raz-encrypt 2.1.0 → 2.3.0

package/dist/canonicalJson.d.ts

@@ -1,18 +1,3 @@
-/**
- * Canonical JSON per RFC 8785 (JCS): no whitespace, object keys sorted by
- * UTF-16 code unit, ECMAScript number and string serialization — so the same
- * logical document always hashes to the same value regardless of key order
- * on the wire.
- *
- * Unlike a bare `JSON.stringify`, this rejects (with a `TypeError` naming the
- * offending path) every value that JSON cannot represent faithfully, rather
- * than silently collapsing it into something else. Two different in-memory
- * documents must never canonicalize to the same bytes (ADR 0012):
- * `undefined`, `NaN`, `±Infinity`, `BigInt`, functions, symbols, sparse
- * arrays, circular references, lone surrogates, and anything that is not a
- * plain object / array / string / finite number / boolean / null (`Map`,
- * `Set`, `Date`, typed arrays, class instances, ...).
- */
 export declare function canonicalize(value: unknown): string;
 /** The document hash every signature is made over. */
 export declare function hashDocument(value: unknown): string;

package/dist/canonicalJson.js

@@ -1,82 +1,22 @@
 import { sha512 } from "@noble/hashes/sha2.js";
 import { bytesToHex, utf8ToBytes } from "@noble/hashes/utils.js";
 /**
- * Canonical JSON per RFC 8785 (JCS): no whitespace, object keys sorted by
- * UTF-16 code unit, ECMAScript number and string serialization — so the same
- * logical document always hashes to the same value regardless of key order
- * on the wire.
- *
- * Unlike a bare `JSON.stringify`, this rejects (with a `TypeError` naming the
- * offending path) every value that JSON cannot represent faithfully, rather
- * than silently collapsing it into something else. Two different in-memory
- * documents must never canonicalize to the same bytes (ADR 0012):
- * `undefined`, `NaN`, `±Infinity`, `BigInt`, functions, symbols, sparse
- * arrays, circular references, lone surrogates, and anything that is not a
- * plain object / array / string / finite number / boolean / null (`Map`,
- * `Set`, `Date`, typed arrays, class instances, ...).
+ * Deterministic JSON serialization (object keys sorted recursively) so the
+ * same logical document always hashes to the same value regardless of key
+ * order on the wire.
  */
-export function canonicalize(value) {
-    return serialize(value, "$", new Set());
-}
-function fail(path, what) {
-    throw new TypeError(`canonicalize: ${what} at ${path} cannot be represented as canonical JSON`);
-}
-function serialize(value, path, ancestors) {
-    switch (typeof value) {
-        case "string":
-            return serializeString(value, path);
-        case "number":
-            if (!Number.isFinite(value))
-                fail(path, `non-finite number (${String(value)})`);
-            // ECMAScript Number::toString is exactly what RFC 8785 §3.2.2.3 mandates
-            // (including "-0" -> "0").
-            return JSON.stringify(value);
-        case "boolean":
-            return value ? "true" : "false";
-        case "object":
-            break;
-        default:
-            return fail(path, typeof value === "undefined" ? "undefined" : `${typeof value}`);
-    }
-    if (value === null)
-        return "null";
-    const obj = value;
-    if (ancestors.has(obj))
-        fail(path, "circular reference");
-    ancestors.add(obj);
-    try {
-        if (Array.isArray(obj)) {
-            const parts = [];
-            for (let i = 0; i < obj.length; i++) {
-                if (!(i in obj))
-                    fail(`${path}[${i}]`, "hole in sparse array");
-                parts.push(serialize(obj[i], `${path}[${i}]`, ancestors));
-            }
-            return `[${parts.join(",")}]`;
-        }
-        const proto = Object.getPrototypeOf(obj);
-        if (proto !== Object.prototype && proto !== null) {
-            fail(path, `non-plain object (${proto.constructor?.name ?? "unknown"})`);
-        }
-        const record = obj;
-        // Default sort() compares UTF-16 code units, which is the RFC 8785 order.
-        const keys = Object.keys(record).sort();
-        const parts = keys.map((key) => `${serializeString(key, `${path}.${key}`)}:${serialize(record[key], `${path}.${key}`, ancestors)}`);
-        return `{${parts.join(",")}}`;
-    }
-    finally {
-        ancestors.delete(obj);
+function sortKeysDeep(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeysDeep);
+    if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.keys(value)
+            .sort()
+            .map((key) => [key, sortKeysDeep(value[key])]));
     }
+    return value;
 }
-// High surrogate not followed by a low one, or a low surrogate not preceded by a high one.
-const LONE_SURROGATE = /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/;
-function serializeString(value, path) {
-    // RFC 8785 requires I-JSON: strings must be well-formed UTF-16. A lone
-    // surrogate has no UTF-8 encoding, so two distinct strings would otherwise
-    // both turn into U+FFFD when hashed.
-    if (LONE_SURROGATE.test(value))
-        fail(path, "string with a lone surrogate");
-    return JSON.stringify(value);
+export function canonicalize(value) {
+    return JSON.stringify(sortKeysDeep(value));
 }
 /** The document hash every signature is made over. */
 export function hashDocument(value) {

