@sempdev/semp 0.4.3

package/dist/recovery/bundle_store.js

@@ -0,0 +1,104 @@
+/**
+ * Backup-bundle persistence per RECOVERY.md §2.6.
+ *
+ * The home server retains the user's most recent bundle plus the
+ * recent superseded chain (so a client recovering after a long
+ * offline period can fetch the bundle that matches whichever
+ * recovery secret the user remembers). Pruning honors the §2.6
+ * floor of 30 days for superseded entries.
+ *
+ * @module
+ */
+/**
+ * Spec-mandated retention floor for superseded bundles per §2.6:
+ * at least 30 days. Operators MAY use a larger value; smaller
+ * values are clamped up by {@link InMemoryBundleStore.pruneSuperseded}.
+ */
+export const MinSupersededRetentionMs = 30 * 24 * 60 * 60 * 1000;
+/** Reference {@link BundleStore}. Single-process only. */
+export class InMemoryBundleStore {
+    byUser = new Map();
+    nowFn;
+    constructor(nowFn = () => new Date()) {
+        this.nowFn = nowFn;
+    }
+    async putCurrent(userId, bundle, supersededAt) {
+        if (userId === "") {
+            throw new Error("recovery: empty userId");
+        }
+        if (bundle.user_id !== userId) {
+            throw new Error(`recovery: bundle.user_id ${JSON.stringify(bundle.user_id)} does not match ${JSON.stringify(userId)}`);
+        }
+        const existing = this.byUser.get(userId) ?? [];
+        const current = existing.find((r) => r.supersededAt === "");
+        if (current === undefined) {
+            // First put for this user. supersedes MUST be null.
+            if (bundle.supersedes !== null && bundle.supersedes !== "") {
+                throw new Error(`recovery: initial bundle for ${userId} sets supersedes=${JSON.stringify(bundle.supersedes)}; expected null`);
+            }
+        }
+        else {
+            if (bundle.supersedes !== current.bundle.bundle_id) {
+                throw new Error(`recovery: bundle.supersedes ${JSON.stringify(bundle.supersedes)} does not match current bundle id ${JSON.stringify(current.bundle.bundle_id)}`);
+            }
+            current.supersededAt = supersededAt.toISOString().replace(/\.\d{3}Z$/, "Z");
+        }
+        existing.push({ bundle: deepClone(bundle), supersededAt: "" });
+        this.byUser.set(userId, existing);
+    }
+    async getCurrent(userId) {
+        const list = this.byUser.get(userId);
+        if (list === undefined) {
+            return null;
+        }
+        const cur = list.find((r) => r.supersededAt === "");
+        return cur === undefined ? null : deepClone(cur.bundle);
+    }
+    async history(userId) {
+        const list = this.byUser.get(userId) ?? [];
+        return [...list]
+            .sort((a, b) => {
+            const ax = Date.parse(a.bundle.created_at);
+            const bx = Date.parse(b.bundle.created_at);
+            return bx - ax;
+        })
+            .map((r) => deepClone(r.bundle));
+    }
+    async deleteAll(userId) {
+        this.byUser.delete(userId);
+    }
+    async pruneSuperseded(retainForMs, now) {
+        if (retainForMs < MinSupersededRetentionMs) {
+            retainForMs = MinSupersededRetentionMs;
+        }
+        const cutoff = (now ?? this.nowFn()).getTime() - retainForMs;
+        let pruned = 0;
+        for (const [user, list] of this.byUser) {
+            const next = list.filter((r) => {
+                if (r.supersededAt === "") {
+                    return true; // current bundle: always retain
+                }
+                const ts = Date.parse(r.supersededAt);
+                if (Number.isNaN(ts)) {
+                    return true; // malformed — be conservative
+                }
+                if (ts < cutoff) {
+                    pruned++;
+                    return false;
+                }
+                return true;
+            });
+            if (next.length === 0) {
+                this.byUser.delete(user);
+            }
+            else {
+                this.byUser.set(user, next);
+            }
+        }
+        return pruned;
+    }
+}
+function deepClone(x) {
+    return JSON.parse(JSON.stringify(x));
+}
+//# sourceMappingURL=bundle_store.js.map

