@sempdev/semp 0.4.3 → 0.5.1

package/dist/crypto/index.d.ts

@@ -10,5 +10,5 @@ export { newHKDFSHA512, deriveSessionKeys, deriveSessionKeysWithResumption, deri
 export { computeMAC, verifyMAC } from "./mac.js";
 export { type AEADAlgorithm, aeadOpen, aeadSeal } from "./aead.js";
 export { argon2idKDF } from "./argon2.js";
-export { HybridCiphertextSize, HybridPrivateKeySize, HybridPublicKeySize, HybridSharedSecretSize, Kyber768CiphertextSize, Kyber768PrivateKeySize, Kyber768PublicKeySize, Kyber768SharedKeySize, X25519Size, hybridDecapsulate, hybridPrivateKeyFromKyberAndX25519, kyber768Decapsulate, kyber768EncapsulateDeterministic, kyber768KeyPairFromSeed, x25519Agree, x25519PublicKey, } from "./kem.js";
+export { HybridCiphertextSize, HybridPrivateKeySize, HybridPublicKeySize, HybridSharedSecretSize, Kyber768CiphertextSize, Kyber768PrivateKeySize, Kyber768PublicKeySize, Kyber768SharedKeySize, X25519Size, hybridDecapsulate, hybridEncapsulate, hybridGenerateKeyPair, hybridPrivateKeyFromKyberAndX25519, kyber768Decapsulate, kyber768EncapsulateDeterministic, kyber768KeyPairFromSeed, x25519Agree, x25519PublicKey, } from "./kem.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/crypto/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,+BAA+B,EAC/B,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,GAAG,EACR,KAAK,WAAW,GACjB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EAAE,KAAK,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEnE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,kCAAkC,EAClC,mBAAmB,EACnB,gCAAgC,EAChC,uBAAuB,EACvB,WAAW,EACX,eAAe,GAChB,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,+BAA+B,EAC/B,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,GAAG,EACR,KAAK,WAAW,GACjB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EAAE,KAAK,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEnE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,kCAAkC,EAClC,mBAAmB,EACnB,gCAAgC,EAChC,uBAAuB,EACvB,WAAW,EACX,eAAe,GAChB,MAAM,UAAU,CAAC"}

package/dist/crypto/index.js

@@ -10,5 +10,5 @@ export { newHKDFSHA512, deriveSessionKeys, deriveSessionKeysWithResumption, deri
 export { computeMAC, verifyMAC } from "./mac.js";
 export { aeadOpen, aeadSeal } from "./aead.js";
 export { argon2idKDF } from "./argon2.js";
-export { HybridCiphertextSize, HybridPrivateKeySize, HybridPublicKeySize, HybridSharedSecretSize, Kyber768CiphertextSize, Kyber768PrivateKeySize, Kyber768PublicKeySize, Kyber768SharedKeySize, X25519Size, hybridDecapsulate, hybridPrivateKeyFromKyberAndX25519, kyber768Decapsulate, kyber768EncapsulateDeterministic, kyber768KeyPairFromSeed, x25519Agree, x25519PublicKey, } from "./kem.js";
+export { HybridCiphertextSize, HybridPrivateKeySize, HybridPublicKeySize, HybridSharedSecretSize, Kyber768CiphertextSize, Kyber768PrivateKeySize, Kyber768PublicKeySize, Kyber768SharedKeySize, X25519Size, hybridDecapsulate, hybridEncapsulate, hybridGenerateKeyPair, hybridPrivateKeyFromKyberAndX25519, kyber768Decapsulate, kyber768EncapsulateDeterministic, kyber768KeyPairFromSeed, x25519Agree, x25519PublicKey, } from "./kem.js";
 //# sourceMappingURL=index.js.map

package/dist/crypto/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,+BAA+B,EAC/B,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,GAGjB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EAAsB,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEnE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,kCAAkC,EAClC,mBAAmB,EACnB,gCAAgC,EAChC,uBAAuB,EACvB,WAAW,EACX,eAAe,GAChB,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,+BAA+B,EAC/B,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,GAGjB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EAAsB,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEnE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,kCAAkC,EAClC,mBAAmB,EACnB,gCAAgC,EAChC,uBAAuB,EACvB,WAAW,EACX,eAAe,GAChB,MAAM,UAAU,CAAC"}

package/dist/crypto/kem.d.ts

@@ -69,6 +69,35 @@ export declare function kyber768Decapsulate(secretKey: Uint8Array, ciphertext: U
  * from a real entropy-driven keygen.
  */
 export declare function hybridPrivateKeyFromKyberAndX25519(x25519Priv: Uint8Array, kyberPriv: Uint8Array): Uint8Array;
+/**
+ * Generate a fresh hybrid keypair. The public half is
+ * `kyberPub || x25519Pub` (1216 bytes), the private half is
+ * `kyberPriv || x25519Priv` (2432 bytes). Used by the initiator
+ * side of the handshake to produce an ephemeral hybrid pub for
+ * INIT.
+ *
+ * Both halves are entropy-driven via `globalThis.crypto`. The
+ * Kyber half uses ML-KEM-768 keygen with a fresh 64-byte seed.
+ */
+export declare function hybridGenerateKeyPair(): {
+    publicKey: Uint8Array;
+    secretKey: Uint8Array;
+};
+/**
+ * Hybrid Encapsulate. Responder-side: takes the initiator's
+ * hybrid public key (`kyberPub || x25519Pub`), generates a fresh
+ * ephemeral X25519 keypair, encapsulates a Kyber shared key
+ * under the initiator's Kyber pub, and returns:
+ *
+ *   - sharedSecret: `K_kyber || K_x25519` (64 bytes)
+ *   - ciphertext:   `kyberCt || responderX25519Pub` (1120 bytes)
+ *
+ * Wire layout matches `ENVELOPE.md` §4.4.1 (Kyber FIRST).
+ */
+export declare function hybridEncapsulate(remotePub: Uint8Array): {
+    ciphertext: Uint8Array;
+    sharedSecret: Uint8Array;
+};
 /**
  * Hybrid Decapsulate. Reverses the responder-side encapsulation
  * (kyber half + X25519 ECDH against the sender's ephemeral pub)

