@agimon-ai/doompi-web-security 0.0.1-alpha.19 → 0.0.1-alpha.25

package/dist/adapters/browserBundleVerifier.d.cts

@@ -1,6 +1,6 @@
 import { BundleManifest } from "../types/bundleManifest.cjs";
 //#region src/adapters/browserBundleVerifier.d.ts
-type BundleVerificationFailure = {
+export type BundleVerificationFailure = {
   code: 'invalid-envelope';
 } | {
   code: 'untrusted-public-key';
@@ -13,14 +13,14 @@ type BundleVerificationFailure = {
 } | {
   code: 'invalid-signature';
 };
-type BundleVerificationResult = {
+export type BundleVerificationResult = {
   ok: true;
   manifest: BundleManifest;
 } | {
   ok: false;
   failure: BundleVerificationFailure;
 };
-type BundleAssetVerificationFailure = {
+export type BundleAssetVerificationFailure = {
   code: 'asset-not-listed';
   path: string;
 } | {
@@ -30,16 +30,15 @@ type BundleAssetVerificationFailure = {
 } | {
   code: 'digest-mismatch';
 };
-type BundleAssetVerificationResult = {
+export type BundleAssetVerificationResult = {
   ok: true;
 } | {
   ok: false;
   failure: BundleAssetVerificationFailure;
 };
 /** Verifies a strict envelope against a separately trusted key and revision floor. */
-declare function verifySignedBundleManifest(value: unknown, trustedPublicKey: string, minimumRevision?: number): Promise<BundleVerificationResult>;
+export declare function verifySignedBundleManifest(value: unknown, trustedPublicKey: string, minimumRevision?: number): Promise<BundleVerificationResult>;
 /** Verifies fetched raw response bytes against an authenticated manifest. */
-declare function verifyBundleAsset(manifest: BundleManifest, assetPath: string, bytes: ArrayBuffer): Promise<BundleAssetVerificationResult>;
+export declare function verifyBundleAsset(manifest: BundleManifest, assetPath: string, bytes: ArrayBuffer): Promise<BundleAssetVerificationResult>;
 //#endregion
-export { BundleAssetVerificationFailure, BundleAssetVerificationResult, BundleVerificationFailure, BundleVerificationResult, verifyBundleAsset, verifySignedBundleManifest };
 //# sourceMappingURL=browserBundleVerifier.d.cts.map

package/dist/adapters/browserBundleVerifier.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"browserBundleVerifier.d.cts","names":[],"sources":["../../src/adapters/browserBundleVerifier.ts"],"mappings":";;KAQY;EACN;;EACA;;EACA;EAAwB;EAAyB;;EACjD;;EACA;;KAEM;EACN;EAAU,UAAU;;EACpB;EAAW,SAAS;;KAEd;EACN;EAA0B;;EAC1B;EAA8B;EAAkB;;EAChD;;KAEM;EAAkC;;EAAe;EAAW,SAAS;;;iBAgB3D,2BACpB,gBACA,0BACA,2BACC,QAAQ;;iBAsCW,kBACpB,UAAU,gBACV,mBACA,OAAO,cACN,QAAQ"}
+{"version":3,"file":"browserBundleVerifier.d.cts","names":[],"sources":["../../src/adapters/browserBundleVerifier.ts"],"mappings":";;YAQY;EACN;;EACA;;EACA;EAAwB;EAAyB;;EACjD;;EACA;;YAEM;EACN;EAAU,UAAU;;EACpB;EAAW,SAAS;;YAEd;EACN;EAA0B;;EAC1B;EAA8B;EAAkB;;EAChD;;YAEM;EAAkC;;EAAe;EAAW,SAAS;;;wBAgB3D,2BACpB,gBACA,0BACA,2BACC,QAAQ;;wBAsCW,kBACpB,UAAU,gBACV,mBACA,OAAO,cACN,QAAQ"}

package/dist/adapters/browserBundleVerifier.d.mts

@@ -1,6 +1,6 @@
 import { BundleManifest } from "../types/bundleManifest.mjs";
 //#region src/adapters/browserBundleVerifier.d.ts
-type BundleVerificationFailure = {
+export type BundleVerificationFailure = {
   code: 'invalid-envelope';
 } | {
   code: 'untrusted-public-key';
@@ -13,14 +13,14 @@ type BundleVerificationFailure = {
 } | {
   code: 'invalid-signature';
 };
-type BundleVerificationResult = {
+export type BundleVerificationResult = {
   ok: true;
   manifest: BundleManifest;
 } | {
   ok: false;
   failure: BundleVerificationFailure;
 };
-type BundleAssetVerificationFailure = {
+export type BundleAssetVerificationFailure = {
   code: 'asset-not-listed';
   path: string;
 } | {
@@ -30,16 +30,15 @@ type BundleAssetVerificationFailure = {
 } | {
   code: 'digest-mismatch';
 };
-type BundleAssetVerificationResult = {
+export type BundleAssetVerificationResult = {
   ok: true;
 } | {
   ok: false;
   failure: BundleAssetVerificationFailure;
 };
 /** Verifies a strict envelope against a separately trusted key and revision floor. */
-declare function verifySignedBundleManifest(value: unknown, trustedPublicKey: string, minimumRevision?: number): Promise<BundleVerificationResult>;
+export declare function verifySignedBundleManifest(value: unknown, trustedPublicKey: string, minimumRevision?: number): Promise<BundleVerificationResult>;
 /** Verifies fetched raw response bytes against an authenticated manifest. */
-declare function verifyBundleAsset(manifest: BundleManifest, assetPath: string, bytes: ArrayBuffer): Promise<BundleAssetVerificationResult>;
+export declare function verifyBundleAsset(manifest: BundleManifest, assetPath: string, bytes: ArrayBuffer): Promise<BundleAssetVerificationResult>;
 //#endregion
-export { BundleAssetVerificationFailure, BundleAssetVerificationResult, BundleVerificationFailure, BundleVerificationResult, verifyBundleAsset, verifySignedBundleManifest };
 //# sourceMappingURL=browserBundleVerifier.d.mts.map

