@sempdev/semp 0.4.3

package/dist/closure/driver.js

@@ -0,0 +1,126 @@
+/**
+ * Home-server closure driver per CLOSURE.md §3 + §4 + §5.
+ *
+ * Orchestrates closure lifecycle on a {@link ClosureStore}:
+ *  - {@link Driver.submit}: accept a request or cancel
+ *  - {@link Driver.tick}: drive due requests to finalization
+ *  - {@link Driver.isAccountClosed}: §5 ingress enforcement
+ *  - {@link Driver.recipientPolicy}: returns a delivery-policy
+ *    adapter that rejects envelopes addressed to closed accounts
+ *
+ * @module
+ */
+import { isFinalizable, validateClosureRecord, } from "./closure.js";
+import { AlreadyPendingError } from "./store.js";
+/** Closure driver. */
+export class Driver {
+    store;
+    nowFn;
+    constructor(cfg) {
+        this.store = cfg.store;
+        this.nowFn = cfg.nowFn ?? (() => new Date());
+    }
+    /**
+     * Apply `record` to the store. Caller MUST verify the record's
+     * signature and authority (§2.3 — the issuing device must be a
+     * full-access device of the account) BEFORE calling submit.
+     */
+    async submit(record) {
+        try {
+            validateClosureRecord(record);
+        }
+        catch (err) {
+            return {
+                kind: "invalid",
+                reason: err instanceof Error ? err.message : String(err),
+            };
+        }
+        if (record.step === "request") {
+            try {
+                await this.store.putPending(record);
+                return { kind: "accepted" };
+            }
+            catch (err) {
+                if (err instanceof AlreadyPendingError) {
+                    return { kind: "already_pending" };
+                }
+                throw err;
+            }
+        }
+        // step === "cancel"
+        const existing = await this.store.getPending(record.user_id);
+        if (existing === null) {
+            return { kind: "not_pending" };
+        }
+        await this.store.deletePending(record.user_id);
+        return { kind: "accepted" };
+    }
+    /**
+     * Drive any pending requests whose finalization timestamp has
+     * arrived to the finalized state. Returns the list of accounts
+     * finalized in this tick (deterministically ordered).
+     */
+    async tick() {
+        const now = this.nowFn();
+        const due = await this.store.duePending(now);
+        const out = [];
+        for (const r of due) {
+            if (!isFinalizable(r, now)) {
+                continue; // defensive
+            }
+            await this.store.putFinalized(r.user_id, now);
+            await this.store.deletePending(r.user_id);
+            out.push({ user_id: r.user_id, finalized_at: now });
+        }
+        return out;
+    }
+    /**
+     * Report whether `userId`'s account is currently closed within
+     * the §6.1 retention window.
+     *
+     * Returns true when `getFinalized(userId)` yields a timestamp
+     * (the store enforces retention via its prune path; once an
+     * entry is pruned, this returns false and the local-part is
+     * eligible for §6.2 reassignment).
+     */
+    async isAccountClosed(userId) {
+        const finalized = await this.store.getFinalized(userId);
+        return finalized !== null;
+    }
+    /**
+     * Return a per-recipient delivery-policy adapter that rejects
+     * envelopes addressed to closed accounts per §5.1, preserving
+     * existence indistinguishability per DESIGN.md §2.7 (the
+     * `policy_forbidden` reason is the same one a non-existent
+     * address receives).
+     *
+     * Pass `useSilent: true` to return the `silent` acknowledgment
+     * instead. Both preserve indistinguishability; the choice is
+     * operator policy.
+     */
+    recipientPolicy(opts = {}) {
+        return async (recipientAddress) => {
+            let closed;
+            try {
+                closed = await this.isAccountClosed(recipientAddress);
+            }
+            catch {
+                // Fail open per §5.1: a transient store error MUST NOT
+                // silently drop deliveries to active accounts.
+                return null;
+            }
+            if (!closed) {
+                return null;
+            }
+            if (opts.useSilent === true) {
+                return { acknowledgment: "silent" };
+            }
+            return {
+                acknowledgment: "rejected",
+                reason_code: "policy_forbidden",
+                reason: "recipient policy",
+            };
+        };
+    }
+}
+//# sourceMappingURL=driver.js.map

