@sempdev/semp 0.4.3

package/dist/handshake/server.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Handshake server driver per HANDSHAKE.md §2.
+ *
+ * Mirror of {@link "./driver".runClient}: drives one transport
+ * through the v1 handshake from the server side, producing a
+ * Session on success.
+ *
+ * Flow:
+ *
+ *   1. Receive INIT. Pull capabilities, transport identifier,
+ *      client ephemeral key, client nonce.
+ *   2. Negotiate the encryption algorithm (server picks the
+ *      strongest mutually supported suite per HANDSHAKE.md §3).
+ *   3. Generate a server ephemeral X25519 keypair and a 32-byte
+ *      server nonce. Pick a session_id (ULID by convention).
+ *   4. Derive the five SEMP session keys + K_resumption via
+ *      HKDF-SHA-512 over the X25519 shared secret with salt
+ *      `client_nonce || server_nonce`.
+ *   5. Build and send a signed RESPONSE.
+ *   6. Receive CONFIRM. Verify the confirmation hash matches
+ *      SHA-256(canonical(INIT) || canonical(RESPONSE)).
+ *   7. (Optional) Verify the identity proof via a caller-supplied
+ *      hook. v1 driver: if no hook is supplied, skip; otherwise
+ *      reject on hook rejection.
+ *   8. Build and send a signed ACCEPTED with permissions, TTL,
+ *      and an optional resumption ticket.
+ *
+ * Errors close the transport so the peer's pending receive
+ * unblocks.
+ *
+ * @module
+ */
+import { type SessionKeys } from "../crypto/index.js";
+import { Session } from "../session/index.js";
+import type { Transport } from "../transport/index.js";
+import { type ResumptionTicket } from "./messages.js";
+/** Result the identity-proof hook returns. */
+export interface IdentityProofVerdict {
+    /** True if the proof is acceptable. */
+    ok: boolean;
+    /**
+     * On `ok=false`, the reason_code surfaced in the REJECTED
+     * message (default: "auth_failed").
+     */
+    reasonCode?: string;
+    /** On `ok=false`, the optional human-readable reason. */
+    reason?: string;
+}
+/** Configuration for the server side of a handshake. */
+export interface ServerConfig {
+    /** 32-byte Ed25519 secret seed for the server's domain signing key. */
+    serverDomainSigningSeed: Uint8Array;
+    /** The server's domain, surfaced in `server_identity_proof.domain`. */
+    domain: string;
+    /**
+     * Suites this server accepts, in preference order. The server
+     * picks the first one that's also in the client's offered set.
+     */
+    supportedSuites: ReadonlyArray<"x25519-chacha20-poly1305">;
+    /**
+     * Per-session identity-proof signature. The driver embeds this
+     * into RESPONSE.server_identity_proof. Production servers compute
+     * it per HANDSHAKE.md §2.3 over the agreed handshake parameters;
+     * v1 driver accepts a caller-supplied callback so the higher
+     * layer keeps the per-session signing key out of this module.
+     */
+    identityProofSignature: (input: {
+        serverEphemeralKey: {
+            algorithm: string;
+            key: string;
+            key_id: string;
+        };
+        clientNonce: string;
+        serverNonce: string;
+    }) => string;
+    /**
+     * Optional verifier for the client's identity proof carried in
+     * CONFIRM. If omitted, the v1 driver accepts any non-empty
+     * proof (and an empty proof, since the v1 client driver leaves
+     * it empty).
+     */
+    verifyIdentityProof?: (input: {
+        identityProofB64: string;
+        sessionKeys: SessionKeys;
+    }) => IdentityProofVerdict;
+    /**
+     * Permissions to grant on ACCEPTED. v1 driver does no
+     * authorization; the caller decides.
+     */
+    permissions: ReadonlyArray<string>;
+    /** Session TTL in seconds. */
+    sessionTTL: number;
+    /** Optional resumption ticket builder; called once after CONFIRM. */
+    resumptionTicket?: (sessionKeys: SessionKeys) => ResumptionTicket;
+    /** Generator for session_id (ULID-shaped string). Required. */
+    generateSessionId: () => string;
+    /** Optional bytes for the server ephemeral private key (tests). */
+    serverEphemeralPriv?: Uint8Array;
+    /** Optional 32-byte server nonce (tests). */
+    serverNonce?: Uint8Array;
+    /** Optional extensions echoed back on ACCEPTED. */
+    acceptedExtensions?: Record<string, unknown>;
+}
+/**
+ * Drive a handshake from the server side over `transport`. Resolves
+ * with a Session (role="server") that owns the transport on
+ * success. On rejection (suite mismatch, identity proof failure,
+ * confirmation hash mismatch) sends a signed REJECTED then closes
+ * the transport.
