@interncom/diplomatic 0.22.0 → 0.24.0

package/dist/cli/shared/codecs/notifItem.d.ts

@@ -1,6 +1,8 @@
 import { ICodecStruct } from "../codec.ts";
+import { type HostRlm } from "../crypto/derivation.ts";
 export interface IBagNotifItem {
     seq: number;
+    rlm: HostRlm;
     headCph: Uint8Array;
     bodyCph?: Uint8Array;
 }

package/dist/cli/shared/crypto/bagman.d.ts

@@ -0,0 +1,19 @@
+import type { IKDM } from "../codecs/kdm.ts";
+import type { PublicKey } from "../types.ts";
+import { type ValStat } from "../valstat.ts";
+import type { HostRlm, PDK } from "./derivation.ts";
+export declare class BagManager {
+    #private;
+    readonly publicKey: PublicKey;
+    private idnt;
+    private realm;
+    readonly rlm: HostRlm;
+    readonly idKDM: Readonly<IKDM>;
+    readonly realmKDM: Readonly<IKDM>;
+    private constructor();
+    static init(idnt: PDK["Identity"], realm: PDK["RealmKey"], rlm: HostRlm, idKDM: IKDM, realmKDM: IKDM): Promise<ValStat<BagManager>>;
+    sign(message: Uint8Array | string): Promise<ValStat<Uint8Array>>;
+    bagKDM(msgHeadEnc: Uint8Array): Promise<ValStat<Uint8Array>>;
+    encrypt(kdm: Uint8Array, data: Uint8Array): Promise<ValStat<Uint8Array>>;
+    decrypt(kdm: Uint8Array, data: Uint8Array): Promise<ValStat<Uint8Array>>;
+}

package/dist/cli/shared/crypto/binary.d.ts

@@ -0,0 +1 @@
+export declare function bytesEqual(a: Uint8Array, b: Uint8Array): boolean;

package/dist/cli/shared/crypto/derivation.d.ts

@@ -0,0 +1,45 @@
+import { type IKDM } from "../codecs/kdm.ts";
+import { type ValStat } from "../valstat.ts";
+export declare const Purpose: {
+    readonly Identity: "diplomatic.identity.v1";
+    readonly Cipher: "diplomatic.cipher.v1";
+    readonly Bind: "diplomatic.bind.v1";
+    readonly BindTag: "diplomatic.bindtag.v1";
+    readonly Fingerprint: "diplomatic.fingerprint.v1";
+    readonly Pair: "diplomatic.qrpair.v1";
+    readonly BagKdm: "diplomatic.bagkdm.v1";
+    readonly RealmKey: "diplomatic.realmKey.v1";
+    readonly RealmID: "diplomatic.realmID.v1";
+    readonly HostRLM: "diplomatic.hostRLM.v1";
+};
+export type Purpose = typeof Purpose[keyof typeof Purpose];
+declare const pdkSymbol: unique symbol;
+export type PurposeDerivedKey<P extends Purpose> = Uint8Array & {
+    readonly [pdkSymbol]: P;
+};
+declare const childKeySymbol: unique symbol;
+export type ChildKey<P extends Purpose> = Uint8Array & {
+    readonly [childKeySymbol]: P;
+};
+export type PDK = {
+    [K in keyof typeof Purpose]: ChildKey<(typeof Purpose)[K]>;
+};
+/** Host-stamped bag rlm. Peek, pull, and bag signatures use this. */
+export type HostRlm = PDK["HostRLM"];
+export declare const nullKDM: IKDM;
+export declare function asChildKey<P extends Purpose>(bytes: Uint8Array, _purpose: P): ValStat<ChildKey<P>>;
+export declare function asHostRlm(bytes: Uint8Array): ValStat<HostRlm>;
+export declare function derivePDK<P extends Purpose>({ parent, purpose, }: {
+    parent: Uint8Array;
+    purpose: P;
+}): Promise<ValStat<PurposeDerivedKey<P>>>;
+export declare function deriveChild<P extends Purpose>({ pdk, kdm, }: {
+    pdk: PurposeDerivedKey<P>;
+    kdm: Uint8Array | IKDM;
+}): Promise<ValStat<ChildKey<P>>>;
+export declare function deriveKey<P extends Purpose>({ parent, purpose, kdm, }: {
+    parent: Uint8Array;
+    purpose: P;
+    kdm: Uint8Array | IKDM;
+}): Promise<ValStat<ChildKey<P>>>;
+export {};