package/dist/recovery/bundle_store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle_store.js","sourceRoot":"","sources":["../../src/recovery/bundle_store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA4CjE,0DAA0D;AAC1D,MAAM,OAAO,mBAAmB;IACb,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC3C,KAAK,CAAa;IAEnC,YAAY,QAAoB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAC9C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,UAAU,CACd,MAAc,EACd,MAAoB,EACpB,YAAkB;QAElB,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CACtG,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,oDAAoD;YACpD,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC3D,MAAM,IAAI,KAAK,CACb,gCAAgC,MAAM,oBAAoB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAC7G,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CACb,+BAA+B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAChJ,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,YAAY,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC9E,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC;QACpD,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3C,OAAO,CAAC,GAAG,IAAI,CAAC;aACb,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACb,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC3C,OAAO,EAAE,GAAG,EAAE,CAAC;QACjB,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,WAAmB,EACnB,GAAU;QAEV,IAAI,WAAW,GAAG,wBAAwB,EAAE,CAAC;YAC3C,WAAW,GAAG,wBAAwB,CAAC;QACzC,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC;QAC7D,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC7B,IAAI,CAAC,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;oBAC1B,OAAO,IAAI,CAAC,CAAC,gCAAgC;gBAC/C,CAAC;gBACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;gBACtC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;oBACrB,OAAO,IAAI,CAAC,CAAC,8BAA8B;gBAC7C,CAAC;gBACD,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;oBAChB,MAAM,EAAE,CAAC;oBACT,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,SAAS,SAAS,CAAI,CAAI;IACxB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAM,CAAC;AAC5C,CAAC"}

package/dist/recovery/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Recovery layer per RECOVERY.md.
+ *
+ * Wire records (successor, recovery-set manifest, share record,
+ * backup bundle), Shamir secret splitting + recombination, full
+ * sign / verify primitives, manifest cross-check, Argon2id-derived
+ * bundle-payload encryption + decryption, recovery key derivation,
+ * and a reference {@link BundleStore}.
+ *
+ * @module
+ */
+export { type BackupBundle, type BundleKDF, type BundlePayload, type DeviceIdentityPubkey, type EncryptionKey, type IdentityKey, type RecoveryContributor, type RecoverySetManifest, type RecoveryShareRecord, type RecoverySignatureBlock, type RecoveryVerifyPK, type SuccessorRecord, BundlePayloadAEAD, BundleType, KDFAlgorithmArgon2id, MinKDFIterations, MinKDFMemoryKB, MinKDFParallelism, MinKDFSaltBytes, RecommendedKDFIterations, RecommendedKDFMemoryKB, RecommendedKDFParallelism, RecordVersion, RecoveryBundlePrefix, RecoveryManifestPrefix, RecoverySetManifestType, RecoveryShareRecordType, RecoveryShareSignaturePrefix, SignatureAlgorithmEd25519, SuccessorRecordPrefix, SuccessorRecordType, } from "./types.js";
+export { type RandSource, type ShamirShare, MaxShamirTotalShares, MinShamirThreshold, combineShares, splitSecret, } from "./shamir.js";
+export { checkShareMatchesManifest, prepareSuccessorSignatures, signManifest, signShareRecord, signSuccessorDomain, signSuccessorNewKey, signSuccessorRecovery, validateManifest, validateShareRecord, validateSuccessorRecord, verifyManifest, verifyShareRecord, verifySuccessorRecord, verifySuccessorTwoSignatures, } from "./sign.js";
+export { signBundle, validateBundle, verifyBundle } from "./bundle.js";
+export { type SecretForm, MinPassphraseBytes, RecoverySignKeyInfo, decryptBundlePayload, deriveBundleKey, deriveRecoverySignKey, encryptBundlePayload, normalizeRecoverySecret, } from "./bundle_crypto.js";
+export { type BundleStore, InMemoryBundleStore, MinSupersededRetentionMs, } from "./bundle_store.js";
+export { type CrossCheckReason, type DirectoryView, ManifestCrossCheckError, crossCheckManifestContributors, } from "./manifest_crosscheck.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/recovery/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/recovery/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,iBAAiB,EACjB,UAAU,EACV,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,WAAW,GACZ,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EACL,KAAK,UAAU,EACf,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,KAAK,WAAW,EAChB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC"}

