@interncom/diplomatic 0.20.0 → 0.22.0

package/dist/web/openClient.d.ts

@@ -6,6 +6,11 @@ type OpenDiplomaticClientBase = {
     clock?: IClock;
     /** Max wait for setSeed → Enclave.spawnSyncWorker handshake (default 15s). */
     readyTimeoutMs?: number;
+    /**
+     * Timed `[dip]` traces for local writes, EntDB, and watchers (default false).
+     * Process-wide; same flag as {@link openEntDB}.
+     */
+    verbose?: boolean;
     /**
      * Debounce local write → worker sync (default `defaultSyncDebounceMs`).
      * Use `0` in tests for an immediate upload-queue handoff.

package/dist/web/react/useClient.d.ts

@@ -17,6 +17,11 @@ type UseClientBase = {
      * Set false to notify only after durable commit.
      */
     optimistic?: boolean;
+    /**
+     * Timed `[dip]` traces (default false). See {@link openEntDB} /
+     * {@link openDiplomaticClient}.
+     */
+    verbose?: boolean;
 };
 /**
  * Worker path: IndexedDB on main; sync Worker appears on setSeed via Enclave.

package/dist/web/shared/crypto/enclave.d.ts

@@ -3,7 +3,7 @@ import { Status } from "../consts.ts";
 import { MASTER_SEED_LEN, type MasterSeed, type SealedMasterKey } from "../seed.ts";
 import type { ICrypto, PublicKey } from "../types.ts";
 import { type ValStat } from "../valstat.ts";
-import { type DHKEReq, type DHKEResp, PairRequest } from "./pairing.ts";
+import { type DHKEReq, type DHKEResp } from "./pairing.ts";
 import { type LargeBlobCreateOpts, type LargeBlobRp } from "../webauthn/largeBlob.ts";
 import { type PrfCeremony, type PrfCreateOpts, type PrfEvalOpts, type PrfRp } from "../webauthn/prf.ts";
 export type { LargeBlobCreateOpts, LargeBlobRp };
@@ -60,10 +60,23 @@ export type Identity = {
     kdmFor: (msgHeadEnc: Uint8Array) => Promise<Uint8Array>;
 };
 declare const SEAL_BIND_DOMAIN: Uint8Array<ArrayBufferLike>;
+declare const FP_MODE: Uint8Array<ArrayBufferLike>;
 declare const SEAL_KEY_LEN = 32;
 declare const SEAL_PRF_MIN_LEN = 16;
 /** Minimum musec length (Mandatory User-Space Entropy Contribution). */
 declare const MUSEC_MIN_LEN = 32;
+declare class PairRequest {
+    #private;
+    private constructor();
+    static create(): Promise<ValStat<PairRequest>>;
+    wipe(): void;
+    get dhkeReq(): DHKEReq;
+    finish(dhkeResp: DHKEResp): Promise<ValStat<{
+        enclave: Enclave;
+        hosts: BundleHost[];
+    }>>;
+}
+export type { PairRequest };
 /** Brand `bytes` as {@link MasterSeed} only if length is {@link MASTER_SEED_LEN}. */
 export declare function asMasterSeed(bytes: Uint8Array): ValStat<MasterSeed>;
 export declare class Enclave {
@@ -143,15 +156,24 @@ export declare class Enclave {
     /** UV + overwrite largeBlob with zeros (destroys stored seed material). */
     static clearLargeBlob(credId: Uint8Array, opts?: LargeBlobRp): Promise<Status>;
     /**
-     * Absorb seed‖hosts plaintext (pair AEAD inner).
-     * Encoder/Decoder never see the seed.
+     * Write numbered `n] xxxx xxxx` hex lines plus a # check to /dev/tty.
+     * Paced mode erases the previous line before the next (Enter between).
+     * Web bundles set DIP_CLI_DUMP=false; the write is compiled out.
      */
-    static fromPairPlain(plain: Uint8Array): ValStat<{
-        enclave: Enclave;
-        hosts: BundleHost[];
-    }>;
+    dumpToTty(): Promise<Status>;
     static pairRequest(): Promise<ValStat<PairRequest>>;
-    pairAccept(dhkeReq: DHKEReq, hosts: BundleHost[]): Promise<ValStat<DHKEResp>>;
+    /**
+     * Seals seed+hosts for dhkeReq. Returns dhkeResp to send back.
+     * @param acks Set fields only after explicit user affirmation (e.g. a checkbox).
+     *   Do not default these to `true` in application code.
+     */
+    pairAccept(dhkeReq: DHKEReq, hosts: BundleHost[], acks: {
+        /**
+         * Set `true` only after the user explicitly affirms they control both
+         * devices in this pair. Never hard-code in a client.
+         */
+        userControlsBothSidesOfPair: true;
+    }): Promise<ValStat<DHKEResp>>;
     /**
      * Spawn a new sync Worker from the embedded bundle and inject this enclave's
      * master seed into it (transfer). Seed never goes to a caller-supplied port —
@@ -178,4 +200,4 @@ export declare class Enclave {
 }
 /** Derive seal key from PRF output (domain-separated). Used by enclave seal/unseal. */
 export declare function sealKeyFromPrf(crypto: ICrypto, prf: Uint8Array, domain?: Uint8Array): Promise<ValStat<Uint8Array>>;
-export { MASTER_SEED_LEN, MUSEC_MIN_LEN, SEAL_BIND_DOMAIN, SEAL_KEY_LEN, SEAL_PRF_MIN_LEN, };
+export { FP_MODE, MASTER_SEED_LEN, MUSEC_MIN_LEN, SEAL_BIND_DOMAIN, SEAL_KEY_LEN, SEAL_PRF_MIN_LEN, };