+ */
+export declare function runServer(transport: Transport, config: ServerConfig): Promise<Session>;
+//# sourceMappingURL=server.d.ts.map

package/dist/handshake/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/handshake/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EACL,KAAK,WAAW,EAKjB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,EAKL,KAAK,gBAAgB,EAKtB,MAAM,eAAe,CAAC;AAEvB,8CAA8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC,uCAAuC;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,uBAAuB,EAAE,UAAU,CAAC;IACpC,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,eAAe,EAAE,aAAa,CAAC,0BAA0B,CAAC,CAAC;IAC3D;;;;;;OAMG;IACH,sBAAsB,EAAE,CAAC,KAAK,EAAE;QAC9B,kBAAkB,EAAE;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC;QACvE,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,KAAK,MAAM,CAAC;IACb;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC5B,gBAAgB,EAAE,MAAM,CAAC;QACzB,WAAW,EAAE,WAAW,CAAC;KAC1B,KAAK,oBAAoB,CAAC;IAC3B;;;OAGG;IACH,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,8BAA8B;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,CAAC,WAAW,EAAE,WAAW,KAAK,gBAAgB,CAAC;IAClE,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,MAAM,CAAC;IAChC,mEAAmE;IACnE,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,6CAA6C;IAC7C,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB,mDAAmD;IACnD,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,OAAO,CAAC,CAWlB"}

package/dist/handshake/server.js

@@ -0,0 +1,247 @@
+/**
+ * Handshake server driver per HANDSHAKE.md §2.
+ *
+ * Mirror of {@link "./driver".runClient}: drives one transport
+ * through the v1 handshake from the server side, producing a
+ * Session on success.
+ *
+ * Flow:
+ *
+ *   1. Receive INIT. Pull capabilities, transport identifier,
+ *      client ephemeral key, client nonce.
+ *   2. Negotiate the encryption algorithm (server picks the
+ *      strongest mutually supported suite per HANDSHAKE.md §3).
+ *   3. Generate a server ephemeral X25519 keypair and a 32-byte
+ *      server nonce. Pick a session_id (ULID by convention).
+ *   4. Derive the five SEMP session keys + K_resumption via
+ *      HKDF-SHA-512 over the X25519 shared secret with salt
+ *      `client_nonce || server_nonce`.
+ *   5. Build and send a signed RESPONSE.
+ *   6. Receive CONFIRM. Verify the confirmation hash matches
+ *      SHA-256(canonical(INIT) || canonical(RESPONSE)).
+ *   7. (Optional) Verify the identity proof via a caller-supplied
+ *      hook. v1 driver: if no hook is supplied, skip; otherwise
+ *      reject on hook rejection.
+ *   8. Build and send a signed ACCEPTED with permissions, TTL,
+ *      and an optional resumption ticket.
+ *
+ * Errors close the transport so the peer's pending receive
+ * unblocks.
+ *
+ * @module
+ */
+import { marshal as canonicalMarshal } from "../canonical/index.js";
+import { deriveSessionKeysWithResumption, newHKDFSHA512, x25519Agree, x25519PublicKey, } from "../crypto/index.js";
+import { fingerprint, publicKeyFromSeed } from "../keys/index.js";
+import { Session } from "../session/index.js";
+import { confirmationHash } from "./confirm.js";
+import { buildAccepted, buildRejected, buildResponse, } from "./messages.js";
+/**
+ * Drive a handshake from the server side over `transport`. Resolves
+ * with a Session (role="server") that owns the transport on
+ * success. On rejection (suite mismatch, identity proof failure,
+ * confirmation hash mismatch) sends a signed REJECTED then closes
+ * the transport.
+ */
+export async function runServer(transport, config) {
+    try {
+        return await runServerInner(transport, config);
+    }
+    catch (err) {
+        try {
+            await transport.close();
+        }
+        catch {
+            // already closed
+        }
+        throw err;
+    }
+}
+async function runServerInner(transport, config) {
+    // Step 1: receive INIT.