package/dist/closure/driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver.js","sourceRoot":"","sources":["../../src/closure/driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EAEL,aAAa,EACb,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAqB,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAiCpE,sBAAsB;AACtB,MAAM,OAAO,MAAM;IACA,KAAK,CAAe;IACpB,KAAK,CAAa;IAEnC,YAAY,GAAiB;QAC3B,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,MAAqB;QAChC,IAAI,CAAC;YACH,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACpC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YAC9B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;oBACvC,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;gBACrC,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,oBAAoB;QACpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAqB,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC3B,SAAS,CAAC,YAAY;YACxB,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACxD,OAAO,SAAS,KAAK,IAAI,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;OAUG;IACH,eAAe,CAAC,OAAgC,EAAE;QAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,EAAE;YAChC,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;gBACvD,+CAA+C;gBAC/C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC5B,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;YACtC,CAAC;YACD,OAAO;gBACL,cAAc,EAAE,UAAU;gBAC1B,WAAW,EAAE,kBAAkB;gBAC/B,MAAM,EAAE,kBAAkB;aAC3B,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;CACF"}

package/dist/closure/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Account closure layer per CLOSURE.md.
+ *
+ * Wire records (request + cancel) and signing primitives, plus
+ * the home-server driver that orchestrates pending → finalized
+ * lifecycle on a {@link ClosureStore}.
+ *
+ * @module
+ */
+export { type ClosureRecord, type ClosureSignature, type SignClosureRecordInput, type SignClosureRecordResult, type Step, type ValidateClosureOptions, AccountClosurePrefix, MaxGracePeriodSeconds, MinGracePeriodSeconds, RecommendedGracePeriodSeconds, RecordType, RecordVersion, SignatureAlgorithmEd25519, finalizationAt, isFinalizable, signClosureRecord, validateClosureRecord, verifyClosureRecord, } from "./closure.js";
+export { type ClosureStore, AlreadyPendingError, InMemoryClosureStore, MinRetentionMs, RecommendedRetentionMs, } from "./store.js";
+export { type DriverConfig, type FinalizeResult, type RecipientPolicyFunc, type SubmitResult, Driver, } from "./driver.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/closure/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/closure/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,IAAI,EACT,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,6BAA6B,EAC7B,UAAU,EACV,aAAa,EACb,yBAAyB,EACzB,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,KAAK,YAAY,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,EACd,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,MAAM,GACP,MAAM,aAAa,CAAC"}

package/dist/closure/index.js

@@ -0,0 +1,13 @@
+/**
+ * Account closure layer per CLOSURE.md.
+ *
+ * Wire records (request + cancel) and signing primitives, plus
+ * the home-server driver that orchestrates pending → finalized
+ * lifecycle on a {@link ClosureStore}.
+ *
+ * @module
+ */
+export { AccountClosurePrefix, MaxGracePeriodSeconds, MinGracePeriodSeconds, RecommendedGracePeriodSeconds, RecordType, RecordVersion, SignatureAlgorithmEd25519, finalizationAt, isFinalizable, signClosureRecord, validateClosureRecord, verifyClosureRecord, } from "./closure.js";
+export { AlreadyPendingError, InMemoryClosureStore, MinRetentionMs, RecommendedRetentionMs, } from "./store.js";
+export { Driver, } from "./driver.js";
+//# sourceMappingURL=index.js.map

package/dist/closure/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/closure/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAOL,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,6BAA6B,EAC7B,UAAU,EACV,aAAa,EACb,yBAAyB,EACzB,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAEL,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,EACd,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAKL,MAAM,GACP,MAAM,aAAa,CAAC"}

