@interncom/diplomatic 0.13.2 → 0.13.4

package/dist/web/passkey/prf-store.d.ts

@@ -47,7 +47,7 @@ export declare class PrfSeedStore implements ISeedStore {
     /**
      * PRF UV inside Enclave, seal master, persist meta (no PRF leaves Enclave).
      */
-    wrapAndSave(enclave: Enclave, opts?: Pick<PasskeyPrfOpts, "salt" | "credId" | "createCredIfNeeded" | "authenticatorAttachment">): Promise<ValStat<Enclave>>;
+    wrapAndSave(enclave: Enclave, opts?: Pick<PasskeyPrfOpts, "salt" | "credId" | "createCredIfNeeded" | "authenticatorAttachment" | "hints">): Promise<ValStat<Enclave>>;
     load(): Promise<Enclave | void>;
     /** Passkey UV inside Enclave → new session enclave. */
     unlock(): Promise<ValStat<Enclave>>;

package/dist/web/shared/consts.d.ts

@@ -40,7 +40,8 @@ export declare enum Status {
     VarLimitExceeded = 26,
     InvalidResponse = 27,
     ConnectionClosed = 28,
-    CryptoError = 29
+    CryptoError = 29,
+    WebAuthnError = 30
 }
 export declare enum APICallName {
     User = 0,

package/dist/web/shared/webauthn/common.d.ts

@@ -7,9 +7,13 @@ export declare const COSE_ALG_EDDSA = -8;
 export declare const COSE_ALG_RS256 = -257;
 /** Prefer modern curves; include RS256 for broader authenticator coverage. */
 export declare const WEBAUTHN_PUB_KEY_PARAMS: PublicKeyCredentialParameters[];
+/** UA preference for the WebAuthn picker. Not exclusive; omit attachment to allow both. */
+export type WebAuthnHint = "security-key" | "client-device" | "hybrid";
 export type WebAuthnRp = {
     rpId?: string;
     rpName?: string;
+    /** Level 3 `hints`. Prefer `security-key` so Android offers USB. */
+    hints?: WebAuthnHint[];
 };
 /**
  * Default WebAuthn RP ID: the full hostname (no eTLD+1 collapse).
@@ -35,6 +39,10 @@ export declare function copyToArrayBuffer(src: Uint8Array): ArrayBuffer;
 export declare function bufferSourceToUint8(src: BufferSource): Uint8Array;
 /** Resolve RP id from opts or `location.hostname`. */
 export declare function resolveWebAuthnRpId(opts?: WebAuthnRp): ValStat<string>;
+/** Last `credentials.create`/`get` throw (name + message). Empty if none. */
+export declare function webAuthnLastError(): string;
+/** Records a WebAuthn DOMException (or other throw) for {@link webAuthnLastError}. */
+export declare function noteWebAuthnError(e: unknown): void;
 /** Success if WebAuthn credentials API is available in this environment. */
 export declare function checkWebAuthn(): Status;
 export declare function asPublicKeyCredential(cred: Credential | null): ValStat<PublicKeyCredential>;

package/dist/web/shared/webauthn/largeBlob.d.ts

@@ -12,7 +12,7 @@ export declare function largeBlobCapable(): Promise<boolean>;
 export declare function largeBlobCreateCred(opts?: LargeBlobCreateOpts): Promise<ValStat<Uint8Array>>;
 /** UV write of opaque bytes to largeBlob. */
 export declare function largeBlobWrite(credId: Uint8Array, data: Uint8Array, opts?: LargeBlobRp): Promise<Status>;
-/** UV read from largeBlob; `credId` undefined = discoverable assertion. */
+/** UV read from largeBlob; `credId` undefined = discoverable then targeted read. */
 export declare function largeBlobRead(credId: Uint8Array | undefined, opts?: LargeBlobRp): Promise<ValStat<{
     blob: Uint8Array;
     credId: Uint8Array;