@interncom/diplomatic 0.12.2 → 0.12.3

package/dist/web/shared/codec.d.ts

@@ -29,6 +29,11 @@ export declare class Encoder {
     writeVarInt(n: number): Status;
     writeVarString(s: string): Status;
     prependBytes(bytes: Uint8Array): void;
+    /**
+     * Append a copy of `bytes`. Parts must not alias caller buffers — callers
+     * often zero sensitive material after encode (seed, PRF, etc.); holding a
+     * live reference would corrupt the eventual {@link result}.
+     */
     writeBytes(bytes: Uint8Array): void;
     writeVarBytes(bytes: Uint8Array): Status;
     writeStruct<T>(codec: ICodecStruct<T>, str: T): Status;

package/dist/web/shared/webauthn/common.d.ts

@@ -24,8 +24,15 @@ export type WebAuthnRp = {
  * Normalizes case and trailing dots. Empty → `"localhost"`.
  */
 export declare function defaultWebAuthnRpId(hostname: string): string;
-/** Copy into a fresh ArrayBuffer-backed view (DOM BufferSource typing). */
-export declare function copyToArrayBuffer(src: Uint8Array): Uint8Array;
+/**
+ * Fresh standalone {@link ArrayBuffer} copy of `src`.
+ * Safari (and some Chromium paths) are picky about BufferSource for
+ * largeBlob write / allowCredentials id — pass a real ArrayBuffer, not a
+ * view into a larger pooled buffer.
+ */
+export declare function copyToArrayBuffer(src: Uint8Array): ArrayBuffer;
+/** Copy WebAuthn blob / BufferSource into an owned Uint8Array. */
+export declare function bufferSourceToUint8(src: BufferSource): Uint8Array;
 /** Resolve RP id from opts or `location.hostname`. */
 export declare function resolveWebAuthnRpId(opts?: WebAuthnRp): ValStat<string>;
 /** Success if WebAuthn credentials API is available in this environment. */

package/dist/web/stores/idb/seed.d.ts

@@ -10,6 +10,8 @@ export declare class IDBSeedStore implements ISeedStore {
     /**
      * Hold enclave in memory only. Durable identity is sealed meta
      * ({@link openPrfStore} / {@link persistPrfMeta}), never plain seed.
+     * Pins identity (nonce+hash) on first save; later saves must match
+     * (largeBlob / hex / PRF unlock cannot switch masters under this DB).
      * `opts.persist` is ignored (kept for API compatibility).
      *
      * TODO(passphrase): when PRF is missing, `persist: true` (or a dedicated
@@ -20,7 +22,7 @@ export declare class IDBSeedStore implements ISeedStore {
     load(): Promise<Enclave | undefined>;
     /**
      * Drop in-memory enclave and any leftover legacy hex. Keeps {@link K_PRF_META}
-     * so daily unlock via PRF still works after a soft lock.
+     * and {@link K_ID_PIN} so unlock / largeBlob restore still match this device.
      */
     clearSession(): Promise<void>;
     wipe(): Promise<void>;

package/dist/web/stores/identityPin.d.ts

@@ -0,0 +1,19 @@
+import type { Enclave } from "../shared/crypto/enclave";
+import type { ICrypto } from "../shared/types";
+/**
+ * Prefix so pin paths never collide with user host labels ("host", …).
+ * Full path: `diplomatic.pin/<hex(nonce)>`.
+ */
+export declare const ID_PIN_PATH_PREFIX = "diplomatic.pin/";
+/** Durable pin row: path-nonce + digest of path-scoped public key. */
+export type IdPin = {
+    n: Uint8Array;
+    h: Uint8Array;
+};
+/** keyPath for deriveIdentity from the stored nonce. */
+export declare function idPinPath(nonce: Uint8Array): string;
+export declare function idPinDigest(crypto: ICrypto, enclave: Enclave, nonce: Uint8Array): Promise<Uint8Array>;
+export declare function makeIdPin(crypto: ICrypto, enclave: Enclave): Promise<IdPin>;
+export declare function idPinMatches(crypto: ICrypto, enclave: Enclave, pin: IdPin): Promise<boolean>;
+export declare function decodeIdPin(raw: unknown): IdPin | undefined;
+export declare function cloneIdPin(pin: IdPin): IdPin;

package/dist/web/stores/memory/seed.d.ts

@@ -1,8 +1,14 @@
 import type { Enclave } from "../../shared/crypto/enclave";
+import type { ICrypto } from "../../shared/types";
 import type { ISeedStore, SetSeedOpts } from "../../types";
+import { type IdPin } from "../identityPin";
 export declare class MemorySeedStore implements ISeedStore {
+    #private;
     enclave?: Enclave;
+    constructor(crypto: ICrypto);
     save(enclave: Enclave, _opts?: SetSeedOpts): Promise<Enclave>;
     load(): Promise<Enclave | undefined>;
     wipe(): Promise<void>;
+    /** Test helper: snapshot of durable pin (nonce+hash only). */
+    peekPin(): IdPin | undefined;
 }