@plane31/blind-relay 0.0.0-stage → 0.1.2

package/dist/crypto/noble.js

@@ -0,0 +1,107 @@
+/** The portable backend over the noble libraries (audited pure JavaScript). */
+import { xchacha20poly1305 } from "@noble/ciphers/chacha";
+import { hsalsa, xsalsa20poly1305 } from "@noble/ciphers/salsa";
+import { ed25519, x25519 } from "@noble/curves/ed25519";
+import { blake2b } from "@noble/hashes/blake2b";
+import { sha512 } from "@noble/hashes/sha512";
+import { randomBytes } from "@noble/hashes/utils";
+// "expand 32-byte k" as little-endian u32 words: the Salsa constant.
+const SIGMA = new Uint32Array([0x61707865, 0x3320646e, 0x79622d32, 0x6b206574]);
+function u32(bytes) {
+    const out = new Uint32Array(bytes.length / 4);
+    const dv = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    for (let i = 0; i < out.length; i++)
+        out[i] = dv.getUint32(i * 4, true);
+    return out;
+}
+function fromU32(words) {
+    const out = new Uint8Array(words.length * 4);
+    const dv = new DataView(out.buffer);
+    for (let i = 0; i < words.length; i++)
+        dv.setUint32(i * 4, words[i] ?? 0, true);
+    return out;
+}
+/** `crypto_box_beforenm`: HSalsa20 of the X25519 shared secret with a zero nonce. */
+function beforeNm(publicKey, secretKey) {
+    const shared = x25519.getSharedSecret(secretKey, publicKey);
+    const out = new Uint32Array(8);
+    hsalsa(SIGMA, u32(shared), u32(new Uint8Array(16)), out);
+    return fromU32(out);
+}
+function isCanonicalY(bytes) {
+    // y < 2^255 - 19, read little-endian with the sign bit cleared.
+    const y = Uint8Array.from(bytes);
+    y[31] = (y[31] ?? 0) & 0x7f;
+    const P = Uint8Array.from([
+        0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f
+    ]);
+    for (let i = 31; i >= 0; i--) {
+        const a = y[i] ?? 0;
+        const b = P[i] ?? 0;
+        if (a < b)
+            return true;
+        if (a > b)
+            return false;
+    }
+    return false;
+}
+export const nobleBackend = {
+    name: "noble",
+    blake2b: (data, outLen, key) => blake2b(data, key ? { dkLen: outLen, key } : { dkLen: outLen }),
+    randomBytes: (length) => randomBytes(length),
+    signKeypairFromSeed(seed) {
+        const publicKey = ed25519.getPublicKey(seed);
+        const secretKey = new Uint8Array(64);
+        secretKey.set(seed, 0);
+        secretKey.set(publicKey, 32);
+        return { publicKey, secretKey };
+    },
+    signDetached: (message, secretKey) => ed25519.sign(message, secretKey.subarray(0, 32)),
+    verifyDetached(signature, message, publicKey) {
+        try {
+            return ed25519.verify(signature, message, publicKey, { zip215: false });
+        }
+        catch {
+            return false;
+        }
+    },
+    isValidSignPoint(publicKey) {
+        if (publicKey.length !== 32 || !isCanonicalY(publicKey))
+            return false;
+        try {
+            const p = ed25519.ExtendedPoint.fromHex(publicKey);
+            p.assertValidity();
+            return !p.equals(ed25519.ExtendedPoint.ZERO) && !p.isSmallOrder() && p.isTorsionFree();
+        }
+        catch {
+            return false;
+        }
+    },
+    boxKeypairFromSeed(seed) {
+        const secretKey = sha512(seed).slice(0, 32);
+        return { publicKey: x25519.getPublicKey(secretKey), secretKey };
+    },
+    boxKeypair() {
+        const secretKey = randomBytes(32);
+        return { publicKey: x25519.getPublicKey(secretKey), secretKey };
+    },
+    scalarMult(secretKey, publicKey) {
+        const shared = x25519.getSharedSecret(secretKey, publicKey); // throws on an all-zero result
+        let acc = 0;
+        for (const b of shared)
+            acc |= b;
+        if (acc === 0)
+            throw new Error("low-order point");
+        return shared;
+    },
+    boxEasy(message, nonce, publicKey, secretKey) {
+        return xsalsa20poly1305(beforeNm(publicKey, secretKey), nonce).encrypt(message); // mac || ciphertext
+    },
+    boxOpenEasy(box, nonce, publicKey, secretKey) {
+        return xsalsa20poly1305(beforeNm(publicKey, secretKey), nonce).decrypt(box);
+    },
+    aeadEncrypt: (plaintext, aad, nonce, key) => xchacha20poly1305(key, nonce, aad).encrypt(plaintext),
+    aeadDecrypt: (ciphertextAndTag, aad, nonce, key) => xchacha20poly1305(key, nonce, aad).decrypt(ciphertextAndTag),
+    memzero: (bytes) => bytes.fill(0)
+};
+//# sourceMappingURL=noble.js.map

