Struct PnpSuite 

pub struct PnpSuite { /* private fields */ }

A keyed one-time-pad channel over one directional half of a PadPool at one pad epoch. A peer seals with the suite for its send direction and opens with the suite for its receive direction; because the two directions are different pad halves, a peer never seals and opens over the same bytes.

State is behind interior mutability so the suite is used through a shared &self (as super::channel::PqSuite is): PnpSuite::seal serializes cursor reservation under a lock and commits the ledger before returning a frame; PnpSuite::open tracks consumed covers.

Implementations

impl PnpSuite

pub fn with_ledger(self, ledger: Arc<dyn PadLedgerStore>) -> Self

Install a durable ledger, resuming the send cursor from it (crash-safety across restarts).

pub fn with_recv_window(self, bytes: u64) -> Self

Set the receiver reorder/replay window, in pad bytes.

pub fn epoch(&self) -> u32

The pad epoch this suite draws from.

pub fn send_remaining(&self) -> usize

Pad bytes remaining in the send direction — the low-water gauge. When this reaches zero, PnpSuite::seal fails closed.

pub fn is_low(&self, threshold: usize) -> bool

Whether the send pad has dropped below threshold bytes — the signal to provision and roll to the next epoch before exhaustion.

pub fn seal(&self, blob: &[u8]) -> Option<Vec<u8>>

Seal blob into a fresh data cover. None — fail-closed — when the pad is exhausted.

pub fn seal_roll( &self, next_epoch: u32, next_commitment: &[u8; 32], ) -> Option<Vec<u8>>

Seal an authenticated roll cover announcing the next pad epoch and a commitment (hash) to its bytes, using the current pad’s one-time MAC. The peer confirms via PnpSuite::open_roll that it holds the identical next pad before switching. None if the current pad is exhausted.

pub fn open(&self, frame: &[u8]) -> Option<Vec<u8>>

Open a data cover, or None on any malformed / tampered / replayed / wrong-epoch frame.

pub fn open_roll(&self, frame: &[u8]) -> Option<(u32, [u8; 32])>

Open a roll cover, returning the announced (next_epoch, next_commitment). None on any tampered / wrong-epoch / non-roll frame.