package/dist/recovery/index.js

@@ -0,0 +1,19 @@
+/**
+ * Recovery layer per RECOVERY.md.
+ *
+ * Wire records (successor, recovery-set manifest, share record,
+ * backup bundle), Shamir secret splitting + recombination, full
+ * sign / verify primitives, manifest cross-check, Argon2id-derived
+ * bundle-payload encryption + decryption, recovery key derivation,
+ * and a reference {@link BundleStore}.
+ *
+ * @module
+ */
+export { BundlePayloadAEAD, BundleType, KDFAlgorithmArgon2id, MinKDFIterations, MinKDFMemoryKB, MinKDFParallelism, MinKDFSaltBytes, RecommendedKDFIterations, RecommendedKDFMemoryKB, RecommendedKDFParallelism, RecordVersion, RecoveryBundlePrefix, RecoveryManifestPrefix, RecoverySetManifestType, RecoveryShareRecordType, RecoveryShareSignaturePrefix, SignatureAlgorithmEd25519, SuccessorRecordPrefix, SuccessorRecordType, } from "./types.js";
+export { MaxShamirTotalShares, MinShamirThreshold, combineShares, splitSecret, } from "./shamir.js";
+export { checkShareMatchesManifest, prepareSuccessorSignatures, signManifest, signShareRecord, signSuccessorDomain, signSuccessorNewKey, signSuccessorRecovery, validateManifest, validateShareRecord, validateSuccessorRecord, verifyManifest, verifyShareRecord, verifySuccessorRecord, verifySuccessorTwoSignatures, } from "./sign.js";
+export { signBundle, validateBundle, verifyBundle } from "./bundle.js";
+export { MinPassphraseBytes, RecoverySignKeyInfo, decryptBundlePayload, deriveBundleKey, deriveRecoverySignKey, encryptBundlePayload, normalizeRecoverySecret, } from "./bundle_crypto.js";
+export { InMemoryBundleStore, MinSupersededRetentionMs, } from "./bundle_store.js";
+export { ManifestCrossCheckError, crossCheckManifestContributors, } from "./manifest_crosscheck.js";
+//# sourceMappingURL=index.js.map

package/dist/recovery/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/recovery/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAaL,iBAAiB,EACjB,UAAU,EACV,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAGL,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,WAAW,GACZ,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAEL,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAEL,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAGL,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC"}

package/dist/recovery/manifest_crosscheck.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Manifest-contributors cross-check per RECOVERY.md §5.2.
+ *
+ * Before trusting a fetched recovery-set manifest, a verifier MUST
+ * confirm that each contributor's `device_identity_pubkey` matches
+ * the user's currently-published device directory. The
+ * {@link DirectoryView} interface lets recovery code consult the
+ * device directory without depending on the keys package.
+ *
+ * @module
+ */
+import type { RecoverySetManifest } from "./types.js";
+/**
+ * Minimal device-directory read surface needed by the cross-check.
+ * The concrete `DeviceDirectory` type in `keys/` exposes a
+ * `findDevice` helper that satisfies this shape.
+ */
+export interface DirectoryView {
+    /** The user this directory belongs to. */
+    userId(): string;
+    /**
+     * Look up `deviceId`. Returns `(algorithm, public_key, true)`
+     * when present; `("", "", false)` when absent.
+     */
+    findDevice(deviceId: string): {
+        algorithm: string;
+        publicKey: string;
+        found: boolean;
+    };
+}
+/** Why a contributor cross-check failed. */
+export type CrossCheckReason = "user_mismatch" | "device_missing" | "pubkey_mismatch" | "algorithm_mismatch";
+/**
+ * Error thrown by {@link crossCheckManifestContributors} when a
+ * contributor entry does not match the device directory.
+ */
+export declare class ManifestCrossCheckError extends Error {
+    readonly name = "ManifestCrossCheckError";
+    readonly reason: CrossCheckReason;
+    /** Contributor share index (1-based) that caused the failure. */
+    readonly shareIndex: number;
+    /** Contributor device id that caused the failure. */
+    readonly deviceId: string;
+    constructor(reason: CrossCheckReason, shareIndex: number, deviceId: string, detail: string);
+}
+/**
+ * Cross-check that every contributor in `m` corresponds to a
+ * device in `directory` per §5.2:
+ *
+ *  - Manifest user_id MUST match directory.userId.
+ *  - Each contributor's device_id MUST be present in the directory.
+ *  - The directory entry's public_key + algorithm MUST match the
+ *    manifest contributor's device_identity_pubkey.
+ *
+ * Throws {@link ManifestCrossCheckError} on the first violation;
+ * returns silently when every contributor matches.
+ */
+export declare function crossCheckManifestContributors(m: RecoverySetManifest, directory: DirectoryView, manifestUserId: string): void;
+//# sourceMappingURL=manifest_crosscheck.d.ts.map

package/dist/recovery/manifest_crosscheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest_crosscheck.d.ts","sourceRoot":"","sources":["../../src/recovery/manifest_crosscheck.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,MAAM,IAAI,MAAM,CAAC;IACjB;;;OAGG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED,4CAA4C;AAC5C,MAAM,MAAM,gBAAgB,GACxB,eAAe,GACf,gBAAgB,GAChB,iBAAiB,GACjB,oBAAoB,CAAC;AAEzB;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,SAAkB,IAAI,6BAA6B;IACnD,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAGxB,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM;CAOjB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAC5C,CAAC,EAAE,mBAAmB,EACtB,SAAS,EAAE,aAAa,EACxB,cAAc,EAAE,MAAM,GACrB,IAAI,CAoCN"}