package/dist/closure/store.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Persistence interface for closure state per CLOSURE.md §2.4 +
+ * §6.1.
+ *
+ * Used by the {@link "./driver".Driver} for two distinct concerns:
+ *
+ *  - Pending state: active closure requests (submit / cancel /
+ *    tick-due).
+ *  - Finalized state: closed accounts within the §6.1 retention
+ *    window. Used by ingress enforcement (§5) and by §6 local-part
+ *    reassignment checks.
+ *
+ * Production deployments plug in a durable backend; tests + demos
+ * use {@link InMemoryClosureStore}.
+ *
+ * @module
+ */
+import type { ClosureRecord } from "./closure.js";
+/**
+ * Spec-mandated retention bounds for the §6.1 post-finalization
+ * retention window: at least 180 days, RECOMMENDED 365 days.
+ */
+export declare const MinRetentionMs: number;
+export declare const RecommendedRetentionMs: number;
+/** Thrown by {@link ClosureStore.putPending} on collision. */
+export declare class AlreadyPendingError extends Error {
+    readonly name = "AlreadyPendingError";
+}
+/** Persistence interface for closure state. */
+export interface ClosureStore {
+    /**
+     * Insert `record` as the active pending request for
+     * `record.user_id`. Throws {@link AlreadyPendingError} if a
+     * request is already pending for the same user (the §2.4
+     * "at most one active closure" rule).
+     */
+    putPending(record: ClosureRecord): Promise<void>;
+    /** Return the pending request for `userId`, or null when none. */
+    getPending(userId: string): Promise<ClosureRecord | null>;
+    /** Remove the pending request for `userId`. Idempotent. */
+    deletePending(userId: string): Promise<void>;
+    /**
+     * Return every pending request whose finalization timestamp is
+     * at or before `now`, in deterministic order (by user_id
+     * ascending). The driver's `tick` consumes this slice.
+     */
+    duePending(now: Date): Promise<ClosureRecord[]>;
+    /** Number of pending requests, for operator monitoring. */
+    countPending(): Promise<number>;
+    /**
+     * Record that `userId`'s closure finalized at the given timestamp.
+     * Used by `isAccountClosed` and the §6.1 retention prune.
+     */
+    putFinalized(userId: string, finalizedAt: Date): Promise<void>;
+    /**
+     * Return the finalization timestamp for `userId`, or null if no
+     * finalization is recorded.
+     */
+    getFinalized(userId: string): Promise<Date | null>;
+    /**
+     * Evict finalized entries older than `retainForMs`. Values smaller
+     * than {@link MinRetentionMs} are clamped up. Returns the number
+     * of entries evicted.
+     */
+    pruneFinalized(retainForMs: number, now?: Date): Promise<number>;
+}
+/** Reference in-memory {@link ClosureStore}. Single-process only. */
+export declare class InMemoryClosureStore implements ClosureStore {
+    private readonly pending;
+    private readonly finalized;
+    putPending(record: ClosureRecord): Promise<void>;
+    getPending(userId: string): Promise<ClosureRecord | null>;
+    deletePending(userId: string): Promise<void>;
+    duePending(now: Date): Promise<ClosureRecord[]>;
+    countPending(): Promise<number>;
+    putFinalized(userId: string, finalizedAt: Date): Promise<void>;
+    getFinalized(userId: string): Promise<Date | null>;
+    pruneFinalized(retainForMs: number, now?: Date): Promise<number>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/closure/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/closure/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD;;;GAGG;AACH,eAAO,MAAM,cAAc,QAA4B,CAAC;AACxD,eAAO,MAAM,sBAAsB,QAA4B,CAAC;AAEhE,8DAA8D;AAC9D,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,SAAkB,IAAI,yBAAyB;CAChD;AAED,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD,kEAAkE;IAClE,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAE1D,2DAA2D;IAC3D,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7C;;;;OAIG;IACH,UAAU,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAEhD,2DAA2D;IAC3D,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhC;;;OAGG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D;;;OAGG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAEnD;;;;OAIG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClE;AAED,qEAAqE;AACrE,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2B;IAE/C,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAYhD,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAKzD,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5C,UAAU,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAW/C,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAI/B,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9D,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAIlD,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;CAcnF"}

