@interncom/diplomatic 0.13.0 → 0.13.2

package/dist/web/passkey/prf-store.d.ts

@@ -1,4 +1,4 @@
-import { Enclave } from "../shared/crypto/enclave";
+import { Enclave, type PasskeyPrfOpts } from "../shared/crypto/enclave";
 import { type SealedMasterKey } from "../shared/seed";
 import { type ValStat } from "../shared/valstat";
 import type { ISeedStore, SetSeedOpts } from "../types";
@@ -47,11 +47,7 @@ export declare class PrfSeedStore implements ISeedStore {
     /**
      * PRF UV inside Enclave, seal master, persist meta (no PRF leaves Enclave).
      */
-    wrapAndSave(enclave: Enclave, opts?: {
-        salt?: Uint8Array;
-        credId?: Uint8Array;
-        createCredIfNeeded?: boolean;
-    }): Promise<ValStat<Enclave>>;
+    wrapAndSave(enclave: Enclave, opts?: Pick<PasskeyPrfOpts, "salt" | "credId" | "createCredIfNeeded" | "authenticatorAttachment">): Promise<ValStat<Enclave>>;
     load(): Promise<Enclave | void>;
     /** Passkey UV inside Enclave → new session enclave. */
     unlock(): Promise<ValStat<Enclave>>;

package/dist/web/shared/crypto/enclave.d.ts

@@ -9,12 +9,10 @@ import { type PrfCreateOpts, type PrfEvalOpts, type PrfRp } from "../webauthn/pr
 export type { LargeBlobCreateOpts, LargeBlobRp };
 export type { PrfCreateOpts, PrfEvalOpts, PrfRp };
 /** Options for PRF seal/unseal ceremonies (no raw PRF bytes). */
-export type PasskeyPrfOpts = PrfRp & {
-    salt?: Uint8Array;
+export type PasskeyPrfOpts = PrfCreateOpts & {
     credId?: Uint8Array;
     /** Seal only: create a PRF credential first when no credId is known. */
     createCredIfNeeded?: boolean;
-    userName?: string;
 };
 /** Durable PRF-sealed master + public meta (never includes PRF output). */
 export type PrfSealedMaster = {

package/dist/web/shared/webauthn/prf.d.ts

@@ -3,7 +3,10 @@ import { type WebAuthnRp } from "./common.ts";
 export type PrfRp = WebAuthnRp;
 export type PrfCreateOpts = PrfRp & {
     userName?: string;
-    authenticatorAttachment?: string;
+    /** Omit so the UA can offer roaming keys (YubiKey) and third-party providers. */
+    authenticatorAttachment?: "platform" | "cross-platform";
+    /** If set, also request PRF eval during create. `{ prf: {} }` already enables hmac-secret. */
+    salt?: Uint8Array;
 };
 /** Default salt for DIPLOMATIC PRF eval (UTF-8). */
 export declare const DEFAULT_PRF_SALT: Uint8Array<ArrayBufferLike>;