@reallyme/crypto 0.3.9 → 0.3.11

package/dist/jwk.js

@@ -1,10 +1,11 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { p256 } from "@noble/curves/nist.js";
 import { secp256k1 } from "@noble/curves/secp256k1.js";
 import { base64urlDecode as codecBase64urlDecodeValue, base64urlEncode as codecBase64urlEncodeValue, canonicalizeJson as codecCanonicalizeJson, ReallyMeCodecError, } from "@reallyme/codec";
 import { ReallyMeCryptoError } from "./errors.js";
+import { validateEd25519PublicKeyIdentity } from "./ed25519.js";
 // JSON and protobuf JWKS ingress routes share this limit so neither boundary
 // can amplify a small public-key record into unbounded curve validation work.
 export const MAX_JWKS_KEYS = 1_024;
@@ -68,11 +69,27 @@ const ensureExactMembers = (value, allowedNames) => {
     if (typeof value !== "object" || value === null) {
         throw new ReallyMeCryptoError("invalid-input");
     }
-    for (const name of Reflect.ownKeys(value)) {
-        if (typeof name !== "string" || !allowedNames.includes(name)) {
+    const names = Reflect.ownKeys(value);
+    if (names.length > 16) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    for (const name of names) {
+        if (typeof name !== "string" ||
+            (!allowedNames.includes(name) && name !== "kid" && !name.startsWith("x-"))) {
             throw new ReallyMeCryptoError("invalid-input");
         }
     }
+    optionalString(value, "kid");
+};
+const optionalString = (value, name) => {
+    if (typeof value !== "object" || value === null) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    const descriptor = Object.getOwnPropertyDescriptor(value, name);
+    if (descriptor !== undefined &&
+        (!("value" in descriptor) || typeof descriptor.value !== "string")) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
 };
 const privateJwkMemberNames = [
     "d",
@@ -199,10 +216,31 @@ const toJcs = (jwk) => {
         throw mapCodecError(error);
     }
 };
+const isCanonicalX25519Identity = (publicKey) => {
+    if (publicKey.length !== 32) {
+        return false;
+    }
+    const highByte = publicKey[31];
+    const lowByte = publicKey[0];
+    if (highByte === undefined || lowByte === undefined || highByte > 0x7f) {
+        return false;
+    }
+    // RFC 7748 agreement accepts non-canonical u-coordinates. JWK identifiers
+    // reject p through 2^255-1 so one field element has one encoding.
+    return highByte !== 0x7f
+        || publicKey.subarray(1, 31).some((byte) => byte !== 0xff)
+        || lowByte < 0xed;
+};
 export const ReallyMeJwk = {
     toJwk(algorithm, publicKey) {
         const spec = jwkSpec(algorithm);
         ensureLength(publicKey, spec.publicKeyLength);
+        if (algorithm === "Ed25519") {
+            validateEd25519PublicKeyIdentity(publicKey);
+        }
+        if (algorithm === "X25519" && !isCanonicalX25519Identity(publicKey)) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
         if (spec.kty === "EC") {
             const ecAlgorithm = spec.crv === "P-256" ? "P-256" : "secp256k1";
             const uncompressed = decompressEc(ecAlgorithm, publicKey);
@@ -247,10 +285,8 @@ export const ReallyMeJwk = {
             }
             if (spec.kty === "EC") {
                 ensureExactMembers(value, ["alg", "crv", "kty", "use", "x", "y"]);
-                if (readString(value, "alg") !== spec.alg ||
-                    readString(value, "use") !== spec.use) {
-                    throw new ReallyMeCryptoError("invalid-input");
-                }
+                optionalStringMatches(value, "alg", spec.alg);
+                optionalStringMatches(value, "use", spec.use);
                 const ecAlgorithm = spec.crv === "P-256" ? "P-256" : "secp256k1";
                 const x = codecBase64urlDecodeCanonical(readString(value, "x"));
                 const y = codecBase64urlDecodeCanonical(readString(value, "y"));
@@ -274,9 +310,7 @@ export const ReallyMeJwk = {
             }
             const algorithm = readString(value, "alg");
             ensureExactMembers(value, ["alg", "kty", "pub", "use"]);
-            if (readString(value, "use") !== spec.use) {
-                throw new ReallyMeCryptoError("invalid-input");
-            }
+            optionalStringMatches(value, "use", spec.use);
             const akpSpec = specFromAlgorithm(algorithm);
             const publicKey = codecBase64urlDecodeCanonical(readString(value, "pub"));
             ensureLength(publicKey, akpSpec.publicKeyLength);
@@ -302,7 +336,8 @@ export const ReallyMeJwk = {
     },
     fromJwks(value) {
         return withJwkBoundaryErrors(() => {
-            ensureExactMembers(value, ["keys"]);
+            // RFC 7517 permits additional set-level members. They do not alter the
+            // public-key identities extracted from the required keys array.
             if (typeof value !== "object" || value === null) {
                 throw new ReallyMeCryptoError("invalid-input");
             }

