@reallyme/crypto 0.3.9 → 0.3.11

package/README.md

@@ -42,9 +42,11 @@ Classical primitives are backed by pinned `@noble` packages. The primitives that
 must stay identical to Rust — ML-KEM, ML-DSA, SLH-DSA, X-Wing, Argon2id, HPKE,
 and others — are backed by a WASM module that ships prebuilt with the package.
 
-Applications may either install the WASM provider once for the package-level
-`ReallyMeCrypto` convenience API, or build isolated facade instances with an
-explicit provider object. Missing WASM providers fail closed with
+Applications may install the package's initialized WASM module once for the
+package-level `ReallyMeCrypto` convenience API, or build isolated facade
+instances with `createReallyMeWasmProvider` and the same package-owned module.
+Both paths reject replacement verification functions. Explicit facades reject
+structural provider objects; missing or untrusted providers fail with
 `provider-failure`. JWK/JWKS helpers delegate base64url and JCS canonicalization
 to the published `@reallyme/codec` package, so applications that use those
 helpers should also install the Codec WASM provider.
@@ -66,8 +68,8 @@ import {
 } from "@reallyme/crypto";
 import { initSync as initCryptoWasm } from "@reallyme/crypto/wasm/reallyme_crypto_wasm.js";
 
-// Provider constructors validate the dynamically imported module as `unknown`
-// against the package's explicit required-export list.
+// Both the global installer and explicit facade bind to this package's
+// initialized module namespace after verifying callable identity.
 const wasmProvider: unknown = await import(
   "@reallyme/crypto/wasm/reallyme_crypto_wasm.js"
 );
@@ -94,15 +96,12 @@ const keyPair = ReallyMeCrypto.generateKemKeyPair("X-Wing-768");
 const isolatedKeyPair = isolatedCrypto.generateKemKeyPair("X-Wing-768");
 ```
 
-The explicit facade form is preferred for Workers, SSR, tests, and multi-bundle
-applications because each instance owns its provider routing and does not depend
-on package-global mutable state.
+The explicit facade form is useful for Workers, SSR, tests, and multi-bundle
+applications because each instance owns its provider routing. The provider
+must come from this package's initialized WASM module.
 
 The package-owned WASM provider derives ML-DSA, ML-KEM, and X-Wing seed-based
 keypairs inside Rust and returns the public key produced by that implementation.
-Custom provider objects are trusted providers: if an application supplies its
-own seed-derived keypair provider, it is responsible for public-key
-correspondence and must be covered by its own conformance evidence.
 
 ## Raw WASM Module Contract
 

package/dist/aead.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";

package/dist/aesKw.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";

package/dist/algorithms.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 export const REALLYME_SIGNATURE_ALGORITHMS = [

package/dist/argon2id.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";

package/dist/bip340Schnorr.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { schnorr, secp256k1 } from "@noble/curves/secp256k1.js";

package/dist/cryptoFacade.d.ts

@@ -1,5 +1,3 @@
-import type { ReallyMeAeadAlgorithm, ReallyMeHashAlgorithm, ReallyMeHkdfAlgorithm, ReallyMeHpkeSuite, ReallyMeJwaConcatKdfAlgorithm, ReallyMeKemAlgorithm, ReallyMeKeyAgreementAlgorithm, ReallyMeKeyWrapAlgorithm, ReallyMeKmacKdfAlgorithm, ReallyMeMacAlgorithm, ReallyMePbkdf2Algorithm, ReallyMeSignatureAlgorithm } from "./algorithms.js";
-import type { ReallyMeRsaPublicKeyDerEncoding } from "./rsa.js";
 import type { ReallyMeWasmProvider } from "./wasmProvider.js";
 export type ReallyMeSignatureKeyPair = Readonly<{
     publicKey: Uint8Array;
@@ -30,84 +28,65 @@ export type ReallyMeCryptoProviders = Readonly<{
  * stable typed route and rejects algorithm/operation combinations that the
  * selected method does not define.
