@interncom/diplomatic 0.22.0 → 0.23.0

package/dist/web/shared/http.d.ts

@@ -6,66 +6,66 @@ import { ValStat } from "./valstat.ts";
 export declare const api: {
     readonly user: {
         readonly path: "/user";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<never, void>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<void, void>;
         readonly name: APICallName.User;
     };
     readonly push: {
         readonly path: "/push";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./types.ts").IBag, import("./codecs/pushItem.ts").IBagPushItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./types.ts").IBag[], import("./codecs/pushItem.ts").IBagPushItem[]>;
         readonly name: APICallName.Push;
     };
     readonly peek: {
         readonly path: "/peek";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<number, import("./codecs/peekItem.ts").IBagPeekItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./api/peek.ts").IPeekCursor, import("./codecs/peekItem.ts").IBagPeekItem[]>;
         readonly name: APICallName.Peek;
     };
     readonly pull: {
         readonly path: "/pull";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<number, import("./codecs/pullItem.ts").IBagPullItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./api/pull.ts").IPullReq, import("./codecs/pullItem.ts").IBagPullItem[]>;
         readonly name: APICallName.Pull;
     };
 };
 export declare const apiCalls: {
     readonly 0: {
         readonly path: "/user";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<never, void>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<void, void>;
         readonly name: APICallName.User;
     };
     readonly 2: {
         readonly path: "/push";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./types.ts").IBag, import("./codecs/pushItem.ts").IBagPushItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./types.ts").IBag[], import("./codecs/pushItem.ts").IBagPushItem[]>;
         readonly name: APICallName.Push;
     };
     readonly 1: {
         readonly path: "/peek";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<number, import("./codecs/peekItem.ts").IBagPeekItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./api/peek.ts").IPeekCursor, import("./codecs/peekItem.ts").IBagPeekItem[]>;
         readonly name: APICallName.Peek;
     };
     readonly 3: {
         readonly path: "/pull";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<number, import("./codecs/pullItem.ts").IBagPullItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./api/pull.ts").IPullReq, import("./codecs/pullItem.ts").IBagPullItem[]>;
         readonly name: APICallName.Pull;
     };
 };
 export declare const callPaths: {
     readonly "/user": {
         readonly path: "/user";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<never, void>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<void, void>;
         readonly name: APICallName.User;
     };
     readonly "/push": {
         readonly path: "/push";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./types.ts").IBag, import("./codecs/pushItem.ts").IBagPushItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./types.ts").IBag[], import("./codecs/pushItem.ts").IBagPushItem[]>;
         readonly name: APICallName.Push;
     };
     readonly "/peek": {
         readonly path: "/peek";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<number, import("./codecs/peekItem.ts").IBagPeekItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./api/peek.ts").IPeekCursor, import("./codecs/peekItem.ts").IBagPeekItem[]>;
         readonly name: APICallName.Peek;
     };
     readonly "/pull": {
         readonly path: "/pull";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<number, import("./codecs/pullItem.ts").IBagPullItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./api/pull.ts").IPullReq, import("./codecs/pullItem.ts").IBagPullItem[]>;
         readonly name: APICallName.Pull;
     };
 };

package/dist/web/shared/storage/memory.d.ts

@@ -1,10 +1,10 @@
 import { type IStorage } from "../types.ts";
 interface IMemoryStorage extends IStorage {
     users: Set<string>;
-    bag: Map<string, Map<number, {
+    bag: Map<string, Map<string, Map<number, {
         headCph: Uint8Array;
         bodyCph: Uint8Array;
-    }>>;
+    }>>>;
 }
 /** Fresh in-memory host storage (isolated bag/user maps). */
 export declare function createMemoryStorage(): IMemoryStorage;

package/dist/web/shared/sync.d.ts

@@ -1,9 +1,11 @@
 import { IBagPeekItem } from "./codecs/peekItem.ts";
+import type { IKDM } from "./codecs/kdm.ts";
+import { type HostRlm } from "./crypto/derivation.ts";
 import { Enclave } from "./crypto/enclave.ts";
-import { ICrypto, PublicKey } from "./types.ts";
+import { ICrypto } from "./types.ts";
 import { ValStat } from "./valstat.ts";
 export interface IDecryptedBagPeekItem {
     kdm: Uint8Array;
     headEnc: Uint8Array;
 }
-export declare function decryptPeekItem(item: IBagPeekItem, pubKey: PublicKey, enclave: Enclave, crypto: ICrypto): Promise<ValStat<IDecryptedBagPeekItem>>;
+export declare function decryptPeekItem(item: IBagPeekItem, verifyKey: CryptoKey, enclave: Enclave, crypto: ICrypto, rlm: HostRlm, realm?: IKDM): Promise<ValStat<IDecryptedBagPeekItem>>;

