p2party 0.14.2 → 0.14.7

package/lib/blindRendezvous/roomPolicyV4.d.ts

@@ -0,0 +1,90 @@
+/**
+ * `RoomPolicyV4`: the immutable security semantics of a blind room.
+ *
+ * Section 4.1 keeps delivery profiles, stores, routes, planner preferences,
+ * and local frontend controls out of this object: it is hashed into
+ * `RoomContextId`, so anything that can change without creating a different
+ * room must live elsewhere.
+ *
+ * The existing 32-byte `RoomPolicyV1` session policy is nested by value, not
+ * copied field by field, so `authMode`, `pqMode`, `rendezvousMode`, and the
+ * cover schedule keep exactly one encoder and one source of truth.
+ */
+import { PAIR_BOOTSTRAP_SUITE_ID_V1 } from "./pairBootstrapSuite";
+import type { RoomPolicyV1 } from "../roomPolicy";
+export type AdmissionFloorV4 = {
+    mode: "capability";
+} | {
+    mode: "authority-grant";
+    authorityEd25519PublicKey: Uint8Array;
+    maxAuthorityCredentialLifetimeWindows: number;
+};
+export interface RoomProtocolLimitsV1 {
+    logicalWindowMs: bigint;
+    maxClockSkewWindows: number;
+    operationRetentionWindows: number;
+    pairControlRetentionWindows: number;
+    receiverKeyOverlapWindows: number;
+    maxFutureLogicalWindows: number;
+    maxDependenciesPerOperation: number;
+    maxOperationsPerAuthorWindow: number;
+}
+export interface RoomPolicyV4 {
+    version: 4;
+    /** Exact `encodeRoomPolicyV1(...)` bytes. */
+    sessionPolicyV1: Uint8Array;
+    roomCryptoSuite: 1;
+    operationCodec: 1;
+    pairBootstrapSuite: typeof PAIR_BOOTSTRAP_SUITE_ID_V1;
+    protocolLimits: RoomProtocolLimitsV1;
+    admissionFloor: AdmissionFloorV4;
+    maxRoomMembers: number;
+}
+export declare class RoomPolicyV4Error extends Error {
+    readonly name = "RoomPolicyV4Error";
+    constructor(message: string);
+}
+/**
+ * Semantic validation beyond the canonical encoding's width checks.
+ *
+ * The schema already rejects out-of-range widths, unknown enum values, and
+ * noncanonical encodings. This adds the Section 4.1 cross-field inequalities
+ * and the nested-session-policy requirement, which no width check can express.
+ */
+export declare const validateRoomPolicyV4: (policy: RoomPolicyV4) => void;
+/** The unique canonical encoding of a validated policy. */
+export declare const encodeRoomPolicyV4: (policy: RoomPolicyV4) => Uint8Array;
+/** Decode, prove the bytes are the unique encoding, then validate semantics. */
+export declare const decodeRoomPolicyV4: (encoded: Uint8Array) => RoomPolicyV4;
+export declare const roomPoliciesEqualV4: (left: RoomPolicyV4, right: RoomPolicyV4) => boolean;
+/**
+ * The nested session policy of the byte-frozen blind default: the existing
+ * canonical v1 default (revision 0, no PIN, ML-KEM-768, immediate cover) with
+ * only `rendezvousMode` changed to `blind-meeting-point`.
+ *
+ * Section 4.1 publishes these exact 32 bytes; `tests/blindRendezvous`
+ * re-derives them from `encodeRoomPolicyV1` rather than trusting the literal.
+ */
+export declare const DEFAULT_BLIND_SESSION_POLICY_V1: Readonly<RoomPolicyV1>;
+/**
+ * The room policy a capability-only `v2.` invitation resolves to.
+ *
+ * Fixing this here rather than reading a mutable application default is the
+ * point: a later default change must not reinterpret an already shared bare v2
+ * invitation.
+ *
+ * Status: the field values are transcribed from Section 4.1, but the object's
+ * canonical bytes and therefore its `PolicyHash` depend on the unfrozen
+ * `canonicalSchema`. Neither is a published v0.4 release artifact yet.
+ */
+export declare const DEFAULT_BLIND_POLICY_V4_0: Readonly<RoomPolicyV4>;
+/**
+ * A fresh, independently owned copy of the blind default policy.
+ *
+ * `Object.freeze` does not protect the elements of a `Uint8Array`, and
+ * `Object.freeze` on a non-empty typed array throws, so the only way to keep
+ * `DEFAULT_BLIND_POLICY_V4_0` byte-frozen in practice is to never hand out a
+ * reference to its `sessionPolicyV1` storage. Callers that resolve a bare v2
+ * invitation get this copy.
+ */
+export declare const copyBlindDefaultPolicy: () => RoomPolicyV4;