+    const initBytes = await receiveOrThrow(transport, "init");
+    const initMsg = parseHandshakeMessage(initBytes);
+    if (initMsg.step !== "init") {
+        throw new Error(`handshake: expected step="init", got "${initMsg.step}"`);
+    }
+    const init = JSON.parse(new TextDecoder().decode(initBytes));
+    // Step 2: negotiate.
+    const negotiated = pickSuite(init.capabilities.encryption_algorithms, config.supportedSuites);
+    const sessionId = config.generateSessionId();
+    if (negotiated === undefined) {
+        await sendRejected(transport, sessionId, "version_unsupported", config.serverDomainSigningSeed);
+        throw new Error("handshake: no mutually supported suite");
+    }
+    // Step 3: ephemeral + nonce + session_id.
+    const serverEphPriv = config.serverEphemeralPriv ?? randomBytes(32);
+    const serverEphPub = x25519PublicKey(serverEphPriv);
+    const serverEphKeyId = fingerprint(serverEphPub);
+    const serverNonce = config.serverNonce ?? randomBytes(32);
+    // Step 4: derive session keys.
+    const clientEphPub = base64Decode(init.client_ephemeral_key.key);
+    const clientNonce = base64Decode(init.nonce);
+    const sharedSecret = x25519Agree(serverEphPriv, clientEphPub);
+    const kdf = newHKDFSHA512();
+    const keys = deriveSessionKeysWithResumption(kdf, sharedSecret, clientNonce, serverNonce);
+    // Step 5: signed RESPONSE.
+    const serverIdentityProof = {
+        domain: config.domain,
+        key_id: fingerprint(publicKeyFromSeed(config.serverDomainSigningSeed)),
+        signature: config.identityProofSignature({
+            serverEphemeralKey: {
+                algorithm: negotiated,
+                key: base64Encode(serverEphPub),
+                key_id: serverEphKeyId,
+            },
+            clientNonce: init.nonce,
+            serverNonce: base64Encode(serverNonce),
+        }),
+    };
+    const resp = buildResponse({
+        sessionId,
+        clientNonce: init.nonce,
+        serverNonce: base64Encode(serverNonce),
+        serverEphemeralKey: {
+            algorithm: negotiated,
+            key: base64Encode(serverEphPub),
+            key_id: serverEphKeyId,
+        },
+        serverIdentityProof,
+        negotiated: {
+            encryption_algorithm: negotiated,
+            extensions: [],
+        },
+        serverDomainSigningSeed: config.serverDomainSigningSeed,
+    });
+    await transport.send(canonicalMarshal(resp));
+    // Step 6: CONFIRM.
+    const confirmBytes = await receiveOrThrow(transport, "confirm");
+    const confirmMsg = parseHandshakeMessage(confirmBytes);
+    if (confirmMsg.step !== "confirm") {
+        throw new Error(`handshake: expected step="confirm", got "${confirmMsg.step}"`);
+    }
+    const confirm = JSON.parse(new TextDecoder().decode(confirmBytes));
+    // Verify confirmation_hash.
+    const wantHash = confirmationHash(initBytes, canonicalMarshal(resp));
+    const gotHash = base64Decode(confirm.confirmation_hash);
+    if (!constantTimeEqual(gotHash, wantHash)) {
+        await sendRejected(transport, sessionId, "handshake_invalid", config.serverDomainSigningSeed);
+        throw new Error("handshake: confirmation hash mismatch");
+    }
+    // Step 7: optional identity proof verification.
+    if (config.verifyIdentityProof !== undefined) {
+        const verdict = config.verifyIdentityProof({
+            identityProofB64: confirm.identity_proof,
+            sessionKeys: keys,
+        });
+        if (!verdict.ok) {
+            await sendRejected(transport, sessionId, verdict.reasonCode ?? "auth_failed", config.serverDomainSigningSeed, verdict.reason);
+            throw new Error(`handshake: identity proof rejected (${verdict.reasonCode ?? "auth_failed"})`);
+        }
+    }
+    // Step 8: signed ACCEPTED.
