyPair";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoHpkeSenderExportResult hpke_sender_export = 64;
+         */
+        value: CryptoHpkeSenderExportResult;
+        case: "hpkeSenderExport";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoHpkeReceiverExportResult hpke_receiver_export = 65;
+         */
+        value: CryptoHpkeReceiverExportResult;
+        case: "hpkeReceiverExport";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoHpkeSealedMessage hpke_psk_seal = 66;
+         */
+        value: CryptoHpkeSealedMessage;
+        case: "hpkePskSeal";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.CryptoHpkeOpenResult hpke_psk_open = 67;
+         */
+        value: CryptoHpkeOpenResult;
+        case: "hpkePskOpen";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoOperationResult.
+ * Use `create(CryptoOperationResultSchema)` to create a new message.
+ */
+export declare const CryptoOperationResultSchema: GenMessage<CryptoOperationResult>;
+/**
+ * HpkeSuiteIdentifier is the canonical 0.3.0 HPKE algorithm identifier.
+ * Components use their assigned two-byte HPKE registry values; implementations
+ * must reject unsupported combinations instead of selecting a fallback suite.
+ *
+ * @generated from message reallyme.crypto.v1.HpkeSuiteIdentifier
+ */
+export type HpkeSuiteIdentifier = Message<"reallyme.crypto.v1.HpkeSuiteIdentifier"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.HpkeKemId kem = 1;
+     */
+    kem: HpkeKemId;
+    /**
+     * @generated from field: reallyme.crypto.v1.HpkeKdfId kdf = 2;
+     */
+    kdf: HpkeKdfId;
+    /**
+     * @generated from field: reallyme.crypto.v1.HpkeAeadId aead = 3;
+     */
+    aead: HpkeAeadId;
+};
+/**
+ * Describes the message reallyme.crypto.v1.HpkeSuiteIdentifier.
+ * Use `create(HpkeSuiteIdentifierSchema)` to create a new message.
+ */
+export declare const HpkeSuiteIdentifierSchema: GenMessage<HpkeSuiteIdentifier>;
 /**
  * CryptoAlgorithmIdentifier is a oneof wrapper for protocol messages that need
  * to carry a typed algorithm choice without using free-form strings.
@@ -130,12 +626,6 @@ export type CryptoAlgorithmIdentifier = Message<"reallyme.crypto.v1.CryptoAlgori
          */
         value: KemAlgorithm;
         case: "kem";
-    } | {
-        /**
-         * @generated from field: reallyme.crypto.v1.HpkeSuite hpke = 4;
-         */
-        value: HpkeSuite;
-        case: "hpke";
     } | {
         /**
          * @generated from field: reallyme.crypto.v1.AeadAlgorithm aead = 5;
@@ -172,16 +662,1788 @@ export type CryptoAlgorithmIdentifier = Message<"reallyme.crypto.v1.CryptoAlgori
          */
         value: MulticodecKeyAlgorithm;
         case: "multicodecKey";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.HpkeSuiteIdentifier hpke_suite = 11;
+         */
+        value: HpkeSuiteIdentifier;
+        case: "hpkeSuite";
     } | {
         case: undefined;
         value?: undefined;
     };
 };
 /**
- * Describes the message reallyme.crypto.v1.CryptoAlgorithmIdentifier.
- * Use `create(CryptoAlgorithmIdentifierSchema)` to create a new message.
+ * Describes the message reallyme.crypto.v1.CryptoAlgorithmIdentifier.
+ * Use `create(CryptoAlgorithmIdentifierSchema)` to create a new message.
+ */
+export declare const CryptoAlgorithmIdentifierSchema: GenMessage<CryptoAlgorithmIdentifier>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHashRequest
+ */
+export type CryptoHashRequest = Message<"reallyme.crypto.v1.CryptoHashRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes input = 2;
+     */
+    input: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHashRequest.
+ * Use `create(CryptoHashRequestSchema)` to create a new message.
+ */
+export declare const CryptoHashRequestSchema: GenMessage<CryptoHashRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHashResult
+ */
+export type CryptoHashResult = Message<"reallyme.crypto.v1.CryptoHashResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes digest = 2;
+     */
+    digest: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHashResult.
+ * Use `create(CryptoHashResultSchema)` to create a new message.
+ */
+export declare const CryptoHashResultSchema: GenMessage<CryptoHashResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoAeadSealRequest
+ */
+export type CryptoAeadSealRequest = Message<"reallyme.crypto.v1.CryptoAeadSealRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing AEAD key; callers must zeroize copies where platform
+     * semantics permit.
+     *
+     * @generated from field: bytes key = 2;
+     */
+    key: Uint8Array;
+    /**
+     * @generated from field: bytes nonce = 3;
+     */
+    nonce: Uint8Array;
+    /**
+     * @generated from field: bytes aad = 4;
+     */
+    aad: Uint8Array;
+    /**
+     * Plaintext may contain secret or PII-bearing application data.
+     *
+     * @generated from field: bytes plaintext = 5;
+     */
+    plaintext: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoAeadSealRequest.
+ * Use `create(CryptoAeadSealRequestSchema)` to create a new message.
+ */
+export declare const CryptoAeadSealRequestSchema: GenMessage<CryptoAeadSealRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoAeadSealResult
+ */
+export type CryptoAeadSealResult = Message<"reallyme.crypto.v1.CryptoAeadSealResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes ciphertext_with_tag = 2;
+     */
+    ciphertextWithTag: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoAeadSealResult.
+ * Use `create(CryptoAeadSealResultSchema)` to create a new message.
+ */
+export declare const CryptoAeadSealResultSchema: GenMessage<CryptoAeadSealResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoAeadOpenRequest
+ */
+export type CryptoAeadOpenRequest = Message<"reallyme.crypto.v1.CryptoAeadOpenRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing AEAD key; callers must zeroize copies where platform
+     * semantics permit.
+     *
+     * @generated from field: bytes key = 2;
+     */
+    key: Uint8Array;
+    /**
+     * @generated from field: bytes nonce = 3;
+     */
+    nonce: Uint8Array;
+    /**
+     * @generated from field: bytes aad = 4;
+     */
+    aad: Uint8Array;
+    /**
+     * @generated from field: bytes ciphertext_with_tag = 5;
+     */
+    ciphertextWithTag: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoAeadOpenRequest.
+ * Use `create(CryptoAeadOpenRequestSchema)` to create a new message.
+ */
+export declare const CryptoAeadOpenRequestSchema: GenMessage<CryptoAeadOpenRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoAeadOpenResult
+ */
+export type CryptoAeadOpenResult = Message<"reallyme.crypto.v1.CryptoAeadOpenResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Decrypted plaintext may contain secret or PII-bearing application data.
+     *
+     * @generated from field: bytes plaintext = 2;
+     */
+    plaintext: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoAeadOpenResult.
+ * Use `create(CryptoAeadOpenResultSchema)` to create a new message.
+ */
+export declare const CryptoAeadOpenResultSchema: GenMessage<CryptoAeadOpenResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoMacAuthenticateRequest
+ */
+export type CryptoMacAuthenticateRequest = Message<"reallyme.crypto.v1.CryptoMacAuthenticateRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing MAC key.
+     *
+     * @generated from field: bytes key = 2;
+     */
+    key: Uint8Array;
+    /**
+     * @generated from field: bytes message = 3;
+     */
+    message: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoMacAuthenticateRequest.
+ * Use `create(CryptoMacAuthenticateRequestSchema)` to create a new message.
+ */
+export declare const CryptoMacAuthenticateRequestSchema: GenMessage<CryptoMacAuthenticateRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoMacAuthenticateResult
+ */
+export type CryptoMacAuthenticateResult = Message<"reallyme.crypto.v1.CryptoMacAuthenticateResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes tag = 2;
+     */
+    tag: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoMacAuthenticateResult.
+ * Use `create(CryptoMacAuthenticateResultSchema)` to create a new message.
+ */
+export declare const CryptoMacAuthenticateResultSchema: GenMessage<CryptoMacAuthenticateResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoMacVerifyRequest
+ */
+export type CryptoMacVerifyRequest = Message<"reallyme.crypto.v1.CryptoMacVerifyRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes tag = 2;
+     */
+    tag: Uint8Array;
+    /**
+     * Secret-bearing MAC key.
+     *
+     * @generated from field: bytes key = 3;
+     */
+    key: Uint8Array;
+    /**
+     * @generated from field: bytes message = 4;
+     */
+    message: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoMacVerifyRequest.
+ * Use `create(CryptoMacVerifyRequestSchema)` to create a new message.
+ */
+export declare const CryptoMacVerifyRequestSchema: GenMessage<CryptoMacVerifyRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKdfDeriveKeyRequest
+ */
+export type CryptoKdfDeriveKeyRequest = Message<"reallyme.crypto.v1.CryptoKdfDeriveKeyRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing password or input secret for the selected KDF.
+     *
+     * @generated from field: bytes password = 2;
+     */
+    password: Uint8Array;
+    /**
+     * Salt is commonly public but may be privacy-impacting in application
+     * contexts; treat it according to the protocol using this message.
+     *
+     * @generated from field: bytes salt = 3;
+     */
+    salt: Uint8Array;
+    /**
+     * @generated from field: uint32 iterations = 4;
+     */
+    iterations: number;
+    /**
+     * @generated from field: uint32 output_length = 5;
+     */
+    outputLength: number;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKdfDeriveKeyRequest.
+ * Use `create(CryptoKdfDeriveKeyRequestSchema)` to create a new message.
+ */
+export declare const CryptoKdfDeriveKeyRequestSchema: GenMessage<CryptoKdfDeriveKeyRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKdfDeriveKeyResult
+ */
+export type CryptoKdfDeriveKeyResult = Message<"reallyme.crypto.v1.CryptoKdfDeriveKeyResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing derived key material.
+     *
+     * @generated from field: bytes derived_key = 2;
+     */
+    derivedKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKdfDeriveKeyResult.
+ * Use `create(CryptoKdfDeriveKeyResultSchema)` to create a new message.
+ */
+export declare const CryptoKdfDeriveKeyResultSchema: GenMessage<CryptoKdfDeriveKeyResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoArgon2idDeriveRequest
+ */
+export type CryptoArgon2idDeriveRequest = Message<"reallyme.crypto.v1.CryptoArgon2idDeriveRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: reallyme.crypto.v1.Argon2idKdfVersion kdf_version = 2;
+     */
+    kdfVersion: Argon2idKdfVersion;
+    /**
+     * Secret-bearing password or input secret.
+     *
+     * @generated from field: bytes secret = 3;
+     */
+    secret: Uint8Array;
+    /**
+     * Salt is commonly public but may be privacy-impacting in application
+     * contexts; treat it according to the protocol using this message.
+     *
+     * @generated from field: bytes salt = 4;
+     */
+    salt: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoArgon2idDeriveRequest.
+ * Use `create(CryptoArgon2idDeriveRequestSchema)` to create a new message.
+ */
+export declare const CryptoArgon2idDeriveRequestSchema: GenMessage<CryptoArgon2idDeriveRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHkdfDeriveRequest
+ */
+export type CryptoHkdfDeriveRequest = Message<"reallyme.crypto.v1.CryptoHkdfDeriveRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing input key material.
+     *
+     * @generated from field: bytes input_key_material = 2;
+     */
+    inputKeyMaterial: Uint8Array;
+    /**
+     * Salt is commonly public but can be privacy-impacting in some protocols.
+     *
+     * @generated from field: bytes salt = 3;
+     */
+    salt: Uint8Array;
+    /**
+     * @generated from field: bytes info = 4;
+     */
+    info: Uint8Array;
+    /**
+     * @generated from field: uint32 output_length = 5;
+     */
+    outputLength: number;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHkdfDeriveRequest.
+ * Use `create(CryptoHkdfDeriveRequestSchema)` to create a new message.
+ */
+export declare const CryptoHkdfDeriveRequestSchema: GenMessage<CryptoHkdfDeriveRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHkdfDeriveResult
+ */
+export type CryptoHkdfDeriveResult = Message<"reallyme.crypto.v1.CryptoHkdfDeriveResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing HKDF output key material.
+     *
+     * @generated from field: bytes output_key_material = 2;
+     */
+    outputKeyMaterial: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHkdfDeriveResult.
+ * Use `create(CryptoHkdfDeriveResultSchema)` to create a new message.
+ */
+export declare const CryptoHkdfDeriveResultSchema: GenMessage<CryptoHkdfDeriveResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoJwaConcatKdfSha256DeriveRequest
+ */
+export type CryptoJwaConcatKdfSha256DeriveRequest = Message<"reallyme.crypto.v1.CryptoJwaConcatKdfSha256DeriveRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing shared secret input.
