@sempdev/semp 0.4.3

package/dist/migration/sign.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Sequential four-signature compose / verify per MIGRATION.md §3.3.
+ *
+ * The migration record carries a chain of signatures:
+ *
+ *   1. old_identity_signature
+ *   2. new_identity_signature
+ *   3. new_domain_signature
+ *   4. old_domain_signature   (cooperative only)
+ *
+ * Each signature commits to all prior signatures' final values so
+ * walking them in order detects after-the-fact tampering with an
+ * earlier signing party's commitment.
+ *
+ * @module
+ */
+import { type MigrationRecord } from "./types.js";
+/**
+ * Pre-populate algorithm + key_id on every signature slot so the
+ * chained-signature canonical bytes are stable across passes per
+ * §3.3. Each later signature commits to prior slots' final state
+ * (including algorithm and key_id).
+ *
+ * In cooperative mode this allocates the `old_domain_signature`
+ * slot with the old provider's key id populated up front; the old
+ * provider populates only the `value` field at AcceptSubmission
+ * time. In unilateral mode the slot stays null.
+ */
+export declare function prepareSignatures(r: MigrationRecord, oldIdentityKeyId: string, newIdentityKeyId: string, newDomainKeyId: string, oldDomainKeyId?: string): void;
+/** Sign signing-pass 1 (old identity). */
+export declare function signOldIdentity(r: MigrationRecord, oldIdentityPriv: Uint8Array, oldIdentityKeyId: string): string;
+/** Sign signing-pass 2 (new identity). */
+export declare function signNewIdentity(r: MigrationRecord, newIdentityPriv: Uint8Array, newIdentityKeyId: string): string;
+/** Sign signing-pass 3 (new domain). */
+export declare function signNewDomain(r: MigrationRecord, newDomainPriv: Uint8Array, newDomainKeyId: string): string;
+/** Sign signing-pass 4 (old domain, cooperative only). */
+export declare function signOldDomain(r: MigrationRecord, oldDomainPriv: Uint8Array, oldDomainKeyId: string): string;
+/**
+ * Verify a single signature pass (zero-indexed: 0=old identity,
+ * 1=new identity, 2=new domain, 3=old domain). Used by orchestration
+ * code that validates partial submissions before the chain is
+ * complete.
+ */
+export declare function verifyMigrationPass(r: MigrationRecord, passIdx: number, pub: Uint8Array): boolean;
+/**
+ * Verify all signatures in §3.3 order: old identity → new identity
+ * → new domain → old domain. Returns true on full success.
+ *
+ * `oldDomainPub` is consulted only in cooperative mode; pass any
+ * value (including a zero-length array) for unilateral records.
+ */
+export declare function verifyMigrationRecord(r: MigrationRecord, oldIdentityPub: Uint8Array, newIdentityPub: Uint8Array, newDomainPub: Uint8Array, oldDomainPub: Uint8Array | null): boolean;
+/** Structural validation per §3.2. Throws on the first violation. */
+export declare function validateMigrationRecord(r: MigrationRecord): void;
+/**
+ * Enforce the §3.3 rule: `migrated_at` MUST be at or after the old
+ * identity key's `created` timestamp, and MUST NOT be in the future
+ * relative to `now` beyond ordinary clock-skew tolerance.
+ *
+ * `oldKeyCreated` is the `created` timestamp of the old identity
+ * key record (resolved from the old key endpoint).
+ * `clockSkewMs` defaults to 5 minutes.
