@reallyme/crypto 0.1.8 → 0.3.0

package/dist/proto.js

@@ -1,10 +1,12 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
 // SPDX-License-Identifier: Apache-2.0
+import { create, fromBinary, toBinary } from "@bufbuild/protobuf";
 import { ReallyMeCryptoError } from "./errors.js";
-export { AeadAlgorithm, AeadAlgorithmSchema, CryptoAlgorithmFamily, CryptoAlgorithmFamilySchema, CryptoAlgorithmIdentifierSchema, CryptoBackendErrorSchema, CryptoErrorSchema, CryptoErrorReason, CryptoErrorReasonSchema, CryptoPrimitiveErrorSchema, CryptoProviderErrorSchema, HashAlgorithm, HashAlgorithmSchema, HpkeSuite, HpkeSuiteSchema, JsonWebKeySchema, JsonWebKeySetSchema, KdfAlgorithm, KdfAlgorithmSchema, KemAlgorithm, KemAlgorithmSchema, KeyAgreementAlgorithm, KeyAgreementAlgorithmSchema, KeyWrapAlgorithm, KeyWrapAlgorithmSchema, MacAlgorithm, MacAlgorithmSchema, MulticodecKeyAlgorithm, MulticodecKeyAlgorithmSchema, SignatureAlgorithm, SignatureAlgorithmSchema, file_reallyme_crypto_v1_crypto, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
-export { CodecBaseEncodingErrorSchema, CodecCanonicalizationErrorSchema, CodecErrorSchema, CodecErrorReason, CodecErrorReasonSchema, CodecMultiformatErrorSchema, CodecPemErrorSchema, file_reallyme_codec_v1_codec, } from "./proto/generated/reallyme/codec/v1/codec_pb.js";
-import { AeadAlgorithm, HashAlgorithm, HpkeSuite, KdfAlgorithm, KemAlgorithm, KeyAgreementAlgorithm, KeyWrapAlgorithm, MacAlgorithm, MulticodecKeyAlgorithm, SignatureAlgorithm, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+import { MAX_JWKS_KEYS, ReallyMeJwk } from "./jwk.js";
+import { ensureByteArrayAtMost, MAX_CRYPTO_INPUT_LENGTH, } from "./validateBytes.js";
+export { AeadAlgorithm, AeadAlgorithmSchema, CryptoAlgorithmFamily, CryptoAlgorithmFamilySchema, CryptoAlgorithmIdentifierSchema, CryptoAeadOpenRequestSchema, CryptoAeadOpenResultSchema, CryptoAeadSealRequestSchema, CryptoAeadSealResultSchema, CryptoBackendErrorSchema, CryptoBip340SchnorrSignRequestSchema, CryptoErrorSchema, CryptoErrorReason, CryptoErrorReasonSchema, CryptoHashRequestSchema, CryptoHashResultSchema, CryptoHkdfDeriveRequestSchema, CryptoHkdfDeriveResultSchema, CryptoHpkeOpenRequestSchema, CryptoHpkeOpenResultSchema, CryptoHpkeSealRequestSchema, CryptoHpkeSealedMessageSchema, CryptoJwaConcatKdfSha256DeriveRequestSchema, CryptoJwaConcatKdfSha256DeriveResultSchema, CryptoKdfDeriveKeyRequestSchema, CryptoKdfDeriveKeyResultSchema, CryptoKemEncapsulationSchema, CryptoKemDecapsulateRequestSchema, CryptoKemDecapsulateResultSchema, CryptoKemEncapsulateRequestSchema, CryptoKemDeriveKeyPairRequestSchema, CryptoKemGenerateKeyPairRequestSchema, CryptoKeyAgreementDeriveKeyPairRequestSchema, CryptoKeyAgreementDeriveSharedSecretRequestSchema, CryptoKeyAgreementDeriveSharedSecretResultSchema, CryptoKeyPairSchema, CryptoKeyUnwrapRequestSchema, CryptoKeyUnwrapResultSchema, CryptoKeyWrapRequestSchema, CryptoKeyWrapResultSchema, CryptoMacAuthenticateRequestSchema, CryptoMacAuthenticateResultSchema, CryptoMacVerifyRequestSchema, CryptoOperationRequestSchema, CryptoOperationResponseSchema, CryptoOperationResultSchema, CryptoPrimitiveErrorSchema, CryptoProviderErrorSchema, CryptoProviderCapabilitySchema, CryptoProviderCapabilitySetSchema, CryptoProviderSupportStatus, CryptoProviderSupportStatusSchema, CryptoRsaVerifyRequestSchema, CryptoSignatureDeriveKeyPairRequestSchema, CryptoSignatureGenerateKeyPairRequestSchema, CryptoSignatureSignRequestSchema, CryptoSignatureSignResultSchema, CryptoSignatureVerifyRequestSchema, CryptoVerificationResultSchema, CryptoVerificationStatus, CryptoVerificationStatusSchema, HashAlgorithm, HashAlgorithmSchema, HpkeAeadId, HpkeAeadIdSchema, HpkeKdfId, HpkeKdfIdSchema, HpkeKemId, HpkeKemIdSchema, HpkeSuiteIdentifierSchema, JsonWebKeySchema, JsonWebKeySetSchema, KdfAlgorithm, KdfAlgorithmSchema, KemAlgorithm, KemAlgorithmSchema, KeyAgreementAlgorithm, KeyAgreementAlgorithmSchema, KeyWrapAlgorithm, KeyWrapAlgorithmSchema, MacAlgorithm, MacAlgorithmSchema, MulticodecKeyAlgorithm, MulticodecKeyAlgorithmSchema, SignatureAlgorithm, SignatureAlgorithmSchema, file_reallyme_crypto_v1_crypto, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+import { AeadAlgorithm, HashAlgorithm, HpkeAeadId, HpkeKdfId, HpkeKemId, KdfAlgorithm, KemAlgorithm, KeyAgreementAlgorithm, KeyWrapAlgorithm, MacAlgorithm, MulticodecKeyAlgorithm, SignatureAlgorithm, CryptoAlgorithmIdentifierSchema, CryptoAlgorithmFamily, CryptoBackendErrorSchema, CryptoErrorReason, CryptoErrorSchema, CryptoHpkeSealedMessageSchema, HpkeSuiteIdentifierSchema, CryptoKemEncapsulationSchema, CryptoKeyPairSchema, CryptoPrimitiveErrorSchema, CryptoProviderCapabilitySchema, CryptoProviderCapabilitySetSchema, CryptoProviderErrorSchema, CryptoProviderSupportStatus, CryptoVerificationResultSchema, CryptoVerificationStatus, JsonWebKeySchema, JsonWebKeySetSchema, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
 export const signatureAlgorithmFromProto = (value) => {
     switch (value) {
         case SignatureAlgorithm.ED25519:
@@ -169,8 +171,6 @@ export const kemAlgorithmFromProto = (value) => {
             return "ML-KEM-1024";
         case KemAlgorithm.X_WING_768:
             return "X-Wing-768";
-        case KemAlgorithm.X_WING_1024:
-            return "X-Wing-1024";
         default:
             throw new ReallyMeCryptoError("unsupported-algorithm");
     }
@@ -185,8 +185,6 @@ export const kemAlgorithmToProto = (value) => {
             return KemAlgorithm.ML_KEM_1024;
         case "X-Wing-768":
             return KemAlgorithm.X_WING_768;
-        case "X-Wing-1024":
-            return KemAlgorithm.X_WING_1024;
     }
 };
 export const keyAgreementAlgorithmFromProto = (value) => {
@@ -219,6 +217,8 @@ export const macAlgorithmFromProto = (value) => {
     switch (value) {
         case MacAlgorithm.HMAC_SHA256:
             return "HMAC-SHA-256";
+        case MacAlgorithm.HMAC_SHA384:
+            return "HMAC-SHA-384";
         case MacAlgorithm.HMAC_SHA512:
             return "HMAC-SHA-512";
         default:
@@ -229,6 +229,8 @@ export const macAlgorithmToProto = (value) => {
     switch (value) {
         case "HMAC-SHA-256":
             return MacAlgorithm.HMAC_SHA256;
+        case "HMAC-SHA-384":
+            return MacAlgorithm.HMAC_SHA384;
         case "HMAC-SHA-512":
             return MacAlgorithm.HMAC_SHA512;
     }
@@ -237,6 +239,10 @@ export const kdfAlgorithmFromProto = (value) => {
     switch (value) {
         case KdfAlgorithm.HKDF_SHA256:
             return "HKDF-SHA256";
+        case KdfAlgorithm.HKDF_SHA384:
+            return "HKDF-SHA384";
+        case KdfAlgorithm.KMAC_256:
+            return "KMAC256";
         case KdfAlgorithm.ARGON2ID:
             return "Argon2id";
         case KdfAlgorithm.PBKDF2_HMAC_SHA256:
@@ -253,6 +259,10 @@ export const kdfAlgorithmToProto = (value) => {
     switch (value) {
         case "HKDF-SHA256":
             return KdfAlgorithm.HKDF_SHA256;
+        case "HKDF-SHA384":
+            return KdfAlgorithm.HKDF_SHA384;
+        case "KMAC256":
+            return KdfAlgorithm.KMAC_256;
         case "Argon2id":
             return KdfAlgorithm.ARGON2ID;
         case "PBKDF2-HMAC-SHA-256":
@@ -265,6 +275,10 @@ export const kdfAlgorithmToProto = (value) => {
 };
 export const keyWrapAlgorithmFromProto = (value) => {
     switch (value) {
+        case KeyWrapAlgorithm.AES_128_KW:
+            return "AES-128-KW";
+        case KeyWrapAlgorithm.AES_192_KW:
+            return "AES-192-KW";
         case KeyWrapAlgorithm.AES_256_KW:
             return "AES-256-KW";
         default:
@@ -273,28 +287,79 @@ export const keyWrapAlgorithmFromProto = (value) => {
 };
 export const keyWrapAlgorithmToProto = (value) => {
     switch (value) {
+        case "AES-128-KW":
+            return KeyWrapAlgorithm.AES_128_KW;
+        case "AES-192-KW":
+            return KeyWrapAlgorithm.AES_192_KW;
         case "AES-256-KW":
