nx_tls13_client_session.nx

nx_tls13_client_session.nx -- TLS 1.3 client session state + emit-ClientHello primitive (step 3c.1 of the nx_https_client wiring arc). The Tls13ClientSession struct is the container that the remaining handshake-orchestrator steps (3c.2 recv ServerHello + derive handshake keys; 3c.3 recv encrypted handshake messages via dispatcher_with_validation; 3c.4 emit client Finished; 3c.5 derive application traffic keys) populate field by field as the handshake progresses. At session creation: - client_random[0..32] filled with caller-supplied entropy - x25519 ephemeral keypair generated from caller-supplied seed - transcript hash state initialised - state = CSTATE_INIT (before any message) After emit-CH (this commit): - ClientHello bytes written to caller buffer + transcript updated - state = CSTATE_CH_SENT After 3c.2 (queued): state = WAIT_EE (handshake keys derived) After 3c.3 (queued): state cycles WAIT_EE -> WAIT_CERT -> WAIT_CV -> WAIT_SF -> WAIT_CLIENT_FIN After 3c.4 (queued): state = WAIT_APP_KEYS After 3c.5 (queued): state = CONNECTED (application data flow OK) Public API (this commit): struct Tls13ClientSession { /* see below */ } nx_tls13_client_session_new(client_random, x25519_priv) -> *Tls13ClientSession nx_tls13_client_session_emit_ch(session, sni, sni_len, out_buf, out_cap) -> bytes-written or negative-verdict nx_tls13_client_session_verdict_is_valid(v) -> 0|1 Sealed verdict enum: NX_TLS13_CSESSION_OK positive return = bytes written NX_TLS13_CSESSION_BAD_STATE called emit_ch outside INIT state NX_TLS13_CSESSION_BUF_OVERFLOW output buffer too small NX_TLS13_CSESSION_INTERNAL hello-emit returned negative