  */
-declare const createReallyMeCryptoFacade: (resolveWasmProvider: () => ReallyMeWasmProvider) => {
-    /**
-     * Executes a generated binary request and returns a binary
-     * `CryptoOperationResponse`.
-     */
-    readonly processOperationResponse: (request: Uint8Array) => Uint8Array;
-    /**
-     * Executes a permitted non-secret generated ProtoJSON request and returns
-     * the same binary `CryptoOperationResponse`. Secret-bearing selectors fail
-     * before JSON value deserialization.
-     */
-    readonly processOperationResponseJson: (requestJson: Uint8Array) => Uint8Array;
-    readonly hash: (algorithm: ReallyMeHashAlgorithm, bytes: Uint8Array) => Uint8Array;
-    readonly seal: (algorithm: ReallyMeAeadAlgorithm, key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array) => Uint8Array;
-    readonly open: (algorithm: ReallyMeAeadAlgorithm, key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ciphertextWithTag: Uint8Array) => Uint8Array;
-    readonly authenticate: (algorithm: ReallyMeMacAlgorithm, key: Uint8Array, message: Uint8Array) => Uint8Array;
-    readonly verifyMac: (algorithm: ReallyMeMacAlgorithm, tag: Uint8Array, key: Uint8Array, message: Uint8Array) => boolean;
-    readonly deriveArgon2id: (kdfVersion: number, secret: Uint8Array, salt: Uint8Array) => Uint8Array;
-    readonly deriveKey: (algorithm: ReallyMePbkdf2Algorithm, password: Uint8Array, salt: Uint8Array, iterations: number, outputLength: number) => Uint8Array;
-    readonly deriveHkdf: (algorithm: ReallyMeHkdfAlgorithm, inputKeyMaterial: Uint8Array, salt: Uint8Array, info: Uint8Array, outputLength: number) => Uint8Array;
-    readonly deriveJwaConcatKdfSha256: (algorithm: ReallyMeJwaConcatKdfAlgorithm, sharedSecret: Uint8Array, algorithmId: Uint8Array, partyUInfo: Uint8Array, partyVInfo: Uint8Array, outputLength: number) => Uint8Array;
-    readonly deriveKmac256: (algorithm: ReallyMeKmacKdfAlgorithm, key: Uint8Array, context: Uint8Array, customization: Uint8Array, outputLength: number) => Uint8Array;
-    readonly wrapKey: (algorithm: ReallyMeKeyWrapAlgorithm, wrappingKey: Uint8Array, keyToWrap: Uint8Array) => Uint8Array;
-    readonly unwrapKey: (algorithm: ReallyMeKeyWrapAlgorithm, wrappingKey: Uint8Array, wrappedKey: Uint8Array) => Uint8Array;
-    readonly generateKeyPair: (algorithm: ReallyMeSignatureAlgorithm) => ReallyMeSignatureKeyPair;
-    readonly deriveKeyPair: (algorithm: ReallyMeSignatureAlgorithm, secretKey: Uint8Array) => ReallyMeSignatureKeyPair;
-    readonly sign: (algorithm: ReallyMeSignatureAlgorithm, message: Uint8Array, secretKey: Uint8Array) => Uint8Array;
-    readonly signBip340Schnorr: (message32: Uint8Array, secretKey: Uint8Array, auxRand32: Uint8Array) => Uint8Array;
-    readonly verify: (algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array) => void;
-    readonly verifyRsa: (algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKeyDer: Uint8Array, publicKeyEncoding: ReallyMeRsaPublicKeyDerEncoding) => void;
-    readonly deriveSharedSecret: (algorithm: ReallyMeKeyAgreementAlgorithm, publicKey: Uint8Array, secretKey: Uint8Array) => Uint8Array;
-    readonly deriveKeyAgreementKeyPair: (algorithm: ReallyMeKeyAgreementAlgorithm, secretKey: Uint8Array) => ReallyMeKeyAgreementKeyPair;