+     *
+     * @generated from field: bytes shared_secret = 2;
+     */
+    sharedSecret: Uint8Array;
+    /**
+     * @generated from field: bytes algorithm_id = 3;
+     */
+    algorithmId: Uint8Array;
+    /**
+     * @generated from field: bytes party_u_info = 4;
+     */
+    partyUInfo: Uint8Array;
+    /**
+     * @generated from field: bytes party_v_info = 5;
+     */
+    partyVInfo: Uint8Array;
+    /**
+     * @generated from field: uint32 output_length = 6;
+     */
+    outputLength: number;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoJwaConcatKdfSha256DeriveRequest.
+ * Use `create(CryptoJwaConcatKdfSha256DeriveRequestSchema)` to create a new message.
+ */
+export declare const CryptoJwaConcatKdfSha256DeriveRequestSchema: GenMessage<CryptoJwaConcatKdfSha256DeriveRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoJwaConcatKdfSha256DeriveResult
+ */
+export type CryptoJwaConcatKdfSha256DeriveResult = Message<"reallyme.crypto.v1.CryptoJwaConcatKdfSha256DeriveResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing derived key material.
+     *
+     * @generated from field: bytes derived_key = 2;
+     */
+    derivedKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoJwaConcatKdfSha256DeriveResult.
+ * Use `create(CryptoJwaConcatKdfSha256DeriveResultSchema)` to create a new message.
+ */
+export declare const CryptoJwaConcatKdfSha256DeriveResultSchema: GenMessage<CryptoJwaConcatKdfSha256DeriveResult>;
+/**
+ * CryptoKmac256DeriveRequest exposes NIST SP 800-185 KMAC256 for protocol
+ * constructions that define the exact context and customization strings.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoKmac256DeriveRequest
+ */
+export type CryptoKmac256DeriveRequest = Message<"reallyme.crypto.v1.CryptoKmac256DeriveRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing KMAC key. KMAC256 requires at least 32 octets.
+     *
+     * @generated from field: bytes key = 2;
+     */
+    key: Uint8Array;
+    /**
+     * Potentially privacy-bearing protocol context; clear decoded owned copies.
+     *
+     * @generated from field: bytes context = 3;
+     */
+    context: Uint8Array;
+    /**
+     * Potentially privacy-bearing domain separation; clear decoded owned copies.
+     *
+     * @generated from field: bytes customization = 4;
+     */
+    customization: Uint8Array;
+    /**
+     * @generated from field: uint32 output_length = 5;
+     */
+    outputLength: number;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKmac256DeriveRequest.
+ * Use `create(CryptoKmac256DeriveRequestSchema)` to create a new message.
+ */
+export declare const CryptoKmac256DeriveRequestSchema: GenMessage<CryptoKmac256DeriveRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKmac256DeriveResult
+ */
+export type CryptoKmac256DeriveResult = Message<"reallyme.crypto.v1.CryptoKmac256DeriveResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing derived key material.
+     *
+     * @generated from field: bytes derived_key = 2;
+     */
+    derivedKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKmac256DeriveResult.
+ * Use `create(CryptoKmac256DeriveResultSchema)` to create a new message.
+ */
+export declare const CryptoKmac256DeriveResultSchema: GenMessage<CryptoKmac256DeriveResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKeyWrapRequest
+ */
+export type CryptoKeyWrapRequest = Message<"reallyme.crypto.v1.CryptoKeyWrapRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing key-encryption key.
+     *
+     * @generated from field: bytes wrapping_key = 2;
+     */
+    wrappingKey: Uint8Array;
+    /**
+     * Secret-bearing key material to wrap.
+     *
+     * @generated from field: bytes key_to_wrap = 3;
+     */
+    keyToWrap: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKeyWrapRequest.
+ * Use `create(CryptoKeyWrapRequestSchema)` to create a new message.
+ */
+export declare const CryptoKeyWrapRequestSchema: GenMessage<CryptoKeyWrapRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKeyWrapResult
+ */
+export type CryptoKeyWrapResult = Message<"reallyme.crypto.v1.CryptoKeyWrapResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes wrapped_key = 2;
+     */
+    wrappedKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKeyWrapResult.
+ * Use `create(CryptoKeyWrapResultSchema)` to create a new message.
+ */
+export declare const CryptoKeyWrapResultSchema: GenMessage<CryptoKeyWrapResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKeyUnwrapRequest
+ */
+export type CryptoKeyUnwrapRequest = Message<"reallyme.crypto.v1.CryptoKeyUnwrapRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing key-encryption key.
+     *
+     * @generated from field: bytes wrapping_key = 2;
+     */
+    wrappingKey: Uint8Array;
+    /**
+     * @generated from field: bytes wrapped_key = 3;
+     */
+    wrappedKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKeyUnwrapRequest.
+ * Use `create(CryptoKeyUnwrapRequestSchema)` to create a new message.
+ */
+export declare const CryptoKeyUnwrapRequestSchema: GenMessage<CryptoKeyUnwrapRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKeyUnwrapResult
+ */
+export type CryptoKeyUnwrapResult = Message<"reallyme.crypto.v1.CryptoKeyUnwrapResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing unwrapped key material.
+     *
+     * @generated from field: bytes key = 2;
+     */
+    key: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKeyUnwrapResult.
+ * Use `create(CryptoKeyUnwrapResultSchema)` to create a new message.
+ */
+export declare const CryptoKeyUnwrapResultSchema: GenMessage<CryptoKeyUnwrapResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoSignatureGenerateKeyPairRequest
+ */
+export type CryptoSignatureGenerateKeyPairRequest = Message<"reallyme.crypto.v1.CryptoSignatureGenerateKeyPairRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoSignatureGenerateKeyPairRequest.
+ * Use `create(CryptoSignatureGenerateKeyPairRequestSchema)` to create a new message.
+ */
+export declare const CryptoSignatureGenerateKeyPairRequestSchema: GenMessage<CryptoSignatureGenerateKeyPairRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoSignatureDeriveKeyPairRequest
+ */
+export type CryptoSignatureDeriveKeyPairRequest = Message<"reallyme.crypto.v1.CryptoSignatureDeriveKeyPairRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing seed or private key input, depending on the algorithm.
+     *
+     * @generated from field: bytes secret_key = 2;
+     */
+    secretKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoSignatureDeriveKeyPairRequest.
+ * Use `create(CryptoSignatureDeriveKeyPairRequestSchema)` to create a new message.
+ */
+export declare const CryptoSignatureDeriveKeyPairRequestSchema: GenMessage<CryptoSignatureDeriveKeyPairRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoSignatureSignRequest
+ */
+export type CryptoSignatureSignRequest = Message<"reallyme.crypto.v1.CryptoSignatureSignRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes message = 2;
+     */
+    message: Uint8Array;
+    /**
+     * Secret-bearing signing key material.
+     *
+     * @generated from field: bytes secret_key = 3;
+     */
+    secretKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoSignatureSignRequest.
+ * Use `create(CryptoSignatureSignRequestSchema)` to create a new message.
+ */
+export declare const CryptoSignatureSignRequestSchema: GenMessage<CryptoSignatureSignRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoSignatureSignResult
+ */
+export type CryptoSignatureSignResult = Message<"reallyme.crypto.v1.CryptoSignatureSignResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes signature = 2;
+     */
+    signature: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoSignatureSignResult.
+ * Use `create(CryptoSignatureSignResultSchema)` to create a new message.
+ */
+export declare const CryptoSignatureSignResultSchema: GenMessage<CryptoSignatureSignResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoBip340SchnorrSignRequest
+ */
+export type CryptoBip340SchnorrSignRequest = Message<"reallyme.crypto.v1.CryptoBip340SchnorrSignRequest"> & {
+    /**
+     * @generated from field: bytes message32 = 1;
+     */
+    message32: Uint8Array;
+    /**
+     * Secret-bearing secp256k1 signing key material.
+     *
+     * @generated from field: bytes secret_key = 2;
+     */
+    secretKey: Uint8Array;
+    /**
+     * Secret-bearing auxiliary randomness used for deterministic nonce hardening.
+     *
+     * @generated from field: bytes aux_rand32 = 3;
+     */
+    auxRand32: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoBip340SchnorrSignRequest.
+ * Use `create(CryptoBip340SchnorrSignRequestSchema)` to create a new message.
+ */
+export declare const CryptoBip340SchnorrSignRequestSchema: GenMessage<CryptoBip340SchnorrSignRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoSignatureVerifyRequest
+ */
+export type CryptoSignatureVerifyRequest = Message<"reallyme.crypto.v1.CryptoSignatureVerifyRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes signature = 2;
+     */
+    signature: Uint8Array;
+    /**
+     * @generated from field: bytes message = 3;
+     */
+    message: Uint8Array;
+    /**
+     * @generated from field: bytes public_key = 4;
+     */
+    publicKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoSignatureVerifyRequest.
+ * Use `create(CryptoSignatureVerifyRequestSchema)` to create a new message.
+ */
+export declare const CryptoSignatureVerifyRequestSchema: GenMessage<CryptoSignatureVerifyRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoRsaVerifyRequest
+ */
+export type CryptoRsaVerifyRequest = Message<"reallyme.crypto.v1.CryptoRsaVerifyRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes signature = 2;
+     */
+    signature: Uint8Array;
+    /**
+     * @generated from field: bytes message = 3;
+     */
+    message: Uint8Array;
+    /**
+     * @generated from field: bytes public_key_der = 4;
+     */
+    publicKeyDer: Uint8Array;
+    /**
+     * @generated from field: reallyme.crypto.v1.RsaPublicKeyDerEncoding public_key_encoding = 5;
+     */
+    publicKeyEncoding: RsaPublicKeyDerEncoding;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoRsaVerifyRequest.
+ * Use `create(CryptoRsaVerifyRequestSchema)` to create a new message.
+ */
+export declare const CryptoRsaVerifyRequestSchema: GenMessage<CryptoRsaVerifyRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKeyAgreementDeriveSharedSecretRequest
+ */
+export type CryptoKeyAgreementDeriveSharedSecretRequest = Message<"reallyme.crypto.v1.CryptoKeyAgreementDeriveSharedSecretRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes public_key = 2;
+     */
+    publicKey: Uint8Array;
+    /**
+     * Secret-bearing private key material.
+     *
+     * @generated from field: bytes secret_key = 3;
+     */
+    secretKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKeyAgreementDeriveSharedSecretRequest.
+ * Use `create(CryptoKeyAgreementDeriveSharedSecretRequestSchema)` to create a new message.
+ */
+export declare const CryptoKeyAgreementDeriveSharedSecretRequestSchema: GenMessage<CryptoKeyAgreementDeriveSharedSecretRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKeyAgreementDeriveSharedSecretResult
+ */
+export type CryptoKeyAgreementDeriveSharedSecretResult = Message<"reallyme.crypto.v1.CryptoKeyAgreementDeriveSharedSecretResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing shared secret; callers must feed it into a protocol KDF.
+     *
+     * @generated from field: bytes shared_secret = 2;
+     */
+    sharedSecret: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKeyAgreementDeriveSharedSecretResult.
+ * Use `create(CryptoKeyAgreementDeriveSharedSecretResultSchema)` to create a new message.
+ */
+export declare const CryptoKeyAgreementDeriveSharedSecretResultSchema: GenMessage<CryptoKeyAgreementDeriveSharedSecretResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKeyAgreementDeriveKeyPairRequest
+ */
+export type CryptoKeyAgreementDeriveKeyPairRequest = Message<"reallyme.crypto.v1.CryptoKeyAgreementDeriveKeyPairRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing seed or private key input, depending on the algorithm.
+     *
+     * @generated from field: bytes secret_key = 2;
+     */
+    secretKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKeyAgreementDeriveKeyPairRequest.
+ * Use `create(CryptoKeyAgreementDeriveKeyPairRequestSchema)` to create a new message.
+ */
+export declare const CryptoKeyAgreementDeriveKeyPairRequestSchema: GenMessage<CryptoKeyAgreementDeriveKeyPairRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKemGenerateKeyPairRequest
+ */
+export type CryptoKemGenerateKeyPairRequest = Message<"reallyme.crypto.v1.CryptoKemGenerateKeyPairRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKemGenerateKeyPairRequest.
+ * Use `create(CryptoKemGenerateKeyPairRequestSchema)` to create a new message.
