@interncom/diplomatic 0.22.0 → 0.24.0

package/dist/web/objEq.d.ts

@@ -0,0 +1 @@
+export declare function objEq(a: unknown, b: unknown): boolean;

package/dist/web/passkey/prf-store.d.ts

@@ -1,7 +1,10 @@
-import { Enclave, type PasskeyPrfOpts } from "../shared/crypto/enclave";
+import { Enclave } from "../shared/crypto/enclave";
+import { type PDK } from "../shared/crypto/derivation";
+import type { PasskeyPrfOpts } from "../shared/crypto/prf";
+import { Status } from "../shared/consts";
 import { type SealedMasterKey } from "../shared/seed";
 import { type ValStat } from "../shared/valstat";
-import type { ISeedStore, SetSeedOpts } from "../types";
+import type { IAccountStore, SetSeedOpts } from "../types";
 import { type PrfRp } from "../shared/webauthn/prf";
 import { type AuthenticatorAttachmentName, type EnrolledOs } from "../shared/webauthn/common";
 /** Max bindings on one device. Keeps allowCredentials small. */
@@ -12,8 +15,8 @@ export type KeyringEntry = {
     type: "prf";
     sealedMaster: SealedMasterKey;
     credId: Uint8Array;
-    /** blake3(master ‖ bindtag ‖ credId); check-only, not a display fingerprint. */
-    tag: Uint8Array;
+    /** Bind-tag PDK child keyed by credId; check-only, not a display fingerprint. */
+    tag: PDK["BindTag"];
     userId?: Uint8Array;
     nick?: string;
     enrolledAt: number;
@@ -45,10 +48,18 @@ export type KeyringRow = {
  * Persist the keyring for cold start (e.g. protocol IDB).
  * Called with `undefined` when the store is wiped.
  */
-export type PersistKeyring = (ring: Keyring | undefined) => void | Promise<void>;
+export type PersistKeyring = (ring: Keyring | undefined) => Status | Promise<Status>;
 export type PrfSeedStoreOpts = PrfRp & {
     persistKeyring: PersistKeyring;
     keyring?: Keyring;
+    /**
+     * When set, unlock runs this instead of the keyring held here.
+     * The account store uses it to pick the row by the asserted credId.
+     */
+    unlockAccount?: () => Promise<ValStat<{
+        enclave: Enclave;
+        keyring?: Keyring;
+    }>>;
 };
 /**
  * Session + durable PRF-bound seed. Session secret is always {@link Enclave}.
@@ -57,13 +68,14 @@ export type PrfSeedStoreOpts = PrfRp & {
  * - {@link bindAndSave} creates a binding and appends/upserts a keyring entry.
  * - {@link unlock} runs PRF UV inside Enclave and returns a new enclave.
  */
-export declare class PrfSeedStore implements ISeedStore {
+export declare class PrfSeedStore implements IAccountStore {
     #private;
-    constructor(opts: PrfSeedStoreOpts);
+    constructor(opts: Omit<PrfSeedStoreOpts, "keyring">);
+    static open(opts: PrfSeedStoreOpts): ValStat<PrfSeedStore>;
     get keyring(): Keyring | undefined;
     /** Public rows (no sealed master). */
     list(): KeyringRow[];
-    save(enclave: Enclave, opts?: SetSeedOpts): Promise<Enclave>;
+    save(enclave: Enclave, opts?: SetSeedOpts): Promise<ValStat<Enclave>>;
     /**
      * PRF UV inside Enclave.bind, persist the entry.
      * Always creates a new cred unless `credId` is passed (re-bind that cred).
@@ -73,7 +85,10 @@ export declare class PrfSeedStore implements ISeedStore {
         nick?: string;
     }): Promise<ValStat<Enclave>>;
     load(): Promise<Enclave | void>;
-    /** Passkey UV inside Enclave → new session enclave. */
+    /**
+     * Passkey UV inside Enclave → new session enclave.
+     * With `unlockAccount`, the asserted credId selects the account.
+     */
     unlock(): Promise<ValStat<Enclave>>;
     /** Set a display nick (local only; does not update the binding key). */
     rename(credId: Uint8Array, nick: string): Promise<ValStat<void>>;
@@ -84,11 +99,12 @@ export declare class PrfSeedStore implements ISeedStore {
     remove(credId: Uint8Array): Promise<ValStat<void>>;
     wipe(): Promise<void>;
 }
-export declare function cloneKeyring(r: Keyring): Keyring;
+export declare function cloneKeyring(r: Keyring): ValStat<Keyring>;
 /** Read a keyring from IDB structured-clone output. */
 export declare function decodeKeyring(raw: unknown): Keyring | undefined;
 /** Cred ids of every keyring entry. */
 export declare function keyringCredIds(ring: Keyring | undefined): Uint8Array[];
+export declare function touchKeyring(ring: Keyring, credId: Uint8Array): ValStat<Keyring | undefined>;
 /** Inferred kind for UI. Not attested. */
 export declare function keyringKind(row: KeyringRow): string;
 /** Display label: nick, else inferred kind + short cred id. */