package/dist/recovery/manifest_crosscheck.js

@@ -0,0 +1,59 @@
+/**
+ * Manifest-contributors cross-check per RECOVERY.md §5.2.
+ *
+ * Before trusting a fetched recovery-set manifest, a verifier MUST
+ * confirm that each contributor's `device_identity_pubkey` matches
+ * the user's currently-published device directory. The
+ * {@link DirectoryView} interface lets recovery code consult the
+ * device directory without depending on the keys package.
+ *
+ * @module
+ */
+/**
+ * Error thrown by {@link crossCheckManifestContributors} when a
+ * contributor entry does not match the device directory.
+ */
+export class ManifestCrossCheckError extends Error {
+    name = "ManifestCrossCheckError";
+    reason;
+    /** Contributor share index (1-based) that caused the failure. */
+    shareIndex;
+    /** Contributor device id that caused the failure. */
+    deviceId;
+    constructor(reason, shareIndex, deviceId, detail) {
+        super(`recovery: ${detail}`);
+        this.reason = reason;
+        this.shareIndex = shareIndex;
+        this.deviceId = deviceId;
+    }
+}
+/**
+ * Cross-check that every contributor in `m` corresponds to a
+ * device in `directory` per §5.2:
+ *
+ *  - Manifest user_id MUST match directory.userId.
+ *  - Each contributor's device_id MUST be present in the directory.
+ *  - The directory entry's public_key + algorithm MUST match the
+ *    manifest contributor's device_identity_pubkey.
+ *
+ * Throws {@link ManifestCrossCheckError} on the first violation;
+ * returns silently when every contributor matches.
+ */
+export function crossCheckManifestContributors(m, directory, manifestUserId) {
+    if (directory.userId() !== manifestUserId) {
+        throw new ManifestCrossCheckError("user_mismatch", 0, "", `manifest user ${JSON.stringify(manifestUserId)} does not match directory user ${JSON.stringify(directory.userId())}`);
+    }
+    for (const c of m.contributors) {
+        const lookup = directory.findDevice(c.device_id);
+        if (!lookup.found) {
+            throw new ManifestCrossCheckError("device_missing", c.share_index, c.device_id, `manifest contributor share_index=${c.share_index} device_id=${JSON.stringify(c.device_id)} is not in the directory`);
+        }
+        if (lookup.algorithm !== c.device_identity_pubkey.algorithm) {
+            throw new ManifestCrossCheckError("algorithm_mismatch", c.share_index, c.device_id, `manifest contributor share_index=${c.share_index} algorithm ${JSON.stringify(c.device_identity_pubkey.algorithm)} does not match directory ${JSON.stringify(lookup.algorithm)}`);
+        }
+        if (lookup.publicKey !== c.device_identity_pubkey.public_key) {
+            throw new ManifestCrossCheckError("pubkey_mismatch", c.share_index, c.device_id, `manifest contributor share_index=${c.share_index} public_key does not match directory entry`);
+        }
+    }
+}
+//# sourceMappingURL=manifest_crosscheck.js.map

