@interncom/diplomatic 0.11.5 → 0.12.0

package/dist/cli/shared/seed.d.ts

@@ -0,0 +1,25 @@
+import { type ValStat } from "./valstat.ts";
+declare const masterSeedSymbol: unique symbol;
+declare const sealedMasterKeySymbol: unique symbol;
+/** Master seed length in bytes (Ed25519 seed / PRF material). */
+export declare const MASTER_SEED_LEN = 32;
+/**
+ * AEAD-sealed master (libsodium secretbox combined layout):
+ * 24-byte nonce + 32-byte ciphertext + 16-byte MAC.
+ */
+export declare const SEALED_MASTER_KEY_LEN: number;
+export type MasterSeed = Uint8Array & {
+    readonly [masterSeedSymbol]: true;
+};
+/**
+ * Master seed sealed under KDF(PRF) (nonce‖ciphertext‖tag).
+ * Useless without the PRF output that derives the wrap key.
+ */
+export type SealedMasterKey = Uint8Array & {
+    readonly [sealedMasterKeySymbol]: true;
+};
+/** Brand `bytes` as {@link MasterSeed} only if length is {@link MASTER_SEED_LEN}. */
+export declare function asMasterSeed(bytes: Uint8Array): ValStat<MasterSeed>;
+/** Brand `bytes` as {@link SealedMasterKey} only if length is {@link SEALED_MASTER_KEY_LEN}. */
+export declare function asSealedMasterKey(bytes: Uint8Array): ValStat<SealedMasterKey>;
+export {};

package/dist/cli/shared/types.d.ts

@@ -4,7 +4,10 @@ import { IAuthTimestamp } from "./codecs/authTimestamp.ts";
 import type { IBagPeekItem } from "./codecs/peekItem.ts";
 import { IUsageQuota } from "./codecs/usageQuota.ts";
 import { APICallName, Status } from "./consts.ts";
-import { ValStat } from "./valstat.ts";
+import type { ValStat } from "./valstat.ts";
+/** Identity seed brands — defined in seed.ts; re-exported for convenience. */
+export type { MasterSeed, SealedMasterKey } from "./seed.ts";
+export { asMasterSeed, asSealedMasterKey, MASTER_SEED_LEN, SEALED_MASTER_KEY_LEN, } from "./seed.ts";
 export type GroupID = string;
 declare const entityIDSymbol: unique symbol;
 export type EntityID = Uint8Array & {
@@ -98,15 +101,11 @@ export interface KeyPair {
     privateKey: PrivateKey;
     publicKey: PublicKey;
 }
-declare const masterSeedSymbol: unique symbol;
 declare const derivationSeedSymbol: unique symbol;
 declare const publicKeySymbol: unique symbol;
 declare const privateKeySymbol: unique symbol;
 declare const hostSpecificKeyPairSymbol: unique symbol;
 declare const hashSymbol: unique symbol;
-export type MasterSeed = Uint8Array & {
-    readonly [masterSeedSymbol]: true;
-};
 export type DerivationSeed = Uint8Array & {
     readonly [derivationSeedSymbol]: true;
 };
@@ -214,4 +213,3 @@ export interface IUpsertMessage extends IMessage {
 export interface IDeleteMessage extends Omit<IMessage, "bod"> {
     len: 0;
 }
-export {};