package/dist/web/passkey/seed.d.ts

@@ -1,21 +1,27 @@
 import { Enclave } from "../shared/crypto/enclave";
 import { type ValStat } from "../shared/valstat";
-import type { ISeedStore, SetSeedOpts } from "../types";
+import type { IAccountStore, SetSeedOpts } from "../types";
 import type { LargeBlobRp } from "../shared/webauthn/largeBlob";
 export type PasskeySeedStoreOpts = LargeBlobRp & {
     credId?: Uint8Array;
+    /** Account `credId` belongs to. Omitted is the default account, "". */
+    label?: string;
 };
 /**
- * ISeedStore backed by largeBlob. Session secret is always {@link Enclave}.
+ * IAccountStore backed by largeBlob. Session secret is always {@link Enclave}.
+ * Each account label has its own credential. Omitted label is "".
  * Persist uses {@link Enclave.persistToLargeBlob} / {@link Enclave.fromLargeBlob}.
  */
-export declare class PasskeySeedStore implements ISeedStore {
+export declare class PasskeySeedStore implements IAccountStore {
     #private;
     constructor(opts: PasskeySeedStoreOpts);
+    /** Credential id of the selected account. */
     get credId(): Uint8Array | undefined;
-    setCredId(credId: Uint8Array | undefined): void;
-    save(enclave: Enclave, opts?: SetSeedOpts): Promise<Enclave>;
+    setCredId(credId: Uint8Array | undefined, label?: string): void;
+    save(enclave: Enclave, opts?: SetSeedOpts): Promise<ValStat<Enclave>>;
     load(): Promise<Enclave | void>;
-    unlock(): Promise<ValStat<Enclave>>;
+    unlock(opts?: {
+        label?: string;
+    }): Promise<ValStat<Enclave>>;
     wipe(): Promise<void>;
 }

package/dist/web/shared/api/peek.d.ts

@@ -1,3 +1,11 @@
+import { ICodecStruct } from "../codec.ts";
 import { IAuthenticatedEndpoint } from "../endpoint.ts";
 import { IBagPeekItem } from "../codecs/peekItem.ts";
-export declare const peekEnd: IAuthenticatedEndpoint<number, IBagPeekItem[]>;
+import { type HostRlm } from "../crypto/derivation.ts";
+/** One realm cursor: that rlm, and the last seq the client has in it. */
+export interface IPeekCursor {
+    rlm: HostRlm;
+    seq: number;
+}
+export declare const peekCursorCodec: ICodecStruct<IPeekCursor>;
+export declare const peekEnd: IAuthenticatedEndpoint<IPeekCursor, IBagPeekItem[]>;