             return KeyWrapAlgorithm.AES_256_KW;
     }
 };
 export const hpkeSuiteFromProto = (value) => {
-    switch (value) {
-        case HpkeSuite.DHKEM_P256_HKDF_SHA256_HKDF_SHA256_AES_256_GCM:
-            return "DHKEM-P256-HKDF-SHA256-HKDF-SHA256-AES-256-GCM";
-        case HpkeSuite.DHKEM_X25519_HKDF_SHA256_HKDF_SHA256_CHACHA20_POLY1305:
-            return "DHKEM-X25519-HKDF-SHA256-HKDF-SHA256-CHACHA20-POLY1305";
-        default:
-            throw new ReallyMeCryptoError("unsupported-algorithm");
+    if (value.kem === HpkeKemId.DHKEM_P256_HKDF_SHA256 &&
+        value.kdf === HpkeKdfId.HKDF_SHA256 &&
+        value.aead === HpkeAeadId.AES_256_GCM) {
+        return "DHKEM-P256-HKDF-SHA256-HKDF-SHA256-AES-256-GCM";
     }
+    if (value.kem === HpkeKemId.DHKEM_X25519_HKDF_SHA256 &&
+        value.kdf === HpkeKdfId.HKDF_SHA256 &&
+        value.aead === HpkeAeadId.CHACHA20_POLY1305) {
+        return "DHKEM-X25519-HKDF-SHA256-HKDF-SHA256-CHACHA20-POLY1305";
+    }
+    throw new ReallyMeCryptoError("unsupported-algorithm");
 };
 export const hpkeSuiteToProto = (value) => {
     switch (value) {
         case "DHKEM-P256-HKDF-SHA256-HKDF-SHA256-AES-256-GCM":
-            return HpkeSuite.DHKEM_P256_HKDF_SHA256_HKDF_SHA256_AES_256_GCM;
+            return create(HpkeSuiteIdentifierSchema, {
+                kem: HpkeKemId.DHKEM_P256_HKDF_SHA256,
+                kdf: HpkeKdfId.HKDF_SHA256,
+                aead: HpkeAeadId.AES_256_GCM,
+            });
         case "DHKEM-X25519-HKDF-SHA256-HKDF-SHA256-CHACHA20-POLY1305":
-            return HpkeSuite.DHKEM_X25519_HKDF_SHA256_HKDF_SHA256_CHACHA20_POLY1305;
+            return create(HpkeSuiteIdentifierSchema, {
+                kem: HpkeKemId.DHKEM_X25519_HKDF_SHA256,
+                kdf: HpkeKdfId.HKDF_SHA256,
+                aead: HpkeAeadId.CHACHA20_POLY1305,
+            });
     }
 };
+const signatureAlgorithmIdentifierToProto = (value) => create(CryptoAlgorithmIdentifierSchema, {
+    algorithm: { case: "signature", value: signatureAlgorithmToProto(value) },
+});
+const keyAgreementAlgorithmIdentifierToProto = (value) => create(CryptoAlgorithmIdentifierSchema, {
+    algorithm: { case: "keyAgreement", value: keyAgreementAlgorithmToProto(value) },
+});
+const kemAlgorithmIdentifierToProto = (value) => create(CryptoAlgorithmIdentifierSchema, {
+    algorithm: { case: "kem", value: kemAlgorithmToProto(value) },
+});
+const hpkeSuiteIdentifierToProto = (value) => create(CryptoAlgorithmIdentifierSchema, {
+    algorithm: { case: "hpkeSuite", value: hpkeSuiteToProto(value) },
+});
+const signatureAlgorithmFromIdentifier = (value) => {
+    if (value?.algorithm.case !== "signature") {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    return signatureAlgorithmFromProto(value.algorithm.value);
+};
+const keyAgreementAlgorithmFromIdentifier = (value) => {
+    if (value?.algorithm.case !== "keyAgreement") {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    return keyAgreementAlgorithmFromProto(value.algorithm.value);
+};
+const kemAlgorithmFromIdentifier = (value) => {
+    if (value?.algorithm.case !== "kem") {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    return kemAlgorithmFromProto(value.algorithm.value);
+};
+const hpkeSuiteFromIdentifier = (value) => {
+    if (value?.algorithm.case !== "hpkeSuite") {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    return hpkeSuiteFromProto(value.algorithm.value);
+};
 export const multicodecKeyAlgorithmFromProto = (value) => {
     switch (value) {
         case MulticodecKeyAlgorithm.ED25519_PUB:
@@ -361,3 +426,663 @@ export const multicodecKeyAlgorithmToProto = (value) => {
             return MulticodecKeyAlgorithm.ML_DSA_87_PUB;
     }
 };
+// The largest supported canonical JWK is below 4 KiB. Keeping a full factor of
+// two for future public-key encodings prevents attacker-controlled allocations
+// and guarantees conversion never depends on an engine's argument-count limit.