package/dist/kmac.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";

package/dist/memory.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 /**

package/dist/mlDsa.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";

package/dist/mlKem.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";

package/dist/operationResponse.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";

package/dist/p256Ecdh.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { p256 } from "@noble/curves/nist.js";

package/dist/p256Ecdsa.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { p256 } from "@noble/curves/nist.js";

package/dist/p384Ecdh.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { p384 } from "@noble/curves/nist.js";

package/dist/p384Ecdsa.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { p384 } from "@noble/curves/nist.js";

package/dist/p521Ecdh.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { p521 } from "@noble/curves/nist.js";

package/dist/p521Ecdsa.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { p521 } from "@noble/curves/nist.js";

package/dist/pbkdf2.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { pbkdf2 } from "@noble/hashes/pbkdf2.js";
@@ -16,6 +16,9 @@ export const PBKDF2_MIN_ITERATIONS = 100_000;
 export const PBKDF2_MAX_ITERATIONS = 10_000_000;
 export const PBKDF2_MIN_OUTPUT_LENGTH = 1;
 export const PBKDF2_MAX_OUTPUT_LENGTH = 4096;
+const PBKDF2_SHA256_OUTPUT_LENGTH = 32;
+const PBKDF2_SHA512_OUTPUT_LENGTH = 64;
+const PBKDF2_MAX_HMAC_EVALUATIONS = 20_000_000;
 /**
  * OWASP Password Storage Cheat Sheet minimum iteration counts for deriving a
  * *new* password key.
@@ -30,7 +33,7 @@ export const ReallyMePbkdf2 = {
      * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA256} iterations.
      */
     deriveHmacSha256(password, salt, iterations, outputLength) {
-        validate(password, salt, iterations, outputLength);
+        validate(password, salt, iterations, outputLength, PBKDF2_SHA256_OUTPUT_LENGTH);
         return pbkdf2(sha256, password, salt, { c: iterations, dkLen: outputLength });
     },
     /**
@@ -38,11 +41,11 @@ export const ReallyMePbkdf2 = {
      * {@link PBKDF2_RECOMMENDED_MIN_ITERATIONS_SHA512} iterations.
      */
     deriveHmacSha512(password, salt, iterations, outputLength) {
-        validate(password, salt, iterations, outputLength);
+        validate(password, salt, iterations, outputLength, PBKDF2_SHA512_OUTPUT_LENGTH);
         return pbkdf2(sha512, password, salt, { c: iterations, dkLen: outputLength });
     },
 };
-function validate(password, salt, iterations, outputLength) {
+function validate(password, salt, iterations, outputLength, digestLength) {
     ensureByteArray(password);
     ensureByteArray(salt);
     if (password.length < PBKDF2_MIN_INPUT_LENGTH ||
@@ -57,4 +60,9 @@ function validate(password, salt, iterations, outputLength) {
         outputLength > PBKDF2_MAX_OUTPUT_LENGTH) {
         throw new ReallyMeCryptoError("invalid-input");
     }
+    const blockCount = Math.ceil(outputLength / digestLength);
+    const evaluations = iterations * blockCount;
+    if (!Number.isSafeInteger(evaluations) || evaluations > PBKDF2_MAX_HMAC_EVALUATIONS) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
 }

package/dist/proto/generated/reallyme/crypto/v1/crypto_pb.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { enumDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";