+ */
+export declare const CryptoKemGenerateKeyPairRequestSchema: GenMessage<CryptoKemGenerateKeyPairRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKemDeriveKeyPairRequest
+ */
+export type CryptoKemDeriveKeyPairRequest = Message<"reallyme.crypto.v1.CryptoKemDeriveKeyPairRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing seed or private key input, depending on the algorithm.
+     *
+     * @generated from field: bytes secret_key = 2;
+     */
+    secretKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKemDeriveKeyPairRequest.
+ * Use `create(CryptoKemDeriveKeyPairRequestSchema)` to create a new message.
+ */
+export declare const CryptoKemDeriveKeyPairRequestSchema: GenMessage<CryptoKemDeriveKeyPairRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKemEncapsulateRequest
+ */
+export type CryptoKemEncapsulateRequest = Message<"reallyme.crypto.v1.CryptoKemEncapsulateRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes public_key = 2;
+     */
+    publicKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKemEncapsulateRequest.
+ * Use `create(CryptoKemEncapsulateRequestSchema)` to create a new message.
+ */
+export declare const CryptoKemEncapsulateRequestSchema: GenMessage<CryptoKemEncapsulateRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKemDecapsulateRequest
+ */
+export type CryptoKemDecapsulateRequest = Message<"reallyme.crypto.v1.CryptoKemDecapsulateRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes ciphertext = 2;
+     */
+    ciphertext: Uint8Array;
+    /**
+     * Secret-bearing KEM private key material.
+     *
+     * @generated from field: bytes secret_key = 3;
+     */
+    secretKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKemDecapsulateRequest.
+ * Use `create(CryptoKemDecapsulateRequestSchema)` to create a new message.
+ */
+export declare const CryptoKemDecapsulateRequestSchema: GenMessage<CryptoKemDecapsulateRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoKemDecapsulateResult
+ */
+export type CryptoKemDecapsulateResult = Message<"reallyme.crypto.v1.CryptoKemDecapsulateResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing KEM shared secret.
+     *
+     * @generated from field: bytes shared_secret = 2;
+     */
+    sharedSecret: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKemDecapsulateResult.
+ * Use `create(CryptoKemDecapsulateResultSchema)` to create a new message.
+ */
+export declare const CryptoKemDecapsulateResultSchema: GenMessage<CryptoKemDecapsulateResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHpkeSealRequest
+ */
+export type CryptoHpkeSealRequest = Message<"reallyme.crypto.v1.CryptoHpkeSealRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes recipient_public_key = 2;
+     */
+    recipientPublicKey: Uint8Array;
+    /**
+     * @generated from field: bytes info = 3;
+     */
+    info: Uint8Array;
+    /**
+     * @generated from field: bytes aad = 4;
+     */
+    aad: Uint8Array;
+    /**
+     * Plaintext may contain secret or PII-bearing application data.
+     *
+     * @generated from field: bytes plaintext = 5;
+     */
+    plaintext: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHpkeSealRequest.
+ * Use `create(CryptoHpkeSealRequestSchema)` to create a new message.
+ */
+export declare const CryptoHpkeSealRequestSchema: GenMessage<CryptoHpkeSealRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHpkeOpenRequest
+ */
+export type CryptoHpkeOpenRequest = Message<"reallyme.crypto.v1.CryptoHpkeOpenRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing HPKE recipient private key material.
+     *
+     * @generated from field: bytes recipient_secret_key = 2;
+     */
+    recipientSecretKey: Uint8Array;
+    /**
+     * @generated from field: bytes encapsulated_key = 3;
+     */
+    encapsulatedKey: Uint8Array;
+    /**
+     * @generated from field: bytes info = 4;
+     */
+    info: Uint8Array;
+    /**
+     * @generated from field: bytes aad = 5;
+     */
+    aad: Uint8Array;
+    /**
+     * @generated from field: bytes ciphertext = 6;
+     */
+    ciphertext: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHpkeOpenRequest.
+ * Use `create(CryptoHpkeOpenRequestSchema)` to create a new message.
+ */
+export declare const CryptoHpkeOpenRequestSchema: GenMessage<CryptoHpkeOpenRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHpkeOpenResult
+ */
+export type CryptoHpkeOpenResult = Message<"reallyme.crypto.v1.CryptoHpkeOpenResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Decrypted plaintext may contain secret or PII-bearing application data.
+     *
+     * @generated from field: bytes plaintext = 2;
+     */
+    plaintext: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHpkeOpenResult.
+ * Use `create(CryptoHpkeOpenResultSchema)` to create a new message.
+ */
+export declare const CryptoHpkeOpenResultSchema: GenMessage<CryptoHpkeOpenResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHpkeGenerateKeyPairRequest
+ */
+export type CryptoHpkeGenerateKeyPairRequest = Message<"reallyme.crypto.v1.CryptoHpkeGenerateKeyPairRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHpkeGenerateKeyPairRequest.
+ * Use `create(CryptoHpkeGenerateKeyPairRequestSchema)` to create a new message.
+ */
+export declare const CryptoHpkeGenerateKeyPairRequestSchema: GenMessage<CryptoHpkeGenerateKeyPairRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHpkeDeriveKeyPairRequest
+ */
+export type CryptoHpkeDeriveKeyPairRequest = Message<"reallyme.crypto.v1.CryptoHpkeDeriveKeyPairRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing input keying material. The selected KEM defines its exact
+     * accepted length; callers must supply high-entropy bytes.
+     *
+     * @generated from field: bytes input_key_material = 2;
+     */
+    inputKeyMaterial: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHpkeDeriveKeyPairRequest.
+ * Use `create(CryptoHpkeDeriveKeyPairRequestSchema)` to create a new message.
+ */
+export declare const CryptoHpkeDeriveKeyPairRequestSchema: GenMessage<CryptoHpkeDeriveKeyPairRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHpkeSenderExportRequest
+ */
+export type CryptoHpkeSenderExportRequest = Message<"reallyme.crypto.v1.CryptoHpkeSenderExportRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes recipient_public_key = 2;
+     */
+    recipientPublicKey: Uint8Array;
+    /**
+     * @generated from field: bytes info = 3;
+     */
+    info: Uint8Array;
+    /**
+     * @generated from field: bytes exporter_context = 4;
+     */
+    exporterContext: Uint8Array;
+    /**
+     * @generated from field: uint32 output_length = 5;
+     */
+    outputLength: number;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHpkeSenderExportRequest.
+ * Use `create(CryptoHpkeSenderExportRequestSchema)` to create a new message.
+ */
+export declare const CryptoHpkeSenderExportRequestSchema: GenMessage<CryptoHpkeSenderExportRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHpkeReceiverExportRequest
+ */
+export type CryptoHpkeReceiverExportRequest = Message<"reallyme.crypto.v1.CryptoHpkeReceiverExportRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing HPKE recipient private key material.
+     *
+     * @generated from field: bytes recipient_secret_key = 2;
+     */
+    recipientSecretKey: Uint8Array;
+    /**
+     * @generated from field: bytes encapsulated_key = 3;
+     */
+    encapsulatedKey: Uint8Array;
+    /**
+     * @generated from field: bytes info = 4;
+     */
+    info: Uint8Array;
+    /**
+     * @generated from field: bytes exporter_context = 5;
+     */
+    exporterContext: Uint8Array;
+    /**
+     * @generated from field: uint32 output_length = 6;
+     */
+    outputLength: number;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHpkeReceiverExportRequest.
+ * Use `create(CryptoHpkeReceiverExportRequestSchema)` to create a new message.
+ */
+export declare const CryptoHpkeReceiverExportRequestSchema: GenMessage<CryptoHpkeReceiverExportRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHpkeSenderExportResult
+ */
+export type CryptoHpkeSenderExportResult = Message<"reallyme.crypto.v1.CryptoHpkeSenderExportResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes encapsulated_key = 2;
+     */
+    encapsulatedKey: Uint8Array;
+    /**
+     * Secret-bearing HPKE exporter output.
+     *
+     * @generated from field: bytes exporter_secret = 3;
+     */
+    exporterSecret: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHpkeSenderExportResult.
+ * Use `create(CryptoHpkeSenderExportResultSchema)` to create a new message.
+ */
+export declare const CryptoHpkeSenderExportResultSchema: GenMessage<CryptoHpkeSenderExportResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHpkeReceiverExportResult
+ */
+export type CryptoHpkeReceiverExportResult = Message<"reallyme.crypto.v1.CryptoHpkeReceiverExportResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing HPKE exporter output.
+     *
+     * @generated from field: bytes exporter_secret = 2;
+     */
+    exporterSecret: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHpkeReceiverExportResult.
+ * Use `create(CryptoHpkeReceiverExportResultSchema)` to create a new message.
+ */
+export declare const CryptoHpkeReceiverExportResultSchema: GenMessage<CryptoHpkeReceiverExportResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHpkePskSealRequest
+ */
+export type CryptoHpkePskSealRequest = Message<"reallyme.crypto.v1.CryptoHpkePskSealRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes recipient_public_key = 2;
+     */
+    recipientPublicKey: Uint8Array;
+    /**
+     * @generated from field: bytes info = 3;
+     */
+    info: Uint8Array;
+    /**
+     * @generated from field: bytes aad = 4;
+     */
+    aad: Uint8Array;
+    /**
+     * Plaintext may contain secret or PII-bearing application data.
+     *
+     * @generated from field: bytes plaintext = 5;
+     */
+    plaintext: Uint8Array;
+    /**
+     * Secret-bearing, high-entropy pre-shared key. Passwords are not valid HPKE
+     * PSKs and must not be passed through this field.
+     *
+     * @generated from field: bytes psk = 6;
+     */
+    psk: Uint8Array;
+    /**
+     * @generated from field: bytes psk_id = 7;
+     */
+    pskId: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHpkePskSealRequest.
+ * Use `create(CryptoHpkePskSealRequestSchema)` to create a new message.
+ */
+export declare const CryptoHpkePskSealRequestSchema: GenMessage<CryptoHpkePskSealRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoHpkePskOpenRequest
+ */
+export type CryptoHpkePskOpenRequest = Message<"reallyme.crypto.v1.CryptoHpkePskOpenRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * Secret-bearing HPKE recipient private key material.
+     *
+     * @generated from field: bytes recipient_secret_key = 2;
+     */
+    recipientSecretKey: Uint8Array;
+    /**
+     * @generated from field: bytes encapsulated_key = 3;
+     */
+    encapsulatedKey: Uint8Array;
+    /**
+     * @generated from field: bytes info = 4;
+     */
+    info: Uint8Array;
+    /**
+     * @generated from field: bytes aad = 5;
+     */
+    aad: Uint8Array;
+    /**
+     * @generated from field: bytes ciphertext = 6;
+     */
+    ciphertext: Uint8Array;
+    /**
+     * Secret-bearing, high-entropy pre-shared key. Passwords are not valid HPKE
+     * PSKs and must not be passed through this field.
+     *
+     * @generated from field: bytes psk = 7;
+     */
+    psk: Uint8Array;
+    /**
+     * @generated from field: bytes psk_id = 8;
+     */
+    pskId: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHpkePskOpenRequest.
+ * Use `create(CryptoHpkePskOpenRequestSchema)` to create a new message.
+ */
+export declare const CryptoHpkePskOpenRequestSchema: GenMessage<CryptoHpkePskOpenRequest>;
+/**
+ * CryptoKeyPair is the protobuf boundary envelope for generated or derived
+ * keypairs. Secret-key bytes are included only for APIs whose public facade
+ * already returns exportable secret-key material; non-exportable platform keys
+ * must use a separate handle-specific protocol.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoKeyPair
+ */
+export type CryptoKeyPair = Message<"reallyme.crypto.v1.CryptoKeyPair"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes public_key = 2;
+     */
+    publicKey: Uint8Array;
+    /**
+     * Secret-bearing exportable private key material.
+     *
+     * @generated from field: bytes secret_key = 3;
+     */
+    secretKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKeyPair.
+ * Use `create(CryptoKeyPairSchema)` to create a new message.
+ */
+export declare const CryptoKeyPairSchema: GenMessage<CryptoKeyPair>;
+/**
+ * CryptoKemEncapsulation is the protobuf boundary envelope for KEM
+ * encapsulation results. `shared_secret` is secret-bearing material; callers
+ * must keep it in binary/protobuf channels and zeroize it when possible.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoKemEncapsulation
+ */
+export type CryptoKemEncapsulation = Message<"reallyme.crypto.v1.CryptoKemEncapsulation"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes ciphertext = 2;
+     */
+    ciphertext: Uint8Array;
+    /**
+     * Secret-bearing KEM shared secret.