package/dist/crypto/noble.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"noble.js","sourceRoot":"","sources":["../../src/crypto/noble.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,qEAAqE;AACrE,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAEhF,SAAS,GAAG,CAAC,KAAiB;IAC5B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACxE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,KAAkB;IACjC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,EAAE,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAChF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qFAAqF;AACrF,SAAS,QAAQ,CAAC,SAAqB,EAAE,SAAqB;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACrC,gEAAgE;IAChE,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC;QACxB,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;KAC/L,CAAC,CAAC;IACH,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAkB;IACzC,IAAI,EAAE,OAAO;IACb,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC/F,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;IAC5C,mBAAmB,CAAC,IAAI;QACtB,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QACrC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvB,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC7B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAClC,CAAC;IACD,YAAY,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtF,cAAc,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS;QAC1C,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,gBAAgB,CAAC,SAAS;QACxB,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACnD,CAAC,CAAC,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;QACzF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,IAAI;QACrB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC;IACD,UAAU;QACR,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC;IACD,UAAU,CAAC,SAAS,EAAE,SAAS;QAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,+BAA+B;QAC5F,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,GAAG,IAAI,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;QAC1C,OAAO,gBAAgB,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB;IACvG,CAAC;IACD,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;QAC1C,OAAO,gBAAgB,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,WAAW,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAClG,WAAW,EAAE,CAAC,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAChH,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;CAClC,CAAC"}

package/dist/crypto/sodium.d.ts

@@ -0,0 +1,9 @@
+import type { CryptoBackend } from "./backend.js";
+/**
+ * Node only. The wrapper is loaded through its `require` condition, the CommonJS build, which is
+ * self-contained; its ESM build has shipped broken (0.7.16 imports a sibling file the package does
+ * not contain), and a consumer's plain `import` would hit that. The release smoke test loads this
+ * entry from the packed tarball in a clean Node to keep it so.
+ */
+export declare function loadSodiumBackend(): Promise<CryptoBackend>;
+//# sourceMappingURL=sodium.d.ts.map

package/dist/crypto/sodium.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sodium.d.ts","sourceRoot":"","sources":["../../src/crypto/sodium.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAc,aAAa,EAAe,MAAM,cAAc,CAAC;AAI3E;;;;;GAKG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,aAAa,CAAC,CAqChE"}

package/dist/crypto/sodium.js

@@ -0,0 +1,51 @@
+/**
+ * The libsodium backend (wasm). Loaded only when asked for, so the default bundle never carries
+ * the wasm; use it on Node, where it is faster than the portable backend, and to cross-check it.
+ */
+import { createRequire } from "node:module";
+/**
+ * Node only. The wrapper is loaded through its `require` condition, the CommonJS build, which is
+ * self-contained; its ESM build has shipped broken (0.7.16 imports a sibling file the package does
+ * not contain), and a consumer's plain `import` would hit that. The release smoke test loads this
+ * entry from the packed tarball in a clean Node to keep it so.
+ */
+export async function loadSodiumBackend() {
+    const require = createRequire(import.meta.url);
+    const mod = require("libsodium-wrappers-sumo");
+    const sodium = mod.default ?? mod;
+    await sodium.ready;
+    return {
+        name: "sodium",
+        blake2b: (data, outLen, key) => sodium.crypto_generichash(outLen, data, key ?? null),
+        randomBytes: (length) => sodium.randombytes_buf(length),
+        signKeypairFromSeed(seed) {
+            const kp = sodium.crypto_sign_seed_keypair(seed);
+            return { publicKey: kp.publicKey, secretKey: kp.privateKey };
+        },
+        signDetached: (message, secretKey) => sodium.crypto_sign_detached(message, secretKey),
+        verifyDetached(signature, message, publicKey) {
+            try {
+                return sodium.crypto_sign_verify_detached(signature, message, publicKey);
+            }
+            catch {
+                return false;
+            }
+        },
+        isValidSignPoint: (publicKey) => publicKey.length === 32 && sodium.crypto_core_ed25519_is_valid_point(publicKey),
+        boxKeypairFromSeed(seed) {
+            const kp = sodium.crypto_box_seed_keypair(seed);
+            return { publicKey: kp.publicKey, secretKey: kp.privateKey };
+        },
+        boxKeypair() {
+            const kp = sodium.crypto_box_keypair();
+            return { publicKey: kp.publicKey, secretKey: kp.privateKey };
+        },
+        scalarMult: (secretKey, publicKey) => sodium.crypto_scalarmult(secretKey, publicKey),
+        boxEasy: (message, nonce, publicKey, secretKey) => sodium.crypto_box_easy(message, nonce, publicKey, secretKey),
+        boxOpenEasy: (box, nonce, publicKey, secretKey) => sodium.crypto_box_open_easy(box, nonce, publicKey, secretKey),
+        aeadEncrypt: (plaintext, aad, nonce, key) => sodium.crypto_aead_xchacha20poly1305_ietf_encrypt(plaintext, aad, null, nonce, key),
+        aeadDecrypt: (ciphertextAndTag, aad, nonce, key) => sodium.crypto_aead_xchacha20poly1305_ietf_decrypt(null, ciphertextAndTag, aad, nonce, key),
+        memzero: (bytes) => sodium.memzero(bytes)
+    };
+}
+//# sourceMappingURL=sodium.js.map