package/dist/cli/shared/webauthn/common.d.ts

@@ -0,0 +1,38 @@
+import { Status } from "../consts.ts";
+import { type ValStat } from "../valstat.ts";
+export declare const WEBAUTHN_CHAL_LEN = 32;
+/** COSE algorithm identifiers for WebAuthn `pubKeyCredParams`. */
+export declare const COSE_ALG_ES256 = -7;
+export declare const COSE_ALG_EDDSA = -8;
+export declare const COSE_ALG_RS256 = -257;
+/** Prefer modern curves; include RS256 for broader authenticator coverage. */
+export declare const WEBAUTHN_PUB_KEY_PARAMS: PublicKeyCredentialParameters[];
+export type WebAuthnRp = {
+    rpId?: string;
+    rpName?: string;
+};
+/**
+ * Default WebAuthn RP ID: the full hostname (no eTLD+1 collapse).
+ *
+ * Credentials are scoped to this exact host. That is deliberate and simple —
+ * no Public Suffix List, no multi-part-suffix guesses. Apps that want a shared
+ * RP across subdomains (e.g. `app.example.com` + `www.example.com` →
+ * `example.com`) must pass an explicit `rpId` that is a valid suffix of the
+ * origin (WebAuthn requires the RP ID equal the effective domain or a
+ * registrable suffix of it).
+ *
+ * Normalizes case and trailing dots. Empty → `"localhost"`.
+ */
+export declare function defaultWebAuthnRpId(hostname: string): string;
+/** Copy into a fresh ArrayBuffer-backed view (DOM BufferSource typing). */
+export declare function copyToArrayBuffer(src: Uint8Array): Uint8Array;
+/** Resolve RP id from opts or `location.hostname`. */
+export declare function resolveWebAuthnRpId(opts?: WebAuthnRp): ValStat<string>;
+/** Success if WebAuthn credentials API is available in this environment. */
+export declare function checkWebAuthn(): Status;
+export declare function asPublicKeyCredential(cred: Credential | null): ValStat<PublicKeyCredential>;
+/**
+ * Best-effort capability probe (not all UAs expose this).
+ * `extKey` e.g. `"extension:largeBlob"`, `"extension:prf"`.
+ */
+export declare function webAuthnExtensionCapable(extKey: string): Promise<boolean>;

package/dist/cli/shared/webauthn/largeBlob.d.ts

@@ -0,0 +1,19 @@
+import { Status } from "../consts.ts";
+import { type ValStat } from "../valstat.ts";
+import { type WebAuthnRp } from "./common.ts";
+export type LargeBlobRp = WebAuthnRp;
+export type LargeBlobCreateOpts = LargeBlobRp & {
+    userName?: string;
+    authenticatorAttachment?: string;
+};
+/** Best-effort capability probe. */
+export declare function largeBlobCapable(): Promise<boolean>;
+/** Create discoverable largeBlob-capable credential; returns credential id. */
+export declare function largeBlobCreateCred(opts?: LargeBlobCreateOpts): Promise<ValStat<Uint8Array>>;
+/** UV write of opaque bytes to largeBlob. */
+export declare function largeBlobWrite(credId: Uint8Array, data: Uint8Array, opts?: LargeBlobRp): Promise<Status>;
+/** UV read from largeBlob; `credId` undefined = discoverable assertion. */
+export declare function largeBlobRead(credId: Uint8Array | undefined, opts?: LargeBlobRp): Promise<ValStat<{
+    blob: Uint8Array;
+    credId: Uint8Array;
+}>>;

package/dist/cli/shared/webauthn/prf.d.ts

@@ -0,0 +1,33 @@
+import { type ValStat } from "../valstat.ts";
+import { type WebAuthnRp } from "./common.ts";
+export type PrfRp = WebAuthnRp;
+export type PrfCreateOpts = PrfRp & {
+    userName?: string;
+    authenticatorAttachment?: string;
+};
+/** Default salt for DIPLOMATIC PRF eval (UTF-8). */
+export declare const DEFAULT_PRF_SALT: Uint8Array<ArrayBufferLike>;
+/** Bytes of PRF output we consume (first N of `results.first`). */
+export declare const PRF_OUTPUT_LEN = 32;
+export type PrfCreateResult = {
+    credId: Uint8Array;
+    prfEnabled: boolean;
+};
+/** Internal: PRF output + cred id. For Enclave only — do not re-export to apps. */
+export type PrfEvalResult = {
+    prf: Uint8Array;
+    credId: Uint8Array;
+};
+export type PrfEvalOpts = PrfRp & {
+    credId?: Uint8Array;
+    salt?: Uint8Array;
+};
+/** Best-effort: client advertises PRF extension. */
+export declare function prfCapable(): Promise<boolean>;
+/** Create a discoverable credential that enables PRF. */
+export declare function createPrfCred(opts?: PrfCreateOpts): Promise<ValStat<PrfCreateResult>>;
+/**
+ * Evaluate PRF (UV). Returns PRF bytes — only Enclave should call this and must
+ * zero/drop PRF after seal/unseal. Apps must not hold PRF alongside sealed meta.
+ */
+export declare function evalPrf(opts?: PrfEvalOpts): Promise<ValStat<PrfEvalResult>>;