package/dist/closure/store.js

@@ -0,0 +1,89 @@
+/**
+ * Persistence interface for closure state per CLOSURE.md §2.4 +
+ * §6.1.
+ *
+ * Used by the {@link "./driver".Driver} for two distinct concerns:
+ *
+ *  - Pending state: active closure requests (submit / cancel /
+ *    tick-due).
+ *  - Finalized state: closed accounts within the §6.1 retention
+ *    window. Used by ingress enforcement (§5) and by §6 local-part
+ *    reassignment checks.
+ *
+ * Production deployments plug in a durable backend; tests + demos
+ * use {@link InMemoryClosureStore}.
+ *
+ * @module
+ */
+import { finalizationAt } from "./closure.js";
+/**
+ * Spec-mandated retention bounds for the §6.1 post-finalization
+ * retention window: at least 180 days, RECOMMENDED 365 days.
+ */
+export const MinRetentionMs = 180 * 24 * 60 * 60 * 1000;
+export const RecommendedRetentionMs = 365 * 24 * 60 * 60 * 1000;
+/** Thrown by {@link ClosureStore.putPending} on collision. */
+export class AlreadyPendingError extends Error {
+    name = "AlreadyPendingError";
+}
+/** Reference in-memory {@link ClosureStore}. Single-process only. */
+export class InMemoryClosureStore {
+    pending = new Map();
+    finalized = new Map();
+    async putPending(record) {
+        if (record.user_id === "") {
+            throw new Error("closure: store put_pending missing user_id");
+        }
+        if (this.pending.has(record.user_id)) {
+            throw new AlreadyPendingError(`closure: pending request already exists for ${record.user_id}`);
+        }
+        this.pending.set(record.user_id, { ...record });
+    }
+    async getPending(userId) {
+        const r = this.pending.get(userId);
+        return r === undefined ? null : { ...r };
+    }
+    async deletePending(userId) {
+        this.pending.delete(userId);
+    }
+    async duePending(now) {
+        const due = [];
+        for (const r of this.pending.values()) {
+            if (now.getTime() >= finalizationAt(r).getTime()) {
+                due.push({ ...r });
+            }
+        }
+        due.sort((a, b) => (a.user_id < b.user_id ? -1 : a.user_id > b.user_id ? 1 : 0));
+        return due;
+    }
+    async countPending() {
+        return this.pending.size;
+    }
+    async putFinalized(userId, finalizedAt) {
+        if (userId === "") {
+            throw new Error("closure: store put_finalized missing user_id");
+        }
+        if (Number.isNaN(finalizedAt.getTime())) {
+            throw new Error("closure: store put_finalized invalid timestamp");
+        }
+        this.finalized.set(userId, finalizedAt);
+    }
+    async getFinalized(userId) {
+        return this.finalized.get(userId) ?? null;
+    }
+    async pruneFinalized(retainForMs, now = new Date()) {
+        if (retainForMs < MinRetentionMs) {
+            retainForMs = MinRetentionMs;
+        }
+        const cutoff = now.getTime() - retainForMs;
+        let removed = 0;
+        for (const [userId, finalizedAtTs] of this.finalized) {
+            if (finalizedAtTs.getTime() < cutoff) {
+                this.finalized.delete(userId);
+                removed++;
+            }
+        }
+        return removed;
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/closure/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/closure/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhE,8DAA8D;AAC9D,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC1B,IAAI,GAAG,qBAAqB,CAAC;CAChD;AAgDD,qEAAqE;AACrE,MAAM,OAAO,oBAAoB;IACd,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC3C,SAAS,GAAG,IAAI,GAAG,EAAgB,CAAC;IAErD,KAAK,CAAC,UAAU,CAAC,MAAqB;QACpC,IAAI,MAAM,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,mBAAmB,CAC3B,+CAA+C,MAAM,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc;QAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAS;QACxB,MAAM,GAAG,GAAoB,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBACjD,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,WAAiB;QAClD,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAAmB,EAAE,MAAY,IAAI,IAAI,EAAE;QAC9D,IAAI,WAAW,GAAG,cAAc,EAAE,CAAC;YACjC,WAAW,GAAG,cAAc,CAAC;QAC/B,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC;QAC3C,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACrD,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;gBACrC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC9B,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/crypto/aead.d.ts

@@ -0,0 +1,29 @@
+/**
+ * AEAD primitives for SEMP.
+ *
+ * The two currently defined algorithm suites use different AEAD
+ * variants:
+ *
+ *   - `x25519-chacha20-poly1305` — ChaCha20-Poly1305, 12-byte nonce.
+ *   - `pq-kyber768-x25519`       — XChaCha20-Poly1305, 24-byte nonce.
+ *
+ * The sealing flow is identical in both cases: AEAD.Seal(key, nonce,
+ * plaintext, aad) -> ciphertext || tag. Returns a single byte slice
+ * with the authentication tag appended.
+ *
+ * @module
+ */
+/** Algorithm name used in vectors and on the wire. */
+export type AEADAlgorithm = "chacha20-poly1305" | "xchacha20-poly1305";
+/**
+ * Seal `plaintext` with the negotiated AEAD. Returns
+ * `ciphertext || tag` (no nonce prefix; the caller composes the
+ * wire layout per ENVELOPE.md §7.1.1).
+ */
+export declare function aeadSeal(algorithm: AEADAlgorithm, key: Uint8Array, nonce: Uint8Array, plaintext: Uint8Array, aad: Uint8Array): Uint8Array;
+/**
+ * Open AEAD ciphertext. Throws on tag mismatch (Poly1305 fail).
+ * Returns the plaintext on success.
+ */
+export declare function aeadOpen(algorithm: AEADAlgorithm, key: Uint8Array, nonce: Uint8Array, ciphertext: Uint8Array, aad: Uint8Array): Uint8Array;
+//# sourceMappingURL=aead.d.ts.map

