@reallyme/crypto 0.3.9 → 0.3.11

package/dist/protoAlgorithms.d.ts

@@ -0,0 +1,21 @@
+import type { ReallyMeAeadAlgorithm, ReallyMeHashAlgorithm, ReallyMeHpkeSuite, ReallyMeKdfAlgorithm, ReallyMeKemAlgorithm, ReallyMeKeyAgreementAlgorithm, ReallyMeKeyWrapAlgorithm, ReallyMeMacAlgorithm, ReallyMeSignatureAlgorithm } from "./algorithms.js";
+import { AeadAlgorithm, HashAlgorithm, KdfAlgorithm, KemAlgorithm, KeyAgreementAlgorithm, KeyWrapAlgorithm, MacAlgorithm, SignatureAlgorithm } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+import type { HpkeSuiteIdentifier } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+export declare const signatureAlgorithmFromProto: (value: SignatureAlgorithm) => ReallyMeSignatureAlgorithm;
+export declare const signatureAlgorithmToProto: (value: ReallyMeSignatureAlgorithm) => SignatureAlgorithm;
+export declare const hashAlgorithmFromProto: (value: HashAlgorithm) => ReallyMeHashAlgorithm;
+export declare const hashAlgorithmToProto: (value: ReallyMeHashAlgorithm) => HashAlgorithm;
+export declare const aeadAlgorithmFromProto: (value: AeadAlgorithm) => ReallyMeAeadAlgorithm;
+export declare const aeadAlgorithmToProto: (value: ReallyMeAeadAlgorithm) => AeadAlgorithm;
+export declare const kemAlgorithmFromProto: (value: KemAlgorithm) => ReallyMeKemAlgorithm;
+export declare const kemAlgorithmToProto: (value: ReallyMeKemAlgorithm) => KemAlgorithm;
+export declare const keyAgreementAlgorithmFromProto: (value: KeyAgreementAlgorithm) => ReallyMeKeyAgreementAlgorithm;
+export declare const keyAgreementAlgorithmToProto: (value: ReallyMeKeyAgreementAlgorithm) => KeyAgreementAlgorithm;
+export declare const macAlgorithmFromProto: (value: MacAlgorithm) => ReallyMeMacAlgorithm;
+export declare const macAlgorithmToProto: (value: ReallyMeMacAlgorithm) => MacAlgorithm;
+export declare const kdfAlgorithmFromProto: (value: KdfAlgorithm) => ReallyMeKdfAlgorithm;
+export declare const kdfAlgorithmToProto: (value: ReallyMeKdfAlgorithm) => KdfAlgorithm;
+export declare const keyWrapAlgorithmFromProto: (value: KeyWrapAlgorithm) => ReallyMeKeyWrapAlgorithm;
+export declare const keyWrapAlgorithmToProto: (value: ReallyMeKeyWrapAlgorithm) => KeyWrapAlgorithm;
+export declare const hpkeSuiteFromProto: (value: HpkeSuiteIdentifier) => ReallyMeHpkeSuite;
+export declare const hpkeSuiteToProto: (value: ReallyMeHpkeSuite) => HpkeSuiteIdentifier;

package/dist/protoAlgorithms.js

@@ -0,0 +1,323 @@
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
+//
+// SPDX-License-Identifier: MIT OR Apache-2.0
+import { create } from "@bufbuild/protobuf";
+import { ReallyMeCryptoError } from "./errors.js";
+import { AeadAlgorithm, HashAlgorithm, HpkeAeadId, HpkeKdfId, HpkeKemId, HpkeSuiteIdentifierSchema, KdfAlgorithm, KemAlgorithm, KeyAgreementAlgorithm, KeyWrapAlgorithm, MacAlgorithm, SignatureAlgorithm, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+export const signatureAlgorithmFromProto = (value) => {
+    switch (value) {
+        case SignatureAlgorithm.ED25519:
+            return "Ed25519";
+        case SignatureAlgorithm.ECDSA_P256_SHA256:
+            return "ECDSA-P256-SHA256";
+        case SignatureAlgorithm.ECDSA_P384_SHA384:
+            return "ECDSA-P384-SHA384";
+        case SignatureAlgorithm.ECDSA_P521_SHA512:
+            return "ECDSA-P521-SHA512";
+        case SignatureAlgorithm.ECDSA_SECP256K1_SHA256:
+            return "ECDSA-secp256k1-SHA256";
+        case SignatureAlgorithm.BIP340_SCHNORR_SECP256K1_SHA256:
+            return "BIP340-Schnorr-secp256k1-SHA256";
+        case SignatureAlgorithm.RSA_PKCS1V15_SHA1:
+            return "RSA-PKCS1v15-SHA1";
+        case SignatureAlgorithm.RSA_PKCS1V15_SHA256:
+            return "RSA-PKCS1v15-SHA256";