package/dist/cli/shared/worker/embeddedWorkerSource.d.ts

@@ -0,0 +1 @@
+export declare const DIPLOMATIC_WORKER_SOURCE = "";

package/dist/cli/shared/worker/spawn.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Construct a DIPLOMATIC sync Worker from the embedded bundle.
+ * Does not inject seed — use {@link Enclave.spawnSyncWorker} for that.
+ */
+export declare function spawnDiplomaticSyncWorker(): Worker;

package/dist/cli/src/index.d.ts

@@ -4,14 +4,15 @@ import type { IBagPeekItem } from "../shared/codecs/peekItem.ts";
 import { IBagPullItem } from "../shared/codecs/pullItem.ts";
 import { IBagPushItem } from "../shared/codecs/pushItem.ts";
 import { Status } from "../shared/consts.ts";
-import { HostHandle, IHostConnectionInfo, IMessage, ITransport, MasterSeed } from "../shared/types.ts";
+import { Enclave } from "../shared/crypto/enclave.ts";
+import { HostHandle, IHostConnectionInfo, IMessage, ITransport } from "../shared/types.ts";
 import { ValStat } from "../shared/valstat.ts";
 export declare class CLIClient<Handle extends HostHandle> {
     private enclave;
     private conn?;
     private clock;
-    constructor({ seed, clock }: {
-        seed: MasterSeed;
+    constructor({ enclave, clock }: {
+        enclave: Enclave;
         clock?: IClock;
     });
     connect(host: IHostConnectionInfo<Handle>, transport: ITransport): Promise<Status>;
@@ -23,17 +24,18 @@ export declare class CLIClient<Handle extends HostHandle> {
     listen(onNotification: (bytes: Uint8Array) => Promise<Status>, onDisconnect?: () => void, onConnect?: () => void): Promise<Status>;
     isConnected(): boolean;
 }
-export declare function initCLI<Handle extends URL>({ seed, host, transport }: {
-    seed: MasterSeed;
+export declare function initCLI<Handle extends URL>({ enclave, host, transport }: {
+    enclave: Enclave;
     host: IHostConnectionInfo<Handle>;
     transport: ITransport;
 }): Promise<[CLIClient<Handle>, Status]>;
-export declare function initCLIOrPanic<Handle extends URL>({ seed, host, transport }: {
-    seed: MasterSeed;
+export declare function initCLIOrPanic<Handle extends URL>({ enclave, host, transport }: {
+    enclave: Enclave;
     host: IHostConnectionInfo<Handle>;
     transport?: ITransport;
 }): Promise<CLIClient<Handle>>;
-export declare function loadSeedOrPanic(envVar: string): MasterSeed;
+/** Load master seed hex from env and construct an Enclave immediately. */
+export declare function loadEnclaveOrPanic(envVar: string): Enclave;
 export declare function loadHostOrPanic(envVar: string): IHostConnectionInfo<URL>;
 export { default as msgpack } from "../bun/src/codec.ts";
 export { Decoder } from "../shared/codec.ts";

package/dist/web/client.d.ts

@@ -2,7 +2,8 @@ import DiplomaticClientAPI from "./shared/client";
 import { IClock } from "./shared/clock";
 import { Status } from "./shared/consts";
 import { EncodedMessage } from "./shared/message";
-import { EntityID, Hash, HostHandle, ICrypto, IDeleteParams, IEntRev, IHostConnectionInfo, IInsertParams, IMessageHead, IStateManager, ITransport, IUpdateParams, MasterSeed } from "./shared/types";
+import type { Enclave } from "./shared/crypto/enclave";
+import { EntityID, Hash, HostHandle, ICrypto, IDeleteParams, IEntRev, IHostConnectionInfo, IInsertParams, IMessageHead, IStateManager, ITransport, IUpdateParams } from "./shared/types";
 import { ValStat } from "./shared/valstat";
 import { ApldState, IClient, IDiplomaticClientState, IDiplomaticClientXferState, IHostRow, IStateEmitter, IStore, IStoredMessage, ListMsgsOpts, ReconcileOpts, ReconcileReport, SetSeedOpts, WipeOpts } from "./types";
 export declare class SyncClient<Handle extends HostHandle> implements IClient<Handle> {
@@ -54,7 +55,7 @@ export declare class SyncClient<Handle extends HostHandle> implements IClient<Ha
     onScheduleSync?: (() => void) | undefined);
     /** Record phase progress and notify xferState listeners. */
     private emitProgress;
-    setSeed(seed: MasterSeed, opts?: SetSeedOpts): Promise<void>;
+    setSeed(enclave: Enclave, opts?: SetSeedOpts): Promise<void>;
     private getClientState;
     private getXferState;
     /**