package/dist/crypto/aead.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aead.d.ts","sourceRoot":"","sources":["../../src/crypto/aead.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,sDAAsD;AACtD,MAAM,MAAM,aAAa,GAAG,mBAAmB,GAAG,oBAAoB,CAAC;AAEvE;;;;GAIG;AACH,wBAAgB,QAAQ,CACtB,SAAS,EAAE,aAAa,EACxB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,UAAU,EACrB,GAAG,EAAE,UAAU,GACd,UAAU,CAGZ;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,SAAS,EAAE,aAAa,EACxB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,UAAU,GACd,UAAU,CAGZ"}

package/dist/crypto/aead.js

@@ -0,0 +1,48 @@
+/**
+ * AEAD primitives for SEMP.
+ *
+ * The two currently defined algorithm suites use different AEAD
+ * variants:
+ *
+ *   - `x25519-chacha20-poly1305` — ChaCha20-Poly1305, 12-byte nonce.
+ *   - `pq-kyber768-x25519`       — XChaCha20-Poly1305, 24-byte nonce.
+ *
+ * The sealing flow is identical in both cases: AEAD.Seal(key, nonce,
+ * plaintext, aad) -> ciphertext || tag. Returns a single byte slice
+ * with the authentication tag appended.
+ *
+ * @module
+ */
+import { chacha20poly1305, xchacha20poly1305 } from "@noble/ciphers/chacha.js";
+/**
+ * Seal `plaintext` with the negotiated AEAD. Returns
+ * `ciphertext || tag` (no nonce prefix; the caller composes the
+ * wire layout per ENVELOPE.md §7.1.1).
+ */
+export function aeadSeal(algorithm, key, nonce, plaintext, aad) {
+    const c = newCipher(algorithm, key, nonce, aad);
+    return c.encrypt(plaintext);
+}
+/**
+ * Open AEAD ciphertext. Throws on tag mismatch (Poly1305 fail).
+ * Returns the plaintext on success.
+ */
+export function aeadOpen(algorithm, key, nonce, ciphertext, aad) {
+    const c = newCipher(algorithm, key, nonce, aad);
+    return c.decrypt(ciphertext);
+}
+function newCipher(algorithm, key, nonce, aad) {
+    switch (algorithm) {
+        case "chacha20-poly1305":
+            if (nonce.length !== 12) {
+                throw new Error(`chacha20-poly1305 nonce must be 12 bytes, got ${nonce.length}`);
+            }
+            return chacha20poly1305(key, nonce, aad);
+        case "xchacha20-poly1305":
+            if (nonce.length !== 24) {
+                throw new Error(`xchacha20-poly1305 nonce must be 24 bytes, got ${nonce.length}`);
+            }
+            return xchacha20poly1305(key, nonce, aad);
+    }
+}
+//# sourceMappingURL=aead.js.map

package/dist/crypto/aead.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aead.js","sourceRoot":"","sources":["../../src/crypto/aead.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAK/E;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CACtB,SAAwB,EACxB,GAAe,EACf,KAAiB,EACjB,SAAqB,EACrB,GAAe;IAEf,MAAM,CAAC,GAAG,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CACtB,SAAwB,EACxB,GAAe,EACf,KAAiB,EACjB,UAAsB,EACtB,GAAe;IAEf,MAAM,CAAC,GAAG,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,SAAS,CAChB,SAAwB,EACxB,GAAe,EACf,KAAiB,EACjB,GAAe;IAEf,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,mBAAmB;YACtB,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,iDAAiD,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,OAAO,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3C,KAAK,oBAAoB;YACvB,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,kDAAkD,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC"}