package/lib/blindRendezvous/schemas.d.ts

@@ -0,0 +1,221 @@
+/**
+ * Canonical descriptors for the blind-rendezvous wire objects.
+ *
+ * These descriptors are the schema SSOT named in Section 1.4: they own field
+ * order, integer widths, enum bytes, collection ordering, and bounds. Every
+ * other module derives its encoder, decoder, key table, and bound check from
+ * here rather than restating them.
+ *
+ * Field order below follows the specification's declaration order in Sections
+ * 4.0 through 4.5. A TypeScript interface may list the same fields in a
+ * different order for readability; interface order is not wire order.
+ *
+ * Status: PROPOSED, NOT FROZEN. Integer widths are this artifact's proposal
+ * for the Phase-0 freeze, not published v0.4 release bytes.
+ */
+import type { TypeDescriptor } from "./canonicalSchema";
+/** Section 4.4 operation payload classes: exact signed inner byte counts. */
+export declare const OPERATION_PAYLOAD_CLASS_BYTES: Readonly<Record<0 | 1, number>>;
+export declare const MAX_OPERATION_PAYLOAD_BYTES: number;
+/** Absolute profile bound for one carried signed room operation. */
+export declare const MAX_CARRIED_ROOM_OPERATION_BYTES_V1: number;
+/** Section 4.11 suite-1 bootstrap KEM ciphertext width. */
+export declare const PAIR_BOOTSTRAP_KEM_CIPHERTEXT_BYTES_V1: 1120;
+/** Sections 4.9/4.11 suite-1 ML-KEM-768 + X25519 public-key width. */
+export declare const RENDEZVOUS_HYBRID_KEM_PUBLIC_KEY_BYTES_V1: 1216;
+/** Section 4.11: every currently defined pair step has zero or one dependency. */
+export declare const MAX_PAIR_DEPENDENCIES_V1 = 1;
+/**
+ * The largest unique pair-padding suffix.
+ *
+ * An established class-1 plaintext is minimal only when its empty-padding
+ * encoding is at least 4,018 bytes. Its target is 69,553 bytes, so the largest
+ * possible canonical suffix is 69,553 - 4,018 = 65,535 bytes.
+ */
+export declare const MAX_PAIR_PADDING_BYTES_V1 = 65535;
+/** Section 4.12 permits one through three transport candidates. */
+export declare const MAX_PAIR_TRANSPORT_CANDIDATES_V1 = 3;
+export declare const MAX_PAIR_WEBRTC_SDP_BYTES_V1 = 32768;
+export declare const MAX_PAIR_LOCAL_CANDIDATE_BYTES_V1 = 2048;
+/** Section 4.2 bounds one encrypted store hint to 255 exact routes. */
+export declare const MAX_STORE_HINT_ROUTES_V1 = 255;
+/** Section 4.8 bounds each frontend-owned canonical identity set. */
+export declare const MAX_FRONTEND_ROOM_CONTROL_SET_ENTRIES_V1 = 65535;
+/**
+ * Leaves one 16-bit collection slot for the canonical quota+1 physical proof.
+ */
+export declare const MAX_OPERATIONS_PER_AUTHOR_WINDOW_V1 = 65534;
+/** Section 4.0 closes the kernel at 8 modules and 9 entrypoints. */
+export declare const KERNEL_MODULE_IDS: readonly [1, 2, 3, 4, 5, 6, 7, 8];
+export declare const KERNEL_ENTRYPOINT_IDS: readonly [1, 2, 3, 4, 5, 6, 7, 8, 9];
+/**
+ * Section 4.0: modules 1..5 own entrypoints 1..5; module 6 owns the delivery
+ * scheduler (6) and `R2Conforms` (7); module 7 owns the eventual pair-control
+ * transition (8); module 8 owns claim evaluation (9).
+ */
+export declare const KERNEL_ENTRYPOINT_IDS_BY_MODULE: Readonly<Record<(typeof KERNEL_MODULE_IDS)[number], readonly number[]>>;
+/** Section 4.0: a v0.4 release must carry FPO-001 through FPO-006. */
+export declare const V04_REQUIRED_FORMAL_OBLIGATION_IDS: readonly [1, 2, 3, 4, 5, 6];
+export declare const roomProtocolLimitsV1Schema: TypeDescriptor;
+export declare const admissionFloorV4Schema: TypeDescriptor;
+export declare const roomPolicyV4Schema: TypeDescriptor;
+export declare const appendScheduleRoleV1Schema: TypeDescriptor;
+export declare const appendScheduleEntryV1Schema: TypeDescriptor;
+export declare const deliverySizeClassV1Schema: TypeDescriptor;
+export declare const deliveryProfileV1Schema: TypeDescriptor;
+export declare const operationKindV1Schema: TypeDescriptor;
+export declare const operationLifetimeV1Schema: TypeDescriptor;
+export declare const authenticatedRoomOperationUnsignedV1Schema: TypeDescriptor;
+export declare const authenticatedRoomOperationV1Schema: TypeDescriptor;
+export declare const pairBootstrapHeaderV1Schema: TypeDescriptor;
+export declare const pairStepEnvelopeV1Schema: TypeDescriptor;
+export declare const carrierEnvelopeV1Schema: TypeDescriptor;
+export declare const carrierPlaintextV1Schema: TypeDescriptor;
+/** The sorted duplicate-free operation-ID projection hashed by
+ * `operationsDigest` and by the R2 required-operation digest. */
+export declare const operationIdSetSchema: TypeDescriptor;