package/dist/crypto/sodium.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sodium.js","sourceRoot":"","sources":["../../src/crypto/sodium.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAK5C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,yBAAyB,CAAkC,CAAC;IAChF,MAAM,MAAM,GAAW,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAAC;IACnB,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC;QACpF,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC;QACvD,mBAAmB,CAAC,IAAI;YACtB,MAAM,EAAE,GAAG,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;YACjD,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC;QAC/D,CAAC;QACD,YAAY,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC;QACrF,cAAc,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS;YAC1C,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,2BAA2B,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YAC3E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,gBAAgB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,kCAAkC,CAAC,SAAS,CAAC;QAChH,kBAAkB,CAAC,IAAI;YACrB,MAAM,EAAE,GAAG,MAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;YAChD,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC;QAC/D,CAAC;QACD,UAAU;YACR,MAAM,EAAE,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACvC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC;QAC/D,CAAC;QACD,UAAU,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC;QACpF,OAAO,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;QAC/G,WAAW,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;QAChH,WAAW,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,0CAA0C,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAChI,WAAW,EAAE,CAAC,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,0CAA0C,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC;QAC9I,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;KAC1C,CAAC;AACJ,CAAC"}

package/dist/crypto.d.ts

@@ -0,0 +1,66 @@
+import { setCryptoBackend, type BoxKeypair, type CryptoBackend, type SignKeypair as SigningKeypair } from "./crypto/backend.js";
+export type { CryptoBackend, BoxKeypair, SigningKeypair };
+export { setCryptoBackend };
+/** Kept from the protocol's earlier name on purpose: changing it changes every vector. */
+export declare const LABEL_PREFIX = "SealedStream/5/";
+export declare const WIRE_VERSION = 5;
+export declare const HASH_BYTES = 32;
+export declare const KEY_BYTES = 32;
+export declare const SEED_BYTES = 32;
+export declare const NONCE_BYTES = 24;
+export declare const TAG_BYTES = 16;
+export declare const SIGNATURE_BYTES = 64;
+export declare const PUBLIC_KEY_BYTES = 32;
+export declare const SEALED_BOX_BYTES = 80;
+export declare const DEVICE_ID_BYTES = 16;
+/** Recovery code prefix, also kept from the earlier name. */
+export declare const RECOVERY_CODE_PREFIX = "KV1R-";
+export type Label = "identity" | "stream" | "record-id" | "doc-hash" | "device-sign" | "device-box" | "account-sig" | "snapshot-sig" | "epoch-sig" | "record-sig" | "reset-sig" | "reset-keys-sig" | "epoch-key" | "wrap" | "record-aad" | "vault-aad";
+/** Select a backend if none is set (the portable one) and resolve. Idempotent. */
+export declare function ready(): Promise<void>;
+export declare function backendName(): CryptoBackend["name"];
+/** `C(label)` = ASCII("SealedStream/5/" + label) || 0x00. */
+export declare function C(label: Label): Uint8Array;
+/** `H(x)`: BLAKE2b, 32-byte output, unkeyed. */
+export declare function H(data: Uint8Array): Uint8Array;
+/** `D(seed, label)`: BLAKE2b keyed with the seed over `C(label)`, 32-byte output. */
+export declare function D(seed: Uint8Array, label: Label): Uint8Array;
+export declare function bodyHash(body: Uint8Array): Uint8Array;
+export declare function identityId(accountName: string, accountPublicKey: Uint8Array): Uint8Array;
+export declare function streamId(identity: Uint8Array, deviceId: Uint8Array): Uint8Array;
+export declare function recordId(stream: Uint8Array, epoch: number, counter: number): Uint8Array;
+export declare function wrapHash(wrap: Uint8Array): Uint8Array;
+export declare function keyCommitment(stream: Uint8Array, epoch: number, epochKey: Uint8Array): Uint8Array;
+/** `AK` from `accountSeed`. The only thing the account seed ever derives. */
+export declare function accountKeypair(accountSeed: Uint8Array): SigningKeypair;
+/** `DSK` = Ed25519 from `D(deviceSeed, "device-sign")`. */
+export declare function deviceSigningKeypair(deviceSeed: Uint8Array): SigningKeypair;
+/** `DEK` = `crypto_box_seed_keypair(D(deviceSeed, "device-box"))`. The seed is never used as a scalar. */
+export declare function deviceBoxKeypair(deviceSeed: Uint8Array): BoxKeypair;
+export declare function signingKeypairFromSeed(seed: Uint8Array): SigningKeypair;
+/** An Ed25519 public key must be a canonical point on the main subgroup and not the identity. */
+export declare function assertValidSigningKey(publicKey: Uint8Array, stage?: string): void;