+ */
+export declare function checkMigratedAtBound(r: MigrationRecord, oldKeyCreated: Date | null, now: Date, clockSkewMs?: number): void;
+//# sourceMappingURL=sign.d.ts.map

package/dist/migration/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/migration/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,OAAO,EAEL,KAAK,eAAe,EAOrB,MAAM,YAAY,CAAC;AAWpB;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,CAAC,EAAE,eAAe,EAClB,gBAAgB,EAAE,MAAM,EACxB,gBAAgB,EAAE,MAAM,EACxB,cAAc,EAAE,MAAM,EACtB,cAAc,CAAC,EAAE,MAAM,GACtB,IAAI,CA8BN;AAED,0CAA0C;AAC1C,wBAAgB,eAAe,CAC7B,CAAC,EAAE,eAAe,EAClB,eAAe,EAAE,UAAU,EAC3B,gBAAgB,EAAE,MAAM,GACvB,MAAM,CAER;AAED,0CAA0C;AAC1C,wBAAgB,eAAe,CAC7B,CAAC,EAAE,eAAe,EAClB,eAAe,EAAE,UAAU,EAC3B,gBAAgB,EAAE,MAAM,GACvB,MAAM,CAKR;AAED,wCAAwC;AACxC,wBAAgB,aAAa,CAC3B,CAAC,EAAE,eAAe,EAClB,aAAa,EAAE,UAAU,EACzB,cAAc,EAAE,MAAM,GACrB,MAAM,CAUR;AAED,0DAA0D;AAC1D,wBAAgB,aAAa,CAC3B,CAAC,EAAE,eAAe,EAClB,aAAa,EAAE,UAAU,EACzB,cAAc,EAAE,MAAM,GACrB,MAAM,CAqBR;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,eAAe,EAClB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,UAAU,GACd,OAAO,CAMT;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,CAAC,EAAE,eAAe,EAClB,cAAc,EAAE,UAAU,EAC1B,cAAc,EAAE,UAAU,EAC1B,YAAY,EAAE,UAAU,EACxB,YAAY,EAAE,UAAU,GAAG,IAAI,GAC9B,OAAO,CAyBT;AAED,qEAAqE;AACrE,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,eAAe,GAAG,IAAI,CA2EhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,eAAe,EAClB,aAAa,EAAE,IAAI,GAAG,IAAI,EAC1B,GAAG,EAAE,IAAI,EACT,WAAW,SAAgB,GAC1B,IAAI,CAeN"}

package/dist/migration/sign.js

@@ -0,0 +1,331 @@
+/**
+ * Sequential four-signature compose / verify per MIGRATION.md §3.3.
+ *
+ * The migration record carries a chain of signatures:
+ *
+ *   1. old_identity_signature
+ *   2. new_identity_signature
+ *   3. new_domain_signature
+ *   4. old_domain_signature   (cooperative only)
+ *
+ * Each signature commits to all prior signatures' final values so
+ * walking them in order detects after-the-fact tampering with an
+ * earlier signing party's commitment.
+ *
+ * @module
+ */
+import { marshal as canonicalMarshal } from "../canonical/index.js";
+import { sign as ed25519Sign, verify as ed25519Verify, } from "../keys/index.js";
+import { MaxForwardingWindowMs, MigrationPrefix, MigrationRecordType, MinForwardingWindowMs, SignatureAlgorithmEd25519, } from "./types.js";
+/** Order of signature slots per §3.3. */
+const SIGNATURE_FIELDS = [
+    "old_identity_signature",
+    "new_identity_signature",
+    "new_domain_signature",
+    "old_domain_signature",
+];
+/**
+ * Pre-populate algorithm + key_id on every signature slot so the
+ * chained-signature canonical bytes are stable across passes per
+ * §3.3. Each later signature commits to prior slots' final state
+ * (including algorithm and key_id).
+ *
+ * In cooperative mode this allocates the `old_domain_signature`
+ * slot with the old provider's key id populated up front; the old
+ * provider populates only the `value` field at AcceptSubmission
+ * time. In unilateral mode the slot stays null.
+ */
+export function prepareSignatures(r, oldIdentityKeyId, newIdentityKeyId, newDomainKeyId, oldDomainKeyId) {
+    r.old_identity_signature = {
+        algorithm: SignatureAlgorithmEd25519,
+        key_id: oldIdentityKeyId,
+        value: "",
+    };
+    r.new_identity_signature = {
+        algorithm: SignatureAlgorithmEd25519,
+        key_id: newIdentityKeyId,
+        value: "",
+    };
+    r.new_domain_signature = {
+        algorithm: SignatureAlgorithmEd25519,
+        key_id: newDomainKeyId,
+        value: "",
+    };
+    if (r.mode === "cooperative") {
+        if (oldDomainKeyId === undefined || oldDomainKeyId === "") {
+            throw new Error("migration: cooperative mode requires oldDomainKeyId");
+        }
+        r.old_domain_signature = {
+            algorithm: SignatureAlgorithmEd25519,
+            key_id: oldDomainKeyId,
+            value: "",
+        };
+    }
+    else {
+        r.old_domain_signature = null;
+    }
+}
+/** Sign signing-pass 1 (old identity). */
+export function signOldIdentity(r, oldIdentityPriv, oldIdentityKeyId) {
+    return signSlot(r, "old_identity_signature", oldIdentityPriv, oldIdentityKeyId);
+}
+/** Sign signing-pass 2 (new identity). */