package/dist/canonicalJson.js.map

@@ -1 +1 @@
-{"version":3,"file":"canonicalJson.js","sourceRoot":"","sources":["../src/canonicalJson.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAEjE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,IAAY;IACtC,MAAM,IAAI,SAAS,CAAC,iBAAiB,IAAI,OAAO,IAAI,0CAA0C,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,IAAY,EAAE,SAAsB;IACrE,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtC,KAAK,QAAQ;YACX,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,IAAI,EAAE,sBAAsB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChF,yEAAyE;YACzE,2BAA2B;YAC3B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAClC,KAAK,QAAQ;YACX,MAAM;QACR;YACE,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,MAAM,GAAG,GAAG,KAAe,CAAC;IAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IACzD,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;oBAAE,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;gBAC/D,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAChC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAY,CAAC;QACpD,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,EAAE,qBAAsB,KAA6C,CAAC,WAAW,EAAE,IAAI,IAAI,SAAS,GAAG,CAAC,CAAC;QACpH,CAAC;QACD,MAAM,MAAM,GAAG,GAA8B,CAAC;QAC9C,0EAA0E;QAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QACpI,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,cAAc,GAAG,wEAAwE,CAAC;AAEhG,SAAS,eAAe,CAAC,KAAa,EAAE,IAAY;IAClD,uEAAuE;IACvE,2EAA2E;IAC3E,qCAAqC;IACrC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"canonicalJson.js","sourceRoot":"","sources":["../src/canonicalJson.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAEjE;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC;aAC1C,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/core.d.ts