+export declare const kernelEntrypointV1Schema: TypeDescriptor;
+export declare const executableRendezvousKernelModuleV1Schema: TypeDescriptor;
+export declare const executableRendezvousKernelManifestV1Schema: TypeDescriptor;
+export declare const blindRendezvousImplementationBuildManifestV1Schema: TypeDescriptor;
+export declare const claimEvaluationStateV1Schema: TypeDescriptor;
+export declare const claimScopeKindV1Schema: TypeDescriptor;
+export declare const claimAssumptionKindV1Schema: TypeDescriptor;
+export declare const claimAssumptionVerificationV1Schema: TypeDescriptor;
+export declare const claimAssumptionV1Schema: TypeDescriptor;
+export declare const claimEvidenceKindV1Schema: TypeDescriptor;
+export declare const claimWordingByStateV1Schema: TypeDescriptor;
+export declare const claimDefinitionV1Schema: TypeDescriptor;
+export declare const claimRegistryV1Schema: TypeDescriptor;
+export declare const claimWordingEntryV1Schema: TypeDescriptor;
+export declare const claimReasonEntryV1Schema: TypeDescriptor;
+export declare const claimWordingCatalogV1Schema: TypeDescriptor;
+export declare const claimEvidenceBindingV1Schema: TypeDescriptor;
+export declare const claimPrerequisiteBindingV1Schema: TypeDescriptor;
+export declare const claimFormalResultBindingV1Schema: TypeDescriptor;
+export declare const claimAssumptionBindingV1Schema: TypeDescriptor;
+export declare const claimEvaluationDatasetV1Schema: TypeDescriptor;
+export declare const claimEvaluationInputV1Schema: TypeDescriptor;
+export declare const claimEvaluationV1Schema: TypeDescriptor;
+export declare const formalObligationKindV1Schema: TypeDescriptor;
+export declare const formalObligationV1Schema: TypeDescriptor;
+export declare const formalObligationRegistryV1Schema: TypeDescriptor;
+export declare const formalProofScopeArtifactV1Schema: TypeDescriptor;
+export declare const formalProofResultKindV1Schema: TypeDescriptor;
+export declare const formalProofResultV1Schema: TypeDescriptor;
+/** The resolved assumption sequence hashed by `FormalAssumptionSetHash`. */
+export declare const resolvedAssumptionSetSchema: TypeDescriptor;
+/** The normalized source-tree projection hashed by `KernelSourceTreeHash`. */
+export declare const kernelSourceTreeEntrySchema: TypeDescriptor;
+export declare const kernelSourceTreeSchema: TypeDescriptor;
+/** The per-entrypoint projection hashed by `KernelModuleSemanticsHash`. */
+export declare const kernelModuleSemanticsEntrySchema: TypeDescriptor;
+export declare const kernelModuleSemanticsSchema: TypeDescriptor;
+/** No room-derived value appears here: every room in a profile shares it. */
+export declare const publicBucketV1Schema: TypeDescriptor;
+export declare const publicChunkBodyV1Schema: TypeDescriptor;
+export declare const publicChunkV1Schema: TypeDescriptor;
+export declare const publicStoreCheckpointBodyV1Schema: TypeDescriptor;
+export declare const publicStoreCheckpointV1Schema: TypeDescriptor;
+export declare const publicCheckpointChunkLeafV1Schema: TypeDescriptor;
+export declare const publicCheckpointChunkInclusionProofV1Schema: TypeDescriptor;
+export declare const storeCheckpointChainStartV1Schema: TypeDescriptor;
+export declare const storeDescriptorUnsignedV1Schema: TypeDescriptor;
+export declare const storeDescriptorV1Schema: TypeDescriptor;
+export declare const storeRouteUnsignedV1Schema: TypeDescriptor;
+export declare const storeRouteV1Schema: TypeDescriptor;
+export declare const canonicalBytes32SetV1Schema: TypeDescriptor;
+export declare const initializedRoomAdmissionFenceV1Schema: TypeDescriptor;
+export declare const localPresenceOwnershipV1Schema: TypeDescriptor;
+export declare const authorityCustodyStatusV1Schema: TypeDescriptor;
+export declare const authorityCustodyProjectionV1Schema: TypeDescriptor;
+export declare const frontendRoomControlsV1Schema: TypeDescriptor;
+export declare const bootstrapAdmissionDecisionLeaseV1Schema: TypeDescriptor;
+export declare const admissionGrantUnsignedV1Schema: TypeDescriptor;
+export declare const admissionGrantV1Schema: TypeDescriptor;
+export declare const pairStepKindV1Schema: TypeDescriptor;
+export declare const pairAttemptModeV1Schema: TypeDescriptor;
+export declare const pairAttemptLeaseV1Schema: TypeDescriptor;
+export declare const pairBootstrapRecipientKindV1Schema: TypeDescriptor;
+export declare const pairTransportCandidateKindV1Schema: TypeDescriptor;
+export declare const stableIdentityBundleV1Schema: TypeDescriptor;
+export declare const pairIdentityHelloUnsignedV1Schema: TypeDescriptor;
+export declare const pairIdentityHelloV1Schema: TypeDescriptor;