package/dist/adapters/browserBundleVerifier.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"browserBundleVerifier.d.mts","names":[],"sources":["../../src/adapters/browserBundleVerifier.ts"],"mappings":";;KAQY;EACN;;EACA;;EACA;EAAwB;EAAyB;;EACjD;;EACA;;KAEM;EACN;EAAU,UAAU;;EACpB;EAAW,SAAS;;KAEd;EACN;EAA0B;;EAC1B;EAA8B;EAAkB;;EAChD;;KAEM;EAAkC;;EAAe;EAAW,SAAS;;;iBAgB3D,2BACpB,gBACA,0BACA,2BACC,QAAQ;;iBAsCW,kBACpB,UAAU,gBACV,mBACA,OAAO,cACN,QAAQ"}
+{"version":3,"file":"browserBundleVerifier.d.mts","names":[],"sources":["../../src/adapters/browserBundleVerifier.ts"],"mappings":";;YAQY;EACN;;EACA;;EACA;EAAwB;EAAyB;;EACjD;;EACA;;YAEM;EACN;EAAU,UAAU;;EACpB;EAAW,SAAS;;YAEd;EACN;EAA0B;;EAC1B;EAA8B;EAAkB;;EAChD;;YAEM;EAAkC;;EAAe;EAAW,SAAS;;;wBAgB3D,2BACpB,gBACA,0BACA,2BACC,QAAQ;;wBAsCW,kBACpB,UAAU,gBACV,mBACA,OAAO,cACN,QAAQ"}

package/dist/adapters/browserSealedChannel.d.cts

@@ -1,20 +1,20 @@
 import { SealedDirection, SealedEnvelope, SealedFailure } from "../types/sealedChannel.cjs";
 //#region src/adapters/browserSealedChannel.d.ts
-type SealResult = {
+export type SealResult = {
   ok: true;
   envelope: SealedEnvelope;
 } | {
   ok: false;
   failure: SealedFailure;
 };
-type OpenResult = {
+export type OpenResult = {
   ok: true;
   plaintext: Uint8Array;
 } | {
   ok: false;
   failure: SealedFailure;
 };
-interface SealedChannel {
+export interface SealedChannel {
   seal(plaintext: Uint8Array): Promise<SealResult>;
   open(envelope: unknown): Promise<OpenResult>;
 }
@@ -25,12 +25,11 @@ interface SealedChannel {
  * authenticated: a relay can watch the client's public key go past and learn
  * nothing, and it cannot substitute the host's because it never carried it.
  */
-declare function connectSealedChannel(hostPublicKey: string): Promise<{
+export declare function connectSealedChannel(hostPublicKey: string): Promise<{
   channel: SealedChannel;
   clientPublicKey: string;
 } | undefined>;
 /** Exposed so a test can build the browser side against a known secret. */
-declare function channelFromSecret(secret: ArrayBuffer, sendDirection: SealedDirection, noncePrefix: Uint8Array): Promise<SealedChannel>;
+export declare function channelFromSecret(secret: ArrayBuffer, sendDirection: SealedDirection, noncePrefix: Uint8Array): Promise<SealedChannel>;
 //#endregion
-export { OpenResult, SealResult, SealedChannel, channelFromSecret, connectSealedChannel };
 //# sourceMappingURL=browserSealedChannel.d.cts.map

package/dist/adapters/browserSealedChannel.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"browserSealedChannel.d.cts","names":[],"sources":["../../src/adapters/browserSealedChannel.ts"],"mappings":";;KA8BY;EAAe;EAAU,UAAU;;EAAqB;EAAW,SAAS;;KAC5E;EAAe;EAAU,WAAW;;EAAiB;EAAW,SAAS;;UAEpE;EACf,KAAK,WAAW,aAAa,QAAQ;EACrC,KAAK,oBAAoB,QAAQ;;;;;;;;;iBA+Gb,qBACpB,wBACC;EAAU,SAAS;EAAe;;;iBAyBf,kBACpB,QAAQ,aACR,eAAe,iBACf,aAAa,aACZ,QAAQ"}
+{"version":3,"file":"browserSealedChannel.d.cts","names":[],"sources":["../../src/adapters/browserSealedChannel.ts"],"mappings":";;YA8BY;EAAe;EAAU,UAAU;;EAAqB;EAAW,SAAS;;YAC5E;EAAe;EAAU,WAAW;;EAAiB;EAAW,SAAS;;iBAEpE;EACf,KAAK,WAAW,aAAa,QAAQ;EACrC,KAAK,oBAAoB,QAAQ;;;;;;;;;wBA+Gb,qBACpB,wBACC;EAAU,SAAS;EAAe;;;wBAyBf,kBACpB,QAAQ,aACR,eAAe,iBACf,aAAa,aACZ,QAAQ"}

package/dist/adapters/browserSealedChannel.d.mts

@@ -1,20 +1,20 @@
 import { SealedDirection, SealedEnvelope, SealedFailure } from "../types/sealedChannel.mjs";
 //#region src/adapters/browserSealedChannel.d.ts
-type SealResult = {
+export type SealResult = {
   ok: true;
   envelope: SealedEnvelope;
 } | {
   ok: false;
   failure: SealedFailure;
 };
-type OpenResult = {
+export type OpenResult = {
   ok: true;
   plaintext: Uint8Array;
 } | {
   ok: false;
   failure: SealedFailure;
 };
-interface SealedChannel {
+export interface SealedChannel {
   seal(plaintext: Uint8Array): Promise<SealResult>;
   open(envelope: unknown): Promise<OpenResult>;
 }
@@ -25,12 +25,11 @@ interface SealedChannel {
  * authenticated: a relay can watch the client's public key go past and learn
  * nothing, and it cannot substitute the host's because it never carried it.
  */
-declare function connectSealedChannel(hostPublicKey: string): Promise<{
+export declare function connectSealedChannel(hostPublicKey: string): Promise<{
   channel: SealedChannel;
   clientPublicKey: string;
 } | undefined>;
 /** Exposed so a test can build the browser side against a known secret. */
-declare function channelFromSecret(secret: ArrayBuffer, sendDirection: SealedDirection, noncePrefix: Uint8Array): Promise<SealedChannel>;
+export declare function channelFromSecret(secret: ArrayBuffer, sendDirection: SealedDirection, noncePrefix: Uint8Array): Promise<SealedChannel>;
 //#endregion
-export { OpenResult, SealResult, SealedChannel, channelFromSecret, connectSealedChannel };
 //# sourceMappingURL=browserSealedChannel.d.mts.map

package/dist/adapters/browserSealedChannel.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"browserSealedChannel.d.mts","names":[],"sources":["../../src/adapters/browserSealedChannel.ts"],"mappings":";;KA8BY;EAAe;EAAU,UAAU;;EAAqB;EAAW,SAAS;;KAC5E;EAAe;EAAU,WAAW;;EAAiB;EAAW,SAAS;;UAEpE;EACf,KAAK,WAAW,aAAa,QAAQ;EACrC,KAAK,oBAAoB,QAAQ;;;;;;;;;iBA+Gb,qBACpB,wBACC;EAAU,SAAS;EAAe;;;iBAyBf,kBACpB,QAAQ,aACR,eAAe,iBACf,aAAa,aACZ,QAAQ"}
+{"version":3,"file":"browserSealedChannel.d.mts","names":[],"sources":["../../src/adapters/browserSealedChannel.ts"],"mappings":";;YA8BY;EAAe;EAAU,UAAU;;EAAqB;EAAW,SAAS;;YAC5E;EAAe;EAAU,WAAW;;EAAiB;EAAW,SAAS;;iBAEpE;EACf,KAAK,WAAW,aAAa,QAAQ;EACrC,KAAK,oBAAoB,QAAQ;;;;;;;;;wBA+Gb,qBACpB,wBACC;EAAU,SAAS;EAAe;;;wBAyBf,kBACpB,QAAQ,aACR,eAAe,iBACf,aAAa,aACZ,QAAQ"}