+    const ticket = config.resumptionTicket?.(keys);
+    const accepted = buildAccepted({
+        sessionId,
+        sessionTTL: config.sessionTTL,
+        permissions: [...config.permissions],
+        serverDomainSigningSeed: config.serverDomainSigningSeed,
+        ...(ticket !== undefined ? { resumptionTicket: ticket } : {}),
+        ...(config.acceptedExtensions !== undefined
+            ? { extensions: config.acceptedExtensions }
+            : {}),
+    });
+    await transport.send(canonicalMarshal(accepted));
+    return new Session({
+        role: "server",
+        sessionId,
+        sessionTTL: config.sessionTTL,
+        establishedAt: new Date(),
+        permissions: [...config.permissions],
+        keys,
+        transport,
+        ...(ticket !== undefined ? { resumptionTicket: ticket } : {}),
+        serverIdentityProofKeyId: serverIdentityProof.key_id,
+        serverIdentityProofSignature: serverIdentityProof.signature,
+        extensions: config.acceptedExtensions ?? {},
+    });
+}
+// ---------------------------------------------------------------------------
+// Internals
+function pickSuite(clientOffers, serverSupports) {
+    for (const s of serverSupports) {
+        if (clientOffers.includes(s)) {
+            return s;
+        }
+    }
+    return undefined;
+}
+async function sendRejected(transport, sessionId, reasonCode, serverDomainSigningSeed, reason) {
+    const r = buildRejected({
+        sessionId,
+        reasonCode,
+        serverDomainSigningSeed,
+        ...(reason !== undefined ? { reason } : {}),
+    });
+    try {
+        await transport.send(canonicalMarshal(r));
+    }
+    catch {
+        // peer may have already disconnected; ignore.
+    }
+}
+async function receiveOrThrow(transport, expected) {
+    const msg = await transport.receive();
+    if (msg === null) {
+        throw new Error(`handshake: connection closed waiting for ${expected}`);
+    }
+    return msg;
+}
+function parseHandshakeMessage(bytes) {
+    const text = new TextDecoder().decode(bytes);
+    const obj = JSON.parse(text);
+    if (obj.type !== "SEMP_HANDSHAKE") {
+        throw new Error(`handshake: expected type=SEMP_HANDSHAKE, got "${obj.type ?? "?"}"`);
+    }
+    if (typeof obj.step !== "string") {
+        throw new Error("handshake: missing step field");
+    }
+    return obj;
+}
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= (a[i] ?? 0) ^ (b[i] ?? 0);
+    }
+    return diff === 0;
+}
+function randomBytes(n) {
+    const out = new Uint8Array(n);
+    globalThis.crypto.getRandomValues(out);
+    return out;
+}
+function base64Encode(b) {
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(b).toString("base64");
+    }
+    let bin = "";
+    for (let i = 0; i < b.length; i++) {
+        bin += String.fromCharCode(b[i] ?? 0);
+    }
+    return btoa(bin);
+}
+function base64Decode(s) {
+    if (typeof Buffer !== "undefined") {
+        return new Uint8Array(Buffer.from(s, "base64"));
+    }
+    const bin = atob(s);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++) {
+        out[i] = bin.charCodeAt(i);
+    }
+    return out;
+}
+//# sourceMappingURL=server.js.map

package/dist/handshake/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/handshake/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAEL,+BAA+B,EAC/B,aAAa,EACb,WAAW,EACX,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAG9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAOL,aAAa,EACb,aAAa,EACb,aAAa,GACd,MAAM,eAAe,CAAC;AAmEvB;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,SAAoB,EACpB,MAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,MAAM,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,SAAoB,EACpB,MAAoB;IAEpB,wBAAwB;IACxB,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,yCAAyC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAgB,CAAC;IAE5E,qBAAqB;IACrB,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;IAC7C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,0CAA0C;IAC1C,MAAM,aAAa,GAAG,MAAM,CAAC,mBAAmB,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;IAE1D,+BAA+B;IAC/B,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,WAAW,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,+BAA+B,CAC1C,GAAG,EACH,YAAY,EACZ,WAAW,EACX,WAAW,CACZ,CAAC;IAEF,2BAA2B;IAC3B,MAAM,mBAAmB,GAAwB;QAC/C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,WAAW,CAAC,iBAAiB,