+export declare const pairIdentityAcceptUnsignedV1Schema: TypeDescriptor;
+export declare const pairIdentityAcceptV1Schema: TypeDescriptor;
+export declare const stableEdgeAttemptClaimUnsignedV1Schema: TypeDescriptor;
+export declare const stableEdgeAttemptClaimV1Schema: TypeDescriptor;
+export declare const pairTransportCandidateV1Schema: TypeDescriptor;
+export declare const pairTransportOfferV1Schema: TypeDescriptor;
+export declare const pairTransportAnswerV1Schema: TypeDescriptor;
+export declare const quiesceProposeV1Schema: TypeDescriptor;
+export declare const quiesceAckV1Schema: TypeDescriptor;
+export declare const healCompleteV1Schema: TypeDescriptor;
+export declare const pairCheckpointV1Schema: TypeDescriptor;
+export declare const pairStepBodyV1Schema: TypeDescriptor;
+export declare const pairPlaintextV1Schema: TypeDescriptor;
+export declare const pairIdentityUnsignedProjectionV1Schema: TypeDescriptor;
+export declare const pairOuterPrebindingV1Schema: TypeDescriptor;
+export declare const pairOuterBindingV1Schema: TypeDescriptor;
+export declare const pairFlightSlotV1Schema: TypeDescriptor;
+export declare const pairBootstrapRecipientBindingV1Schema: TypeDescriptor;
+export declare const pairBootstrapInfoV1Schema: TypeDescriptor;
+export declare const pairAcceptedSlotCoordinateV1Schema: TypeDescriptor;
+export declare const pairAuthorChainPrefixEvidenceV1Schema: TypeDescriptor;
+export declare const identityHelloHistoricalPresenceEvidenceV1Schema: TypeDescriptor;
+/**
+ * Exact pair-subject evidence retained for one authenticated IDENTITY_HELLO.
+ *
+ * Endpoint order is protocol-visible: remote HELLO author first, local
+ * responder second. The semantic codec requires exactly two entries.
+ */
+export declare const identityHelloHistoricalEvidenceBundleV1Schema: TypeDescriptor;
+/**
+ * Canonical post-authentication input. Its descriptor is shared by the live
+ * transition and durable entry so neither path can drift in field order or
+ * bounds.
+ */
+export declare const pairSlotAcceptanceCandidateV1Schema: TypeDescriptor;
+export declare const pairAcceptedSlotEntryV1Schema: TypeDescriptor;
+export declare const pairAcceptedSlotLedgerSnapshotV1Schema: TypeDescriptor;
+export declare const pairOpenBudgetCoordinateV1Schema: TypeDescriptor;
+export declare const pairOpenBudgetChargeV1Schema: TypeDescriptor;
+export declare const pairOpenBudgetSnapshotV1Schema: TypeDescriptor;
+export declare const admissionRevokeUnsignedV1Schema: TypeDescriptor;
+export declare const admissionRevokeV1Schema: TypeDescriptor;
+export declare const presenceCoreV1Schema: TypeDescriptor;
+export declare const presencePermitUnsignedV1Schema: TypeDescriptor;
+export declare const presencePermitV1Schema: TypeDescriptor;
+export declare const presenceV1Schema: TypeDescriptor;
+/**
+ * Canonical input to `PresenceProofTranscriptHash`.
+ *
+ * The declaration order is protocol-visible. Keeping it in the schema SSOT
+ * prevents an implementation from silently reordering the outer bindings.
+ */
+export declare const presenceProofTranscriptV1Schema: TypeDescriptor;
+export declare const leaveV1Schema: TypeDescriptor;
+export declare const storeHintOperationV1Schema: TypeDescriptor;
+export declare const corePresenceFactV1Schema: TypeDescriptor;
+export declare const coreStoreFactV1Schema: TypeDescriptor;
+export declare const coreRevocationFloorV1Schema: TypeDescriptor;
+export declare const authorityWindowFaultV1Schema: TypeDescriptor;
+export declare const authorityAdmissionStatusV1Schema: TypeDescriptor;
+/**
+ * Exact canonical tuple hashed by AuthorityAdmissionStateDigest. It excludes
+ * the reference window, whole-Core digest, custody digest source material,
+ * and unrelated authority facts by construction.
+ */
+export declare const authorityAdmissionStateDigestInputV1Schema: TypeDescriptor;
+/**
+ * Variant order is the canonical fault order and therefore protocol-visible.
+ * Reducer sorting derives its order from this descriptor.
+ */
+export declare const coreFaultV1Schema: TypeDescriptor;
+export declare const roomCapacityStateV1Schema: TypeDescriptor;
+export declare const coreRoomStateV1Schema: TypeDescriptor;
+export declare const connectionPlannerModeV1Schema: TypeDescriptor;
+export declare const connectionPlannerPolicyV1Schema: TypeDescriptor;
+export declare const provisionalTopologyEdgeV1Schema: TypeDescriptor;
+export declare const activeStableTopologyEdgeV1Schema: TypeDescriptor;
+export declare const plannerAndExplicitStateV1Schema: TypeDescriptor;