-    readonly generateKemKeyPair: (algorithm: ReallyMeKemAlgorithm) => ReallyMeKemKeyPair;
-    readonly deriveKemKeyPair: (algorithm: ReallyMeKemAlgorithm, secretKey: Uint8Array) => ReallyMeKemKeyPair;
-    readonly encapsulate: (algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array) => ReallyMeKemEncapsulation;
-    readonly decapsulate: (algorithm: ReallyMeKemAlgorithm, ciphertext: Uint8Array, secretKey: Uint8Array) => Uint8Array;
-    readonly sealHpke: (suite: ReallyMeHpkeSuite, recipientPublicKey: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array) => ReallyMeHpkeSealedMessage;
-    readonly openHpke: (suite: ReallyMeHpkeSuite, recipientSecretKey: Uint8Array, encapsulatedKey: Uint8Array, info: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array) => Uint8Array;
-};
+export declare const createReallyMeCryptoFacade: (resolveWasmProvider: () => ReallyMeWasmProvider) => Readonly<{
+    generateKeyPair(algorithm: import("./algorithms.js").ReallyMeSignatureAlgorithm): ReallyMeSignatureKeyPair;
+    deriveKeyPair(algorithm: import("./algorithms.js").ReallyMeSignatureAlgorithm, secretKey: Uint8Array): ReallyMeSignatureKeyPair;
+    sign(algorithm: import("./algorithms.js").ReallyMeSignatureAlgorithm, message: Uint8Array, secretKey: Uint8Array): Uint8Array;
+    signBip340Schnorr(message32: Uint8Array, secretKey: Uint8Array, auxRand32: Uint8Array): Uint8Array;
+    verify(algorithm: import("./algorithms.js").ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array): void;
+    verifyRsa(algorithm: import("./algorithms.js").ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKeyDer: Uint8Array, publicKeyEncoding: import("./rsa.js").ReallyMeRsaPublicKeyDerEncoding): void;
+    deriveSharedSecret(algorithm: import("./algorithms.js").ReallyMeKeyAgreementAlgorithm, publicKey: Uint8Array, secretKey: Uint8Array): Uint8Array;
+    deriveKeyAgreementKeyPair(algorithm: import("./algorithms.js").ReallyMeKeyAgreementAlgorithm, secretKey: Uint8Array): ReallyMeKeyAgreementKeyPair;
+    generateKemKeyPair(algorithm: import("./algorithms.js").ReallyMeKemAlgorithm): ReallyMeKemKeyPair;
+    deriveKemKeyPair(algorithm: import("./algorithms.js").ReallyMeKemAlgorithm, secretKey: Uint8Array): ReallyMeKemKeyPair;
+    encapsulate(algorithm: import("./algorithms.js").ReallyMeKemAlgorithm, publicKey: Uint8Array): ReallyMeKemEncapsulation;
+    decapsulate(algorithm: import("./algorithms.js").ReallyMeKemAlgorithm, ciphertext: Uint8Array, secretKey: Uint8Array): Uint8Array;
+    sealHpke(suite: import("./algorithms.js").ReallyMeHpkeSuite, recipientPublicKey: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): ReallyMeHpkeSealedMessage;
+    openHpke(suite: import("./algorithms.js").ReallyMeHpkeSuite, recipientSecretKey: Uint8Array, encapsulatedKey: Uint8Array, info: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array): Uint8Array;
+    processOperationResponse(request: Uint8Array): Uint8Array;
+    processOperationResponseJson(requestJson: Uint8Array): Uint8Array;
+    hash(algorithm: import("./algorithms.js").ReallyMeHashAlgorithm, bytes: Uint8Array): Uint8Array;
+    seal(algorithm: import("./algorithms.js").ReallyMeAeadAlgorithm, key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): Uint8Array;
