@interncom/diplomatic 0.21.1 → 0.23.0

package/dist/cli/shared/codecs/kdm.d.ts

@@ -0,0 +1,6 @@
+import { ICodecStruct } from "../codec.ts";
+export interface IKDM {
+    label: string;
+    index: number;
+}
+export declare const kdmCodec: ICodecStruct<IKDM>;

package/dist/cli/shared/codecs/notifItem.d.ts

@@ -1,6 +1,8 @@
 import { ICodecStruct } from "../codec.ts";
+import { type HostRlm } from "../crypto/derivation.ts";
 export interface IBagNotifItem {
     seq: number;
+    rlm: HostRlm;
     headCph: Uint8Array;
     bodyCph?: Uint8Array;
 }

package/dist/cli/shared/crypto/derivation.d.ts

@@ -0,0 +1,45 @@
+import { type IKDM } from "../codecs/kdm.ts";
+import { type ValStat } from "../valstat.ts";
+export declare const Purpose: {
+    readonly Identity: "diplomatic.identity.v1";
+    readonly Cipher: "diplomatic.cipher.v1";
+    readonly Bind: "diplomatic.bind.v1";
+    readonly BindTag: "diplomatic.bindtag.v1";
+    readonly Fingerprint: "diplomatic.fingerprint.v1";
+    readonly Pair: "diplomatic.qrpair.v1";
+    readonly BagKdm: "diplomatic.bagkdm.v1";
+    readonly RealmKey: "diplomatic.realmKey.v1";
+    readonly RealmID: "diplomatic.realmID.v1";
+    readonly HostRLM: "diplomatic.hostRLM.v1";
+};
+export type Purpose = typeof Purpose[keyof typeof Purpose];
+declare const pdkSymbol: unique symbol;
+export type PurposeDerivedKey<P extends Purpose> = Uint8Array & {
+    readonly [pdkSymbol]: P;
+};
+declare const childKeySymbol: unique symbol;
+export type ChildKey<P extends Purpose> = Uint8Array & {
+    readonly [childKeySymbol]: P;
+};
+export type PDK = {
+    [K in keyof typeof Purpose]: ChildKey<(typeof Purpose)[K]>;
+};
+/** Host-stamped bag rlm. Peek, pull, and bag signatures use this. */
+export type HostRlm = PDK["HostRLM"];
+export declare const nullKDM: IKDM;
+export declare function asChildKey<P extends Purpose>(bytes: Uint8Array, _purpose: P): ValStat<ChildKey<P>>;
+export declare function asHostRlm(bytes: Uint8Array): ValStat<HostRlm>;
+export declare function derivePDK<P extends Purpose>({ parent, purpose, }: {
+    parent: Uint8Array;
+    purpose: P;
+}): Promise<ValStat<PurposeDerivedKey<P>>>;
+export declare function deriveChild<P extends Purpose>({ pdk, kdm, }: {
+    pdk: PurposeDerivedKey<P>;
+    kdm: Uint8Array | IKDM;
+}): Promise<ValStat<ChildKey<P>>>;
+export declare function deriveKey<P extends Purpose>({ parent, purpose, kdm, }: {
+    parent: Uint8Array;
+    purpose: P;
+    kdm: Uint8Array | IKDM;
+}): Promise<ValStat<ChildKey<P>>>;
+export {};