package/dist/adapters/bundleSigner.d.cts

@@ -1,6 +1,6 @@
 import { SignedBundleManifest } from "../types/bundleManifest.cjs";
 //#region src/adapters/bundleSigner.d.ts
-interface BundleSigner {
+export interface BundleSigner {
   /** Base64url SPKI for an independently trusted verifier to pin. */
   publicKey(): string;
   /** Hashes and signs once per asset directory. Undefined when the bundle is empty. */
@@ -10,9 +10,8 @@ interface BundleSigner {
   /** Invalidates one cached directory, or every cached directory when omitted. */
   invalidate(assetsDir?: string): void;
 }
-declare function createBundleSigner(stateDir: string, _onNotice?: (message: string) => void): BundleSigner;
+export declare function createBundleSigner(stateDir: string, _onNotice?: (message: string) => void): BundleSigner;
 /** Re-derives the public key from a stored private key. */
-declare function publicKeyOf(privateKeyPem: string): string;
+export declare function publicKeyOf(privateKeyPem: string): string;
 //#endregion
-export { BundleSigner, createBundleSigner, publicKeyOf };
 //# sourceMappingURL=bundleSigner.d.cts.map

package/dist/adapters/bundleSigner.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"bundleSigner.d.cts","names":[],"sources":["../../src/adapters/bundleSigner.ts"],"mappings":";;UA6CiB;;EAEf;;EAEA,KAAK,oBAAoB;;EAEzB,QAAQ,oBAAoB;;EAE5B,WAAW;;iBAsJG,mBAAmB,kBAAkB,aAAY,2BAAsC;;iBAoDvF,YAAY"}
+{"version":3,"file":"bundleSigner.d.cts","names":[],"sources":["../../src/adapters/bundleSigner.ts"],"mappings":";;iBA6CiB;;EAEf;;EAEA,KAAK,oBAAoB;;EAEzB,QAAQ,oBAAoB;;EAE5B,WAAW;;wBAsJG,mBAAmB,kBAAkB,aAAY,2BAAsC;;wBAoDvF,YAAY"}

package/dist/adapters/bundleSigner.d.mts

@@ -1,6 +1,6 @@
 import { SignedBundleManifest } from "../types/bundleManifest.mjs";
 //#region src/adapters/bundleSigner.d.ts
-interface BundleSigner {
+export interface BundleSigner {
   /** Base64url SPKI for an independently trusted verifier to pin. */
   publicKey(): string;
   /** Hashes and signs once per asset directory. Undefined when the bundle is empty. */
@@ -10,9 +10,8 @@ interface BundleSigner {
   /** Invalidates one cached directory, or every cached directory when omitted. */
   invalidate(assetsDir?: string): void;
 }
-declare function createBundleSigner(stateDir: string, _onNotice?: (message: string) => void): BundleSigner;
+export declare function createBundleSigner(stateDir: string, _onNotice?: (message: string) => void): BundleSigner;
 /** Re-derives the public key from a stored private key. */
-declare function publicKeyOf(privateKeyPem: string): string;
+export declare function publicKeyOf(privateKeyPem: string): string;
 //#endregion
-export { BundleSigner, createBundleSigner, publicKeyOf };
 //# sourceMappingURL=bundleSigner.d.mts.map

package/dist/adapters/bundleSigner.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"bundleSigner.d.mts","names":[],"sources":["../../src/adapters/bundleSigner.ts"],"mappings":";;UA6CiB;;EAEf;;EAEA,KAAK,oBAAoB;;EAEzB,QAAQ,oBAAoB;;EAE5B,WAAW;;iBAsJG,mBAAmB,kBAAkB,aAAY,2BAAsC;;iBAoDvF,YAAY"}
+{"version":3,"file":"bundleSigner.d.mts","names":[],"sources":["../../src/adapters/bundleSigner.ts"],"mappings":";;iBA6CiB;;EAEf;;EAEA,KAAK,oBAAoB;;EAEzB,QAAQ,oBAAoB;;EAE5B,WAAW;;wBAsJG,mBAAmB,kBAAkB,aAAY,2BAAsC;;wBAoDvF,YAAY"}

package/dist/adapters/nodeSealedChannel.d.cts

@@ -1,25 +1,25 @@
 import { SealedEnvelope, SealedFailure } from "../types/sealedChannel.cjs";
 //#region src/adapters/nodeSealedChannel.d.ts
-type SealResult = {
+export type SealResult = {
   ok: true;
   envelope: SealedEnvelope;
 } | {
   ok: false;
   failure: SealedFailure;
 };
-type OpenResult = {
+export type OpenResult = {
   ok: true;
   plaintext: Uint8Array;
 } | {
   ok: false;
   failure: SealedFailure;
 };
-interface SealedChannel {
+export interface SealedChannel {
   /** Seals one message. Counters advance only on success. */
   seal(plaintext: Uint8Array): SealResult;
   open(envelope: unknown): OpenResult;
 }
-interface HostHandshake {
+export interface HostHandshake {
   /** Base64url uncompressed P-256 point, printed in the QR. */
   publicKey: string;
   /** Completes the exchange against the peer's key and yields the channel. */
@@ -34,7 +34,6 @@ interface HostHandshake {
  * host, because the host only ever derives against the key the client presents
  * and the client only ever derives against the key it read off the screen.
  */
-declare function createHostHandshake(): HostHandshake;
+export declare function createHostHandshake(): HostHandshake;
 //#endregion
-export { HostHandshake, OpenResult, SealResult, SealedChannel, createHostHandshake };
 //# sourceMappingURL=nodeSealedChannel.d.cts.map

