rootproto

type KeyStore ¶

type KeyStore struct {
	GetPrivateKey         func() ([]byte, error)                           // raw 32-byte scalar
	GetClientPublicKey    func(clientID string) ([]byte, bool)             // raw uncompressed SEC1, (nil,false) if unknown
	CommitClientPublicKey func(clientID string, newPublicKey []byte) error // persist after validated renewKeyAck
}

KeyStore is the server's callback seam into host-owned persistence The server holds one long-lived private key shared across all clients

type Keypair ¶

type Keypair struct {
	PublicKey  []byte
	PrivateKey []byte
}

Keypair holds raw P-256 public and private key bytes Public key: 65-byte uncompressed SEC1 (0x04 || X || Y) Private key: 32-byte raw scalar

func GenerateKeypair() (*Keypair, error)

type ReplayStore ¶

type ReplayStore struct {
	Load   func() ([]byte, error)
	Append func(entry []byte) error
	Save   func(snapshot []byte) error
}

ReplayStore is the host's callback seam for persisting seen requestIDs Append is called after every accepted message; Save replaces the persisted state on client deletion; Load returns the concatenation of every record the host has persisted

type RequestHandler ¶

type RequestHandler func(clientID string, payload []byte) (replyPayload any)

RequestHandler processes a client request and returns the reply payload Payload decrypted, but still-CBOR-encoded; the handler unmarshals into its own types Hosts encode app-level results as they see fit; the library does not inspect the shape

type Server ¶

type Server struct {
	// contains filtered or unexported fields
}

func NewServer(selfID string, keyStore KeyStore, replayStore ReplayStore) (*Server, error)

func (s *Server) ClearReplayHistory(clientID string) error

func (s *Server) Close() error

func (s *Server) OffRequest(msgType string)

func (s *Server) OnRequest(msgType string, handler RequestHandler)

func (s *Server) Push(clientID, msgType string, payload any, write WriteFn) error

func (s *Server) Receive(bytes []byte, write WriteFn) error

type Session ¶

type Session struct {
	// contains filtered or unexported fields
}

Session holds an AES-256-GCM cipher bound to a derived key

func DeriveSession(privateKey, publicKey []byte) (*Session, error)

func SessionFromKey(key []byte) (*Session, error)

func (s *Session) Decrypt(ciphertext, aad []byte) ([]byte, error)

func (s *Session) Encrypt(plaintext, aad []byte) ([]byte, error)

type WriteFn ¶

type WriteFn func(bytes []byte) error

WriteFn is the host-owned wire