package/dist/cli/shared/crypto/enclave.d.ts

@@ -1,43 +1,18 @@
 import type { BundleHost } from "../codecs/bundleHost.ts";
+import type { IKDM } from "../codecs/kdm.ts";
 import { Status } from "../consts.ts";
-import { MASTER_SEED_LEN, type MasterSeed, type SealedMasterKey } from "../seed.ts";
-import type { ICrypto, PublicKey } from "../types.ts";
+import { type MasterSeed, type SealedMasterKey } from "../seed.ts";
+import type { PublicKey } from "../types.ts";
 import { type ValStat } from "../valstat.ts";
+import { type HostRlm, type PDK } from "./derivation.ts";
 import { type DHKEReq, type DHKEResp, PairRequest } from "./pairing.ts";
 import { type LargeBlobCreateOpts, type LargeBlobRp } from "../webauthn/largeBlob.ts";
-import { type PrfCeremony, type PrfCreateOpts, type PrfEvalOpts, type PrfRp } from "../webauthn/prf.ts";
-export type { LargeBlobCreateOpts, LargeBlobRp };
-export type { PrfCreateOpts, PrfEvalOpts, PrfRp };
-/** Options for PRF seal/unseal ceremonies (no raw PRF bytes). */
-export type PasskeyPrfOpts = PrfCreateOpts & {
-    credId?: Uint8Array | readonly Uint8Array[];
-    /** Seal only: create a PRF credential first when no credId is known. */
-    createCredIfNeeded?: boolean;
-};
-/** One binding to try on unseal (cred id + sealed master). */
-export type PrfBinding = {
-    sealedMaster: SealedMasterKey;
-    credId: Uint8Array;
-};
-/** Durable PRF-sealed master + public ceremony facts (never includes PRF output). */
-export type PrfSealedMaster = PrfCeremony & {
-    sealedMaster: SealedMasterKey;
-    salt: Uint8Array;
-};
-/** One existing keyring member used to prove this enclave matches the list. */
-export type BindPrior = {
-    credId: Uint8Array;
-    tag: Uint8Array;
-};
-/** Seal + bind-tag from {@link Enclave.bind} (tag is not a global fingerprint). */
-export type PrfBound = PrfSealedMaster & {
-    tag: Uint8Array;
-};
+import { type BindPrior, type PasskeyPrfOpts, type PrfBinding, type PrfBound, type PrfSealedMaster } from "./prf.ts";
 export type EncryptCipher = {
-    encrypt: (data: Uint8Array) => Promise<Uint8Array>;
+    encrypt: (data: Uint8Array) => Promise<ValStat<Uint8Array>>;
 };
 export type DecryptCipher = {
-    decrypt: (data: Uint8Array) => Promise<Uint8Array>;
+    decrypt: (data: Uint8Array) => Promise<ValStat<Uint8Array>>;
 };
 /** Encrypt + decrypt capability for one KDM. */
 export type DerivedCipher = EncryptCipher & DecryptCipher;
@@ -50,21 +25,21 @@ export type CipherForUsage<U extends CipherUsage> = {
     both: DerivedCipher;
 }[U];
 /**
- * Path-scoped signing identity: public key is public; sign/kdmFor re-enter
+ * KDM-scoped signing identity: public key is public; sign/kdmFor re-enter
  * the enclave so the private key never leaves. Used for hosts, export files, etc.
  */
 export type Identity = {
     readonly publicKey: PublicKey;
-    sign: (message: Uint8Array | string) => Promise<Uint8Array>;
-    /** Per-bag KDM mixed with this identity's private key (see bag seal). */
-    kdmFor: (msgHeadEnc: Uint8Array) => Promise<Uint8Array>;
+    sign: (message: Uint8Array | string) => Promise<ValStat<Uint8Array>>;
+    /** Per-bag 8-byte KDM (bag-kdm PDK child keyed by the encoded head). */
+    kdmFor: (msgHeadEnc: Uint8Array) => Promise<ValStat<Uint8Array>>;
 };
-declare const SEAL_BIND_DOMAIN: Uint8Array<ArrayBufferLike>;
-declare const FP_MODE: Uint8Array<ArrayBufferLike>;
-declare const SEAL_KEY_LEN = 32;
-declare const SEAL_PRF_MIN_LEN = 16;
 /** Minimum musec length (Mandatory User-Space Entropy Contribution). */
-declare const MUSEC_MIN_LEN = 32;
+export declare const MUSEC_MIN_LEN = 32;
+export declare function fromSeedHosts(buf: Uint8Array): ValStat<{
+    enclave: Enclave;
+    hosts: BundleHost[];
+}>;
 /** Brand `bytes` as {@link MasterSeed} only if length is {@link MASTER_SEED_LEN}. */
 export declare function asMasterSeed(bytes: Uint8Array): ValStat<MasterSeed>;
 export declare class Enclave {
@@ -90,7 +65,7 @@ export declare class Enclave {
      */
     sealWithPasskey(opts?: PasskeyPrfOpts): Promise<ValStat<PrfSealedMaster>>;
     /**