@@ -10,8 +10,8 @@
  * included, fs-backed versions of the same logic — this module is the
  * un-wired core they're built from, not a separate implementation.
  */
-export { createResponderHandshakeCore as createResponderHandshake, decryptFromCore as decryptFrom, DecryptionError, encryptForCore as encryptFor, establishSessionInitiatorCore as establishSessionInitiator, establishSessionResponderCore as establishSessionResponder, HandshakeVerificationError, makeKeyConfirmation, verifyKeyConfirmation, MalformedHandshakeMessageError, ReplayedBoxError, signCore as sign, UntrustedPartyError, verifyCore as verify, } from "./crypto/hybrid.js";
-export type { BoxReplayInfo, Certificate, DecryptDeps, EncryptedBox, HandshakeRole, HandshakeSignature, HandshakeTranscript, InitiatorHandshakeMessage, InitiatorSessionResult, LogDeps, ResponderHandshakeInit, ResponderHandshakeMessage, ResponderHandshakeSecrets, ResponderSessionResult, SessionKeys, SignOptions, TrustDeps, TrustStatus, VerifyDeps, VerifyFailureReason, VerifyResult, } from "./crypto/hybrid.js";
+export { createResponderHandshakeCore as createResponderHandshake, decryptFromCore as decryptFrom, encryptForCore as encryptFor, establishSessionInitiatorCore as establishSessionInitiator, establishSessionResponderCore as establishSessionResponder, HandshakeVerificationError, signCore as sign, UntrustedPartyError, verifyCore as verify, } from "./crypto/hybrid.js";
+export type { Certificate, EncryptedBox, HandshakeSignature, InitiatorHandshakeMessage, InitiatorSessionResult, LogDeps, ResponderHandshakeInit, ResponderHandshakeMessage, ResponderHandshakeSecrets, ResponderSessionResult, SessionKeys, SignOptions, TrustDeps, TrustStatus, VerifyDeps, VerifyFailureReason, VerifyResult, } from "./crypto/hybrid.js";
 export { generateClassicalKeypair, classicalSharedSecret, classicalSign, classicalVerify } from "./crypto/classical.js";
 export type { ClassicalKeypair } from "./crypto/classical.js";
 export { generatePqcKemKeypair, generatePqcSignKeypair, pqcDecapsulate, pqcEncapsulate, pqcSign, pqcVerify, } from "./crypto/pqc.js";
@@ -20,8 +20,6 @@ export { canonicalize, hashDocument } from "./canonicalJson.js";
 export { fingerprint } from "./fingerprint.js";
 export { decryptFrame, encryptFrame, FrameDecryptionError } from "./crypto/frameCipher.js";
 export type { EncryptedFrame } from "./crypto/frameCipher.js";
-export { createFrameChannels, FrameCounterError, FrameReceiver, FrameSender } from "./crypto/frameSession.js";
-export { ConfirmedSession, UnconfirmedSessionError } from "./crypto/confirmedSession.js";
 export { CHAIN_INFO_INITIATOR_TO_RESPONDER, CHAIN_INFO_RESPONDER_TO_INITIATOR, ML_KEM_STEP_CADENCE, performEcdhStep, performKemStep, ratchetChainKey, seedChainKey, } from "./crypto/ratchet.js";
 export type { AsymmetricStepResult, ChainStep } from "./crypto/ratchet.js";
 export type { Identity, PublicCard } from "./identity.js";

package/dist/core.js

@@ -10,13 +10,11 @@
  * included, fs-backed versions of the same logic — this module is the
  * un-wired core they're built from, not a separate implementation.
  */
-export { createResponderHandshakeCore as createResponderHandshake, decryptFromCore as decryptFrom, DecryptionError, encryptForCore as encryptFor, establishSessionInitiatorCore as establishSessionInitiator, establishSessionResponderCore as establishSessionResponder, HandshakeVerificationError, makeKeyConfirmation, verifyKeyConfirmation, MalformedHandshakeMessageError, ReplayedBoxError, signCore as sign, UntrustedPartyError, verifyCore as verify, } from "./crypto/hybrid.js";
+export { createResponderHandshakeCore as createResponderHandshake, decryptFromCore as decryptFrom, encryptForCore as encryptFor, establishSessionInitiatorCore as establishSessionInitiator, establishSessionResponderCore as establishSessionResponder, HandshakeVerificationError, signCore as sign, UntrustedPartyError, verifyCore as verify, } from "./crypto/hybrid.js";
 export { generateClassicalKeypair, classicalSharedSecret, classicalSign, classicalVerify } from "./crypto/classical.js";
 export { generatePqcKemKeypair, generatePqcSignKeypair, pqcDecapsulate, pqcEncapsulate, pqcSign, pqcVerify, } from "./crypto/pqc.js";
 export { canonicalize, hashDocument } from "./canonicalJson.js";
 export { fingerprint } from "./fingerprint.js";
 export { decryptFrame, encryptFrame, FrameDecryptionError } from "./crypto/frameCipher.js";
-export { createFrameChannels, FrameCounterError, FrameReceiver, FrameSender } from "./crypto/frameSession.js";
-export { ConfirmedSession, UnconfirmedSessionError } from "./crypto/confirmedSession.js";
 export { CHAIN_INFO_INITIATOR_TO_RESPONDER, CHAIN_INFO_RESPONDER_TO_INITIATOR, ML_KEM_STEP_CADENCE, performEcdhStep, performKemStep, ratchetChainKey, seedChainKey, } from "./crypto/ratchet.js";
 //# sourceMappingURL=core.js.map