package/dist/proto.d.ts

@@ -1,119 +1,10 @@
-import type { ReallyMeAeadAlgorithm, ReallyMeHashAlgorithm, ReallyMeHpkeSuite, ReallyMeKdfAlgorithm, ReallyMeKemAlgorithm, ReallyMeKeyAgreementAlgorithm, ReallyMeKeyWrapAlgorithm, ReallyMeMacAlgorithm, ReallyMeSignatureAlgorithm } from "./algorithms.js";
-import { ReallyMeCryptoError } from "./errors.js";
-import type { ReallyMeHpkeSealedMessage, ReallyMeKemEncapsulation, ReallyMeKemKeyPair, ReallyMeKeyAgreementKeyPair, ReallyMeSignatureKeyPair } from "./cryptoFacade.js";
-import type { ReallyMeJwkKey, ReallyMeJwksKeySet } from "./jwk.js";
 export { AeadAlgorithm, AeadAlgorithmSchema, CryptoAlgorithmFamily, CryptoAlgorithmFamilySchema, CryptoAlgorithmIdentifierSchema, CryptoAeadOpenRequestSchema, CryptoAeadOpenResultSchema, CryptoAeadSealRequestSchema, CryptoAeadSealResultSchema, CryptoBackendErrorSchema, CryptoBip340SchnorrSignRequestSchema, CryptoErrorSchema, CryptoErrorReason, CryptoErrorReasonSchema, CryptoHashRequestSchema, CryptoHashResultSchema, CryptoHkdfDeriveRequestSchema, CryptoHkdfDeriveResultSchema, CryptoHpkeOpenRequestSchema, CryptoHpkeOpenResultSchema, CryptoHpkeSealRequestSchema, CryptoHpkeSealedMessageSchema, CryptoJwaConcatKdfSha256DeriveRequestSchema, CryptoJwaConcatKdfSha256DeriveResultSchema, CryptoKdfDeriveKeyRequestSchema, CryptoKdfDeriveKeyResultSchema, CryptoKemEncapsulationSchema, CryptoKemDecapsulateRequestSchema, CryptoKemDecapsulateResultSchema, CryptoKemEncapsulateRequestSchema, CryptoKemDeriveKeyPairRequestSchema, CryptoKemGenerateKeyPairRequestSchema, CryptoKeyAgreementDeriveKeyPairRequestSchema, CryptoKeyAgreementDeriveSharedSecretRequestSchema, CryptoKeyAgreementDeriveSharedSecretResultSchema, CryptoKeyPairSchema, CryptoKeyUnwrapRequestSchema, CryptoKeyUnwrapResultSchema, CryptoKeyWrapRequestSchema, CryptoKeyWrapResultSchema, CryptoMacAuthenticateRequestSchema, CryptoMacAuthenticateResultSchema, CryptoMacVerifyRequestSchema, CryptoOperationRequestSchema, CryptoOperationResponseSchema, CryptoOperationResultSchema, CryptoPrimitiveErrorSchema, CryptoProviderErrorSchema, CryptoProviderCapabilitySchema, CryptoProviderCapabilitySetSchema, CryptoProviderSupportStatus, CryptoProviderSupportStatusSchema, CryptoRsaVerifyRequestSchema, CryptoSignatureDeriveKeyPairRequestSchema, CryptoSignatureGenerateKeyPairRequestSchema, CryptoSignatureSignRequestSchema, CryptoSignatureSignResultSchema, CryptoSignatureVerifyRequestSchema, CryptoVerificationResultSchema, CryptoVerificationStatus, CryptoVerificationStatusSchema, HashAlgorithm, HashAlgorithmSchema, HpkeAeadId, HpkeAeadIdSchema, HpkeKdfId, HpkeKdfIdSchema, HpkeKemId, HpkeKemIdSchema, HpkeSuiteIdentifierSchema, JsonWebKeySchema, JsonWebKeySetSchema, KdfAlgorithm, KdfAlgorithmSchema, KemAlgorithm, KemAlgorithmSchema, KeyAgreementAlgorithm, KeyAgreementAlgorithmSchema, KeyWrapAlgorithm, KeyWrapAlgorithmSchema, MacAlgorithm, MacAlgorithmSchema, MulticodecKeyAlgorithm, MulticodecKeyAlgorithmSchema, SignatureAlgorithm, SignatureAlgorithmSchema, file_reallyme_crypto_v1_crypto, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