-     * UV + PRF seal, plus a per-cred bind tag (blake3(master ‖ domain ‖ credId)).
+     * UV + PRF seal, plus a per-cred bind tag (bindtag PDK child keyed by credId).
      * Tag compute and compare stay in the enclave. If `prior` is non-empty, every
      * stored tag must match this master or bind fails (one keyring, one master).
      */
@@ -117,8 +92,8 @@ export declare class Enclave {
     static unsealWithIkm(sealed: SealedMasterKey, ikm: Uint8Array): Promise<ValStat<Enclave>>;
     /**
      * UV + write IdentityBundle (seed + hosts) to largeBlob.
-     * Encode and WebAuthn write complete inside this method; nothing seed-bearing
-     * is returned. Prefer empty `hosts` for seed-only backup.
+     * Encode stays here; {@link writeLargeBlob} does the UV write. Nothing
+     * seed-bearing is returned. Prefer empty `hosts` for seed-only backup.
      *
      * Pass `opts.credId` to write an existing credential (one UV). Omit it to
      * create a largeBlob-capable credential then write (two UV). Returns the
@@ -149,16 +124,19 @@ export declare class Enclave {
      * Web bundles set DIP_CLI_DUMP=false; the write is compiled out.
      */
     dumpToTty(): Promise<Status>;
+    static pairRequest(): Promise<ValStat<PairRequest>>;
     /**
-     * Absorb seed‖hosts plaintext (pair AEAD inner).
-     * Encoder/Decoder never see the seed.
+     * Seals seed+hosts for dhkeReq. Returns dhkeResp to send back.
+     * @param acks Set fields only after explicit user affirmation (e.g. a checkbox).
+     *   Do not default these to `true` in application code.
      */
-    static fromPairPlain(plain: Uint8Array): ValStat<{
-        enclave: Enclave;
-        hosts: BundleHost[];
-    }>;
-    static pairRequest(): Promise<ValStat<PairRequest>>;
-    pairAccept(dhkeReq: DHKEReq, hosts: BundleHost[]): Promise<ValStat<DHKEResp>>;
+    pairAccept(dhkeReq: DHKEReq, hosts: BundleHost[], acks: {
+        /**
+         * Set `true` only after the user explicitly affirms they control both
+         * devices in this pair. Never hard-code in a client.
+         */
+        userControlsBothSidesOfPair: true;
+    }): Promise<ValStat<DHKEResp>>;
     /**
      * Spawn a new sync Worker from the embedded bundle and inject this enclave's
      * master seed into it (transfer). Seed never goes to a caller-supplied port —
@@ -171,18 +149,19 @@ export declare class Enclave {
         id: number;
         persist?: boolean;
     }): Worker;
+    realmID(realmKDM: IKDM): Promise<ValStat<PDK["RealmID"]>>;
+    hostRlm(realmKDM: IKDM, hostKDM: IKDM): Promise<ValStat<PDK["HostRLM"]>>;
+    realmForRlm(hostKDM: IKDM, rlm: HostRlm, realms: readonly IKDM[]): Promise<ValStat<IKDM>>;
     /**
-     * Cipher for public KDM. Does not hold key bytes; each op re-enters the
-     * enclave (async, hardware-shaped). `usage` selects the return shape:
+     * Cipher for public KDM under a realm (default: nullKDM). Does not hold
+     * key bytes; each op re-enters the enclave. `usage` selects the shape:
      * `"encrypt"` → `{ encrypt }`, `"decrypt"` → `{ decrypt }`, `"both"` → both.
      */
-    deriveCipher<U extends CipherUsage>(kdm: Uint8Array, usage: U): CipherForUsage<U>;
+    deriveCipher<U extends CipherUsage>(kdm: Uint8Array, usage: U, realmKDM?: IKDM): CipherForUsage<U>;
     /**
-     * Path-scoped identity (label+index). Private key stays in the enclave; only
-     * publicKey and capability methods are returned (frozen).
+     * Identity from the identity PDK + KDM. Private key stays in the enclave;
+     * only publicKey and capability methods are returned.
      */
-    deriveIdentity(keyPath: string, idx?: number): Promise<Identity>;
+    deriveIdentity(kdm: IKDM): Promise<ValStat<Identity>>;
+    fingerprint(kdm?: Uint8Array | IKDM): Promise<ValStat<PDK["Fingerprint"]>>;
 }
-/** Derive seal key from PRF output (domain-separated). Used by enclave seal/unseal. */
-export declare function sealKeyFromPrf(crypto: ICrypto, prf: Uint8Array, domain?: Uint8Array): Promise<ValStat<Uint8Array>>;
-export { FP_MODE, MASTER_SEED_LEN, MUSEC_MIN_LEN, SEAL_BIND_DOMAIN, SEAL_KEY_LEN, SEAL_PRF_MIN_LEN, };