package/dist/core.js.map

@@ -1 +1 @@
-{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,4BAA4B,IAAI,wBAAwB,EACxD,eAAe,IAAI,WAAW,EAC9B,eAAe,EACf,cAAc,IAAI,UAAU,EAC5B,6BAA6B,IAAI,yBAAyB,EAC1D,6BAA6B,IAAI,yBAAyB,EAC1D,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,8BAA8B,EAC9B,gBAAgB,EAChB,QAAQ,IAAI,IAAI,EAChB,mBAAmB,EACnB,UAAU,IAAI,MAAM,GACrB,MAAM,oBAAoB,CAAC;AAyB5B,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,cAAc,EACd,cAAc,EACd,OAAO,EACP,SAAS,GACV,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE3F,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC9G,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEzF,OAAO,EACL,iCAAiC,EACjC,iCAAiC,EACjC,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,eAAe,EACf,YAAY,GACb,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,4BAA4B,IAAI,wBAAwB,EACxD,eAAe,IAAI,WAAW,EAC9B,cAAc,IAAI,UAAU,EAC5B,6BAA6B,IAAI,yBAAyB,EAC1D,6BAA6B,IAAI,yBAAyB,EAC1D,0BAA0B,EAC1B,QAAQ,IAAI,IAAI,EAChB,mBAAmB,EACnB,UAAU,IAAI,MAAM,GACrB,MAAM,oBAAoB,CAAC;AAqB5B,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,cAAc,EACd,cAAc,EACd,OAAO,EACP,SAAS,GACV,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAG3F,OAAO,EACL,iCAAiC,EACjC,iCAAiC,EACjC,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,eAAe,EACf,YAAY,GACb,MAAM,qBAAqB,CAAC"}

package/dist/crypto/classical.d.ts

@@ -8,5 +8,3 @@ export declare function classicalSign(message: Uint8Array, secretKey: Uint8Array
 export declare function classicalVerify(signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array): boolean;
 /** ECDH shared secret between our secret key and their public key. */
 export declare function classicalSharedSecret(secretKey: Uint8Array, theirPublicKey: Uint8Array): Uint8Array;
-/** True iff `keypair`'s two fields are the exact byte lengths p384's own keygen produces — a cheap sanity check for key material sourced from somewhere this library doesn't control (e.g. a caller-supplied KeyStore, issue #38). */
-export declare function isValidClassicalKeypairShape(keypair: ClassicalKeypair): boolean;

package/dist/crypto/classical.js

@@ -18,8 +18,4 @@ export function classicalVerify(signature, message, publicKey) {
 export function classicalSharedSecret(secretKey, theirPublicKey) {
     return p384.getSharedSecret(secretKey, theirPublicKey);
 }
-/** True iff `keypair`'s two fields are the exact byte lengths p384's own keygen produces — a cheap sanity check for key material sourced from somewhere this library doesn't control (e.g. a caller-supplied KeyStore, issue #38). */
-export function isValidClassicalKeypairShape(keypair) {
-    return keypair.secretKey.length === p384.lengths.secretKey && keypair.publicKey.length === p384.lengths.publicKey;
-}
 //# sourceMappingURL=classical.js.map

package/dist/crypto/classical.js.map

@@ -1 +1 @@
-{"version":3,"file":"classical.js","sourceRoot":"","sources":["../../src/crypto/classical.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAO7C,yEAAyE;AACzE,MAAM,UAAU,wBAAwB;IACtC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAmB,EAAE,SAAqB;IACtE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAqB,EAAE,OAAmB,EAAE,SAAqB;IAC/F,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,qBAAqB,CAAC,SAAqB,EAAE,cAA0B;IACrF,OAAO,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,sOAAsO;AACtO,MAAM,UAAU,4BAA4B,CAAC,OAAyB;IACpE,OAAO,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;AACpH,CAAC"}
+{"version":3,"file":"classical.js","sourceRoot":"","sources":["../../src/crypto/classical.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAO7C,yEAAyE;AACzE,MAAM,UAAU,wBAAwB;IACtC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAmB,EAAE,SAAqB;IACtE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAqB,EAAE,OAAmB,EAAE,SAAqB;IAC/F,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,qBAAqB,CAAC,SAAqB,EAAE,cAA0B;IACrF,OAAO,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;AACzD,CAAC"}

