@interncom/diplomatic 0.13.6 → 0.14.1

package/dist/cli/shared/webauthn/prf.d.ts

@@ -1,28 +1,44 @@
 import { type ValStat } from "../valstat.ts";
-import { type WebAuthnRp } from "./common.ts";
+import { type AuthenticatorAttachmentName, type WebAuthnRp } from "./common.ts";
 export type PrfRp = WebAuthnRp;
 export type PrfCreateOpts = PrfRp & {
+    /** WebAuthn user.name — stable account id. */
     userName?: string;
+    /** WebAuthn user.displayName — human nick. */
+    displayName?: string;
     /** Omit so the UA can offer roaming keys (YubiKey) and third-party providers. */
     authenticatorAttachment?: "platform" | "cross-platform";
-    /** Seal salt (eval is on get, not create — some UAs throw on create-time eval). */
+    /** PRF salt. Tried at create; some UAs only eval on get(). */
     salt?: Uint8Array;
+    /** Already-bound cred ids so create does not assert an existing key. */
+    excludeCredentials?: readonly Uint8Array[];
 };
 /** Default salt for DIPLOMATIC PRF eval (UTF-8). */
 export declare const DEFAULT_PRF_SALT: Uint8Array<ArrayBufferLike>;
+/** Default WebAuthn user.name / displayName when none is supplied. */
+export declare const DEFAULT_PRF_USER_NAME = "diplomatic-prf";
 /** Bytes of PRF output we consume (first N of `results.first`). */
 export declare const PRF_OUTPUT_LEN = 32;
-export type PrfCreateResult = {
+/** Public ceremony facts (no PRF bytes). */
+export type PrfCeremony = {
     credId: Uint8Array;
+    userId?: Uint8Array;
+    attachment?: AuthenticatorAttachmentName;
+    transports?: string[];
+    aaguid?: Uint8Array;
+};
+export type PrfCreateResult = PrfCeremony & {
     prfEnabled: boolean;
+    /** Present when the UA evaluated PRF during create (no second get). */
+    prf?: Uint8Array;
 };
 /** Internal: PRF output + cred id. For Enclave only — do not re-export to apps. */
-export type PrfEvalResult = {
+export type PrfEvalResult = PrfCeremony & {
     prf: Uint8Array;
-    credId: Uint8Array;
 };
 export type PrfEvalOpts = PrfRp & {
-    credId?: Uint8Array;
+    /** One id, or every bound id so a spare key can assert in one get(). */
+    credId?: Uint8Array | readonly Uint8Array[];
     salt?: Uint8Array;
 };
 /** Best-effort: client advertises PRF extension. */