+const MAX_JWK_CANONICAL_JCS_LENGTH = 8_192;
+const asciiToBytes = (value) => {
+    if (value.length > MAX_JWK_CANONICAL_JCS_LENGTH) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    const bytes = new Uint8Array(value.length);
+    for (let index = 0; index < value.length; index += 1) {
+        const codeUnit = value.charCodeAt(index);
+        if (codeUnit > 0x7f) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        bytes[index] = codeUnit;
+    }
+    return bytes;
+};
+const asciiFromBytes = (value) => {
+    ensureByteArrayAtMost(value, MAX_JWK_CANONICAL_JCS_LENGTH);
+    const characters = [];
+    for (const byte of value) {
+        if (byte > 0x7f) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        characters.push(String.fromCharCode(byte));
+    }
+    return characters.join("");
+};
+const withJwkProtoBoundaryErrors = (operation) => {
+    try {
+        return operation();
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+const cryptoErrorReasonToFacadeError = (reason) => {
+    switch (reason) {
+        case CryptoErrorReason.PRIMITIVE_INVALID_SIGNATURE:
+        case CryptoErrorReason.PRIMITIVE_VERIFICATION_FAILED:
+            return new ReallyMeCryptoError("invalid-signature");
+        case CryptoErrorReason.PROVIDER_UNSUPPORTED_ALGORITHM:
+        case CryptoErrorReason.PROVIDER_UNSUPPORTED_BACKEND:
+            return new ReallyMeCryptoError("unsupported-algorithm");
+        case CryptoErrorReason.PROVIDER_UNAVAILABLE:
+        case CryptoErrorReason.PROVIDER_RANDOMNESS_UNAVAILABLE:
+        case CryptoErrorReason.PROVIDER_KEY_EXISTS:
+        case CryptoErrorReason.PROVIDER_KEY_NOT_FOUND:
+        case CryptoErrorReason.PROVIDER_ACCESS_DENIED:
+        case CryptoErrorReason.PROVIDER_USER_AUTHENTICATION_REQUIRED:
+        case CryptoErrorReason.PROVIDER_USER_CANCELED:
+        case CryptoErrorReason.PROVIDER_HARDWARE_UNAVAILABLE:
+        case CryptoErrorReason.PROVIDER_HARDWARE_REJECTED_KEY:
+        case CryptoErrorReason.BACKEND_INVALID_STATE:
+        case CryptoErrorReason.BACKEND_INTERNAL:
+            return new ReallyMeCryptoError("provider-failure");
+        case CryptoErrorReason.PRIMITIVE_INVALID_PARAMETER:
+        case CryptoErrorReason.PRIMITIVE_INVALID_LENGTH:
+        case CryptoErrorReason.PRIMITIVE_INVALID_KEY:
+        case CryptoErrorReason.PRIMITIVE_INVALID_PUBLIC_KEY:
+        case CryptoErrorReason.PRIMITIVE_INVALID_PRIVATE_KEY:
+        case CryptoErrorReason.PRIMITIVE_INVALID_NONCE:
+        case CryptoErrorReason.PRIMITIVE_INVALID_SALT:
+        case CryptoErrorReason.PRIMITIVE_INVALID_PASSWORD:
+        case CryptoErrorReason.PRIMITIVE_INVALID_ENCODING:
+        case CryptoErrorReason.PRIMITIVE_INVALID_SHARED_SECRET:
+        case CryptoErrorReason.PRIMITIVE_MALFORMED_CIPHERTEXT:
+        case CryptoErrorReason.PRIMITIVE_INVALID_TAG:
+        case CryptoErrorReason.PRIMITIVE_MALFORMED_PROTOBUF:
+        case CryptoErrorReason.PRIMITIVE_MALFORMED_JSON:
+        case CryptoErrorReason.PRIMITIVE_RESOURCE_LIMIT_EXCEEDED:
+        case CryptoErrorReason.PRIMITIVE_MISSING_OPERATION:
+            return new ReallyMeCryptoError("invalid-input");
+        case CryptoErrorReason.PRIMITIVE_AUTHENTICATION_FAILED:
+            return new ReallyMeCryptoError("authentication-failed");
+        default:
+            return new ReallyMeCryptoError("invalid-input");
+    }
+};
+const invalidInputReasons = new Set([
+    CryptoErrorReason.PRIMITIVE_INVALID_PARAMETER,
+    CryptoErrorReason.PRIMITIVE_INVALID_LENGTH,
+    CryptoErrorReason.PRIMITIVE_INVALID_KEY,
+    CryptoErrorReason.PRIMITIVE_INVALID_PUBLIC_KEY,
+    CryptoErrorReason.PRIMITIVE_INVALID_PRIVATE_KEY,
+    CryptoErrorReason.PRIMITIVE_INVALID_NONCE,
+    CryptoErrorReason.PRIMITIVE_INVALID_SALT,
+    CryptoErrorReason.PRIMITIVE_INVALID_PASSWORD,
+    CryptoErrorReason.PRIMITIVE_INVALID_ENCODING,
+    CryptoErrorReason.PRIMITIVE_INVALID_SHARED_SECRET,
+    CryptoErrorReason.PRIMITIVE_MALFORMED_CIPHERTEXT,
+    CryptoErrorReason.PRIMITIVE_INVALID_TAG,
+    CryptoErrorReason.PRIMITIVE_MALFORMED_PROTOBUF,
+    CryptoErrorReason.PRIMITIVE_MALFORMED_JSON,
+    CryptoErrorReason.PRIMITIVE_RESOURCE_LIMIT_EXCEEDED,
+    CryptoErrorReason.PRIMITIVE_MISSING_OPERATION,
+]);
+export const cryptoWireErrorToProto = (error) => {
+    switch (error.branch) {
+        case "primitive":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "primitive",
+                    value: create(CryptoPrimitiveErrorSchema, {
+                        reason: error.reason,
+                    }),
+                },
+            });
+        case "provider":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "provider",
+                    value: create(CryptoProviderErrorSchema, {
+                        reason: error.reason,
+                    }),
+                },
+            });
+        case "backend":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "backend",
+                    value: create(CryptoBackendErrorSchema, {
+                        reason: error.reason,
+                    }),
+                },
+            });
+    }
+};
+export const cryptoWireErrorFromProto = (value) => {
+    switch (value.error.case) {
+        case "primitive":
+            return strictCryptoWireError("primitive", value.error.value.reason);
+        case "provider":
+            return strictCryptoWireError("provider", value.error.value.reason);
+        case "backend":
+            return strictCryptoWireError("backend", value.error.value.reason);