package/dist/crypto/frameCipher.js

@@ -1,9 +1,5 @@
 import { gcm } from "@noble/ciphers/aes.js";
 import { bytesToHex, hexToBytes } from "@noble/hashes/utils.js";
-// Prefer FrameSender/FrameReceiver (./frameSession.ts), which own the counter so
-// it cannot be reused by mistake; use these raw functions only if you must manage
-// counters yourself.
-//
 // The per-frame AEAD used to wrap every message sent under a session key
 // established by establishSessionInitiatorCore/establishSessionResponderCore
 // (see hybrid.ts) — one directional key, reused across many frames, so the
@@ -24,10 +20,8 @@ export class FrameDecryptionError extends Error {
 }
 /** Encodes `counter` as a 96-bit nonce: 4 zero bytes + an 8-byte big-endian counter (2^64 frames is far beyond any realistic session). */
 function counterToNonce(counter) {
-    // isSafeInteger, not isInteger: above 2^53 distinct counters can round to
-    // the same double, which would silently reuse a nonce.
-    if (!Number.isSafeInteger(counter) || counter < 0) {
-        throw new Error(`Frame counter must be a non-negative safe integer (0 to 2^53-1), got ${counter}.`);
+    if (!Number.isInteger(counter) || counter < 0) {
+        throw new Error(`Frame counter must be a non-negative integer, got ${counter}.`);
     }
     const nonce = new Uint8Array(NONCE_LENGTH);
     let value = BigInt(counter);

package/dist/crypto/frameCipher.js.map

@@ -1 +1 @@
-{"version":3,"file":"frameCipher.js","sourceRoot":"","sources":["../../src/crypto/frameCipher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhE,iFAAiF;AACjF,kFAAkF;AAClF,qBAAqB;AACrB,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,4EAA4E;AAC5E,wEAAwE;AACxE,gBAAgB;AAEhB,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C;QACE,KAAK,CAAC,+FAA+F,CAAC,CAAC;QACvG,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AASD,0IAA0I;AAC1I,SAAS,cAAc,CAAC,OAAe;IACrC,0EAA0E;IAC1E,uDAAuD;IACvD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wEAAwE,OAAO,GAAG,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,YAAY,GAAG,CAAC,EAAE,CAAC,IAAI,YAAY,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QACtE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC;QACjC,KAAK,KAAK,EAAE,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,GAAe,EAAE,OAAe,EAAE,SAAqB,EAAE,GAAgB;IACpG,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAe,EAAE,KAAqB,EAAE,GAAgB;IACnF,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;AACH,CAAC"}
+{"version":3,"file":"frameCipher.js","sourceRoot":"","sources":["../../src/crypto/frameCipher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhE,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,4EAA4E;AAC5E,wEAAwE;AACxE,gBAAgB;AAEhB,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C;QACE,KAAK,CAAC,+FAA+F,CAAC,CAAC;QACvG,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AASD,0IAA0I;AAC1I,SAAS,cAAc,CAAC,OAAe;IACrC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,qDAAqD,OAAO,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,YAAY,GAAG,CAAC,EAAE,CAAC,IAAI,YAAY,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QACtE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC;QACjC,KAAK,KAAK,EAAE,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,GAAe,EAAE,OAAe,EAAE,SAAqB,EAAE,GAAgB;IACpG,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAe,EAAE,KAAqB,EAAE,GAAgB;IACnF,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;AACH,CAAC"}