package/dist/cli/shared/crypto/enclave.d.ts

@@ -1,98 +1,38 @@
 import type { BundleHost } from "../codecs/bundleHost.ts";
+import type { IKDM } from "../codecs/kdm.ts";
+import type { MasterSeed, SealedMasterKey } from "../seed.ts";
+import type { ValStat } from "../valstat.ts";
+import type { PDK } from "./derivation.ts";
+import type { DHKEReq, DHKEResp } from "./pairing.ts";
+import type { LargeBlobCreateOpts, LargeBlobRp } from "../webauthn/largeBlob.ts";
+import type { BindPrior, PasskeyPrfOpts, PrfBinding, PrfBound, PrfSealedMaster } from "./prf.ts";
 import { Status } from "../consts.ts";
-import { MASTER_SEED_LEN, type MasterSeed, type SealedMasterKey } from "../seed.ts";
-import type { ICrypto, PublicKey } from "../types.ts";
-import { type ValStat } from "../valstat.ts";
-import { type DHKEReq, type DHKEResp } from "./pairing.ts";
-import { type LargeBlobCreateOpts, type LargeBlobRp } from "../webauthn/largeBlob.ts";
-import { type PrfCeremony, type PrfCreateOpts, type PrfEvalOpts, type PrfRp } from "../webauthn/prf.ts";
-export type { LargeBlobCreateOpts, LargeBlobRp };
-export type { PrfCreateOpts, PrfEvalOpts, PrfRp };
-/** Options for PRF seal/unseal ceremonies (no raw PRF bytes). */
-export type PasskeyPrfOpts = PrfCreateOpts & {
-    credId?: Uint8Array | readonly Uint8Array[];
-    /** Seal only: create a PRF credential first when no credId is known. */
-    createCredIfNeeded?: boolean;
-};
-/** One binding to try on unseal (cred id + sealed master). */
-export type PrfBinding = {
-    sealedMaster: SealedMasterKey;
-    credId: Uint8Array;
-};
-/** Durable PRF-sealed master + public ceremony facts (never includes PRF output). */
-export type PrfSealedMaster = PrfCeremony & {
-    sealedMaster: SealedMasterKey;
-    salt: Uint8Array;
-};
-/** One existing keyring member used to prove this enclave matches the list. */
-export type BindPrior = {
-    credId: Uint8Array;
-    tag: Uint8Array;
-};
-/** Seal + bind-tag from {@link Enclave.bind} (tag is not a global fingerprint). */
-export type PrfBound = PrfSealedMaster & {
-    tag: Uint8Array;
-};
-export type EncryptCipher = {
-    encrypt: (data: Uint8Array) => Promise<Uint8Array>;
-};
-export type DecryptCipher = {
-    decrypt: (data: Uint8Array) => Promise<Uint8Array>;
-};
-/** Encrypt + decrypt capability for one KDM. */
-export type DerivedCipher = EncryptCipher & DecryptCipher;
-/** Which ops the caller needs; only those methods are present on the handle. */
-export type CipherUsage = "encrypt" | "decrypt" | "both";
-/** Return shape of `deriveCipher` for a given usage (type-level enforcement). */
-export type CipherForUsage<U extends CipherUsage> = {
-    encrypt: EncryptCipher;
-    decrypt: DecryptCipher;
-    both: DerivedCipher;
-}[U];
-/**
- * Path-scoped signing identity: public key is public; sign/kdmFor re-enter
- * the enclave so the private key never leaves. Used for hosts, export files, etc.
- */
-export type Identity = {
-    readonly publicKey: PublicKey;
-    sign: (message: Uint8Array | string) => Promise<Uint8Array>;
-    /** Per-bag KDM mixed with this identity's private key (see bag seal). */
-    kdmFor: (msgHeadEnc: Uint8Array) => Promise<Uint8Array>;
-};
-declare const SEAL_BIND_DOMAIN: Uint8Array<ArrayBufferLike>;
-declare const FP_MODE: Uint8Array<ArrayBufferLike>;
-declare const SEAL_KEY_LEN = 32;
-declare const SEAL_PRF_MIN_LEN = 16;
+import { PairRequest } from "./pairing.ts";
+import { BagManager } from "./bagman.ts";
 /** Minimum musec length (Mandatory User-Space Entropy Contribution). */
-declare const MUSEC_MIN_LEN = 32;
-declare class PairRequest {
-    #private;
-    private constructor();
-    static create(): Promise<ValStat<PairRequest>>;
-    wipe(): void;
-    get dhkeReq(): DHKEReq;
-    finish(dhkeResp: DHKEResp): Promise<ValStat<{
-        enclave: Enclave;
-        hosts: BundleHost[];
-    }>>;
-}
-export type { PairRequest };
+export declare const MUSEC_MIN_LEN = 32;
+export declare function fromSeedHosts(buf: Uint8Array): ValStat<{
+    enclave: OuterEnclave;
+    hosts: BundleHost[];
+}>;
 /** Brand `bytes` as {@link MasterSeed} only if length is {@link MASTER_SEED_LEN}. */
 export declare function asMasterSeed(bytes: Uint8Array): ValStat<MasterSeed>;
-export declare class Enclave {
+declare class OuterEnclave {
     #private;
     private constructor();
     /**
      * New enclave: blake3(OS CSPRNG ‖ musec). musec is required (MUSEC_MIN_LEN).
-     * Mix stays in this method; musec is wiped before return.
+     * Musec is wiped on every return, including rejection and a throw from the
+     * OS generator. A rejected digest is wiped. The stored seed is that digest