+        default:
+            return malformedCryptoErrorEnvelope();
+    }
+};
+export const cryptoWireErrorToProtoBytes = (error) => toBinary(CryptoErrorSchema, cryptoWireErrorToProto(error));
+export const cryptoWireErrorFromProtoBytes = (bytes) => {
+    try {
+        return cryptoWireErrorFromProto(fromBinary(CryptoErrorSchema, bytes));
+    }
+    catch {
+        return malformedCryptoErrorEnvelope();
+    }
+};
+const strictCryptoWireError = (branch, reason) => {
+    const result = cryptoWireErrorTryNew(branch, reason);
+    return result.ok ? result.value : malformedCryptoErrorEnvelope();
+};
+export const cryptoWireErrorTryNew = (branch, reason) => {
+    if (reason === CryptoErrorReason.UNSPECIFIED) {
+        return { ok: false, error: "unspecified-reason" };
+    }
+    if (knownCryptoErrorReasons.has(reason) && !cryptoErrorReasonMatchesBranch(branch, reason)) {
+        return { ok: false, error: "branch-reason-mismatch" };
+    }
+    if (!cryptoErrorReasonCodeMatchesBranch(branch, reason)) {
+        return { ok: false, error: "reason-code-out-of-range" };
+    }
+    return { ok: true, value: { branch, reason, reasonCode: reason } };
+};
+const malformedCryptoErrorEnvelope = () => ({
+    branch: "primitive",
+    reason: CryptoErrorReason.PRIMITIVE_MALFORMED_PROTOBUF,
+    reasonCode: CryptoErrorReason.PRIMITIVE_MALFORMED_PROTOBUF,
+});
+const cryptoErrorReasonCodeMatchesBranch = (branch, reasonCode) => {
+    switch (branch) {
+        case "primitive":
+            return reasonCode >= 100 && reasonCode <= 199;
+        case "provider":
+            return reasonCode >= 200 && reasonCode <= 299;
+        case "backend":
+            return reasonCode >= 300 && reasonCode <= 399;
+    }
+};
+const cryptoErrorReasonMatchesBranch = (branch, reason) => {
+    switch (branch) {
+        case "primitive":
+            return primitiveCryptoErrorReasons.has(reason);
+        case "provider":
+            return providerCryptoErrorReasons.has(reason);
+        case "backend":
+            return backendCryptoErrorReasons.has(reason);
+    }
+};
+const primitiveCryptoErrorReasons = new Set([
+    CryptoErrorReason.PRIMITIVE_INVALID_PARAMETER,
+    CryptoErrorReason.PRIMITIVE_INVALID_LENGTH,
+    CryptoErrorReason.PRIMITIVE_INVALID_KEY,
+    CryptoErrorReason.PRIMITIVE_INVALID_PUBLIC_KEY,
+    CryptoErrorReason.PRIMITIVE_INVALID_PRIVATE_KEY,
+    CryptoErrorReason.PRIMITIVE_INVALID_NONCE,
+    CryptoErrorReason.PRIMITIVE_INVALID_SALT,
+    CryptoErrorReason.PRIMITIVE_INVALID_PASSWORD,
+    CryptoErrorReason.PRIMITIVE_INVALID_ENCODING,
+    CryptoErrorReason.PRIMITIVE_INVALID_SIGNATURE,
+    CryptoErrorReason.PRIMITIVE_VERIFICATION_FAILED,
+    CryptoErrorReason.PRIMITIVE_AUTHENTICATION_FAILED,
+    CryptoErrorReason.PRIMITIVE_MALFORMED_CIPHERTEXT,
+    CryptoErrorReason.PRIMITIVE_INVALID_TAG,
+    CryptoErrorReason.PRIMITIVE_INVALID_SHARED_SECRET,
+    CryptoErrorReason.PRIMITIVE_MALFORMED_PROTOBUF,
+    CryptoErrorReason.PRIMITIVE_MALFORMED_JSON,
+    CryptoErrorReason.PRIMITIVE_RESOURCE_LIMIT_EXCEEDED,
+    CryptoErrorReason.PRIMITIVE_MISSING_OPERATION,
+]);
+const providerCryptoErrorReasons = new Set([
+    CryptoErrorReason.PROVIDER_UNSUPPORTED_ALGORITHM,
+    CryptoErrorReason.PROVIDER_UNSUPPORTED_BACKEND,
+    CryptoErrorReason.PROVIDER_UNAVAILABLE,
+    CryptoErrorReason.PROVIDER_RANDOMNESS_UNAVAILABLE,
+    CryptoErrorReason.PROVIDER_KEY_EXISTS,
+    CryptoErrorReason.PROVIDER_KEY_NOT_FOUND,
+    CryptoErrorReason.PROVIDER_ACCESS_DENIED,
+    CryptoErrorReason.PROVIDER_USER_AUTHENTICATION_REQUIRED,
+    CryptoErrorReason.PROVIDER_USER_CANCELED,
+    CryptoErrorReason.PROVIDER_HARDWARE_UNAVAILABLE,
+    CryptoErrorReason.PROVIDER_HARDWARE_REJECTED_KEY,
+]);
+const backendCryptoErrorReasons = new Set([
+    CryptoErrorReason.BACKEND_INVALID_STATE,
+    CryptoErrorReason.BACKEND_INTERNAL,
+]);
+const knownCryptoErrorReasons = new Set([
+    ...primitiveCryptoErrorReasons,
+    ...providerCryptoErrorReasons,
+    ...backendCryptoErrorReasons,
+]);
+export const cryptoWireErrorToFacadeError = (error) => {
+    if (!knownCryptoErrorReasons.has(error.reason)) {
+        return new ReallyMeCryptoError("provider-failure");
+    }
+    const facadeError = cryptoErrorReasonToFacadeError(error.reason);
+    if (facadeError.code !== "invalid-input" || invalidInputReasons.has(error.reason)) {
+        return facadeError;
+    }
+    switch (error.branch) {
+        case "primitive":
+            return facadeError;
+        case "provider":
+        case "backend":
+            return new ReallyMeCryptoError("provider-failure");
+    }
+};
+export const cryptoErrorToProto = (error) => {
+    switch (error.code) {
+        case "invalid-input":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "primitive",
+                    value: create(CryptoPrimitiveErrorSchema, {
+                        reason: CryptoErrorReason.PRIMITIVE_INVALID_PARAMETER,
+                    }),
+                },
+            });
+        case "invalid-signature":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "primitive",
+                    value: create(CryptoPrimitiveErrorSchema, {
+                        reason: CryptoErrorReason.PRIMITIVE_INVALID_SIGNATURE,
+                    }),
+                },
+            });
+        case "authentication-failed":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "primitive",
+                    value: create(CryptoPrimitiveErrorSchema, {
+                        reason: CryptoErrorReason.PRIMITIVE_AUTHENTICATION_FAILED,