package/dist/cli/shared/crypto/largeBlob.d.ts

@@ -0,0 +1,8 @@
+import { Status } from "../consts.ts";
+import { type ValStat } from "../valstat.ts";
+import { type LargeBlobCreateOpts, type LargeBlobRp } from "../webauthn/largeBlob.ts";
+export declare function largeBlobCredId(opts?: LargeBlobCreateOpts & {
+    credId?: Uint8Array;
+}): Promise<ValStat<Uint8Array>>;
+export declare function writeLargeBlob(credId: Uint8Array, data: Uint8Array, opts?: LargeBlobRp): Promise<Status>;
+export declare function wipeLargeBlob(credId: Uint8Array, opts?: LargeBlobRp): Promise<Status>;

package/dist/cli/shared/crypto/noble.d.ts

@@ -1,24 +1,17 @@
 import { type X25519Sk } from "./x25519.ts";
 import type { Blake3Opts, DerivationSeed, Hash, ICrypto, KeyPair } from "../types.ts";
-/**
- * ICrypto: noble for XSalsa20 + blake3; WebCrypto Ed25519 + X25519
- * (our scalar; RFC 7748 check before trusting pub/DH).
- */
-export declare class NobleCrypto implements ICrypto {
-    private verifyKeys;
-    genRandomBytes(bytes: number): Promise<Uint8Array>;
-    gen256BitSecureRandomSeed(): Promise<Uint8Array>;
-    encryptXSalsa20Poly1305Combined(data: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
-    decryptXSalsa20Poly1305Combined(data: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
-    deriveEd25519KeyPair(derivationSeed: DerivationSeed): Promise<KeyPair>;
-    private importSignKey;
-    private importVerifyKey;
-    signEd25519(message: Uint8Array | string, secKey: Uint8Array): Promise<Uint8Array>;
-    checkSigEd25519(sig: Uint8Array, message: Uint8Array | string, pubKey: Uint8Array): Promise<boolean>;
-    blake3(data: Uint8Array, opts?: Blake3Opts): Promise<Hash>;
-    genX25519(): Promise<{
-        priv: X25519Sk;
-        pub: Uint8Array;
-    }>;
-    x25519Shared(priv: X25519Sk, peerPub: Uint8Array): Promise<Uint8Array>;
-}
+export declare function genRandomBytes(bytes: number): Promise<Uint8Array>;
+export declare function gen256BitSecureRandomSeed(): Promise<Uint8Array>;
+export declare function encryptXSalsa20Poly1305Combined(data: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
+export declare function decryptXSalsa20Poly1305Combined(data: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
+export declare function deriveEd25519KeyPair(derivationSeed: DerivationSeed): Promise<KeyPair>;
+export declare function importVerifyKey(pubKey: Uint8Array): Promise<CryptoKey>;
+export declare function signEd25519(message: Uint8Array | string, secKey: Uint8Array): Promise<Uint8Array>;
+export declare function checkSigEd25519(sig: Uint8Array, message: Uint8Array | string, verifyKey: CryptoKey): Promise<boolean>;
+export declare function blake3(data: Uint8Array, opts?: Blake3Opts): Promise<Hash>;
+export declare function genX25519(): Promise<{
+    priv: X25519Sk;
+    pub: Uint8Array;
+}>;
+export declare function x25519Shared(priv: X25519Sk, peerPub: Uint8Array): Promise<Uint8Array>;
+export declare const noble: ICrypto;

package/dist/cli/shared/crypto/pairing.d.ts

@@ -1,8 +1,8 @@
 import type { BundleHost } from "../codecs/bundleHost.ts";
 import { type ValStat } from "../valstat.ts";
-import { Enclave } from "./enclave.ts";
+import { type PDK } from "./derivation.ts";
+import type { Enclave } from "./enclave.ts";
 import type { X25519Sk } from "./x25519.ts";
-export declare const SEAL_PAIR_DOMAIN: Uint8Array<ArrayBufferLike>;
 export declare const X25519_PUB_LEN = 32;
 /** respPub (32) ‖ XSalsa nonce (24) ‖ tag (16); plaintext follows in the ct. */
 export declare const DHKE_RESP_MIN: number;
@@ -19,13 +19,17 @@ export declare function asDHKEResp(bytes: Uint8Array): ValStat<DHKEResp>;
 export declare function pairKey(sk: X25519Sk, // local X25519 priv
 peer: Uint8Array, // ECDH peer pub (enroller: dhkeReq; enrollee: respPub)
 reqPub: Uint8Array, // enrollee pub, bound into KDF
-respPub: Uint8Array): Promise<ValStat<Uint8Array>>;
+respPub: Uint8Array): Promise<ValStat<PDK["Pair"]>>;
+export declare function sealPair(dhkeReq: DHKEReq): Promise<ValStat<{
+    key: PDK["Pair"];
+    pub: Uint8Array;
+}>>;
 export declare class PairRequest {
     #private;
     private constructor();
     static create(): Promise<ValStat<PairRequest>>;
     wipe(): void;
-    get dhkeReq(): DHKEReq;
+    dhkeReq(): ValStat<DHKEReq>;
     finish(dhkeResp: DHKEResp): Promise<ValStat<{
         enclave: Enclave;
         hosts: BundleHost[];