package/dist/recovery/manifest_crosscheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest_crosscheck.js","sourceRoot":"","sources":["../../src/recovery/manifest_crosscheck.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA8BH;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAC9B,IAAI,GAAG,yBAAyB,CAAC;IAC1C,MAAM,CAAmB;IAClC,iEAAiE;IACxD,UAAU,CAAS;IAC5B,qDAAqD;IAC5C,QAAQ,CAAS;IAE1B,YACE,MAAwB,EACxB,UAAkB,EAClB,QAAgB,EAChB,MAAc;QAEd,KAAK,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,8BAA8B,CAC5C,CAAsB,EACtB,SAAwB,EACxB,cAAsB;IAEtB,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,cAAc,EAAE,CAAC;QAC1C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,CAAC,EACD,EAAE,EACF,iBAAiB,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,kCAAkC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,CACtH,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,uBAAuB,CAC/B,gBAAgB,EAChB,CAAC,CAAC,WAAW,EACb,CAAC,CAAC,SAAS,EACX,oCAAoC,CAAC,CAAC,WAAW,cAAc,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,0BAA0B,CACrH,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC,sBAAsB,CAAC,SAAS,EAAE,CAAC;YAC5D,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,CAAC,CAAC,WAAW,EACb,CAAC,CAAC,SAAS,EACX,oCAAoC,CAAC,CAAC,WAAW,cAAc,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,SAAS,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CACjL,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC,sBAAsB,CAAC,UAAU,EAAE,CAAC;YAC7D,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,CAAC,CAAC,WAAW,EACb,CAAC,CAAC,SAAS,EACX,oCAAoC,CAAC,CAAC,WAAW,4CAA4C,CAC9F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/recovery/shamir.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Shamir's Secret Sharing over GF(256) per RECOVERY.md §5.1 + §5.4.
+ *
+ * Operates one polynomial per secret byte; the polynomial constant
+ * term is the secret byte and the higher coefficients are random.
+ * Reconstruction uses Lagrange interpolation at x=0.
+ *
+ * GF(256) arithmetic uses the AES reduction polynomial 0x11b with
+ * generator g = 3 (matches semp-go byte-for-byte; the recovery-shamir
+ * vectors verify cross-language reproducibility).
+ *
+ * @module
+ */
+/** Minimum reconstruction threshold per §5.1. */
+export declare const MinShamirThreshold = 2;
+/** Maximum share count per §5.1. */
+export declare const MaxShamirTotalShares = 16;
+/** A single Shamir share. */
+export interface ShamirShare {
+    /** 1-based polynomial-evaluation x-coordinate. Index 0 IS the secret. */
+    index: number;
+    /** One byte per secret byte. */
+    value: Uint8Array;
+}
+/**
+ * Random source for split. `n` MUST be filled with cryptographically
+ * strong bytes. Defaults to `globalThis.crypto.getRandomValues`.
+ */
+export type RandSource = (n: number) => Uint8Array;
+/**
+ * Split `secret` into `totalShares` shares with reconstruction
+ * threshold `threshold` per §5.1. Returns `totalShares` shares; any
+ * `threshold` of them suffice.
+ *
+ * Bounds: `MinShamirThreshold <= threshold <= totalShares <=
+ * MaxShamirTotalShares`.
+ */
+export declare function splitSecret(secret: Uint8Array, threshold: number, totalShares: number, rand?: RandSource): ShamirShare[];
+/**
+ * Reconstruct the secret from at least `threshold` shares per §5.4.
+ * Each share's `value` MUST have the same length; that common length
+ * is the recovered secret's length.
+ *
+ * Caller MUST track the threshold against the manifest. This function
+ * does not enforce a minimum count; supplying more than threshold is
+ * well-defined (Lagrange interpolation is exact for any subset >=
+ * threshold), and supplying fewer yields a nonsense byte string with
+ * no error.
+ */
+export declare function combineShares(shares: ShamirShare[]): Uint8Array;
+//# sourceMappingURL=shamir.d.ts.map

package/dist/recovery/shamir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shamir.d.ts","sourceRoot":"","sources":["../../src/recovery/shamir.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,iDAAiD;AACjD,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAEpC,oCAAoC;AACpC,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC,6BAA6B;AAC7B,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,KAAK,EAAE,UAAU,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,EAAE,MAAM,KAAK,UAAU,CAAC;AAQnD;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,UAAwB,GAC7B,WAAW,EAAE,CA6Cf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,UAAU,CAyC/D"}