+        case SignatureAlgorithm.RSA_PKCS1V15_SHA384:
+            return "RSA-PKCS1v15-SHA384";
+        case SignatureAlgorithm.RSA_PKCS1V15_SHA512:
+            return "RSA-PKCS1v15-SHA512";
+        case SignatureAlgorithm.RSA_PSS_SHA1_MGF1_SHA1:
+            return "RSA-PSS-SHA1-MGF1-SHA1";
+        case SignatureAlgorithm.RSA_PSS_SHA256_MGF1_SHA256:
+            return "RSA-PSS-SHA256-MGF1-SHA256";
+        case SignatureAlgorithm.RSA_PSS_SHA384_MGF1_SHA384:
+            return "RSA-PSS-SHA384-MGF1-SHA384";
+        case SignatureAlgorithm.RSA_PSS_SHA512_MGF1_SHA512:
+            return "RSA-PSS-SHA512-MGF1-SHA512";
+        case SignatureAlgorithm.ML_DSA_44:
+            return "ML-DSA-44";
+        case SignatureAlgorithm.ML_DSA_65:
+            return "ML-DSA-65";
+        case SignatureAlgorithm.ML_DSA_87:
+            return "ML-DSA-87";
+        case SignatureAlgorithm.SLH_DSA_SHA2_128S:
+            return "SLH-DSA-SHA2-128s";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const signatureAlgorithmToProto = (value) => {
+    switch (value) {
+        case "Ed25519":
+            return SignatureAlgorithm.ED25519;
+        case "ECDSA-P256-SHA256":
+            return SignatureAlgorithm.ECDSA_P256_SHA256;
+        case "ECDSA-P384-SHA384":
+            return SignatureAlgorithm.ECDSA_P384_SHA384;
+        case "ECDSA-P521-SHA512":
+            return SignatureAlgorithm.ECDSA_P521_SHA512;
+        case "ECDSA-secp256k1-SHA256":
+            return SignatureAlgorithm.ECDSA_SECP256K1_SHA256;
+        case "BIP340-Schnorr-secp256k1-SHA256":
+            return SignatureAlgorithm.BIP340_SCHNORR_SECP256K1_SHA256;
+        case "RSA-PKCS1v15-SHA1":
+            return SignatureAlgorithm.RSA_PKCS1V15_SHA1;
+        case "RSA-PKCS1v15-SHA256":
+            return SignatureAlgorithm.RSA_PKCS1V15_SHA256;
+        case "RSA-PKCS1v15-SHA384":
+            return SignatureAlgorithm.RSA_PKCS1V15_SHA384;
+        case "RSA-PKCS1v15-SHA512":
+            return SignatureAlgorithm.RSA_PKCS1V15_SHA512;
+        case "RSA-PSS-SHA1-MGF1-SHA1":
+            return SignatureAlgorithm.RSA_PSS_SHA1_MGF1_SHA1;
+        case "RSA-PSS-SHA256-MGF1-SHA256":
+            return SignatureAlgorithm.RSA_PSS_SHA256_MGF1_SHA256;
+        case "RSA-PSS-SHA384-MGF1-SHA384":
+            return SignatureAlgorithm.RSA_PSS_SHA384_MGF1_SHA384;
+        case "RSA-PSS-SHA512-MGF1-SHA512":
+            return SignatureAlgorithm.RSA_PSS_SHA512_MGF1_SHA512;
+        case "ML-DSA-44":
+            return SignatureAlgorithm.ML_DSA_44;
+        case "ML-DSA-65":
+            return SignatureAlgorithm.ML_DSA_65;
+        case "ML-DSA-87":
+            return SignatureAlgorithm.ML_DSA_87;
+        case "SLH-DSA-SHA2-128s":
+            return SignatureAlgorithm.SLH_DSA_SHA2_128S;
+    }
+};
+export const hashAlgorithmFromProto = (value) => {
+    switch (value) {
+        case HashAlgorithm.SHA2_256:
+            return "SHA2-256";
+        case HashAlgorithm.SHA2_384:
+            return "SHA2-384";
+        case HashAlgorithm.SHA2_512:
+            return "SHA2-512";
+        case HashAlgorithm.SHA3_224:
+            return "SHA3-224";
+        case HashAlgorithm.SHA3_256:
+            return "SHA3-256";
+        case HashAlgorithm.SHA3_384:
+            return "SHA3-384";
+        case HashAlgorithm.SHA3_512:
+            return "SHA3-512";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const hashAlgorithmToProto = (value) => {
+    switch (value) {
+        case "SHA2-256":
+            return HashAlgorithm.SHA2_256;
+        case "SHA2-384":
+            return HashAlgorithm.SHA2_384;
+        case "SHA2-512":
+            return HashAlgorithm.SHA2_512;
+        case "SHA3-224":