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACtE,SAAS,EAAE,MAAM,CAAC,sBAAsB,CAAC;YACvC,kBAAkB,EAAE;gBAClB,SAAS,EAAE,UAAU;gBACrB,GAAG,EAAE,YAAY,CAAC,YAAY,CAAC;gBAC/B,MAAM,EAAE,cAAc;aACvB;YACD,WAAW,EAAE,IAAI,CAAC,KAAK;YACvB,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC;SACvC,CAAC;KACH,CAAC;IACF,MAAM,IAAI,GAAoB,aAAa,CAAC;QAC1C,SAAS;QACT,WAAW,EAAE,IAAI,CAAC,KAAK;QACvB,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC;QACtC,kBAAkB,EAAE;YAClB,SAAS,EAAE,UAAU;YACrB,GAAG,EAAE,YAAY,CAAC,YAAY,CAAC;YAC/B,MAAM,EAAE,cAAc;SACvB;QACD,mBAAmB;QACnB,UAAU,EAAE;YACV,oBAAoB,EAAE,UAAU;YAChC,UAAU,EAAE,EAAE;SACf;QACD,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;KACxD,CAAC,CAAC;IACH,MAAM,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7C,mBAAmB;IACnB,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACvD,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,4CAA4C,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAmB,CAAC;IAErF,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxD,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1C,MAAM,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,gDAAgD;IAChD,IAAI,MAAM,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC;YACzC,gBAAgB,EAAE,OAAO,CAAC,cAAc;YACxC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,YAAY,CAChB,SAAS,EACT,SAAS,EACT,OAAO,CAAC,UAAU,IAAI,aAAa,EACnC,MAAM,CAAC,uBAAuB,EAC9B,OAAO,CAAC,MAAM,CACf,CAAC;YACF,MAAM,IAAI,KAAK,CACb,uCAAuC,OAAO,CAAC,UAAU,IAAI,aAAa,GAAG,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAoB,aAAa,CAAC;QAC9C,SAAS;QACT,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QACpC,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,MAAM,CAAC,kBAAkB,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,kBAAkB,EAAE;YAC3C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,MAAM,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEjD,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,QAAQ;QACd,SAAS;QACT,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,aAAa,EAAE,IAAI,IAAI,EAAE;QACzB,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QACpC,IAAI;QACJ,SAAS;QACT,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,wBAAwB,EAAE,mBAAmB,CAAC,MAAM;QACpD,4BAA4B,EAAE,mBAAmB,CAAC,SAAS;QAC3D,UAAU,EAAE,MAAM,CAAC,kBAAkB,IAAI,EAAE;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,YAAY;AAEZ,SAAS,SAAS,CAChB,YAAsB,EACtB,cAAyD;IAEzD,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,SAAoB,EACpB,SAAiB,EACjB,UAAkB,EAClB,uBAAmC,EACnC,MAAe;IAEf,MAAM,CAAC,GAAG,aAAa,CAAC;QACtB,SAAS;QACT,UAAU;QACV,uBAAuB;QACvB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,SAAoB,EAAE,QAAgB;IAClE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;IACtC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAiB;IAC9C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqC,CAAC;IACjE,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAuB,CAAC;AACjC,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAa,EAAE,CAAa;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,CAAa;IACjC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/handshake/server_state.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Stateful handshake server per HANDSHAKE.md §2.
+ *
+ * Mirror of `semp-go/handshake.Server`: a state machine the caller
+ * drives over a transport. The class never performs network I/O
+ * directly — the caller moves bytes between this object and the
+ * underlying transport.
+ *
+ * Lifecycle:
+ *
+ * ```ts
+ * const s = new HandshakeServer({ ... });
+ * const initBytes = await transport.receive();
+ * const respBytes = s.onInit(initBytes);
+ * await transport.send(respBytes);
+ *
+ * const confirmBytes = await transport.receive();
+ * const acceptedBytes = s.onConfirm(confirmBytes);
+ * await transport.send(acceptedBytes);
+ *
+ * // s.session() now usable
+ * ```
+ *
+ * The high-level {@link "./server".runServer} wraps this state
+ * machine with the transport plumbing for callers who don't want
+ * to manage step ordering manually.
+ *
+ * @module
+ */
+import { type SessionKeys } from "../crypto/index.js";
+import { type ResumptionTicket } from "./messages.js";
+import type { IdentityProofVerdict, ServerConfig } from "./server.js";
+/**
+ * Configuration for a {@link HandshakeServer}. Same fields as
+ * {@link "./server".ServerConfig}; surfaced as a separate type so
+ * the stateful class lifecycle is independent of the high-level
+ * `runServer` orchestrator.