+     * buffer, so the success path must not wipe it.
      */
-    static fromRandom(musec: Uint8Array): Promise<ValStat<Enclave>>;
+    static fromRandom(musec: Uint8Array): Promise<ValStat<OuterEnclave>>;
     /**
      * Construct from raw master seed bytes (import / bootstrap only).
      * Copies the seed so callers may zero their buffer after success.
      * Prefer {@link fromRandom} or {@link unsealWithPasskey} for normal flows.
      */
-    static fromBytes(bytes: Uint8Array): ValStat<Enclave>;
+    static fromBytes(bytes: Uint8Array): ValStat<OuterEnclave>;
     /**
      * UV + PRF ceremony, then AEAD-seal master. Returns sealed ciphertext + public
      * meta only — never PRF output. Sealed blob on disk is useless without a
@@ -102,7 +42,7 @@ export declare class Enclave {
      */
     sealWithPasskey(opts?: PasskeyPrfOpts): Promise<ValStat<PrfSealedMaster>>;
     /**
-     * UV + PRF seal, plus a per-cred bind tag (blake3(master ‖ domain ‖ credId)).
+     * UV + PRF seal, plus a per-cred bind tag (bindtag PDK child keyed by credId).
      * Tag compute and compare stay in the enclave. If `prior` is non-empty, every
      * stored tag must match this master or bind fails (one keyring, one master).
      */
@@ -114,23 +54,23 @@ export declare class Enclave {
     static unsealWithPasskey(bindings: readonly PrfBinding[], opts: PasskeyPrfOpts & {
         salt: Uint8Array;
     }): Promise<ValStat<{
-        enclave: Enclave;
+        enclave: OuterEnclave;
         credId: Uint8Array;
     }>>;
     /**
      * AEAD-seal master under caller-supplied PRF IKM (CLI hmac-secret).
      * Wipes `ikm` before return. Ciphertext only — never the seed.
      */
-    sealWithIkm(ikm: Uint8Array): Promise<ValStat<SealedMasterKey>>;
+    sealWithIKM(ikm: Uint8Array): Promise<ValStat<SealedMasterKey>>;
     /**
      * Unseal a PRF binding given IKM (CLI hmac-secret eval). Returns Enclave.
      * Wipes `ikm` before return.
      */
-    static unsealWithIkm(sealed: SealedMasterKey, ikm: Uint8Array): Promise<ValStat<Enclave>>;
+    static unsealWithIKM(sealed: SealedMasterKey, ikm: Uint8Array): Promise<ValStat<OuterEnclave>>;
     /**
      * UV + write IdentityBundle (seed + hosts) to largeBlob.
-     * Encode and WebAuthn write complete inside this method; nothing seed-bearing
-     * is returned. Prefer empty `hosts` for seed-only backup.
+     * Inner encodes the wire and {@link writeLargeBlob} does the UV write.
+     * Nothing seed-bearing is returned. Prefer empty `hosts` for seed-only backup.
      *
      * Pass `opts.credId` to write an existing credential (one UV). Omit it to
      * create a largeBlob-capable credential then write (two UV). Returns the
@@ -149,7 +89,7 @@ export declare class Enclave {
     static fromLargeBlob(opts?: LargeBlobRp & {
         credId?: Uint8Array;
     }): Promise<ValStat<{
-        enclave: Enclave;
+        enclave: OuterEnclave;
         hosts: BundleHost[];
         credId: Uint8Array;
     }>>;
@@ -160,7 +100,7 @@ export declare class Enclave {
      * Paced mode erases the previous line before the next (Enter between).
      * Web bundles set DIP_CLI_DUMP=false; the write is compiled out.
      */
-    dumpToTty(): Promise<Status>;
+    dumpToTTY(): Promise<Status>;
     static pairRequest(): Promise<ValStat<PairRequest>>;
     /**
      * Seals seed+hosts for dhkeReq. Returns dhkeResp to send back.
@@ -186,18 +126,7 @@ export declare class Enclave {
         id: number;
         persist?: boolean;
     }): Worker;
-    /**
-     * Cipher for public KDM. Does not hold key bytes; each op re-enters the
-     * enclave (async, hardware-shaped). `usage` selects the return shape:
-     * `"encrypt"` → `{ encrypt }`, `"decrypt"` → `{ decrypt }`, `"both"` → both.
-     */
-    deriveCipher<U extends CipherUsage>(kdm: Uint8Array, usage: U): CipherForUsage<U>;
-    /**
-     * Path-scoped identity (label+index). Private key stays in the enclave; only
-     * publicKey and capability methods are returned (frozen).
-     */
-    deriveIdentity(keyPath: string, idx?: number): Promise<Identity>;
+    bagman(idKDM: IKDM, realmKDM: IKDM): Promise<ValStat<BagManager>>;
+    fingerprint(kdm?: Uint8Array | IKDM): Promise<ValStat<PDK["Fingerprint"]>>;
 }
-/** Derive seal key from PRF output (domain-separated). Used by enclave seal/unseal. */
-export declare function sealKeyFromPrf(crypto: ICrypto, prf: Uint8Array, domain?: Uint8Array): Promise<ValStat<Uint8Array>>;
-export { FP_MODE, MASTER_SEED_LEN, MUSEC_MIN_LEN, SEAL_BIND_DOMAIN, SEAL_KEY_LEN, SEAL_PRF_MIN_LEN, };
+export { OuterEnclave as Enclave };