package/dist/crypto/kem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kem.d.ts","sourceRoot":"","sources":["../../src/crypto/kem.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,kCAAkC;AAClC,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAC1C,mCAAmC;AACnC,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAC3C,kCAAkC;AAClC,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAC3C,wDAAwD;AACxD,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,0CAA0C;AAC1C,eAAO,MAAM,UAAU,KAAK,CAAC;AAE7B,mCAAmC;AACnC,eAAO,MAAM,mBAAmB,QAAqC,CAAC;AACtE,oCAAoC;AACpC,eAAO,MAAM,oBAAoB,QAAsC,CAAC;AACxE,mCAAmC;AACnC,eAAO,MAAM,oBAAoB,QAAsC,CAAC;AACxE,2CAA2C;AAC3C,eAAO,MAAM,sBAAsB,QAAqC,CAAC;AAKzE,4DAA4D;AAC5D,wBAAgB,WAAW,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAEpF;AAED,2DAA2D;AAC3D,wBAAgB,eAAe,CAAC,SAAS,EAAE,UAAU,GAAG,UAAU,CAEjE;AAKD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,UAAU,GAAG;IACzD,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,UAAU,CAAC;CACvB,CAMA;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,UAAU,EACrB,CAAC,EAAE,UAAU,GACZ;IAAE,UAAU,EAAE,UAAU,CAAC;IAAC,YAAY,EAAE,UAAU,CAAA;CAAE,CAGtD;AAED,gCAAgC;AAChC,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,UAAU,EACrB,UAAU,EAAE,UAAU,GACrB,UAAU,CAEZ;AAKD;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,GACpB,UAAU,CAWZ;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,GACpB,UAAU,CAuBZ"}
+{"version":3,"file":"kem.d.ts","sourceRoot":"","sources":["../../src/crypto/kem.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,kCAAkC;AAClC,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAC1C,mCAAmC;AACnC,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAC3C,kCAAkC;AAClC,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAC3C,wDAAwD;AACxD,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,0CAA0C;AAC1C,eAAO,MAAM,UAAU,KAAK,CAAC;AAE7B,mCAAmC;AACnC,eAAO,MAAM,mBAAmB,QAAqC,CAAC;AACtE,oCAAoC;AACpC,eAAO,MAAM,oBAAoB,QAAsC,CAAC;AACxE,mCAAmC;AACnC,eAAO,MAAM,oBAAoB,QAAsC,CAAC;AACxE,2CAA2C;AAC3C,eAAO,MAAM,sBAAsB,QAAqC,CAAC;AAKzE,4DAA4D;AAC5D,wBAAgB,WAAW,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAEpF;AAED,2DAA2D;AAC3D,wBAAgB,eAAe,CAAC,SAAS,EAAE,UAAU,GAAG,UAAU,CAEjE;AAKD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,UAAU,GAAG;IACzD,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,UAAU,CAAC;CACvB,CAMA;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,UAAU,EACrB,CAAC,EAAE,UAAU,GACZ;IAAE,UAAU,EAAE,UAAU,CAAC;IAAC,YAAY,EAAE,UAAU,CAAA;CAAE,CAGtD;AAED,gCAAgC;AAChC,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,UAAU,EACrB,UAAU,EAAE,UAAU,GACrB,UAAU,CAEZ;AAKD;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,GACpB,UAAU,CAWZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,IAAI;IACvC,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,UAAU,CAAC;CACvB,CAcA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,UAAU,GACpB;IAAE,UAAU,EAAE,UAAU,CAAC;IAAC,YAAY,EAAE,UAAU,CAAA;CAAE,CA+BtD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,GACpB,UAAU,CAuBZ"}

package/dist/crypto/kem.js

@@ -97,6 +97,69 @@ export function hybridPrivateKeyFromKyberAndX25519(x25519Priv, kyberPriv) {
     out.set(x25519Priv, Kyber768PrivateKeySize);
     return out;
 }
+/**
+ * Generate a fresh hybrid keypair. The public half is
+ * `kyberPub || x25519Pub` (1216 bytes), the private half is
+ * `kyberPriv || x25519Priv` (2432 bytes). Used by the initiator
+ * side of the handshake to produce an ephemeral hybrid pub for
+ * INIT.
+ *
+ * Both halves are entropy-driven via `globalThis.crypto`. The
+ * Kyber half uses ML-KEM-768 keygen with a fresh 64-byte seed.
+ */
+export function hybridGenerateKeyPair() {
+    const xPriv = new Uint8Array(X25519Size);
+    globalThis.crypto.getRandomValues(xPriv);
+    const xPub = x25519PublicKey(xPriv);
+    const seed = new Uint8Array(64);
+    globalThis.crypto.getRandomValues(seed);
+    const { secretKey: kyberPriv, publicKey: kyberPub } = ml_kem768.keygen(seed);
+    const pub = new Uint8Array(HybridPublicKeySize);
+    pub.set(kyberPub, 0);
+    pub.set(xPub, Kyber768PublicKeySize);
+    const priv = new Uint8Array(HybridPrivateKeySize);
+    priv.set(kyberPriv, 0);
+    priv.set(xPriv, Kyber768PrivateKeySize);
+    return { publicKey: pub, secretKey: priv };
+}
+/**
+ * Hybrid Encapsulate. Responder-side: takes the initiator's
+ * hybrid public key (`kyberPub || x25519Pub`), generates a fresh
+ * ephemeral X25519 keypair, encapsulates a Kyber shared key
+ * under the initiator's Kyber pub, and returns:
+ *
+ *   - sharedSecret: `K_kyber || K_x25519` (64 bytes)
+ *   - ciphertext:   `kyberCt || responderX25519Pub` (1120 bytes)
+ *
+ * Wire layout matches `ENVELOPE.md` §4.4.1 (Kyber FIRST).
+ */
+export function hybridEncapsulate(remotePub) {
+    if (remotePub.length !== HybridPublicKeySize) {
+        throw new Error(`hybrid Encapsulate: remote pub ${remotePub.length} bytes, want ${HybridPublicKeySize}`);
+    }
+    const kyberRemote = remotePub.slice(0, Kyber768PublicKeySize);
+    const xRemote = remotePub.slice(Kyber768PublicKeySize);
+    const xEphPriv = new Uint8Array(X25519Size);
+    globalThis.crypto.getRandomValues(xEphPriv);
+    const xEphPub = x25519PublicKey(xEphPriv);
+    const xSS = x25519Agree(xEphPriv, xRemote);
+    // Burn the X25519 ephemeral private now that the shared
+    // secret is in hand.
+    xEphPriv.fill(0);
+    // ML-KEM-768 entropy-driven encapsulation. The noble API
+    // expects the FIPS 203 `m` randomness as the second argument;
+    // when omitted it pulls from `globalThis.crypto`.
+    const m = new Uint8Array(32);
+    globalThis.crypto.getRandomValues(m);
+    const { cipherText: kyberCt, sharedSecret: kyberSS } = ml_kem768.encapsulate(kyberRemote, m);
+    const ciphertext = new Uint8Array(HybridCiphertextSize);
+    ciphertext.set(kyberCt, 0);
+    ciphertext.set(xEphPub, Kyber768CiphertextSize);
+    const sharedSecret = new Uint8Array(HybridSharedSecretSize);
+    sharedSecret.set(kyberSS, 0);
+    sharedSecret.set(xSS, Kyber768SharedKeySize);
+    return { ciphertext, sharedSecret };
+}
 /**
  * Hybrid Decapsulate. Reverses the responder-side encapsulation
  * (kyber half + X25519 ECDH against the sender's ephemeral pub)