package/dist/crypto/argon2.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Argon2id KDF wrapper for SEMP recovery bundles per RECOVERY.md
+ * §2.4. The vectors fix all four parameters (memory, iterations,
+ * parallelism, output length) so the runner can re-derive the
+ * bundle key deterministically.
+ *
+ * @module
+ */
+/**
+ * Argon2id key derivation.
+ *
+ * @param secret raw secret bytes (the recovery secret).
+ * @param salt 16-byte salt.
+ * @param memoryKB memory cost in KiB (e.g. 65536 for 64 MiB).
+ * @param iterations time cost.
+ * @param parallelism degree of parallelism (lanes).
+ * @param outputLength output length in bytes (typically 32).
+ */
+export declare function argon2idKDF(secret: Uint8Array, salt: Uint8Array, memoryKB: number, iterations: number, parallelism: number, outputLength: number): Uint8Array;
+//# sourceMappingURL=argon2.d.ts.map

package/dist/crypto/argon2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"argon2.d.ts","sourceRoot":"","sources":["../../src/crypto/argon2.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,UAAU,CAOZ"}

package/dist/crypto/argon2.js

@@ -0,0 +1,28 @@
+/**
+ * Argon2id KDF wrapper for SEMP recovery bundles per RECOVERY.md
+ * §2.4. The vectors fix all four parameters (memory, iterations,
+ * parallelism, output length) so the runner can re-derive the
+ * bundle key deterministically.
+ *
+ * @module
+ */
+import { argon2id } from "@noble/hashes/argon2.js";
+/**
+ * Argon2id key derivation.
+ *
+ * @param secret raw secret bytes (the recovery secret).
+ * @param salt 16-byte salt.
+ * @param memoryKB memory cost in KiB (e.g. 65536 for 64 MiB).
+ * @param iterations time cost.
+ * @param parallelism degree of parallelism (lanes).
+ * @param outputLength output length in bytes (typically 32).
+ */
+export function argon2idKDF(secret, salt, memoryKB, iterations, parallelism, outputLength) {
+    return argon2id(secret, salt, {
+        m: memoryKB,
+        t: iterations,
+        p: parallelism,
+        dkLen: outputLength,
+    });
+}
+//# sourceMappingURL=argon2.js.map

package/dist/crypto/argon2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"argon2.js","sourceRoot":"","sources":["../../src/crypto/argon2.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEnD;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CACzB,MAAkB,EAClB,IAAgB,EAChB,QAAgB,EAChB,UAAkB,EAClB,WAAmB,EACnB,YAAoB;IAEpB,OAAO,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE;QAC5B,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,UAAU;QACb,CAAC,EAAE,WAAW;QACd,KAAK,EAAE,YAAY;KACpB,CAAC,CAAC;AACL,CAAC"}

package/dist/crypto/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Layer 1 cryptographic primitives. Mirrors the semp-go `crypto`
+ * package: KDF, MAC, signature, KEM, AEAD, and suite glue. The
+ * implementation is the audited @noble suite end-to-end; no native
+ * bindings, browser-compatible.
+ *
+ * @module
+ */
+export { newHKDFSHA512, deriveSessionKeys, deriveSessionKeysWithResumption, deriveResumedSessionKeys, deriveRekeyKeys, InfoSessionEncC2S, InfoSessionEncS2C, InfoSessionMACC2S, InfoSessionMACS2C, InfoSessionEnvMAC, InfoSessionResumption, SessionKeyLength, type KDF, type SessionKeys, } from "./kdf.js";
+export { computeMAC, verifyMAC } from "./mac.js";
+export { type AEADAlgorithm, aeadOpen, aeadSeal } from "./aead.js";
+export { argon2idKDF } from "./argon2.js";
+export { HybridCiphertextSize, HybridPrivateKeySize, HybridPublicKeySize, HybridSharedSecretSize, Kyber768CiphertextSize, Kyber768PrivateKeySize, Kyber768PublicKeySize, Kyber768SharedKeySize, X25519Size, hybridDecapsulate, hybridPrivateKeyFromKyberAndX25519, kyber768Decapsulate, kyber768EncapsulateDeterministic, kyber768KeyPairFromSeed, x25519Agree, x25519PublicKey, } from "./kem.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/crypto/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,+BAA+B,EAC/B,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,GAAG,EACR,KAAK,WAAW,GACjB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EAAE,KAAK,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEnE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,kCAAkC,EAClC,mBAAmB,EACnB,gCAAgC,EAChC,uBAAuB,EACvB,WAAW,EACX,eAAe,GAChB,MAAM,UAAU,CAAC"}