+     *
+     * @generated from field: bytes shared_secret = 3;
+     */
+    sharedSecret: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoKemEncapsulation.
+ * Use `create(CryptoKemEncapsulationSchema)` to create a new message.
+ */
+export declare const CryptoKemEncapsulationSchema: GenMessage<CryptoKemEncapsulation>;
+/**
+ * CryptoHpkeSealedMessage is the protobuf boundary envelope for HPKE Base-mode
+ * sender output.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoHpkeSealedMessage
+ */
+export type CryptoHpkeSealedMessage = Message<"reallyme.crypto.v1.CryptoHpkeSealedMessage"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes encapsulated_key = 2;
+     */
+    encapsulatedKey: Uint8Array;
+    /**
+     * @generated from field: bytes ciphertext = 3;
+     */
+    ciphertext: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoHpkeSealedMessage.
+ * Use `create(CryptoHpkeSealedMessageSchema)` to create a new message.
+ */
+export declare const CryptoHpkeSealedMessageSchema: GenMessage<CryptoHpkeSealedMessage>;
+/**
+ * @generated from message reallyme.crypto.v1.ApplePlatformKeyPolicy
+ */
+export type ApplePlatformKeyPolicy = Message<"reallyme.crypto.v1.ApplePlatformKeyPolicy"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.AppleSecureEnclaveAccessPolicy access_policy = 1;
+     */
+    accessPolicy: AppleSecureEnclaveAccessPolicy;
+    /**
+     * @generated from field: reallyme.crypto.v1.AppleKeychainAccessibility accessibility = 2;
+     */
+    accessibility: AppleKeychainAccessibility;
+};
+/**
+ * Describes the message reallyme.crypto.v1.ApplePlatformKeyPolicy.
+ * Use `create(ApplePlatformKeyPolicySchema)` to create a new message.
+ */
+export declare const ApplePlatformKeyPolicySchema: GenMessage<ApplePlatformKeyPolicy>;
+/**
+ * @generated from message reallyme.crypto.v1.AndroidPlatformKeyPolicy
+ */
+export type AndroidPlatformKeyPolicy = Message<"reallyme.crypto.v1.AndroidPlatformKeyPolicy"> & {
+    /**
+     * When present, this value must match
+     * CryptoPlatformKeyGenerateRequest.requested_security_level.
+     *
+     * @generated from field: reallyme.crypto.v1.PlatformKeySecurityLevel requested_security_level = 1;
+     */
+    requestedSecurityLevel: PlatformKeySecurityLevel;
+    /**
+     * @generated from field: bool user_authentication_required = 2;
+     */
+    userAuthenticationRequired: boolean;
+    /**
+     * @generated from field: uint32 user_authentication_timeout_seconds = 3;
+     */
+    userAuthenticationTimeoutSeconds: number;
+    /**
+     * @generated from field: bool allow_biometric_strong = 4;
+     */
+    allowBiometricStrong: boolean;
+    /**
+     * @generated from field: bool allow_device_credential = 5;
+     */
+    allowDeviceCredential: boolean;
+    /**
+     * @generated from field: bool invalidated_by_biometric_enrollment = 6;
+     */
+    invalidatedByBiometricEnrollment: boolean;
+    /**
+     * @generated from field: bool user_confirmation_required = 7;
+     */
+    userConfirmationRequired: boolean;
+    /**
+     * @generated from field: bool unlocked_device_required = 8;
+     */
+    unlockedDeviceRequired: boolean;
+    /**
+     * @generated from field: bytes attestation_challenge = 9;
+     */
+    attestationChallenge: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.AndroidPlatformKeyPolicy.
+ * Use `create(AndroidPlatformKeyPolicySchema)` to create a new message.
+ */
+export declare const AndroidPlatformKeyPolicySchema: GenMessage<AndroidPlatformKeyPolicy>;
+/**
+ * @generated from message reallyme.crypto.v1.PlatformKeyPolicy
+ */
+export type PlatformKeyPolicy = Message<"reallyme.crypto.v1.PlatformKeyPolicy"> & {
+    /**
+     * @generated from oneof reallyme.crypto.v1.PlatformKeyPolicy.policy
+     */
+    policy: {
+        /**
+         * @generated from field: reallyme.crypto.v1.ApplePlatformKeyPolicy apple = 1;
+         */
+        value: ApplePlatformKeyPolicy;
+        case: "apple";
+    } | {
+        /**
+         * @generated from field: reallyme.crypto.v1.AndroidPlatformKeyPolicy android = 2;
+         */
+        value: AndroidPlatformKeyPolicy;
+        case: "android";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message reallyme.crypto.v1.PlatformKeyPolicy.
+ * Use `create(PlatformKeyPolicySchema)` to create a new message.
+ */
+export declare const PlatformKeyPolicySchema: GenMessage<PlatformKeyPolicy>;
+/**
+ * CryptoPlatformPrivateKeyHandle is an opaque, privacy-sensitive reference to
+ * platform-resident private key material. It is not interchangeable with
+ * raw-byte `secret_key` fields and must never contain exportable private key
+ * material.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoPlatformPrivateKeyHandle
+ */
+export type CryptoPlatformPrivateKeyHandle = Message<"reallyme.crypto.v1.CryptoPlatformPrivateKeyHandle"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.PlatformKeyProvider provider = 1;
+     */
+    provider: PlatformKeyProvider;
+    /**
+     * @generated from field: reallyme.crypto.v1.PlatformKeyPurpose purpose = 2;
+     */
+    purpose: PlatformKeyPurpose;
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 3;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes opaque_handle = 4;
+     */
+    opaqueHandle: Uint8Array;
+    /**
+     * @generated from field: bytes public_key = 5;
+     */
+    publicKey: Uint8Array;
+    /**
+     * @generated from field: reallyme.crypto.v1.PlatformKeySecurityLevel actual_security_level = 6;
+     */
+    actualSecurityLevel: PlatformKeySecurityLevel;
+    /**
+     * @generated from field: reallyme.crypto.v1.PlatformKeySecurityLevel requested_security_level = 7;
+     */
+    requestedSecurityLevel: PlatformKeySecurityLevel;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoPlatformPrivateKeyHandle.
+ * Use `create(CryptoPlatformPrivateKeyHandleSchema)` to create a new message.
+ */
+export declare const CryptoPlatformPrivateKeyHandleSchema: GenMessage<CryptoPlatformPrivateKeyHandle>;
+/**
+ * Platform-key operations in 0.3.0 are limited to P-256 ECDSA signing and
+ * P-256 ECDH. Providers must reject an algorithm/purpose mismatch and must
+ * report the actual security level rather than treating this request as
+ * evidence that hardware residency was obtained.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoPlatformKeyGenerateRequest
+ */
+export type CryptoPlatformKeyGenerateRequest = Message<"reallyme.crypto.v1.CryptoPlatformKeyGenerateRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.PlatformKeyProvider provider = 1;
+     */
+    provider: PlatformKeyProvider;
+    /**
+     * @generated from field: reallyme.crypto.v1.PlatformKeyPurpose purpose = 2;
+     */
+    purpose: PlatformKeyPurpose;
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 3;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes application_tag = 4;
+     */
+    applicationTag: Uint8Array;
+    /**
+     * @generated from field: reallyme.crypto.v1.PlatformKeyPolicy policy = 5;
+     */
+    policy?: PlatformKeyPolicy | undefined;
+    /**
+     * @generated from field: bool overwrite_existing = 6;
+     */
+    overwriteExisting: boolean;
+    /**
+     * @generated from field: reallyme.crypto.v1.PlatformKeySecurityLevel requested_security_level = 7;
+     */
+    requestedSecurityLevel: PlatformKeySecurityLevel;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoPlatformKeyGenerateRequest.
+ * Use `create(CryptoPlatformKeyGenerateRequestSchema)` to create a new message.
+ */
+export declare const CryptoPlatformKeyGenerateRequestSchema: GenMessage<CryptoPlatformKeyGenerateRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoPlatformKeyGenerateResult
+ */
+export type CryptoPlatformKeyGenerateResult = Message<"reallyme.crypto.v1.CryptoPlatformKeyGenerateResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoPlatformPrivateKeyHandle private_key_handle = 1;
+     */
+    privateKeyHandle?: CryptoPlatformPrivateKeyHandle | undefined;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoPlatformKeyGenerateResult.
+ * Use `create(CryptoPlatformKeyGenerateResultSchema)` to create a new message.
+ */
+export declare const CryptoPlatformKeyGenerateResultSchema: GenMessage<CryptoPlatformKeyGenerateResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoPlatformKeyGetPublicKeyRequest
+ */
+export type CryptoPlatformKeyGetPublicKeyRequest = Message<"reallyme.crypto.v1.CryptoPlatformKeyGetPublicKeyRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoPlatformPrivateKeyHandle private_key_handle = 1;
+     */
+    privateKeyHandle?: CryptoPlatformPrivateKeyHandle | undefined;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoPlatformKeyGetPublicKeyRequest.
+ * Use `create(CryptoPlatformKeyGetPublicKeyRequestSchema)` to create a new message.
+ */
+export declare const CryptoPlatformKeyGetPublicKeyRequestSchema: GenMessage<CryptoPlatformKeyGetPublicKeyRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoPlatformKeyGetPublicKeyResult
+ */
+export type CryptoPlatformKeyGetPublicKeyResult = Message<"reallyme.crypto.v1.CryptoPlatformKeyGetPublicKeyResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoPlatformPrivateKeyHandle private_key_handle = 1;
+     */
+    privateKeyHandle?: CryptoPlatformPrivateKeyHandle | undefined;
+    /**
+     * @generated from field: bytes public_key = 2;
+     */
+    publicKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoPlatformKeyGetPublicKeyResult.
+ * Use `create(CryptoPlatformKeyGetPublicKeyResultSchema)` to create a new message.
+ */
+export declare const CryptoPlatformKeyGetPublicKeyResultSchema: GenMessage<CryptoPlatformKeyGetPublicKeyResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoPlatformSignatureSignRequest
+ */
+export type CryptoPlatformSignatureSignRequest = Message<"reallyme.crypto.v1.CryptoPlatformSignatureSignRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoPlatformPrivateKeyHandle private_key_handle = 1;
+     */
+    privateKeyHandle?: CryptoPlatformPrivateKeyHandle | undefined;
+    /**
+     * @generated from field: bytes message = 2;
+     */
+    message: Uint8Array;
+    /**
+     * @generated from field: string authentication_prompt = 3;
+     */
+    authenticationPrompt: string;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoPlatformSignatureSignRequest.
+ * Use `create(CryptoPlatformSignatureSignRequestSchema)` to create a new message.
+ */
+export declare const CryptoPlatformSignatureSignRequestSchema: GenMessage<CryptoPlatformSignatureSignRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoPlatformSignatureSignResult
+ */
+export type CryptoPlatformSignatureSignResult = Message<"reallyme.crypto.v1.CryptoPlatformSignatureSignResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes signature = 2;
+     */
+    signature: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoPlatformSignatureSignResult.
+ * Use `create(CryptoPlatformSignatureSignResultSchema)` to create a new message.
+ */
+export declare const CryptoPlatformSignatureSignResultSchema: GenMessage<CryptoPlatformSignatureSignResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoPlatformSignatureVerifyRequest
+ */
+export type CryptoPlatformSignatureVerifyRequest = Message<"reallyme.crypto.v1.CryptoPlatformSignatureVerifyRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes signature = 2;
+     */
+    signature: Uint8Array;
+    /**
+     * @generated from field: bytes message = 3;
+     */
+    message: Uint8Array;
+    /**
+     * @generated from field: bytes public_key = 4;
+     */
+    publicKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoPlatformSignatureVerifyRequest.
+ * Use `create(CryptoPlatformSignatureVerifyRequestSchema)` to create a new message.
+ */
+export declare const CryptoPlatformSignatureVerifyRequestSchema: GenMessage<CryptoPlatformSignatureVerifyRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoPlatformKeyAgreementDeriveSharedSecretRequest
+ */
+export type CryptoPlatformKeyAgreementDeriveSharedSecretRequest = Message<"reallyme.crypto.v1.CryptoPlatformKeyAgreementDeriveSharedSecretRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoPlatformPrivateKeyHandle private_key_handle = 1;
+     */
+    privateKeyHandle?: CryptoPlatformPrivateKeyHandle | undefined;
+    /**
+     * @generated from field: bytes peer_public_key = 2;
+     */
+    peerPublicKey: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoPlatformKeyAgreementDeriveSharedSecretRequest.