package/lib/blindRendezvous/storeDescriptor.d.ts

@@ -0,0 +1,160 @@
+/**
+ * Store identity and routes (Section 4.2).
+ *
+ * A `StoreId` is stable across compatible descriptor and route rotation, so
+ * adding a route or refreshing a lease does not create a different store. What
+ * changes with each descriptor is `DescriptorHash` and a monotonic generation.
+ *
+ * Neither a descriptor nor a route is part of room identity. That separation is
+ * the point: a client can add, deny, or replace a store without rekeying a room
+ * or reissuing an invitation, and a store learns nothing about the room from
+ * either object.
+ *
+ * The descriptor signature proves possession of the store's identity key, and
+ * every route signature is made with that same key — so a route binds the exact
+ * `StoreId`, `DescriptorHash`, locator, parameters, family, and lease, and a
+ * route cannot be transplanted onto another store or another descriptor.
+ */
+import type { LibCrypto } from "../cryptography/libcrypto";
+export interface StoreCheckpointChainStartV1 {
+    deliveryProfileHash: Uint8Array;
+    chainStartIngressWindow: bigint;
+}
+export interface StoreDescriptorV1 {
+    version: 1;
+    storeIdentityEd25519Key: Uint8Array;
+    allocationIssuerPublicKeyDer: Uint8Array;
+    descriptorGeneration: bigint;
+    compatibilityHash: Uint8Array;
+    supportedDeliveryProfileHashes: readonly Uint8Array[];
+    checkpointChainStarts: readonly StoreCheckpointChainStartV1[];
+    notBeforeUnixMs: bigint;
+    notAfterUnixMs: bigint;
+    descriptorSignature: Uint8Array;
+}
+export interface StoreRouteV1 {
+    version: 1;
+    storeId: Uint8Array;
+    descriptorHash: Uint8Array;
+    routeFamily: number;
+    opaqueLocator: Uint8Array;
+    routePublicParameters: Uint8Array;
+    notBeforeUnixMs: bigint;
+    notAfterUnixMs: bigint;
+    routeSignature: Uint8Array;
+}
+export declare class StoreDescriptorError extends Error {
+    readonly name = "StoreDescriptorError";
+    constructor(message: string);
+}
+/**
+ * `StoreId = H("p2party/store-id/v1" || storeIdentityEd25519Key)`
+ *
+ * Derived from the key alone, which is what makes it survive descriptor and
+ * route rotation.
+ */
+export declare const storeId: (storeIdentityEd25519Key: Uint8Array) => Promise<Uint8Array>;
+/**
+ * `DescriptorHash = H("p2party/store-descriptor/v1" ||
+ *    Canonical(StoreDescriptorV1 without descriptorSignature))`
+ */
+export declare const descriptorHash: (descriptor: StoreDescriptorV1) => Promise<Uint8Array>;
+/**
+ * `RouteId = H("p2party/store-route/v1" ||
+ *    Canonical(StoreRouteV1 without routeSignature))`
+ */
+export declare const routeId: (route: StoreRouteV1) => Promise<Uint8Array>;
+/** `"p2party/store-descriptor-signature/v1" || DescriptorHash` */
+export declare const storeDescriptorSignedMessage: (descriptor: StoreDescriptorV1) => Promise<Uint8Array>;
+/** `"p2party/store-route-signature/v1" || RouteId` */
+export declare const storeRouteSignedMessage: (route: StoreRouteV1) => Promise<Uint8Array>;
+/**
+ * `PublicCarrierContextId = H("p2party/public-carrier-context/v1" ||
+ *    StoreId || DeliveryProfileHash)`
+ *
+ * This scopes cryptography and store idempotency: one wrapping, allocation and
+ * scheduled-work domain per store and profile, no matter how many routes reach
+ * it.
+ */
+export declare const publicCarrierContextId: (storeIdBytes: Uint8Array, deliveryProfileHash: Uint8Array) => Promise<Uint8Array>;
+/**
+ * `PublicRouteInstanceId = H("p2party/public-route-instance/v1" ||
+ *    PublicCarrierContextId || RouteId)`
+ *
+ * This scopes path health and assurance evidence. Two routes to one store are
+ * two instances of one context — never two stores, and never two chances to
+ * publish the same object.
+ */