package/dist/web/shared/types.d.ts

@@ -4,6 +4,7 @@ import { IAuthTimestamp } from "./codecs/authTimestamp.ts";
 import type { IBagPeekItem } from "./codecs/peekItem.ts";
 import { IUsageQuota } from "./codecs/usageQuota.ts";
 import { APICallName, Status } from "./consts.ts";
+import type { HostRlm } from "./crypto/derivation.ts";
 import type { ValStat } from "./valstat.ts";
 /** Identity seed brands — defined in seed.ts; re-exported for convenience. */
 export type { MasterSeed, SealedMasterKey } from "./seed.ts";
@@ -75,27 +76,35 @@ export type IDeleteParams = {
     eid: EntityID;
     force?: boolean;
 };
+/** One setBags outcome. Success carries the host seq in that bag's rlm. */
+export type ISetBagResult = {
+    status: Status.Success;
+    seq: number;
+} | {
+    status: Exclude<Status, Status.Success>;
+};
 export interface IStorage {
     addUser: (pubKey: PublicKey) => Promise<ValStat<void>>;
     hasUser: (pubKey: PublicKey) => Promise<ValStat<boolean>>;
     subMeta: (pubKey: PublicKey) => Promise<ValStat<ISubscriptionMetadata>>;
     /**
-     * Store bags for a user. Returns host seq for each bag in order.
-     * Empty list succeeds with []. Implementations must assign contiguous
-     * seqs atomically (transaction / single batch) so concurrent writers
-     * cannot claim the same seq.
+     * Store bags for a user. One result per input bag, same order.
+     * An invalid rlm is InvalidParam for that bag; the others are still stored.
+     * Seqs are contiguous per rlm among stored bags, assigned atomically so
+     * concurrent writers cannot claim the same seq in the same rlm.
+     * Empty list succeeds with []. A storage failure fails the call.
      */
-    setBags: (pubKey: PublicKey, bags: IBag[]) => Promise<ValStat<number[]>>;
+    setBags: (pubKey: PublicKey, bags: IBag[]) => Promise<ValStat<ISetBagResult[]>>;
     /**
-     * Fetch ciphertext bodies for the given host seqs.
-     * Returns only seqs that exist (missing seqs are omitted, not an error).
-     * Empty `seqs` succeeds with [].
+     * Fetch ciphertext bodies for `seqs` in `rlm`.
+     * Missing seqs are omitted. Empty `seqs` succeeds with [].
      */
-    getBodies: (pubKey: PublicKey, seqs: number[]) => Promise<ValStat<{
+    getBodies: (pubKey: PublicKey, rlm: HostRlm, seqs: number[]) => Promise<ValStat<{
         seq: number;
         bodyCph: Uint8Array;
     }[]>>;
-    listHeads: (pubKey: PublicKey, minSeq: number) => Promise<ValStat<IBagPeekItem[]>>;
+    /** Heads in `rlm` with seq greater than minSeq, ordered by seq. */
+    listHeads: (pubKey: PublicKey, rlm: HostRlm, minSeq: number) => Promise<ValStat<IBagPeekItem[]>>;
 }
 export interface KeyPair {
     keyType: "ed25519";
@@ -123,7 +132,8 @@ export type Hash = Uint8Array & {
     readonly [hashSymbol]: true;
 };
 export interface IHostCrypto {
-    checkSigEd25519: (sig: Uint8Array, message: Uint8Array | string, pubKey: PublicKey) => Promise<boolean>;
+    importVerifyKey: (pubKey: PublicKey) => Promise<CryptoKey>;
+    checkSigEd25519: (sig: Uint8Array, message: Uint8Array | string, verifyKey: CryptoKey) => Promise<boolean>;
 }
 /** BLAKE3 hash / MAC / KDF (noble: `key` XOR `context`, not both). */
 export type Blake3Opts = {
@@ -168,6 +178,9 @@ export interface IPushListener {
     disconnect(): void;
 }
 export interface IBagHeader {
+    /** HostRLM. Covered by sig, with headCph. */
+    rlm: HostRlm;
+    /** Ed25519 over rlm ‖ headCph. First field on the wire. */
     sig: Uint8Array;
     kdm: Uint8Array;
 }

