@interncom/diplomatic 0.17.0 → 0.18.3

package/dist/web/shared/crypto/enclave.d.ts

@@ -62,13 +62,18 @@ export type Identity = {
 declare const SEAL_BIND_DOMAIN: Uint8Array<ArrayBufferLike>;
 declare const SEAL_KEY_LEN = 32;
 declare const SEAL_PRF_MIN_LEN = 16;
+/** Minimum musec length (Mandatory User-Space Entropy Contribution). */
+declare const MUSEC_MIN_LEN = 32;
 /** Brand `bytes` as {@link MasterSeed} only if length is {@link MASTER_SEED_LEN}. */
 export declare function asMasterSeed(bytes: Uint8Array): ValStat<MasterSeed>;
 export declare class Enclave {
     #private;
     private constructor();
-    /** New enclave with a fresh 32-byte master seed. */
-    static fromRandom(): Promise<Enclave>;
+    /**
+     * New enclave: blake3(OS CSPRNG ‖ musec). musec is required (MUSEC_MIN_LEN).
+     * Mix stays in this method; musec is wiped before return.
+     */
+    static fromRandom(musec: Uint8Array): Promise<ValStat<Enclave>>;
     /**
      * Construct from raw master seed bytes (import / bootstrap only).
      * Copies the seed so callers may zero their buffer after success.
@@ -99,6 +104,16 @@ export declare class Enclave {
         enclave: Enclave;
         credId: Uint8Array;
     }>>;
+    /**
+     * AEAD-seal master under caller-supplied PRF IKM (CLI hmac-secret).
+     * Wipes `ikm` before return. Ciphertext only — never the seed.
+     */
+    sealWithIkm(ikm: Uint8Array): Promise<ValStat<SealedMasterKey>>;
+    /**
+     * Unseal a PRF binding given IKM (CLI hmac-secret eval). Returns Enclave.
+     * Wipes `ikm` before return.
+     */
+    static unsealWithIkm(sealed: SealedMasterKey, ikm: Uint8Array): Promise<ValStat<Enclave>>;
     /**
      * UV + write IdentityBundle (seed + hosts) to largeBlob.
      * Encode and WebAuthn write complete inside this method; nothing seed-bearing
@@ -163,4 +178,4 @@ export declare class Enclave {
 }
 /** Derive seal key from PRF output (domain-separated). Used by enclave seal/unseal. */
 export declare function sealKeyFromPrf(crypto: ICrypto, prf: Uint8Array, domain?: Uint8Array): Promise<ValStat<Uint8Array>>;
-export { MASTER_SEED_LEN, SEAL_BIND_DOMAIN, SEAL_KEY_LEN, SEAL_PRF_MIN_LEN };
+export { MASTER_SEED_LEN, MUSEC_MIN_LEN, SEAL_BIND_DOMAIN, SEAL_KEY_LEN, SEAL_PRF_MIN_LEN, };

package/dist/web/shared/exim.d.ts

@@ -1,12 +1,21 @@
 import { Enclave } from "./crypto/enclave.ts";
 import { ICrypto, IMessageHead } from "./types.ts";
 import { ValStat } from "./valstat.ts";
-export declare const defaultFileExtension = "dpl";
-export declare function encodeFile(keyLbl: string, keyIdx: number, msgs: Iterable<{
-    head: IMessageHead;
-    body?: Uint8Array;
-}>, crypto: ICrypto, enclave: Enclave): Promise<ValStat<Uint8Array>>;
-export declare function decodeFile(file: Uint8Array, crypto: ICrypto, enclave: Enclave): Promise<ValStat<{
-    head: IMessageHead;
-    body?: Uint8Array;
-}[]>>;
+export declare namespace Exim {
+    const defaultFileExtension = "dpl";
+    function encodeFile(keyLbl: string, keyIdx: number, msgs: Iterable<{
+        head: IMessageHead;
+        body?: Uint8Array;
+    }>, crypto: ICrypto, enclave: Enclave): Promise<ValStat<Uint8Array>>;
+    function decodeFile(file: Uint8Array, crypto: ICrypto, enclave: Enclave): Promise<ValStat<{
+        head: IMessageHead;
+        body?: Uint8Array;
+    }[]>>;
+    function migrateFile(file: Uint8Array, crypto: ICrypto, enclaveIn: Enclave, enclaveOut: Enclave, transform: (msgs: Iterable<{
+        head: IMessageHead;
+        body?: Uint8Array;
+    }>) => Iterable<{
+        head: IMessageHead;
+        body?: Uint8Array;
+    }>): Promise<ValStat<Uint8Array>>;
+}

package/dist/web/shared/webauthn/prf.d.ts

@@ -1,8 +1,9 @@
 import { type AuthenticatorAttachmentName, type WebAuthnRp } from "./common.ts";
-export type PrfRp = WebAuthnRp;
-export type PrfCreateOpts = PrfRp & {
-    /** WebAuthn user.name — stable account id. */
+export type PrfRp = WebAuthnRp & {
+    /** WebAuthn user.name — stable account id shown on the binding key. */
     userName?: string;
+};
+export type PrfCreateOpts = PrfRp & {
     /** WebAuthn user.displayName — human nick. */
     displayName?: string;
     /** Omit so the UA can offer roaming keys (YubiKey) and third-party providers. */
@@ -14,7 +15,7 @@ export type PrfCreateOpts = PrfRp & {
 };
 /** Default salt for DIPLOMATIC PRF eval (UTF-8). */
 export declare const DEFAULT_PRF_SALT: Uint8Array<ArrayBufferLike>;
-/** Default WebAuthn user.name / displayName when none is supplied. */
+/** Last-resort WebAuthn user.name when the app omits userName, rpId, and rpName. */
 export declare const DEFAULT_PRF_USER_NAME = "diplomatic-prf";
 /** Public ceremony facts (no PRF bytes). */
 export type PrfCeremony = {