+export function signNewIdentity(r, newIdentityPriv, newIdentityKeyId) {
+    if (r.old_identity_signature.value === "") {
+        throw new Error("migration: signOldIdentity MUST run before signNewIdentity");
+    }
+    return signSlot(r, "new_identity_signature", newIdentityPriv, newIdentityKeyId);
+}
+/** Sign signing-pass 3 (new domain). */
+export function signNewDomain(r, newDomainPriv, newDomainKeyId) {
+    if (r.old_identity_signature.value === "" ||
+        r.new_identity_signature.value === "") {
+        throw new Error("migration: signNewDomain requires old_identity and new_identity signatures");
+    }
+    return signSlot(r, "new_domain_signature", newDomainPriv, newDomainKeyId);
+}
+/** Sign signing-pass 4 (old domain, cooperative only). */
+export function signOldDomain(r, oldDomainPriv, oldDomainKeyId) {
+    if (r.mode !== "cooperative") {
+        throw new Error(`migration: signOldDomain only valid for mode=cooperative (got ${JSON.stringify(r.mode)})`);
+    }
+    if (r.old_domain_signature === null) {
+        throw new Error("migration: prepareSignatures MUST run before signOldDomain (cooperative mode)");
+    }
+    if (r.old_identity_signature.value === "" ||
+        r.new_identity_signature.value === "" ||
+        r.new_domain_signature.value === "") {
+        throw new Error("migration: signOldDomain requires all three prior signatures");
+    }
+    return signSlot(r, "old_domain_signature", oldDomainPriv, oldDomainKeyId);
+}
+/**
+ * Verify a single signature pass (zero-indexed: 0=old identity,
+ * 1=new identity, 2=new domain, 3=old domain). Used by orchestration
+ * code that validates partial submissions before the chain is
+ * complete.
+ */
+export function verifyMigrationPass(r, passIdx, pub) {
+    if (!Number.isInteger(passIdx) || passIdx < 0 || passIdx >= SIGNATURE_FIELDS.length) {
+        return false;
+    }
+    const field = SIGNATURE_FIELDS[passIdx];
+    return verifySlot(r, field, passIdx, pub);
+}
+/**
+ * Verify all signatures in §3.3 order: old identity → new identity
+ * → new domain → old domain. Returns true on full success.
+ *
+ * `oldDomainPub` is consulted only in cooperative mode; pass any
+ * value (including a zero-length array) for unilateral records.
+ */
+export function verifyMigrationRecord(r, oldIdentityPub, newIdentityPub, newDomainPub, oldDomainPub) {
+    validateMigrationRecord(r);
+    if (!verifySlot(r, "old_identity_signature", 0, oldIdentityPub)) {
+        return false;
+    }
+    if (!verifySlot(r, "new_identity_signature", 1, newIdentityPub)) {
+        return false;
+    }
+    if (!verifySlot(r, "new_domain_signature", 2, newDomainPub)) {
+        return false;
+    }
+    if (r.mode === "cooperative") {
+        if (r.old_domain_signature === null) {
+            return false;
+        }
+        if (oldDomainPub === null || oldDomainPub.length === 0) {
+            return false;
+        }
+        if (!verifySlot(r, "old_domain_signature", 3, oldDomainPub)) {
+            return false;
+        }
+    }
+    else if (r.old_domain_signature !== null) {
+        return false;
+    }
+    return true;
+}
+/** Structural validation per §3.2. Throws on the first violation. */
+export function validateMigrationRecord(r) {
+    if (r.type !== MigrationRecordType) {
+        throw new Error(`migration: type ${JSON.stringify(r.type)}, want ${MigrationRecordType}`);
+    }
+    for (const f of [
+        "version",
+        "record_id",
+        "old_address",
+        "new_address",
+        "old_identity_key_id",
+        "new_identity_key_id",
+        "new_identity_public_key",
+        "migrated_at",
+    ]) {
+        if (typeof r[f] !== "string" || r[f] === "") {
+            throw new Error(`migration: missing ${f}`);
+        }
+    }
+    const migratedMs = Date.parse(r.migrated_at);
+    if (Number.isNaN(migratedMs)) {
+        throw new Error("migration: migrated_at is not ISO 8601");
+    }
+    if (r.mode !== "cooperative" && r.mode !== "unilateral") {
+        throw new Error(`migration: mode ${JSON.stringify(r.mode)} is invalid`);
+    }
+    if (r.mode === "cooperative") {
+        if (typeof r.forwarding_window_until !== "string" || r.forwarding_window_until === "") {
+            throw new Error("migration: cooperative mode MUST set forwarding_window_until");