package/dist/crypto/kem.js.map

@@ -1 +1 @@
-{"version":3,"file":"kem.js","sourceRoot":"","sources":["../../src/crypto/kem.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAE1D,kCAAkC;AAClC,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAC1C,mCAAmC;AACnC,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAC3C,kCAAkC;AAClC,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAC3C,wDAAwD;AACxD,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,0CAA0C;AAC1C,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,CAAC;AAE7B,mCAAmC;AACnC,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,GAAG,UAAU,CAAC,CAAC,OAAO;AAC9E,oCAAoC;AACpC,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,GAAG,UAAU,CAAC,CAAC,OAAO;AAChF,mCAAmC;AACnC,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,GAAG,UAAU,CAAC,CAAC,OAAO;AAChF,2CAA2C;AAC3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAAqB,GAAG,UAAU,CAAC,CAAC,KAAK;AAE/E,8EAA8E;AAC9E,wBAAwB;AAExB,4DAA4D;AAC5D,MAAM,UAAU,WAAW,CAAC,SAAqB,EAAE,SAAqB;IACtE,OAAO,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,eAAe,CAAC,SAAqB;IACnD,OAAO,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;AACxC,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AAExB;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAgB;IAItD,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uDAAuD,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAC9C,SAAqB,EACrB,CAAa;IAEb,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACzE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AAClD,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,mBAAmB,CACjC,SAAqB,EACrB,UAAsB;IAEtB,OAAO,SAAS,CAAC,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAElE;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAChD,UAAsB,EACtB,SAAqB;IAErB,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,uBAAuB,UAAU,QAAQ,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,sBAAsB,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,sBAAsB,sBAAsB,QAAQ,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,oBAAoB,CAAC,CAAC;IACjD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAsB,EACtB,SAAqB;IAErB,IAAI,UAAU,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,kCAAkC,UAAU,CAAC,MAAM,gBAAgB,oBAAoB,EAAE,CAC1F,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,4BAA4B,SAAS,CAAC,MAAM,gBAAgB,oBAAoB,EAAE,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAE3D,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,sBAAsB,CAAC,CAAC;IACtD,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"kem.js","sourceRoot":"","sources":["../../src/crypto/kem.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAE1D,kCAAkC;AAClC,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAC1C,mCAAmC;AACnC,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAC3C,kCAAkC;AAClC,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAC3C,wDAAwD;AACxD,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,0CAA0C;AAC1C,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,CAAC;AAE7B,mCAAmC;AACnC,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,GAAG,UAAU,CAAC,CAAC,OAAO;AAC9E,oCAAoC;AACpC,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,GAAG,UAAU,CAAC,CAAC,OAAO;AAChF,mCAAmC;AACnC,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,GAAG,UAAU,CAAC,CAAC,OAAO;AAChF,2CAA2C;AAC3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAAqB,GAAG,UAAU,CAAC,CAAC,KAAK;AAE/E,8EAA8E;AAC9E,wBAAwB;AAExB,4DAA4D;AAC5D,MAAM,UAAU,WAAW,CAAC,SAAqB,EAAE,SAAqB;IACtE,OAAO,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,eAAe,CAAC,SAAqB;IACnD,OAAO,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;AACxC,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AAExB;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAgB;IAItD,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uDAAuD,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAC9C,SAAqB,EACrB,CAAa;IAEb,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACzE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AAClD,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,mBAAmB,CACjC,SAAqB,EACrB,UAAsB;IAEtB,OAAO,SAAS,CAAC,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAElE;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAChD,UAAsB,EACtB,SAAqB;IAErB,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,uBAAuB,UAAU,QAAQ,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,sBAAsB,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,sBAAsB,sBAAsB,QAAQ,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,oBAAoB,CAAC,CAAC;IACjD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB;IAInC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAChC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAChD,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACrB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACxC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAqB;IAErB,IAAI,SAAS,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,kCAAkC,SAAS,CAAC,MAAM,gBAAgB,mBAAmB,EAAE,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3C,wDAAwD;IACxD,qBAAqB;IACrB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,yDAAyD;IACzD,8DAA8D;IAC9D,kDAAkD;IAClD,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7B,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,WAAW,CAC1E,WAAW,EACX,CAAC,CACF,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,oBAAoB,CAAC,CAAC;IACxD,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC3B,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAC5D,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7B,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAC7C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAsB,EACtB,SAAqB;IAErB,IAAI,UAAU,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,kCAAkC,UAAU,CAAC,MAAM,gBAAgB,oBAAoB,EAAE,CAC1F,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,4BAA4B,SAAS,CAAC,MAAM,gBAAgB,oBAAoB,EAAE,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAE3D,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,sBAAsB,CAAC,CAAC;IACtD,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/delivery/forwarder.d.ts

