@interncom/diplomatic 0.22.0 → 0.23.0

package/dist/web/passkey/prf-store.d.ts

@@ -1,7 +1,10 @@
-import { Enclave, type PasskeyPrfOpts } from "../shared/crypto/enclave";
+import { Enclave } from "../shared/crypto/enclave";
+import { type PDK } from "../shared/crypto/derivation";
+import type { PasskeyPrfOpts } from "../shared/crypto/prf";
+import { Status } from "../shared/consts";
 import { type SealedMasterKey } from "../shared/seed";
 import { type ValStat } from "../shared/valstat";
-import type { ISeedStore, SetSeedOpts } from "../types";
+import type { IAccountStore, SetSeedOpts } from "../types";
 import { type PrfRp } from "../shared/webauthn/prf";
 import { type AuthenticatorAttachmentName, type EnrolledOs } from "../shared/webauthn/common";
 /** Max bindings on one device. Keeps allowCredentials small. */
@@ -12,8 +15,8 @@ export type KeyringEntry = {
     type: "prf";
     sealedMaster: SealedMasterKey;
     credId: Uint8Array;
-    /** blake3(master ‖ bindtag ‖ credId); check-only, not a display fingerprint. */
-    tag: Uint8Array;
+    /** Bind-tag PDK child keyed by credId; check-only, not a display fingerprint. */
+    tag: PDK["BindTag"];
     userId?: Uint8Array;
     nick?: string;
     enrolledAt: number;
@@ -45,10 +48,18 @@ export type KeyringRow = {
  * Persist the keyring for cold start (e.g. protocol IDB).
  * Called with `undefined` when the store is wiped.
  */
-export type PersistKeyring = (ring: Keyring | undefined) => void | Promise<void>;
+export type PersistKeyring = (ring: Keyring | undefined) => Status | Promise<Status>;
 export type PrfSeedStoreOpts = PrfRp & {
     persistKeyring: PersistKeyring;
     keyring?: Keyring;
+    /**
+     * When set, unlock runs this instead of the keyring held here.
+     * The account store uses it to pick the row by the asserted credId.
+     */
+    unlockAccount?: () => Promise<ValStat<{
+        enclave: Enclave;
+        keyring?: Keyring;
+    }>>;
 };
 /**
  * Session + durable PRF-bound seed. Session secret is always {@link Enclave}.
@@ -57,13 +68,14 @@ export type PrfSeedStoreOpts = PrfRp & {
  * - {@link bindAndSave} creates a binding and appends/upserts a keyring entry.
  * - {@link unlock} runs PRF UV inside Enclave and returns a new enclave.
  */
-export declare class PrfSeedStore implements ISeedStore {
+export declare class PrfSeedStore implements IAccountStore {
     #private;
-    constructor(opts: PrfSeedStoreOpts);
+    constructor(opts: Omit<PrfSeedStoreOpts, "keyring">);
+    static open(opts: PrfSeedStoreOpts): ValStat<PrfSeedStore>;
     get keyring(): Keyring | undefined;
     /** Public rows (no sealed master). */
     list(): KeyringRow[];
-    save(enclave: Enclave, opts?: SetSeedOpts): Promise<Enclave>;
+    save(enclave: Enclave, opts?: SetSeedOpts): Promise<ValStat<Enclave>>;
     /**
      * PRF UV inside Enclave.bind, persist the entry.
      * Always creates a new cred unless `credId` is passed (re-bind that cred).
@@ -73,7 +85,10 @@ export declare class PrfSeedStore implements ISeedStore {
         nick?: string;
     }): Promise<ValStat<Enclave>>;
     load(): Promise<Enclave | void>;
-    /** Passkey UV inside Enclave → new session enclave. */
+    /**
+     * Passkey UV inside Enclave → new session enclave.
+     * With `unlockAccount`, the asserted credId selects the account.
+     */
     unlock(): Promise<ValStat<Enclave>>;
     /** Set a display nick (local only; does not update the binding key). */
     rename(credId: Uint8Array, nick: string): Promise<ValStat<void>>;
@@ -84,11 +99,12 @@ export declare class PrfSeedStore implements ISeedStore {
     remove(credId: Uint8Array): Promise<ValStat<void>>;
     wipe(): Promise<void>;
 }
-export declare function cloneKeyring(r: Keyring): Keyring;
+export declare function cloneKeyring(r: Keyring): ValStat<Keyring>;
 /** Read a keyring from IDB structured-clone output. */
 export declare function decodeKeyring(raw: unknown): Keyring | undefined;
 /** Cred ids of every keyring entry. */
 export declare function keyringCredIds(ring: Keyring | undefined): Uint8Array[];
+export declare function touchKeyring(ring: Keyring, credId: Uint8Array): ValStat<Keyring | undefined>;
 /** Inferred kind for UI. Not attested. */
 export declare function keyringKind(row: KeyringRow): string;
 /** Display label: nick, else inferred kind + short cred id. */