package/dist/recovery/shamir.js

@@ -0,0 +1,181 @@
+/**
+ * Shamir's Secret Sharing over GF(256) per RECOVERY.md §5.1 + §5.4.
+ *
+ * Operates one polynomial per secret byte; the polynomial constant
+ * term is the secret byte and the higher coefficients are random.
+ * Reconstruction uses Lagrange interpolation at x=0.
+ *
+ * GF(256) arithmetic uses the AES reduction polynomial 0x11b with
+ * generator g = 3 (matches semp-go byte-for-byte; the recovery-shamir
+ * vectors verify cross-language reproducibility).
+ *
+ * @module
+ */
+/** Minimum reconstruction threshold per §5.1. */
+export const MinShamirThreshold = 2;
+/** Maximum share count per §5.1. */
+export const MaxShamirTotalShares = 16;
+const defaultRand = (n) => {
+    const out = new Uint8Array(n);
+    globalThis.crypto.getRandomValues(out);
+    return out;
+};
+/**
+ * Split `secret` into `totalShares` shares with reconstruction
+ * threshold `threshold` per §5.1. Returns `totalShares` shares; any
+ * `threshold` of them suffice.
+ *
+ * Bounds: `MinShamirThreshold <= threshold <= totalShares <=
+ * MaxShamirTotalShares`.
+ */
+export function splitSecret(secret, threshold, totalShares, rand = defaultRand) {
+    if (secret.length === 0) {
+        throw new Error("recovery: split secret is empty");
+    }
+    if (!Number.isInteger(threshold) || threshold < MinShamirThreshold) {
+        throw new Error(`recovery: threshold ${threshold} below minimum ${MinShamirThreshold}`);
+    }
+    if (!Number.isInteger(totalShares) || totalShares < threshold) {
+        throw new Error(`recovery: total_shares ${totalShares} below threshold ${threshold}`);
+    }
+    if (totalShares > MaxShamirTotalShares) {
+        throw new Error(`recovery: total_shares ${totalShares} above maximum ${MaxShamirTotalShares}`);
+    }
+    const shares = [];
+    for (let i = 0; i < totalShares; i++) {
+        shares.push({ index: i + 1, value: new Uint8Array(secret.length) });
+    }
+    // One polynomial per secret byte. Coefficient 0 is the secret byte;
+    // 1..threshold-1 are random.
+    const coeffs = new Uint8Array(threshold);
+    const randomNeeded = (threshold - 1) * secret.length;
+    const randomBuf = rand(randomNeeded);
+    if (randomBuf.length < randomNeeded) {
+        throw new Error("recovery: shamir random source returned too few bytes");
+    }
+    let randIdx = 0;
+    for (let j = 0; j < secret.length; j++) {
+        coeffs[0] = secret[j] ?? 0;
+        for (let k = 1; k < threshold; k++) {
+            coeffs[k] = randomBuf[randIdx++] ?? 0;
+        }
+        for (const share of shares) {
+            share.value[j] = polyEval(coeffs, share.index);
+        }
+    }
+    return shares;
+}
+/**
+ * Reconstruct the secret from at least `threshold` shares per §5.4.
+ * Each share's `value` MUST have the same length; that common length
+ * is the recovered secret's length.
+ *
+ * Caller MUST track the threshold against the manifest. This function
+ * does not enforce a minimum count; supplying more than threshold is
+ * well-defined (Lagrange interpolation is exact for any subset >=
+ * threshold), and supplying fewer yields a nonsense byte string with
+ * no error.
+ */
+export function combineShares(shares) {
+    if (shares.length === 0) {
+        throw new Error("recovery: combine got no shares");
+    }
+    const secretLen = shares[0].value.length;
+    if (secretLen === 0) {
+        throw new Error("recovery: combine got empty share value");
+    }
+    const xs = new Uint8Array(shares.length);
+    const seen = new Set();
+    for (let i = 0; i < shares.length; i++) {
+        const s = shares[i];
+        if (s.index === 0) {
+            throw new Error(`recovery: share[${i}] has invalid index 0`);
+        }
+        if (s.index < 0 || s.index > 255 || !Number.isInteger(s.index)) {
+            throw new Error(`recovery: share[${i}] index ${s.index} out of [1, 255]`);
+        }
+        if (seen.has(s.index)) {
+            throw new Error(`recovery: share index ${s.index} appears more than once`);
+        }
+        seen.add(s.index);
+        if (s.value.length !== secretLen) {
+            throw new Error(`recovery: share[${i}] value length ${s.value.length} differs from share[0] length ${secretLen}`);
+        }
+        xs[i] = s.index;
+    }
+    const out = new Uint8Array(secretLen);
+    const ys = new Uint8Array(shares.length);
+    for (let j = 0; j < secretLen; j++) {
+        for (let i = 0; i < shares.length; i++) {
+            ys[i] = shares[i].value[j] ?? 0;
+        }
+        out[j] = lagrangeInterpolateAtZero(xs, ys);
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// GF(256) tables under AES reduction polynomial 0x11b, generator g = 3.
+const gf256Exp = new Uint8Array(256);
+const gf256Log = new Uint8Array(256);
+(function buildTables() {
+    let x = 1;
+    for (let i = 0; i < 255; i++) {
+        gf256Exp[i] = x;
+        gf256Log[x] = i;
+        x = gf256MulRaw(x, 3);
+    }
+    gf256Exp[255] = 1;
+})();
+function gf256MulRaw(a, b) {
+    let p = 0;
+    for (let i = 0; i < 8; i++) {
+        if ((b & 1) === 1) {
+            p ^= a;
+        }
+        const hi = a & 0x80;
+        a = (a << 1) & 0xff;
+        if (hi !== 0) {
+            a ^= 0x1b;
+        }
+        b >>= 1;
+    }
+    return p & 0xff;
+}
+function gf256Mul(a, b) {
+    if (a === 0 || b === 0) {
+        return 0;
+    }
+    const idx = (gf256Log[a] + gf256Log[b]) % 255;
+    return gf256Exp[idx];
+}
+function gf256Inv(a) {
+    if (a === 0) {
+        throw new Error("recovery: gf256Inv(0)");
+    }
+    return gf256Exp[255 - gf256Log[a]];
+}
+function polyEval(coeffs, x) {
+    let y = 0;
+    for (let k = coeffs.length - 1; k >= 0; k--) {
+        y = gf256Mul(y, x) ^ (coeffs[k] ?? 0);
+    }
+    return y & 0xff;
+}
+function lagrangeInterpolateAtZero(xs, ys) {
+    let result = 0;
+    for (let i = 0; i < xs.length; i++) {
+        let num = 1;
+        let den = 1;
+        for (let k = 0; k < xs.length; k++) {
+            if (k === i) {
+                continue;
+            }
+            num = gf256Mul(num, xs[k]);
+            den = gf256Mul(den, xs[k] ^ xs[i]);
+        }
+        const basis = gf256Mul(num, gf256Inv(den));
+        result ^= gf256Mul(ys[i], basis);
+    }
+    return result & 0xff;
+}
+//# sourceMappingURL=shamir.js.map