package/dist/web/shared/webauthn/prf.d.ts

@@ -29,6 +29,14 @@ export type PrfEvalOpts = PrfRp & {
     /** One id, or every bound id so a spare key can assert in one get(). */
     credId?: Uint8Array | readonly Uint8Array[];
     salt?: Uint8Array;
+    /**
+     * Salt for each cred when accounts do not share one.
+     * Sent as evalByCredential so the passkey the user picks evals its own.
+     */
+    salts?: readonly {
+        credId: Uint8Array;
+        salt: Uint8Array;
+    }[];
 };
 /** Best-effort: client advertises PRF extension. */
 export declare function prfCapable(): Promise<boolean>;

package/dist/web/stores/cursor.d.ts

@@ -0,0 +1,30 @@
+import type { IKDM } from "../shared/codecs/kdm";
+import type { HostSeqsUpdate } from "../types";
+import type { IRealm } from "./realm";
+/** One host-realm cursor. The realm KDM plus the newest bag seq. */
+export interface RealmCursor extends IKDM {
+    lastSeq: number;
+}
+declare const downloadKeySymbol: unique symbol;
+/** Key of one queued download: host label, realm, and seq. */
+export type DownloadKey = string & {
+    readonly [downloadKeySymbol]: true;
+};
+type CursorRow = {
+    lastSeq: number;
+    seqs?: RealmCursor[];
+};
+export declare function isDefaultRealm(realm?: IKDM): boolean;
+export declare function sameRealm(a: IKDM, b: IKDM): boolean;
+export declare function realmKey(realm: IKDM): string;
+export declare function cursorOf(row: CursorRow, realm?: IKDM): number;
+export declare function realmKDMs(rows: readonly IRealm[]): IKDM[];
+export declare function realmKDM(label: string | undefined, rows: readonly IRealm[]): IKDM;
+export declare function storedRealm(realm: IKDM): IKDM | undefined;
+export declare function downloadKey(host: string, seq: number, realm?: IKDM): DownloadKey;
+export declare function nextCursor(cur: number, u: HostSeqsUpdate): number | undefined;
+export declare function projectCursors(cursors: readonly RealmCursor[]): {
+    lastSeq: number;
+    seqs?: RealmCursor[];
+};
+export {};

package/dist/web/stores/idb/account.d.ts

@@ -0,0 +1,58 @@
+import { Status } from "../../shared/consts";
+import { Enclave } from "../../shared/crypto/enclave";
+import type { ICrypto } from "../../shared/types";
+import { type ValStat } from "../../shared/valstat";
+import type { PrfRp } from "../../shared/webauthn/prf";
+import type { IAccountStore, SetSeedOpts } from "../../types";
+import { type Keyring, PrfSeedStore, type PrfSeedStoreOpts } from "../../passkey/prf-store";
+import { type KeyTag } from "../keyTag";
+/**
+ * One account: its label, catalog id, database names, key tag, and the
+ * binding that unseals its key.
+ */
+export type Account = {
+    label: string;
+    /** Stable id. Database names are derived from this. */
+    acct?: string;
+    /** Protocol database name. */
+    data?: string;
+    /** EntDB name. Absent until EntDB is opened. */
+    ents?: string;
+    keyTag?: KeyTag;
+    keyring?: Keyring;
+};
+export declare function decodeAccount(raw: unknown): Account | undefined;
+export declare class IDBAccountStore implements IAccountStore {
+    #private;
+    db: IDBDatabase;
+    constructor(db: IDBDatabase, crypto: ICrypto);
+    setCloser(close: () => void): void;
+    /**
+     * Mint an account key with {@link Enclave.fromRandom} and store its key tag.
+     * A blank label is "". A label that already names a key is unchanged.
+     * An existing keyring on that row is kept. musec is wiped.
+     */
+    create(label: string, musec: Uint8Array): Promise<ValStat<Enclave>>;
+    /**
+     * Record the key tag for `opts.label`. Does not open the account.
+     * Durable identity is the account keyring
+     * ({@link openPrfStore} / {@link persistKeyring}), never plain seed.
+     * The row is created on the first save. A later save must match that
+     * account's key tag. `opts.persist` is ignored (kept for API compatibility).
+     *
+     * TODO(passphrase): when PRF is missing, seal under a passphrase KDF
+     * and store that ciphertext on this account row.
+     */
+    save(enclave: Enclave, opts?: SetSeedOpts): Promise<ValStat<Enclave>>;
+    dataName(label: string): Promise<string | undefined>;
+    ensureEnts(label: string): Promise<string>;
+    wipe(): Promise<void>;
+    loadKeyring(label?: string): Promise<Keyring | undefined>;
+    persistKeyring(ring: Keyring | undefined, label?: string): Promise<Status>;
+    hasKeyring(label?: string): Promise<boolean>;
+    unlock(opts: PrfRp): Promise<ValStat<{
+        enclave: Enclave;
+        label: string;
+    }>>;
+    openPrfStore(opts: Omit<PrfSeedStoreOpts, "persistKeyring" | "keyring" | "unlockAccount">, label?: string): Promise<ValStat<PrfSeedStore>>;
+}