package/dist/web/shared/api/pull.d.ts

@@ -1,3 +1,11 @@
+import { ICodecStruct } from "../codec.ts";
 import { type IBagPullItem } from "../codecs/pullItem.ts";
+import { type HostRlm } from "../crypto/derivation.ts";
 import { IAuthenticatedEndpoint } from "../endpoint.ts";
-export declare const pullEnd: IAuthenticatedEndpoint<number, IBagPullItem[]>;
+/** One realm, and the seqs to fetch in it. */
+export interface IPullReq {
+    rlm: HostRlm;
+    seqs: number[];
+}
+export declare const pullReqCodec: ICodecStruct<IPullReq>;
+export declare const pullEnd: IAuthenticatedEndpoint<IPullReq, IBagPullItem[]>;

package/dist/web/shared/api/push.d.ts

@@ -1,4 +1,6 @@
+import { ICodecStruct } from "../codec.ts";
 import { type IBagPushItem } from "../codecs/pushItem.ts";
 import { IAuthenticatedEndpoint } from "../endpoint.ts";
 import { IBag } from "../types.ts";
-export declare const pushEnd: IAuthenticatedEndpoint<IBag, IBagPushItem[]>;
+export declare const pushReqCodec: ICodecStruct<IBag[]>;
+export declare const pushEnd: IAuthenticatedEndpoint<IBag[], IBagPushItem[]>;

package/dist/web/shared/api/user.d.ts

@@ -1,2 +1,2 @@
 import { IAuthenticatedEndpoint } from "../endpoint.ts";
-export declare const userEnd: IAuthenticatedEndpoint<never, void>;
+export declare const userEnd: IAuthenticatedEndpoint<void, void>;

package/dist/web/shared/auth.d.ts

@@ -1,9 +1,9 @@
 import { IClock } from "./clock.ts";
 import { type IAuthTimestamp } from "./codecs/authTimestamp.ts";
 import { Status } from "./consts.ts";
-import type { Identity } from "./crypto/enclave.ts";
+import type { BagManager } from "./crypto/bagman.ts";
 import type { IHostCrypto } from "./types.ts";
 import { ValStat } from "./valstat.ts";
 export type EncodedAuthTimestamp = Uint8Array;
-export declare function makeAuthTimestamp(identity: Pick<Identity, "publicKey" | "sign">, ts: Date): Promise<ValStat<IAuthTimestamp>>;
+export declare function makeAuthTimestamp(identity: BagManager, ts: Date): Promise<ValStat<IAuthTimestamp>>;
 export declare function validateAuthTimestamp(authTS: IAuthTimestamp, crypto: IHostCrypto, clock: IClock): Promise<Status>;

package/dist/web/shared/bag.d.ts

@@ -1,16 +1,21 @@
 import { IMessageHead } from "./codecs/messageHead.ts";
-import { type DecryptCipher, Enclave, type Identity } from "./crypto/enclave.ts";
+import type { HostRlm } from "./crypto/derivation.ts";
+import { BagManager } from "./crypto/bagman.ts";
 import { EncodedMessage } from "./message.ts";
 import { type ValStat } from "./valstat.ts";
-import type { Hash, IBag, ICrypto, IHostCrypto, IMessage, IMessageWithHash, PublicKey } from "./types.ts";
-export declare function bagSigValid(bag: IBag, pubKey: PublicKey, crypto: IHostCrypto): Promise<boolean>;
-export declare function sealBag(msg: IMessage, identity: Identity, crypto: ICrypto, enclave: Enclave): Promise<ValStat<IBag>>;
+import type { Hash, IBag, ICrypto, IHostCrypto, IMessage, IMessageWithHash } from "./types.ts";
+export declare function bagSigMsg(rlm: HostRlm, headCph: Uint8Array): Uint8Array;
+export declare function bagSigValid(bag: IBag, verifyKey: CryptoKey, crypto: IHostCrypto): Promise<boolean>;
+export declare function sealBag(msg: IMessage, bagMgr: BagManager, crypto: ICrypto): Promise<ValStat<IBag>>;
 export interface IOpenBag {
     msgHead: IMessageHead;
     bod?: EncodedMessage;
     headHash: Hash;
 }
-export declare function openBagBody(headEnc: Uint8Array, bodyCph: Uint8Array | undefined, cipher: DecryptCipher, crypto: ICrypto, 
+export type BagDecrypt = {
+    decrypt: (data: Uint8Array) => Promise<ValStat<Uint8Array>>;
+};
+export declare function openBagBody(headEnc: Uint8Array, bodyCph: Uint8Array | undefined, cipher: BagDecrypt, crypto: ICrypto, 
 /** When set (e.g. from peek), skip blake3(headEnc). */
 headHashKnown?: Hash): Promise<ValStat<IOpenBag>>;
-export declare function openBag(bag: IBag, pubKey: PublicKey, crypto: ICrypto, enclave: Enclave): Promise<ValStat<IMessageWithHash>>;
+export declare function openBag(bag: IBag, verifyKey: CryptoKey, crypto: ICrypto, bagMgr: BagManager): Promise<ValStat<IMessageWithHash>>;