+export declare const publicRouteInstanceId: (carrierContextId: Uint8Array, routeIdBytes: Uint8Array) => Promise<Uint8Array>;
+export type StoreValidity = {
+    readonly valid: true;
+} | {
+    readonly valid: false;
+    readonly reason: string;
+};
+/**
+ * `StoreDescriptorAuthentic(descriptor)`.
+ *
+ * This predicate is deliberately timeless. It proves that the descriptor has
+ * one canonical encoding, a non-empty signed lease, a complete profile/chain
+ * projection, and a valid store-identity signature. Historical verification
+ * and core reduction must not make this answer depend on the wall clock.
+ */
+export declare const storeDescriptorAuthentic: (descriptor: StoreDescriptorV1, module?: LibCrypto) => Promise<StoreValidity>;
+/**
+ * `StoreDescriptorActiveAt(descriptor, atUnixMs)`.
+ *
+ * Network adapters use an explicit transaction instant. The cheap half-open
+ * lease check precedes signature verification.
+ */
+export declare const storeDescriptorActiveAt: (descriptor: StoreDescriptorV1, atUnixMs: bigint, module?: LibCrypto) => Promise<StoreValidity>;
+/**
+ * `StoreRouteAuthentic(route, descriptor)`.
+ *
+ * Descriptor authenticity is part of this predicate. The route signature is
+ * made with that descriptor's store identity key, so a route lifted from
+ * another store or descriptor generation cannot become an authorized path.
+ */
+export declare const storeRouteAuthentic: (route: StoreRouteV1, descriptor: StoreDescriptorV1, module?: LibCrypto) => Promise<StoreValidity>;
+/**
+ * `StoreRouteActiveAt(route, descriptor, atUnixMs)`.
+ *
+ * This checks the route's own half-open lease before timeless route and
+ * descriptor authenticity. Callers that also require the descriptor itself to
+ * be active at the same instant must check `storeDescriptorActiveAt` as the
+ * specification requires for that operation.
+ */
+export declare const storeRouteActiveAt: (route: StoreRouteV1, descriptor: StoreDescriptorV1, atUnixMs: bigint, module?: LibCrypto) => Promise<StoreValidity>;
+/**
+ * Compatibility wrapper for callers that validate descriptor activation.
+ *
+ * New timeless protocol checks should call `storeDescriptorAuthentic`
+ * directly.
+ */
+export declare const validateStoreDescriptor: (descriptor: StoreDescriptorV1, atUnixMs: bigint, module?: LibCrypto) => Promise<StoreValidity>;
+/**
+ * Compatibility wrapper for callers that validate route activation.
+ *
+ * New timeless protocol checks should call `storeRouteAuthentic` directly.
+ */
+export declare const validateStoreRoute: (route: StoreRouteV1, descriptor: StoreDescriptorV1, atUnixMs: bigint, module?: LibCrypto) => Promise<StoreValidity>;
+/** Whether a descriptor serves a given delivery profile. */
+export declare const descriptorSupportsProfile: (descriptor: StoreDescriptorV1, deliveryProfileHash: Uint8Array) => boolean;
+/** The immutable chain start this store declares for a profile, if any. */
+export declare const descriptorChainStart: (descriptor: StoreDescriptorV1, deliveryProfileHash: Uint8Array) => bigint | null;
+/**
+ * Two valid descriptors deriving one `StoreId` that name different chain
+ * starts for one profile.
+ *
+ * This is signed equivocation about where the accountability chain begins, and
+ * the specification makes it permanent for that store and profile: a higher
+ * descriptor generation cannot clear it, because a clean reset requires a new
+ * store identity. Canonical order is by descriptor hash, so one fault yields
+ * one proof.
+ */
+export declare const chainStartConflict: (first: StoreDescriptorV1, second: StoreDescriptorV1, deliveryProfileHash: Uint8Array, module?: LibCrypto) => Promise<{
+    readonly conflicting: false;
+} | {
+    readonly conflicting: true;
+    readonly canonicalOrder: readonly [StoreDescriptorV1, StoreDescriptorV1];
+}>;