 export type { CryptoAlgorithmIdentifier, CryptoAeadOpenRequest, CryptoAeadOpenResult, CryptoAeadSealRequest, CryptoAeadSealResult, CryptoBackendError, CryptoBip340SchnorrSignRequest, CryptoError, CryptoHashRequest, CryptoHashResult, CryptoHkdfDeriveRequest, CryptoHkdfDeriveResult, CryptoHpkeOpenRequest, CryptoHpkeOpenResult, CryptoHpkeSealRequest, CryptoHpkeSealedMessage, CryptoJwaConcatKdfSha256DeriveRequest, CryptoJwaConcatKdfSha256DeriveResult, CryptoKdfDeriveKeyRequest, CryptoKdfDeriveKeyResult, CryptoKemEncapsulation, CryptoKemDecapsulateRequest, CryptoKemDecapsulateResult, CryptoKemEncapsulateRequest, CryptoKemDeriveKeyPairRequest, CryptoKemGenerateKeyPairRequest, CryptoKeyAgreementDeriveKeyPairRequest, CryptoKeyAgreementDeriveSharedSecretRequest, CryptoKeyAgreementDeriveSharedSecretResult, CryptoKeyPair, CryptoKeyUnwrapRequest, CryptoKeyUnwrapResult, CryptoKeyWrapRequest, CryptoKeyWrapResult, CryptoMacAuthenticateRequest, CryptoMacAuthenticateResult, CryptoMacVerifyRequest, CryptoOperationRequest, CryptoOperationResponse, CryptoOperationResult, CryptoPrimitiveError, CryptoProviderCapability, CryptoProviderCapabilitySet, CryptoProviderError, CryptoRsaVerifyRequest, CryptoSignatureDeriveKeyPairRequest, CryptoSignatureGenerateKeyPairRequest, CryptoSignatureSignRequest, CryptoSignatureSignResult, CryptoSignatureVerifyRequest, CryptoVerificationResult, HpkeSuiteIdentifier, JsonWebKey, JsonWebKeySet, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
-import { AeadAlgorithm, HashAlgorithm, KdfAlgorithm, KemAlgorithm, KeyAgreementAlgorithm, KeyWrapAlgorithm, MacAlgorithm, MulticodecKeyAlgorithm, SignatureAlgorithm, CryptoAlgorithmFamily, CryptoErrorReason } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
-import type { CryptoAlgorithmIdentifier, CryptoError, CryptoHpkeSealedMessage, CryptoKemEncapsulation, CryptoKeyPair, CryptoProviderCapability, CryptoProviderCapabilitySet, CryptoVerificationResult, HpkeSuiteIdentifier, JsonWebKey, JsonWebKeySet } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
-export type ReallyMeCryptoWireErrorBranch = "primitive" | "provider" | "backend";
-export type ReallyMeCryptoWireError = Readonly<{
-    branch: ReallyMeCryptoWireErrorBranch;
-    reason: CryptoErrorReason;
-    reasonCode?: number;
-}>;
-export type ReallyMeCryptoWireErrorValidationCode = "unspecified-reason" | "branch-reason-mismatch" | "reason-code-out-of-range";
-export type ReallyMeCryptoWireErrorValidationResult = Readonly<{
-    ok: true;
-    value: ReallyMeCryptoWireError;
-}> | Readonly<{
-    ok: false;
-    error: ReallyMeCryptoWireErrorValidationCode;
-}>;
-export type ReallyMeMulticodecKeyAlgorithm = "ed25519-pub" | "x25519-pub" | "secp256k1-pub" | "p256-pub" | "p384-pub" | "p521-pub" | "ed448-pub" | "rsa-pub" | "mlkem-512-pub" | "mlkem-768-pub" | "mlkem-1024-pub" | "mldsa-44-pub" | "mldsa-65-pub" | "mldsa-87-pub";
-export type ReallyMeProviderSupportStatus = "partial" | "provider-aware" | "supported" | "unsupported";
-export type ReallyMeProviderCapability = Readonly<{
-    algorithm: CryptoAlgorithmIdentifier;
-    family: CryptoAlgorithmFamily;
-    providerNames: ReadonlyArray<string>;
-    status: ReallyMeProviderSupportStatus;
-    usesRust: boolean;
-}>;
-export type ReallyMeSignatureKeyPairProtoValue = Readonly<{
-    algorithm: ReallyMeSignatureAlgorithm;
-    keyPair: ReallyMeSignatureKeyPair;
-}>;
-export type ReallyMeKeyAgreementKeyPairProtoValue = Readonly<{
-    algorithm: ReallyMeKeyAgreementAlgorithm;
-    keyPair: ReallyMeKeyAgreementKeyPair;
-}>;
-export type ReallyMeKemKeyPairProtoValue = Readonly<{
-    algorithm: ReallyMeKemAlgorithm;
-    keyPair: ReallyMeKemKeyPair;
-}>;
-export type ReallyMeKemEncapsulationProtoValue = Readonly<{