+export declare function assertValidBoxKey(publicKey: Uint8Array, stage?: string): void;
+/** Detached Ed25519 over `C(label) || body`. Not Ed25519ph, no intermediate hash. */
+export declare function sign(secretKey: Uint8Array, label: Label, body: Uint8Array): Uint8Array;
+/**
+ * Verify a detached signature. Throws `INVALID_KEY` for an invalid or small-order key and
+ * `BAD_SIGNATURE` for anything else that does not verify, including a non-canonical scalar.
+ */
+export declare function verify(publicKey: Uint8Array, label: Label, body: Uint8Array, signature: Uint8Array, stage?: string): void;
+/** XChaCha20-Poly1305: returns ciphertext with the 16-byte tag appended. */
+export declare function aeadSeal(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): Uint8Array;
+export declare function aeadOpen(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ciphertextAndTag: Uint8Array, stage?: string): Uint8Array;
+/** The sealed-box nonce: BLAKE2b-24 over the ephemeral and recipient public keys, as libsodium defines it. */
+export declare function sealedBoxNonce(ephemeralPublicKey: Uint8Array, recipientPublicKey: Uint8Array): Uint8Array;
+/** `crypto_box_seal` with a given ephemeral keypair (tests reproduce fixture wraps with it). */
+export declare function sealBoxWith(epochKey: Uint8Array, recipientPublicKey: Uint8Array, ephemeral: BoxKeypair): Uint8Array;
+/** `crypto_box_seal` of a 32-byte epoch key: exactly 80 bytes. */
+export declare function sealBox(epochKey: Uint8Array, recipientPublicKey: Uint8Array): Uint8Array;
+export declare function openSealedBox(box: Uint8Array, recipient: BoxKeypair, stage?: string): Uint8Array;
+/** `crypto_box_seed_keypair`, exposed for tests that rebuild fixture wraps from their ephemeral seeds. */
+export declare function boxKeypairFromSeed(seed: Uint8Array): BoxKeypair;
+export declare function randomBytes(length: number): Uint8Array;
+/** Best-effort zeroisation. JavaScript gives no guarantee; the protocol says so. */
+export declare function zero(bytes: Uint8Array): void;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AASA,OAAO,EAAkB,gBAAgB,EAAE,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,KAAK,WAAW,IAAI,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGhJ,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,0FAA0F;AAC1F,eAAO,MAAM,YAAY,oBAAoB,CAAC;AAC9C,eAAO,MAAM,YAAY,IAAI,CAAC;AAC9B,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,eAAO,MAAM,SAAS,KAAK,CAAC;AAC5B,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,eAAO,MAAM,WAAW,KAAK,CAAC;AAC9B,eAAO,MAAM,SAAS,KAAK,CAAC;AAC5B,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,6DAA6D;AAC7D,eAAO,MAAM,oBAAoB,UAAU,CAAC;AAE5C,MAAM,MAAM,KAAK,GACb,UAAU,GACV,QAAQ,GACR,WAAW,GACX,UAAU,GACV,aAAa,GACb,YAAY,GACZ,aAAa,GACb,cAAc,GACd,WAAW,GACX,YAAY,GACZ,WAAW,GACX,gBAAgB,GAChB,WAAW,GACX,MAAM,GACN,YAAY,GACZ,WAAW,CAAC;AAEhB,kFAAkF;AAClF,wBAAsB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ3C;AAUD,wBAAgB,WAAW,IAAI,aAAa,CAAC,MAAM,CAAC,CAEnD;AAYD,6DAA6D;AAC7D,wBAAgB,CAAC,CAAC,KAAK,EAAE,KAAK,GAAG,UAAU,CAE1C;AAED,gDAAgD;AAChD,wBAAgB,CAAC,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAE9C;AAED,qFAAqF;AACrF,wBAAgB,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,UAAU,CAG5D;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAErD;AAED,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,GAAG,UAAU,CAExF;AAED,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,GAAG,UAAU,CAE/E;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,CAEvF;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAErD;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,GAAG,UAAU,CAEjG;AAID,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,WAAW,EAAE,UAAU,GAAG,cAAc,CAEtE;AAED,2DAA2D;AAC3D,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,UAAU,GAAG,cAAc,CAE3E;AAED,0GAA0G;AAC1G,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CAEnE;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,CAGvE;AAED,iGAAiG;AACjG,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,SAAW,GAAG,IAAI,CAInF;AAOD,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,SAAW,GAAG,IAAI,CAU/E;AAID,qFAAqF;AACrF,wBAAgB,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,GAAG,UAAU,CAEtF;AAmBD;;;GAGG;AACH,wBAAgB,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,SAAW,GAAG,IAAI,CAM3H;AAID,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAG/G;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,SAAY,GAAG,UAAU,CAOzI;AAID,8GAA8G;AAC9G,wBAAgB,cAAc,CAAC,kBAAkB,EAAE,UAAU,EAAE,kBAAkB,EAAE,UAAU,GAAG,UAAU,CAEzG;AAED,gGAAgG;AAChG,wBAAgB,WAAW,CAAC,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAGnH;AAED,kEAAkE;AAClE,wBAAgB,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,UAAU,GAAG,UAAU,CAIxF;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,SAAc,GAAG,UAAU,CASrG;AAED,0GAA0G;AAC1G,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAE/D;AAID,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAEtD;AAED,oFAAoF;AACpF,wBAAgB,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAE5C"}