package/dist/adapters/nodeSealedChannel.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"nodeSealedChannel.d.cts","names":[],"sources":["../../src/adapters/nodeSealedChannel.ts"],"mappings":";;KAqBY;EAAe;EAAU,UAAU;;EAAqB;EAAW,SAAS;;KAC5E;EAAe;EAAU,WAAW;;EAAiB;EAAW,SAAS;;UAEpE;;EAEf,KAAK,WAAW,aAAa;EAC7B,KAAK,oBAAoB;;UAGV;;EAEf;;EAEA,OAAO,wBAAwB;;;;;;;;;;;iBAwFjB,uBAAuB"}
+{"version":3,"file":"nodeSealedChannel.d.cts","names":[],"sources":["../../src/adapters/nodeSealedChannel.ts"],"mappings":";;YAqBY;EAAe;EAAU,UAAU;;EAAqB;EAAW,SAAS;;YAC5E;EAAe;EAAU,WAAW;;EAAiB;EAAW,SAAS;;iBAEpE;;EAEf,KAAK,WAAW,aAAa;EAC7B,KAAK,oBAAoB;;iBAGV;;EAEf;;EAEA,OAAO,wBAAwB;;;;;;;;;;;wBAwFjB,uBAAuB"}

package/dist/adapters/nodeSealedChannel.d.mts

@@ -1,25 +1,25 @@
 import { SealedEnvelope, SealedFailure } from "../types/sealedChannel.mjs";
 //#region src/adapters/nodeSealedChannel.d.ts
-type SealResult = {
+export type SealResult = {
   ok: true;
   envelope: SealedEnvelope;
 } | {
   ok: false;
   failure: SealedFailure;
 };
-type OpenResult = {
+export type OpenResult = {
   ok: true;
   plaintext: Uint8Array;
 } | {
   ok: false;
   failure: SealedFailure;
 };
-interface SealedChannel {
+export interface SealedChannel {
   /** Seals one message. Counters advance only on success. */
   seal(plaintext: Uint8Array): SealResult;
   open(envelope: unknown): OpenResult;
 }
-interface HostHandshake {
+export interface HostHandshake {
   /** Base64url uncompressed P-256 point, printed in the QR. */
   publicKey: string;
   /** Completes the exchange against the peer's key and yields the channel. */
@@ -34,7 +34,6 @@ interface HostHandshake {
  * host, because the host only ever derives against the key the client presents
  * and the client only ever derives against the key it read off the screen.
  */
-declare function createHostHandshake(): HostHandshake;
+export declare function createHostHandshake(): HostHandshake;
 //#endregion
-export { HostHandshake, OpenResult, SealResult, SealedChannel, createHostHandshake };
 //# sourceMappingURL=nodeSealedChannel.d.mts.map

package/dist/adapters/nodeSealedChannel.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"nodeSealedChannel.d.mts","names":[],"sources":["../../src/adapters/nodeSealedChannel.ts"],"mappings":";;KAqBY;EAAe;EAAU,UAAU;;EAAqB;EAAW,SAAS;;KAC5E;EAAe;EAAU,WAAW;;EAAiB;EAAW,SAAS;;UAEpE;;EAEf,KAAK,WAAW,aAAa;EAC7B,KAAK,oBAAoB;;UAGV;;EAEf;;EAEA,OAAO,wBAAwB;;;;;;;;;;;iBAwFjB,uBAAuB"}
+{"version":3,"file":"nodeSealedChannel.d.mts","names":[],"sources":["../../src/adapters/nodeSealedChannel.ts"],"mappings":";;YAqBY;EAAe;EAAU,UAAU;;EAAqB;EAAW,SAAS;;YAC5E;EAAe;EAAU,WAAW;;EAAiB;EAAW,SAAS;;iBAEpE;;EAEf,KAAK,WAAW,aAAa;EAC7B,KAAK,oBAAoB;;iBAGV;;EAEf;;EAEA,OAAO,wBAAwB;;;;;;;;;;;wBAwFjB,uBAAuB"}

package/dist/adapters/sealedTransport.d.cts

@@ -1,5 +1,5 @@
 //#region src/adapters/sealedTransport.d.ts
-interface SealedTransport {
+export interface SealedTransport {
   /** False on loopback and before the handshake completes, where everything passes through. */
   active(): boolean;
   sealText(text: string): Promise<string>;
@@ -11,7 +11,7 @@ interface SealedTransport {
   fetch(input: string, init?: RequestInit): Promise<Response>;
   lastFailure(): string | undefined;
 }
-declare function createSealedTransport(): SealedTransport & {
+export declare function createSealedTransport(): SealedTransport & {
   /** Completes the handshake against the host key from the QR. */
   connect: (hostPublicKey: string) => Promise<string | undefined>;
   /** Drops the channel, so everything falls back to pass-through. */
@@ -30,7 +30,7 @@ declare function createSealedTransport(): SealedTransport & {
  * Inactive until a handshake completes, and inactive forever on the loopback
  * listener, so `sealedTransport.fetch` is a plain `fetch` there.
  */
-declare const sealedTransport: SealedTransport & {
+export declare const sealedTransport: SealedTransport & {
   /** Completes the handshake against the host key from the QR. */
   connect: (hostPublicKey: string) => Promise<string | undefined>;
   /** Drops the channel, so everything falls back to pass-through. */
@@ -39,5 +39,4 @@ declare const sealedTransport: SealedTransport & {
   relayRequestsThrough: (path: string) => void;
 };
 //#endregion
-export { SealedTransport, createSealedTransport, sealedTransport };
 //# sourceMappingURL=sealedTransport.d.cts.map

package/dist/adapters/sealedTransport.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"sealedTransport.d.cts","names":[],"sources":["../../src/adapters/sealedTransport.ts"],"mappings":";UAqBiB;;EAEf;EACA,SAAS,eAAe;;EAExB,SAAS,eAAe;EACxB,WAAW,OAAO,aAAa,QAAQ;EACvC,WAAW,OAAO,aAAa,QAAQ;;EAEvC,MAAM,eAAe,OAAO,cAAc,QAAQ;EAClD;;iBA4Dc,yBAAyB;;EAEvC,UAAU,0BAA0B;;EAEpC;;EAEA,uBAAuB;;;;;;;;;;;;;cAmJZ,iBAAe;;EAvJjB,UAAC,0BAA0B;;EAE7B;;EAEe,uBAAC"}
+{"version":3,"file":"sealedTransport.d.cts","names":[],"sources":["../../src/adapters/sealedTransport.ts"],"mappings":";iBAqBiB;;EAEf;EACA,SAAS,eAAe;;EAExB,SAAS,eAAe;EACxB,WAAW,OAAO,aAAa,QAAQ;EACvC,WAAW,OAAO,aAAa,QAAQ;;EAEvC,MAAM,eAAe,OAAO,cAAc,QAAQ;EAClD;;wBA4Dc,yBAAyB;;EAEvC,UAAU,0BAA0B;;EAEpC;;EAEA,uBAAuB;;;;;;;;;;;;;qBAmJZ,iBAAe;;EAvJjB,UAAC,0BAA0B;;EAE7B;;EAEe,uBAAC"}