+    open(algorithm: import("./algorithms.js").ReallyMeAeadAlgorithm, key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ciphertextWithTag: Uint8Array): Uint8Array;
+    authenticate(algorithm: import("./algorithms.js").ReallyMeMacAlgorithm, key: Uint8Array, message: Uint8Array): Uint8Array;
+    verifyMac(algorithm: import("./algorithms.js").ReallyMeMacAlgorithm, tag: Uint8Array, key: Uint8Array, message: Uint8Array): void;
+    deriveArgon2id(kdfVersion: number, secret: Uint8Array, salt: Uint8Array): Uint8Array;
+    deriveKey(algorithm: import("./algorithms.js").ReallyMePbkdf2Algorithm, password: Uint8Array, salt: Uint8Array, iterations: number, outputLength: number): Uint8Array;
+    deriveHkdf(algorithm: import("./algorithms.js").ReallyMeHkdfAlgorithm, inputKeyMaterial: Uint8Array, salt: Uint8Array, info: Uint8Array, outputLength: number): Uint8Array;
+    deriveJwaConcatKdfSha256(algorithm: import("./algorithms.js").ReallyMeJwaConcatKdfAlgorithm, sharedSecret: Uint8Array, algorithmId: Uint8Array, partyUInfo: Uint8Array, partyVInfo: Uint8Array, outputLength: number): Uint8Array;
+    deriveKmac256(algorithm: import("./algorithms.js").ReallyMeKmacKdfAlgorithm, key: Uint8Array, context: Uint8Array, customization: Uint8Array, outputLength: number): Uint8Array;
+    wrapKey(algorithm: import("./algorithms.js").ReallyMeKeyWrapAlgorithm, wrappingKey: Uint8Array, keyToWrap: Uint8Array): Uint8Array;
+    unwrapKey(algorithm: import("./algorithms.js").ReallyMeKeyWrapAlgorithm, wrappingKey: Uint8Array, wrappedKey: Uint8Array): Uint8Array;
+}>;
 export type ReallyMeCryptoFacade = ReturnType<typeof createReallyMeCryptoFacade>;
 export declare const createReallyMeCrypto: (providers?: ReallyMeCryptoProviders) => ReallyMeCryptoFacade;
-export declare const ReallyMeCrypto: {
-    /**
-     * Executes a generated binary request and returns a binary
-     * `CryptoOperationResponse`.
-     */
-    readonly processOperationResponse: (request: Uint8Array) => Uint8Array;
-    /**
-     * Executes a permitted non-secret generated ProtoJSON request and returns
-     * the same binary `CryptoOperationResponse`. Secret-bearing selectors fail
-     * before JSON value deserialization.
-     */
-    readonly processOperationResponseJson: (requestJson: Uint8Array) => Uint8Array;
-    readonly hash: (algorithm: ReallyMeHashAlgorithm, bytes: Uint8Array) => Uint8Array;
-    readonly seal: (algorithm: ReallyMeAeadAlgorithm, key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array) => Uint8Array;
-    readonly open: (algorithm: ReallyMeAeadAlgorithm, key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ciphertextWithTag: Uint8Array) => Uint8Array;
-    readonly authenticate: (algorithm: ReallyMeMacAlgorithm, key: Uint8Array, message: Uint8Array) => Uint8Array;
-    readonly verifyMac: (algorithm: ReallyMeMacAlgorithm, tag: Uint8Array, key: Uint8Array, message: Uint8Array) => boolean;
-    readonly deriveArgon2id: (kdfVersion: number, secret: Uint8Array, salt: Uint8Array) => Uint8Array;
-    readonly deriveKey: (algorithm: ReallyMePbkdf2Algorithm, password: Uint8Array, salt: Uint8Array, iterations: number, outputLength: number) => Uint8Array;