package/dist/crypto.js

@@ -0,0 +1,225 @@
+/**
+ * The one cipher suite of Kavach v1 (protocol section 3) over a primitive backend.
+ *
+ * Everything here is a thin, checked wrapper: no algorithm choice, no fallback, no key
+ * derivation other than the three the protocol names. Call `ready()` once before anything else;
+ * it selects the portable backend unless `setCryptoBackend` chose another first.
+ */
+import { concat, isAllZero, u32, encodeName } from "./bytes.js";
+import { KavachError } from "./errors.js";
+import { currentBackend, setCryptoBackend } from "./crypto/backend.js";
+import { nobleBackend } from "./crypto/noble.js";
+export { setCryptoBackend };
+/** Kept from the protocol's earlier name on purpose: changing it changes every vector. */
+export const LABEL_PREFIX = "SealedStream/5/";
+export const WIRE_VERSION = 5;
+export const HASH_BYTES = 32;
+export const KEY_BYTES = 32;
+export const SEED_BYTES = 32;
+export const NONCE_BYTES = 24;
+export const TAG_BYTES = 16;
+export const SIGNATURE_BYTES = 64;
+export const PUBLIC_KEY_BYTES = 32;
+export const SEALED_BOX_BYTES = 80;
+export const DEVICE_ID_BYTES = 16;
+/** Recovery code prefix, also kept from the earlier name. */
+export const RECOVERY_CODE_PREFIX = "KV1R-";
+/** Select a backend if none is set (the portable one) and resolve. Idempotent. */
+export async function ready() {
+    if (!currentBackend()) {
+        // The portable backend draws randomness from the Web Crypto global; Hermes has none until the
+        // app installs one (the Expo helper does, from expo-crypto). Say so, rather than fail later.
+        const g = globalThis;
+        if (typeof g.crypto?.getRandomValues !== "function")
+            throw new KavachError("INVALID_KEY", "ready", "no crypto.getRandomValues: install a secure random source before opening Kavach");
+        setCryptoBackend(nobleBackend);
+    }
+}
+/** The portable backend needs no loading, so it is selected on first use when nothing else was. */
+function be() {
+    const b = currentBackend();
+    if (b)
+        return b;
+    setCryptoBackend(nobleBackend);
+    return nobleBackend;
+}
+export function backendName() {
+    return be().name;
+}
+function ascii(text) {
+    const out = new Uint8Array(text.length);
+    for (let i = 0; i < text.length; i++) {
+        const c = text.charCodeAt(i);
+        if (c > 0x7f)
+            throw new RangeError("label is not ASCII");
+        out[i] = c;
+    }
+    return out;
+}
+/** `C(label)` = ASCII("SealedStream/5/" + label) || 0x00. */
+export function C(label) {
+    return concat(ascii(LABEL_PREFIX + label), Uint8Array.of(0));
+}
+/** `H(x)`: BLAKE2b, 32-byte output, unkeyed. */
+export function H(data) {
+    return be().blake2b(data, HASH_BYTES);
+}
+/** `D(seed, label)`: BLAKE2b keyed with the seed over `C(label)`, 32-byte output. */
+export function D(seed, label) {
+    if (seed.length !== SEED_BYTES)
+        throw new KavachError("INVALID_KEY", "derive", "seed must be 32 bytes");
+    return be().blake2b(C(label), HASH_BYTES, seed);
+}
+export function bodyHash(body) {
+    return H(concat(C("doc-hash"), body));
+}
+export function identityId(accountName, accountPublicKey) {
+    return H(concat(C("identity"), encodeName(accountName), accountPublicKey));
+}
+export function streamId(identity, deviceId) {
+    return H(concat(C("stream"), identity, deviceId));
+}
+export function recordId(stream, epoch, counter) {
+    return H(concat(C("record-id"), stream, u32(epoch), u32(counter)));
+}
+export function wrapHash(wrap) {
+    return H(concat(C("wrap"), wrap));
+}
+export function keyCommitment(stream, epoch, epochKey) {
+    return H(concat(C("epoch-key"), stream, u32(epoch), epochKey));
+}
+// Keys ---------------------------------------------------------------------------------------
+/** `AK` from `accountSeed`. The only thing the account seed ever derives. */
+export function accountKeypair(accountSeed) {
+    return signingKeypairFromSeed(accountSeed);
+}
+/** `DSK` = Ed25519 from `D(deviceSeed, "device-sign")`. */
+export function deviceSigningKeypair(deviceSeed) {
+    return signingKeypairFromSeed(D(deviceSeed, "device-sign"));
+}
+/** `DEK` = `crypto_box_seed_keypair(D(deviceSeed, "device-box"))`. The seed is never used as a scalar. */
+export function deviceBoxKeypair(deviceSeed) {
+    return be().boxKeypairFromSeed(D(deviceSeed, "device-box"));
+}
+export function signingKeypairFromSeed(seed) {
+    if (seed.length !== SEED_BYTES)
+        throw new KavachError("INVALID_KEY", "keypair", "seed must be 32 bytes");
+    return be().signKeypairFromSeed(seed);
+}
+/** An Ed25519 public key must be a canonical point on the main subgroup and not the identity. */
+export function assertValidSigningKey(publicKey, stage = "verify") {
+    if (publicKey.length !== PUBLIC_KEY_BYTES || !be().isValidSignPoint(publicKey)) {
+        throw new KavachError("INVALID_KEY", stage, "invalid Ed25519 public key");
+    }
+}
+/**
+ * An X25519 public key must not yield an all-zero shared secret. A fixed non-secret scalar
+ * probes it; libsodium refuses the low-order result.
+ */
+const PROBE_SCALAR = new Uint8Array(32).fill(0x42);