package/dist/web/shared/crypto/noble.d.ts

@@ -1,5 +1,5 @@
 import { type X25519Sk } from "./x25519.ts";
-import type { DerivationSeed, Hash, ICrypto, KeyPair } from "../types.ts";
+import type { Blake3Opts, DerivationSeed, Hash, ICrypto, KeyPair } from "../types.ts";
 /**
  * ICrypto: noble for XSalsa20 + blake3; WebCrypto Ed25519 + X25519
  * (our scalar; RFC 7748 check before trusting pub/DH).
@@ -15,7 +15,7 @@ export declare class NobleCrypto implements ICrypto {
     private importVerifyKey;
     signEd25519(message: Uint8Array | string, secKey: Uint8Array): Promise<Uint8Array>;
     checkSigEd25519(sig: Uint8Array, message: Uint8Array | string, pubKey: Uint8Array): Promise<boolean>;
-    blake3(data: Uint8Array): Promise<Hash>;
+    blake3(data: Uint8Array, opts?: Blake3Opts): Promise<Hash>;
     genX25519(): Promise<{
         priv: X25519Sk;
         pub: Uint8Array;

package/dist/web/shared/crypto/pairing.d.ts

@@ -1,6 +1,4 @@
-import type { BundleHost } from "../codecs/bundleHost.ts";
 import { type ValStat } from "../valstat.ts";
-import { Enclave } from "./enclave.ts";
 import type { X25519Sk } from "./x25519.ts";
 export declare const SEAL_PAIR_DOMAIN: Uint8Array<ArrayBufferLike>;
 export declare const X25519_PUB_LEN = 32;
@@ -20,15 +18,4 @@ export declare function pairKey(sk: X25519Sk, // local X25519 priv
 peer: Uint8Array, // ECDH peer pub (enroller: dhkeReq; enrollee: respPub)
 reqPub: Uint8Array, // enrollee pub, bound into KDF
 respPub: Uint8Array): Promise<ValStat<Uint8Array>>;
-export declare class PairRequest {
-    #private;
-    private constructor();
-    static create(): Promise<ValStat<PairRequest>>;
-    wipe(): void;
-    get dhkeReq(): DHKEReq;
-    finish(dhkeResp: DHKEResp): Promise<ValStat<{
-        enclave: Enclave;
-        hosts: BundleHost[];
-    }>>;
-}
 export {};

package/dist/web/shared/types.d.ts

@@ -125,6 +125,13 @@ export type Hash = Uint8Array & {
 export interface IHostCrypto {
     checkSigEd25519: (sig: Uint8Array, message: Uint8Array | string, pubKey: PublicKey) => Promise<boolean>;
 }
+/** BLAKE3 hash / MAC / KDF (noble: `key` XOR `context`, not both). */
+export type Blake3Opts = {
+    /** 32-byte MAC key. */
+    key?: Uint8Array;
+    /** KDF context (hardcoded, app-specific). */
+    context?: Uint8Array | string;
+};
 export interface ICrypto extends IHostCrypto {
     genRandomBytes: (bytes: number) => Promise<Uint8Array>;
     gen256BitSecureRandomSeed: () => Promise<Uint8Array>;
@@ -132,7 +139,7 @@ export interface ICrypto extends IHostCrypto {
     decryptXSalsa20Poly1305Combined: (headerAndCipher: Uint8Array, key: Uint8Array) => Promise<Uint8Array>;
     deriveEd25519KeyPair: (derivationSeed: DerivationSeed) => Promise<KeyPair>;
     signEd25519: (message: Uint8Array | string, secKey: PrivateKey) => Promise<Uint8Array>;
-    blake3: (data: Uint8Array) => Promise<Hash>;
+    blake3: (data: Uint8Array, opts?: Blake3Opts) => Promise<Hash>;
 }
 export interface IMsgpackCodec {
     encode: (source: unknown) => Uint8Array;

package/dist/web/types.d.ts

@@ -295,7 +295,7 @@ export interface IStateEmitter<T> {
 export interface IClient<Handle extends HostHandle> {
     /** Install session enclave (master seed stays inside enclave). */
     setSeed(enclave: Enclave, opts?: SetSeedOpts): Promise<void>;
-    link(host: IHostConnectionInfo<Handle>): Promise<void>;
+    link(host: IHostConnectionInfo<Handle>, connect?: boolean): Promise<void>;
     unlink(label: string): Promise<void>;
     /** Linked hosts from the protocol store (handle, label, lastSeq, …). */
     hosts(): Promise<IHostRow<Handle>[]>;

package/dist/web/verbose.d.ts

@@ -0,0 +1,4 @@
+/** Turn `[dip]` timings on or off. */
+export declare function setVerbose(v: boolean): void;
+/** Timed `[dip]` line when verbose. */
+export declare function dipLog(msg: string, extra?: object): void;