package/dist/cli/shared/crypto/largeBlob.d.ts

@@ -0,0 +1,8 @@
+import { Status } from "../consts.ts";
+import { type ValStat } from "../valstat.ts";
+import { type LargeBlobCreateOpts, type LargeBlobRp } from "../webauthn/largeBlob.ts";
+export declare function largeBlobCredId(opts?: LargeBlobCreateOpts & {
+    credId?: Uint8Array;
+}): Promise<ValStat<Uint8Array>>;
+export declare function writeLargeBlob(credId: Uint8Array, data: Uint8Array, opts?: LargeBlobRp): Promise<Status>;
+export declare function wipeLargeBlob(credId: Uint8Array, opts?: LargeBlobRp): Promise<Status>;

package/dist/cli/shared/crypto/noble.d.ts

@@ -1,24 +1,17 @@
 import { type X25519Sk } from "./x25519.ts";
 import type { Blake3Opts, DerivationSeed, Hash, ICrypto, KeyPair } from "../types.ts";
-/**
- * ICrypto: noble for XSalsa20 + blake3; WebCrypto Ed25519 + X25519
- * (our scalar; RFC 7748 check before trusting pub/DH).
- */
-export declare class NobleCrypto implements ICrypto {
-    private verifyKeys;
-    genRandomBytes(bytes: number): Promise<Uint8Array>;
-    gen256BitSecureRandomSeed(): Promise<Uint8Array>;
-    encryptXSalsa20Poly1305Combined(data: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
-    decryptXSalsa20Poly1305Combined(data: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
-    deriveEd25519KeyPair(derivationSeed: DerivationSeed): Promise<KeyPair>;
-    private importSignKey;
-    private importVerifyKey;
-    signEd25519(message: Uint8Array | string, secKey: Uint8Array): Promise<Uint8Array>;
-    checkSigEd25519(sig: Uint8Array, message: Uint8Array | string, pubKey: Uint8Array): Promise<boolean>;
-    blake3(data: Uint8Array, opts?: Blake3Opts): Promise<Hash>;
-    genX25519(): Promise<{
-        priv: X25519Sk;
-        pub: Uint8Array;
-    }>;
-    x25519Shared(priv: X25519Sk, peerPub: Uint8Array): Promise<Uint8Array>;
-}
+export declare function genRandomBytes(bytes: number): Promise<Uint8Array>;
+export declare function gen256BitSecureRandomSeed(): Promise<Uint8Array>;
+export declare function encryptXSalsa20Poly1305Combined(data: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
+export declare function decryptXSalsa20Poly1305Combined(data: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
+export declare function deriveEd25519KeyPair(derivationSeed: DerivationSeed): Promise<KeyPair>;
+export declare function importVerifyKey(pubKey: Uint8Array): Promise<CryptoKey>;
+export declare function signEd25519(message: Uint8Array | string, secKey: Uint8Array): Promise<Uint8Array>;
+export declare function checkSigEd25519(sig: Uint8Array, message: Uint8Array | string, verifyKey: CryptoKey): Promise<boolean>;
+export declare function blake3(data: Uint8Array, opts?: Blake3Opts): Promise<Hash>;
+export declare function genX25519(): Promise<{
+    priv: X25519Sk;
+    pub: Uint8Array;
+}>;
+export declare function x25519Shared(priv: X25519Sk, peerPub: Uint8Array): Promise<Uint8Array>;
+export declare const noble: ICrypto;