+export function assertValidBoxKey(publicKey, stage = "verify") {
+    if (publicKey.length !== PUBLIC_KEY_BYTES || isAllZero(publicKey)) {
+        throw new KavachError("INVALID_KEY", stage, "invalid X25519 public key");
+    }
+    try {
+        const shared = be().scalarMult(PROBE_SCALAR, publicKey);
+        if (isAllZero(shared))
+            throw new Error("zero");
+    }
+    catch {
+        throw new KavachError("INVALID_KEY", stage, "low-order X25519 public key");
+    }
+}
+// Signatures ----------------------------------------------------------------------------------
+/** Detached Ed25519 over `C(label) || body`. Not Ed25519ph, no intermediate hash. */
+export function sign(secretKey, label, body) {
+    return be().signDetached(concat(C(label), body), secretKey);
+}
+// The Ed25519 group order L, little-endian, for the canonical-scalar check.
+const L = Uint8Array.from([
+    0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10
+]);
+function isCanonicalScalar(s) {
+    // s < L, comparing little-endian from the most significant byte.
+    for (let i = 31; i >= 0; i--) {
+        const a = s[i] ?? 0;
+        const b = L[i] ?? 0;
+        if (a < b)
+            return true;
+        if (a > b)
+            return false;
+    }
+    return false;
+}
+/**
+ * Verify a detached signature. Throws `INVALID_KEY` for an invalid or small-order key and
+ * `BAD_SIGNATURE` for anything else that does not verify, including a non-canonical scalar.
+ */
+export function verify(publicKey, label, body, signature, stage = "verify") {
+    assertValidSigningKey(publicKey, stage);
+    if (signature.length !== SIGNATURE_BYTES || !isCanonicalScalar(signature.subarray(32))) {
+        throw new KavachError("BAD_SIGNATURE", stage);
+    }
+    if (!be().verifyDetached(signature, concat(C(label), body), publicKey))
+        throw new KavachError("BAD_SIGNATURE", stage);
+}
+// AEAD ---------------------------------------------------------------------------------------
+/** XChaCha20-Poly1305: returns ciphertext with the 16-byte tag appended. */
+export function aeadSeal(key, nonce, aad, plaintext) {
+    if (key.length !== KEY_BYTES || nonce.length !== NONCE_BYTES)
+        throw new KavachError("INVALID_KEY", "aead");
+    return be().aeadEncrypt(plaintext, aad, nonce, key);
+}
+export function aeadOpen(key, nonce, aad, ciphertextAndTag, stage = "decrypt") {
+    if (key.length !== KEY_BYTES || nonce.length !== NONCE_BYTES)
+        throw new KavachError("INVALID_KEY", stage);
+    try {
+        return be().aeadDecrypt(ciphertextAndTag, aad, nonce, key);
+    }
+    catch {
+        throw new KavachError("DECRYPT_FAILED", stage);
+    }
+}
+// Sealed boxes -------------------------------------------------------------------------------
+/** The sealed-box nonce: BLAKE2b-24 over the ephemeral and recipient public keys, as libsodium defines it. */
+export function sealedBoxNonce(ephemeralPublicKey, recipientPublicKey) {
+    return be().blake2b(concat(ephemeralPublicKey, recipientPublicKey), NONCE_BYTES);
+}
+/** `crypto_box_seal` with a given ephemeral keypair (tests reproduce fixture wraps with it). */
+export function sealBoxWith(epochKey, recipientPublicKey, ephemeral) {
+    const nonce = sealedBoxNonce(ephemeral.publicKey, recipientPublicKey);
+    return concat(ephemeral.publicKey, be().boxEasy(epochKey, nonce, recipientPublicKey, ephemeral.secretKey));
+}
+/** `crypto_box_seal` of a 32-byte epoch key: exactly 80 bytes. */
+export function sealBox(epochKey, recipientPublicKey) {
+    if (epochKey.length !== KEY_BYTES)
+        throw new KavachError("INVALID_KEY", "seal");
+    assertValidBoxKey(recipientPublicKey, "seal");
+    return sealBoxWith(epochKey, recipientPublicKey, be().boxKeypair());
+}
+export function openSealedBox(box, recipient, stage = "open-wrap") {
+    if (box.length !== SEALED_BOX_BYTES)
+        throw new KavachError("MALFORMED", stage, "wrap must be 80 bytes");
+    try {
+        const ephemeralPublic = box.subarray(0, PUBLIC_KEY_BYTES);
+        const nonce = sealedBoxNonce(ephemeralPublic, recipient.publicKey);
+        return be().boxOpenEasy(box.subarray(PUBLIC_KEY_BYTES), nonce, ephemeralPublic, recipient.secretKey);
+    }
+    catch {
+        throw new KavachError("DECRYPT_FAILED", stage);
+    }
+}
+/** `crypto_box_seed_keypair`, exposed for tests that rebuild fixture wraps from their ephemeral seeds. */
+export function boxKeypairFromSeed(seed) {
+    return be().boxKeypairFromSeed(seed);
+}
+// Randomness and hygiene ----------------------------------------------------------------------
+export function randomBytes(length) {
+    return be().randomBytes(length);
+}
+/** Best-effort zeroisation. JavaScript gives no guarantee; the protocol says so. */
+export function zero(bytes) {
+    be().memzero(bytes);
