@interncom/diplomatic 0.12.3 → 0.12.4

package/dist/web/passkey/prf-store.d.ts

@@ -9,7 +9,10 @@ export type PrfSeedMeta = {
     sealedMaster: SealedMasterKey;
     /** PRF salt used at wrap time. */
     salt: Uint8Array;
-    /** Optional allowCredentials id. */
+    /**
+     * Last PRF passkey id (allowCredentials). The sealed-meta row itself is
+     * the breadcrumb that this device enrolled PRF unlock.
+     */
     credId?: Uint8Array;
 };
 /**

package/dist/web/shared/crypto/enclave.d.ts

@@ -71,10 +71,14 @@ export declare class Enclave {
     /**
      * UV + PRF ceremony, then unseal durable master into a new Enclave.
      * Callers never supply PRF bytes — only sealed meta + RP/salt/credId.
+     * Returns the credential id used so stores can persist it (skip picker next time).
      */
     static unsealWithPasskey(crypto: ICrypto, sealedMaster: SealedMasterKey, opts: PasskeyPrfOpts & {
         salt: Uint8Array;
-    }): Promise<ValStat<Enclave>>;
+    }): Promise<ValStat<{
+        enclave: Enclave;
+        credId: Uint8Array;
+    }>>;
     /**
      * UV + write IdentityBundle (seed + hosts) to largeBlob.
      * Encode and WebAuthn write complete inside this method; nothing seed-bearing

package/dist/web/stores/idb/seed.d.ts

@@ -29,6 +29,8 @@ export declare class IDBSeedStore implements ISeedStore {
     loadPrfMeta(): Promise<PrfSeedMeta | undefined>;
     persistPrfMeta(meta: PrfSeedMeta | undefined): Promise<void>;
     hasPrfMeta(): Promise<boolean>;
+    /** Last PRF passkey id, if this device has a sealed PRF identity. */
+    lastPrfCredId(): Promise<Uint8Array | undefined>;
     openPrfStore(opts: Omit<PrfSeedStoreOpts, "crypto" | "persistMeta" | "meta"> & {
         crypto?: ICrypto;
     }): Promise<PrfSeedStore>;