+ * Use `create(CryptoPlatformKeyAgreementDeriveSharedSecretRequestSchema)` to create a new message.
+ */
+export declare const CryptoPlatformKeyAgreementDeriveSharedSecretRequestSchema: GenMessage<CryptoPlatformKeyAgreementDeriveSharedSecretRequest>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoPlatformKeyAgreementDeriveSharedSecretResult
+ */
+export type CryptoPlatformKeyAgreementDeriveSharedSecretResult = Message<"reallyme.crypto.v1.CryptoPlatformKeyAgreementDeriveSharedSecretResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: bytes shared_secret = 2;
+     */
+    sharedSecret: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoPlatformKeyAgreementDeriveSharedSecretResult.
+ * Use `create(CryptoPlatformKeyAgreementDeriveSharedSecretResultSchema)` to create a new message.
+ */
+export declare const CryptoPlatformKeyAgreementDeriveSharedSecretResultSchema: GenMessage<CryptoPlatformKeyAgreementDeriveSharedSecretResult>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoPlatformKeyDeleteRequest
+ */
+export type CryptoPlatformKeyDeleteRequest = Message<"reallyme.crypto.v1.CryptoPlatformKeyDeleteRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoPlatformPrivateKeyHandle private_key_handle = 1;
+     */
+    privateKeyHandle?: CryptoPlatformPrivateKeyHandle | undefined;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoPlatformKeyDeleteRequest.
+ * Use `create(CryptoPlatformKeyDeleteRequestSchema)` to create a new message.
+ */
+export declare const CryptoPlatformKeyDeleteRequestSchema: GenMessage<CryptoPlatformKeyDeleteRequest>;
+/**
+ * Deletion is idempotent: deleting a well-formed handle whose key is already
+ * absent succeeds. Malformed handles and provider mismatches remain typed
+ * failures. The result echoes no handle so the boundary does not create an
+ * unnecessary additional copy of a persistent key identifier.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoPlatformKeyDeleteResult
+ */
+export type CryptoPlatformKeyDeleteResult = Message<"reallyme.crypto.v1.CryptoPlatformKeyDeleteResult"> & {};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoPlatformKeyDeleteResult.
+ * Use `create(CryptoPlatformKeyDeleteResultSchema)` to create a new message.
+ */
+export declare const CryptoPlatformKeyDeleteResultSchema: GenMessage<CryptoPlatformKeyDeleteResult>;
+/**
+ * Attestation is an explicit evidence operation. A provider or security-level
+ * enum value alone never proves that a key is hardware-backed.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoPlatformKeyAttestRequest
+ */
+export type CryptoPlatformKeyAttestRequest = Message<"reallyme.crypto.v1.CryptoPlatformKeyAttestRequest"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoPlatformPrivateKeyHandle private_key_handle = 1;
+     */
+    privateKeyHandle?: CryptoPlatformPrivateKeyHandle | undefined;
+    /**
+     * @generated from field: bytes challenge = 2;
+     */
+    challenge: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoPlatformKeyAttestRequest.
+ * Use `create(CryptoPlatformKeyAttestRequestSchema)` to create a new message.
+ */
+export declare const CryptoPlatformKeyAttestRequestSchema: GenMessage<CryptoPlatformKeyAttestRequest>;
+/**
+ * A wrapper keeps each certificate in a separately hardened generated owner
+ * instead of retaining a nested byte-vector with ambiguous cleanup semantics.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoPlatformKeyAttestationCertificate
+ */
+export type CryptoPlatformKeyAttestationCertificate = Message<"reallyme.crypto.v1.CryptoPlatformKeyAttestationCertificate"> & {
+    /**
+     * @generated from field: bytes certificate_der = 1;
+     */
+    certificateDer: Uint8Array;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoPlatformKeyAttestationCertificate.
+ * Use `create(CryptoPlatformKeyAttestationCertificateSchema)` to create a new message.
+ */
+export declare const CryptoPlatformKeyAttestationCertificateSchema: GenMessage<CryptoPlatformKeyAttestationCertificate>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoPlatformKeyAttestResult
+ */
+export type CryptoPlatformKeyAttestResult = Message<"reallyme.crypto.v1.CryptoPlatformKeyAttestResult"> & {
+    /**
+     * @generated from field: repeated reallyme.crypto.v1.CryptoPlatformKeyAttestationCertificate certificate_chain = 1;
+     */
+    certificateChain: CryptoPlatformKeyAttestationCertificate[];
+    /**
+     * @generated from field: reallyme.crypto.v1.PlatformKeySecurityLevel actual_security_level = 2;
+     */
+    actualSecurityLevel: PlatformKeySecurityLevel;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoPlatformKeyAttestResult.
+ * Use `create(CryptoPlatformKeyAttestResultSchema)` to create a new message.
+ */
+export declare const CryptoPlatformKeyAttestResultSchema: GenMessage<CryptoPlatformKeyAttestResult>;
+/**
+ * CryptoVerificationResult is for protocol layers that need a stable,
+ * serializable verification status. Ordinary facade calls should continue to
+ * fail closed with typed errors.
+ *
+ * @generated from message reallyme.crypto.v1.CryptoVerificationResult
+ */
+export type CryptoVerificationResult = Message<"reallyme.crypto.v1.CryptoVerificationResult"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoVerificationStatus status = 2;
+     */
+    status: CryptoVerificationStatus;
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoError error = 3;
+     */
+    error?: CryptoError | undefined;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoVerificationResult.
+ * Use `create(CryptoVerificationResultSchema)` to create a new message.
+ */
+export declare const CryptoVerificationResultSchema: GenMessage<CryptoVerificationResult>;
+/**
+ * CryptoProviderCapability describes the package/provider posture for one
+ * algorithm in one published lane. Provider names are non-secret identifiers
+ * such as "CryptoKit", "BouncyCastle", or "ReallyMe Rust WASM".
+ *
+ * @generated from message reallyme.crypto.v1.CryptoProviderCapability
+ */
+export type CryptoProviderCapability = Message<"reallyme.crypto.v1.CryptoProviderCapability"> & {
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmIdentifier algorithm = 1;
+     */
+    algorithm?: CryptoAlgorithmIdentifier | undefined;
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoAlgorithmFamily family = 2;
+     */
+    family: CryptoAlgorithmFamily;
+    /**
+     * @generated from field: reallyme.crypto.v1.CryptoProviderSupportStatus status = 3;
+     */
+    status: CryptoProviderSupportStatus;
+    /**
+     * @generated from field: repeated string provider_names = 4;
+     */
+    providerNames: string[];
+    /**
+     * @generated from field: bool uses_rust = 5;
+     */
+    usesRust: boolean;
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoProviderCapability.
+ * Use `create(CryptoProviderCapabilitySchema)` to create a new message.
  */
-export declare const CryptoAlgorithmIdentifierSchema: GenMessage<CryptoAlgorithmIdentifier>;
+export declare const CryptoProviderCapabilitySchema: GenMessage<CryptoProviderCapability>;
+/**
+ * @generated from message reallyme.crypto.v1.CryptoProviderCapabilitySet
+ */
+export type CryptoProviderCapabilitySet = Message<"reallyme.crypto.v1.CryptoProviderCapabilitySet"> & {
+    /**
+     * @generated from field: repeated reallyme.crypto.v1.CryptoProviderCapability capabilities = 1;
+     */
+    capabilities: CryptoProviderCapability[];
+};
+/**
+ * Describes the message reallyme.crypto.v1.CryptoProviderCapabilitySet.
+ * Use `create(CryptoProviderCapabilitySetSchema)` to create a new message.
+ */
+export declare const CryptoProviderCapabilitySetSchema: GenMessage<CryptoProviderCapabilitySet>;
 /**
  * JsonWebKey carries a public JWK document at API/storage boundaries. The JSON
  * member is the canonical JCS form used by the package vectors; private key
@@ -306,6 +2568,22 @@ export declare enum CryptoErrorReason {
      * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_INVALID_SHARED_SECRET = 125;
      */
     PRIMITIVE_INVALID_SHARED_SECRET = 125,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_MALFORMED_PROTOBUF = 130;
+     */
+    PRIMITIVE_MALFORMED_PROTOBUF = 130,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_MALFORMED_JSON = 131;
+     */
+    PRIMITIVE_MALFORMED_JSON = 131,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_RESOURCE_LIMIT_EXCEEDED = 132;
+     */
+    PRIMITIVE_RESOURCE_LIMIT_EXCEEDED = 132,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PRIMITIVE_MISSING_OPERATION = 133;
+     */
+    PRIMITIVE_MISSING_OPERATION = 133,
     /**
      * Provider policy and availability.
      *
@@ -324,6 +2602,34 @@ export declare enum CryptoErrorReason {
      * @generated from enum value: CRYPTO_ERROR_REASON_PROVIDER_RANDOMNESS_UNAVAILABLE = 203;
      */
     PROVIDER_RANDOMNESS_UNAVAILABLE = 203,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PROVIDER_KEY_EXISTS = 204;
+     */
+    PROVIDER_KEY_EXISTS = 204,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PROVIDER_KEY_NOT_FOUND = 205;
+     */
+    PROVIDER_KEY_NOT_FOUND = 205,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PROVIDER_ACCESS_DENIED = 206;
+     */
+    PROVIDER_ACCESS_DENIED = 206,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PROVIDER_USER_AUTHENTICATION_REQUIRED = 207;
+     */
+    PROVIDER_USER_AUTHENTICATION_REQUIRED = 207,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PROVIDER_USER_CANCELED = 208;
+     */
+    PROVIDER_USER_CANCELED = 208,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PROVIDER_HARDWARE_UNAVAILABLE = 209;
+     */
+    PROVIDER_HARDWARE_UNAVAILABLE = 209,
+    /**
+     * @generated from enum value: CRYPTO_ERROR_REASON_PROVIDER_HARDWARE_REJECTED_KEY = 210;
+     */
+    PROVIDER_HARDWARE_REJECTED_KEY = 210,
     /**
      * Backend dispatch and internal state.
      *
@@ -392,9 +2698,20 @@ export declare enum CryptoAlgorithmFamily {
  */
 export declare const CryptoAlgorithmFamilySchema: GenEnum<CryptoAlgorithmFamily>;
 /**
- * SignatureAlgorithm identifies signature suites supported or reserved by the
- * crypto repository. RSA values identify verification suites; RSA signing is
- * intentionally not exposed by this package today.
+ * Algorithm selector values are a permanent, append-only wire contract from
+ * this release onward. Each family-scoped enum uses sparse subfamily bands so
+ * future suites can be added beside related algorithms without renumbering an
+ * existing value.
+ *
+ * SignatureAlgorithm bands:
+ *   100-199: EdDSA
+ *   200-299: elliptic-curve signatures
+ *   300-499: RSA verification suites
+ *   1000-1099: post-quantum signatures
+ *   1100-1199: hash-based post-quantum signatures
+ *
+ * RSA values identify verification suites; RSA signing is intentionally not
+ * exposed by this package today.