package/dist/web/passkey/seed.d.ts

@@ -1,21 +1,27 @@
 import { Enclave } from "../shared/crypto/enclave";
 import { type ValStat } from "../shared/valstat";
-import type { ISeedStore, SetSeedOpts } from "../types";
+import type { IAccountStore, SetSeedOpts } from "../types";
 import type { LargeBlobRp } from "../shared/webauthn/largeBlob";
 export type PasskeySeedStoreOpts = LargeBlobRp & {
     credId?: Uint8Array;
+    /** Account `credId` belongs to. Omitted is the default account, "". */
+    label?: string;
 };
 /**
- * ISeedStore backed by largeBlob. Session secret is always {@link Enclave}.
+ * IAccountStore backed by largeBlob. Session secret is always {@link Enclave}.
+ * Each account label has its own credential. Omitted label is "".
  * Persist uses {@link Enclave.persistToLargeBlob} / {@link Enclave.fromLargeBlob}.
  */
-export declare class PasskeySeedStore implements ISeedStore {
+export declare class PasskeySeedStore implements IAccountStore {
     #private;
     constructor(opts: PasskeySeedStoreOpts);
+    /** Credential id of the selected account. */
     get credId(): Uint8Array | undefined;
-    setCredId(credId: Uint8Array | undefined): void;
-    save(enclave: Enclave, opts?: SetSeedOpts): Promise<Enclave>;
+    setCredId(credId: Uint8Array | undefined, label?: string): void;
+    save(enclave: Enclave, opts?: SetSeedOpts): Promise<ValStat<Enclave>>;
     load(): Promise<Enclave | void>;
-    unlock(): Promise<ValStat<Enclave>>;
+    unlock(opts?: {
+        label?: string;
+    }): Promise<ValStat<Enclave>>;
     wipe(): Promise<void>;
 }

package/dist/web/shared/api/peek.d.ts

@@ -1,3 +1,11 @@
+import { ICodecStruct } from "../codec.ts";
 import { IAuthenticatedEndpoint } from "../endpoint.ts";
 import { IBagPeekItem } from "../codecs/peekItem.ts";
-export declare const peekEnd: IAuthenticatedEndpoint<number, IBagPeekItem[]>;
+import { type HostRlm } from "../crypto/derivation.ts";
+/** One realm cursor: that rlm, and the last seq the client has in it. */
+export interface IPeekCursor {
+    rlm: HostRlm;
+    seq: number;
+}
+export declare const peekCursorCodec: ICodecStruct<IPeekCursor>;
+export declare const peekEnd: IAuthenticatedEndpoint<IPeekCursor, IBagPeekItem[]>;

package/dist/web/shared/api/pull.d.ts

@@ -1,3 +1,11 @@
+import { ICodecStruct } from "../codec.ts";
 import { type IBagPullItem } from "../codecs/pullItem.ts";
+import { type HostRlm } from "../crypto/derivation.ts";
 import { IAuthenticatedEndpoint } from "../endpoint.ts";
-export declare const pullEnd: IAuthenticatedEndpoint<number, IBagPullItem[]>;
+/** One realm, and the seqs to fetch in it. */
+export interface IPullReq {
+    rlm: HostRlm;
+    seqs: number[];
+}
+export declare const pullReqCodec: ICodecStruct<IPullReq>;
+export declare const pullEnd: IAuthenticatedEndpoint<IPullReq, IBagPullItem[]>;

package/dist/web/shared/api/push.d.ts

@@ -1,4 +1,6 @@
+import { ICodecStruct } from "../codec.ts";
 import { type IBagPushItem } from "../codecs/pushItem.ts";
 import { IAuthenticatedEndpoint } from "../endpoint.ts";
 import { IBag } from "../types.ts";
-export declare const pushEnd: IAuthenticatedEndpoint<IBag, IBagPushItem[]>;
+export declare const pushReqCodec: ICodecStruct<IBag[]>;
+export declare const pushEnd: IAuthenticatedEndpoint<IBag[], IBagPushItem[]>;