package/dist/cli/shared/crypto/pairing.d.ts

@@ -1,6 +1,8 @@
+import type { BundleHost } from "../codecs/bundleHost.ts";
 import { type ValStat } from "../valstat.ts";
+import { type PDK } from "./derivation.ts";
+import type { Enclave } from "./enclave.ts";
 import type { X25519Sk } from "./x25519.ts";
-export declare const SEAL_PAIR_DOMAIN: Uint8Array<ArrayBufferLike>;
 export declare const X25519_PUB_LEN = 32;
 /** respPub (32) ‖ XSalsa nonce (24) ‖ tag (16); plaintext follows in the ct. */
 export declare const DHKE_RESP_MIN: number;
@@ -17,5 +19,20 @@ export declare function asDHKEResp(bytes: Uint8Array): ValStat<DHKEResp>;
 export declare function pairKey(sk: X25519Sk, // local X25519 priv
 peer: Uint8Array, // ECDH peer pub (enroller: dhkeReq; enrollee: respPub)
 reqPub: Uint8Array, // enrollee pub, bound into KDF
-respPub: Uint8Array): Promise<ValStat<Uint8Array>>;
+respPub: Uint8Array): Promise<ValStat<PDK["Pair"]>>;
+export declare function sealPair(dhkeReq: DHKEReq): Promise<ValStat<{
+    key: PDK["Pair"];
+    pub: Uint8Array;
+}>>;
+export declare class PairRequest {
+    #private;
+    private constructor();
+    static create(): Promise<ValStat<PairRequest>>;
+    wipe(): void;
+    dhkeReq(): ValStat<DHKEReq>;
+    finish(dhkeResp: DHKEResp): Promise<ValStat<{
+        enclave: Enclave;
+        hosts: BundleHost[];
+    }>>;
+}
 export {};

package/dist/cli/shared/crypto/prf.d.ts

@@ -0,0 +1,52 @@
+import type { SealedMasterKey } from "../seed.ts";
+import { type ValStat } from "../valstat.ts";
+import { type PDK } from "./derivation.ts";
+import { type PrfCeremony, type PrfCreateOpts, type PrfEvalOpts } from "../webauthn/prf.ts";
+/** Options for PRF seal/unseal ceremonies (no raw PRF bytes). */
+export type PasskeyPrfOpts = PrfCreateOpts & {
+    credId?: Uint8Array | readonly Uint8Array[];
+    /** Seal only: create a PRF credential first when no credId is known. */
+    createCredIfNeeded?: boolean;
+};
+/** One binding to try on unseal (cred id + sealed master). */
+export type PrfBinding = {
+    sealedMaster: SealedMasterKey;
+    credId: Uint8Array;
+    /** PRF salt for this cred. Omitted salts use the ceremony salt. */
+    salt?: Uint8Array;
+};
+/** Durable PRF-sealed master + public ceremony facts (never includes PRF output). */
+export type PrfSealedMaster = PrfCeremony & {
+    sealedMaster: SealedMasterKey;
+    salt: Uint8Array;
+};
+/** One existing keyring member used to prove this enclave matches the list. */
+export type BindPrior = {
+    credId: Uint8Array;
+    tag: PDK["BindTag"];
+};
+/** Seal + bind-tag from {@link Enclave.bind} (tag is not a global fingerprint). */
+export type PrfBound = PrfSealedMaster & {
+    tag: PDK["BindTag"];
+};
+type PrfCreateResult = PrfCeremony & {
+    prfEnabled: boolean;
+    prf?: Uint8Array;
+};
+type PrfEvalResult = PrfCeremony & {
+    prf: Uint8Array;
+};
+export declare function createPrfCred(opts?: PrfCreateOpts): Promise<ValStat<PrfCreateResult>>;
+export declare function evalPrf(opts?: PrfEvalOpts): Promise<ValStat<PrfEvalResult>>;
+export declare function sealPRF(opts: PasskeyPrfOpts | undefined): Promise<ValStat<PrfCeremony & {
+    prf: Uint8Array;
+    salt: Uint8Array;
+}>>;
+export declare function unsealPRF(bindings: readonly PrfBinding[], opts: PasskeyPrfOpts & {
+    salt: Uint8Array;
+}): Promise<ValStat<{
+    prf: Uint8Array;
+    credId: Uint8Array;
+    order: readonly PrfBinding[];
+}>>;
+export {};