+        }
+        const untilMs = Date.parse(r.forwarding_window_until);
+        if (Number.isNaN(untilMs)) {
+            throw new Error("migration: forwarding_window_until is not ISO 8601");
+        }
+        const window = untilMs - migratedMs;
+        if (window < MinForwardingWindowMs) {
+            throw new Error(`migration: cooperative forwarding window ${window} below minimum ${MinForwardingWindowMs}`);
+        }
+        if (window > MaxForwardingWindowMs) {
+            throw new Error(`migration: cooperative forwarding window ${window} exceeds maximum ${MaxForwardingWindowMs}`);
+        }
+    }
+    for (const f of [
+        "old_identity_signature",
+        "new_identity_signature",
+        "new_domain_signature",
+    ]) {
+        const sig = r[f];
+        if (typeof sig?.algorithm !== "string" || sig.algorithm === "") {
+            throw new Error(`migration: ${f}.algorithm missing`);
+        }
+        if (typeof sig?.key_id !== "string" || sig.key_id === "") {
+            throw new Error(`migration: ${f}.key_id missing`);
+        }
+        if (typeof sig?.value !== "string") {
+            throw new Error(`migration: ${f}.value must be a string`);
+        }
+    }
+    if (r.mode === "cooperative") {
+        if (r.old_domain_signature === null) {
+            throw new Error("migration: cooperative record requires old_domain_signature");
+        }
+        if (typeof r.old_domain_signature.value !== "string") {
+            throw new Error("migration: old_domain_signature.value must be a string");
+        }
+    }
+    else if (r.old_domain_signature !== null) {
+        throw new Error("migration: unilateral record MUST NOT carry old_domain_signature");
+    }
+}
+/**
+ * Enforce the §3.3 rule: `migrated_at` MUST be at or after the old
+ * identity key's `created` timestamp, and MUST NOT be in the future
+ * relative to `now` beyond ordinary clock-skew tolerance.
+ *
+ * `oldKeyCreated` is the `created` timestamp of the old identity
+ * key record (resolved from the old key endpoint).
+ * `clockSkewMs` defaults to 5 minutes.
+ */
+export function checkMigratedAtBound(r, oldKeyCreated, now, clockSkewMs = 5 * 60 * 1000) {
+    const migratedMs = Date.parse(r.migrated_at);
+    if (Number.isNaN(migratedMs)) {
+        throw new Error("migration: migrated_at is not ISO 8601");
+    }
+    if (oldKeyCreated !== null && migratedMs < oldKeyCreated.getTime()) {
+        throw new Error(`migration: migrated_at ${r.migrated_at} precedes old identity key created ${oldKeyCreated.toISOString()}`);
+    }
+    if (migratedMs > now.getTime() + clockSkewMs) {
+        throw new Error(`migration: migrated_at ${r.migrated_at} is in the future beyond clock-skew tolerance`);
+    }
+}
+// ---------------------------------------------------------------------------
+// Internal helpers
+function signSlot(r, field, priv, expectedKeyId) {
+    const slot = r[field];
+    if (slot === null) {
+        throw new Error(`migration: ${field} slot is null (call prepareSignatures)`);
+    }
+    if (slot.algorithm === "" || slot.key_id === "") {
+        throw new Error(`migration: ${field} requires algorithm + key_id pre-populated (call prepareSignatures)`);
+    }
+    if (slot.key_id !== expectedKeyId) {
+        throw new Error(`migration: ${field}.key_id ${JSON.stringify(slot.key_id)} does not match passed ${JSON.stringify(expectedKeyId)}`);
+    }
+    // Build a deep copy + blank from this slot onward.
+    const view = JSON.parse(JSON.stringify(r));
+    blankFromIndex(view, fieldIndex(field, r.mode));
+    const canonical = canonicalMarshal(view);
+    const signingInput = concat(new TextEncoder().encode(MigrationPrefix), canonical);
+    const sig = ed25519Sign(priv, signingInput);
+    const sigB64 = base64Encode(sig);
+    slot.value = sigB64;
+    return sigB64;
+}
+function verifySlot(r, field, passIdx, pub) {
+    const slot = r[field];
+    if (slot === null) {
+        return false;
+    }
+    if (slot.value === "") {
+        return false;
+    }
+    let sig;
+    try {
+        sig = base64Decode(slot.value);
+    }
+    catch {
+        return false;
+    }
+    // Recreate the signing-time canonical bytes: this slot blanked,
+    // every later slot also blanked (they hadn't been signed yet).