+                    }),
+                },
+            });
+        case "provider-failure":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "backend",
+                    value: create(CryptoBackendErrorSchema, {
+                        reason: CryptoErrorReason.BACKEND_INTERNAL,
+                    }),
+                },
+            });
+        case "unsupported-algorithm":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "provider",
+                    value: create(CryptoProviderErrorSchema, {
+                        reason: CryptoErrorReason.PROVIDER_UNSUPPORTED_ALGORITHM,
+                    }),
+                },
+            });
+    }
+};
+export const cryptoErrorToProtoBytes = (error) => toBinary(CryptoErrorSchema, cryptoErrorToProto(error));
+export const cryptoErrorFromProto = (value) => {
+    return cryptoWireErrorToFacadeError(cryptoWireErrorFromProto(value));
+};
+export const cryptoErrorFromProtoBytes = (bytes) => {
+    return cryptoWireErrorToFacadeError(cryptoWireErrorFromProtoBytes(bytes));
+};
+const signatureJwkAlgorithmToProto = (value) => {
+    switch (value) {
+        case "Ed25519":
+            return SignatureAlgorithm.ED25519;
+        case "P-256":
+            return SignatureAlgorithm.ECDSA_P256_SHA256;
+        case "secp256k1":
+            return SignatureAlgorithm.ECDSA_SECP256K1_SHA256;
+        case "ML-DSA-44":
+            return SignatureAlgorithm.ML_DSA_44;
+        case "ML-DSA-65":
+            return SignatureAlgorithm.ML_DSA_65;
+        case "ML-DSA-87":
+            return SignatureAlgorithm.ML_DSA_87;
+        case "SLH-DSA-SHA2-128s":
+            return SignatureAlgorithm.SLH_DSA_SHA2_128S;
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+const jwkAlgorithmToProto = (value) => {
+    switch (value) {
+        case "X25519":
+            return create(CryptoAlgorithmIdentifierSchema, {
+                algorithm: {
+                    case: "keyAgreement",
+                    value: KeyAgreementAlgorithm.X25519,
+                },
+            });
+        case "ML-KEM-512":
+            return create(CryptoAlgorithmIdentifierSchema, {
+                algorithm: {
+                    case: "kem",
+                    value: KemAlgorithm.ML_KEM_512,
+                },
+            });
+        case "ML-KEM-768":
+            return create(CryptoAlgorithmIdentifierSchema, {
+                algorithm: {
+                    case: "kem",
+                    value: KemAlgorithm.ML_KEM_768,
+                },
+            });
+        case "ML-KEM-1024":
+            return create(CryptoAlgorithmIdentifierSchema, {
+                algorithm: {
+                    case: "kem",
+                    value: KemAlgorithm.ML_KEM_1024,
+                },
+            });
+        case "X-Wing-768":
+            return create(CryptoAlgorithmIdentifierSchema, {
+                algorithm: {
+                    case: "kem",
+                    value: KemAlgorithm.X_WING_768,
+                },
+            });
+        default:
+            return create(CryptoAlgorithmIdentifierSchema, {
+                algorithm: {
+                    case: "signature",
+                    value: signatureJwkAlgorithmToProto(value),
+                },
+            });
+    }
+};
+const signatureJwkAlgorithmFromProto = (value) => {
+    switch (value) {
+        case SignatureAlgorithm.ED25519:
+            return "Ed25519";
+        case SignatureAlgorithm.ECDSA_P256_SHA256:
+            return "P-256";
+        case SignatureAlgorithm.ECDSA_SECP256K1_SHA256:
+            return "secp256k1";
+        case SignatureAlgorithm.ML_DSA_44:
+            return "ML-DSA-44";
+        case SignatureAlgorithm.ML_DSA_65:
+            return "ML-DSA-65";
+        case SignatureAlgorithm.ML_DSA_87:
+            return "ML-DSA-87";
+        case SignatureAlgorithm.SLH_DSA_SHA2_128S:
+            return "SLH-DSA-SHA2-128s";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+const jwkAlgorithmFromProto = (value) => {
+    switch (value.algorithm.case) {
+        case "signature":
+            return signatureJwkAlgorithmFromProto(value.algorithm.value);
+        case "keyAgreement":
+            if (value.algorithm.value === KeyAgreementAlgorithm.X25519) {
+                return "X25519";
+            }
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+        case "kem":
+            switch (value.algorithm.value) {
+                case KemAlgorithm.ML_KEM_512:
+                    return "ML-KEM-512";
+                case KemAlgorithm.ML_KEM_768:
+                    return "ML-KEM-768";
+                case KemAlgorithm.ML_KEM_1024:
+                    return "ML-KEM-1024";
+                case KemAlgorithm.X_WING_768:
+                    return "X-Wing-768";
+                default:
+                    throw new ReallyMeCryptoError("unsupported-algorithm");
+            }
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const jsonWebKeyToProto = (key) => create(JsonWebKeySchema, {
+    algorithm: jwkAlgorithmToProto(key.algorithm),
+    publicKey: key.publicKey,
+    canonicalJcs: asciiToBytes(ReallyMeJwk.toJcs(key.jwk)),
+});
+export const jsonWebKeyToProtoBytes = (key) => toBinary(JsonWebKeySchema, jsonWebKeyToProto(key));
+export const jsonWebKeyFromProto = (value) => withJwkProtoBoundaryErrors(() => {
+    // Read each field once so a hostile message proxy cannot change values
+    // between validation and construction.