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAA2E,MAAM,qBAAqB,CAAC;AAChJ,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,0FAA0F;AAC1F,MAAM,CAAC,MAAM,YAAY,GAAG,iBAAiB,CAAC;AAC9C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAC9B,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,CAAC;AAC7B,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC;AAC5B,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,CAAC;AAC7B,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAC9B,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC;AAC5B,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,6DAA6D;AAC7D,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAoB5C,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,KAAK;IACzB,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACtB,8FAA8F;QAC9F,6FAA6F;QAC7F,MAAM,CAAC,GAAG,UAAwD,CAAC;QACnE,IAAI,OAAO,CAAC,CAAC,MAAM,EAAE,eAAe,KAAK,UAAU;YAAE,MAAM,IAAI,WAAW,CAAC,aAAa,EAAE,OAAO,EAAE,iFAAiF,CAAC,CAAC;QACtL,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,SAAS,EAAE;IACT,MAAM,CAAC,GAAG,cAAc,EAAE,CAAC;IAC3B,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAChB,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC/B,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC;AACnB,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,IAAI;YAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,CAAC,CAAC;QACzD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,CAAC,CAAC,KAAY;IAC5B,OAAO,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,CAAC,CAAC,IAAgB;IAChC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,CAAC,CAAC,IAAgB,EAAE,KAAY;IAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU;QAAE,MAAM,IAAI,WAAW,CAAC,aAAa,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAC;IACxG,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAgB;IACvC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,WAAmB,EAAE,gBAA4B;IAC1E,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAoB,EAAE,QAAoB;IACjE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAkB,EAAE,KAAa,EAAE,OAAe;IACzE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAgB;IACvC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAkB,EAAE,KAAa,EAAE,QAAoB;IACnF,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,+FAA+F;AAE/F,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,WAAuB;IACpD,OAAO,sBAAsB,CAAC,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,oBAAoB,CAAC,UAAsB;IACzD,OAAO,sBAAsB,CAAC,CAAC,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,gBAAgB,CAAC,UAAsB;IACrD,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAgB;IACrD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU;QAAE,MAAM,IAAI,WAAW,CAAC,aAAa,EAAE,SAAS,EAAE,uBAAuB,CAAC,CAAC;IACzG,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,qBAAqB,CAAC,SAAqB,EAAE,KAAK,GAAG,QAAQ;IAC3E,IAAI,SAAS,CAAC,MAAM,KAAK,gBAAgB,IAAI,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,WAAW,CAAC,aAAa,EAAE,KAAK,EAAE,4BAA4B,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnD,MAAM,UAAU,iBAAiB,CAAC,SAAqB,EAAE,KAAK,GAAG,QAAQ;IACvE,IAAI,SAAS,CAAC,MAAM,KAAK,gBAAgB,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,WAAW,CAAC,aAAa,EAAE,KAAK,EAAE,2BAA2B,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,SAAS,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,aAAa,EAAE,KAAK,EAAE,6BAA6B,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,gGAAgG;AAEhG,qFAAqF;AACrF,MAAM,UAAU,IAAI,CAAC,SAAqB,EAAE,KAAY,EAAE,IAAgB;IACxE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC;IACxB,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAChH,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CAC7E,CAAC,CAAC;AAEH,SAAS,iBAAiB,CAAC,CAAa;IACtC,iEAAiE;IACjE,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,SAAqB,EAAE,KAAY,EAAE,IAAgB,EAAE,SAAqB,EAAE,KAAK,GAAG,QAAQ;IACnH,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,SAAS,CAAC,MAAM,KAAK,eAAe,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;AACxH,CAAC;AAED,+FAA+F;AAE/F,4EAA4E;AAC5E,MAAM,UAAU,QAAQ,CAAC,GAAe,EAAE,KAAiB,EAAE,GAAe,EAAE,SAAqB;IACjG,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;QAAE,MAAM,IAAI,WAAW,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC3G,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAe,EAAE,KAAiB,EAAE,GAAe,EAAE,gBAA4B,EAAE,KAAK,GAAG,SAAS;IAC3H,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;QAAE,MAAM,IAAI,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAC1G,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,+FAA+F;AAE/F,8GAA8G;AAC9G,MAAM,UAAU,cAAc,CAAC,kBAA8B,EAAE,kBAA8B;IAC3F,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,EAAE,WAAW,CAAC,CAAC;AACnF,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,WAAW,CAAC,QAAoB,EAAE,kBAA8B,EAAE,SAAqB;IACrG,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,OAAO,CAAC,QAAoB,EAAE,kBAA8B;IAC1E,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAChF,iBAAiB,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,WAAW,CAAC,QAAQ,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAe,EAAE,SAAqB,EAAE,KAAK,GAAG,WAAW;IACvF,IAAI,GAAG,CAAC,MAAM,KAAK,gBAAgB;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,uBAAuB,CAAC,CAAC;IACxG,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,cAAc,CAAC,eAAe,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QACnE,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IACvG,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,kBAAkB,CAAC,IAAgB;IACjD,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,gGAAgG;AAEhG,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,IAAI,CAAC,KAAiB;IACpC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC"}