package/dist/recovery/shamir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shamir.js","sourceRoot":"","sources":["../../src/recovery/shamir.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,iDAAiD;AACjD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEpC,oCAAoC;AACpC,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAgBvC,MAAM,WAAW,GAAe,CAAC,CAAC,EAAE,EAAE;IACpC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CACzB,MAAkB,EAClB,SAAiB,EACjB,WAAmB,EACnB,OAAmB,WAAW;IAE9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,kBAAkB,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,uBAAuB,SAAS,kBAAkB,kBAAkB,EAAE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,SAAS,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,0BAA0B,WAAW,oBAAoB,SAAS,EAAE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,GAAG,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,0BAA0B,WAAW,kBAAkB,oBAAoB,EAAE,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,oEAAoE;IACpE,6BAA6B;IAC7B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,SAAS,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,MAAqB;IACjD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,MAAM,CAAC;IAC1C,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,yBAAyB,CAAC,CAAC,KAAK,yBAAyB,CAC1D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,mBAAmB,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,MAAM,iCAAiC,SAAS,EAAE,CACjG,CAAC;QACJ,CAAC;QACD,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,GAAG,CAAC,CAAC,CAAC,GAAG,yBAAyB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,wEAAwE;AAExE,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AACrC,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAErC,CAAC,SAAS,WAAW;IACnB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChB,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACpB,CAAC,CAAC,EAAE,CAAC;AAEL,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;QACD,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;QACpB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACpB,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YACb,CAAC,IAAI,IAAI,CAAC;QACZ,CAAC;QACD,CAAC,KAAK,CAAC,CAAC;IACV,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC;AAClB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC,GAAG,GAAG,CAAC;IAChD,OAAO,QAAQ,CAAC,GAAG,CAAE,CAAC;AACxB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAE,CAAC;AACvC,CAAC;AAED,SAAS,QAAQ,CAAC,MAAkB,EAAE,CAAS;IAC7C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CAAC,EAAc,EAAE,EAAc;IAC/D,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,SAAS;YACX,CAAC;YACD,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC;YAC5B,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAE,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,MAAM,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,GAAG,IAAI,CAAC;AACvB,CAAC"}

package/dist/recovery/sign.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Sign / verify primitives for recovery wire records per
+ * RECOVERY.md §5.2, §5.3, §7.3, §7.5.
+ *
+ * @module
+ */
+import { type RecoverySetManifest, type RecoveryShareRecord, type SuccessorRecord } from "./types.js";
+/**
+ * Pre-populate the algorithm + key_id fields on all three signature
+ * blocks so the canonical bytes are stable across the three signing
+ * passes. Every signing pass signs the SAME canonical bytes (with
+ * all three `value` fields elided), so this MUST be called before
+ * any of the {@link signSuccessor*} functions.
+ */
+export declare function prepareSuccessorSignatures(r: SuccessorRecord, recoveryKeyId: string, newKeyId: string, domainKeyId: string): void;
+/** Sign `r.recovery_signature` per §7.3. */
+export declare function signSuccessorRecovery(r: SuccessorRecord, recoveryPriv: Uint8Array, recoveryKeyId: string): string;
+/** Sign `r.new_key_signature` per §7.3. */
+export declare function signSuccessorNewKey(r: SuccessorRecord, newIdentityPriv: Uint8Array, newKeyId: string): string;
+/** Sign `r.domain_signature` per §7.3. */
+export declare function signSuccessorDomain(r: SuccessorRecord, domainPriv: Uint8Array, domainKeyId: string): string;
+/**
+ * Verify the two device-side signatures (recovery, new_key) on `r`
+ * and accept an empty `domain_signature.value`. This is what the
+ * home server runs on receipt of a key-compromise rotation cascade
+ * (KEY.md §10.5.5): the device produced both signatures, the server
+ * has not yet added its own.
+ */
+export declare function verifySuccessorTwoSignatures(r: SuccessorRecord, recoveryVerifyPub: Uint8Array, newKeyPub: Uint8Array): boolean;
+/** Verify all three signatures on `r` per §7.5. */
+export declare function verifySuccessorRecord(r: SuccessorRecord, recoveryVerifyPub: Uint8Array, newKeyPub: Uint8Array, domainPub: Uint8Array): boolean;
+/** Structural validation per §7. Throws on first violation. */
+export declare function validateSuccessorRecord(r: SuccessorRecord, opts?: {
+    skipSignatureCheck?: boolean;
+}): void;
+/**
+ * Sign `m.signature` with the user's identity private key per §5.2.
+ * Pre-populates algorithm + key_id so the canonical bytes cover them.
+ */
+export declare function signManifest(m: RecoverySetManifest, identityPriv: Uint8Array, identityKeyId: string): string;
+/** Verify `m.signature` against `identityPub` per §5.2. */
+export declare function verifyManifest(m: RecoverySetManifest, identityPub: Uint8Array): boolean;
+/** Structural validation per §5.2. Throws on first violation. */
+export declare function validateManifest(m: RecoverySetManifest, opts?: {
+    skipSignatureCheck?: boolean;
+}): void;
+/** Sign `s.device_signature` with the device's identity private key per §5.3. */
+export declare function signShareRecord(s: RecoveryShareRecord, devicePriv: Uint8Array, deviceKeyId: string): string;
+/** Verify `s.device_signature` against `devicePub` per §5.3. */
+export declare function verifyShareRecord(s: RecoveryShareRecord, devicePub: Uint8Array): boolean;
+/** Structural validation per §5.3. Throws on first violation. */
+export declare function validateShareRecord(s: RecoveryShareRecord, opts?: {
+    skipSignatureCheck?: boolean;
+}): void;
+/**
+ * Cross-check that `s` belongs to `m` per §5.3 step 2: bundle_id,
+ * share_index, device_id, threshold, total_shares MUST all match.
+ * Returns true when every check passes.
+ */
+export declare function checkShareMatchesManifest(s: RecoveryShareRecord, m: RecoverySetManifest): boolean;
+//# sourceMappingURL=sign.d.ts.map