-    algorithm: ReallyMeKemAlgorithm;
-    encapsulation: ReallyMeKemEncapsulation;
-}>;
-export type ReallyMeHpkeSealedMessageProtoValue = Readonly<{
-    sealedMessage: ReallyMeHpkeSealedMessage;
-    suite: ReallyMeHpkeSuite;
-}>;
-export declare const signatureAlgorithmFromProto: (value: SignatureAlgorithm) => ReallyMeSignatureAlgorithm;
-export declare const signatureAlgorithmToProto: (value: ReallyMeSignatureAlgorithm) => SignatureAlgorithm;
-export declare const hashAlgorithmFromProto: (value: HashAlgorithm) => ReallyMeHashAlgorithm;
-export declare const hashAlgorithmToProto: (value: ReallyMeHashAlgorithm) => HashAlgorithm;
-export declare const aeadAlgorithmFromProto: (value: AeadAlgorithm) => ReallyMeAeadAlgorithm;
-export declare const aeadAlgorithmToProto: (value: ReallyMeAeadAlgorithm) => AeadAlgorithm;
-export declare const kemAlgorithmFromProto: (value: KemAlgorithm) => ReallyMeKemAlgorithm;
-export declare const kemAlgorithmToProto: (value: ReallyMeKemAlgorithm) => KemAlgorithm;
-export declare const keyAgreementAlgorithmFromProto: (value: KeyAgreementAlgorithm) => ReallyMeKeyAgreementAlgorithm;
-export declare const keyAgreementAlgorithmToProto: (value: ReallyMeKeyAgreementAlgorithm) => KeyAgreementAlgorithm;
-export declare const macAlgorithmFromProto: (value: MacAlgorithm) => ReallyMeMacAlgorithm;
-export declare const macAlgorithmToProto: (value: ReallyMeMacAlgorithm) => MacAlgorithm;
-export declare const kdfAlgorithmFromProto: (value: KdfAlgorithm) => ReallyMeKdfAlgorithm;
-export declare const kdfAlgorithmToProto: (value: ReallyMeKdfAlgorithm) => KdfAlgorithm;
-export declare const keyWrapAlgorithmFromProto: (value: KeyWrapAlgorithm) => ReallyMeKeyWrapAlgorithm;
-export declare const keyWrapAlgorithmToProto: (value: ReallyMeKeyWrapAlgorithm) => KeyWrapAlgorithm;
-export declare const hpkeSuiteFromProto: (value: HpkeSuiteIdentifier) => ReallyMeHpkeSuite;
-export declare const hpkeSuiteToProto: (value: ReallyMeHpkeSuite) => HpkeSuiteIdentifier;
-export declare const multicodecKeyAlgorithmFromProto: (value: MulticodecKeyAlgorithm) => ReallyMeMulticodecKeyAlgorithm;
-export declare const multicodecKeyAlgorithmToProto: (value: ReallyMeMulticodecKeyAlgorithm) => MulticodecKeyAlgorithm;
-export declare const cryptoWireErrorToProto: (error: ReallyMeCryptoWireError) => CryptoError;
-export declare const cryptoWireErrorFromProto: (value: CryptoError) => ReallyMeCryptoWireError;
-export declare const cryptoWireErrorToProtoBytes: (error: ReallyMeCryptoWireError) => Uint8Array;
-export declare const cryptoWireErrorFromProtoBytes: (bytes: Uint8Array) => ReallyMeCryptoWireError;
-export declare const cryptoWireErrorTryNew: (branch: ReallyMeCryptoWireErrorBranch, reason: CryptoErrorReason) => ReallyMeCryptoWireErrorValidationResult;
-export declare const cryptoWireErrorToFacadeError: (error: ReallyMeCryptoWireError) => ReallyMeCryptoError;
-export declare const cryptoErrorToProto: (error: ReallyMeCryptoError) => CryptoError;
-export declare const cryptoErrorToProtoBytes: (error: ReallyMeCryptoError) => Uint8Array;
-export declare const cryptoErrorFromProto: (value: CryptoError) => ReallyMeCryptoError;
-export declare const cryptoErrorFromProtoBytes: (bytes: Uint8Array) => ReallyMeCryptoError;
-export declare const jsonWebKeyToProto: (key: ReallyMeJwkKey) => JsonWebKey;
-export declare const jsonWebKeyToProtoBytes: (key: ReallyMeJwkKey) => Uint8Array;