+    const view = JSON.parse(JSON.stringify(r));
+    blankFromIndex(view, passIdx);
+    const canonical = canonicalMarshal(view);
+    const signingInput = concat(new TextEncoder().encode(MigrationPrefix), canonical);
+    return ed25519Verify(pub, sig, signingInput);
+}
+function fieldIndex(field, mode) {
+    // Skip old_domain_signature in unilateral mode.
+    void mode;
+    return SIGNATURE_FIELDS.indexOf(field);
+}
+function blankFromIndex(view, fromIndex) {
+    for (let i = fromIndex; i < SIGNATURE_FIELDS.length; i++) {
+        const field = SIGNATURE_FIELDS[i] ?? "";
+        const slot = view[field];
+        if (slot === null || slot === undefined) {
+            continue;
+        }
+        if (typeof slot !== "object" || Array.isArray(slot)) {
+            continue;
+        }
+        slot.value = "";
+    }
+}
+function concat(a, b) {
+    const out = new Uint8Array(a.length + b.length);
+    out.set(a, 0);
+    out.set(b, a.length);
+    return out;
+}
+function base64Encode(b) {
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(b).toString("base64");
+    }
+    let bin = "";
+    for (let i = 0; i < b.length; i++) {
+        bin += String.fromCharCode(b[i] ?? 0);
+    }
+    return btoa(bin);
+}
+function base64Decode(s) {
+    if (typeof Buffer !== "undefined") {
+        return new Uint8Array(Buffer.from(s, "base64"));
+    }
+    const bin = atob(s);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++) {
+        out[i] = bin.charCodeAt(i);
+    }
+    return out;
+}
+//# sourceMappingURL=sign.js.map

package/dist/migration/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../src/migration/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EACL,IAAI,IAAI,WAAW,EACnB,MAAM,IAAI,aAAa,GACxB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAIL,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AAEpB,yCAAyC;AACzC,MAAM,gBAAgB,GAAG;IACvB,wBAAwB;IACxB,wBAAwB;IACxB,sBAAsB;IACtB,sBAAsB;CACd,CAAC;AAGX;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,CAAkB,EAClB,gBAAwB,EACxB,gBAAwB,EACxB,cAAsB,EACtB,cAAuB;IAEvB,CAAC,CAAC,sBAAsB,GAAG;QACzB,SAAS,EAAE,yBAAyB;QACpC,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,EAAE;KACV,CAAC;IACF,CAAC,CAAC,sBAAsB,GAAG;QACzB,SAAS,EAAE,yBAAyB;QACpC,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,EAAE;KACV,CAAC;IACF,CAAC,CAAC,oBAAoB,GAAG;QACvB,SAAS,EAAE,yBAAyB;QACpC,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE,EAAE;KACV,CAAC;IACF,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC7B,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,EAAE,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,oBAAoB,GAAG;YACvB,SAAS,EAAE,yBAAyB;YACpC,MAAM,EAAE,cAAc;YACtB,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAChC,CAAC;AACH,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,eAAe,CAC7B,CAAkB,EAClB,eAA2B,EAC3B,gBAAwB;IAExB,OAAO,QAAQ,CAAC,CAAC,EAAE,wBAAwB,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;AAClF,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,eAAe,CAC7B,CAAkB,EAClB,eAA2B,EAC3B,gBAAwB;IAExB,IAAI,CAAC,CAAC,sBAAsB,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,QAAQ,CAAC,CAAC,EAAE,wBAAwB,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;AAClF,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,aAAa,CAC3B,CAAkB,EAClB,aAAyB,EACzB,cAAsB;IAEtB,IACE,CAAC,CAAC,sBAAsB,CAAC,KAAK,KAAK,EAAE;QACrC,CAAC,CAAC,sBAAsB,CAAC,KAAK,KAAK,EAAE,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,CAAC,EAAE,sBAAsB,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;AAC5E,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAC3B,CAAkB,EAClB,aAAyB,EACzB,cAAsB;IAEtB,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,iEAAiE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,IACE,CAAC,CAAC,sBAAsB,CAAC,KAAK,KAAK,EAAE;QACrC,CAAC,CAAC,sBAAsB,CAAC,KAAK,KAAK,EAAE;QACrC,CAAC,CAAC,oBAAoB,CAAC,KAAK,KAAK,EAAE,EACnC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,CAAC,EAAE,sBAAsB,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,CAAkB,EAClB,OAAe,EACf,GAAe;IAEf,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,IAAI,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACpF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAE,CAAC;IACzC,OAAO,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,CAAkB,EAClB,cAA0B,EAC1B,cAA0B,EAC1B,YAAwB,EACxB,YAA+B;IAE/B,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,uBAAuB,CAAC,CAAkB;IACxD,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,mBAAmB,EAAE,CACzE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI;QACd,SAAS;QACT,WAAW;QACX,aAAa;QACb,aAAa;QACb,qBAAqB;QACrB,qBAAqB;QACrB,yBAAyB;QACzB,aAAa;KACL,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,CAAC,uBAAuB,KAAK,QAAQ,IAAI,CAAC,CAAC,uBAAuB,KAAK,EAAE,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;QACpC,IAAI,MAAM,GAAG,qBAAqB,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,4CAA4C,MAAM,kBAAkB,qBAAqB,EAAE,CAC5F,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,GAAG,qBAAqB,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,4CAA4C,MAAM,oBAAoB,qBAAqB,EAAE,CAC9F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI;QACd,wBAAwB;QACxB,wBAAwB;QACxB,sBAAsB;KACd,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,OAAO,GAAG,EAAE,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,OAAO,GAAG,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,oBAAoB,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,CAAkB,EAClB,aAA0B,EAC1B,GAAS,EACT,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;IAE3B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,aAAa,KAAK,IAAI,IAAI,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,0BAA0B,CAAC,CAAC,WAAW,sCAAsC,aAAa,CAAC,WAAW,EAAE,EAAE,CAC3G,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,WAAW,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,0BAA0B,CAAC,CAAC,WAAW,+CAA+C,CACvF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AAEnB,SAAS,QAAQ,CACf,CAAkB,EAClB,KAAe,EACf,IAAgB,EAChB,aAAqB;IAErB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAmC,CAAC;IACxD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,wCAAwC,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,cAAc,KAAK,qEAAqE,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,cAAc,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CACnH,CAAC;IACJ,CAAC;IACD,mDAAmD;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAA4B,CAAC;IACtE,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,MAAM,CACzB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,EACzC,SAAS,CACV,CAAC;IACF,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;IACpB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CACjB,CAAkB,EAClB,KAAe,EACf,OAAe,EACf,GAAe;IAEf,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAmC,CAAC;IACxD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,gEAAgE;IAChE,+DAA+D;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAA4B,CAAC;IACtE,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,MAAM,CACzB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,EACzC,SAAS,CACV,CAAC;IACF,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,UAAU,CAAC,KAAe,EAAE,IAAmB;IACtD,gDAAgD;IAChD,KAAK,IAAI,CAAC;IACV,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,cAAc,CACrB,IAA6B,EAC7B,SAAiB;IAEjB,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,SAAS;QACX,CAAC;QACA,IAAgC,CAAC,KAAK,GAAG,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,CAAa,EAAE,CAAa;IAC1C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAChD,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACd,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,CAAa;IACjC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/migration/types.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Wire-record types and constants for SEMP_MIGRATION per
+ * MIGRATION.md §3.
+ *
+ * @module
+ */
+/** Wire-level type discriminators. */
+export declare const MigrationRecordType = "SEMP_MIGRATION";
+export declare const MigrationRecordVersion = "1.0.0";
+/** Domain-separation prefix per ENVELOPE.md §4.3. */
+export declare const MigrationPrefix = "SEMP-MIGRATION-RECORD:";
+/** Notice message type per §4. */
+export declare const MigrationNoticeType = "SEMP_MIGRATION_NOTICE";
+/** Migration mode per §2. */
+export type MigrationMode = "cooperative" | "unilateral";
+/**
+ * Forwarding window bounds per §5.1, in milliseconds.