package/dist/web/shared/api/user.d.ts

@@ -1,2 +1,2 @@
 import { IAuthenticatedEndpoint } from "../endpoint.ts";
-export declare const userEnd: IAuthenticatedEndpoint<never, void>;
+export declare const userEnd: IAuthenticatedEndpoint<void, void>;

package/dist/web/shared/bag.d.ts

@@ -1,10 +1,13 @@
+import type { IKDM } from "./codecs/kdm.ts";
 import { IMessageHead } from "./codecs/messageHead.ts";
+import type { HostRlm } from "./crypto/derivation.ts";
 import { type DecryptCipher, Enclave, type Identity } from "./crypto/enclave.ts";
 import { EncodedMessage } from "./message.ts";
 import { type ValStat } from "./valstat.ts";
-import type { Hash, IBag, ICrypto, IHostCrypto, IMessage, IMessageWithHash, PublicKey } from "./types.ts";
-export declare function bagSigValid(bag: IBag, pubKey: PublicKey, crypto: IHostCrypto): Promise<boolean>;
-export declare function sealBag(msg: IMessage, identity: Identity, crypto: ICrypto, enclave: Enclave): Promise<ValStat<IBag>>;
+import type { Hash, IBag, ICrypto, IHostCrypto, IMessage, IMessageWithHash } from "./types.ts";
+export declare function bagSigMsg(rlm: HostRlm, headCph: Uint8Array): Uint8Array;
+export declare function bagSigValid(bag: IBag, verifyKey: CryptoKey, crypto: IHostCrypto): Promise<boolean>;
+export declare function sealBag(msg: IMessage, identity: Identity, crypto: ICrypto, enclave: Enclave, hostKDM?: IKDM, realmKDM?: IKDM): Promise<ValStat<IBag>>;
 export interface IOpenBag {
     msgHead: IMessageHead;
     bod?: EncodedMessage;
@@ -13,4 +16,4 @@ export interface IOpenBag {
 export declare function openBagBody(headEnc: Uint8Array, bodyCph: Uint8Array | undefined, cipher: DecryptCipher, crypto: ICrypto, 
 /** When set (e.g. from peek), skip blake3(headEnc). */
 headHashKnown?: Hash): Promise<ValStat<IOpenBag>>;
-export declare function openBag(bag: IBag, pubKey: PublicKey, crypto: ICrypto, enclave: Enclave): Promise<ValStat<IMessageWithHash>>;
+export declare function openBag(bag: IBag, verifyKey: CryptoKey, crypto: ICrypto, enclave: Enclave, hostKDM?: IKDM, realms?: readonly IKDM[]): Promise<ValStat<IMessageWithHash>>;

package/dist/web/shared/client.d.ts

@@ -1,9 +1,14 @@
 import { IClock } from "./clock.ts";
+import type { IKDM } from "./codecs/kdm.ts";
+import type { IBagPeekItem } from "./codecs/peekItem.ts";
+import type { IBagPullItem } from "./codecs/pullItem.ts";
 import { Status } from "./consts.ts";
 import { Enclave, type Identity } from "./crypto/enclave.ts";
+import { type HostRlm } from "./crypto/derivation.ts";
 import type { HostHandle, IBag, ICrypto, IHostConnectionInfo, IHostMetadata, IMessage, ITransport, PushReceiver } from "./types.ts";
 import { ValStat } from "./valstat.ts";
 export default class DiplomaticClientAPI<Handle extends HostHandle> {
+    #private;
     enclave: Enclave;
     crypto: ICrypto;
     private host;
@@ -12,12 +17,13 @@ export default class DiplomaticClientAPI<Handle extends HostHandle> {
     private updateHostMeta;
     constructor(enclave: Enclave, crypto: ICrypto, host: IHostConnectionInfo<Handle>, clock: IClock, transport: ITransport, updateHostMeta: (meta: IHostMetadata) => Promise<Status>);
     private call;
-    identity: () => Promise<Identity>;
-    seal: (msg: IMessage) => Promise<ValStat<IBag>>;
+    identity: () => Promise<ValStat<Identity>>;
+    hostRlm: (realm?: IKDM) => Promise<ValStat<HostRlm>>;
+    seal: (msg: IMessage, realm?: IKDM) => Promise<ValStat<IBag>>;
     register: () => Promise<ValStat<void>>;
-    peek: (lastSeq: number) => Promise<ValStat<import("./codecs/peekItem.ts").IBagPeekItem[]>>;
+    peek: (lastSeq: number, realm?: IKDM) => Promise<ValStat<IBagPeekItem[]>>;
     push: (bags: IBag[]) => Promise<ValStat<import("./codecs/pushItem.ts").IBagPushItem[]>>;
-    pull: (seqs: number[]) => Promise<ValStat<import("./codecs/pullItem.ts").IBagPullItem[]>>;
+    pull: (seqs: number[], realm?: IKDM) => Promise<ValStat<IBagPullItem[]>>;
     listen: (recv: PushReceiver, onDisconnect?: () => void, onConnect?: () => void) => Promise<Status>;
     /** Returns whether this client has an active connection to its host.
      * If a push listener is active, reports the listener's connected state.