package/dist/cli/shared/crypto/prf.d.ts

@@ -0,0 +1,52 @@
+import type { SealedMasterKey } from "../seed.ts";
+import { type ValStat } from "../valstat.ts";
+import { type PDK } from "./derivation.ts";
+import { type PrfCeremony, type PrfCreateOpts, type PrfEvalOpts } from "../webauthn/prf.ts";
+/** Options for PRF seal/unseal ceremonies (no raw PRF bytes). */
+export type PasskeyPrfOpts = PrfCreateOpts & {
+    credId?: Uint8Array | readonly Uint8Array[];
+    /** Seal only: create a PRF credential first when no credId is known. */
+    createCredIfNeeded?: boolean;
+};
+/** One binding to try on unseal (cred id + sealed master). */
+export type PrfBinding = {
+    sealedMaster: SealedMasterKey;
+    credId: Uint8Array;
+    /** PRF salt for this cred. Omitted salts use the ceremony salt. */
+    salt?: Uint8Array;
+};
+/** Durable PRF-sealed master + public ceremony facts (never includes PRF output). */
+export type PrfSealedMaster = PrfCeremony & {
+    sealedMaster: SealedMasterKey;
+    salt: Uint8Array;
+};
+/** One existing keyring member used to prove this enclave matches the list. */
+export type BindPrior = {
+    credId: Uint8Array;
+    tag: PDK["BindTag"];
+};
+/** Seal + bind-tag from {@link Enclave.bind} (tag is not a global fingerprint). */
+export type PrfBound = PrfSealedMaster & {
+    tag: PDK["BindTag"];
+};
+type PrfCreateResult = PrfCeremony & {
+    prfEnabled: boolean;
+    prf?: Uint8Array;
+};
+type PrfEvalResult = PrfCeremony & {
+    prf: Uint8Array;
+};
+export declare function createPrfCred(opts?: PrfCreateOpts): Promise<ValStat<PrfCreateResult>>;
+export declare function evalPrf(opts?: PrfEvalOpts): Promise<ValStat<PrfEvalResult>>;
+export declare function sealPRF(opts: PasskeyPrfOpts | undefined): Promise<ValStat<PrfCeremony & {
+    prf: Uint8Array;
+    salt: Uint8Array;
+}>>;
+export declare function unsealPRF(bindings: readonly PrfBinding[], opts: PasskeyPrfOpts & {
+    salt: Uint8Array;
+}): Promise<ValStat<{
+    prf: Uint8Array;
+    credId: Uint8Array;
+    order: readonly PrfBinding[];
+}>>;
+export {};

package/dist/cli/shared/crypto/realms.d.ts

@@ -0,0 +1,7 @@
+import { type IKDM } from "../codecs/kdm.ts";
+import { type MasterSeed } from "../seed.ts";
+import { type ValStat } from "../valstat.ts";
+import { type PDK } from "./derivation.ts";
+export declare function deriveRealmKey(parent: MasterSeed, realmKDM: IKDM): Promise<ValStat<PDK["RealmKey"]>>;
+export declare function deriveRealmID(parent: MasterSeed, realmKDM: IKDM): Promise<ValStat<PDK["RealmID"]>>;
+export declare function deriveHostRLM(parent: PDK["RealmID"], hostKDM: IKDM): Promise<ValStat<PDK["HostRLM"]>>;

package/dist/cli/shared/endpoint.d.ts

@@ -10,8 +10,8 @@ interface IProtoClient {
     enclave: Enclave;
     clock: IClock;
 }
-export interface IAuthenticatedEndpoint<ReqItem, Resp> {
-    encodeReq(client: IProtoClient, identity: Identity, authTS: IAuthTimestamp, body: Iterable<ReqItem>, reqEnc: Encoder): Promise<Status>;
+export interface IAuthenticatedEndpoint<ReqInput, Resp> {
+    encodeReq(client: IProtoClient, identity: Identity, authTS: IAuthTimestamp, body: ReqInput, reqEnc: Encoder): Promise<Status>;
     handleReq(host: IProtoHost, reqDec: Decoder, respEnc: Encoder): Promise<Status>;
     decodeResp(respDec: Decoder): ValStat<Resp>;
 }