+            return HashAlgorithm.SHA3_224;
+        case "SHA3-256":
+            return HashAlgorithm.SHA3_256;
+        case "SHA3-384":
+            return HashAlgorithm.SHA3_384;
+        case "SHA3-512":
+            return HashAlgorithm.SHA3_512;
+    }
+};
+export const aeadAlgorithmFromProto = (value) => {
+    switch (value) {
+        case AeadAlgorithm.AES_128_GCM:
+            return "AES-128-GCM";
+        case AeadAlgorithm.AES_192_GCM:
+            return "AES-192-GCM";
+        case AeadAlgorithm.AES_256_GCM:
+            return "AES-256-GCM";
+        case AeadAlgorithm.AES_256_GCM_SIV:
+            return "AES-256-GCM-SIV";
+        case AeadAlgorithm.CHACHA20_POLY1305:
+            return "ChaCha20-Poly1305";
+        case AeadAlgorithm.XCHACHA20_POLY1305:
+            return "XChaCha20-Poly1305";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const aeadAlgorithmToProto = (value) => {
+    switch (value) {
+        case "AES-128-GCM":
+            return AeadAlgorithm.AES_128_GCM;
+        case "AES-192-GCM":
+            return AeadAlgorithm.AES_192_GCM;
+        case "AES-256-GCM":
+            return AeadAlgorithm.AES_256_GCM;
+        case "AES-256-GCM-SIV":
+            return AeadAlgorithm.AES_256_GCM_SIV;
+        case "ChaCha20-Poly1305":
+            return AeadAlgorithm.CHACHA20_POLY1305;
+        case "XChaCha20-Poly1305":
+            return AeadAlgorithm.XCHACHA20_POLY1305;
+    }
+};
+export const kemAlgorithmFromProto = (value) => {
+    switch (value) {
+        case KemAlgorithm.ML_KEM_512:
+            return "ML-KEM-512";
+        case KemAlgorithm.ML_KEM_768:
+            return "ML-KEM-768";
+        case KemAlgorithm.ML_KEM_1024:
+            return "ML-KEM-1024";
+        case KemAlgorithm.X_WING_768:
+            return "X-Wing-768";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const kemAlgorithmToProto = (value) => {
+    switch (value) {
+        case "ML-KEM-512":
+            return KemAlgorithm.ML_KEM_512;
+        case "ML-KEM-768":
+            return KemAlgorithm.ML_KEM_768;
+        case "ML-KEM-1024":
+            return KemAlgorithm.ML_KEM_1024;
+        case "X-Wing-768":
+            return KemAlgorithm.X_WING_768;
+    }
+};
+export const keyAgreementAlgorithmFromProto = (value) => {
+    switch (value) {
+        case KeyAgreementAlgorithm.X25519:
+            return "X25519";
+        case KeyAgreementAlgorithm.P256_ECDH:
+            return "P-256-ECDH";
+        case KeyAgreementAlgorithm.P384_ECDH:
+            return "P-384-ECDH";
+        case KeyAgreementAlgorithm.P521_ECDH:
+            return "P-521-ECDH";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const keyAgreementAlgorithmToProto = (value) => {
+    switch (value) {
+        case "X25519":
+            return KeyAgreementAlgorithm.X25519;
+        case "P-256-ECDH":
+            return KeyAgreementAlgorithm.P256_ECDH;
+        case "P-384-ECDH":
+            return KeyAgreementAlgorithm.P384_ECDH;
+        case "P-521-ECDH":
+            return KeyAgreementAlgorithm.P521_ECDH;
+    }
+};
+export const macAlgorithmFromProto = (value) => {
+    switch (value) {
+        case MacAlgorithm.HMAC_SHA256:
+            return "HMAC-SHA-256";
+        case MacAlgorithm.HMAC_SHA384:
+            return "HMAC-SHA-384";
+        case MacAlgorithm.HMAC_SHA512:
+            return "HMAC-SHA-512";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const macAlgorithmToProto = (value) => {
+    switch (value) {
+        case "HMAC-SHA-256":
+            return MacAlgorithm.HMAC_SHA256;
+        case "HMAC-SHA-384":
+            return MacAlgorithm.HMAC_SHA384;
+        case "HMAC-SHA-512":
+            return MacAlgorithm.HMAC_SHA512;
+    }