package/dist/crypto/index.js

@@ -0,0 +1,14 @@
+/**
+ * Layer 1 cryptographic primitives. Mirrors the semp-go `crypto`
+ * package: KDF, MAC, signature, KEM, AEAD, and suite glue. The
+ * implementation is the audited @noble suite end-to-end; no native
+ * bindings, browser-compatible.
+ *
+ * @module
+ */
+export { newHKDFSHA512, deriveSessionKeys, deriveSessionKeysWithResumption, deriveResumedSessionKeys, deriveRekeyKeys, InfoSessionEncC2S, InfoSessionEncS2C, InfoSessionMACC2S, InfoSessionMACS2C, InfoSessionEnvMAC, InfoSessionResumption, SessionKeyLength, } from "./kdf.js";
+export { computeMAC, verifyMAC } from "./mac.js";
+export { aeadOpen, aeadSeal } from "./aead.js";
+export { argon2idKDF } from "./argon2.js";
+export { HybridCiphertextSize, HybridPrivateKeySize, HybridPublicKeySize, HybridSharedSecretSize, Kyber768CiphertextSize, Kyber768PrivateKeySize, Kyber768PublicKeySize, Kyber768SharedKeySize, X25519Size, hybridDecapsulate, hybridPrivateKeyFromKyberAndX25519, kyber768Decapsulate, kyber768EncapsulateDeterministic, kyber768KeyPairFromSeed, x25519Agree, x25519PublicKey, } from "./kem.js";
+//# sourceMappingURL=index.js.map

package/dist/crypto/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,+BAA+B,EAC/B,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,GAGjB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EAAsB,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEnE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,kCAAkC,EAClC,mBAAmB,EACnB,gCAAgC,EAChC,uBAAuB,EACvB,WAAW,EACX,eAAe,GAChB,MAAM,UAAU,CAAC"}

package/dist/crypto/kdf.d.ts

@@ -0,0 +1,96 @@
+/**
+ * HKDF-SHA-512 derivation per HANDSHAKE.md §2.4 and SESSION.md §2.1.
+ *
+ * SEMP uses HKDF-SHA-512 for both currently defined algorithm suites.
+ * The five per-key info labels (and the resumption label) are bound
+ * contexts that prevent cross-context key confusion if an
+ * implementation accidentally reuses a PRK across derivations.
+ *
+ * @module
+ */
+/**
+ * Per-key HKDF info labels for the five session keys derived from
+ * the initial-handshake PRK. Per VECTORS.md §2.2, the rekey
+ * derivation reuses these same labels — cross-context separation
+ * comes from the salt change (rekey nonces vs handshake nonces),
+ * not from a different label namespace.
+ */
+export declare const InfoSessionEncC2S = "SEMP-v1-session-enc-c2s";
+export declare const InfoSessionEncS2C = "SEMP-v1-session-enc-s2c";
+export declare const InfoSessionMACC2S = "SEMP-v1-session-mac-c2s";
+export declare const InfoSessionMACS2C = "SEMP-v1-session-mac-s2c";
+export declare const InfoSessionEnvMAC = "SEMP-v1-session-env-mac";
+/**
+ * K_resumption label per HANDSHAKE.md §2.8.3 and SESSION.md §2.7.
+ * K_resumption is NOT used to encrypt or MAC any message in the
+ * current session; it is the secret a server retains so that, mixed
+ * with a fresh ephemeral DH on a later resume attempt, the resumed
+ * session derives a new key schedule.
+ */
+export declare const InfoSessionResumption = "SEMP-v1-session-resumption";
+/** Length in bytes of every derived session key (SESSION.md §2.1). */
+export declare const SessionKeyLength = 32;
+/**
+ * Generic KDF interface. Both currently defined SEMP suites use
+ * HKDF-SHA-512; future suites may swap to a different hash.
+ */
+export interface KDF {
+    /** HKDF-Extract(salt, ikm) -> PRK. */
+    extract(salt: Uint8Array, ikm: Uint8Array): Uint8Array;
+    /** HKDF-Expand(prk, info, length) -> length bytes of OKM. */
+    expand(prk: Uint8Array, info: Uint8Array, length: number): Uint8Array;
+}
+/**
+ * Returns a stateless HKDF-SHA-512 KDF instance. Safe for concurrent
+ * use; no state is held between calls.
+ */
+export declare function newHKDFSHA512(): KDF;
+/** The five session keys derived from a handshake PRK. */
+export interface SessionKeys {
+    /** Client -> server message encryption key. */
+    encC2S: Uint8Array;
+    /** Server -> client message encryption key. */
+    encS2C: Uint8Array;
+    /** Client -> server message MAC key. */
+    macC2S: Uint8Array;
+    /** Server -> client message MAC key. */
+    macS2C: Uint8Array;
+    /** Envelope-layer MAC key (HMAC-SHA-256 over canonical envelopes). */
+    envMAC: Uint8Array;
+    /**
+     * Resumption secret (32 bytes). Set on initial-handshake derivation
+     * via {@link deriveSessionKeysWithResumption}; absent on rekey
+     * derivations.
+     */
+    resumption?: Uint8Array;
+}
+/**
+ * Derive the five session keys from a handshake. The salt is
+ * `clientNonce || serverNonce`. Per VECTORS.md §2.1, the IKM is the
+ * shared secret from the negotiated KEM; for rekey, the same five
+ * keys are derived under the rekey nonces but the resumption secret
+ * is NOT regenerated.
+ */
+export declare function deriveSessionKeys(kdf: KDF, sharedSecret: Uint8Array, clientNonce: Uint8Array, serverNonce: Uint8Array): SessionKeys;
+/**
+ * Like {@link deriveSessionKeys} but also derives K_resumption.
+ * Used on the initial handshake; rekey derivations skip the
+ * resumption expansion.
+ */
+export declare function deriveSessionKeysWithResumption(kdf: KDF, sharedSecret: Uint8Array, clientNonce: Uint8Array, serverNonce: Uint8Array): SessionKeys;
+/**
+ * Derive the resumed-session keys from a rekey ECDH and a retained
+ * resumption secret per HANDSHAKE.md §2.8.3 and SESSION.md §2.7.
+ * IKM is `ephemeralSharedSecret || kResumption`, salt is
+ * `clientNonce || serverNonce`. The five expand labels are the same
+ * SEMP-v1-session-* labels as the initial derivation.
+ */
+export declare function deriveResumedSessionKeys(kdf: KDF, ephemeralSharedSecret: Uint8Array, kResumption: Uint8Array, clientNonce: Uint8Array, serverNonce: Uint8Array): SessionKeys;
+/**
+ * Derive rekey keys per SESSION.md §3.3. Identical to the initial
+ * derivation in label set; the cross-context separation comes from
+ * the salt construction (rekeyNonce || responderNonce) and a fresh
+ * shared secret.
+ */
+export declare function deriveRekeyKeys(kdf: KDF, sharedSecret: Uint8Array, rekeyNonce: Uint8Array, responderNonce: Uint8Array): SessionKeys;
+//# sourceMappingURL=kdf.d.ts.map