package/dist/web/stores/idb/catalog.d.ts

@@ -0,0 +1 @@
+export declare function entsNameFor(label: string): Promise<string>;

package/dist/web/stores/idb/dnlds.d.ts

@@ -1,9 +1,10 @@
+import type { IKDM } from "../../shared/codecs/kdm";
 import { IDownloadMessage, IDownloadQueue } from "../../types";
 export declare class IDBDownloadQueue implements IDownloadQueue {
-    db: IDBDatabase;
+    private db;
     constructor(db: IDBDatabase);
     enq(msgs: Iterable<IDownloadMessage>): Promise<void>;
-    deq(host: string, seqs: Iterable<number>): Promise<void>;
+    deq(host: string, seqs: Iterable<number>, realm?: IKDM): Promise<void>;
     list(): Promise<IDownloadMessage[]>;
     count(): Promise<number>;
     wipe(): Promise<void>;

package/dist/web/stores/idb/hosts.d.ts

@@ -1,20 +1,21 @@
+import type { IKDM } from "../../shared/codecs/kdm";
 import { Status } from "../../shared/consts";
 import { IHostConnectionInfo, IHostMetadata } from "../../shared/types";
-import type { HostStatsUpdate, IHostRow, IHostStore } from "../../types";
+import type { HostSeqsUpdate, IHostRow, IHostStore } from "../../types";
 export declare class IDBHostStore implements IHostStore<URL> {
-    db: IDBDatabase;
+    private db;
     constructor(db: IDBDatabase);
     /**
-     * Upsert connection info. Same label + same handle/idx keeps lastSeq and
-     * host meta (safe re-link). Changing handle/idx resets the peek cursor.
+     * Upsert connection info. Same label + same handle/idx keeps cursors and
+     * host meta (safe re-link). Changing handle/idx clears host_seqs.
      */
     add(info: IHostConnectionInfo<URL>): Promise<void>;
-    private put;
-    touch(label: string, seq: number): Promise<void>;
-    recordStats(label: string, u: HostStatsUpdate): Promise<void>;
+    touch(label: string, seq: number, realm?: IKDM): Promise<void>;
+    recordSeqs(label: string, u: HostSeqsUpdate, realm?: IKDM): Promise<void>;
     get(label: string): Promise<IHostRow<URL> | undefined>;
     set(label: string, meta: IHostMetadata): Promise<Status.Success | Status.NotFound | Status.DatabaseError>;
     del(label: string): Promise<void>;
     list(): Promise<IHostRow<URL>[]>;
     wipe(): Promise<void>;
+    private put;
 }

package/dist/web/stores/idb/idbutil.d.ts

@@ -0,0 +1,2 @@
+export declare function deleteDatabase(name: string): Promise<void>;
+export declare function openAt(name: string, version: number, upgrade: (db: IDBDatabase, tx: IDBTransaction) => void): Promise<IDBDatabase>;

package/dist/web/stores/idb/migrate.d.ts

@@ -0,0 +1,2 @@
+export declare function openMetaDB(): Promise<IDBDatabase>;
+export declare function openDataDB(name: string): Promise<IDBDatabase>;

package/dist/web/stores/idb/msgs.d.ts

@@ -3,8 +3,8 @@ import { ICrypto } from "../../shared/types";
 import { EntityID, Hash } from "../../shared/types";
 import { ApldState, IMessageStore, IStorableMessage, IStoredMessage, ListMsgsOpts } from "../../types";
 export declare class IDBMessageStore implements IMessageStore {
+    private db;
     private crypto;
-    db: IDBDatabase;
     constructor(db: IDBDatabase, crypto: ICrypto);
     add(messages: IStorableMessage[]): Promise<Status[]>;
     del(keys: Iterable<Hash>): Promise<void>;