+};
+export const kdfAlgorithmFromProto = (value) => {
+    switch (value) {
+        case KdfAlgorithm.HKDF_SHA256:
+            return "HKDF-SHA256";
+        case KdfAlgorithm.HKDF_SHA384:
+            return "HKDF-SHA384";
+        case KdfAlgorithm.KMAC_256:
+            return "KMAC256";
+        case KdfAlgorithm.ARGON2ID:
+            return "Argon2id";
+        case KdfAlgorithm.PBKDF2_HMAC_SHA256:
+            return "PBKDF2-HMAC-SHA-256";
+        case KdfAlgorithm.PBKDF2_HMAC_SHA512:
+            return "PBKDF2-HMAC-SHA-512";
+        case KdfAlgorithm.JWA_CONCAT_KDF_SHA256:
+            return "JWA-CONCAT-KDF-SHA256";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const kdfAlgorithmToProto = (value) => {
+    switch (value) {
+        case "HKDF-SHA256":
+            return KdfAlgorithm.HKDF_SHA256;
+        case "HKDF-SHA384":
+            return KdfAlgorithm.HKDF_SHA384;
+        case "KMAC256":
+            return KdfAlgorithm.KMAC_256;
+        case "Argon2id":
+            return KdfAlgorithm.ARGON2ID;
+        case "PBKDF2-HMAC-SHA-256":
+            return KdfAlgorithm.PBKDF2_HMAC_SHA256;
+        case "PBKDF2-HMAC-SHA-512":
+            return KdfAlgorithm.PBKDF2_HMAC_SHA512;
+        case "JWA-CONCAT-KDF-SHA256":
+            return KdfAlgorithm.JWA_CONCAT_KDF_SHA256;
+    }
+};
+export const keyWrapAlgorithmFromProto = (value) => {
+    switch (value) {
+        case KeyWrapAlgorithm.AES_128_KW:
+            return "AES-128-KW";
+        case KeyWrapAlgorithm.AES_192_KW:
+            return "AES-192-KW";
+        case KeyWrapAlgorithm.AES_256_KW:
+            return "AES-256-KW";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const keyWrapAlgorithmToProto = (value) => {
+    switch (value) {
+        case "AES-128-KW":
+            return KeyWrapAlgorithm.AES_128_KW;
+        case "AES-192-KW":
+            return KeyWrapAlgorithm.AES_192_KW;
+        case "AES-256-KW":
+            return KeyWrapAlgorithm.AES_256_KW;
+    }
+};
+export const hpkeSuiteFromProto = (value) => {
+    if (value.kem === HpkeKemId.DHKEM_P256_HKDF_SHA256 &&
+        value.kdf === HpkeKdfId.HKDF_SHA256 &&
+        value.aead === HpkeAeadId.AES_256_GCM) {
+        return "DHKEM-P256-HKDF-SHA256-HKDF-SHA256-AES-256-GCM";
+    }
+    if (value.kem === HpkeKemId.DHKEM_X25519_HKDF_SHA256 &&
+        value.kdf === HpkeKdfId.HKDF_SHA256 &&
+        value.aead === HpkeAeadId.CHACHA20_POLY1305) {
+        return "DHKEM-X25519-HKDF-SHA256-HKDF-SHA256-CHACHA20-POLY1305";
+    }
+    throw new ReallyMeCryptoError("unsupported-algorithm");
+};
+export const hpkeSuiteToProto = (value) => {
+    switch (value) {
+        case "DHKEM-P256-HKDF-SHA256-HKDF-SHA256-AES-256-GCM":
+            return create(HpkeSuiteIdentifierSchema, {
+                kem: HpkeKemId.DHKEM_P256_HKDF_SHA256,
+                kdf: HpkeKdfId.HKDF_SHA256,
+                aead: HpkeAeadId.AES_256_GCM,
+            });
+        case "DHKEM-X25519-HKDF-SHA256-HKDF-SHA256-CHACHA20-POLY1305":
+            return create(HpkeSuiteIdentifierSchema, {
+                kem: HpkeKemId.DHKEM_X25519_HKDF_SHA256,
+                kdf: HpkeKdfId.HKDF_SHA256,
+                aead: HpkeAeadId.CHACHA20_POLY1305,
+            });
+    }
+};

package/dist/protoErrors.d.ts

@@ -0,0 +1,27 @@
+import { ReallyMeCryptoError } from "./errors.js";
+import { CryptoErrorReason } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+import type { CryptoError } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+export type ReallyMeCryptoWireErrorBranch = "primitive" | "provider" | "backend";
+export type ReallyMeCryptoWireError = Readonly<{
+    branch: ReallyMeCryptoWireErrorBranch;
+    reason: CryptoErrorReason;
+    reasonCode?: number;