package/dist/crypto/kdf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../src/crypto/kdf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAC3D,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAC3D,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAC3D,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAC3D,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAE3D;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,+BAA+B,CAAC;AAElE,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC;;;GAGG;AACH,MAAM,WAAW,GAAG;IAClB,sCAAsC;IACtC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,GAAG,UAAU,CAAC;IACvD,6DAA6D;IAC7D,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;CACvE;AAWD;;;GAGG;AACH,wBAAgB,aAAa,IAAI,GAAG,CAEnC;AAED,0DAA0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,+CAA+C;IAC/C,MAAM,EAAE,UAAU,CAAC;IACnB,+CAA+C;IAC/C,MAAM,EAAE,UAAU,CAAC;IACnB,wCAAwC;IACxC,MAAM,EAAE,UAAU,CAAC;IACnB,wCAAwC;IACxC,MAAM,EAAE,UAAU,CAAC;IACnB,sEAAsE;IACtE,MAAM,EAAE,UAAU,CAAC;IACnB;;;;OAIG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,GAAG,EACR,YAAY,EAAE,UAAU,EACxB,WAAW,EAAE,UAAU,EACvB,WAAW,EAAE,UAAU,GACtB,WAAW,CAUb;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,GAAG,EACR,YAAY,EAAE,UAAU,EACxB,WAAW,EAAE,UAAU,EACvB,WAAW,EAAE,UAAU,GACtB,WAAW,CAWb;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,GAAG,EACR,qBAAqB,EAAE,UAAU,EACjC,WAAW,EAAE,UAAU,EACvB,WAAW,EAAE,UAAU,EACvB,WAAW,EAAE,UAAU,GACtB,WAAW,CAWb;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,GAAG,EACR,YAAY,EAAE,UAAU,EACxB,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,UAAU,GACzB,WAAW,CAEb"}