package/lib/cryptography/aeadWasm.d.ts

@@ -0,0 +1,18 @@
+import type { LibCrypto } from "./libcrypto";
+export declare const WASM_AEAD_MAX_BYTES = 2147483647;
+type AeadPrimitive = (module: LibCrypto, output: number, input: number, inputLength: number, key: number, nonce: number, associatedData: number, associatedDataLength: number) => number;
+export interface WasmAeadSuite {
+    readonly name: string;
+    readonly keyBytes: number;
+    readonly nonceBytes: number;
+    readonly tagBytes: number;
+    readonly encrypt: AeadPrimitive;
+    readonly decrypt: AeadPrimitive;
+}
+export declare class WasmAeadError extends Error {
+    readonly name = "WasmAeadError";
+}
+export declare const maxAeadPlaintextBytes: (suite: WasmAeadSuite) => number;
+export declare const sealWasmAead: (suite: WasmAeadSuite, module: LibCrypto, key: Uint8Array, nonce: Uint8Array, plaintext: Uint8Array, associatedData: Uint8Array) => Uint8Array;
+export declare const openWasmAead: (suite: WasmAeadSuite, module: LibCrypto, key: Uint8Array, nonce: Uint8Array, ciphertextAndTag: Uint8Array, associatedData: Uint8Array) => Uint8Array | null;
+export {};

package/lib/cryptography/byteInput.d.ts

@@ -0,0 +1,12 @@
+export interface ByteInputConstraints {
+    readonly exactLength?: number;
+    readonly maximumLength?: number;
+}
+/**
+ * Take an ordinary, owned snapshot of borrowed bytes before a WASM boundary.
+ *
+ * Typed-array intrinsics are used deliberately: a Proxy can pass `instanceof`
+ * while lying about its length, and a real view can shadow `length`, iteration,
+ * or species properties. None of those surfaces influence this copy.
+ */
+export declare const snapshotByteInput: (value: unknown, label: string, constraints?: ByteInputConstraints) => Uint8Array;

package/lib/cryptography/carrierAead.d.ts

@@ -0,0 +1,23 @@
+import type { LibCrypto } from "./libcrypto";
+/**
+ * XChaCha20-Poly1305 as required by the blind-rendezvous delivery profile's
+ * `carrierAeadSuite = 1` (`draft-irtf-cfrg-xchacha-03`).
+ *
+ * The construction comes from the pinned libsodium build. The reusable
+ * XChaCha adapter owns the hardened WASM boundary; this compatibility wrapper
+ * preserves the established carrier call shape and errors. Application code
+ * implements no cryptography, which is what SEC-002 and SEC-019 require.
+ */
+export declare class CarrierAeadError extends Error {
+    readonly name = "CarrierAeadError";
+    constructor(message: string);
+}
+export declare const xchacha20poly1305Seal: (key: Uint8Array, nonce: Uint8Array, associatedData: Uint8Array, plaintext: Uint8Array, module: LibCrypto) => Uint8Array;
+/**
+ * Returns null on authentication failure.
+ *
+ * libsodium verifies the tag in constant time and writes no plaintext when it
+ * fails, so a caller can treat null as "not for this room" — which is exactly
+ * how a dummy object reads — without having to scrub a partial buffer.
+ */
+export declare const xchacha20poly1305Open: (key: Uint8Array, nonce: Uint8Array, associatedData: Uint8Array, ciphertextAndTag: Uint8Array, module: LibCrypto) => Uint8Array | null;

package/lib/cryptography/chacha20poly1305.d.ts

@@ -0,0 +1,7 @@
+import type { LibCrypto } from "./libcrypto";
+export declare const CHACHA20POLY1305_MAX_WASM_BYTES = 2147483647;
+export declare const CHACHA20POLY1305_MAX_PLAINTEXT_BYTES: number;
+/** Seal to RFC 8439 `ciphertext || 16-byte Poly1305 tag`. */
+export declare const chacha20Poly1305Seal: (module: LibCrypto, key: Uint8Array, nonce: Uint8Array, plaintext: Uint8Array, associatedData: Uint8Array) => Uint8Array;
+/** Open RFC 8439 `ciphertext || tag`, returning null on authentication failure. */
+export declare const chacha20Poly1305Open: (module: LibCrypto, key: Uint8Array, nonce: Uint8Array, ciphertextAndTag: Uint8Array, associatedData: Uint8Array) => Uint8Array | null;

package/lib/cryptography/fips202.d.ts

@@ -0,0 +1,10 @@
+import type { LibCrypto } from "./libcrypto";
+export declare const SHA3_256_BYTES = 32;
+/**
+ * The one-shot bound proved by the pinned mlkem-native FIPS 202 backend.
+ *
+ * WASM uses a 32-bit size_t, so this is `(SIZE_MAX >> 12)` from mlkem768.h.
+ */
+export declare const FIPS202_MAX_BUFFER_BYTES = 1048575;
+export declare const shake256: (input: Uint8Array, outputLength: number, module: LibCrypto) => Uint8Array;
+export declare const sha3_256: (input: Uint8Array, module: LibCrypto) => Uint8Array;