package/dist/web/shared/codecs/kdm.d.ts

@@ -0,0 +1,6 @@
+import { ICodecStruct } from "../codec.ts";
+export interface IKDM {
+    label: string;
+    index: number;
+}
+export declare const kdmCodec: ICodecStruct<IKDM>;

package/dist/web/shared/codecs/notifItem.d.ts

@@ -1,6 +1,8 @@
 import { ICodecStruct } from "../codec.ts";
+import { type HostRlm } from "../crypto/derivation.ts";
 export interface IBagNotifItem {
     seq: number;
+    rlm: HostRlm;
     headCph: Uint8Array;
     bodyCph?: Uint8Array;
 }

package/dist/web/shared/crypto/derivation.d.ts

@@ -0,0 +1,45 @@
+import { type IKDM } from "../codecs/kdm.ts";
+import { type ValStat } from "../valstat.ts";
+export declare const Purpose: {
+    readonly Identity: "diplomatic.identity.v1";
+    readonly Cipher: "diplomatic.cipher.v1";
+    readonly Bind: "diplomatic.bind.v1";
+    readonly BindTag: "diplomatic.bindtag.v1";
+    readonly Fingerprint: "diplomatic.fingerprint.v1";
+    readonly Pair: "diplomatic.qrpair.v1";
+    readonly BagKdm: "diplomatic.bagkdm.v1";
+    readonly RealmKey: "diplomatic.realmKey.v1";
+    readonly RealmID: "diplomatic.realmID.v1";
+    readonly HostRLM: "diplomatic.hostRLM.v1";
+};
+export type Purpose = typeof Purpose[keyof typeof Purpose];
+declare const pdkSymbol: unique symbol;
+export type PurposeDerivedKey<P extends Purpose> = Uint8Array & {
+    readonly [pdkSymbol]: P;
+};
+declare const childKeySymbol: unique symbol;
+export type ChildKey<P extends Purpose> = Uint8Array & {
+    readonly [childKeySymbol]: P;
+};
+export type PDK = {
+    [K in keyof typeof Purpose]: ChildKey<(typeof Purpose)[K]>;
+};
+/** Host-stamped bag rlm. Peek, pull, and bag signatures use this. */
+export type HostRlm = PDK["HostRLM"];
+export declare const nullKDM: IKDM;
+export declare function asChildKey<P extends Purpose>(bytes: Uint8Array, _purpose: P): ValStat<ChildKey<P>>;
+export declare function asHostRlm(bytes: Uint8Array): ValStat<HostRlm>;
+export declare function derivePDK<P extends Purpose>({ parent, purpose, }: {
+    parent: Uint8Array;
+    purpose: P;
+}): Promise<ValStat<PurposeDerivedKey<P>>>;
+export declare function deriveChild<P extends Purpose>({ pdk, kdm, }: {
+    pdk: PurposeDerivedKey<P>;
+    kdm: Uint8Array | IKDM;
+}): Promise<ValStat<ChildKey<P>>>;
+export declare function deriveKey<P extends Purpose>({ parent, purpose, kdm, }: {
+    parent: Uint8Array;
+    purpose: P;
+    kdm: Uint8Array | IKDM;
+}): Promise<ValStat<ChildKey<P>>>;
+export {};