package/dist/cli/shared/http.d.ts

@@ -6,66 +6,66 @@ import { ValStat } from "./valstat.ts";
 export declare const api: {
     readonly user: {
         readonly path: "/user";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<never, void>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<void, void>;
         readonly name: APICallName.User;
     };
     readonly push: {
         readonly path: "/push";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./types.ts").IBag, import("./codecs/pushItem.ts").IBagPushItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./types.ts").IBag[], import("./codecs/pushItem.ts").IBagPushItem[]>;
         readonly name: APICallName.Push;
     };
     readonly peek: {
         readonly path: "/peek";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<number, import("./codecs/peekItem.ts").IBagPeekItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./api/peek.ts").IPeekCursor, import("./codecs/peekItem.ts").IBagPeekItem[]>;
         readonly name: APICallName.Peek;
     };
     readonly pull: {
         readonly path: "/pull";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<number, import("./codecs/pullItem.ts").IBagPullItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./api/pull.ts").IPullReq, import("./codecs/pullItem.ts").IBagPullItem[]>;
         readonly name: APICallName.Pull;
     };
 };
 export declare const apiCalls: {
     readonly 0: {
         readonly path: "/user";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<never, void>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<void, void>;
         readonly name: APICallName.User;
     };
     readonly 2: {
         readonly path: "/push";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./types.ts").IBag, import("./codecs/pushItem.ts").IBagPushItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./types.ts").IBag[], import("./codecs/pushItem.ts").IBagPushItem[]>;
         readonly name: APICallName.Push;
     };
     readonly 1: {
         readonly path: "/peek";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<number, import("./codecs/peekItem.ts").IBagPeekItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./api/peek.ts").IPeekCursor, import("./codecs/peekItem.ts").IBagPeekItem[]>;
         readonly name: APICallName.Peek;
     };
     readonly 3: {
         readonly path: "/pull";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<number, import("./codecs/pullItem.ts").IBagPullItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./api/pull.ts").IPullReq, import("./codecs/pullItem.ts").IBagPullItem[]>;
         readonly name: APICallName.Pull;
     };
 };
 export declare const callPaths: {
     readonly "/user": {
         readonly path: "/user";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<never, void>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<void, void>;
         readonly name: APICallName.User;
     };
     readonly "/push": {
         readonly path: "/push";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./types.ts").IBag, import("./codecs/pushItem.ts").IBagPushItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./types.ts").IBag[], import("./codecs/pushItem.ts").IBagPushItem[]>;
         readonly name: APICallName.Push;
     };
     readonly "/peek": {
         readonly path: "/peek";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<number, import("./codecs/peekItem.ts").IBagPeekItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./api/peek.ts").IPeekCursor, import("./codecs/peekItem.ts").IBagPeekItem[]>;
         readonly name: APICallName.Peek;
     };
     readonly "/pull": {
         readonly path: "/pull";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<number, import("./codecs/pullItem.ts").IBagPullItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./api/pull.ts").IPullReq, import("./codecs/pullItem.ts").IBagPullItem[]>;
         readonly name: APICallName.Pull;
     };
 };

package/dist/cli/shared/sync.d.ts

@@ -1,9 +1,11 @@
 import { IBagPeekItem } from "./codecs/peekItem.ts";
+import type { IKDM } from "./codecs/kdm.ts";
+import { type HostRlm } from "./crypto/derivation.ts";
 import { Enclave } from "./crypto/enclave.ts";
-import { ICrypto, PublicKey } from "./types.ts";
+import { ICrypto } from "./types.ts";
 import { ValStat } from "./valstat.ts";
 export interface IDecryptedBagPeekItem {
     kdm: Uint8Array;
     headEnc: Uint8Array;
 }
-export declare function decryptPeekItem(item: IBagPeekItem, pubKey: PublicKey, enclave: Enclave, crypto: ICrypto): Promise<ValStat<IDecryptedBagPeekItem>>;
+export declare function decryptPeekItem(item: IBagPeekItem, verifyKey: CryptoKey, enclave: Enclave, crypto: ICrypto, rlm: HostRlm, realm?: IKDM): Promise<ValStat<IDecryptedBagPeekItem>>;