+ */
+export type HandshakeServerConfig = ServerConfig;
+/** Outcome of a successful server-side handshake. */
+export interface HandshakeServerSession {
+    sessionId: string;
+    sessionTTL: number;
+    permissions: string[];
+    keys: SessionKeys;
+    serverIdentityProofKeyId: string;
+    serverIdentityProofSignature: string;
+    extensions: Record<string, unknown>;
+    resumptionTicket?: ResumptionTicket;
+}
+/**
+ * Error thrown when a built-in policy check rejects the peer
+ * (suite mismatch, confirmation-hash mismatch, identity-proof
+ * verdict). The associated `step="rejected"` bytes have already
+ * been written to {@link HandshakeServer.lastRejectedBytes} so the
+ * caller can transmit them before closing the transport.
+ */
+export declare class HandshakeServerRejectionError extends Error {
+    readonly reasonCode: string;
+    readonly reason: string | undefined;
+    readonly rejectedBytes: Uint8Array;
+    readonly name = "HandshakeServerRejectionError";
+    constructor(reasonCode: string, reason: string | undefined, rejectedBytes: Uint8Array);
+}
+/**
+ * Stateful handshake server. One instance handles exactly one
+ * handshake — discard after success or error. Re-using an instance
+ * is a programming error (the state machine is single-shot).
+ */
+export declare class HandshakeServer {
+    private readonly cfg;
+    private sessionId;
+    private serverEphPriv;
+    private serverNonce;
+    private initCanonical;
+    private respCanonical;
+    private sessionKeys;
+    private serverIdProof;
+    private finalSession;
+    constructor(cfg: HandshakeServerConfig);
+    /**
+     * Process the client's INIT and produce signed RESPONSE bytes per
+     * §2.2 / §2.3. Throws {@link HandshakeServerRejectionError} on
+     * suite mismatch — the rejection bytes are accessible on the
+     * thrown error for the caller to transmit before closing the
+     * transport.
+     */
+    onInit(data: Uint8Array): Uint8Array;
+    /**
+     * Process the client's CONFIRM and produce signed ACCEPTED bytes
+     * per §2.4 / §2.5. Throws {@link HandshakeServerRejectionError}
+     * on confirmation-hash mismatch or identity-proof verdict
+     * failure.
+     */
+    onConfirm(data: Uint8Array): Uint8Array;
+    /** Final session, populated by {@link onConfirm}. */
+    session(): HandshakeServerSession;
+    /** Wipe in-memory secret state. Idempotent. */
+    erase(): void;
+}
+export type { IdentityProofVerdict };
+//# sourceMappingURL=server_state.d.ts.map

package/dist/handshake/server_state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server_state.d.ts","sourceRoot":"","sources":["../../src/handshake/server_state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,EACL,KAAK,WAAW,EAKjB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAKL,KAAK,gBAAgB,EAKtB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAEjD,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,IAAI,EAAE,WAAW,CAAC;IAClB,wBAAwB,EAAE,MAAM,CAAC;IACjC,4BAA4B,EAAE,MAAM,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;;;;;GAMG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;aAGpC,UAAU,EAAE,MAAM;aAClB,MAAM,EAAE,MAAM,GAAG,SAAS;aAC1B,aAAa,EAAE,UAAU;IAJ3C,SAAkB,IAAI,mCAAmC;gBAEvC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,aAAa,EAAE,UAAU;CAM5C;AAED;;;;GAIG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;IAE5C,OAAO,CAAC,SAAS,CAAM;IACvB,OAAO,CAAC,aAAa,CAA2B;IAChD,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,aAAa,CAA2B;IAChD,OAAO,CAAC,aAAa,CAA2B;IAChD,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,YAAY,CAAuC;gBAE/C,GAAG,EAAE,qBAAqB;IAatC;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU;IAkFpC;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU;IA+EvC,qDAAqD;IACrD,OAAO,IAAI,sBAAsB;IASjC,+CAA+C;IAC/C,KAAK,IAAI,IAAI;CAOd;AAsED,YAAY,EAAE,oBAAoB,EAAE,CAAC"}