package/dist/web/shared/crypto/enclave.d.ts

@@ -1,43 +1,18 @@
 import type { BundleHost } from "../codecs/bundleHost.ts";
+import type { IKDM } from "../codecs/kdm.ts";
 import { Status } from "../consts.ts";
-import { MASTER_SEED_LEN, type MasterSeed, type SealedMasterKey } from "../seed.ts";
-import type { ICrypto, PublicKey } from "../types.ts";
+import { type MasterSeed, type SealedMasterKey } from "../seed.ts";
+import type { PublicKey } from "../types.ts";
 import { type ValStat } from "../valstat.ts";
-import { type DHKEReq, type DHKEResp } from "./pairing.ts";
+import { type HostRlm, type PDK } from "./derivation.ts";
+import { type DHKEReq, type DHKEResp, PairRequest } from "./pairing.ts";
 import { type LargeBlobCreateOpts, type LargeBlobRp } from "../webauthn/largeBlob.ts";
-import { type PrfCeremony, type PrfCreateOpts, type PrfEvalOpts, type PrfRp } from "../webauthn/prf.ts";
-export type { LargeBlobCreateOpts, LargeBlobRp };
-export type { PrfCreateOpts, PrfEvalOpts, PrfRp };
-/** Options for PRF seal/unseal ceremonies (no raw PRF bytes). */
-export type PasskeyPrfOpts = PrfCreateOpts & {
-    credId?: Uint8Array | readonly Uint8Array[];
-    /** Seal only: create a PRF credential first when no credId is known. */
-    createCredIfNeeded?: boolean;
-};
-/** One binding to try on unseal (cred id + sealed master). */
-export type PrfBinding = {
-    sealedMaster: SealedMasterKey;
-    credId: Uint8Array;
-};
-/** Durable PRF-sealed master + public ceremony facts (never includes PRF output). */
-export type PrfSealedMaster = PrfCeremony & {
-    sealedMaster: SealedMasterKey;
-    salt: Uint8Array;
-};
-/** One existing keyring member used to prove this enclave matches the list. */
-export type BindPrior = {
-    credId: Uint8Array;
-    tag: Uint8Array;
-};
-/** Seal + bind-tag from {@link Enclave.bind} (tag is not a global fingerprint). */
-export type PrfBound = PrfSealedMaster & {
-    tag: Uint8Array;
-};
+import { type BindPrior, type PasskeyPrfOpts, type PrfBinding, type PrfBound, type PrfSealedMaster } from "./prf.ts";
 export type EncryptCipher = {
-    encrypt: (data: Uint8Array) => Promise<Uint8Array>;
+    encrypt: (data: Uint8Array) => Promise<ValStat<Uint8Array>>;
 };
 export type DecryptCipher = {
-    decrypt: (data: Uint8Array) => Promise<Uint8Array>;
+    decrypt: (data: Uint8Array) => Promise<ValStat<Uint8Array>>;
 };
 /** Encrypt + decrypt capability for one KDM. */
 export type DerivedCipher = EncryptCipher & DecryptCipher;
@@ -50,33 +25,21 @@ export type CipherForUsage<U extends CipherUsage> = {
     both: DerivedCipher;
 }[U];
 /**
- * Path-scoped signing identity: public key is public; sign/kdmFor re-enter
+ * KDM-scoped signing identity: public key is public; sign/kdmFor re-enter
  * the enclave so the private key never leaves. Used for hosts, export files, etc.
  */
 export type Identity = {
     readonly publicKey: PublicKey;
-    sign: (message: Uint8Array | string) => Promise<Uint8Array>;
-    /** Per-bag KDM mixed with this identity's private key (see bag seal). */
-    kdmFor: (msgHeadEnc: Uint8Array) => Promise<Uint8Array>;
+    sign: (message: Uint8Array | string) => Promise<ValStat<Uint8Array>>;
+    /** Per-bag 8-byte KDM (bag-kdm PDK child keyed by the encoded head). */
+    kdmFor: (msgHeadEnc: Uint8Array) => Promise<ValStat<Uint8Array>>;
 };
-declare const SEAL_BIND_DOMAIN: Uint8Array<ArrayBufferLike>;
-declare const FP_MODE: Uint8Array<ArrayBufferLike>;
-declare const SEAL_KEY_LEN = 32;
-declare const SEAL_PRF_MIN_LEN = 16;
 /** Minimum musec length (Mandatory User-Space Entropy Contribution). */
-declare const MUSEC_MIN_LEN = 32;
