@interncom/diplomatic 0.14.0 → 0.15.0

package/dist/web/passkey/seed.d.ts

@@ -1,9 +1,7 @@
 import { Enclave } from "../shared/crypto/enclave";
 import { type ValStat } from "../shared/valstat";
 import type { ISeedStore, SetSeedOpts } from "../types";
-import { type LargeBlobRp } from "./largeBlob";
-export { defaultWebAuthnRpId } from "./webauthn";
-export { LargeBlob, type LargeBlobCreateOpts, type LargeBlobRp, } from "./largeBlob";
+import type { LargeBlobRp } from "../shared/webauthn/largeBlob";
 export type PasskeySeedStoreOpts = LargeBlobRp & {
     credId?: Uint8Array;
 };

package/dist/web/shared/codecs/identityBundle.d.ts

@@ -1,25 +1,12 @@
 import { ICodecStruct } from "../codec.ts";
-import { type MasterSeed } from "../seed.ts";
-import { type ValStat } from "../valstat.ts";
 import { type BundleHost } from "./bundleHost.ts";
 export { type BundleHost, bundleHostCodec } from "./bundleHost.ts";
-export declare const IDENTITY_BUNDLE_VERSION = 1;
-export type IdentityBundle = {
-    v: number;
-    masterSeed: MasterSeed;
+export type IdentityHosts = {
     hosts: BundleHost[];
 };
 /**
- * IdentityBundle wire layout:
- *   v: varint
- *   masterSeed: 32 fixed bytes
+ * Host list on the IdentityBundle wire:
  *   hostsLen: varint
  *   hosts: hostsLen × BundleHost
  */
-export declare const identityBundleCodec: ICodecStruct<IdentityBundle>;
-/**
- * Build a wire-format identity bundle from a branded {@link MasterSeed} + hosts.
- * Codec/tests only. Runtime seed I/O must go through Enclave.persistToLargeBlob
- * — never encode then hand seed-bearing bytes to outer layers.
- */
-export declare function createIdentityBundle(masterSeed: MasterSeed, hosts: BundleHost[]): ValStat<IdentityBundle>;
+export declare const identityHostsCodec: ICodecStruct<IdentityHosts>;

package/dist/web/shared/crypto/enclave.d.ts

@@ -125,6 +125,14 @@ export declare class Enclave {
     }>>;
     /** UV + overwrite largeBlob with zeros (destroys stored seed material). */
     static clearLargeBlob(credId: Uint8Array, opts?: LargeBlobRp): Promise<Status>;
+    /**
+     * Absorb seed‖hosts plaintext (pair AEAD inner).
+     * Encoder/Decoder never see the seed.
+     */
+    static fromPairPlain(plain: Uint8Array): ValStat<{
+        enclave: Enclave;
+        hosts: BundleHost[];
+    }>;
     static pairRequest(): Promise<ValStat<PairRequest>>;
     pairAccept(dhkeReq: DHKEReq, hosts: BundleHost[]): Promise<ValStat<DHKEResp>>;
     /**

package/dist/web/shared/webauthn/common.d.ts

@@ -1,6 +1,10 @@
 import { Status } from "../consts.ts";
 import { type ValStat } from "../valstat.ts";
 export declare const WEBAUTHN_CHAL_LEN = 32;
+/** Default RP name shown in the WebAuthn picker. */
+export declare const DEFAULT_WEBAUTHN_RP_NAME = "DIPLOMATIC";
+/** WebAuthn PublicKeyCredentialType. */
+export declare const WEBAUTHN_CRED_TYPE: "public-key";
 /** COSE algorithm identifiers for WebAuthn `pubKeyCredParams`. */
 export declare const COSE_ALG_ES256 = -7;
 export declare const COSE_ALG_EDDSA = -8;

package/dist/web/shared/webauthn/largeBlob.d.ts

@@ -1,4 +1,3 @@
-import { Status } from "../consts.ts";
 import { type ValStat } from "../valstat.ts";
 import { type WebAuthnRp } from "./common.ts";
 export type LargeBlobRp = WebAuthnRp;
@@ -10,8 +9,6 @@ export type LargeBlobCreateOpts = LargeBlobRp & {
 export declare function largeBlobCapable(): Promise<boolean>;
 /** Create discoverable largeBlob-capable credential; returns credential id. */
 export declare function largeBlobCreateCred(opts?: LargeBlobCreateOpts): Promise<ValStat<Uint8Array>>;
-/** UV write of opaque bytes to largeBlob. */
-export declare function largeBlobWrite(credId: Uint8Array, data: Uint8Array, opts?: LargeBlobRp): Promise<Status>;
 /** UV read from largeBlob; `credId` undefined = discoverable then targeted read. */
 export declare function largeBlobRead(credId: Uint8Array | undefined, opts?: LargeBlobRp): Promise<ValStat<{
     blob: Uint8Array;

package/dist/web/shared/webauthn/prf.d.ts

@@ -1,11 +1,13 @@
-import { type ValStat } from "../valstat.ts";
 import { type AuthenticatorAttachmentName, type WebAuthnRp } from "./common.ts";
 export type PrfRp = WebAuthnRp;
 export type PrfCreateOpts = PrfRp & {
+    /** WebAuthn user.name — stable account id. */
     userName?: string;
+    /** WebAuthn user.displayName — human nick. */
+    displayName?: string;
     /** Omit so the UA can offer roaming keys (YubiKey) and third-party providers. */
     authenticatorAttachment?: "platform" | "cross-platform";
-    /** Seal salt (eval is on get, not create — some UAs throw on create-time eval). */
+    /** PRF salt. Tried at create; some UAs only eval on get(). */
     salt?: Uint8Array;
     /** Already-bound cred ids so create does not assert an existing key. */
     excludeCredentials?: readonly Uint8Array[];
@@ -14,8 +16,6 @@ export type PrfCreateOpts = PrfRp & {
 export declare const DEFAULT_PRF_SALT: Uint8Array<ArrayBufferLike>;
 /** Default WebAuthn user.name / displayName when none is supplied. */
 export declare const DEFAULT_PRF_USER_NAME = "diplomatic-prf";
-/** Bytes of PRF output we consume (first N of `results.first`). */
-export declare const PRF_OUTPUT_LEN = 32;
 /** Public ceremony facts (no PRF bytes). */
 export type PrfCeremony = {
     credId: Uint8Array;
@@ -24,13 +24,6 @@ export type PrfCeremony = {
     transports?: string[];
     aaguid?: Uint8Array;
 };
-export type PrfCreateResult = PrfCeremony & {
-    prfEnabled: boolean;
-};
-/** Internal: PRF output + cred id. For Enclave only — do not re-export to apps. */
-export type PrfEvalResult = PrfCeremony & {
-    prf: Uint8Array;
-};
 export type PrfEvalOpts = PrfRp & {
     /** One id, or every bound id so a spare key can assert in one get(). */
     credId?: Uint8Array | readonly Uint8Array[];
@@ -38,10 +31,3 @@ export type PrfEvalOpts = PrfRp & {
 };
 /** Best-effort: client advertises PRF extension. */
 export declare function prfCapable(): Promise<boolean>;
-/** Create a discoverable credential that enables PRF. */
-export declare function createPrfCred(opts?: PrfCreateOpts): Promise<ValStat<PrfCreateResult>>;
-/**
- * Evaluate PRF (UV). Returns PRF bytes — only Enclave should call this and must
- * zero/drop PRF after seal/unseal. Apps must not hold PRF alongside sealed meta.
- */
-export declare function evalPrf(opts?: PrfEvalOpts): Promise<ValStat<PrfEvalResult>>;