+ *
+ *  - Min:         30 days  (cooperative servers MUST NOT accept below this)
+ *  - Recommended: 180 days
+ *  - Max:         730 days (~2 years; servers MAY decline above this)
+ */
+export declare const MinForwardingWindowMs: number;
+export declare const RecommendedForwardingWindowMs: number;
+export declare const MaxForwardingWindowMs: number;
+/** Only signature algorithm currently defined for migration records. */
+export declare const SignatureAlgorithmEd25519 = "ed25519";
+/** Reusable signature block. */
+export interface MigrationSignatureBlock {
+    algorithm: string;
+    key_id: string;
+    value: string;
+}
+/** SEMP_MIGRATION record per §3.1. */
+export interface MigrationRecord {
+    type: typeof MigrationRecordType;
+    version: string;
+    record_id: string;
+    old_address: string;
+    new_address: string;
+    old_identity_key_id: string;
+    new_identity_key_id: string;
+    /** Base64. */
+    new_identity_public_key: string;
+    /** ISO 8601 UTC. */
+    migrated_at: string;
+    /**
+     * ISO 8601 UTC, or null when no forwarding is offered (typical
+     * for unilateral mode where the old provider is non-cooperative).
+     */
+    forwarding_window_until: string | null;
+    mode: MigrationMode;
+    old_identity_signature: MigrationSignatureBlock;
+    new_identity_signature: MigrationSignatureBlock;
+    new_domain_signature: MigrationSignatureBlock;
+    /** Required when mode === "cooperative"; null in unilateral mode. */
+    old_domain_signature: MigrationSignatureBlock | null;
+    /**
+     * Optional extension entries. Every signature in the §3.3 chain
+     * covers `extensions`; any content captured here is attested by
+     * all signers.
+     */
+    extensions?: Record<string, unknown>;
+}
+/**
+ * SEMP_MIGRATION_NOTICE message a server sends to inform a sender
+ * that the recipient has migrated. Per §4.
+ */
+export interface MigrationNotice {
+    type: typeof MigrationNoticeType;
+    version: string;
+    /** ULID for the notice. */
+    notice_id: string;
+    /** Reference to the published migration record. */
+    record_id: string;
+    /** URL where the migration record can be fetched. */
+    record_url: string;
+    /** Old address (the one the sender attempted to deliver to). */
+    old_address: string;
+    /** New address the sender SHOULD redirect to. */
+    new_address: string;
+    /** Migration mode (informational). */
+    mode: MigrationMode;
+    /** ISO 8601 UTC timestamp the notice was issued. */
+    issued_at: string;
+}
+/** Rejection wrapper a sender returns when it refuses to honor a notice. */
+export interface MigrationNoticeRejection {
+    notice: MigrationNotice;
+    reason: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/migration/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/migration/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,sCAAsC;AACtC,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD,eAAO,MAAM,sBAAsB,UAAU,CAAC;AAE9C,qDAAqD;AACrD,eAAO,MAAM,eAAe,2BAA2B,CAAC;AAExD,kCAAkC;AAClC,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAE3D,6BAA6B;AAC7B,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,YAAY,CAAC;AAEzD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,QAA2B,CAAC;AAC9D,eAAO,MAAM,6BAA6B,QAA4B,CAAC;AACvE,eAAO,MAAM,qBAAqB,QAA4B,CAAC;AAE/D,wEAAwE;AACxE,eAAO,MAAM,yBAAyB,YAAY,CAAC;AAEnD,gCAAgC;AAChC,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,sCAAsC;AACtC,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,OAAO,mBAAmB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,cAAc;IACd,uBAAuB,EAAE,MAAM,CAAC;IAChC,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,IAAI,EAAE,aAAa,CAAC;IAEpB,sBAAsB,EAAE,uBAAuB,CAAC;IAChD,sBAAsB,EAAE,uBAAuB,CAAC;IAChD,oBAAoB,EAAE,uBAAuB,CAAC;IAC9C,qEAAqE;IACrE,oBAAoB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAErD;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,OAAO,mBAAmB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,IAAI,EAAE,aAAa,CAAC;IACpB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,4EAA4E;AAC5E,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB"}

package/dist/migration/types.js

@@ -0,0 +1,26 @@
+/**
+ * Wire-record types and constants for SEMP_MIGRATION per
+ * MIGRATION.md §3.
+ *
+ * @module
+ */
+/** Wire-level type discriminators. */
+export const MigrationRecordType = "SEMP_MIGRATION";
+export const MigrationRecordVersion = "1.0.0";
+/** Domain-separation prefix per ENVELOPE.md §4.3. */
+export const MigrationPrefix = "SEMP-MIGRATION-RECORD:";
+/** Notice message type per §4. */
+export const MigrationNoticeType = "SEMP_MIGRATION_NOTICE";
+/**
+ * Forwarding window bounds per §5.1, in milliseconds.