@@ -18,39 +18,52 @@
  *   4. Returns the peer's parsed {@link SubmissionResponse}.
  *
  * The original sender's domain proof of provenance does NOT need
- * to be preserved separately — in the SEMP architecture the
+ * to be preserved separately; in the SEMP architecture the
  * sender's home server and the federation initiator are the SAME
  * server, so re-signing with the local domain key is functionally
  * identical to "the sender's domain signed this envelope".
  *
+ * The forwarder is protocol-pure: the two pluggable inputs it
+ * requires ({@link EndpointResolver} and {@link PeerDomainKeyLookup})
+ * cover everything the spec defines for federation peer addressing.
+ * Peer endpoint URLs come from `endpointResolver`, which the
+ * operator can wire to a discovery-driven lookup
+ * (DISCOVERY.md §5.1) or a static peer map. Peer signing keys
+ * come from `peerDomainKey`, which the operator can wire to a
+ * pre-loaded map (loaded at startup) or to a KEY.md fetcher
+ * ({@link "../discovery".fetchDomainKeys}). Neither shape is
+ * privileged; both satisfy the spec.
+ *
  * @module
  */
 import { type Envelope } from "../envelope/index.js";
+import type { KeysRequest, KeysResponse } from "../keys/index.js";
 import { type Capabilities, type FederationPolicy } from "../handshake/index.js";
 import type { Transport } from "../transport/index.js";
 import type { SubmissionResponse } from "./submission.js";
-/** Per-peer routing information. */
-export interface PeerConfig {
-    /** Peer's domain (e.g. `"b.example"`). */
-    domain: string;
-    /**
-     * Federation endpoint URL (e.g. `"ws://127.0.0.1:18082/v1/federate"`).
-     * The forwarder passes this verbatim to {@link Dialer}.
-     */
-    endpoint: string;
-    /**
-     * Peer's long-term Ed25519 signing public key. Used by the
-     * federation Initiator to verify the peer's response / accepted
-     * messages.
-     */
-    domainSigningPub: Uint8Array;
-}
-/** Domain → {@link PeerConfig} map. */
-export declare class PeerRegistry {
-    private readonly peers;
-    put(cfg: PeerConfig): void;
-    lookup(domain: string): PeerConfig | null;
-}
+/**
+ * Returns the federation endpoint URL the {@link Forwarder} should
+ * dial for `peerDomain`. Implementations cover the full range of
+ * peer-endpoint sourcing: a discovery-driven lookup over DNS SRV
+ * plus the well-known URI per DISCOVERY.md §5.1, a static map for
+ * operators that pre-pin known peers, or a hybrid that consults the
+ * static map first and falls back to discovery.
+ *
+ * Throwing blocks the federation handshake. The {@link Forwarder}
+ * surfaces the error to whoever asked for the forward.
+ */
+export type EndpointResolver = (peerDomain: string) => Promise<string>;
+/**
+ * Returns the long-term Ed25519 signing public key for a peer
+ * domain. Operators populate this from a startup-time map, from a
+ * KEY.md fetcher
+ * ({@link "../discovery".fetchDomainKeys}), or from a hybrid.
+ *
+ * Throwing blocks the federation handshake; the
+ * {@link Forwarder} surfaces the error to whoever asked for the
+ * forward.
+ */
+export type PeerDomainKeyLookup = (peerDomain: string) => Promise<Uint8Array>;
 /** Opens a transport to a peer's federation endpoint. */
 export type Dialer = (endpoint: string) => Promise<Transport>;
 /** Inputs to {@link Forwarder}. */
@@ -61,8 +74,25 @@ export interface ForwarderConfig {
     localServerID: string;
     /** Local 32-byte Ed25519 secret seed. */
     localDomainSeed: Uint8Array;
-    /** Static peer registry. */
-    peers: PeerRegistry;
+    /**
+     * Resolves a peer domain to a federation endpoint URL. Required.
+     *
+     * For pre-pinned static peers, supply a function that looks the
+     * domain up in an in-memory map. For discovery-driven lookups,
+     * compose a custom resolver around
+     * {@link "../discovery".fetchConfiguration} or
+     * {@link "../discovery".resolveServer}.
+     */
+    endpointResolver: EndpointResolver;
+    /**
+     * Resolves a peer domain to its long-term signing public key.
+     * Required.
+     *
+     * For pre-pinned static peers, supply a function that looks the
+     * domain up in an in-memory map. For lazy KEY.md fetch, compose a
+     * resolver around {@link "../discovery".fetchDomainKeys}.
+     */
+    peerDomainKey: PeerDomainKeyLookup;
     /** Transport dialer. */
     dial: Dialer;
     /**
@@ -91,9 +121,26 @@ export declare class Forwarder {
      * `K_env_mac` and ship `env` across the cached session for
      * `peerDomain`. Returns the peer's parsed submission response.
      *
-     * Opens a federation session lazily on first call per peer.
+     * Opens a federation session lazily on first call per peer. The
+     * peer endpoint is resolved through `cfg.endpointResolver`; the
+     * peer signing key is resolved through `cfg.peerDomainKey`. Both
+     * lookups happen before the dial, so an unknown peer fails fast.
      */
     forward(peerDomain: string, env: Envelope): Promise<SubmissionResponse>;
+    /**
+     * Fetch keys from `peerDomain` over the cached federation
+     * session. Mirrors {@link forward} but skips envelope handling
+     * entirely: the request is JSON-encoded, written to the
+     * federation stream, and the peer's JSON response is parsed and
+     * returned verbatim. The caller is responsible for verifying
+     * any signatures on the enclosed key records.
+     *
+     * Opens a federation session lazily on first call per peer. On
+     * a transport-level failure during the round trip, the cached
+     * session is dropped so the next call re-handshakes; protocol
+     * errors above the wire are surfaced without dropping.
+     */
+    fetchKeys(peerDomain: string, request: KeysRequest): Promise<KeysResponse>;
     /** Tear down every cached session. Call on shutdown. */
     close(): Promise<void>;
     /** Diagnostic: peer domains with a live cached session. */
@@ -101,6 +148,7 @@ export declare class Forwarder {
     private getSession;
     private openSession;
     private forwardOnSession;
+    private fetchKeysOnSession;
     private dropSession;
 }
 //# sourceMappingURL=forwarder.d.ts.map