  *
  * @generated from enum reallyme.crypto.v1.SignatureAlgorithm
  */
@@ -404,77 +2721,77 @@ export declare enum SignatureAlgorithm {
      */
     UNSPECIFIED = 0,
     /**
-     * @generated from enum value: SIGNATURE_ALGORITHM_ED25519 = 1;
+     * @generated from enum value: SIGNATURE_ALGORITHM_ED25519 = 100;
      */
-    ED25519 = 1,
+    ED25519 = 100,
     /**
-     * @generated from enum value: SIGNATURE_ALGORITHM_ECDSA_P256_SHA256 = 2;
+     * @generated from enum value: SIGNATURE_ALGORITHM_ECDSA_P256_SHA256 = 200;
      */
-    ECDSA_P256_SHA256 = 2,
+    ECDSA_P256_SHA256 = 200,
     /**
-     * @generated from enum value: SIGNATURE_ALGORITHM_ECDSA_P384_SHA384 = 3;
+     * @generated from enum value: SIGNATURE_ALGORITHM_ECDSA_P384_SHA384 = 210;
      */
-    ECDSA_P384_SHA384 = 3,
+    ECDSA_P384_SHA384 = 210,
     /**
-     * @generated from enum value: SIGNATURE_ALGORITHM_ECDSA_P521_SHA512 = 4;
+     * @generated from enum value: SIGNATURE_ALGORITHM_ECDSA_P521_SHA512 = 220;
      */
-    ECDSA_P521_SHA512 = 4,
+    ECDSA_P521_SHA512 = 220,
     /**
-     * @generated from enum value: SIGNATURE_ALGORITHM_ECDSA_SECP256K1_SHA256 = 5;
+     * @generated from enum value: SIGNATURE_ALGORITHM_ECDSA_SECP256K1_SHA256 = 230;
      */
-    ECDSA_SECP256K1_SHA256 = 5,
+    ECDSA_SECP256K1_SHA256 = 230,
     /**
-     * @generated from enum value: SIGNATURE_ALGORITHM_BIP340_SCHNORR_SECP256K1_SHA256 = 6;
+     * @generated from enum value: SIGNATURE_ALGORITHM_BIP340_SCHNORR_SECP256K1_SHA256 = 240;
      */
-    BIP340_SCHNORR_SECP256K1_SHA256 = 6,
+    BIP340_SCHNORR_SECP256K1_SHA256 = 240,
     /**
-     * @generated from enum value: SIGNATURE_ALGORITHM_RSA_PKCS1V15_SHA1 = 7;
+     * @generated from enum value: SIGNATURE_ALGORITHM_RSA_PKCS1V15_SHA1 = 300;
      */
-    RSA_PKCS1V15_SHA1 = 7,
+    RSA_PKCS1V15_SHA1 = 300,
     /**
-     * @generated from enum value: SIGNATURE_ALGORITHM_RSA_PKCS1V15_SHA256 = 8;
+     * @generated from enum value: SIGNATURE_ALGORITHM_RSA_PKCS1V15_SHA256 = 310;
      */
-    RSA_PKCS1V15_SHA256 = 8,
+    RSA_PKCS1V15_SHA256 = 310,
     /**
-     * @generated from enum value: SIGNATURE_ALGORITHM_RSA_PKCS1V15_SHA384 = 9;
+     * @generated from enum value: SIGNATURE_ALGORITHM_RSA_PKCS1V15_SHA384 = 320;
      */
-    RSA_PKCS1V15_SHA384 = 9,
+    RSA_PKCS1V15_SHA384 = 320,
     /**
-     * @generated from enum value: SIGNATURE_ALGORITHM_RSA_PKCS1V15_SHA512 = 10;
+     * @generated from enum value: SIGNATURE_ALGORITHM_RSA_PKCS1V15_SHA512 = 330;
      */
-    RSA_PKCS1V15_SHA512 = 10,
+    RSA_PKCS1V15_SHA512 = 330,
     /**
-     * @generated from enum value: SIGNATURE_ALGORITHM_RSA_PSS_SHA1_MGF1_SHA1 = 11;
+     * @generated from enum value: SIGNATURE_ALGORITHM_RSA_PSS_SHA1_MGF1_SHA1 = 400;
      */
-    RSA_PSS_SHA1_MGF1_SHA1 = 11,
+    RSA_PSS_SHA1_MGF1_SHA1 = 400,
     /**
-     * @generated from enum value: SIGNATURE_ALGORITHM_RSA_PSS_SHA256_MGF1_SHA256 = 12;
+     * @generated from enum value: SIGNATURE_ALGORITHM_RSA_PSS_SHA256_MGF1_SHA256 = 410;
      */
-    RSA_PSS_SHA256_MGF1_SHA256 = 12,
+    RSA_PSS_SHA256_MGF1_SHA256 = 410,
     /**
-     * @generated from enum value: SIGNATURE_ALGORITHM_RSA_PSS_SHA384_MGF1_SHA384 = 13;
+     * @generated from enum value: SIGNATURE_ALGORITHM_RSA_PSS_SHA384_MGF1_SHA384 = 420;
      */
-    RSA_PSS_SHA384_MGF1_SHA384 = 13,
+    RSA_PSS_SHA384_MGF1_SHA384 = 420,
     /**
-     * @generated from enum value: SIGNATURE_ALGORITHM_RSA_PSS_SHA512_MGF1_SHA512 = 14;
+     * @generated from enum value: SIGNATURE_ALGORITHM_RSA_PSS_SHA512_MGF1_SHA512 = 430;
      */
-    RSA_PSS_SHA512_MGF1_SHA512 = 14,
+    RSA_PSS_SHA512_MGF1_SHA512 = 430,
     /**
-     * @generated from enum value: SIGNATURE_ALGORITHM_ML_DSA_44 = 15;
+     * @generated from enum value: SIGNATURE_ALGORITHM_ML_DSA_44 = 1000;
      */
-    ML_DSA_44 = 15,
+    ML_DSA_44 = 1000,
     /**
-     * @generated from enum value: SIGNATURE_ALGORITHM_ML_DSA_65 = 16;
+     * @generated from enum value: SIGNATURE_ALGORITHM_ML_DSA_65 = 1010;
      */
-    ML_DSA_65 = 16,
+    ML_DSA_65 = 1010,
     /**
-     * @generated from enum value: SIGNATURE_ALGORITHM_ML_DSA_87 = 17;
+     * @generated from enum value: SIGNATURE_ALGORITHM_ML_DSA_87 = 1020;
      */
-    ML_DSA_87 = 17,
+    ML_DSA_87 = 1020,
     /**
-     * @generated from enum value: SIGNATURE_ALGORITHM_SLH_DSA_SHA2_128S = 18;
+     * @generated from enum value: SIGNATURE_ALGORITHM_SLH_DSA_SHA2_128S = 1100;
      */
-    SLH_DSA_SHA2_128S = 18
+    SLH_DSA_SHA2_128S = 1100
 }
 /**
  * Describes the enum reallyme.crypto.v1.SignatureAlgorithm.
@@ -482,7 +2799,9 @@ export declare enum SignatureAlgorithm {
 export declare const SignatureAlgorithmSchema: GenEnum<SignatureAlgorithm>;
 /**
  * KeyAgreementAlgorithm identifies direct shared-secret derivation suites.
- * Callers must still feed derived shared secrets through a protocol KDF.
+ * Values 100-199 are Montgomery-form curves and 200-299 are NIST prime
+ * curves. Callers must still feed derived shared secrets through a protocol
+ * KDF.
  *
  * @generated from enum reallyme.crypto.v1.KeyAgreementAlgorithm
  */
@@ -492,29 +2811,30 @@ export declare enum KeyAgreementAlgorithm {
      */
     UNSPECIFIED = 0,
     /**
-     * @generated from enum value: KEY_AGREEMENT_ALGORITHM_X25519 = 1;
+     * @generated from enum value: KEY_AGREEMENT_ALGORITHM_X25519 = 100;
      */
-    X25519 = 1,
+    X25519 = 100,
     /**
-     * @generated from enum value: KEY_AGREEMENT_ALGORITHM_P256_ECDH = 2;
+     * @generated from enum value: KEY_AGREEMENT_ALGORITHM_P256_ECDH = 200;
      */
-    P256_ECDH = 2,
+    P256_ECDH = 200,
     /**
-     * @generated from enum value: KEY_AGREEMENT_ALGORITHM_P384_ECDH = 3;
+     * @generated from enum value: KEY_AGREEMENT_ALGORITHM_P384_ECDH = 210;
      */
-    P384_ECDH = 3,
+    P384_ECDH = 210,
     /**
-     * @generated from enum value: KEY_AGREEMENT_ALGORITHM_P521_ECDH = 4;
+     * @generated from enum value: KEY_AGREEMENT_ALGORITHM_P521_ECDH = 220;
      */
-    P521_ECDH = 4
+    P521_ECDH = 220
 }
 /**
  * Describes the enum reallyme.crypto.v1.KeyAgreementAlgorithm.
  */
 export declare const KeyAgreementAlgorithmSchema: GenEnum<KeyAgreementAlgorithm>;
 /**
- * KemAlgorithm identifies encapsulation suites. X-Wing values are ReallyMe's
- * supported hybrid KEM variants over X25519 and ML-KEM.
+ * KemAlgorithm identifies encapsulation suites. X-Wing values are supported
+ * hybrid KEM variants over X25519 and ML-KEM. Values 1000-1099 are
+ * post-quantum KEMs and 1100-1199 are hybrid KEMs.
  *
  * @generated from enum reallyme.crypto.v1.KemAlgorithm
  */
@@ -524,55 +2844,189 @@ export declare enum KemAlgorithm {
      */
     UNSPECIFIED = 0,
     /**
-     * @generated from enum value: KEM_ALGORITHM_ML_KEM_512 = 1;
-     */
-    ML_KEM_512 = 1,
-    /**
-     * @generated from enum value: KEM_ALGORITHM_ML_KEM_768 = 2;
+     * @generated from enum value: KEM_ALGORITHM_ML_KEM_512 = 1000;
      */
-    ML_KEM_768 = 2,
+    ML_KEM_512 = 1000,
     /**
-     * @generated from enum value: KEM_ALGORITHM_ML_KEM_1024 = 3;
+     * @generated from enum value: KEM_ALGORITHM_ML_KEM_768 = 1010;
      */
-    ML_KEM_1024 = 3,
+    ML_KEM_768 = 1010,
     /**
-     * @generated from enum value: KEM_ALGORITHM_X_WING_768 = 4;
+     * @generated from enum value: KEM_ALGORITHM_ML_KEM_1024 = 1020;
      */
-    X_WING_768 = 4,
+    ML_KEM_1024 = 1020,
     /**
-     * @generated from enum value: KEM_ALGORITHM_X_WING_1024 = 5;
+     * @generated from enum value: KEM_ALGORITHM_X_WING_768 = 1100;
      */
-    X_WING_1024 = 5
+    X_WING_768 = 1100
 }
 /**
  * Describes the enum reallyme.crypto.v1.KemAlgorithm.
  */
 export declare const KemAlgorithmSchema: GenEnum<KemAlgorithm>;
 /**
- * HpkeSuite identifies supported RFC 9180 HPKE Base-mode ciphersuites.
+ * HpkeKemId carries the two-byte HPKE KEM registry identifier. Registered
+ * draft values are append-only wire values even while their defining drafts
+ * continue to evolve. Runtime provider policy separately determines whether a
+ * registered identifier is executable in a given build.
+ *
+ * @generated from enum reallyme.crypto.v1.HpkeKemId
+ */
+export declare enum HpkeKemId {
+    /**
+     * @generated from enum value: HPKE_KEM_ID_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: HPKE_KEM_ID_DHKEM_P256_HKDF_SHA256 = 16;
+     */
+    DHKEM_P256_HKDF_SHA256 = 16,
+    /**
+     * @generated from enum value: HPKE_KEM_ID_DHKEM_P384_HKDF_SHA384 = 17;
+     */
+    DHKEM_P384_HKDF_SHA384 = 17,
+    /**
+     * @generated from enum value: HPKE_KEM_ID_DHKEM_P521_HKDF_SHA512 = 18;
+     */
+    DHKEM_P521_HKDF_SHA512 = 18,
+    /**
+     * @generated from enum value: HPKE_KEM_ID_DHKEM_CP256_HKDF_SHA256 = 19;
+     */
+    DHKEM_CP256_HKDF_SHA256 = 19,
+    /**
+     * @generated from enum value: HPKE_KEM_ID_DHKEM_CP384_HKDF_SHA384 = 20;
+     */
+    DHKEM_CP384_HKDF_SHA384 = 20,
+    /**
+     * @generated from enum value: HPKE_KEM_ID_DHKEM_CP521_HKDF_SHA512 = 21;
+     */
+    DHKEM_CP521_HKDF_SHA512 = 21,
+    /**
+     * @generated from enum value: HPKE_KEM_ID_DHKEM_SECP256K1_HKDF_SHA256 = 22;
+     */
+    DHKEM_SECP256K1_HKDF_SHA256 = 22,
+    /**
+     * @generated from enum value: HPKE_KEM_ID_DHKEM_X25519_HKDF_SHA256 = 32;
+     */
+    DHKEM_X25519_HKDF_SHA256 = 32,
+    /**
+     * @generated from enum value: HPKE_KEM_ID_DHKEM_X448_HKDF_SHA512 = 33;
+     */
+    DHKEM_X448_HKDF_SHA512 = 33,
+    /**
+     * @generated from enum value: HPKE_KEM_ID_DHKEM_X25519_ELLIGATOR_HKDF_SHA256 = 34;
+     */
+    DHKEM_X25519_ELLIGATOR_HKDF_SHA256 = 34,
+    /**
+     * @generated from enum value: HPKE_KEM_ID_X25519_KYBER768_DRAFT00 = 48;
+     */
+    X25519_KYBER768_DRAFT00 = 48,
+    /**
+     * @generated from enum value: HPKE_KEM_ID_ML_KEM_512 = 64;
+     */
+    ML_KEM_512 = 64,
+    /**
+     * @generated from enum value: HPKE_KEM_ID_ML_KEM_768 = 65;
+     */
+    ML_KEM_768 = 65,
+    /**
+     * @generated from enum value: HPKE_KEM_ID_ML_KEM_1024 = 66;
+     */
+    ML_KEM_1024 = 66,
+    /**
+     * @generated from enum value: HPKE_KEM_ID_ML_KEM_768_P256 = 80;
+     */
+    ML_KEM_768_P256 = 80,
+    /**
+     * @generated from enum value: HPKE_KEM_ID_ML_KEM_1024_P384 = 81;
+     */
+    ML_KEM_1024_P384 = 81,
+    /**
+     * @generated from enum value: HPKE_KEM_ID_X_WING = 25722;
+     */
+    X_WING = 25722
+}
+/**
+ * Describes the enum reallyme.crypto.v1.HpkeKemId.