package/dist/web/shared/blobs.d.ts

@@ -0,0 +1,25 @@
+import type { EntityID, IEntRev, IMessage, IMsgEntBody } from "./types.ts";
+import { ValStat } from "./valstat.ts";
+/** Head typ prefix. The rest is an app mime, such as "image/jpeg". */
+export declare const blobPrefix = "blob:";
+export declare function blobTyp(mime: string): string;
+export declare function isBlobTyp(typ: string | undefined): typ is string;
+export declare function mimeOf(typ: string | undefined): string | undefined;
+export interface IBlobWrite {
+    tags?: string[];
+    pid?: EntityID;
+}
+export interface IBlobUpdate extends IBlobWrite {
+    mime?: string;
+}
+type BlobMsg = {
+    typ: string;
+    bod: Uint8Array;
+};
+export declare function openBlob(bod: Uint8Array): ValStat<IMsgEntBody<Uint8Array>>;
+export declare function insertBlobMsg(mime: string, bytes: Uint8Array, opts?: IBlobWrite): ValStat<BlobMsg>;
+export declare function updateBlobMsg(prev: IMessage | undefined, bytes: Uint8Array, opts?: IBlobUpdate): ValStat<BlobMsg & {
+    prior: IEntRev;
+}>;
+export declare function blobBytes(msg: IMessage | undefined): ValStat<Uint8Array>;
+export {};