package/dist/web/identity/pairPackage.d.ts

@@ -0,0 +1,31 @@
+import { Enclave, type PasskeyPrfOpts } from "../shared/crypto/enclave";
+import type { SealedMasterKey } from "../shared/seed";
+import type { ICrypto } from "../shared/types";
+import { type ValStat } from "../shared/valstat";
+import type { BundleHost } from "../shared/codecs/bundleHost";
+import type { PrfRp } from "../shared/webauthn/prf";
+export { type PairPackagePlain, pairPackagePlainCodec, } from "../shared/codecs/pairPackage";
+export { PAIR_PACKAGE_VERSION, type PairPackageEnvelope, pairPackageEnvelopeCodec, } from "../shared/codecs/pairPackageEnvelope";
+export type OpenedPairPackage = {
+    enclave: Enclave;
+    hosts: BundleHost[];
+    salt: Uint8Array;
+    credId?: Uint8Array;
+    /** Sealed master for protocol IDB, under same PRF (single ceremony). */
+    sealedMaster: SealedMasterKey;
+};
+/**
+ * Pair package seal/open under PRF.
+ */
+export declare const PairPackage: {
+    readonly PREFIX: "dip1:";
+    readonly VERSION: 1;
+    /**
+     * Seal enclave seed + hosts: Enclave runs PRF UV, then AEAD → `dip1:` string.
+     */
+    readonly seal: (_crypto: ICrypto, enclave: Enclave, hosts: BundleHost[], opts?: PasskeyPrfOpts) => Promise<ValStat<string>>;
+    /**
+     * Open pair package: decode envelope, Enclave runs PRF UV + decrypt + enclave.
+     */
+    readonly open: (crypto: ICrypto, pairPkg: string, rp: PrfRp) => Promise<ValStat<OpenedPairPackage>>;
+};