package/lib/cryptography/hpke.d.ts

@@ -0,0 +1,84 @@
+import type { MlKem768X25519KeyPair } from "./hybridKem";
+import type { LibCrypto } from "./libcrypto";
+export { HPKE_CHACHA20POLY1305_AEAD_ID, HPKE_HASH_BYTES, HPKE_HKDF_SHA256_KDF_ID, HPKE_KEY_BYTES, HPKE_MAX_APPLICATION_CONTEXT_BYTES, HPKE_MAX_EXPORT_BYTES, HPKE_MLKEM768_X25519_KEM_ID, HPKE_MLKEM768_X25519_SUITE, HPKE_MODE_BASE, HPKE_MODE_PSK, HPKE_NONCE_BYTES, HPKE_PAIR_PSK_BYTES, HPKE_PAIR_PSK_ID_BYTES, HPKE_TAG_BYTES, } from "./hpkeSuite";
+export interface HpkeContext {
+    readonly sequence: bigint;
+    readonly destroyed: boolean;
+    /**
+     * RFC 9180 Export. It does not consume a nonce and has no replay protection.
+     */
+    exportSecret(exporterContext: Uint8Array, length: number): Promise<Uint8Array>;
+    /** Idempotently wipe the AEAD and exporter state. */
+    destroy(): void;
+}
+export interface HpkeSenderContext extends HpkeContext {
+    readonly role: "sender";
+    seal(associatedData: Uint8Array, plaintext: Uint8Array): Uint8Array;
+}
+export interface HpkeRecipientContext extends HpkeContext {
+    readonly role: "recipient";
+    /**
+     * Return null on authentication failure. A failed Open does not advance the
+     * sequence number.
+     */
+    open(associatedData: Uint8Array, ciphertextAndTag: Uint8Array): Uint8Array | null;
+}
+export interface HpkePskSenderSetup {
+    readonly encapsulatedKey: Uint8Array;
+    readonly context: HpkeSenderContext;
+}
+export interface HpkePskSenderOptions {
+    readonly module: LibCrypto;
+    readonly recipientPublicKey: Uint8Array;
+    readonly info: Uint8Array;
+    /** Pair suite 1 requires the exact 32-byte RoomRoot or HelloRoot. */
+    readonly psk: Uint8Array;
+    /** Pair suite 1 requires the exact 32-byte transcript-derived PSK ID. */
+    readonly pskId: Uint8Array;
+}
+export interface HpkePskRecipientOptions {
+    readonly module: LibCrypto;
+    readonly encapsulatedKey: Uint8Array;
+    readonly recipientSecretKey: Uint8Array;
+    readonly info: Uint8Array;
+    readonly psk: Uint8Array;
+    readonly pskId: Uint8Array;
+}
+/** RFC 9180 SetupPSKS for the fixed pair-bootstrap suite. */
+export declare const setupHpkePskSender: (options: HpkePskSenderOptions) => Promise<HpkePskSenderSetup>;
+/**
+ * Deterministic SetupPSKS hook for pinned vectors only.
+ *
+ * Reusing or predicting its 64-byte randomness destroys KEM security. Normal
+ * protocol code must call setupHpkePskSender(), which obtains fresh CSPRNG
+ * bytes internally.
+ *
+ * @internal
+ */
+export declare const setupHpkePskSenderDeterministically: (options: HpkePskSenderOptions & {
+    readonly encapsulationRandomness: Uint8Array;
+}) => Promise<HpkePskSenderSetup>;
+/** RFC 9180 SetupPSKR for the fixed pair-bootstrap suite. */
+export declare const setupHpkePskRecipient: (options: HpkePskRecipientOptions) => Promise<HpkeRecipientContext>;
+/**
+ * Generate a production recipient key pair using the hybrid KEM's CSPRNG path.
+ */
+export declare const generateHpkeRecipientKeyPair: (module: LibCrypto) => Promise<MlKem768X25519KeyPair>;
+/**
+ * HPKE KEM DeriveKeyPair mapping used by the official conformance vectors.
+ * The pair profile restricts IKM to one exact 32-byte seed.
+ */
+export declare const deriveHpkeRecipientKeyPair: (ikm: Uint8Array, module: LibCrypto) => Promise<MlKem768X25519KeyPair>;
+/**
+ * Base-mode deterministic setup exists solely to verify the official
+ * draft-ietf-hpke-pq vector for this exact KEM/KDF/AEAD tuple. Pair protocol
+ * code must never use base mode.
+ *
+ * @internal
+ */
+export declare const setupHpkeBaseSenderForConformance: (options: {
+    readonly module: LibCrypto;
+    readonly recipientPublicKey: Uint8Array;
+    readonly info: Uint8Array;
+    readonly encapsulationRandomness: Uint8Array;
+}) => Promise<HpkePskSenderSetup>;