package/dist/web/index.d.ts

@@ -27,8 +27,8 @@ import type { SyncProgressEvent } from "./progress";
 import { defaultPeekProgressEvery, idleProgress, shouldEmitItemProgress } from "./progress";
 import { defaultWebAuthnRpId, PasskeySeedStore } from "./passkey/seed";
 import { DEFAULT_PRF_SALT, prfCapable, type PrfRp } from "./shared/webauthn/prf";
-import { PrfSeedStore } from "./passkey/prf-store";
-import type { PersistPrfSeedMeta, PrfSeedMeta, PrfSeedStoreOpts } from "./passkey/prf-store";
+import { KEYRING_MAX, keyringCredIds, keyringKind, keyringLabel, PrfSeedStore } from "./passkey/prf-store";
+import type { Keyring, KeyringEntry, KeyringRow, PersistKeyring, PrfSeedStoreOpts } from "./passkey/prf-store";
 import type { PasskeySeedStoreOpts } from "./passkey/seed";
 import { type BundleHost } from "./shared/codecs/bundleHost";
 import { asDHKEReq, asDHKEResp, PairRequest } from "./shared/crypto/pairing";
@@ -39,8 +39,8 @@ import { openDiplomaticClient, type OpenDiplomaticClientMainOptions, type OpenDi
 import { WorkerClient } from "./worker/client";
 import type { WorkerClientOptions } from "./worker/client";
 import type { WipeOpts } from "./types";
-/** Platform advertises largeBlob (not a guarantee the authenticator has it). */
+/** Platform advertises largeBlob (not a guarantee the binding key has it). */
 export declare function largeBlobCapable(): Promise<boolean>;
 export { webAuthnLastError } from "./shared/webauthn/common";
-export { APLD_APPLIED, APLD_ERROR, APLD_PENDING, apldFromStored, asDHKEReq, asDHKEResp, asSealedMasterKey, b64tob, b64urltob, btob64, btob64url, btoh, CachedEntDB, checksumEntRevs, checksumSet, Clock, cmpBytes, crypto, Decoder, DEFAULT_PRF_SALT, defaultPeekProgressEvery, defaultWebAuthnRpId, eidCodec, Enclave, encodeEntRev, Encoder, EntDBMemory, EntIDB, EntitiesQuery, EntityID, entStateManager, genSingletonEID, GroupID, hostHTTPTransport, htob, HTTPTransport, IDBSeedStore, IDBStore, idleProgress, IEntDB, IEntity, isApldState, isLiveEnt, isPendingApply, isTerminalApplyFailure, isTombstone, IStore, MASTER_SEED_LEN, MemoryStore, normalizeTags, nullEntDB, nullStateManager, openDiplomaticClient, openEntDB, openIDBStore, PairRequest, PasskeySeedStore, prfCapable, PrfSeedStore, revFromEntity, revFromHead, SEALED_MASTER_KEY_LEN, setApld, shouldEmitItemProgress, SingletonStateManager, StateManager, Status, SyncClient, TypedEventEmitter, useClient, useClientState, useClientXferState, useStateWatcher, useStateWatcherSuspense, useSyncOnResume, WorkerClient, };
-export type { ApldState, Applier, BundleHost, CachedEntDBOptions, DHKEReq, DHKEResp, EntDBMemoryOptions, HostHandle, HostStatsUpdate, IClient, ICrypto, IDeleteParams, IDiplomaticClientState, IEntRev, IEntRow, IHostConnectionInfo, IHostRow, IMessage, IMutateOp, IOp, IStateManager, IStoredMessage, IStoredMessageData, IStoredMessageWrite, ITombstone, ITransport, IUpdateParams, ListMsgsOpts, OpenDiplomaticClientMainOptions, OpenDiplomaticClientOptions, OpenDiplomaticClientWorkerOptions, OpenedDiplomaticClient, OpenEntDBOptions, PairPackagePlain, PasskeySeedStoreOpts, PersistPrfSeedMeta, PrfRp, PrfSeedMeta, PrfSeedStoreOpts, ReconcileOpts, ReconcileReport, SealedMasterKey, SetSeedOpts, SyncProgressEvent, WipeOpts, WorkerClientOptions, };
+export { APLD_APPLIED, APLD_ERROR, APLD_PENDING, apldFromStored, asDHKEReq, asDHKEResp, asSealedMasterKey, b64tob, b64urltob, btob64, btob64url, btoh, CachedEntDB, checksumEntRevs, checksumSet, Clock, cmpBytes, crypto, Decoder, DEFAULT_PRF_SALT, defaultPeekProgressEvery, defaultWebAuthnRpId, eidCodec, Enclave, encodeEntRev, Encoder, EntDBMemory, EntIDB, EntitiesQuery, EntityID, entStateManager, genSingletonEID, GroupID, hostHTTPTransport, htob, HTTPTransport, IDBSeedStore, IDBStore, idleProgress, IEntDB, IEntity, isApldState, isLiveEnt, isPendingApply, isTerminalApplyFailure, isTombstone, IStore, KEYRING_MAX, keyringCredIds, keyringKind, keyringLabel, MASTER_SEED_LEN, MemoryStore, normalizeTags, nullEntDB, nullStateManager, openDiplomaticClient, openEntDB, openIDBStore, PairRequest, PasskeySeedStore, prfCapable, PrfSeedStore, revFromEntity, revFromHead, SEALED_MASTER_KEY_LEN, setApld, shouldEmitItemProgress, SingletonStateManager, StateManager, Status, SyncClient, TypedEventEmitter, useClient, useClientState, useClientXferState, useStateWatcher, useStateWatcherSuspense, useSyncOnResume, WorkerClient, };
+export type { ApldState, Applier, BundleHost, CachedEntDBOptions, DHKEReq, DHKEResp, EntDBMemoryOptions, HostHandle, HostStatsUpdate, IClient, ICrypto, IDeleteParams, IDiplomaticClientState, IEntRev, IEntRow, IHostConnectionInfo, IHostRow, IMessage, IMutateOp, IOp, IStateManager, IStoredMessage, IStoredMessageData, IStoredMessageWrite, ITombstone, ITransport, IUpdateParams, Keyring, KeyringEntry, KeyringRow, ListMsgsOpts, OpenDiplomaticClientMainOptions, OpenDiplomaticClientOptions, OpenDiplomaticClientWorkerOptions, OpenedDiplomaticClient, OpenEntDBOptions, PairPackagePlain, PasskeySeedStoreOpts, PersistKeyring, PrfRp, PrfSeedStoreOpts, ReconcileOpts, ReconcileReport, SealedMasterKey, SetSeedOpts, SyncProgressEvent, WipeOpts, WorkerClientOptions, };