package/dist/web/index.d.ts

@@ -6,15 +6,18 @@ import { EntIDB } from "./entdb/idb";
 import { EntDBMemory, type EntDBMemoryOptions } from "./entdb/memory";
 import { useClient, useClientState, useClientXferState, useSyncOnResume } from "./react/useClient";
 import useStateWatcher, { useStateWatcherSuspense } from "./react/useStateWatcher";
-import { b64tob, btob64, btoh, htob } from "./shared/binary";
+import { b64tob, b64urltob, btob64, btob64url, btoh, htob } from "./shared/binary";
 import { Clock } from "./shared/clock";
 import { Decoder, Encoder } from "./shared/codec";
 import { eidCodec, genSingletonEID } from "./shared/codecs/eid";
 import { Status } from "./shared/consts";
 import { hostHTTPTransport, HTTPTransport } from "./shared/http";
 import { TypedEventEmitter } from "./shared/events";
-import { EntityID, GroupID, HostHandle, ICrypto, IDeleteParams, IEntRev, IHostConnectionInfo, IMessage, IMutateOp, type IOp, IStateManager, ITransport, IUpdateParams, MasterSeed } from "./shared/types";
+import { asMasterSeed, asSealedMasterKey, MASTER_SEED_LEN, type MasterSeed, SEALED_MASTER_KEY_LEN, type SealedMasterKey } from "./shared/seed";
+import { EntityID, GroupID, HostHandle, ICrypto, IDeleteParams, IEntRev, IHostConnectionInfo, IMessage, IMutateOp, type IOp, IStateManager, ITransport, IUpdateParams } from "./shared/types";
+import { Enclave, sealKeyFromPrf } from "./shared/crypto/enclave";
 import { nullStateManager, StateManager } from "./state";
+import { IDBSeedStore } from "./stores/idb/seed";
 import { IDBStore, openIDBStore } from "./stores/idb/store";
 import { MemoryStore } from "./stores/memory/store";
 import { SingletonStateManager } from "./shared/singleton";
@@ -22,8 +25,17 @@ import type { ApldState, Applier, HostStatsUpdate, IClient, IDiplomaticClientSta
 import { APLD_APPLIED, APLD_ERROR, APLD_PENDING, apldFromStored, isApldState, isPendingApply, isTerminalApplyFailure, setApld } from "./types";
 import type { SyncProgressEvent } from "./progress";
 import { defaultPeekProgressEvery, idleProgress, shouldEmitItemProgress } from "./progress";
-import { clearLargeBlobSeed, createLargeBlobCred, defaultWebAuthnRpId, discoverLargeBlobSeed, largeBlobCapable, PasskeySeedStore, readLargeBlobSeed, readLargeBlobUnlock, storeSeedLargeBlob, writeLargeBlobSeed } from "./passkey/seed";
-import type { LargeBlobRp, LargeBlobUnlock } from "./passkey/seed";
+import { defaultWebAuthnRpId, LargeBlob, PasskeySeedStore } from "./passkey/seed";
+import type { LargeBlobCreateOpts, LargeBlobRp } from "./passkey/seed";
+import { createPrfCred, DEFAULT_PRF_SALT, evalPrf, prfCapable, type PrfCreateOpts, type PrfEvalResult, type PrfRp } from "./shared/webauthn/prf";
+import { PrfSeedStore } from "./passkey/prf-store";
+import type { PersistPrfSeedMeta, PrfSeedMeta, PrfSeedStoreOpts } from "./passkey/prf-store";
+import type { PasskeySeedStoreOpts } from "./passkey/seed";
+import { type BundleHost, bundleHostCodec } from "./shared/codecs/bundleHost";
+import { createIdentityBundle, IDENTITY_BUNDLE_VERSION, identityBundleCodec } from "./shared/codecs/identityBundle";
+import type { IdentityBundle } from "./shared/codecs/identityBundle";
+import { PAIR_PACKAGE_VERSION, PairPackage, pairPackageEnvelopeCodec, pairPackagePlainCodec } from "./identity/pairPackage";
+import type { OpenedPairPackage, PairPackageEnvelope, PairPackagePlain } from "./identity/pairPackage";
 import { checksumEntRevs, checksumSet, cmpBytes, encodeEntRev } from "./shared/checksum";
 import { openDiplomaticClient, type OpenDiplomaticClientMainOptions, type OpenDiplomaticClientOptions, type OpenDiplomaticClientWorkerOptions, type OpenedDiplomaticClient } from "./openClient";
 import { WorkerClient } from "./worker/client";
@@ -33,5 +45,5 @@ export declare function genWebClient(stateMgr: IStateManager, url: URL): Promise
     client: SyncClient<URL>;