-export declare const jsonWebKeyFromProto: (value: JsonWebKey) => ReallyMeJwkKey;
-export declare const jsonWebKeyFromProtoBytes: (bytes: Uint8Array) => ReallyMeJwkKey;
-export declare const jsonWebKeySetToProto: (keySet: ReallyMeJwksKeySet) => JsonWebKeySet;
-export declare const jsonWebKeySetToProtoBytes: (keySet: ReallyMeJwksKeySet) => Uint8Array;
-export declare const jsonWebKeySetFromProto: (value: JsonWebKeySet) => ReallyMeJwksKeySet;
-export declare const jsonWebKeySetFromProtoBytes: (bytes: Uint8Array) => ReallyMeJwksKeySet;
-export declare const signatureKeyPairToProto: (algorithm: ReallyMeSignatureAlgorithm, keyPair: ReallyMeSignatureKeyPair) => CryptoKeyPair;
-export declare const signatureKeyPairToProtoBytes: (algorithm: ReallyMeSignatureAlgorithm, keyPair: ReallyMeSignatureKeyPair) => Uint8Array;
-export declare const signatureKeyPairFromProto: (value: CryptoKeyPair) => ReallyMeSignatureKeyPairProtoValue;
-export declare const signatureKeyPairFromProtoBytes: (bytes: Uint8Array) => ReallyMeSignatureKeyPairProtoValue;
-export declare const keyAgreementKeyPairToProto: (algorithm: ReallyMeKeyAgreementAlgorithm, keyPair: ReallyMeKeyAgreementKeyPair) => CryptoKeyPair;
-export declare const keyAgreementKeyPairToProtoBytes: (algorithm: ReallyMeKeyAgreementAlgorithm, keyPair: ReallyMeKeyAgreementKeyPair) => Uint8Array;
-export declare const keyAgreementKeyPairFromProto: (value: CryptoKeyPair) => ReallyMeKeyAgreementKeyPairProtoValue;
-export declare const keyAgreementKeyPairFromProtoBytes: (bytes: Uint8Array) => ReallyMeKeyAgreementKeyPairProtoValue;
-export declare const kemKeyPairToProto: (algorithm: ReallyMeKemAlgorithm, keyPair: ReallyMeKemKeyPair) => CryptoKeyPair;
-export declare const kemKeyPairToProtoBytes: (algorithm: ReallyMeKemAlgorithm, keyPair: ReallyMeKemKeyPair) => Uint8Array;
-export declare const kemKeyPairFromProto: (value: CryptoKeyPair) => ReallyMeKemKeyPairProtoValue;
-export declare const kemKeyPairFromProtoBytes: (bytes: Uint8Array) => ReallyMeKemKeyPairProtoValue;
-export declare const kemEncapsulationToProto: (algorithm: ReallyMeKemAlgorithm, encapsulation: ReallyMeKemEncapsulation) => CryptoKemEncapsulation;
-export declare const kemEncapsulationToProtoBytes: (algorithm: ReallyMeKemAlgorithm, encapsulation: ReallyMeKemEncapsulation) => Uint8Array;
-export declare const kemEncapsulationFromProto: (value: CryptoKemEncapsulation) => ReallyMeKemEncapsulationProtoValue;
-export declare const kemEncapsulationFromProtoBytes: (bytes: Uint8Array) => ReallyMeKemEncapsulationProtoValue;
-export declare const hpkeSealedMessageToProto: (suite: ReallyMeHpkeSuite, sealedMessage: ReallyMeHpkeSealedMessage) => CryptoHpkeSealedMessage;
-export declare const hpkeSealedMessageToProtoBytes: (suite: ReallyMeHpkeSuite, sealedMessage: ReallyMeHpkeSealedMessage) => Uint8Array;
-export declare const hpkeSealedMessageFromProto: (value: CryptoHpkeSealedMessage) => ReallyMeHpkeSealedMessageProtoValue;
-export declare const hpkeSealedMessageFromProtoBytes: (bytes: Uint8Array) => ReallyMeHpkeSealedMessageProtoValue;
-export declare const verificationResultToProto: (algorithm: CryptoAlgorithmIdentifier, valid: boolean) => CryptoVerificationResult;
-export declare const verificationErrorToProto: (algorithm: CryptoAlgorithmIdentifier, error: ReallyMeCryptoError) => CryptoVerificationResult;
-export declare const verificationResultToProtoBytes: (value: CryptoVerificationResult) => Uint8Array;