package/dist/delivery/forwarder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forwarder.d.ts","sourceRoot":"","sources":["../../src/delivery/forwarder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EACL,KAAK,QAAQ,EAGd,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,KAAK,YAAY,EAEjB,KAAK,gBAAgB,EAEtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAK1D,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,gBAAgB,EAAE,UAAU,CAAC;CAC9B;AAED,uCAAuC;AACvC,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IAEvD,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI;IAO1B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;CAG1C;AAED,yDAAyD;AACzD,MAAM,MAAM,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;AAE9D,mCAAmC;AACnC,MAAM,WAAW,eAAe;IAC9B,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,eAAe,EAAE,UAAU,CAAC;IAC5B,4BAA4B;IAC5B,KAAK,EAAE,YAAY,CAAC;IACpB,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,oDAAoD;IACpD,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9D;AASD;;;;;;;GAOG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6C;gBAE5D,GAAG,EAAE,eAAe;IAahC;;;;;;OAMG;IACG,OAAO,CACX,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,QAAQ,GACZ,OAAO,CAAC,kBAAkB,CAAC;IAgB9B,wDAAwD;IAClD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAY5B,2DAA2D;IAC3D,WAAW,IAAI,MAAM,EAAE;YAMT,UAAU;YAkBV,WAAW;YAyDX,gBAAgB;IAqD9B,OAAO,CAAC,WAAW;CAUpB"}
+{"version":3,"file":"forwarder.d.ts","sourceRoot":"","sources":["../../src/delivery/forwarder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAIH,OAAO,EACL,KAAK,QAAQ,EAGd,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,YAAY,EAEjB,KAAK,gBAAgB,EAEtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAK1D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEvE;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAE9E,yDAAyD;AACzD,MAAM,MAAM,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;AAE9D,mCAAmC;AACnC,MAAM,WAAW,eAAe;IAC9B,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,eAAe,EAAE,UAAU,CAAC;IAC5B;;;;;;;;OAQG;IACH,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;;;OAOG;IACH,aAAa,EAAE,mBAAmB,CAAC;IACnC,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,oDAAoD;IACpD,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,MAAM,GAAG,IAAI,CAAC;CAC9D;AASD;;;;;;;GAOG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6C;gBAE5D,GAAG,EAAE,eAAe;IAahC;;;;;;;;;OASG;IACG,OAAO,CACX,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,QAAQ,GACZ,OAAO,CAAC,kBAAkB,CAAC;IAU9B;;;;;;;;;;;;OAYG;IACG,SAAS,CACb,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,YAAY,CAAC;IAUxB,wDAAwD;IAClD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAY5B,2DAA2D;IAC3D,WAAW,IAAI,MAAM,EAAE;YAMT,UAAU;YAgBV,WAAW;YAsEX,gBAAgB;YA+ChB,kBAAkB;IA+BhC,OAAO,CAAC,WAAW;CAUpB"}