package/dist/epoch.d.ts

@@ -0,0 +1,93 @@
+import type { ResolvedAudience } from "./audience.js";
+import { type EpochManifest, type Parsed } from "./codec.js";
+import { type BoxKeypair } from "./crypto.js";
+export declare const MAX_COUNTER = 4294967295;
+export declare const MAX_EPOCH = 4294967295;
+export interface AuthorKeys {
+    readonly identityId: Uint8Array;
+    readonly certificateHash: Uint8Array;
+    readonly streamId: Uint8Array;
+    readonly signingSecretKey: Uint8Array;
+}
+/** Everything T4 persists before any network call. */
+export interface PreparedEpoch {
+    readonly epoch: number;
+    readonly manifest: Uint8Array;
+    readonly manifestHash: Uint8Array;
+    /** Wrap per recipient identity id (hex), the author's own included. */
+    readonly wraps: ReadonlyMap<string, Uint8Array>;
+    readonly epochKey: Uint8Array;
+    readonly capturedRevision: bigint;
+    readonly audienceKey: string;
+    readonly createdAt: bigint;
+}
+/** Prepare an epoch: fresh random key, one sealed box per row, one signature. */
+export declare function prepareEpoch(input: {
+    readonly author: AuthorKeys;
+    readonly epoch: number;
+    readonly createdAt: bigint;
+    readonly audience: ResolvedAudience;
+    readonly desiredRevision: bigint;
+    readonly epochKey?: Uint8Array;
+}): PreparedEpoch;
+export type PublishOutcome = {
+    readonly status: "COMMITTED";
+} | {
+    readonly status: "ALREADY_COMMITTED";
+} | {
+    readonly status: "CONFLICT";
+    readonly currentEpoch: number;
+    readonly currentManifest: Uint8Array | undefined;
+} | {
+    readonly status: "RETRYABLE";
+} | {
+    readonly status: "UNAUTHORIZED";
+} | {
+    readonly status: "PERMANENT_FAILURE";
+};
+export type PublishResolution = "COMMITTED" | "RETRY";
+/**
+ * Resolve a publish outcome for a prepared epoch. Identical bytes at the slot mean committed; a
+ * different valid body at the same epoch is `EQUIVOCATION`; a higher committed epoch than the one
+ * prepared means local state was lost and the device must replace its stream.
+ */
+export declare function resolvePublish(prepared: PreparedEpoch, outcome: PublishOutcome): PublishResolution;
+export type PromotionOutcome = "PROMOTED" | "OBSOLETE";
+/** After commit: promote only if the captured revision and the exact audience still match. */
+export declare function promote(prepared: PreparedEpoch, currentDesiredRevision: bigint, currentAudienceKey: string): PromotionOutcome;
+export type RotationReason = "counterExhausted" | "hygiene" | "clockReversal";
+export interface ActiveEpochView {
+    readonly createdAt: bigint;
+    readonly nextCounter: number;
+    readonly lastSentAt: bigint | undefined;
+}
+export declare function rotationReason(active: ActiveEpochView, now: bigint, hygieneRotationMs: bigint): RotationReason | undefined;
+export interface AuthorCertificateView {
+    readonly certificateHash: Uint8Array;
+    readonly signingKey: Uint8Array;
+    readonly streamId: Uint8Array;
+    readonly current: boolean;
+}
+export interface AuthorView {
+    readonly identityId: Uint8Array;
+    /** The author's current certificate and any archived ones the reader still holds, by hash (hex). */
+    readonly certificates: ReadonlyMap<string, AuthorCertificateView>;
+}
+export interface SelfView {
+    readonly identityId: Uint8Array;
+    readonly certificateHash: Uint8Array;
+    readonly box: BoxKeypair;
+}
+export interface OpenedEpoch {
+    readonly manifest: Parsed<EpochManifest>;
+    readonly epochKey: Uint8Array;
+    /** The manifest belongs to a device of the author that is no longer current: history only. */
+    readonly superseded: boolean;
+}
+/**
+ * Every check of section 8 before a key is stored: manifest signature under the certificate it
+ * names, that certificate's identity and stream, the author's own row, the reader's own row at
+ * its current certificate, the wrap hash, the sealed box and the key commitment.
+ */
+export declare function openEpoch(manifestWire: Uint8Array, author: AuthorView, self: SelfView, wrap: Uint8Array): OpenedEpoch;
+//# sourceMappingURL=epoch.d.ts.map

package/dist/epoch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"epoch.d.ts","sourceRoot":"","sources":["../src/epoch.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAA+E,KAAK,aAAa,EAAE,KAAK,MAAM,EAAE,MAAM,YAAY,CAAC;AAC1I,OAAO,EAAqF,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAGjI,eAAO,MAAM,WAAW,aAAc,CAAC;AACvC,eAAO,MAAM,SAAS,aAAc,CAAC;AAErC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,UAAU,CAAC;CACvC;AAED,sDAAsD;AACtD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC;IAClC,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;CAChC,GAAG,aAAa,CAiChB;AAID,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAChC;IAAE,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,GACxC;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,UAAU,GAAG,SAAS,CAAA;CAAE,GAChH;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAChC;IAAE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE,GACnC;IAAE,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAE7C,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,OAAO,CAAC;AAEtD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,GAAG,iBAAiB,CA0BlG;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,UAAU,CAAC;AAEvD,8FAA8F;AAC9F,wBAAgB,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,GAAG,gBAAgB,CAE7H;AAID,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG,SAAS,GAAG,eAAe,CAAC;AAE9E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAK1H;AAID,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,oGAAoG;IACpG,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,8FAA8F;IAC9F,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,GAAG,WAAW,CAuBrH"}