-export declare const verificationResultFromProtoBytes: (bytes: Uint8Array) => CryptoVerificationResult;
-export declare const providerCapabilityToProto: (value: ReallyMeProviderCapability) => CryptoProviderCapability;
-export declare const providerCapabilityFromProto: (value: CryptoProviderCapability) => ReallyMeProviderCapability;
-export declare const providerCapabilitySetToProto: (values: ReadonlyArray<ReallyMeProviderCapability>) => CryptoProviderCapabilitySet;
-export declare const providerCapabilitySetToProtoBytes: (values: ReadonlyArray<ReallyMeProviderCapability>) => Uint8Array;
-export declare const providerCapabilitySetFromProto: (value: CryptoProviderCapabilitySet) => readonly ReallyMeProviderCapability[];
-export declare const providerCapabilitySetFromProtoBytes: (bytes: Uint8Array) => readonly ReallyMeProviderCapability[];
+export { aeadAlgorithmFromProto, aeadAlgorithmToProto, hashAlgorithmFromProto, hashAlgorithmToProto, hpkeSuiteFromProto, hpkeSuiteToProto, kdfAlgorithmFromProto, kdfAlgorithmToProto, kemAlgorithmFromProto, kemAlgorithmToProto, keyAgreementAlgorithmFromProto, keyAgreementAlgorithmToProto, keyWrapAlgorithmFromProto, keyWrapAlgorithmToProto, macAlgorithmFromProto, macAlgorithmToProto, signatureAlgorithmFromProto, signatureAlgorithmToProto, } from "./protoAlgorithms.js";
+export { multicodecKeyAlgorithmFromProto, multicodecKeyAlgorithmToProto, } from "./protoIdentifiers.js";
+export type { ReallyMeMulticodecKeyAlgorithm } from "./protoIdentifiers.js";
+export { cryptoErrorFromProto, cryptoErrorFromProtoBytes, cryptoErrorToProto, cryptoErrorToProtoBytes, cryptoWireErrorFromProto, cryptoWireErrorFromProtoBytes, cryptoWireErrorToFacadeError, cryptoWireErrorToProto, cryptoWireErrorToProtoBytes, cryptoWireErrorTryNew, } from "./protoErrors.js";
+export type { ReallyMeCryptoWireError, ReallyMeCryptoWireErrorBranch, ReallyMeCryptoWireErrorValidationCode, ReallyMeCryptoWireErrorValidationResult, } from "./protoErrors.js";
+export { jsonWebKeyFromProto, jsonWebKeyFromProtoBytes, jsonWebKeySetFromProto, jsonWebKeySetFromProtoBytes, jsonWebKeySetToProto, jsonWebKeySetToProtoBytes, jsonWebKeyToProto, jsonWebKeyToProtoBytes, } from "./protoJwk.js";
+export { hpkeSealedMessageFromProto, hpkeSealedMessageFromProtoBytes, hpkeSealedMessageToProto, hpkeSealedMessageToProtoBytes, kemEncapsulationFromProto, kemEncapsulationFromProtoBytes, kemEncapsulationToProto, kemEncapsulationToProtoBytes, kemKeyPairFromProto, kemKeyPairFromProtoBytes, kemKeyPairToProto, kemKeyPairToProtoBytes, keyAgreementKeyPairFromProto, keyAgreementKeyPairFromProtoBytes, keyAgreementKeyPairToProto, keyAgreementKeyPairToProtoBytes, providerCapabilityFromProto, providerCapabilitySetFromProto, providerCapabilitySetFromProtoBytes, providerCapabilitySetToProto, providerCapabilitySetToProtoBytes, providerCapabilityToProto, signatureKeyPairFromProto, signatureKeyPairFromProtoBytes, signatureKeyPairToProto, signatureKeyPairToProtoBytes, verificationErrorToProto, verificationResultFromProtoBytes, verificationResultToProto, verificationResultToProtoBytes, } from "./protoValues.js";
+export type { ReallyMeHpkeSealedMessageProtoValue, ReallyMeKemEncapsulationProtoValue, ReallyMeKemKeyPairProtoValue, ReallyMeKeyAgreementKeyPairProtoValue, ReallyMeProviderCapability, ReallyMeProviderSupportStatus, ReallyMeSignatureKeyPairProtoValue, } from "./protoValues.js";