+    const algorithmValue = value.algorithm;
+    const publicKey = value.publicKey;
+    const canonicalJcs = value.canonicalJcs;
+    const algorithm = algorithmValue === undefined
+        ? undefined
+        : jwkAlgorithmFromProto(algorithmValue);
+    if (algorithm === undefined) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    ensureByteArrayAtMost(publicKey, MAX_CRYPTO_INPUT_LENGTH);
+    const jwk = ReallyMeJwk.toJwk(algorithm, publicKey);
+    if (canonicalJcs.length > 0) {
+        const expected = ReallyMeJwk.toJcs(jwk);
+        if (asciiFromBytes(canonicalJcs) !== expected) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+    }
+    return { algorithm, publicKey, jwk };
+});
+export const jsonWebKeyFromProtoBytes = (bytes) => withJwkProtoBoundaryErrors(() => {
+    ensureByteArrayAtMost(bytes, MAX_CRYPTO_INPUT_LENGTH);
+    return jsonWebKeyFromProto(fromBinary(JsonWebKeySchema, bytes));
+});
+export const jsonWebKeySetToProto = (keySet) => create(JsonWebKeySetSchema, {
+    keys: keySet.keys.map((key) => jsonWebKeyToProto(key)),
+});
+export const jsonWebKeySetToProtoBytes = (keySet) => toBinary(JsonWebKeySetSchema, jsonWebKeySetToProto(keySet));
+export const jsonWebKeySetFromProto = (value) => withJwkProtoBoundaryErrors(() => {
+    const keys = value.keys;
+    if (!Array.isArray(keys) || keys.length > MAX_JWKS_KEYS) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    return { keys: keys.map((key) => jsonWebKeyFromProto(key)) };
+});
+export const jsonWebKeySetFromProtoBytes = (bytes) => withJwkProtoBoundaryErrors(() => {
+    ensureByteArrayAtMost(bytes, MAX_CRYPTO_INPUT_LENGTH);
+    return jsonWebKeySetFromProto(fromBinary(JsonWebKeySetSchema, bytes));
+});
+const keyPairToProto = (algorithm, keyPair) => create(CryptoKeyPairSchema, {
+    algorithm,
+    publicKey: keyPair.publicKey,
+    secretKey: keyPair.secretKey,
+});
+export const signatureKeyPairToProto = (algorithm, keyPair) => keyPairToProto(signatureAlgorithmIdentifierToProto(algorithm), keyPair);
+export const signatureKeyPairToProtoBytes = (algorithm, keyPair) => toBinary(CryptoKeyPairSchema, signatureKeyPairToProto(algorithm, keyPair));
+export const signatureKeyPairFromProto = (value) => ({
+    algorithm: signatureAlgorithmFromIdentifier(value.algorithm),
+    keyPair: {
+        publicKey: value.publicKey,
+        secretKey: value.secretKey,
+    },
+});
+export const signatureKeyPairFromProtoBytes = (bytes) => {
+    try {
+        return signatureKeyPairFromProto(fromBinary(CryptoKeyPairSchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const keyAgreementKeyPairToProto = (algorithm, keyPair) => keyPairToProto(keyAgreementAlgorithmIdentifierToProto(algorithm), keyPair);
+export const keyAgreementKeyPairToProtoBytes = (algorithm, keyPair) => toBinary(CryptoKeyPairSchema, keyAgreementKeyPairToProto(algorithm, keyPair));
+export const keyAgreementKeyPairFromProto = (value) => ({
+    algorithm: keyAgreementAlgorithmFromIdentifier(value.algorithm),
+    keyPair: {
+        publicKey: value.publicKey,
+        secretKey: value.secretKey,
+    },
+});
+export const keyAgreementKeyPairFromProtoBytes = (bytes) => {
+    try {
+        return keyAgreementKeyPairFromProto(fromBinary(CryptoKeyPairSchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const kemKeyPairToProto = (algorithm, keyPair) => keyPairToProto(kemAlgorithmIdentifierToProto(algorithm), keyPair);
+export const kemKeyPairToProtoBytes = (algorithm, keyPair) => toBinary(CryptoKeyPairSchema, kemKeyPairToProto(algorithm, keyPair));
+export const kemKeyPairFromProto = (value) => ({
+    algorithm: kemAlgorithmFromIdentifier(value.algorithm),
+    keyPair: {
+        publicKey: value.publicKey,
+        secretKey: value.secretKey,
+    },
+});
+export const kemKeyPairFromProtoBytes = (bytes) => {
+    try {
+        return kemKeyPairFromProto(fromBinary(CryptoKeyPairSchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const kemEncapsulationToProto = (algorithm, encapsulation) => create(CryptoKemEncapsulationSchema, {
+    algorithm: kemAlgorithmIdentifierToProto(algorithm),
+    ciphertext: encapsulation.ciphertext,
+    sharedSecret: encapsulation.sharedSecret,
+});
+export const kemEncapsulationToProtoBytes = (algorithm, encapsulation) => toBinary(CryptoKemEncapsulationSchema, kemEncapsulationToProto(algorithm, encapsulation));