package/dist/adapters/sealedTransport.d.mts

@@ -1,5 +1,5 @@
 //#region src/adapters/sealedTransport.d.ts
-interface SealedTransport {
+export interface SealedTransport {
   /** False on loopback and before the handshake completes, where everything passes through. */
   active(): boolean;
   sealText(text: string): Promise<string>;
@@ -11,7 +11,7 @@ interface SealedTransport {
   fetch(input: string, init?: RequestInit): Promise<Response>;
   lastFailure(): string | undefined;
 }
-declare function createSealedTransport(): SealedTransport & {
+export declare function createSealedTransport(): SealedTransport & {
   /** Completes the handshake against the host key from the QR. */
   connect: (hostPublicKey: string) => Promise<string | undefined>;
   /** Drops the channel, so everything falls back to pass-through. */
@@ -30,7 +30,7 @@ declare function createSealedTransport(): SealedTransport & {
  * Inactive until a handshake completes, and inactive forever on the loopback
  * listener, so `sealedTransport.fetch` is a plain `fetch` there.
  */
-declare const sealedTransport: SealedTransport & {
+export declare const sealedTransport: SealedTransport & {
   /** Completes the handshake against the host key from the QR. */
   connect: (hostPublicKey: string) => Promise<string | undefined>;
   /** Drops the channel, so everything falls back to pass-through. */
@@ -39,5 +39,4 @@ declare const sealedTransport: SealedTransport & {
   relayRequestsThrough: (path: string) => void;
 };
 //#endregion
-export { SealedTransport, createSealedTransport, sealedTransport };
 //# sourceMappingURL=sealedTransport.d.mts.map

package/dist/adapters/sealedTransport.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"sealedTransport.d.mts","names":[],"sources":["../../src/adapters/sealedTransport.ts"],"mappings":";UAqBiB;;EAEf;EACA,SAAS,eAAe;;EAExB,SAAS,eAAe;EACxB,WAAW,OAAO,aAAa,QAAQ;EACvC,WAAW,OAAO,aAAa,QAAQ;;EAEvC,MAAM,eAAe,OAAO,cAAc,QAAQ;EAClD;;iBA4Dc,yBAAyB;;EAEvC,UAAU,0BAA0B;;EAEpC;;EAEA,uBAAuB;;;;;;;;;;;;;cAmJZ,iBAAe;;EAvJjB,UAAC,0BAA0B;;EAE7B;;EAEe,uBAAC"}
+{"version":3,"file":"sealedTransport.d.mts","names":[],"sources":["../../src/adapters/sealedTransport.ts"],"mappings":";iBAqBiB;;EAEf;EACA,SAAS,eAAe;;EAExB,SAAS,eAAe;EACxB,WAAW,OAAO,aAAa,QAAQ;EACvC,WAAW,OAAO,aAAa,QAAQ;;EAEvC,MAAM,eAAe,OAAO,cAAc,QAAQ;EAClD;;wBA4Dc,yBAAyB;;EAEvC,UAAU,0BAA0B;;EAEpC;;EAEA,uBAAuB;;;;;;;;;;;;;qBAmJZ,iBAAe;;EAvJjB,UAAC,0BAA0B;;EAE7B;;EAEe,uBAAC"}

package/dist/services/serialQueue.d.cts

@@ -13,11 +13,10 @@
  * Deliberately not a general work pool. A pool with any concurrency above one
  * reintroduces exactly the reordering this exists to prevent.
  */
-interface SerialQueue {
+export interface SerialQueue {
   /** Resolves with the task's result once every task queued before it has settled. */
   run<T>(task: () => Promise<T>): Promise<T>;
 }
-declare function createSerialQueue(): SerialQueue;
+export declare function createSerialQueue(): SerialQueue;
 //#endregion
-export { SerialQueue, createSerialQueue };
 //# sourceMappingURL=serialQueue.d.cts.map

package/dist/services/serialQueue.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"serialQueue.d.cts","names":[],"sources":["../../src/services/serialQueue.ts"],"mappings":";;;;;;;;;;;;;;;UAciB;;EAEf,IAAI,GAAG,YAAY,QAAQ,KAAK,QAAQ;;iBAG1B,qBAAqB"}
+{"version":3,"file":"serialQueue.d.cts","names":[],"sources":["../../src/services/serialQueue.ts"],"mappings":";;;;;;;;;;;;;;;iBAciB;;EAEf,IAAI,GAAG,YAAY,QAAQ,KAAK,QAAQ;;wBAG1B,qBAAqB"}

package/dist/services/serialQueue.d.mts

@@ -13,11 +13,10 @@
  * Deliberately not a general work pool. A pool with any concurrency above one
  * reintroduces exactly the reordering this exists to prevent.
  */
-interface SerialQueue {
+export interface SerialQueue {
   /** Resolves with the task's result once every task queued before it has settled. */
   run<T>(task: () => Promise<T>): Promise<T>;
 }
-declare function createSerialQueue(): SerialQueue;
+export declare function createSerialQueue(): SerialQueue;
 //#endregion
-export { SerialQueue, createSerialQueue };
 //# sourceMappingURL=serialQueue.d.mts.map

package/dist/services/serialQueue.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"serialQueue.d.mts","names":[],"sources":["../../src/services/serialQueue.ts"],"mappings":";;;;;;;;;;;;;;;UAciB;;EAEf,IAAI,GAAG,YAAY,QAAQ,KAAK,QAAQ;;iBAG1B,qBAAqB"}
+{"version":3,"file":"serialQueue.d.mts","names":[],"sources":["../../src/services/serialQueue.ts"],"mappings":";;;;;;;;;;;;;;;iBAciB;;EAEf,IAAI,GAAG,YAAY,QAAQ,KAAK,QAAQ;;wBAG1B,qBAAqB"}