package/dist/delivery/forwarder.js

@@ -18,11 +18,22 @@
  *   4. Returns the peer's parsed {@link SubmissionResponse}.
  *
  * The original sender's domain proof of provenance does NOT need
- * to be preserved separately — in the SEMP architecture the
+ * to be preserved separately; in the SEMP architecture the
  * sender's home server and the federation initiator are the SAME
  * server, so re-signing with the local domain key is functionally
  * identical to "the sender's domain signed this envelope".
  *
+ * The forwarder is protocol-pure: the two pluggable inputs it
+ * requires ({@link EndpointResolver} and {@link PeerDomainKeyLookup})
+ * cover everything the spec defines for federation peer addressing.
+ * Peer endpoint URLs come from `endpointResolver`, which the
+ * operator can wire to a discovery-driven lookup
+ * (DISCOVERY.md §5.1) or a static peer map. Peer signing keys
+ * come from `peerDomainKey`, which the operator can wire to a
+ * pre-loaded map (loaded at startup) or to a KEY.md fetcher
+ * ({@link "../discovery".fetchDomainKeys}). Neither shape is
+ * privileged; both satisfy the spec.
+ *
  * @module
  */
 import { marshal as canonicalMarshal } from "../canonical/index.js";
@@ -32,19 +43,6 @@ import { sign as ed25519Sign } from "../keys/index.js";
 import { FederationInitiator, } from "../handshake/index.js";
 /** Domain-separation prefix for the seal signature, per §4.3. */
 const EnvelopePrefix = "SEMP-ENVELOPE:";
-/** Domain → {@link PeerConfig} map. */
-export class PeerRegistry {
-    peers = new Map();
-    put(cfg) {
-        if (cfg.domain === "") {
-            throw new Error("delivery: PeerConfig missing domain");
-        }
-        this.peers.set(cfg.domain, { ...cfg });
-    }
-    lookup(domain) {
-        return this.peers.get(domain) ?? null;
-    }
-}
 /**
  * Federation forwarder.
  *
@@ -74,20 +72,40 @@ export class Forwarder {
      * `K_env_mac` and ship `env` across the cached session for
      * `peerDomain`. Returns the peer's parsed submission response.
      *
-     * Opens a federation session lazily on first call per peer.
+     * Opens a federation session lazily on first call per peer. The
+     * peer endpoint is resolved through `cfg.endpointResolver`; the
+     * peer signing key is resolved through `cfg.peerDomainKey`. Both
+     * lookups happen before the dial, so an unknown peer fails fast.
      */
     async forward(peerDomain, env) {
-        const cfg = this.cfg.peers.lookup(peerDomain);
-        if (cfg === null) {
-            throw new Error(`delivery: forwarder: unknown peer ${peerDomain}`);
-        }
-        const fs = await this.getSession(cfg);
+        const fs = await this.getSession(peerDomain);
         try {
             return await this.forwardOnSession(fs, env);
         }
         catch (err) {
-            // Drop the session on transport-layer failure; next call
-            // re-handshakes.
+            this.dropSession(peerDomain);
+            throw err;
+        }
+    }
+    /**
+     * Fetch keys from `peerDomain` over the cached federation
+     * session. Mirrors {@link forward} but skips envelope handling
+     * entirely: the request is JSON-encoded, written to the
+     * federation stream, and the peer's JSON response is parsed and
+     * returned verbatim. The caller is responsible for verifying
+     * any signatures on the enclosed key records.
+     *
+     * Opens a federation session lazily on first call per peer. On
+     * a transport-level failure during the round trip, the cached
+     * session is dropped so the next call re-handshakes; protocol
+     * errors above the wire are surfaced without dropping.
+     */
+    async fetchKeys(peerDomain, request) {
+        const fs = await this.getSession(peerDomain);
+        try {
+            return await this.fetchKeysOnSession(fs, request);
+        }
+        catch (err) {
             this.dropSession(peerDomain);
             throw err;
         }
@@ -110,25 +128,31 @@ export class Forwarder {
         return Array.from(this.sessions.keys()).sort();
     }
     // ---------------------------------------------------------------------------
-    async getSession(cfg) {
-        const cached = this.sessions.get(cfg.domain);
+    async getSession(peerDomain) {
+        const cached = this.sessions.get(peerDomain);
         if (cached !== undefined) {
             return cached;
         }
-        // Coalesce concurrent connects so we don't open two sessions to
-        // the same peer in parallel.
-        const inflight = this.connecting.get(cfg.domain);
+        const inflight = this.connecting.get(peerDomain);
         if (inflight !== undefined) {
             return inflight;
         }
-        const p = this.openSession(cfg).finally(() => {
-            this.connecting.delete(cfg.domain);
+        const p = this.openSession(peerDomain).finally(() => {
+            this.connecting.delete(peerDomain);
         });
-        this.connecting.set(cfg.domain, p);
+        this.connecting.set(peerDomain, p);
         return p;
     }
-    async openSession(cfg) {
-        const transport = await this.cfg.dial(cfg.endpoint);
+    async openSession(peerDomain) {
+        const endpoint = await this.cfg.endpointResolver(peerDomain);
+        if (endpoint === "") {
+            throw new Error(`delivery: endpointResolver returned empty URL for ${peerDomain}`);
+        }
+        const peerPub = await this.cfg.peerDomainKey(peerDomain);
+        if (peerPub.length === 0) {
+            throw new Error(`delivery: peerDomainKey returned empty key for ${peerDomain}`);
+        }
+        const transport = await this.cfg.dial(endpoint);
         const initiator = new FederationInitiator({
             suite: "x25519-chacha20-poly1305",
             capabilities: this.cfg.capabilities ?? {
@@ -139,12 +163,12 @@ export class Forwarder {
             localServerID: this.cfg.localServerID,
             localDomainSeed: this.cfg.localDomainSeed,
             peerDomainPubLookup: (d) => {
-                if (d !== cfg.domain) {
+                if (d !== peerDomain) {
                     throw new Error(`forwarder: peer domain pub lookup for unknown domain ${d}`);
                 }
-                return cfg.domainSigningPub;
+                return peerPub;
             },
-            peerDomain: cfg.domain,
+            peerDomain,
             domainProof: { method: "test-trust", data: this.cfg.localDomain },
             ...(this.cfg.policyAcceptor !== undefined
                 ? { policyAcceptor: this.cfg.policyAcceptor }
@@ -170,7 +194,7 @@ export class Forwarder {
                 session,
                 wireMu: { locked: false },
             };
-            this.sessions.set(cfg.domain, fs);
+            this.sessions.set(peerDomain, fs);
             return fs;
         }
         catch (err) {
@@ -184,18 +208,12 @@ export class Forwarder {
         }
     }
     async forwardOnSession(fs, env) {
-        // Serialize wire access — JS run-to-completion makes this a soft
-        // latch sufficient for the single-thread model.
         while (fs.wireMu.locked) {
             await new Promise((r) => setTimeout(r, 0));
         }
         fs.wireMu.locked = true;
         try {
-            // Update postmark.session_id so the peer's pipeline matches.
             env.postmark.session_id = fs.session.sessionId;
-            // Re-sign with our local domain key + re-MAC under federation
-            // K_env_mac. Both proofs cover the SAME canonical bytes (with
-            // signature + mac blanked).
             env.seal.signature = "";
             env.seal.session_mac = "";
             const canonical = canonicalEnvelopeFor(env);
@@ -220,6 +238,30 @@ export class Forwarder {
             fs.wireMu.locked = false;
         }
     }
+    async fetchKeysOnSession(fs, request) {
+        while (fs.wireMu.locked) {
+            await new Promise((r) => setTimeout(r, 0));
+        }
+        fs.wireMu.locked = true;
+        try {
+            const reqBytes = new TextEncoder().encode(JSON.stringify(request));
+            await fs.transport.send(reqBytes);
+            const respBytes = await fs.transport.receive();
+            if (respBytes === null) {
+                throw new Error("forwarder: connection closed waiting for SEMP_KEYS response");
+            }
+            const parsed = JSON.parse(new TextDecoder().decode(respBytes));
+            if (typeof parsed !== "object" ||
+                parsed === null ||
+                Array.isArray(parsed)) {
+                throw new Error("forwarder: SEMP_KEYS response is not a JSON object");
+            }
+            return parsed;
+        }
+        finally {
+            fs.wireMu.locked = false;
+        }
+    }
     dropSession(peerDomain) {
         const fs = this.sessions.get(peerDomain);
         if (fs === undefined) {