     setSeed: (seedHex: string) => Promise<void>;
 }>;
-export { APLD_APPLIED, APLD_ERROR, APLD_PENDING, apldFromStored, b64tob, btob64, btoh, CachedEntDB, checksumEntRevs, checksumSet, clearLargeBlobSeed, Clock, cmpBytes, createLargeBlobCred, crypto, Decoder, defaultPeekProgressEvery, defaultWebAuthnRpId, discoverLargeBlobSeed, eidCodec, encodeEntRev, Encoder, EntDBMemory, EntIDB, EntitiesQuery, EntityID, entStateManager, genSingletonEID, GroupID, hostHTTPTransport, htob, HTTPTransport, IDBStore, idleProgress, IEntDB, IEntity, isApldState, isLiveEnt, isPendingApply, isTerminalApplyFailure, isTombstone, IStore, largeBlobCapable, MasterSeed, MemoryStore, normalizeTags, nullEntDB, nullStateManager, openDiplomaticClient, openEntDB, openIDBStore, PasskeySeedStore, readLargeBlobSeed, readLargeBlobUnlock, revFromEntity, revFromHead, setApld, shouldEmitItemProgress, SingletonStateManager, StateManager, Status, storeSeedLargeBlob, SyncClient, TypedEventEmitter, useClient, useClientState, useClientXferState, useStateWatcher, useStateWatcherSuspense, useSyncOnResume, WorkerClient, writeLargeBlobSeed, };
-export type { ApldState, Applier, CachedEntDBOptions, EntDBMemoryOptions, HostHandle, HostStatsUpdate, IClient, ICrypto, IDeleteParams, IDiplomaticClientState, IEntRev, IEntRow, IHostConnectionInfo, IHostRow, IMessage, IMutateOp, IOp, IStateManager, IStoredMessage, IStoredMessageData, IStoredMessageWrite, ITombstone, ITransport, IUpdateParams, LargeBlobRp, LargeBlobUnlock, ListMsgsOpts, OpenDiplomaticClientMainOptions, OpenDiplomaticClientOptions, OpenDiplomaticClientWorkerOptions, OpenedDiplomaticClient, OpenEntDBOptions, ReconcileOpts, ReconcileReport, SetSeedOpts, SyncProgressEvent, WipeOpts, WorkerClientOptions, };
+export { APLD_APPLIED, APLD_ERROR, APLD_PENDING, apldFromStored, asMasterSeed, asSealedMasterKey, b64tob, b64urltob, btob64, btob64url, btoh, bundleHostCodec, CachedEntDB, checksumEntRevs, checksumSet, Clock, cmpBytes, createIdentityBundle, createPrfCred, crypto, Decoder, DEFAULT_PRF_SALT, defaultPeekProgressEvery, defaultWebAuthnRpId, eidCodec, encodeEntRev, Encoder, Enclave, EntDBMemory, EntIDB, EntitiesQuery, EntityID, entStateManager, evalPrf, genSingletonEID, GroupID, hostHTTPTransport, htob, HTTPTransport, IDBSeedStore, IDBStore, IDENTITY_BUNDLE_VERSION, identityBundleCodec, idleProgress, IEntDB, IEntity, isApldState, isLiveEnt, isPendingApply, isTerminalApplyFailure, isTombstone, IStore, LargeBlob, MASTER_SEED_LEN, MasterSeed, MemoryStore, normalizeTags, nullEntDB, nullStateManager, openDiplomaticClient, openEntDB, openIDBStore, PAIR_PACKAGE_VERSION, PairPackage, pairPackageEnvelopeCodec, pairPackagePlainCodec, PasskeySeedStore, prfCapable, PrfSeedStore, revFromEntity, revFromHead, SEALED_MASTER_KEY_LEN, setApld, shouldEmitItemProgress, SingletonStateManager, StateManager, Status, SyncClient, TypedEventEmitter, sealKeyFromPrf, useClient, useClientState, useClientXferState, useStateWatcher, useStateWatcherSuspense, useSyncOnResume, WorkerClient, };
+export type { ApldState, Applier, BundleHost, CachedEntDBOptions, EntDBMemoryOptions, HostHandle, HostStatsUpdate, IClient, ICrypto, IDeleteParams, IdentityBundle, IDiplomaticClientState, IEntRev, IEntRow, IHostConnectionInfo, IHostRow, IMessage, IMutateOp, IOp, IStateManager, IStoredMessage, IStoredMessageData, IStoredMessageWrite, ITombstone, ITransport, IUpdateParams, LargeBlobCreateOpts, LargeBlobRp, ListMsgsOpts, OpenDiplomaticClientMainOptions, OpenDiplomaticClientOptions, OpenDiplomaticClientWorkerOptions, OpenedDiplomaticClient, OpenedPairPackage, OpenEntDBOptions, PairPackageEnvelope, PairPackagePlain, PasskeySeedStoreOpts, PersistPrfSeedMeta, PrfCreateOpts, PrfEvalResult, PrfRp, PrfSeedMeta, PrfSeedStoreOpts, ReconcileOpts, ReconcileReport, SealedMasterKey, SetSeedOpts, SyncProgressEvent, WipeOpts, WorkerClientOptions, };