-    readonly deriveHkdf: (algorithm: ReallyMeHkdfAlgorithm, inputKeyMaterial: Uint8Array, salt: Uint8Array, info: Uint8Array, outputLength: number) => Uint8Array;
-    readonly deriveJwaConcatKdfSha256: (algorithm: ReallyMeJwaConcatKdfAlgorithm, sharedSecret: Uint8Array, algorithmId: Uint8Array, partyUInfo: Uint8Array, partyVInfo: Uint8Array, outputLength: number) => Uint8Array;
-    readonly deriveKmac256: (algorithm: ReallyMeKmacKdfAlgorithm, key: Uint8Array, context: Uint8Array, customization: Uint8Array, outputLength: number) => Uint8Array;
-    readonly wrapKey: (algorithm: ReallyMeKeyWrapAlgorithm, wrappingKey: Uint8Array, keyToWrap: Uint8Array) => Uint8Array;
-    readonly unwrapKey: (algorithm: ReallyMeKeyWrapAlgorithm, wrappingKey: Uint8Array, wrappedKey: Uint8Array) => Uint8Array;
-    readonly generateKeyPair: (algorithm: ReallyMeSignatureAlgorithm) => ReallyMeSignatureKeyPair;
-    readonly deriveKeyPair: (algorithm: ReallyMeSignatureAlgorithm, secretKey: Uint8Array) => ReallyMeSignatureKeyPair;
-    readonly sign: (algorithm: ReallyMeSignatureAlgorithm, message: Uint8Array, secretKey: Uint8Array) => Uint8Array;
-    readonly signBip340Schnorr: (message32: Uint8Array, secretKey: Uint8Array, auxRand32: Uint8Array) => Uint8Array;
-    readonly verify: (algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array) => void;
-    readonly verifyRsa: (algorithm: ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKeyDer: Uint8Array, publicKeyEncoding: ReallyMeRsaPublicKeyDerEncoding) => void;
-    readonly deriveSharedSecret: (algorithm: ReallyMeKeyAgreementAlgorithm, publicKey: Uint8Array, secretKey: Uint8Array) => Uint8Array;
-    readonly deriveKeyAgreementKeyPair: (algorithm: ReallyMeKeyAgreementAlgorithm, secretKey: Uint8Array) => ReallyMeKeyAgreementKeyPair;
-    readonly generateKemKeyPair: (algorithm: ReallyMeKemAlgorithm) => ReallyMeKemKeyPair;
-    readonly deriveKemKeyPair: (algorithm: ReallyMeKemAlgorithm, secretKey: Uint8Array) => ReallyMeKemKeyPair;
-    readonly encapsulate: (algorithm: ReallyMeKemAlgorithm, publicKey: Uint8Array) => ReallyMeKemEncapsulation;
-    readonly decapsulate: (algorithm: ReallyMeKemAlgorithm, ciphertext: Uint8Array, secretKey: Uint8Array) => Uint8Array;
-    readonly sealHpke: (suite: ReallyMeHpkeSuite, recipientPublicKey: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array) => ReallyMeHpkeSealedMessage;
-    readonly openHpke: (suite: ReallyMeHpkeSuite, recipientSecretKey: Uint8Array, encapsulatedKey: Uint8Array, info: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array) => Uint8Array;
-};
-export {};
+export declare const ReallyMeCrypto: Readonly<{
+    generateKeyPair(algorithm: import("./algorithms.js").ReallyMeSignatureAlgorithm): ReallyMeSignatureKeyPair;
+    deriveKeyPair(algorithm: import("./algorithms.js").ReallyMeSignatureAlgorithm, secretKey: Uint8Array): ReallyMeSignatureKeyPair;
+    sign(algorithm: import("./algorithms.js").ReallyMeSignatureAlgorithm, message: Uint8Array, secretKey: Uint8Array): Uint8Array;
+    signBip340Schnorr(message32: Uint8Array, secretKey: Uint8Array, auxRand32: Uint8Array): Uint8Array;
+    verify(algorithm: import("./algorithms.js").ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array): void;