package/dist/delivery/forwarder.js.map

@@ -1 +1 @@
-{"version":3,"file":"forwarder.js","sourceRoot":"","sources":["../../src/delivery/forwarder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAEL,oBAAoB,EACpB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAIL,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAK/B,iEAAiE;AACjE,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAmBxC,uCAAuC;AACvC,MAAM,OAAO,YAAY;IACN,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEvD,GAAG,CAAC,GAAe;QACjB,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IACxC,CAAC;CACF;AAiCD;;;;;;;GAOG;AACH,MAAM,OAAO,SAAS;IACH,GAAG,CAAkB;IACrB,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC5C,UAAU,GAAG,IAAI,GAAG,EAAkC,CAAC;IAExE,YAAY,GAAoB;QAC9B,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,GAAG,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CACX,UAAkB,EAClB,GAAa;QAEb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,qCAAqC,UAAU,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yDAAyD;YACzD,iBAAiB;YACjB,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YAC7B,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,KAAK;QACT,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,WAAW;QACT,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,8EAA8E;IAEtE,KAAK,CAAC,UAAU,CAAC,GAAe;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,gEAAgE;QAChE,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC3C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,GAAe;QACvC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC;YACxC,KAAK,EAAE,0BAA0B;YACjC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI;gBACrC,qBAAqB,EAAE,CAAC,0BAA0B,CAAC;gBACnD,UAAU,EAAE,EAAE;aACf;YACD,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW;YACjC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa;YACrC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe;YACzC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE;gBACzB,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;oBACrB,MAAM,IAAI,KAAK,CACb,wDAAwD,CAAC,EAAE,CAC5D,CAAC;gBACJ,CAAC;gBACD,OAAO,GAAG,CAAC,gBAAgB,CAAC;YAC9B,CAAC;YACD,UAAU,EAAE,GAAG,CAAC,MAAM;YACtB,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;YACjE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACnC,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;YAChD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;YACD,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,EAAE,GAAkB;gBACxB,SAAS;gBACT,OAAO;gBACP,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;aAC1B,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAClC,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,EAAiB,EACjB,GAAa;QAEb,iEAAiE;QACjE,gDAAgD;QAChD,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,6DAA6D;YAC7D,GAAG,CAAC,QAAQ,CAAC,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;YAE/C,8DAA8D;YAC9D,8DAA8D;YAC9D,4BAA4B;YAC5B,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,YAAY,GAAG,MAAM,CACzB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,EACxC,SAAS,CACV,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,YAAY,CAC/B,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CACpD,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,WAAW,GAAG,YAAY,CACjC,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAC9C,CAAC;YAEF,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YAC/D,IACE,OAAO,MAAM,KAAK,QAAQ;gBAC1B,MAAM,KAAK,IAAI;gBACf,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACrB,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,MAA4B,CAAC;QACtC,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,UAAkB;QACpC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjC,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YAC9B,cAAc;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,KAAK,gBAAgB,CAAC;AAEtB,SAAS,MAAM,CAAC,CAAa,EAAE,CAAa;IAC1C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAChD,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACd,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,CAAa;IACjC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC"}
+{"version":3,"file":"forwarder.js","sourceRoot":"","sources":["../../src/delivery/forwarder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAEL,oBAAoB,EACpB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAKvD,OAAO,EAIL,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAK/B,iEAAiE;AACjE,MAAM,cAAc,GAAG,gBAAgB,CAAC;AA2ExC;;;;;;;GAOG;AACH,MAAM,OAAO,SAAS;IACH,GAAG,CAAkB;IACrB,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC5C,UAAU,GAAG,IAAI,GAAG,EAAkC,CAAC;IAExE,YAAY,GAAoB;QAC9B,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,GAAG,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,CACX,UAAkB,EAClB,GAAa;QAEb,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YAC7B,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,SAAS,CACb,UAAkB,EAClB,OAAoB;QAEpB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YAC7B,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,KAAK;QACT,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,WAAW;QACT,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,8EAA8E;IAEtE,KAAK,CAAC,UAAU,CAAC,UAAkB;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAClD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,UAAkB;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,qDAAqD,UAAU,EAAE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,kDAAkD,UAAU,EAAE,CAC/D,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC;YACxC,KAAK,EAAE,0BAA0B;YACjC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI;gBACrC,qBAAqB,EAAE,CAAC,0BAA0B,CAAC;gBACnD,UAAU,EAAE,EAAE;aACf;YACD,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW;YACjC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa;YACrC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe;YACzC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE;gBACzB,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;oBACrB,MAAM,IAAI,KAAK,CACb,wDAAwD,CAAC,EAAE,CAC5D,CAAC;gBACJ,CAAC;gBACD,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,UAAU;YACV,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;YACjE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACnC,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;YAChD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;YACD,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,EAAE,GAAkB;gBACxB,SAAS;gBACT,OAAO;gBACP,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;aAC1B,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAClC,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,EAAiB,EACjB,GAAa;QAEb,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,GAAG,CAAC,QAAQ,CAAC,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;YAE/C,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,YAAY,GAAG,MAAM,CACzB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,EACxC,SAAS,CACV,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,YAAY,CAC/B,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CACpD,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,WAAW,GAAG,YAAY,CACjC,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAC9C,CAAC;YAEF,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YAC/D,IACE,OAAO,MAAM,KAAK,QAAQ;gBAC1B,MAAM,KAAK,IAAI;gBACf,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACrB,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,MAA4B,CAAC;QACtC,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,EAAiB,EACjB,OAAoB;QAEpB,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACnE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YAC/D,IACE,OAAO,MAAM,KAAK,QAAQ;gBAC1B,MAAM,KAAK,IAAI;gBACf,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACrB,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,MAAsB,CAAC;QAChC,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,UAAkB;QACpC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjC,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YAC9B,cAAc;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,KAAK,gBAAgB,CAAC;AAEtB,SAAS,MAAM,CAAC,CAAa,EAAE,CAAa;IAC1C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAChD,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACd,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,CAAa;IACjC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC"}