package/dist/cli/shared/types.d.ts

@@ -4,6 +4,7 @@ import { IAuthTimestamp } from "./codecs/authTimestamp.ts";
 import type { IBagPeekItem } from "./codecs/peekItem.ts";
 import { IUsageQuota } from "./codecs/usageQuota.ts";
 import { APICallName, Status } from "./consts.ts";
+import type { HostRlm } from "./crypto/derivation.ts";
 import type { ValStat } from "./valstat.ts";
 /** Identity seed brands — defined in seed.ts; re-exported for convenience. */
 export type { MasterSeed, SealedMasterKey } from "./seed.ts";
@@ -75,27 +76,35 @@ export type IDeleteParams = {
     eid: EntityID;
     force?: boolean;
 };
+/** One setBags outcome. Success carries the host seq in that bag's rlm. */
+export type ISetBagResult = {
+    status: Status.Success;
+    seq: number;
+} | {
+    status: Exclude<Status, Status.Success>;
+};
 export interface IStorage {
     addUser: (pubKey: PublicKey) => Promise<ValStat<void>>;
     hasUser: (pubKey: PublicKey) => Promise<ValStat<boolean>>;
     subMeta: (pubKey: PublicKey) => Promise<ValStat<ISubscriptionMetadata>>;
     /**
-     * Store bags for a user. Returns host seq for each bag in order.
-     * Empty list succeeds with []. Implementations must assign contiguous
-     * seqs atomically (transaction / single batch) so concurrent writers
-     * cannot claim the same seq.
+     * Store bags for a user. One result per input bag, same order.
+     * An invalid rlm is InvalidParam for that bag; the others are still stored.
+     * Seqs are contiguous per rlm among stored bags, assigned atomically so
+     * concurrent writers cannot claim the same seq in the same rlm.
+     * Empty list succeeds with []. A storage failure fails the call.
      */
-    setBags: (pubKey: PublicKey, bags: IBag[]) => Promise<ValStat<number[]>>;
+    setBags: (pubKey: PublicKey, bags: IBag[]) => Promise<ValStat<ISetBagResult[]>>;
     /**
-     * Fetch ciphertext bodies for the given host seqs.
-     * Returns only seqs that exist (missing seqs are omitted, not an error).
-     * Empty `seqs` succeeds with [].
+     * Fetch ciphertext bodies for `seqs` in `rlm`.
+     * Missing seqs are omitted. Empty `seqs` succeeds with [].
      */
-    getBodies: (pubKey: PublicKey, seqs: number[]) => Promise<ValStat<{
+    getBodies: (pubKey: PublicKey, rlm: HostRlm, seqs: number[]) => Promise<ValStat<{
         seq: number;
         bodyCph: Uint8Array;
     }[]>>;
-    listHeads: (pubKey: PublicKey, minSeq: number) => Promise<ValStat<IBagPeekItem[]>>;
+    /** Heads in `rlm` with seq greater than minSeq, ordered by seq. */
+    listHeads: (pubKey: PublicKey, rlm: HostRlm, minSeq: number) => Promise<ValStat<IBagPeekItem[]>>;
 }
 export interface KeyPair {
     keyType: "ed25519";
@@ -123,7 +132,8 @@ export type Hash = Uint8Array & {
     readonly [hashSymbol]: true;
 };
 export interface IHostCrypto {
-    checkSigEd25519: (sig: Uint8Array, message: Uint8Array | string, pubKey: PublicKey) => Promise<boolean>;
+    importVerifyKey: (pubKey: PublicKey) => Promise<CryptoKey>;
+    checkSigEd25519: (sig: Uint8Array, message: Uint8Array | string, verifyKey: CryptoKey) => Promise<boolean>;
 }
 /** BLAKE3 hash / MAC / KDF (noble: `key` XOR `context`, not both). */
 export type Blake3Opts = {
@@ -168,6 +178,9 @@ export interface IPushListener {
     disconnect(): void;
 }
 export interface IBagHeader {
+    /** HostRLM. Covered by sig, with headCph. */
+    rlm: HostRlm;
+    /** Ed25519 over rlm ‖ headCph. First field on the wire. */
     sig: Uint8Array;
     kdm: Uint8Array;
 }

package/dist/cli/shared/webauthn/prf.d.ts

@@ -29,6 +29,14 @@ export type PrfEvalOpts = PrfRp & {
     /** One id, or every bound id so a spare key can assert in one get(). */
     credId?: Uint8Array | readonly Uint8Array[];
     salt?: Uint8Array;
+    /**
+     * Salt for each cred when accounts do not share one.
+     * Sent as evalByCredential so the passkey the user picks evals its own.
+     */
+    salts?: readonly {
+        credId: Uint8Array;
+        salt: Uint8Array;
+    }[];
 };
 /** Best-effort: client advertises PRF extension. */
 export declare function prfCapable(): Promise<boolean>;