+    verifyRsa(algorithm: import("./algorithms.js").ReallyMeSignatureAlgorithm, signature: Uint8Array, message: Uint8Array, publicKeyDer: Uint8Array, publicKeyEncoding: import("./rsa.js").ReallyMeRsaPublicKeyDerEncoding): void;
+    deriveSharedSecret(algorithm: import("./algorithms.js").ReallyMeKeyAgreementAlgorithm, publicKey: Uint8Array, secretKey: Uint8Array): Uint8Array;
+    deriveKeyAgreementKeyPair(algorithm: import("./algorithms.js").ReallyMeKeyAgreementAlgorithm, secretKey: Uint8Array): ReallyMeKeyAgreementKeyPair;
+    generateKemKeyPair(algorithm: import("./algorithms.js").ReallyMeKemAlgorithm): ReallyMeKemKeyPair;
+    deriveKemKeyPair(algorithm: import("./algorithms.js").ReallyMeKemAlgorithm, secretKey: Uint8Array): ReallyMeKemKeyPair;
+    encapsulate(algorithm: import("./algorithms.js").ReallyMeKemAlgorithm, publicKey: Uint8Array): ReallyMeKemEncapsulation;
+    decapsulate(algorithm: import("./algorithms.js").ReallyMeKemAlgorithm, ciphertext: Uint8Array, secretKey: Uint8Array): Uint8Array;
+    sealHpke(suite: import("./algorithms.js").ReallyMeHpkeSuite, recipientPublicKey: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): ReallyMeHpkeSealedMessage;
+    openHpke(suite: import("./algorithms.js").ReallyMeHpkeSuite, recipientSecretKey: Uint8Array, encapsulatedKey: Uint8Array, info: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array): Uint8Array;
+    processOperationResponse(request: Uint8Array): Uint8Array;
+    processOperationResponseJson(requestJson: Uint8Array): Uint8Array;
+    hash(algorithm: import("./algorithms.js").ReallyMeHashAlgorithm, bytes: Uint8Array): Uint8Array;
+    seal(algorithm: import("./algorithms.js").ReallyMeAeadAlgorithm, key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): Uint8Array;
+    open(algorithm: import("./algorithms.js").ReallyMeAeadAlgorithm, key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ciphertextWithTag: Uint8Array): Uint8Array;
+    authenticate(algorithm: import("./algorithms.js").ReallyMeMacAlgorithm, key: Uint8Array, message: Uint8Array): Uint8Array;
+    verifyMac(algorithm: import("./algorithms.js").ReallyMeMacAlgorithm, tag: Uint8Array, key: Uint8Array, message: Uint8Array): void;
+    deriveArgon2id(kdfVersion: number, secret: Uint8Array, salt: Uint8Array): Uint8Array;
+    deriveKey(algorithm: import("./algorithms.js").ReallyMePbkdf2Algorithm, password: Uint8Array, salt: Uint8Array, iterations: number, outputLength: number): Uint8Array;
+    deriveHkdf(algorithm: import("./algorithms.js").ReallyMeHkdfAlgorithm, inputKeyMaterial: Uint8Array, salt: Uint8Array, info: Uint8Array, outputLength: number): Uint8Array;
+    deriveJwaConcatKdfSha256(algorithm: import("./algorithms.js").ReallyMeJwaConcatKdfAlgorithm, sharedSecret: Uint8Array, algorithmId: Uint8Array, partyUInfo: Uint8Array, partyVInfo: Uint8Array, outputLength: number): Uint8Array;
+    deriveKmac256(algorithm: import("./algorithms.js").ReallyMeKmacKdfAlgorithm, key: Uint8Array, context: Uint8Array, customization: Uint8Array, outputLength: number): Uint8Array;
+    wrapKey(algorithm: import("./algorithms.js").ReallyMeKeyWrapAlgorithm, wrappingKey: Uint8Array, keyToWrap: Uint8Array): Uint8Array;
+    unwrapKey(algorithm: import("./algorithms.js").ReallyMeKeyWrapAlgorithm, wrappingKey: Uint8Array, wrappedKey: Uint8Array): Uint8Array;
+}>;