package/dist/delivery/index.d.ts

@@ -27,5 +27,5 @@ export { type PolicyApplyReasonCode, type PolicySnapshot, PolicyApplyError, Poli
 export { type DecodedBrief, type DomainKeyLookup, type DomainPolicyFunc, type EnvMACFunc, type InboxStore, type LocalAddressFunc, type PipelineConfig, type PipelineLogger, type PipelineRejection, type PipelineResult, type RecipientPolicyFunc, type SessionRetiredFunc, Pipeline, } from "./pipeline.js";
 export { type StageCompleteFunc, type StageDeliverFunc, type StageSuppressFunc, type StagedRunnerConfig, EnvelopeAlreadyHeldError, EnvelopeNotHeldError, StagedRunner, } from "./staged_runner.js";
 export { type AttemptResult, type DeliverFunc, type EventSink, type SchedulerConfig, type SchedulerStore, InMemorySchedulerStore, Scheduler, TickInProgressError, UnknownRecordError, } from "./scheduler.js";
-export { type Dialer, type ForwarderConfig, type PeerConfig, Forwarder, PeerRegistry, } from "./forwarder.js";
+export { type Dialer, type EndpointResolver, type ForwarderConfig, type PeerDomainKeyLookup, Forwarder, } from "./forwarder.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/delivery/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delivery/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,2BAA2B,EAC3B,gCAAgC,EAChC,gCAAgC,EAChC,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,KAAK,YAAY,EACjB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,GACxB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,eAAe,EACf,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,qBAAqB,EACrB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,SAAS,EACT,YAAY,EACZ,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,oBAAoB,EACpB,KAAK,GACN,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,qBAAqB,EACrB,eAAe,EACf,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,QAAQ,EACR,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,wBAAwB,EACxB,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,gBAAgB,EAChB,WAAW,EACX,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,QAAQ,GACT,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,oBAAoB,EACpB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,sBAAsB,EACtB,SAAS,EACT,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,KAAK,MAAM,EACX,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,SAAS,EACT,YAAY,GACb,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delivery/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,2BAA2B,EAC3B,gCAAgC,EAChC,gCAAgC,EAChC,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,KAAK,YAAY,EACjB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,GACxB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,eAAe,EACf,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,qBAAqB,EACrB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,SAAS,EACT,YAAY,EACZ,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,oBAAoB,EACpB,KAAK,GACN,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,qBAAqB,EACrB,eAAe,EACf,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,QAAQ,EACR,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,wBAAwB,EACxB,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,gBAAgB,EAChB,WAAW,EACX,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,QAAQ,GACT,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,oBAAoB,EACpB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,sBAAsB,EACtB,SAAS,EACT,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,KAAK,MAAM,EACX,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,SAAS,GACV,MAAM,gBAAgB,CAAC"}

package/dist/delivery/index.js

@@ -27,5 +27,5 @@ export { PolicyApplyError, PolicyState, defaultPolicyKinds, } from "./policy_sta
 export { Pipeline, } from "./pipeline.js";
 export { EnvelopeAlreadyHeldError, EnvelopeNotHeldError, StagedRunner, } from "./staged_runner.js";
 export { InMemorySchedulerStore, Scheduler, TickInProgressError, UnknownRecordError, } from "./scheduler.js";
-export { Forwarder, PeerRegistry, } from "./forwarder.js";
+export { Forwarder, } from "./forwarder.js";
 //# sourceMappingURL=index.js.map

package/dist/delivery/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delivery/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAOL,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,2BAA2B,EAC3B,gCAAgC,EAChC,gCAAgC,EAChC,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAEL,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EASL,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,GACxB,MAAM,UAAU,CAAC;AAElB,OAAO,EAGL,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EAGL,eAAe,EACf,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EAQL,qBAAqB,EACrB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAKL,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAIL,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EAIL,SAAS,EACT,YAAY,EACZ,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,oBAAoB,EACpB,KAAK,GACN,MAAM,YAAY,CAAC;AAEpB,OAAO,EAGL,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAML,qBAAqB,EACrB,eAAe,EACf,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAKL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,QAAQ,EACR,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAKL,wBAAwB,EACxB,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAGL,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAGL,gBAAgB,EAChB,WAAW,EACX,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAaL,QAAQ,GACT,MAAM,eAAe,CAAC;AAEvB,OAAO,EAKL,wBAAwB,EACxB,oBAAoB,EACpB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAML,sBAAsB,EACtB,SAAS,EACT,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAIL,SAAS,EACT,YAAY,GACb,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delivery/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAOL,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,2BAA2B,EAC3B,gCAAgC,EAChC,gCAAgC,EAChC,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAEL,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EASL,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,GACxB,MAAM,UAAU,CAAC;AAElB,OAAO,EAGL,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EAGL,eAAe,EACf,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EAQL,qBAAqB,EACrB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAKL,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAIL,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EAIL,SAAS,EACT,YAAY,EACZ,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,oBAAoB,EACpB,KAAK,GACN,MAAM,YAAY,CAAC;AAEpB,OAAO,EAGL,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAML,qBAAqB,EACrB,eAAe,EACf,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAKL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,QAAQ,EACR,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAKL,wBAAwB,EACxB,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAGL,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAGL,gBAAgB,EAChB,WAAW,EACX,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAaL,QAAQ,GACT,MAAM,eAAe,CAAC;AAEvB,OAAO,EAKL,wBAAwB,EACxB,oBAAoB,EACpB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAML,sBAAsB,EACtB,SAAS,EACT,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAKL,SAAS,GACV,MAAM,gBAAgB,CAAC"}

package/dist/handshake/client_state.d.ts

@@ -40,6 +40,7 @@
  * @module
  */
 import { type SessionKeys } from "../crypto/index.js";
+import type { HandshakeSuite } from "./driver.js";
 import { HandshakeRejectedError } from "./driver.js";
 import { type Capabilities } from "./messages.js";
 /**
@@ -48,7 +49,7 @@ import { type Capabilities } from "./messages.js";
  * lifecycle.
  */
 export interface HandshakeClientConfig {
-    suite: "x25519-chacha20-poly1305";
+    suite: HandshakeSuite;
     capabilities: Capabilities;
     /** Transport identifier ("ws", "h2", "quic"). */
     transport: string;