+ */
+export declare const HpkeKemIdSchema: GenEnum<HpkeKemId>;
+/**
+ * HpkeKdfId carries the two-byte HPKE KDF registry identifier.
+ *
+ * @generated from enum reallyme.crypto.v1.HpkeKdfId
+ */
+export declare enum HpkeKdfId {
+    /**
+     * @generated from enum value: HPKE_KDF_ID_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: HPKE_KDF_ID_HKDF_SHA256 = 1;
+     */
+    HKDF_SHA256 = 1,
+    /**
+     * @generated from enum value: HPKE_KDF_ID_HKDF_SHA384 = 2;
+     */
+    HKDF_SHA384 = 2,
+    /**
+     * @generated from enum value: HPKE_KDF_ID_HKDF_SHA512 = 3;
+     */
+    HKDF_SHA512 = 3,
+    /**
+     * @generated from enum value: HPKE_KDF_ID_SHAKE128 = 16;
+     */
+    SHAKE128 = 16,
+    /**
+     * @generated from enum value: HPKE_KDF_ID_SHAKE256 = 17;
+     */
+    SHAKE256 = 17,
+    /**
+     * @generated from enum value: HPKE_KDF_ID_TURBO_SHAKE128 = 18;
+     */
+    TURBO_SHAKE128 = 18,
+    /**
+     * @generated from enum value: HPKE_KDF_ID_TURBO_SHAKE256 = 19;
+     */
+    TURBO_SHAKE256 = 19
+}
+/**
+ * Describes the enum reallyme.crypto.v1.HpkeKdfId.
+ */
+export declare const HpkeKdfIdSchema: GenEnum<HpkeKdfId>;
+/**
+ * HpkeAeadId carries the two-byte HPKE AEAD registry identifier.
  *
- * @generated from enum reallyme.crypto.v1.HpkeSuite
+ * @generated from enum reallyme.crypto.v1.HpkeAeadId
  */
-export declare enum HpkeSuite {
+export declare enum HpkeAeadId {
     /**
-     * @generated from enum value: HPKE_SUITE_UNSPECIFIED = 0;
+     * @generated from enum value: HPKE_AEAD_ID_UNSPECIFIED = 0;
      */
     UNSPECIFIED = 0,
     /**
-     * @generated from enum value: HPKE_SUITE_DHKEM_P256_HKDF_SHA256_HKDF_SHA256_AES_256_GCM = 1;
+     * @generated from enum value: HPKE_AEAD_ID_AES_128_GCM = 1;
+     */
+    AES_128_GCM = 1,
+    /**
+     * @generated from enum value: HPKE_AEAD_ID_AES_256_GCM = 2;
+     */
+    AES_256_GCM = 2,
+    /**
+     * @generated from enum value: HPKE_AEAD_ID_CHACHA20_POLY1305 = 3;
      */
-    DHKEM_P256_HKDF_SHA256_HKDF_SHA256_AES_256_GCM = 1,
+    CHACHA20_POLY1305 = 3,
     /**
-     * @generated from enum value: HPKE_SUITE_DHKEM_X25519_HKDF_SHA256_HKDF_SHA256_CHACHA20_POLY1305 = 2;
+     * @generated from enum value: HPKE_AEAD_ID_EXPORT_ONLY = 65535;
      */
-    DHKEM_X25519_HKDF_SHA256_HKDF_SHA256_CHACHA20_POLY1305 = 2
+    EXPORT_ONLY = 65535
 }
 /**
- * Describes the enum reallyme.crypto.v1.HpkeSuite.
+ * Describes the enum reallyme.crypto.v1.HpkeAeadId.
  */
-export declare const HpkeSuiteSchema: GenEnum<HpkeSuite>;
+export declare const HpkeAeadIdSchema: GenEnum<HpkeAeadId>;
 /**
- * AeadAlgorithm identifies authenticated-encryption suites.
+ * AeadAlgorithm identifies authenticated-encryption suites. Values 100-199 are
+ * AES-based suites and 200-299 are ChaCha-based suites.
  *
  * @generated from enum reallyme.crypto.v1.AeadAlgorithm
  */
@@ -582,29 +3036,29 @@ export declare enum AeadAlgorithm {
      */
     UNSPECIFIED = 0,
     /**
-     * @generated from enum value: AEAD_ALGORITHM_AES_256_GCM = 1;
+     * @generated from enum value: AEAD_ALGORITHM_AES_128_GCM = 100;
      */
-    AES_256_GCM = 1,
+    AES_128_GCM = 100,
     /**
-     * @generated from enum value: AEAD_ALGORITHM_AES_256_GCM_SIV = 2;
+     * @generated from enum value: AEAD_ALGORITHM_AES_192_GCM = 110;
      */
-    AES_256_GCM_SIV = 2,
+    AES_192_GCM = 110,
     /**
-     * @generated from enum value: AEAD_ALGORITHM_CHACHA20_POLY1305 = 3;
+     * @generated from enum value: AEAD_ALGORITHM_AES_256_GCM = 120;
      */
-    CHACHA20_POLY1305 = 3,
+    AES_256_GCM = 120,
     /**
-     * @generated from enum value: AEAD_ALGORITHM_XCHACHA20_POLY1305 = 4;
+     * @generated from enum value: AEAD_ALGORITHM_AES_256_GCM_SIV = 130;
      */
-    XCHACHA20_POLY1305 = 4,
+    AES_256_GCM_SIV = 130,
     /**
-     * @generated from enum value: AEAD_ALGORITHM_AES_128_GCM = 5;
+     * @generated from enum value: AEAD_ALGORITHM_CHACHA20_POLY1305 = 200;
      */
-    AES_128_GCM = 5,
+    CHACHA20_POLY1305 = 200,
     /**
-     * @generated from enum value: AEAD_ALGORITHM_AES_192_GCM = 6;
+     * @generated from enum value: AEAD_ALGORITHM_XCHACHA20_POLY1305 = 210;
      */
-    AES_192_GCM = 6
+    XCHACHA20_POLY1305 = 210
 }
 /**
  * Describes the enum reallyme.crypto.v1.AeadAlgorithm.
@@ -612,6 +3066,7 @@ export declare enum AeadAlgorithm {
 export declare const AeadAlgorithmSchema: GenEnum<AeadAlgorithm>;
 /**
  * HashAlgorithm identifies digest algorithms exposed by the hash primitives.
+ * Values 100-199 are SHA-2 and 200-299 are SHA-3.
  *
  * @generated from enum reallyme.crypto.v1.HashAlgorithm
  */
@@ -621,40 +3076,41 @@ export declare enum HashAlgorithm {
      */
     UNSPECIFIED = 0,
     /**
-     * @generated from enum value: HASH_ALGORITHM_SHA2_256 = 1;
+     * @generated from enum value: HASH_ALGORITHM_SHA2_256 = 100;
      */
-    SHA2_256 = 1,
+    SHA2_256 = 100,
     /**
-     * @generated from enum value: HASH_ALGORITHM_SHA2_384 = 2;
+     * @generated from enum value: HASH_ALGORITHM_SHA2_384 = 110;
      */
-    SHA2_384 = 2,
+    SHA2_384 = 110,
     /**
-     * @generated from enum value: HASH_ALGORITHM_SHA2_512 = 3;
+     * @generated from enum value: HASH_ALGORITHM_SHA2_512 = 120;
      */
-    SHA2_512 = 3,
+    SHA2_512 = 120,
     /**
-     * @generated from enum value: HASH_ALGORITHM_SHA3_224 = 4;
+     * @generated from enum value: HASH_ALGORITHM_SHA3_224 = 200;
      */
-    SHA3_224 = 4,
+    SHA3_224 = 200,
     /**
-     * @generated from enum value: HASH_ALGORITHM_SHA3_256 = 5;
+     * @generated from enum value: HASH_ALGORITHM_SHA3_256 = 210;
      */
-    SHA3_256 = 5,
+    SHA3_256 = 210,
     /**
-     * @generated from enum value: HASH_ALGORITHM_SHA3_384 = 6;
+     * @generated from enum value: HASH_ALGORITHM_SHA3_384 = 220;
      */
-    SHA3_384 = 6,
+    SHA3_384 = 220,
     /**
-     * @generated from enum value: HASH_ALGORITHM_SHA3_512 = 7;
+     * @generated from enum value: HASH_ALGORITHM_SHA3_512 = 230;
      */
-    SHA3_512 = 7
+    SHA3_512 = 230
 }
 /**
  * Describes the enum reallyme.crypto.v1.HashAlgorithm.
  */
 export declare const HashAlgorithmSchema: GenEnum<HashAlgorithm>;
 /**
- * MacAlgorithm identifies message-authentication-code suites.
+ * MacAlgorithm identifies message-authentication-code suites. Values 100-199
+ * are HMAC suites over SHA-2.
  *
  * @generated from enum reallyme.crypto.v1.MacAlgorithm
  */
@@ -664,21 +3120,32 @@ export declare enum MacAlgorithm {
      */
     UNSPECIFIED = 0,
     /**
-     * @generated from enum value: MAC_ALGORITHM_HMAC_SHA256 = 1;
+     * @generated from enum value: MAC_ALGORITHM_HMAC_SHA256 = 100;
+     */
+    HMAC_SHA256 = 100,
+    /**
+     * @generated from enum value: MAC_ALGORITHM_HMAC_SHA384 = 110;
      */
-    HMAC_SHA256 = 1,
+    HMAC_SHA384 = 110,
     /**
-     * @generated from enum value: MAC_ALGORITHM_HMAC_SHA512 = 2;
+     * @generated from enum value: MAC_ALGORITHM_HMAC_SHA512 = 120;
      */
-    HMAC_SHA512 = 2
+    HMAC_SHA512 = 120
 }
 /**
  * Describes the enum reallyme.crypto.v1.MacAlgorithm.
  */
 export declare const MacAlgorithmSchema: GenEnum<MacAlgorithm>;
 /**
- * KdfAlgorithm identifies key-derivation functions. PBKDF2 values are retained
- * for legacy interoperability; new password storage should prefer Argon2id.
+ * KdfAlgorithm identifies key-derivation functions. PBKDF2 values remain for
+ * standards and password-record interoperability; new password storage should
+ * prefer Argon2id.
+ * Values are grouped by construction:
+ *   100-199: extract-and-expand KDFs
+ *   200-299: memory-hard password KDFs
+ *   300-399: password-record KDFs
+ *   400-499: concatenation KDFs
+ *   500-599: XOF/MAC-based KDFs
  *
  * @generated from enum reallyme.crypto.v1.KdfAlgorithm
  */
@@ -688,32 +3155,66 @@ export declare enum KdfAlgorithm {
      */
     UNSPECIFIED = 0,
     /**
-     * @generated from enum value: KDF_ALGORITHM_HKDF_SHA256 = 1;
+     * @generated from enum value: KDF_ALGORITHM_HKDF_SHA256 = 100;
      */
-    HKDF_SHA256 = 1,
+    HKDF_SHA256 = 100,
+    /**
+     * @generated from enum value: KDF_ALGORITHM_HKDF_SHA384 = 110;
+     */
+    HKDF_SHA384 = 110,
+    /**
+     * @generated from enum value: KDF_ALGORITHM_ARGON2ID = 200;
+     */
+    ARGON2ID = 200,
     /**
-     * @generated from enum value: KDF_ALGORITHM_ARGON2ID = 2;
+     * @generated from enum value: KDF_ALGORITHM_PBKDF2_HMAC_SHA256 = 300;
      */
-    ARGON2ID = 2,
+    PBKDF2_HMAC_SHA256 = 300,
     /**
-     * @generated from enum value: KDF_ALGORITHM_PBKDF2_HMAC_SHA256 = 3;
+     * @generated from enum value: KDF_ALGORITHM_PBKDF2_HMAC_SHA512 = 310;
      */
-    PBKDF2_HMAC_SHA256 = 3,
+    PBKDF2_HMAC_SHA512 = 310,
     /**
-     * @generated from enum value: KDF_ALGORITHM_PBKDF2_HMAC_SHA512 = 4;
+     * @generated from enum value: KDF_ALGORITHM_JWA_CONCAT_KDF_SHA256 = 400;
      */
-    PBKDF2_HMAC_SHA512 = 4,
+    JWA_CONCAT_KDF_SHA256 = 400,
     /**
-     * @generated from enum value: KDF_ALGORITHM_JWA_CONCAT_KDF_SHA256 = 5;
+     * @generated from enum value: KDF_ALGORITHM_KMAC_256 = 500;
      */
-    JWA_CONCAT_KDF_SHA256 = 5
+    KMAC_256 = 500
 }
 /**
  * Describes the enum reallyme.crypto.v1.KdfAlgorithm.