package/dist/recovery/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/recovery/sign.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EAKrB,MAAM,YAAY,CAAC;AAKpB;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,CAAC,EAAE,eAAe,EAClB,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,IAAI,CAUN;AAED,4CAA4C;AAC5C,wBAAgB,qBAAqB,CACnC,CAAC,EAAE,eAAe,EAClB,YAAY,EAAE,UAAU,EACxB,aAAa,EAAE,MAAM,GACpB,MAAM,CAQR;AAED,2CAA2C;AAC3C,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,eAAe,EAClB,eAAe,EAAE,UAAU,EAC3B,QAAQ,EAAE,MAAM,GACf,MAAM,CAQR;AAED,0CAA0C;AAC1C,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,eAAe,EAClB,UAAU,EAAE,UAAU,EACtB,WAAW,EAAE,MAAM,GAClB,MAAM,CAQR;AAuCD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,CAAC,EAAE,eAAe,EAClB,iBAAiB,EAAE,UAAU,EAC7B,SAAS,EAAE,UAAU,GACpB,OAAO,CAoCT;AAED,mDAAmD;AACnD,wBAAgB,qBAAqB,CACnC,CAAC,EAAE,eAAe,EAClB,iBAAiB,EAAE,UAAU,EAC7B,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,UAAU,GACpB,OAAO,CA+BT;AAED,+DAA+D;AAC/D,wBAAgB,uBAAuB,CACrC,CAAC,EAAE,eAAe,EAClB,IAAI,GAAE;IAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC1C,IAAI,CA+BN;AAoBD;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,CAAC,EAAE,mBAAmB,EACtB,YAAY,EAAE,UAAU,EACxB,aAAa,EAAE,MAAM,GACpB,MAAM,CAkBR;AAED,2DAA2D;AAC3D,wBAAgB,cAAc,CAC5B,CAAC,EAAE,mBAAmB,EACtB,WAAW,EAAE,UAAU,GACtB,OAAO,CAYT;AAED,iEAAiE;AACjE,wBAAgB,gBAAgB,CAC9B,CAAC,EAAE,mBAAmB,EACtB,IAAI,GAAE;IAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC1C,IAAI,CAyEN;AAKD,iFAAiF;AACjF,wBAAgB,eAAe,CAC7B,CAAC,EAAE,mBAAmB,EACtB,UAAU,EAAE,UAAU,EACtB,WAAW,EAAE,MAAM,GAClB,MAAM,CAgBR;AAED,gEAAgE;AAChE,wBAAgB,iBAAiB,CAC/B,CAAC,EAAE,mBAAmB,EACtB,SAAS,EAAE,UAAU,GACpB,OAAO,CAYT;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,mBAAmB,EACtB,IAAI,GAAE;IAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC1C,IAAI,CAqCN;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,CAAC,EAAE,mBAAmB,EACtB,CAAC,EAAE,mBAAmB,GACrB,OAAO,CAiBT"}