package/dist/web/stores/idb/names.d.ts

@@ -0,0 +1,13 @@
+/** Account catalog. Unlock reads only this database. */
+export declare const META_DB_NAME = "meta";
+export declare const META_DB_VERSION = 1;
+/** Protocol database: archive, queues, hosts, realm counters, host cursors. */
+export declare const DATA_DB_VERSION = 9;
+export declare function mintAcct(): string;
+export declare function dataDbName(acct: string): string;
+export declare function entsDbName(acct: string): string;
+export declare function placeAccount(acct: string | undefined, data: string | undefined): {
+    acct: string;
+    data: string;
+};
+export declare function assignEnts(acct: string, current: string | undefined): string;

package/dist/web/stores/idb/realms.d.ts

@@ -0,0 +1,11 @@
+import { Status } from "../../shared/consts";
+import { type IRealm, type IRealmStore } from "../realm";
+/** Realm counters for the open account. The database is that account. */
+export declare class IDBRealmStore implements IRealmStore {
+    private db;
+    constructor(db: IDBDatabase);
+    list(): Promise<IRealm[]>;
+    get(label: string): Promise<IRealm | undefined>;
+    put(label: string, index: number): Promise<Status>;
+    wipe(): Promise<void>;
+}

package/dist/web/stores/idb/store.d.ts

@@ -1,12 +1,12 @@
+import { Status } from "../../shared/consts";
 import { ICrypto } from "../../shared/types";
-import { IStore } from "../../types";
-import { IDBDownloadQueue } from "./dnlds";
-import { IDBHostStore } from "./hosts";
-import { IDBMessageStore } from "./msgs";
-import { IDBSeedStore } from "./seed";
-import { IDBUploadQueue } from "./uplds";
-export declare const SEED_META_TABLE = "seedMeta";
+import { type ValStat } from "../../shared/valstat";
+import { IAccountStore, IDownloadQueue, IHostStore, IMessageStore, IStore, IUploadQueue } from "../../types";
+import type { IRealmStore } from "../realm";
+export declare const ACCOUNTS_TABLE = "accounts";
 export declare const HOSTS_TABLE = "hosts";
+/** Host-realm cursors. Key is host, realm label, realm index. */
+export declare const HOST_SEQS_TABLE = "host_seqs";
 export declare const UPLOAD_QUEUE_TABLE = "uploadQueue";
 export declare const DOWNLOAD_QUEUE_TABLE = "downloadQueue";
 export declare const MESSAGES_TABLE = "messages";
@@ -16,22 +16,29 @@ export declare const MESSAGES_TABLE = "messages";
  * strings keep keys compact.
  */
 export declare const MESSAGES_APLD_INDEX = "apld";
-/** Schema version: v3 adds messages.apld index for the apply queue. */
-export declare const DIPLOMATIC_STORE_DB_VERSION = 3;
-export declare const DIPLOMATIC_STORE_DB_NAME = "diplomatic-store-db";
+/** Realm label. Default-realm rows omit rlm and are not in this index. */
+export declare const MESSAGES_RLM_INDEX = "rlm";
+export declare const REALMS_TABLE = "realms";
 export declare class IDBStore implements IStore<URL> {
-    seed: IDBSeedStore;
-    hosts: IDBHostStore;
-    uploads: IDBUploadQueue;
-    downloads: IDBDownloadQueue;
-    messages: IDBMessageStore;
-    db: IDBDatabase;
-    constructor(db: IDBDatabase, crypto: ICrypto);
+    #private;
+    account: IAccountStore;
+    realms: IRealmStore;
+    hosts: IHostStore<URL>;
+    uploads: IUploadQueue;
+    downloads: IDownloadQueue;
+    messages: IMessageStore;
+    constructor(account: IAccountStore, crypto: ICrypto, lookup?: (label: string) => Promise<string | undefined>, db?: IDBDatabase);
+    bind(label: string): Promise<Status>;
+    prepareWorker(label: string): Promise<ValStat<{
+        data: string;
+        ents: string;
+    }>>;
+    close(): void;
     /**
      * Clear protocol tables only (not seed). Seed is wiped only via
-     * {@link ISeedStore.wipe} when client.wipe({ seed: true }).
+     * {@link IAccountStore.wipe} when client.wipe({ seed: true }).
      */
     wipe(): Promise<void>;
 }
-export declare function openIDBStoreDB(): Promise<IDBDatabase>;
 export declare function openIDBStore(crypto: ICrypto): Promise<IDBStore>;
+export declare function openBoundStore(crypto: ICrypto, data: string): Promise<IDBStore>;