package/dist/types/bundleManifest.d.cts

@@ -6,9 +6,9 @@
  * edge that supplied its executable code. Consumers need a separately trusted
  * bootstrap and key before these signatures become a delivery guarantee.
  */
-declare const BUNDLE_MANIFEST_ROUTE = "/bundle-manifest.json";
-declare const BUNDLE_MANIFEST_VERSION = 2;
-interface BundleAsset {
+export declare const BUNDLE_MANIFEST_ROUTE = "/bundle-manifest.json";
+export declare const BUNDLE_MANIFEST_VERSION = 2;
+export interface BundleAsset {
   /** Normalized absolute URL path, without a query or fragment. */
   path: string;
   /** Lowercase hex SHA-256 of the served bytes. */
@@ -17,7 +17,7 @@ interface BundleAsset {
   /** MIME type of the response, without parameters. */
   contentType: string;
 }
-interface BundleManifest {
+export interface BundleManifest {
   version: typeof BUNDLE_MANIFEST_VERSION;
   /** Monotonically increasing persistent signer revision. */
   revision: number;
@@ -25,7 +25,7 @@ interface BundleManifest {
   builtAt: number;
   assets: BundleAsset[];
 }
-interface SignedBundleManifest {
+export interface SignedBundleManifest {
   manifest: BundleManifest;
   /** Base64url IEEE P1363 ECDSA P-256 signature over the canonical serialization. */
   signature: string;
@@ -33,13 +33,12 @@ interface SignedBundleManifest {
   publicKey: string;
 }
 /** The exact bytes signed by Node and verified by WebCrypto. */
-declare function canonicalManifest(manifest: BundleManifest): string;
-declare function isBundleManifest(value: unknown): value is BundleManifest;
-declare function isSignedBundleManifest(value: unknown): value is SignedBundleManifest;
+export declare function canonicalManifest(manifest: BundleManifest): string;
+export declare function isBundleManifest(value: unknown): value is BundleManifest;
+export declare function isSignedBundleManifest(value: unknown): value is SignedBundleManifest;
 /** The recorded asset for one path, or undefined if the manifest does not cover it. */
-declare function assetFor(manifest: BundleManifest, path: string): BundleAsset | undefined;
+export declare function assetFor(manifest: BundleManifest, path: string): BundleAsset | undefined;
 /** The recorded digest for one asset, or undefined if the manifest does not cover it. */
-declare function digestFor(manifest: BundleManifest, path: string): string | undefined;
+export declare function digestFor(manifest: BundleManifest, path: string): string | undefined;
 //#endregion
-export { BUNDLE_MANIFEST_ROUTE, BUNDLE_MANIFEST_VERSION, BundleAsset, BundleManifest, SignedBundleManifest, assetFor, canonicalManifest, digestFor, isBundleManifest, isSignedBundleManifest };
 //# sourceMappingURL=bundleManifest.d.cts.map

package/dist/types/bundleManifest.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"bundleManifest.d.cts","names":[],"sources":["../../src/types/bundleManifest.ts"],"mappings":";;;;;;;;cAQa;cACA;UAMI;;EAEf;;EAEA;EACA;;EAEA;;UAGe;EACf,gBAAgB;;EAEhB;;EAEA;EACA,QAAQ;;UAGO;EACf,UAAU;;EAEV;;EAEA;;;iBAwBc,kBAAkB,UAAU;iBAU5B,iBAAiB,iBAAiB,SAAS;iBAsB3C,uBAAuB,iBAAiB,SAAS;;iBAgBjD,SAAS,UAAU,gBAAgB,eAAe;;iBAKlD,UAAU,UAAU,gBAAgB"}
+{"version":3,"file":"bundleManifest.d.cts","names":[],"sources":["../../src/types/bundleManifest.ts"],"mappings":";;;;;;;;qBAQa;qBACA;iBAMI;;EAEf;;EAEA;EACA;;EAEA;;iBAGe;EACf,gBAAgB;;EAEhB;;EAEA;EACA,QAAQ;;iBAGO;EACf,UAAU;;EAEV;;EAEA;;;wBAwBc,kBAAkB,UAAU;wBAU5B,iBAAiB,iBAAiB,SAAS;wBAsB3C,uBAAuB,iBAAiB,SAAS;;wBAgBjD,SAAS,UAAU,gBAAgB,eAAe;;wBAKlD,UAAU,UAAU,gBAAgB"}

package/dist/types/bundleManifest.d.mts

@@ -6,9 +6,9 @@
  * edge that supplied its executable code. Consumers need a separately trusted
  * bootstrap and key before these signatures become a delivery guarantee.
  */
-declare const BUNDLE_MANIFEST_ROUTE = "/bundle-manifest.json";
-declare const BUNDLE_MANIFEST_VERSION = 2;
-interface BundleAsset {
+export declare const BUNDLE_MANIFEST_ROUTE = "/bundle-manifest.json";
+export declare const BUNDLE_MANIFEST_VERSION = 2;
+export interface BundleAsset {
   /** Normalized absolute URL path, without a query or fragment. */
   path: string;
   /** Lowercase hex SHA-256 of the served bytes. */
@@ -17,7 +17,7 @@ interface BundleAsset {
   /** MIME type of the response, without parameters. */
   contentType: string;
 }
-interface BundleManifest {
+export interface BundleManifest {
   version: typeof BUNDLE_MANIFEST_VERSION;
   /** Monotonically increasing persistent signer revision. */
   revision: number;
@@ -25,7 +25,7 @@ interface BundleManifest {
   builtAt: number;
   assets: BundleAsset[];
 }
-interface SignedBundleManifest {
+export interface SignedBundleManifest {
   manifest: BundleManifest;
   /** Base64url IEEE P1363 ECDSA P-256 signature over the canonical serialization. */
   signature: string;
@@ -33,13 +33,12 @@ interface SignedBundleManifest {
   publicKey: string;
 }
 /** The exact bytes signed by Node and verified by WebCrypto. */
-declare function canonicalManifest(manifest: BundleManifest): string;
-declare function isBundleManifest(value: unknown): value is BundleManifest;
-declare function isSignedBundleManifest(value: unknown): value is SignedBundleManifest;
+export declare function canonicalManifest(manifest: BundleManifest): string;
+export declare function isBundleManifest(value: unknown): value is BundleManifest;
+export declare function isSignedBundleManifest(value: unknown): value is SignedBundleManifest;
 /** The recorded asset for one path, or undefined if the manifest does not cover it. */
-declare function assetFor(manifest: BundleManifest, path: string): BundleAsset | undefined;
+export declare function assetFor(manifest: BundleManifest, path: string): BundleAsset | undefined;
 /** The recorded digest for one asset, or undefined if the manifest does not cover it. */
-declare function digestFor(manifest: BundleManifest, path: string): string | undefined;
+export declare function digestFor(manifest: BundleManifest, path: string): string | undefined;
 //#endregion
-export { BUNDLE_MANIFEST_ROUTE, BUNDLE_MANIFEST_VERSION, BundleAsset, BundleManifest, SignedBundleManifest, assetFor, canonicalManifest, digestFor, isBundleManifest, isSignedBundleManifest };
 //# sourceMappingURL=bundleManifest.d.mts.map