+}>;
+export type ReallyMeCryptoWireErrorValidationCode = "unspecified-reason" | "branch-reason-mismatch" | "reason-code-out-of-range";
+export type ReallyMeCryptoWireErrorValidationResult = Readonly<{
+    ok: true;
+    value: ReallyMeCryptoWireError;
+}> | Readonly<{
+    ok: false;
+    error: ReallyMeCryptoWireErrorValidationCode;
+}>;
+export declare const cryptoWireErrorToProto: (error: ReallyMeCryptoWireError) => CryptoError;
+export declare const cryptoWireErrorFromProto: (value: CryptoError) => ReallyMeCryptoWireError;
+export declare const cryptoWireErrorToProtoBytes: (error: ReallyMeCryptoWireError) => Uint8Array;
+export declare const cryptoWireErrorFromProtoBytes: (bytes: Uint8Array) => ReallyMeCryptoWireError;
+export declare const cryptoWireErrorTryNew: (branch: ReallyMeCryptoWireErrorBranch, reason: CryptoErrorReason) => ReallyMeCryptoWireErrorValidationResult;
+export declare const cryptoWireErrorToFacadeError: (error: ReallyMeCryptoWireError) => ReallyMeCryptoError;
+export declare const cryptoErrorToProto: (error: ReallyMeCryptoError) => CryptoError;
+export declare const cryptoErrorToProtoBytes: (error: ReallyMeCryptoError) => Uint8Array;
+export declare const cryptoErrorFromProto: (value: CryptoError) => ReallyMeCryptoError;
+export declare const cryptoErrorFromProtoBytes: (bytes: Uint8Array) => ReallyMeCryptoError;

package/dist/protoErrors.js

@@ -0,0 +1,275 @@
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
+//
+// SPDX-License-Identifier: MIT OR Apache-2.0
+import { create, fromBinary, toBinary } from "@bufbuild/protobuf";
+import { ReallyMeCryptoError } from "./errors.js";
+import { CryptoBackendErrorSchema, CryptoErrorReason, CryptoErrorSchema, CryptoPrimitiveErrorSchema, CryptoProviderErrorSchema, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+const cryptoErrorReasonToFacadeError = (reason) => {
+    switch (reason) {
+        case CryptoErrorReason.PRIMITIVE_INVALID_SIGNATURE:
+        case CryptoErrorReason.PRIMITIVE_VERIFICATION_FAILED:
+            return new ReallyMeCryptoError("invalid-signature");
+        case CryptoErrorReason.PROVIDER_UNSUPPORTED_ALGORITHM:
+        case CryptoErrorReason.PROVIDER_UNSUPPORTED_BACKEND:
+            return new ReallyMeCryptoError("unsupported-algorithm");
+        case CryptoErrorReason.PROVIDER_UNAVAILABLE:
+        case CryptoErrorReason.PROVIDER_RANDOMNESS_UNAVAILABLE:
+        case CryptoErrorReason.PROVIDER_KEY_EXISTS:
+        case CryptoErrorReason.PROVIDER_KEY_NOT_FOUND:
+        case CryptoErrorReason.PROVIDER_ACCESS_DENIED:
+        case CryptoErrorReason.PROVIDER_USER_AUTHENTICATION_REQUIRED:
+        case CryptoErrorReason.PROVIDER_USER_CANCELED:
+        case CryptoErrorReason.PROVIDER_HARDWARE_UNAVAILABLE:
+        case CryptoErrorReason.PROVIDER_HARDWARE_REJECTED_KEY:
+        case CryptoErrorReason.BACKEND_INVALID_STATE:
+        case CryptoErrorReason.BACKEND_INTERNAL:
+            return new ReallyMeCryptoError("provider-failure");
+        case CryptoErrorReason.PRIMITIVE_INVALID_PARAMETER:
+        case CryptoErrorReason.PRIMITIVE_INVALID_LENGTH:
+        case CryptoErrorReason.PRIMITIVE_INVALID_KEY:
+        case CryptoErrorReason.PRIMITIVE_INVALID_PUBLIC_KEY:
+        case CryptoErrorReason.PRIMITIVE_INVALID_PRIVATE_KEY:
+        case CryptoErrorReason.PRIMITIVE_INVALID_NONCE:
+        case CryptoErrorReason.PRIMITIVE_INVALID_SALT:
+        case CryptoErrorReason.PRIMITIVE_INVALID_PASSWORD:
+        case CryptoErrorReason.PRIMITIVE_INVALID_ENCODING:
+        case CryptoErrorReason.PRIMITIVE_INVALID_SHARED_SECRET:
+        case CryptoErrorReason.PRIMITIVE_MALFORMED_CIPHERTEXT:
+        case CryptoErrorReason.PRIMITIVE_INVALID_TAG:
+        case CryptoErrorReason.PRIMITIVE_MALFORMED_PROTOBUF:
+        case CryptoErrorReason.PRIMITIVE_MALFORMED_JSON:
+        case CryptoErrorReason.PRIMITIVE_RESOURCE_LIMIT_EXCEEDED:
+        case CryptoErrorReason.PRIMITIVE_MISSING_OPERATION:
+            return new ReallyMeCryptoError("invalid-input");
+        case CryptoErrorReason.PRIMITIVE_AUTHENTICATION_FAILED:
+            return new ReallyMeCryptoError("authentication-failed");
+        default:
+            return new ReallyMeCryptoError("invalid-input");
+    }
+};
+const invalidInputReasons = new Set([
+    CryptoErrorReason.PRIMITIVE_INVALID_PARAMETER,
+    CryptoErrorReason.PRIMITIVE_INVALID_LENGTH,
+    CryptoErrorReason.PRIMITIVE_INVALID_KEY,
+    CryptoErrorReason.PRIMITIVE_INVALID_PUBLIC_KEY,
+    CryptoErrorReason.PRIMITIVE_INVALID_PRIVATE_KEY,
+    CryptoErrorReason.PRIMITIVE_INVALID_NONCE,
+    CryptoErrorReason.PRIMITIVE_INVALID_SALT,
+    CryptoErrorReason.PRIMITIVE_INVALID_PASSWORD,
+    CryptoErrorReason.PRIMITIVE_INVALID_ENCODING,
+    CryptoErrorReason.PRIMITIVE_INVALID_SHARED_SECRET,
+    CryptoErrorReason.PRIMITIVE_MALFORMED_CIPHERTEXT,
+    CryptoErrorReason.PRIMITIVE_INVALID_TAG,
+    CryptoErrorReason.PRIMITIVE_MALFORMED_PROTOBUF,
+    CryptoErrorReason.PRIMITIVE_MALFORMED_JSON,
+    CryptoErrorReason.PRIMITIVE_RESOURCE_LIMIT_EXCEEDED,
+    CryptoErrorReason.PRIMITIVE_MISSING_OPERATION,
+]);
+export const cryptoWireErrorToProto = (error) => {
+    switch (error.branch) {
+        case "primitive":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "primitive",
+                    value: create(CryptoPrimitiveErrorSchema, {
+                        reason: error.reason,
+                    }),
+                },
+            });
+        case "provider":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "provider",
+                    value: create(CryptoProviderErrorSchema, {
+                        reason: error.reason,
+                    }),
+                },
+            });
+        case "backend":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "backend",
+                    value: create(CryptoBackendErrorSchema, {
+                        reason: error.reason,
+                    }),
+                },
+            });
+    }
+};
+export const cryptoWireErrorFromProto = (value) => {
+    switch (value.error.case) {
+        case "primitive":
+            return strictCryptoWireError("primitive", value.error.value.reason);
+        case "provider":
+            return strictCryptoWireError("provider", value.error.value.reason);
+        case "backend":
+            return strictCryptoWireError("backend", value.error.value.reason);
+        default:
+            return malformedCryptoErrorEnvelope();
+    }
+};
+export const cryptoWireErrorToProtoBytes = (error) => toBinary(CryptoErrorSchema, cryptoWireErrorToProto(error));
+export const cryptoWireErrorFromProtoBytes = (bytes) => {
+    try {
+        return cryptoWireErrorFromProto(fromBinary(CryptoErrorSchema, bytes));
+    }
+    catch {
+        return malformedCryptoErrorEnvelope();
+    }
+};
+const strictCryptoWireError = (branch, reason) => {
+    const result = cryptoWireErrorTryNew(branch, reason);
+    return result.ok ? result.value : malformedCryptoErrorEnvelope();
+};
+export const cryptoWireErrorTryNew = (branch, reason) => {
+    if (reason === CryptoErrorReason.UNSPECIFIED) {
+        return { ok: false, error: "unspecified-reason" };
+    }
+    if (knownCryptoErrorReasons.has(reason) && !cryptoErrorReasonMatchesBranch(branch, reason)) {
+        return { ok: false, error: "branch-reason-mismatch" };
+    }
+    if (!cryptoErrorReasonCodeMatchesBranch(branch, reason)) {
+        return { ok: false, error: "reason-code-out-of-range" };