-declare class PairRequest {
-    #private;
-    private constructor();
-    static create(): Promise<ValStat<PairRequest>>;
-    wipe(): void;
-    get dhkeReq(): DHKEReq;
-    finish(dhkeResp: DHKEResp): Promise<ValStat<{
-        enclave: Enclave;
-        hosts: BundleHost[];
-    }>>;
-}
-export type { PairRequest };
+export declare const MUSEC_MIN_LEN = 32;
+export declare function fromSeedHosts(buf: Uint8Array): ValStat<{
+    enclave: Enclave;
+    hosts: BundleHost[];
+}>;
 /** Brand `bytes` as {@link MasterSeed} only if length is {@link MASTER_SEED_LEN}. */
 export declare function asMasterSeed(bytes: Uint8Array): ValStat<MasterSeed>;
 export declare class Enclave {
@@ -102,7 +65,7 @@ export declare class Enclave {
      */
     sealWithPasskey(opts?: PasskeyPrfOpts): Promise<ValStat<PrfSealedMaster>>;
     /**
-     * UV + PRF seal, plus a per-cred bind tag (blake3(master ‖ domain ‖ credId)).
+     * UV + PRF seal, plus a per-cred bind tag (bindtag PDK child keyed by credId).
      * Tag compute and compare stay in the enclave. If `prior` is non-empty, every
      * stored tag must match this master or bind fails (one keyring, one master).
      */
@@ -129,8 +92,8 @@ export declare class Enclave {
     static unsealWithIkm(sealed: SealedMasterKey, ikm: Uint8Array): Promise<ValStat<Enclave>>;
     /**
      * UV + write IdentityBundle (seed + hosts) to largeBlob.
-     * Encode and WebAuthn write complete inside this method; nothing seed-bearing
-     * is returned. Prefer empty `hosts` for seed-only backup.
+     * Encode stays here; {@link writeLargeBlob} does the UV write. Nothing
+     * seed-bearing is returned. Prefer empty `hosts` for seed-only backup.
      *
      * Pass `opts.credId` to write an existing credential (one UV). Omit it to
      * create a largeBlob-capable credential then write (two UV). Returns the
@@ -186,18 +149,19 @@ export declare class Enclave {
         id: number;
         persist?: boolean;
     }): Worker;
+    realmID(realmKDM: IKDM): Promise<ValStat<PDK["RealmID"]>>;
+    hostRlm(realmKDM: IKDM, hostKDM: IKDM): Promise<ValStat<PDK["HostRLM"]>>;
+    realmForRlm(hostKDM: IKDM, rlm: HostRlm, realms: readonly IKDM[]): Promise<ValStat<IKDM>>;
     /**
-     * Cipher for public KDM. Does not hold key bytes; each op re-enters the
-     * enclave (async, hardware-shaped). `usage` selects the return shape:
+     * Cipher for public KDM under a realm (default: nullKDM). Does not hold
+     * key bytes; each op re-enters the enclave. `usage` selects the shape:
      * `"encrypt"` → `{ encrypt }`, `"decrypt"` → `{ decrypt }`, `"both"` → both.
      */
-    deriveCipher<U extends CipherUsage>(kdm: Uint8Array, usage: U): CipherForUsage<U>;
+    deriveCipher<U extends CipherUsage>(kdm: Uint8Array, usage: U, realmKDM?: IKDM): CipherForUsage<U>;
     /**
-     * Path-scoped identity (label+index). Private key stays in the enclave; only
-     * publicKey and capability methods are returned (frozen).
+     * Identity from the identity PDK + KDM. Private key stays in the enclave;
+     * only publicKey and capability methods are returned.
      */
-    deriveIdentity(keyPath: string, idx?: number): Promise<Identity>;
+    deriveIdentity(kdm: IKDM): Promise<ValStat<Identity>>;
+    fingerprint(kdm?: Uint8Array | IKDM): Promise<ValStat<PDK["Fingerprint"]>>;
 }
-/** Derive seal key from PRF output (domain-separated). Used by enclave seal/unseal. */
-export declare function sealKeyFromPrf(crypto: ICrypto, prf: Uint8Array, domain?: Uint8Array): Promise<ValStat<Uint8Array>>;
-export { FP_MODE, MASTER_SEED_LEN, MUSEC_MIN_LEN, SEAL_BIND_DOMAIN, SEAL_KEY_LEN, SEAL_PRF_MIN_LEN, };