package/dist/types/bundleManifest.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"bundleManifest.d.mts","names":[],"sources":["../../src/types/bundleManifest.ts"],"mappings":";;;;;;;;cAQa;cACA;UAMI;;EAEf;;EAEA;EACA;;EAEA;;UAGe;EACf,gBAAgB;;EAEhB;;EAEA;EACA,QAAQ;;UAGO;EACf,UAAU;;EAEV;;EAEA;;;iBAwBc,kBAAkB,UAAU;iBAU5B,iBAAiB,iBAAiB,SAAS;iBAsB3C,uBAAuB,iBAAiB,SAAS;;iBAgBjD,SAAS,UAAU,gBAAgB,eAAe;;iBAKlD,UAAU,UAAU,gBAAgB"}
+{"version":3,"file":"bundleManifest.d.mts","names":[],"sources":["../../src/types/bundleManifest.ts"],"mappings":";;;;;;;;qBAQa;qBACA;iBAMI;;EAEf;;EAEA;EACA;;EAEA;;iBAGe;EACf,gBAAgB;;EAEhB;;EAEA;EACA,QAAQ;;iBAGO;EACf,UAAU;;EAEV;;EAEA;;;wBAwBc,kBAAkB,UAAU;wBAU5B,iBAAiB,iBAAiB,SAAS;wBAsB3C,uBAAuB,iBAAiB,SAAS;;wBAgBjD,SAAS,UAAU,gBAAgB,eAAe;;wBAKlD,UAAU,UAAU,gBAAgB"}

package/dist/types/sealedChannel.d.cts

@@ -18,15 +18,15 @@
  * read it identically.
  */
 /** Bumped when the envelope layout changes; a mismatch is refused, never guessed at. */
-declare const SEALED_VERSION = 1;
+export declare const SEALED_VERSION = 1;
 /** Fragment key in the pairing URL carrying the host's ephemeral public key. */
-declare const SEALED_KEY_PARAM = "k";
+export declare const SEALED_KEY_PARAM = "k";
 /** AES-GCM standard nonce length. Longer is non-standard, shorter is unsafe. */
-declare const NONCE_BYTES = 12;
+export declare const NONCE_BYTES = 12;
 /** Random per-channel prefix, so two channels never share a nonce space. */
-declare const NONCE_PREFIX_BYTES = 4;
+export declare const NONCE_PREFIX_BYTES = 4;
 /** Monotonic per-direction counter filling the rest of the nonce. */
-declare const NONCE_COUNTER_BYTES: number;
+export declare const NONCE_COUNTER_BYTES: number;
 /**
  * Rekey well before the counter could wrap.
  *
@@ -35,43 +35,42 @@ declare const NONCE_COUNTER_BYTES: number;
  * 64 bits, so this bound is nowhere near it; the point is that the bound exists
  * and is enforced rather than assumed.
  */
-declare const MAX_MESSAGES_PER_KEY: number;
+export declare const MAX_MESSAGES_PER_KEY: number;
 /**
  * HKDF info strings, one per direction.
  *
  * Separate keys per direction, not one shared key, so a message the server sent
  * can never be replayed back at it as though the client had sent it.
  */
-declare const CLIENT_TO_SERVER_INFO = "doompi/sealed/c2s/v1";
-declare const SERVER_TO_CLIENT_INFO = "doompi/sealed/s2c/v1";
-type SealedDirection = 'c2s' | 's2c';
-declare function infoFor(direction: SealedDirection): string;
+export declare const CLIENT_TO_SERVER_INFO = "doompi/sealed/c2s/v1";
+export declare const SERVER_TO_CLIENT_INFO = "doompi/sealed/s2c/v1";
+export type SealedDirection = 'c2s' | 's2c';
+export declare function infoFor(direction: SealedDirection): string;
 /**
  * One sealed message, as it travels.
  *
  * Base64url rather than binary so the same envelope works on a JSON body and a
  * text WebSocket frame without a second encoding path to get wrong.
  */
-interface SealedEnvelope {
+export interface SealedEnvelope {
   v: number;
   /** Base64url, 4-byte prefix plus 8-byte counter. */
   n: string;
   /** Base64url ciphertext with the GCM tag appended. */
   c: string;
 }
-declare function isSealedEnvelope(value: unknown): value is SealedEnvelope;
+export declare function isSealedEnvelope(value: unknown): value is SealedEnvelope;
 /** Header naming the client's ephemeral public key during the handshake. */
-declare const SEALED_CLIENT_KEY_HEADER = "x-doompi-channel-key";
+export declare const SEALED_CLIENT_KEY_HEADER = "x-doompi-channel-key";
 /** Header carrying a sealed request body's envelope on a non-JSON request. */
-declare const SEALED_BODY_HEADER = "x-doompi-sealed";
-type SealedFailure = 'version' | 'malformed' | 'replay' | 'auth' | 'exhausted';
+export declare const SEALED_BODY_HEADER = "x-doompi-sealed";
+export type SealedFailure = 'version' | 'malformed' | 'replay' | 'auth' | 'exhausted';
 /**
  * Why an unseal failed, in words a diagnostic can show.
  *
  * A decryption failure means a blank cockpit, so every one of these has to name
  * its cause rather than leaving a dead page and no explanation.
  */
-declare function describeSealedFailure(failure: SealedFailure): string;
+export declare function describeSealedFailure(failure: SealedFailure): string;
 //#endregion
-export { CLIENT_TO_SERVER_INFO, MAX_MESSAGES_PER_KEY, NONCE_BYTES, NONCE_COUNTER_BYTES, NONCE_PREFIX_BYTES, SEALED_BODY_HEADER, SEALED_CLIENT_KEY_HEADER, SEALED_KEY_PARAM, SEALED_VERSION, SERVER_TO_CLIENT_INFO, SealedDirection, SealedEnvelope, SealedFailure, describeSealedFailure, infoFor, isSealedEnvelope };
 //# sourceMappingURL=sealedChannel.d.cts.map

package/dist/types/sealedChannel.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"sealedChannel.d.cts","names":[],"sources":["../../src/types/sealedChannel.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;cAoBa;;cAGA;;cAGA;;cAEA;;cAEA;;;;;;;;;cAUA;;;;;;;cAQA;cACA;KAED;iBAEI,QAAQ,WAAW;;;;;;;UAUlB;EACf;;EAEA;;EAEA;;iBAGc,iBAAiB,iBAAiB,SAAS;;cAO9C;;cAEA;KAED;;;;;;;iBAQI,sBAAsB,SAAS"}
+{"version":3,"file":"sealedChannel.d.cts","names":[],"sources":["../../src/types/sealedChannel.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;qBAoBa;;qBAGA;;qBAGA;;qBAEA;;qBAEA;;;;;;;;;qBAUA;;;;;;;qBAQA;qBACA;YAED;wBAEI,QAAQ,WAAW;;;;;;;iBAUlB;EACf;;EAEA;;EAEA;;wBAGc,iBAAiB,iBAAiB,SAAS;;qBAO9C;;qBAEA;YAED;;;;;;;wBAQI,sBAAsB,SAAS"}