package/dist/crypto/hybrid.d.ts

@@ -7,23 +7,6 @@ declare const ALGORITHMS: {
 export declare class UntrustedPartyError extends Error {
     constructor(alias: string);
 }
-/** Thrown by decryptFromCore for a structurally-malformed EncryptedBox or a failed AEAD decryption — both mean "this box is unusable", so one error class covers both causes. */
-export declare class DecryptionError extends Error {
-    constructor(message: string);
-}
-/**
- * True only for the exact canonical format `new Date().toISOString()` itself
- * produces — the one format this codebase ever actually writes. A round-trip
- * check (not a regex, not bare `Date.parse`) catches wrong formats, non-ISO
- * strings `Date.parse` would otherwise accept (implementation-defined beyond
- * strict ISO-8601), AND calendar-overflow values some engines silently roll
- * forward (e.g. a Feb 30th) — all in one comparison: any mismatch, whatever
- * the cause, fails the round-trip (ADR 0010). Exported so other modules that
- * define their own timestamp fields (e.g. trust.ts's rotation/revocation
- * documents) can hold them to the same strict standard instead of each
- * re-deriving their own looser check.
- */
-export declare function isValidIsoInstant(value: string): boolean;
 export interface Certificate {
     documentHash: string;
     classicalSignature: string;
@@ -35,14 +18,6 @@ export interface Certificate {
         pqcSignPublicKey: string;
     };
     signedAt: string;
-    /**
-     * Certificate format. 2 (what sign() writes) means the signatures also cover
-     * `signer.alias` and `signedAt`; absent means a legacy certificate whose
-     * signatures cover only the document hash and expiry, so those two fields
-     * are unauthenticated there. A v2 certificate stripped of this field does
-     * not become a valid legacy one: its signatures are over the v2 message.
-     */
-    version?: 2;
     /** Absent = permanent proof, valid indefinitely (the default, unchanged behavior). */
     expiresAt?: string;
 }
@@ -50,7 +25,7 @@ export interface SignOptions {
     /** If set, verify() rejects this certificate as "expired" once this ISO timestamp has passed. */
     expiresAt?: string;
 }
-export type VerifyFailureReason = "untrusted-signer" | "revoked-signer" | "hash-mismatch" | "classical-signature-mismatch" | "pqc-signature-mismatch" | "expired" | "malformed-certificate";
+export type VerifyFailureReason = "untrusted-signer" | "revoked-signer" | "hash-mismatch" | "classical-signature-mismatch" | "pqc-signature-mismatch" | "expired";
 export type VerifyResult = {
     valid: true;
 } | {
@@ -93,57 +68,24 @@ export declare function signCore(identity: Identity, document: unknown, options?
  */
 export declare function verifyCore(identity: Identity, document: unknown, certificate: Certificate, deps: VerifyDeps): Promise<VerifyResult>;
 export interface EncryptedBox {
-    /** Always 2. Version 1 boxes (1.x, unsigned, no context binding) are rejected. */
-    version: 2;
-    /** 16 random bytes, hex. Unique per box; use it to detect replays. */
-    id: string;
-    /** When the sender sealed the box (ISO-8601, covered by the signature). */
-    signedAt: string;
     kemCipherText: string;
     nonce: string;
     ciphertext: string;
-    /** The sender's dual (ECDSA-P384 + ML-DSA-87) signature over everything above and both party fingerprints. */
-    signature: {
-        classicalSignature: string;
-        pqcSignature: string;
-    };
-}
-/** Thrown by decryptFromCore when the caller's `isReplay` hook reports the (otherwise valid) box was already seen. */
-export declare class ReplayedBoxError extends Error {
-    constructor(id: string);
-}
-/** What the replay hook is told about a box that has already passed signature verification. */
-export interface BoxReplayInfo {
-    id: string;
-    signedAt: string;
-    senderFingerprint: string;
-}
-/** decryptFromCore's dependencies: trust, log, and an optional replay check (return true to reject the box). */
-export interface DecryptDeps extends TrustDeps {
-    isReplay?: (info: BoxReplayInfo) => boolean | Promise<boolean>;
 }
 /**
- * Encrypts `data` for `counterpart` (box v2, ADR 0018). The key comes from