package/dist/web/shared/crypto/largeBlob.d.ts

@@ -0,0 +1,8 @@
+import { Status } from "../consts.ts";
+import { type ValStat } from "../valstat.ts";
+import { type LargeBlobCreateOpts, type LargeBlobRp } from "../webauthn/largeBlob.ts";
+export declare function largeBlobCredId(opts?: LargeBlobCreateOpts & {
+    credId?: Uint8Array;
+}): Promise<ValStat<Uint8Array>>;
+export declare function writeLargeBlob(credId: Uint8Array, data: Uint8Array, opts?: LargeBlobRp): Promise<Status>;
+export declare function wipeLargeBlob(credId: Uint8Array, opts?: LargeBlobRp): Promise<Status>;

package/dist/web/shared/crypto/noble.d.ts

@@ -1,24 +1,17 @@
 import { type X25519Sk } from "./x25519.ts";
 import type { Blake3Opts, DerivationSeed, Hash, ICrypto, KeyPair } from "../types.ts";
-/**
- * ICrypto: noble for XSalsa20 + blake3; WebCrypto Ed25519 + X25519
- * (our scalar; RFC 7748 check before trusting pub/DH).
- */
-export declare class NobleCrypto implements ICrypto {
-    private verifyKeys;
-    genRandomBytes(bytes: number): Promise<Uint8Array>;
-    gen256BitSecureRandomSeed(): Promise<Uint8Array>;
-    encryptXSalsa20Poly1305Combined(data: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
-    decryptXSalsa20Poly1305Combined(data: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
-    deriveEd25519KeyPair(derivationSeed: DerivationSeed): Promise<KeyPair>;
-    private importSignKey;
-    private importVerifyKey;
-    signEd25519(message: Uint8Array | string, secKey: Uint8Array): Promise<Uint8Array>;
-    checkSigEd25519(sig: Uint8Array, message: Uint8Array | string, pubKey: Uint8Array): Promise<boolean>;
-    blake3(data: Uint8Array, opts?: Blake3Opts): Promise<Hash>;
-    genX25519(): Promise<{
-        priv: X25519Sk;
-        pub: Uint8Array;
-    }>;
-    x25519Shared(priv: X25519Sk, peerPub: Uint8Array): Promise<Uint8Array>;
-}
+export declare function genRandomBytes(bytes: number): Promise<Uint8Array>;
+export declare function gen256BitSecureRandomSeed(): Promise<Uint8Array>;
+export declare function encryptXSalsa20Poly1305Combined(data: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
+export declare function decryptXSalsa20Poly1305Combined(data: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
+export declare function deriveEd25519KeyPair(derivationSeed: DerivationSeed): Promise<KeyPair>;
+export declare function importVerifyKey(pubKey: Uint8Array): Promise<CryptoKey>;
+export declare function signEd25519(message: Uint8Array | string, secKey: Uint8Array): Promise<Uint8Array>;
+export declare function checkSigEd25519(sig: Uint8Array, message: Uint8Array | string, verifyKey: CryptoKey): Promise<boolean>;
+export declare function blake3(data: Uint8Array, opts?: Blake3Opts): Promise<Hash>;
+export declare function genX25519(): Promise<{
+    priv: X25519Sk;
+    pub: Uint8Array;
+}>;
+export declare function x25519Shared(priv: X25519Sk, peerPub: Uint8Array): Promise<Uint8Array>;
+export declare const noble: ICrypto;

package/dist/web/shared/crypto/pairing.d.ts

@@ -1,6 +1,8 @@
+import type { BundleHost } from "../codecs/bundleHost.ts";
 import { type ValStat } from "../valstat.ts";
+import { type PDK } from "./derivation.ts";
+import type { Enclave } from "./enclave.ts";
 import type { X25519Sk } from "./x25519.ts";
-export declare const SEAL_PAIR_DOMAIN: Uint8Array<ArrayBufferLike>;
 export declare const X25519_PUB_LEN = 32;
 /** respPub (32) ‖ XSalsa nonce (24) ‖ tag (16); plaintext follows in the ct. */
 export declare const DHKE_RESP_MIN: number;
@@ -17,5 +19,20 @@ export declare function asDHKEResp(bytes: Uint8Array): ValStat<DHKEResp>;
 export declare function pairKey(sk: X25519Sk, // local X25519 priv
 peer: Uint8Array, // ECDH peer pub (enroller: dhkeReq; enrollee: respPub)
 reqPub: Uint8Array, // enrollee pub, bound into KDF
-respPub: Uint8Array): Promise<ValStat<Uint8Array>>;
+respPub: Uint8Array): Promise<ValStat<PDK["Pair"]>>;
+export declare function sealPair(dhkeReq: DHKEReq): Promise<ValStat<{
+    key: PDK["Pair"];
+    pub: Uint8Array;
+}>>;
+export declare class PairRequest {
+    #private;
+    private constructor();
+    static create(): Promise<ValStat<PairRequest>>;
+    wipe(): void;
+    dhkeReq(): ValStat<DHKEReq>;
+    finish(dhkeResp: DHKEResp): Promise<ValStat<{
+        enclave: Enclave;
+        hosts: BundleHost[];
+    }>>;
+}
 export {};