package/dist/web/stores/idb/uplds.d.ts

@@ -1,7 +1,7 @@
 import { Hash } from "../../shared/types";
 import { IUploadQueue } from "../../types";
 export declare class IDBUploadQueue implements IUploadQueue {
-    db: IDBDatabase;
+    private db;
     constructor(db: IDBDatabase);
     enq(host: string, hshs: Iterable<Hash>): Promise<void>;
     deq(host: string, hshs: Iterable<Hash>): Promise<void>;

package/dist/web/stores/keyTag.d.ts

@@ -0,0 +1,14 @@
+import { type PDK } from "../shared/crypto/derivation";
+import type { Enclave } from "../shared/crypto/enclave";
+import type { ICrypto } from "../shared/types";
+import { type ValStat } from "../shared/valstat";
+/** Nonce plus the fingerprint child that names the master. */
+export type KeyTag = {
+    n: Uint8Array;
+    h: PDK["Fingerprint"];
+};
+export declare function keyTagDigest(enclave: Enclave, nonce: Uint8Array): Promise<ValStat<PDK["Fingerprint"]>>;
+export declare function makeKeyTag(crypto: ICrypto, enclave: Enclave): Promise<ValStat<KeyTag>>;
+export declare function keyTagMatches(enclave: Enclave, tag: KeyTag): Promise<boolean>;
+export declare function decodeKeyTag(raw: unknown): KeyTag | undefined;
+export declare function cloneKeyTag(tag: KeyTag): KeyTag;

package/dist/web/stores/label.d.ts

@@ -0,0 +1,3 @@
+import { type ValStat } from "../shared/valstat";
+export declare function accountLabel(raw: string | undefined): ValStat<string>;
+export declare function singleAccountLabel(current: string | undefined, raw: string | undefined, occupied: boolean): ValStat<string>;

package/dist/web/stores/memory/account.d.ts

@@ -0,0 +1,14 @@
+import type { Enclave } from "../../shared/crypto/enclave";
+import type { ICrypto } from "../../shared/types";
+import { type ValStat } from "../../shared/valstat";
+import type { IAccountStore, SetSeedOpts } from "../../types";
+import { type KeyTag } from "../keyTag";
+/** Account list in memory. One slot per label. The client holds the open account. */
+export declare class MemoryAccountStore implements IAccountStore {
+    #private;
+    constructor(crypto: ICrypto);
+    save(enclave: Enclave, opts?: SetSeedOpts): Promise<ValStat<Enclave>>;
+    wipe(): Promise<void>;
+    /** Test helper: snapshot of one account's key tag. Omitted label is "". */
+    peekKeyTag(label?: string): KeyTag | undefined;
+}

package/dist/web/stores/memory/dnlds.d.ts

@@ -1,8 +1,10 @@
+import type { IKDM } from "../../shared/codecs/kdm";
 import { IDownloadMessage, IDownloadQueue } from "../../types";
+import { type DownloadKey } from "../cursor";
 export declare class MemoryDownloadQueue implements IDownloadQueue {
-    queue: Map<string, IDownloadMessage>;
+    queue: Map<DownloadKey, IDownloadMessage>;
     enq(msgs: Iterable<IDownloadMessage>): Promise<void>;
-    deq(host: string, seqs: Iterable<number>): Promise<void>;
+    deq(host: string, seqs: Iterable<number>, realm?: IKDM): Promise<void>;
     list(): Promise<IDownloadMessage[]>;
     count(): Promise<number>;
     wipe(): Promise<void>;