package/dist/cli/shared/crypto/realms.d.ts

@@ -0,0 +1,7 @@
+import { type IKDM } from "../codecs/kdm.ts";
+import { type MasterSeed } from "../seed.ts";
+import { type ValStat } from "../valstat.ts";
+import { type PDK } from "./derivation.ts";
+export declare function deriveRealmKey(parent: MasterSeed, realmKDM: IKDM): Promise<ValStat<PDK["RealmKey"]>>;
+export declare function deriveRealmID(parent: MasterSeed, realmKDM: IKDM): Promise<ValStat<PDK["RealmID"]>>;
+export declare function deriveHostRLM(parent: PDK["RealmID"], hostKDM: IKDM): Promise<ValStat<PDK["HostRLM"]>>;

package/dist/cli/shared/endpoint.d.ts

@@ -2,21 +2,20 @@ import { IClock } from "./clock.ts";
 import { Decoder, Encoder } from "./codec.ts";
 import { IAuthTimestamp } from "./codecs/authTimestamp.ts";
 import { Status } from "./consts.ts";
-import { Enclave, type Identity } from "./crypto/enclave.ts";
+import type { BagManager } from "./crypto/bagman.ts";
 import { ICrypto, IProtoHost } from "./types.ts";
 import { ValStat } from "./valstat.ts";
 interface IProtoClient {
     crypto: ICrypto;
-    enclave: Enclave;
     clock: IClock;
 }
-export interface IAuthenticatedEndpoint<ReqItem, Resp> {
-    encodeReq(client: IProtoClient, identity: Identity, authTS: IAuthTimestamp, body: Iterable<ReqItem>, reqEnc: Encoder): Promise<Status>;
+export interface IAuthenticatedEndpoint<ReqInput, Resp> {
+    encodeReq(client: IProtoClient, identity: BagManager, authTS: IAuthTimestamp, body: ReqInput, reqEnc: Encoder): Promise<Status>;
     handleReq(host: IProtoHost, reqDec: Decoder, respEnc: Encoder): Promise<Status>;
     decodeResp(respDec: Decoder): ValStat<Resp>;
 }
 export interface IAuthData {
-    identity: Identity;
+    identity: BagManager;
     authTS: IAuthTimestamp;
 }
 export {};