- * ECDH-P384 and an ML-KEM-1024 encapsulation, combined by HKDF-SHA384 with a
- * salt that binds both parties and every public value in the box. AES-256-GCM
- * authenticates the same context as AAD, and the sender dual-signs the box so
- * it cannot be forged by the recipient or anyone else. Throws
- * UntrustedPartyError unless `deps.checkTrust(counterpart)` reports "trusted".
- *
- * There is still NO forward secrecy: the ECDH half uses long-term keys. Use a
- * session handshake for anything that needs it.
+ * Encrypts `data` for `counterpart` using a symmetric key derived from BOTH
+ * an ECDH-P384 exchange and an ML-KEM-1024 encapsulation (HKDF-SHA384
+ * combines the two secrets), then AES-256-GCM. Throws UntrustedPartyError
+ * unless `deps.checkTrust(counterpart)` reports "trusted".
  */
 export declare function encryptForCore(identity: Identity, counterpart: PublicCard, data: unknown, deps: TrustDeps): Promise<EncryptedBox>;
 /**
  * Decrypts a box produced by `encryptFor`. `counterpart` is the sender's
  * public card. Throws UntrustedPartyError unless `deps.checkTrust(counterpart)`
- * reports "trusted". The sender's signature and the recipient binding are
- * verified BEFORE any decapsulation or decryption; a v1 box, a box sealed for
- * someone else, or a box not signed by `counterpart` is a DecryptionError. If
- * `deps.isReplay` is given it is consulted only after the signature checks
- * out, and a true result throws ReplayedBoxError.
+ * reports "trusted" — this stops a caller from accidentally decrypting "as
+ * if" a message came from someone they never actually trusted.
  */
-export declare function decryptFromCore<T = unknown>(identity: Identity, counterpart: PublicCard, box: EncryptedBox, deps: DecryptDeps): Promise<T>;
+export declare function decryptFromCore<T = unknown>(identity: Identity, counterpart: PublicCard, box: EncryptedBox, deps: TrustDeps): Promise<T>;
 export interface SessionKeys {
     /** AES-256-GCM key for frames sent by the initiator, decrypted by the responder. */
     initiatorToResponder: Uint8Array;
@@ -212,35 +154,6 @@ export interface ResponderSessionResult {
 export declare class HandshakeVerificationError extends Error {
     constructor(message: string);
 }
-/** Thrown for a structurally-malformed handshake message (non-hex fields) — distinct from HandshakeVerificationError, which means the shape was fine but the signature didn't check out. */
-export declare class MalformedHandshakeMessageError extends Error {
-    constructor(message: string);
-}
-/** The four handshake artifacts a confirmation tag is computed over — exactly what both sides hold once the handshake completes. */
-export interface HandshakeTranscript {
-    initiatorCard: PublicCard;
-    responderCard: PublicCard;
-    responderMessage: ResponderHandshakeMessage;
-    initiatorMessage: InitiatorHandshakeMessage;
-}
-export type HandshakeRole = "initiator" | "responder";
-/**
- * The tag to send the counterpart as proof you derived the same secrets:
- * HMAC-SHA384, keyed by the handshake's `confirmationKey`, over the full
- * transcript and YOUR role (hex, 96 characters). Folding the role in means
- * your own tag can never be replayed back to you as the counterpart's.
- * Send it only after the handshake call returned, and treat the connection
- * as unauthenticated until `verifyKeyConfirmation` succeeds on the tag you
- * receive.
- */
-export declare function makeKeyConfirmation(confirmationKey: Uint8Array, role: HandshakeRole, transcript: HandshakeTranscript): string;
-/**
- * Checks the tag received from the counterpart. Pass the COUNTERPART's role
- * (an initiator verifies "responder"). Returns false — never throws — for a
- * wrong tag, a malformed one (any non-string, odd length, non-hex, wrong
- * length, uppercase) or an unusable key/role, and compares in constant time.
- */
-export declare function verifyKeyConfirmation(confirmationKey: Uint8Array, counterpartRole: HandshakeRole, transcript: HandshakeTranscript, tag: unknown): boolean;
 /**
  * First step of the handshake, run by the connection's responder: generates
  * one fresh, single-use ECDH-P384 keypair and one fresh, single-use