package/dist/web/shared/crypto/prf.d.ts

@@ -0,0 +1,52 @@
+import type { SealedMasterKey } from "../seed.ts";
+import { type ValStat } from "../valstat.ts";
+import { type PDK } from "./derivation.ts";
+import { type PrfCeremony, type PrfCreateOpts, type PrfEvalOpts } from "../webauthn/prf.ts";
+/** Options for PRF seal/unseal ceremonies (no raw PRF bytes). */
+export type PasskeyPrfOpts = PrfCreateOpts & {
+    credId?: Uint8Array | readonly Uint8Array[];
+    /** Seal only: create a PRF credential first when no credId is known. */
+    createCredIfNeeded?: boolean;
+};
+/** One binding to try on unseal (cred id + sealed master). */
+export type PrfBinding = {
+    sealedMaster: SealedMasterKey;
+    credId: Uint8Array;
+    /** PRF salt for this cred. Omitted salts use the ceremony salt. */
+    salt?: Uint8Array;
+};
+/** Durable PRF-sealed master + public ceremony facts (never includes PRF output). */
+export type PrfSealedMaster = PrfCeremony & {
+    sealedMaster: SealedMasterKey;
+    salt: Uint8Array;
+};
+/** One existing keyring member used to prove this enclave matches the list. */
+export type BindPrior = {
+    credId: Uint8Array;
+    tag: PDK["BindTag"];
+};
+/** Seal + bind-tag from {@link Enclave.bind} (tag is not a global fingerprint). */
+export type PrfBound = PrfSealedMaster & {
+    tag: PDK["BindTag"];
+};
+type PrfCreateResult = PrfCeremony & {
+    prfEnabled: boolean;
+    prf?: Uint8Array;
+};
+type PrfEvalResult = PrfCeremony & {
+    prf: Uint8Array;
+};
+export declare function createPrfCred(opts?: PrfCreateOpts): Promise<ValStat<PrfCreateResult>>;
+export declare function evalPrf(opts?: PrfEvalOpts): Promise<ValStat<PrfEvalResult>>;
+export declare function sealPRF(opts: PasskeyPrfOpts | undefined): Promise<ValStat<PrfCeremony & {
+    prf: Uint8Array;
+    salt: Uint8Array;
+}>>;
+export declare function unsealPRF(bindings: readonly PrfBinding[], opts: PasskeyPrfOpts & {
+    salt: Uint8Array;
+}): Promise<ValStat<{
+    prf: Uint8Array;
+    credId: Uint8Array;
+    order: readonly PrfBinding[];
+}>>;
+export {};

package/dist/web/shared/crypto/realms.d.ts

@@ -0,0 +1,7 @@
+import { type IKDM } from "../codecs/kdm.ts";
+import { type MasterSeed } from "../seed.ts";
+import { type ValStat } from "../valstat.ts";
+import { type PDK } from "./derivation.ts";
+export declare function deriveRealmKey(parent: MasterSeed, realmKDM: IKDM): Promise<ValStat<PDK["RealmKey"]>>;
+export declare function deriveRealmID(parent: MasterSeed, realmKDM: IKDM): Promise<ValStat<PDK["RealmID"]>>;
+export declare function deriveHostRLM(parent: PDK["RealmID"], hostKDM: IKDM): Promise<ValStat<PDK["HostRLM"]>>;

package/dist/web/shared/crypto/tty.d.ts

@@ -0,0 +1,3 @@
+import { Status } from "../consts.ts";
+import { type ValStat } from "../valstat.ts";
+export declare function dumpToTty(seed: Uint8Array, fingerprint: () => Promise<ValStat<Uint8Array>>): Promise<Status>;

package/dist/web/shared/endpoint.d.ts

@@ -10,8 +10,8 @@ interface IProtoClient {
     enclave: Enclave;
     clock: IClock;
 }
-export interface IAuthenticatedEndpoint<ReqItem, Resp> {
-    encodeReq(client: IProtoClient, identity: Identity, authTS: IAuthTimestamp, body: Iterable<ReqItem>, reqEnc: Encoder): Promise<Status>;
+export interface IAuthenticatedEndpoint<ReqInput, Resp> {
+    encodeReq(client: IProtoClient, identity: Identity, authTS: IAuthTimestamp, body: ReqInput, reqEnc: Encoder): Promise<Status>;
     handleReq(host: IProtoHost, reqDec: Decoder, respEnc: Encoder): Promise<Status>;
     decodeResp(respDec: Decoder): ValStat<Resp>;
 }