+    }
+    return { ok: true, value: { branch, reason, reasonCode: reason } };
+};
+const malformedCryptoErrorEnvelope = () => ({
+    branch: "primitive",
+    reason: CryptoErrorReason.PRIMITIVE_MALFORMED_PROTOBUF,
+    reasonCode: CryptoErrorReason.PRIMITIVE_MALFORMED_PROTOBUF,
+});
+const cryptoErrorReasonCodeMatchesBranch = (branch, reasonCode) => {
+    switch (branch) {
+        case "primitive":
+            return reasonCode >= 100 && reasonCode <= 199;
+        case "provider":
+            return reasonCode >= 200 && reasonCode <= 299;
+        case "backend":
+            return reasonCode >= 300 && reasonCode <= 399;
+    }
+};
+const cryptoErrorReasonMatchesBranch = (branch, reason) => {
+    switch (branch) {
+        case "primitive":
+            return primitiveCryptoErrorReasons.has(reason);
+        case "provider":
+            return providerCryptoErrorReasons.has(reason);
+        case "backend":
+            return backendCryptoErrorReasons.has(reason);
+    }
+};
+const primitiveCryptoErrorReasons = new Set([
+    CryptoErrorReason.PRIMITIVE_INVALID_PARAMETER,
+    CryptoErrorReason.PRIMITIVE_INVALID_LENGTH,
+    CryptoErrorReason.PRIMITIVE_INVALID_KEY,
+    CryptoErrorReason.PRIMITIVE_INVALID_PUBLIC_KEY,
+    CryptoErrorReason.PRIMITIVE_INVALID_PRIVATE_KEY,
+    CryptoErrorReason.PRIMITIVE_INVALID_NONCE,
+    CryptoErrorReason.PRIMITIVE_INVALID_SALT,
+    CryptoErrorReason.PRIMITIVE_INVALID_PASSWORD,
+    CryptoErrorReason.PRIMITIVE_INVALID_ENCODING,
+    CryptoErrorReason.PRIMITIVE_INVALID_SIGNATURE,
+    CryptoErrorReason.PRIMITIVE_VERIFICATION_FAILED,
+    CryptoErrorReason.PRIMITIVE_AUTHENTICATION_FAILED,
+    CryptoErrorReason.PRIMITIVE_MALFORMED_CIPHERTEXT,
+    CryptoErrorReason.PRIMITIVE_INVALID_TAG,
+    CryptoErrorReason.PRIMITIVE_INVALID_SHARED_SECRET,
+    CryptoErrorReason.PRIMITIVE_MALFORMED_PROTOBUF,
+    CryptoErrorReason.PRIMITIVE_MALFORMED_JSON,
+    CryptoErrorReason.PRIMITIVE_RESOURCE_LIMIT_EXCEEDED,
+    CryptoErrorReason.PRIMITIVE_MISSING_OPERATION,
+]);
+const providerCryptoErrorReasons = new Set([
+    CryptoErrorReason.PROVIDER_UNSUPPORTED_ALGORITHM,
+    CryptoErrorReason.PROVIDER_UNSUPPORTED_BACKEND,
+    CryptoErrorReason.PROVIDER_UNAVAILABLE,
+    CryptoErrorReason.PROVIDER_RANDOMNESS_UNAVAILABLE,
+    CryptoErrorReason.PROVIDER_KEY_EXISTS,
+    CryptoErrorReason.PROVIDER_KEY_NOT_FOUND,
+    CryptoErrorReason.PROVIDER_ACCESS_DENIED,
+    CryptoErrorReason.PROVIDER_USER_AUTHENTICATION_REQUIRED,
+    CryptoErrorReason.PROVIDER_USER_CANCELED,
+    CryptoErrorReason.PROVIDER_HARDWARE_UNAVAILABLE,
+    CryptoErrorReason.PROVIDER_HARDWARE_REJECTED_KEY,
+]);
+const backendCryptoErrorReasons = new Set([
+    CryptoErrorReason.BACKEND_INVALID_STATE,
+    CryptoErrorReason.BACKEND_INTERNAL,
+]);
+const knownCryptoErrorReasons = new Set([
+    ...primitiveCryptoErrorReasons,
+    ...providerCryptoErrorReasons,
+    ...backendCryptoErrorReasons,
+]);
+export const cryptoWireErrorToFacadeError = (error) => {
+    if (!knownCryptoErrorReasons.has(error.reason)) {
+        return new ReallyMeCryptoError("provider-failure");
+    }
+    const facadeError = cryptoErrorReasonToFacadeError(error.reason);
+    if (facadeError.code !== "invalid-input" || invalidInputReasons.has(error.reason)) {
+        return facadeError;
+    }
+    switch (error.branch) {
+        case "primitive":
+            return facadeError;
+        case "provider":
+        case "backend":
+            return new ReallyMeCryptoError("provider-failure");
+    }
+};
+export const cryptoErrorToProto = (error) => {
+    switch (error.code) {
+        case "invalid-input":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "primitive",
