@interncom/diplomatic 0.21.1 → 0.22.0

package/dist/web/shared/crypto/enclave.d.ts

@@ -3,7 +3,7 @@ import { Status } from "../consts.ts";
 import { MASTER_SEED_LEN, type MasterSeed, type SealedMasterKey } from "../seed.ts";
 import type { ICrypto, PublicKey } from "../types.ts";
 import { type ValStat } from "../valstat.ts";
-import { type DHKEReq, type DHKEResp, PairRequest } from "./pairing.ts";
+import { type DHKEReq, type DHKEResp } from "./pairing.ts";
 import { type LargeBlobCreateOpts, type LargeBlobRp } from "../webauthn/largeBlob.ts";
 import { type PrfCeremony, type PrfCreateOpts, type PrfEvalOpts, type PrfRp } from "../webauthn/prf.ts";
 export type { LargeBlobCreateOpts, LargeBlobRp };
@@ -65,6 +65,18 @@ declare const SEAL_KEY_LEN = 32;
 declare const SEAL_PRF_MIN_LEN = 16;
 /** Minimum musec length (Mandatory User-Space Entropy Contribution). */
 declare const MUSEC_MIN_LEN = 32;
+declare class PairRequest {
+    #private;
+    private constructor();
+    static create(): Promise<ValStat<PairRequest>>;
+    wipe(): void;
+    get dhkeReq(): DHKEReq;
+    finish(dhkeResp: DHKEResp): Promise<ValStat<{
+        enclave: Enclave;
+        hosts: BundleHost[];
+    }>>;
+}
+export type { PairRequest };
 /** Brand `bytes` as {@link MasterSeed} only if length is {@link MASTER_SEED_LEN}. */
 export declare function asMasterSeed(bytes: Uint8Array): ValStat<MasterSeed>;
 export declare class Enclave {
@@ -149,16 +161,19 @@ export declare class Enclave {
      * Web bundles set DIP_CLI_DUMP=false; the write is compiled out.
      */
     dumpToTty(): Promise<Status>;
+    static pairRequest(): Promise<ValStat<PairRequest>>;
     /**
-     * Absorb seed‖hosts plaintext (pair AEAD inner).
-     * Encoder/Decoder never see the seed.
+     * Seals seed+hosts for dhkeReq. Returns dhkeResp to send back.
+     * @param acks Set fields only after explicit user affirmation (e.g. a checkbox).
+     *   Do not default these to `true` in application code.
      */
-    static fromPairPlain(plain: Uint8Array): ValStat<{
-        enclave: Enclave;
-        hosts: BundleHost[];
-    }>;
-    static pairRequest(): Promise<ValStat<PairRequest>>;
-    pairAccept(dhkeReq: DHKEReq, hosts: BundleHost[]): Promise<ValStat<DHKEResp>>;
+    pairAccept(dhkeReq: DHKEReq, hosts: BundleHost[], acks: {
+        /**
+         * Set `true` only after the user explicitly affirms they control both
+         * devices in this pair. Never hard-code in a client.
+         */
+        userControlsBothSidesOfPair: true;
+    }): Promise<ValStat<DHKEResp>>;
     /**
      * Spawn a new sync Worker from the embedded bundle and inject this enclave's
      * master seed into it (transfer). Seed never goes to a caller-supplied port —

package/dist/web/shared/crypto/pairing.d.ts

@@ -1,6 +1,4 @@
-import type { BundleHost } from "../codecs/bundleHost.ts";
 import { type ValStat } from "../valstat.ts";
-import { Enclave } from "./enclave.ts";
 import type { X25519Sk } from "./x25519.ts";
 export declare const SEAL_PAIR_DOMAIN: Uint8Array<ArrayBufferLike>;
 export declare const X25519_PUB_LEN = 32;
@@ -20,15 +18,4 @@ export declare function pairKey(sk: X25519Sk, // local X25519 priv
 peer: Uint8Array, // ECDH peer pub (enroller: dhkeReq; enrollee: respPub)
 reqPub: Uint8Array, // enrollee pub, bound into KDF
 respPub: Uint8Array): Promise<ValStat<Uint8Array>>;
-export declare class PairRequest {
-    #private;
-    private constructor();
-    static create(): Promise<ValStat<PairRequest>>;
-    wipe(): void;
-    get dhkeReq(): DHKEReq;
-    finish(dhkeResp: DHKEResp): Promise<ValStat<{
-        enclave: Enclave;
-        hosts: BundleHost[];
-    }>>;
-}
 export {};