package/dist/cli/src/index.d.ts

@@ -3,6 +3,7 @@ import { IClock } from "../shared/clock.ts";
 import type { IBagPeekItem } from "../shared/codecs/peekItem.ts";
 import { IBagPullItem } from "../shared/codecs/pullItem.ts";
 import { IBagPushItem } from "../shared/codecs/pushItem.ts";
+import type { IKDM } from "../shared/codecs/kdm.ts";
 import { Status } from "../shared/consts.ts";
 import { Enclave } from "../shared/crypto/enclave.ts";
 import { HostHandle, IHostConnectionInfo, IMessage, ITransport } from "../shared/types.ts";
@@ -16,10 +17,10 @@ export declare class CLIClient<Handle extends HostHandle> {
         clock?: IClock;
     });
     connect(host: IHostConnectionInfo<Handle>, transport: ITransport): Promise<Status>;
-    push(msgs: IMessage[]): Promise<ValStat<IBagPushItem[]>>;
-    peek(lastSeq: number): Promise<ValStat<IBagPeekItem[]>>;
-    pull(seqs: number[]): Promise<ValStat<IBagPullItem[]>>;
-    open(peekItem: IBagPeekItem, pullItem: IBagPullItem): Promise<ValStat<IOpenBag>>;
+    push(msgs: IMessage[], realm?: IKDM): Promise<ValStat<IBagPushItem[]>>;
+    peek(lastSeq: number, realm?: IKDM): Promise<ValStat<IBagPeekItem[]>>;
+    pull(seqs: number[], realm?: IKDM): Promise<ValStat<IBagPullItem[]>>;
+    open(peekItem: IBagPeekItem, pullItem: IBagPullItem, realm?: IKDM): Promise<ValStat<IOpenBag>>;
     upsertSingletonSync(type: string, body: Uint8Array): Promise<Status>;
     listen(onNotification: (bytes: Uint8Array) => Promise<Status>, onDisconnect?: () => void, onConnect?: () => void): Promise<Status>;
     isConnected(): boolean;

package/dist/web/client.d.ts

@@ -5,8 +5,9 @@ import { EncodedMessage } from "./shared/message";
 import type { Enclave } from "./shared/crypto/enclave";
 import { EntityID, Hash, HostHandle, ICrypto, IDeleteParams, IEntRev, IHostConnectionInfo, IInsertParams, IMessageHead, IStateManager, ITransport, IUpdateParams } from "./shared/types";
 import { ValStat } from "./shared/valstat";
-import { ApldState, IClient, IDiplomaticClientState, IDiplomaticClientXferState, IHostRow, IStateEmitter, IStore, IStoredMessage, ListMsgsOpts, ReconcileOpts, ReconcileReport, SetSeedOpts, WipeOpts } from "./types";
+import { ApldState, IClient, IDiplomaticClientState, IDiplomaticClientXferState, IHostRow, IStateEmitter, IStore, IStoredMessage, ListMsgsOpts, OpenAccount, ReconcileOpts, ReconcileReport, SetSeedOpts, WipeOpts } from "./types";
 export declare class SyncClient<Handle extends HostHandle> implements IClient<Handle> {
+    #private;
     private clock;
     private state;
     private store;
@@ -56,7 +57,10 @@ export declare class SyncClient<Handle extends HostHandle> implements IClient<Ha
     onScheduleSync?: (() => void) | undefined);
     /** Record phase progress and notify xferState listeners. */
     private emitProgress;
-    setSeed(enclave: Enclave, opts?: SetSeedOpts): Promise<void>;
+    /** Account this client is operating as, if one is open. */
+    selected(): OpenAccount<Handle> | undefined;
+    setSeed(enclave: Enclave, opts?: SetSeedOpts): Promise<Status>;
+    adopt(enclave: Enclave, label?: string): Promise<Status>;
     private getClientState;
     private getXferState;
     /**
@@ -168,9 +172,10 @@ export declare class SyncClient<Handle extends HostHandle> implements IClient<Ha
     /** Count archive rows; optional apld filter. Prefer over list+length. */
     countMsgs(apld?: ApldState): Promise<number>;
     /**
-     * Full inventory of one host (peek seq 0): advances lastSeq; optionally
-     * enqueues pull/push. Waits out in-flight {@link sync} first (same as
-     * {@link rebuild}). By default drains via {@link sync}, then re-inventories.
+     * Full inventory of one host (peek seq 0 per realm). Sets each cursor and
+     * optionally enqueues pull/push. Waits out in-flight {@link sync} first
+     * (same as {@link rebuild}). By default drains via {@link sync}, then
+     * re-inventories.
      * Returns ephemeral {@link ReconcileReport} (msgcheck, numBags, numDupes) —
      * bag tallies are not persisted.
      */

package/dist/web/crypto.d.ts

@@ -1,3 +1,2 @@
-import { NobleCrypto } from "./shared/crypto/noble";
-declare const crypto: NobleCrypto;
-export default crypto;
+import { noble } from "./shared/crypto/noble";
+export default noble;