  */
 export declare const KdfAlgorithmSchema: GenEnum<KdfAlgorithm>;
 /**
- * KeyWrapAlgorithm identifies key-wrapping algorithms.
+ * Argon2idKdfVersion selects one immutable, reviewed resource-cost profile.
+ * Numeric versions are stable API values shared by the direct SDK and
+ * generated operation boundaries.
+ *
+ * @generated from enum reallyme.crypto.v1.Argon2idKdfVersion
+ */
+export declare enum Argon2idKdfVersion {
+    /**
+     * @generated from enum value: ARGON2ID_KDF_VERSION_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: ARGON2ID_KDF_VERSION_V1 = 1;
+     */
+    V1 = 1,
+    /**
+     * @generated from enum value: ARGON2ID_KDF_VERSION_V2 = 2;
+     */
+    V2 = 2
+}
+/**
+ * Describes the enum reallyme.crypto.v1.Argon2idKdfVersion.
+ */
+export declare const Argon2idKdfVersionSchema: GenEnum<Argon2idKdfVersion>;
+/**
+ * KeyWrapAlgorithm identifies key-wrapping algorithms. Values 100-199 are
+ * AES-based key-wrapping suites.
  *
  * @generated from enum reallyme.crypto.v1.KeyWrapAlgorithm
  */
@@ -723,9 +3224,17 @@ export declare enum KeyWrapAlgorithm {
      */
     UNSPECIFIED = 0,
     /**
-     * @generated from enum value: KEY_WRAP_ALGORITHM_AES_256_KW = 1;
+     * @generated from enum value: KEY_WRAP_ALGORITHM_AES_128_KW = 100;
+     */
+    AES_128_KW = 100,
+    /**
+     * @generated from enum value: KEY_WRAP_ALGORITHM_AES_192_KW = 110;
      */
-    AES_256_KW = 1
+    AES_192_KW = 110,
+    /**
+     * @generated from enum value: KEY_WRAP_ALGORITHM_AES_256_KW = 120;
+     */
+    AES_256_KW = 120
 }
 /**
  * Describes the enum reallyme.crypto.v1.KeyWrapAlgorithm.
@@ -848,3 +3357,225 @@ export declare enum MulticodecKeyAlgorithm {
  * Describes the enum reallyme.crypto.v1.MulticodecKeyAlgorithm.
  */
 export declare const MulticodecKeyAlgorithmSchema: GenEnum<MulticodecKeyAlgorithm>;
+/**
+ * RsaPublicKeyDerEncoding identifies the accepted DER wrapper for RSA public
+ * keys at verification boundaries.
+ *
+ * @generated from enum reallyme.crypto.v1.RsaPublicKeyDerEncoding
+ */
+export declare enum RsaPublicKeyDerEncoding {
+    /**
+     * @generated from enum value: RSA_PUBLIC_KEY_DER_ENCODING_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: RSA_PUBLIC_KEY_DER_ENCODING_PKCS1 = 1;
+     */
+    PKCS1 = 1,
+    /**
+     * @generated from enum value: RSA_PUBLIC_KEY_DER_ENCODING_SPKI = 2;
+     */
+    SPKI = 2
+}
+/**
+ * Describes the enum reallyme.crypto.v1.RsaPublicKeyDerEncoding.
+ */
+export declare const RsaPublicKeyDerEncodingSchema: GenEnum<RsaPublicKeyDerEncoding>;
+/**
+ * PlatformKeyProvider identifies the platform owner of a non-exportable key.
+ * Hardware residency is represented by security level, not by inventing a
+ * separate cryptographic algorithm value.
+ *
+ * @generated from enum reallyme.crypto.v1.PlatformKeyProvider
+ */
+export declare enum PlatformKeyProvider {
+    /**
+     * @generated from enum value: PLATFORM_KEY_PROVIDER_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: PLATFORM_KEY_PROVIDER_APPLE_KEYCHAIN = 100;
+     */
+    APPLE_KEYCHAIN = 100,
+    /**
+     * @generated from enum value: PLATFORM_KEY_PROVIDER_ANDROID_KEYSTORE = 200;
+     */
+    ANDROID_KEYSTORE = 200
+}
+/**
+ * Describes the enum reallyme.crypto.v1.PlatformKeyProvider.
+ */
+export declare const PlatformKeyProviderSchema: GenEnum<PlatformKeyProvider>;
+/**
+ * PlatformKeySecurityLevel records requested and actual key residency. Actual
+ * residency must be reported by the provider after generation or lookup; a
+ * requested value is not evidence by itself.
+ *
+ * @generated from enum reallyme.crypto.v1.PlatformKeySecurityLevel
+ */
+export declare enum PlatformKeySecurityLevel {
+    /**
+     * @generated from enum value: PLATFORM_KEY_SECURITY_LEVEL_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: PLATFORM_KEY_SECURITY_LEVEL_SOFTWARE = 1;
+     */
+    SOFTWARE = 1,
+    /**
+     * @generated from enum value: PLATFORM_KEY_SECURITY_LEVEL_TRUSTED_EXECUTION_ENVIRONMENT = 2;
+     */
+    TRUSTED_EXECUTION_ENVIRONMENT = 2,
+    /**
+     * @generated from enum value: PLATFORM_KEY_SECURITY_LEVEL_SECURE_ENCLAVE = 3;
+     */
+    SECURE_ENCLAVE = 3,
+    /**
+     * @generated from enum value: PLATFORM_KEY_SECURITY_LEVEL_STRONGBOX = 4;
+     */
+    STRONGBOX = 4
+}
+/**
+ * Describes the enum reallyme.crypto.v1.PlatformKeySecurityLevel.
+ */
+export declare const PlatformKeySecurityLevelSchema: GenEnum<PlatformKeySecurityLevel>;
+/**
+ * @generated from enum reallyme.crypto.v1.PlatformKeyPurpose
+ */
+export declare enum PlatformKeyPurpose {
+    /**
+     * @generated from enum value: PLATFORM_KEY_PURPOSE_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: PLATFORM_KEY_PURPOSE_SIGNING = 1;
+     */
+    SIGNING = 1,
+    /**
+     * @generated from enum value: PLATFORM_KEY_PURPOSE_KEY_AGREEMENT = 2;
+     */
+    KEY_AGREEMENT = 2
+}
+/**
+ * Describes the enum reallyme.crypto.v1.PlatformKeyPurpose.
+ */
+export declare const PlatformKeyPurposeSchema: GenEnum<PlatformKeyPurpose>;
+/**
+ * @generated from enum reallyme.crypto.v1.AppleSecureEnclaveAccessPolicy
+ */
+export declare enum AppleSecureEnclaveAccessPolicy {
+    /**
+     * @generated from enum value: APPLE_SECURE_ENCLAVE_ACCESS_POLICY_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: APPLE_SECURE_ENCLAVE_ACCESS_POLICY_PRIVATE_KEY_USAGE = 1;
+     */
+    PRIVATE_KEY_USAGE = 1,
+    /**
+     * @generated from enum value: APPLE_SECURE_ENCLAVE_ACCESS_POLICY_USER_PRESENCE = 2;
+     */
+    USER_PRESENCE = 2,
+    /**
+     * @generated from enum value: APPLE_SECURE_ENCLAVE_ACCESS_POLICY_BIOMETRY_ANY = 3;
+     */
+    BIOMETRY_ANY = 3,
+    /**
+     * @generated from enum value: APPLE_SECURE_ENCLAVE_ACCESS_POLICY_BIOMETRY_CURRENT_SET = 4;
+     */
+    BIOMETRY_CURRENT_SET = 4,
+    /**
+     * @generated from enum value: APPLE_SECURE_ENCLAVE_ACCESS_POLICY_DEVICE_PASSCODE = 5;
+     */
+    DEVICE_PASSCODE = 5
+}
+/**
+ * Describes the enum reallyme.crypto.v1.AppleSecureEnclaveAccessPolicy.
+ */
+export declare const AppleSecureEnclaveAccessPolicySchema: GenEnum<AppleSecureEnclaveAccessPolicy>;
+/**
+ * @generated from enum reallyme.crypto.v1.AppleKeychainAccessibility
+ */
+export declare enum AppleKeychainAccessibility {
+    /**
+     * @generated from enum value: APPLE_KEYCHAIN_ACCESSIBILITY_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: APPLE_KEYCHAIN_ACCESSIBILITY_WHEN_UNLOCKED_THIS_DEVICE_ONLY = 1;
+     */
+    WHEN_UNLOCKED_THIS_DEVICE_ONLY = 1,
+    /**
+     * @generated from enum value: APPLE_KEYCHAIN_ACCESSIBILITY_WHEN_PASSCODE_SET_THIS_DEVICE_ONLY = 2;
+     */
+    WHEN_PASSCODE_SET_THIS_DEVICE_ONLY = 2
+}
+/**
+ * Describes the enum reallyme.crypto.v1.AppleKeychainAccessibility.
+ */
+export declare const AppleKeychainAccessibilitySchema: GenEnum<AppleKeychainAccessibility>;
+/**
+ * CryptoVerificationStatus avoids using a bare bool in protocol results where
+ * "unset" and "false" need to remain distinguishable.
+ *
+ * @generated from enum reallyme.crypto.v1.CryptoVerificationStatus
+ */
+export declare enum CryptoVerificationStatus {
+    /**
+     * @generated from enum value: CRYPTO_VERIFICATION_STATUS_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: CRYPTO_VERIFICATION_STATUS_VALID = 1;
+     */
+    VALID = 1,
+    /**
+     * Well-formed verification input was processed, but the MAC, signature,
+     * proof, or comparison did not verify. Malformed input, unsupported
+     * algorithms, provider failures, and backend failures use ERROR plus the
+     * structured CryptoError field instead.
+     *
+     * @generated from enum value: CRYPTO_VERIFICATION_STATUS_INVALID = 2;
+     */
+    INVALID = 2,
+    /**
+     * @generated from enum value: CRYPTO_VERIFICATION_STATUS_ERROR = 3;
+     */
+    ERROR = 3
+}
+/**
+ * Describes the enum reallyme.crypto.v1.CryptoVerificationStatus.
+ */
+export declare const CryptoVerificationStatusSchema: GenEnum<CryptoVerificationStatus>;
+/**
+ * CryptoProviderSupportStatus mirrors the release provider matrix at a stable
+ * wire boundary without exposing backend exception text or dynamic logs.
+ *
+ * @generated from enum reallyme.crypto.v1.CryptoProviderSupportStatus
+ */
+export declare enum CryptoProviderSupportStatus {
+    /**
+     * @generated from enum value: CRYPTO_PROVIDER_SUPPORT_STATUS_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from enum value: CRYPTO_PROVIDER_SUPPORT_STATUS_SUPPORTED = 1;
+     */
+    SUPPORTED = 1,
+    /**
+     * @generated from enum value: CRYPTO_PROVIDER_SUPPORT_STATUS_PROVIDER_AWARE = 2;
+     */
+    PROVIDER_AWARE = 2,
+    /**
+     * @generated from enum value: CRYPTO_PROVIDER_SUPPORT_STATUS_PARTIAL = 3;
+     */
+    PARTIAL = 3,
+    /**
+     * @generated from enum value: CRYPTO_PROVIDER_SUPPORT_STATUS_UNSUPPORTED = 4;
+     */
+    UNSUPPORTED = 4
+}
+/**
+ * Describes the enum reallyme.crypto.v1.CryptoProviderSupportStatus.
+ */
+export declare const CryptoProviderSupportStatusSchema: GenEnum<CryptoProviderSupportStatus>;