+ *
+ *  - Min:         30 days  (cooperative servers MUST NOT accept below this)
+ *  - Recommended: 180 days
+ *  - Max:         730 days (~2 years; servers MAY decline above this)
+ */
+export const MinForwardingWindowMs = 30 * 24 * 60 * 60 * 1000;
+export const RecommendedForwardingWindowMs = 180 * 24 * 60 * 60 * 1000;
+export const MaxForwardingWindowMs = 730 * 24 * 60 * 60 * 1000;
+/** Only signature algorithm currently defined for migration records. */
+export const SignatureAlgorithmEd25519 = "ed25519";
+//# sourceMappingURL=types.js.map

package/dist/migration/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/migration/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,sCAAsC;AACtC,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AACpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAE9C,qDAAqD;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAExD,kCAAkC;AAClC,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAK3D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9D,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/D,wEAAwE;AACxE,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAAC"}

package/dist/reasoncodes.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Reason-code registry per VECTORS.md §8 / HANDSHAKE.md §4.1 /
+ * ENVELOPE.md §9.3 / ERRORS.md.
+ *
+ * @module
+ */
+/**
+ * Machine-readable rejection reason returned by handshake,
+ * envelope, key-fetch, and policy operations. Senders use the
+ * code to decide whether to retry, surface to user, or rotate
+ * credentials.
+ */
+export type ReasonCode = "blocked" | "auth_failed" | "policy_forbidden" | "handshake_expired" | "handshake_invalid" | "no_session" | "rate_limited" | "challenge" | "challenge_failed" | "challenge_invalid" | "server_at_capacity" | "resumption_failed" | "version_unsupported" | "seal_invalid" | "session_mac_invalid" | "envelope_expired" | "envelope_size_exceeded" | "extension_unsupported" | "extension_size_exceeded" | "scope_exceeded" | "scope_invalid" | "certificate_expired" | "server_unavailable" | "session_expired" | "rekey_unsupported" | "policy_kind_unsupported" | "policy_op_invalid" | "policy_version_stale";
+/** The full set of recognized ReasonCode values. */
+export declare const KnownReasonCodes: ReadonlySet<string>;
+/** Type guard: is this string one of the recognized codes? */
+export declare function isKnownReasonCode(code: string): code is ReasonCode;
+/**
+ * Reports whether automated retry is appropriate for this reason.
+ *
+ * Recoverable codes signal a transient or transport condition the
+ * sender SHOULD retry after a back-off, OR a state-staleness
+ * condition (handshake_expired, no_session, policy_version_stale)
+ * the sender resolves with a fresh handshake / refresh and a single
+ * retry. Non-recoverable codes signal a permanent condition (blocked,
+ * auth_failed, policy_forbidden, scope_invalid, etc.) where the
+ * sender MUST NOT retry without operator intervention.
+ *
+ * Notes on edge cases:
+ *
+ *   - `session_expired` and `rekey_unsupported` are NOT recoverable
+ *     here because they require a fresh handshake rather than an
+ *     automated retry on the rekey path.
+ *   - `challenge_invalid`, `version_unsupported`, `resumption_failed`,
+ *     `envelope_size_exceeded`, `scope_invalid`, and
+ *     `certificate_expired` are non-recoverable per ERRORS.md.
+ *
+ * Mirrors semp-go's `ReasonCode.Recoverable()` byte-for-byte; the
+ * vectors at `vectors/v1.0.0/rejection-codes.json` cross-check both.
+ */
+export declare function isRecoverable(code: ReasonCode): boolean;
+//# sourceMappingURL=reasoncodes.d.ts.map

package/dist/reasoncodes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reasoncodes.d.ts","sourceRoot":"","sources":["../src/reasoncodes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAElB,SAAS,GACT,aAAa,GACb,kBAAkB,GAClB,mBAAmB,GACnB,mBAAmB,GACnB,YAAY,GACZ,cAAc,GACd,WAAW,GACX,kBAAkB,GAClB,mBAAmB,GACnB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GAErB,cAAc,GACd,qBAAqB,GACrB,kBAAkB,GAClB,wBAAwB,GACxB,uBAAuB,GACvB,yBAAyB,GACzB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,oBAAoB,GACpB,iBAAiB,GACjB,mBAAmB,GACnB,yBAAyB,GACzB,mBAAmB,GACnB,sBAAsB,CAAC;AAE3B,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CA6B/C,CAAC;AAEH,8DAA8D;AAC9D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,UAAU,CAElE;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAcvD"}