package/dist/cli/shared/http.d.ts

@@ -6,66 +6,66 @@ import { ValStat } from "./valstat.ts";
 export declare const api: {
     readonly user: {
         readonly path: "/user";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<never, void>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<void, void>;
         readonly name: APICallName.User;
     };
     readonly push: {
         readonly path: "/push";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./types.ts").IBag, import("./codecs/pushItem.ts").IBagPushItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./types.ts").IBag[], import("./codecs/pushItem.ts").IBagPushItem[]>;
         readonly name: APICallName.Push;
     };
     readonly peek: {
         readonly path: "/peek";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<number, import("./codecs/peekItem.ts").IBagPeekItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./api/peek.ts").IPeekCursor, import("./codecs/peekItem.ts").IBagPeekItem[]>;
         readonly name: APICallName.Peek;
     };
     readonly pull: {
         readonly path: "/pull";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<number, import("./codecs/pullItem.ts").IBagPullItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./api/pull.ts").IPullReq, import("./codecs/pullItem.ts").IBagPullItem[]>;
         readonly name: APICallName.Pull;
     };
 };
 export declare const apiCalls: {
     readonly 0: {
         readonly path: "/user";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<never, void>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<void, void>;
         readonly name: APICallName.User;
     };
     readonly 2: {
         readonly path: "/push";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./types.ts").IBag, import("./codecs/pushItem.ts").IBagPushItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./types.ts").IBag[], import("./codecs/pushItem.ts").IBagPushItem[]>;
         readonly name: APICallName.Push;
     };
     readonly 1: {
         readonly path: "/peek";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<number, import("./codecs/peekItem.ts").IBagPeekItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./api/peek.ts").IPeekCursor, import("./codecs/peekItem.ts").IBagPeekItem[]>;
         readonly name: APICallName.Peek;
     };
     readonly 3: {
         readonly path: "/pull";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<number, import("./codecs/pullItem.ts").IBagPullItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./api/pull.ts").IPullReq, import("./codecs/pullItem.ts").IBagPullItem[]>;
         readonly name: APICallName.Pull;
     };
 };
 export declare const callPaths: {
     readonly "/user": {
         readonly path: "/user";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<never, void>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<void, void>;
         readonly name: APICallName.User;
     };
     readonly "/push": {
         readonly path: "/push";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./types.ts").IBag, import("./codecs/pushItem.ts").IBagPushItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./types.ts").IBag[], import("./codecs/pushItem.ts").IBagPushItem[]>;
         readonly name: APICallName.Push;
     };
     readonly "/peek": {
         readonly path: "/peek";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<number, import("./codecs/peekItem.ts").IBagPeekItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./api/peek.ts").IPeekCursor, import("./codecs/peekItem.ts").IBagPeekItem[]>;
         readonly name: APICallName.Peek;
     };
     readonly "/pull": {
         readonly path: "/pull";
-        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<number, import("./codecs/pullItem.ts").IBagPullItem[]>;
+        readonly endpoint: import("./endpoint.ts").IAuthenticatedEndpoint<import("./api/pull.ts").IPullReq, import("./codecs/pullItem.ts").IBagPullItem[]>;
         readonly name: APICallName.Pull;
     };
 };

package/dist/cli/shared/sync.d.ts

@@ -1,9 +1,9 @@
 import { IBagPeekItem } from "./codecs/peekItem.ts";
-import { Enclave } from "./crypto/enclave.ts";
-import { ICrypto, PublicKey } from "./types.ts";
+import { BagManager } from "./crypto/bagman.ts";
+import { ICrypto } from "./types.ts";
 import { ValStat } from "./valstat.ts";
 export interface IDecryptedBagPeekItem {
     kdm: Uint8Array;
     headEnc: Uint8Array;
 }
-export declare function decryptPeekItem(item: IBagPeekItem, pubKey: PublicKey, enclave: Enclave, crypto: ICrypto): Promise<ValStat<IDecryptedBagPeekItem>>;
+export declare function decryptPeekItem(item: IBagPeekItem, verifyKey: CryptoKey, bagMgr: BagManager, crypto: ICrypto): Promise<ValStat<IDecryptedBagPeekItem>>;