+                    value: create(CryptoPrimitiveErrorSchema, {
+                        reason: CryptoErrorReason.PRIMITIVE_INVALID_PARAMETER,
+                    }),
+                },
+            });
+        case "invalid-signature":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "primitive",
+                    value: create(CryptoPrimitiveErrorSchema, {
+                        reason: CryptoErrorReason.PRIMITIVE_INVALID_SIGNATURE,
+                    }),
+                },
+            });
+        case "authentication-failed":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "primitive",
+                    value: create(CryptoPrimitiveErrorSchema, {
+                        reason: CryptoErrorReason.PRIMITIVE_AUTHENTICATION_FAILED,
+                    }),
+                },
+            });
+        case "provider-failure":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "backend",
+                    value: create(CryptoBackendErrorSchema, {
+                        reason: CryptoErrorReason.BACKEND_INTERNAL,
+                    }),
+                },
+            });
+        case "unsupported-algorithm":
+            return create(CryptoErrorSchema, {
+                error: {
+                    case: "provider",
+                    value: create(CryptoProviderErrorSchema, {
+                        reason: CryptoErrorReason.PROVIDER_UNSUPPORTED_ALGORITHM,
+                    }),
+                },
+            });
+    }
+};
+export const cryptoErrorToProtoBytes = (error) => toBinary(CryptoErrorSchema, cryptoErrorToProto(error));
+export const cryptoErrorFromProto = (value) => {
+    return cryptoWireErrorToFacadeError(cryptoWireErrorFromProto(value));
+};
+export const cryptoErrorFromProtoBytes = (bytes) => {
+    return cryptoWireErrorToFacadeError(cryptoWireErrorFromProtoBytes(bytes));
+};

package/dist/protoIdentifiers.d.ts

@@ -0,0 +1,14 @@
+import type { ReallyMeHpkeSuite, ReallyMeKemAlgorithm, ReallyMeKeyAgreementAlgorithm, ReallyMeSignatureAlgorithm } from "./algorithms.js";
+import { MulticodecKeyAlgorithm } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+import type { CryptoAlgorithmIdentifier } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+export type ReallyMeMulticodecKeyAlgorithm = "ed25519-pub" | "x25519-pub" | "secp256k1-pub" | "p256-pub" | "p384-pub" | "p521-pub" | "ed448-pub" | "rsa-pub" | "mlkem-512-pub" | "mlkem-768-pub" | "mlkem-1024-pub" | "mldsa-44-pub" | "mldsa-65-pub" | "mldsa-87-pub";
+export declare const signatureAlgorithmIdentifierToProto: (value: ReallyMeSignatureAlgorithm) => CryptoAlgorithmIdentifier;
+export declare const keyAgreementAlgorithmIdentifierToProto: (value: ReallyMeKeyAgreementAlgorithm) => CryptoAlgorithmIdentifier;
+export declare const kemAlgorithmIdentifierToProto: (value: ReallyMeKemAlgorithm) => CryptoAlgorithmIdentifier;
+export declare const hpkeSuiteIdentifierToProto: (value: ReallyMeHpkeSuite) => CryptoAlgorithmIdentifier;
+export declare const signatureAlgorithmFromIdentifier: (value: CryptoAlgorithmIdentifier | undefined) => ReallyMeSignatureAlgorithm;
+export declare const keyAgreementAlgorithmFromIdentifier: (value: CryptoAlgorithmIdentifier | undefined) => ReallyMeKeyAgreementAlgorithm;
+export declare const kemAlgorithmFromIdentifier: (value: CryptoAlgorithmIdentifier | undefined) => ReallyMeKemAlgorithm;
+export declare const hpkeSuiteFromIdentifier: (value: CryptoAlgorithmIdentifier | undefined) => ReallyMeHpkeSuite;
+export declare const multicodecKeyAlgorithmFromProto: (value: MulticodecKeyAlgorithm) => ReallyMeMulticodecKeyAlgorithm;
+export declare const multicodecKeyAlgorithmToProto: (value: ReallyMeMulticodecKeyAlgorithm) => MulticodecKeyAlgorithm;