package/dist/types/sealedChannel.d.mts

@@ -18,15 +18,15 @@
  * read it identically.
  */
 /** Bumped when the envelope layout changes; a mismatch is refused, never guessed at. */
-declare const SEALED_VERSION = 1;
+export declare const SEALED_VERSION = 1;
 /** Fragment key in the pairing URL carrying the host's ephemeral public key. */
-declare const SEALED_KEY_PARAM = "k";
+export declare const SEALED_KEY_PARAM = "k";
 /** AES-GCM standard nonce length. Longer is non-standard, shorter is unsafe. */
-declare const NONCE_BYTES = 12;
+export declare const NONCE_BYTES = 12;
 /** Random per-channel prefix, so two channels never share a nonce space. */
-declare const NONCE_PREFIX_BYTES = 4;
+export declare const NONCE_PREFIX_BYTES = 4;
 /** Monotonic per-direction counter filling the rest of the nonce. */
-declare const NONCE_COUNTER_BYTES: number;
+export declare const NONCE_COUNTER_BYTES: number;
 /**
  * Rekey well before the counter could wrap.
  *
@@ -35,43 +35,42 @@ declare const NONCE_COUNTER_BYTES: number;
  * 64 bits, so this bound is nowhere near it; the point is that the bound exists
  * and is enforced rather than assumed.
  */
-declare const MAX_MESSAGES_PER_KEY: number;
+export declare const MAX_MESSAGES_PER_KEY: number;
 /**
  * HKDF info strings, one per direction.
  *
  * Separate keys per direction, not one shared key, so a message the server sent
  * can never be replayed back at it as though the client had sent it.
  */
-declare const CLIENT_TO_SERVER_INFO = "doompi/sealed/c2s/v1";
-declare const SERVER_TO_CLIENT_INFO = "doompi/sealed/s2c/v1";
-type SealedDirection = 'c2s' | 's2c';
-declare function infoFor(direction: SealedDirection): string;
+export declare const CLIENT_TO_SERVER_INFO = "doompi/sealed/c2s/v1";
+export declare const SERVER_TO_CLIENT_INFO = "doompi/sealed/s2c/v1";
+export type SealedDirection = 'c2s' | 's2c';
+export declare function infoFor(direction: SealedDirection): string;
 /**
  * One sealed message, as it travels.
  *
  * Base64url rather than binary so the same envelope works on a JSON body and a
  * text WebSocket frame without a second encoding path to get wrong.
  */
-interface SealedEnvelope {
+export interface SealedEnvelope {
   v: number;
   /** Base64url, 4-byte prefix plus 8-byte counter. */
   n: string;
   /** Base64url ciphertext with the GCM tag appended. */
   c: string;
 }
-declare function isSealedEnvelope(value: unknown): value is SealedEnvelope;
+export declare function isSealedEnvelope(value: unknown): value is SealedEnvelope;
 /** Header naming the client's ephemeral public key during the handshake. */
-declare const SEALED_CLIENT_KEY_HEADER = "x-doompi-channel-key";
+export declare const SEALED_CLIENT_KEY_HEADER = "x-doompi-channel-key";
 /** Header carrying a sealed request body's envelope on a non-JSON request. */
-declare const SEALED_BODY_HEADER = "x-doompi-sealed";
-type SealedFailure = 'version' | 'malformed' | 'replay' | 'auth' | 'exhausted';
+export declare const SEALED_BODY_HEADER = "x-doompi-sealed";
+export type SealedFailure = 'version' | 'malformed' | 'replay' | 'auth' | 'exhausted';
 /**
  * Why an unseal failed, in words a diagnostic can show.
  *
  * A decryption failure means a blank cockpit, so every one of these has to name
  * its cause rather than leaving a dead page and no explanation.
  */
-declare function describeSealedFailure(failure: SealedFailure): string;
+export declare function describeSealedFailure(failure: SealedFailure): string;
 //#endregion
-export { CLIENT_TO_SERVER_INFO, MAX_MESSAGES_PER_KEY, NONCE_BYTES, NONCE_COUNTER_BYTES, NONCE_PREFIX_BYTES, SEALED_BODY_HEADER, SEALED_CLIENT_KEY_HEADER, SEALED_KEY_PARAM, SEALED_VERSION, SERVER_TO_CLIENT_INFO, SealedDirection, SealedEnvelope, SealedFailure, describeSealedFailure, infoFor, isSealedEnvelope };
 //# sourceMappingURL=sealedChannel.d.mts.map

package/dist/types/sealedChannel.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"sealedChannel.d.mts","names":[],"sources":["../../src/types/sealedChannel.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;cAoBa;;cAGA;;cAGA;;cAEA;;cAEA;;;;;;;;;cAUA;;;;;;;cAQA;cACA;KAED;iBAEI,QAAQ,WAAW;;;;;;;UAUlB;EACf;;EAEA;;EAEA;;iBAGc,iBAAiB,iBAAiB,SAAS;;cAO9C;;cAEA;KAED;;;;;;;iBAQI,sBAAsB,SAAS"}
+{"version":3,"file":"sealedChannel.d.mts","names":[],"sources":["../../src/types/sealedChannel.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;qBAoBa;;qBAGA;;qBAGA;;qBAEA;;qBAEA;;;;;;;;;qBAUA;;;;;;;qBAQA;qBACA;YAED;wBAEI,QAAQ,WAAW;;;;;;;iBAUlB;EACf;;EAEA;;EAEA;;wBAGc,iBAAiB,iBAAiB,SAAS;;qBAO9C;;qBAEA;YAED;;;;;;;wBAQI,sBAAsB,SAAS"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agimon-ai/doompi-web-security",
-  "version": "0.0.1-alpha.19",
+  "version": "0.0.1-alpha.25",
   "description": "Shared security primitives for the DoomPi web cockpit: sealed channels and signed bundle manifests for independently trusted verifiers.",
   "keywords": [
     "ai",
@@ -57,11 +57,11 @@
     "access": "public"
   },
   "devDependencies": {
-    "@types/node": "26.4.0",
-    "@vitest/coverage-v8": "4.1.11",
-    "tsdown": "0.22.14",
+    "@types/node": "26.4.1",
+    "@vitest/coverage-v8": "5.0.0",
+    "tsdown": "0.23.0",
     "typescript": "7.0.2",
-    "vitest": "4.1.11"
+    "vitest": "5.0.0"
   },
   "engines": {
     "node": ">=22.19.0"