+export const kemEncapsulationFromProto = (value) => ({
+    algorithm: kemAlgorithmFromIdentifier(value.algorithm),
+    encapsulation: {
+        ciphertext: value.ciphertext,
+        sharedSecret: value.sharedSecret,
+    },
+});
+export const kemEncapsulationFromProtoBytes = (bytes) => {
+    try {
+        return kemEncapsulationFromProto(fromBinary(CryptoKemEncapsulationSchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const hpkeSealedMessageToProto = (suite, sealedMessage) => create(CryptoHpkeSealedMessageSchema, {
+    algorithm: hpkeSuiteIdentifierToProto(suite),
+    encapsulatedKey: sealedMessage.encapsulatedKey,
+    ciphertext: sealedMessage.ciphertext,
+});
+export const hpkeSealedMessageToProtoBytes = (suite, sealedMessage) => toBinary(CryptoHpkeSealedMessageSchema, hpkeSealedMessageToProto(suite, sealedMessage));
+export const hpkeSealedMessageFromProto = (value) => ({
+    suite: hpkeSuiteFromIdentifier(value.algorithm),
+    sealedMessage: {
+        encapsulatedKey: value.encapsulatedKey,
+        ciphertext: value.ciphertext,
+    },
+});
+export const hpkeSealedMessageFromProtoBytes = (bytes) => {
+    try {
+        return hpkeSealedMessageFromProto(fromBinary(CryptoHpkeSealedMessageSchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const verificationResultToProto = (algorithm, valid) => create(CryptoVerificationResultSchema, {
+    algorithm,
+    status: valid ? CryptoVerificationStatus.VALID : CryptoVerificationStatus.INVALID,
+});
+export const verificationErrorToProto = (algorithm, error) => create(CryptoVerificationResultSchema, {
+    algorithm,
+    status: CryptoVerificationStatus.ERROR,
+    error: cryptoErrorToProto(error),
+});
+export const verificationResultToProtoBytes = (value) => toBinary(CryptoVerificationResultSchema, value);
+export const verificationResultFromProtoBytes = (bytes) => {
+    try {
+        return fromBinary(CryptoVerificationResultSchema, bytes);
+    }
+    catch {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+const providerSupportStatusToProto = (value) => {
+    switch (value) {
+        case "partial":
+            return CryptoProviderSupportStatus.PARTIAL;
+        case "provider-aware":
+            return CryptoProviderSupportStatus.PROVIDER_AWARE;
+        case "supported":
+            return CryptoProviderSupportStatus.SUPPORTED;
+        case "unsupported":
+            return CryptoProviderSupportStatus.UNSUPPORTED;
+    }
+};
+const providerSupportStatusFromProto = (value) => {
+    switch (value) {
+        case CryptoProviderSupportStatus.PARTIAL:
+            return "partial";
+        case CryptoProviderSupportStatus.PROVIDER_AWARE:
+            return "provider-aware";
+        case CryptoProviderSupportStatus.SUPPORTED:
+            return "supported";
+        case CryptoProviderSupportStatus.UNSUPPORTED:
+            return "unsupported";
+        default:
+            throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const providerCapabilityToProto = (value) => create(CryptoProviderCapabilitySchema, {
+    algorithm: value.algorithm,
+    family: value.family,
+    providerNames: [...value.providerNames],
+    status: providerSupportStatusToProto(value.status),
+    usesRust: value.usesRust,
+});
+export const providerCapabilityFromProto = (value) => {
+    if (value.algorithm === undefined || value.family === CryptoAlgorithmFamily.UNSPECIFIED) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    return {
+        algorithm: value.algorithm,
+        family: value.family,
+        providerNames: [...value.providerNames],
+        status: providerSupportStatusFromProto(value.status),
+        usesRust: value.usesRust,
+    };
+};
+export const providerCapabilitySetToProto = (values) => create(CryptoProviderCapabilitySetSchema, {
+    capabilities: values.map((value) => providerCapabilityToProto(value)),
+});
+export const providerCapabilitySetToProtoBytes = (values) => toBinary(CryptoProviderCapabilitySetSchema, providerCapabilitySetToProto(values));
+export const providerCapabilitySetFromProto = (value) => value.capabilities.map((capability) => providerCapabilityFromProto(capability));
+export const providerCapabilitySetFromProtoBytes = (bytes) => {
+    try {
+        return providerCapabilitySetFromProto(fromBinary(CryptoProviderCapabilitySetSchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};