package/dist/web/stores/memory/hosts.d.ts

@@ -1,18 +1,20 @@
+import type { IKDM } from "../../shared/codecs/kdm";
 import { Status } from "../../shared/consts";
 import { HostHandle, IHostConnectionInfo, IHostMetadata } from "../../shared/types";
-import type { HostStatsUpdate, IHostRow, IHostStore } from "../../types";
+import type { HostSeqsUpdate, IHostRow, IHostStore } from "../../types";
 export declare class MemoryHostStore<Handle extends HostHandle> implements IHostStore<Handle> {
+    #private;
     hosts: Map<string, IHostRow<Handle>>;
     /**
-     * Upsert connection info. Same label + same handle/idx keeps lastSeq and
-     * host meta (safe re-link). Changing handle/idx resets the peek cursor.
+     * Upsert connection info. Same label + same handle/idx keeps cursors and
+     * host meta (safe re-link). Changing handle/idx clears cursors.
      */
     add(info: IHostConnectionInfo<Handle>): Promise<void>;
-    touch(label: string, seq: number): Promise<void>;
-    recordStats(label: string, u: HostStatsUpdate): Promise<void>;
+    touch(label: string, seq: number, realm?: IKDM): Promise<void>;
+    recordSeqs(label: string, u: HostSeqsUpdate, realm?: IKDM): Promise<void>;
     get(label: string): Promise<IHostRow<Handle> | undefined>;
     set(label: string, meta: IHostMetadata): Promise<Status.Success | Status.NotFound>;
     del(label: string): Promise<void>;
-    list(): Promise<MapIterator<IHostRow<Handle>>>;
+    list(): Promise<IHostRow<Handle>[]>;
     wipe(): Promise<void>;
 }

package/dist/web/stores/memory/realms.d.ts

@@ -0,0 +1,10 @@
+import { Status } from "../../shared/consts";
+import { type IRealm, type IRealmStore } from "../realm";
+/** Realm counters in memory. One store is one account. */
+export declare class MemoryRealmStore implements IRealmStore {
+    #private;
+    list(): Promise<IRealm[]>;
+    get(label: string): Promise<IRealm | undefined>;
+    put(label: string, index: number): Promise<Status>;
+    wipe(): Promise<void>;
+}

package/dist/web/stores/memory/store.d.ts

@@ -1,16 +1,20 @@
+import { Status } from "../../shared/consts";
 import { HostHandle, ICrypto } from "../../shared/types";
 import { IStore } from "../../types";
 import { MemoryDownloadQueue } from "./dnlds";
 import { MemoryHostStore } from "./hosts";
 import { MemoryMessageStore } from "./msgs";
-import { MemorySeedStore } from "./seed";
+import { MemoryAccountStore } from "./account";
+import { MemoryRealmStore } from "./realms";
 import { MemoryUploadQueue } from "./uplds";
 export declare class MemoryStore<Handle extends HostHandle> implements IStore<Handle> {
-    seed: MemorySeedStore;
+    account: MemoryAccountStore;
+    realms: MemoryRealmStore;
     hosts: MemoryHostStore<Handle>;
     uploads: MemoryUploadQueue;
     downloads: MemoryDownloadQueue;
     messages: MemoryMessageStore;
     constructor(crypto: ICrypto);
+    bind(): Promise<Status>;
     wipe(): Promise<void>;
 }

package/dist/web/stores/realm.d.ts

@@ -0,0 +1,35 @@
+import { Status } from "../shared/consts";
+import { type ValStat } from "../shared/valstat";
+declare const entRlmSymbol: unique symbol;
+/** Non-empty realm label on an ent or archived message. */
+export type EntRlm = string & {
+    readonly [entRlmSymbol]: true;
+};
+/** One realm. `index` is the current KDM counter; `prior` are older ones. */
+export interface IRealm {
+    label: string;
+    index: number;
+    /** Counters older than `index` whose bags may still exist. */
+    prior?: number[];
+}
+/** Realm label for a row. The default realm ("" or missing) is omitted. */
+export declare function realmLabel(raw: unknown): EntRlm | undefined;
+/** Drops `rlm` when this row is in the default realm. */
+export declare function omitDefaultRealm<T extends {
+    rlm?: EntRlm | string;
+}>(row: T): T;
+export declare function decodeRealm(raw: unknown): IRealm | undefined;
+export declare function advanceRealm(label: string, prev: IRealm | undefined, index: number): ValStat<IRealm>;
+/** Realm counters for one account. The store is that account. */
+export interface IRealmStore {
+    list(): Promise<IRealm[]>;
+    /** One realm, or undefined when this account has no row for the label. */
+    get(label: string): Promise<IRealm | undefined>;
+    /**
+     * Set the current index.
+     * A higher index keeps the previous one in `prior`.
+     */
+    put(label: string, index: number): Promise<Status>;
+    wipe(): Promise<void>;
+}
+export {};