package/dist/cli/shared/types.d.ts

@@ -4,6 +4,7 @@ import { IAuthTimestamp } from "./codecs/authTimestamp.ts";
 import type { IBagPeekItem } from "./codecs/peekItem.ts";
 import { IUsageQuota } from "./codecs/usageQuota.ts";
 import { APICallName, Status } from "./consts.ts";
+import type { HostRlm } from "./crypto/derivation.ts";
 import type { ValStat } from "./valstat.ts";
 /** Identity seed brands — defined in seed.ts; re-exported for convenience. */
 export type { MasterSeed, SealedMasterKey } from "./seed.ts";
@@ -75,27 +76,35 @@ export type IDeleteParams = {
     eid: EntityID;
     force?: boolean;
 };
+/** One setBags outcome. Success carries the host seq in that bag's rlm. */
+export type ISetBagResult = {
+    status: Status.Success;
+    seq: number;
+} | {
+    status: Exclude<Status, Status.Success>;
+};
 export interface IStorage {
     addUser: (pubKey: PublicKey) => Promise<ValStat<void>>;
     hasUser: (pubKey: PublicKey) => Promise<ValStat<boolean>>;
     subMeta: (pubKey: PublicKey) => Promise<ValStat<ISubscriptionMetadata>>;
     /**
-     * Store bags for a user. Returns host seq for each bag in order.
-     * Empty list succeeds with []. Implementations must assign contiguous
-     * seqs atomically (transaction / single batch) so concurrent writers
-     * cannot claim the same seq.
+     * Store bags for a user. One result per input bag, same order.
+     * An invalid rlm is InvalidParam for that bag; the others are still stored.
+     * Seqs are contiguous per rlm among stored bags, assigned atomically so
+     * concurrent writers cannot claim the same seq in the same rlm.
+     * Empty list succeeds with []. A storage failure fails the call.
      */
-    setBags: (pubKey: PublicKey, bags: IBag[]) => Promise<ValStat<number[]>>;
+    setBags: (pubKey: PublicKey, bags: IBag[]) => Promise<ValStat<ISetBagResult[]>>;
     /**
-     * Fetch ciphertext bodies for the given host seqs.
-     * Returns only seqs that exist (missing seqs are omitted, not an error).
-     * Empty `seqs` succeeds with [].
+     * Fetch ciphertext bodies for `seqs` in `rlm`.
+     * Missing seqs are omitted. Empty `seqs` succeeds with [].
      */
-    getBodies: (pubKey: PublicKey, seqs: number[]) => Promise<ValStat<{
+    getBodies: (pubKey: PublicKey, rlm: HostRlm, seqs: number[]) => Promise<ValStat<{
         seq: number;
         bodyCph: Uint8Array;
     }[]>>;
-    listHeads: (pubKey: PublicKey, minSeq: number) => Promise<ValStat<IBagPeekItem[]>>;
+    /** Heads in `rlm` with seq greater than minSeq, ordered by seq. */
+    listHeads: (pubKey: PublicKey, rlm: HostRlm, minSeq: number) => Promise<ValStat<IBagPeekItem[]>>;
 }
 export interface KeyPair {
     keyType: "ed25519";
@@ -123,7 +132,8 @@ export type Hash = Uint8Array & {
     readonly [hashSymbol]: true;
 };
 export interface IHostCrypto {
-    checkSigEd25519: (sig: Uint8Array, message: Uint8Array | string, pubKey: PublicKey) => Promise<boolean>;
+    importVerifyKey: (pubKey: PublicKey) => Promise<CryptoKey>;
+    checkSigEd25519: (sig: Uint8Array, message: Uint8Array | string, verifyKey: CryptoKey) => Promise<boolean>;
 }
 /** BLAKE3 hash / MAC / KDF (noble: `key` XOR `context`, not both). */
 export type Blake3Opts = {
@@ -141,11 +151,6 @@ export interface ICrypto extends IHostCrypto {
     signEd25519: (message: Uint8Array | string, secKey: PrivateKey) => Promise<Uint8Array>;
     blake3: (data: Uint8Array, opts?: Blake3Opts) => Promise<Hash>;
 }
-export interface IMsgpackCodec {
-    encode: (source: unknown) => Uint8Array;
-    decode: (packed: ArrayBuffer | Uint8Array) => unknown;
-    decodeAsync: (stream: ReadableStream<Uint8Array>) => Promise<unknown>;
-}
 export interface IProtoHost {
     storage: IStorage;
     crypto: IHostCrypto;
@@ -168,6 +173,9 @@ export interface IPushListener {
     disconnect(): void;
 }
 export interface IBagHeader {
+    /** HostRLM. Covered by sig, with headCph. */
+    rlm: HostRlm;
+    /** Ed25519 over rlm ‖ headCph. First field on the wire. */
     sig: Uint8Array;
     kdm: Uint8Array;
 }

package/dist/cli/shared/webauthn/prf.d.ts

@@ -29,6 +29,14 @@ export type PrfEvalOpts = PrfRp & {
     /** One id, or every bound id so a spare key can assert in one get(). */
     credId?: Uint8Array | readonly Uint8Array[];
     salt?: Uint8Array;
+    /**
+     * Salt for each cred when accounts do not share one.
+     * Sent as evalByCredential so the passkey the user picks evals its own.
+     */
+    salts?: readonly {
+        credId: Uint8Array;
+        salt: Uint8Array;
+    }[];
 };
 /** Best-effort: client advertises PRF extension. */
 export declare function prfCapable(): Promise<boolean>;