package/dist/web/shared/client.d.ts

@@ -1,23 +1,32 @@
 import { IClock } from "./clock.ts";
+import { type IKDM } from "./codecs/kdm.ts";
+import type { IBagPeekItem } from "./codecs/peekItem.ts";
+import type { IBagPullItem } from "./codecs/pullItem.ts";
 import { Status } from "./consts.ts";
-import { Enclave, type Identity } from "./crypto/enclave.ts";
-import type { HostHandle, IBag, ICrypto, IHostConnectionInfo, IHostMetadata, IMessage, ITransport, PushReceiver } from "./types.ts";
+import type { BagManager } from "./crypto/bagman.ts";
+import type { Enclave } from "./crypto/enclave.ts";
+import { type HostRlm } from "./crypto/derivation.ts";
+import type { HostHandle, IBag, ICrypto, IHostMetadata, IMessage, ITransport, PushReceiver } from "./types.ts";
 import { ValStat } from "./valstat.ts";
+export declare function hostBagMgrs(enclave: Enclave, idKDM: IKDM, realms?: readonly IKDM[]): Promise<ValStat<BagManager[]>>;
 export default class DiplomaticClientAPI<Handle extends HostHandle> {
-    enclave: Enclave;
+    #private;
     crypto: ICrypto;
-    private host;
     clock: IClock;
     private transport;
     private updateHostMeta;
-    constructor(enclave: Enclave, crypto: ICrypto, host: IHostConnectionInfo<Handle>, clock: IClock, transport: ITransport, updateHostMeta: (meta: IHostMetadata) => Promise<Status>);
+    constructor(bagMgrs: BagManager[], crypto: ICrypto, clock: IClock, transport: ITransport, updateHostMeta: (meta: IHostMetadata) => Promise<Status>);
     private call;
-    identity: () => Promise<Identity>;
-    seal: (msg: IMessage) => Promise<ValStat<IBag>>;
+    bagMgrFor(realm?: IKDM): BagManager | undefined;
+    bagMgrs(): readonly BagManager[];
+    add(bagMgr: BagManager): void;
+    identity: () => Promise<ValStat<BagManager>>;
+    hostRlm: (realm?: IKDM) => Promise<ValStat<HostRlm>>;
+    seal: (msg: IMessage, realm?: IKDM) => Promise<ValStat<IBag>>;
     register: () => Promise<ValStat<void>>;
-    peek: (lastSeq: number) => Promise<ValStat<import("./codecs/peekItem.ts").IBagPeekItem[]>>;
+    peek: (lastSeq: number, realm?: IKDM) => Promise<ValStat<IBagPeekItem[]>>;
     push: (bags: IBag[]) => Promise<ValStat<import("./codecs/pushItem.ts").IBagPushItem[]>>;
-    pull: (seqs: number[]) => Promise<ValStat<import("./codecs/pullItem.ts").IBagPullItem[]>>;
+    pull: (seqs: number[], realm?: IKDM) => Promise<ValStat<IBagPullItem[]>>;
     listen: (recv: PushReceiver, onDisconnect?: () => void, onConnect?: () => void) => Promise<Status>;
     /** Returns whether this client has an active connection to its host.
      * If a push listener is active, reports the listener's connected state.

package/dist/web/shared/codec.d.ts

@@ -14,12 +14,15 @@ export declare class Decoder {
     readDate(): ValStat<Date>;
     readVarInt(): ValStat<number>;
     readVarString(): ValStat<string>;
+    readVarStrings(): ValStat<string[]>;
     readBytes(num: number): ValStat<Uint8Array>;
     readVarBytes(): ValStat<Uint8Array>;
     readStruct<T>(codec: ICodecStruct<T>): ValStat<T>;
     readStructs<T>(codec: ICodecStruct<T>): ValStat<T[]>;
     readBytesSeq(len: number): ValStat<Uint8Array[]>;
     done(): boolean;
+    remaining(): number;
+    readRest(): Uint8Array;
     consumed(): number;
 }
 export declare class Encoder {
@@ -28,6 +31,7 @@ export declare class Encoder {
     writeDate(ts: Date): Status;
     writeVarInt(n: number): Status;
     writeVarString(s: string): Status;
+    writeVarStrings(strs: string[]): Status;
     prependBytes(bytes: Uint8Array): void;
     /**
      * Append a copy of `bytes`. Parts must not alias caller buffers — callers

package/dist/web/shared/codecs/ent.d.ts

@@ -0,0 +1,5 @@
+import { ICodecStruct } from "../codec.ts";
+import { IMsgEntBody } from "../types.ts";
+import { ValStat } from "../valstat.ts";
+export declare const entCodec: ICodecStruct<IMsgEntBody<Uint8Array>>;
+export declare function encodeEnt(ent: IMsgEntBody<Uint8Array>): ValStat<Uint8Array>;

package/dist/web/shared/codecs/kdm.d.ts

@@ -0,0 +1,7 @@
+import { ICodecStruct } from "../codec.ts";
+export interface IKDM {
+    label: string;
+    index: number;
+}
+export declare function kdmEq(k1: IKDM, k2: IKDM): boolean;
+export declare const kdmCodec: ICodecStruct<IKDM>;

package/dist/web/shared/codecs/notifItem.d.ts

@@ -1,6 +1,8 @@
 import { ICodecStruct } from "../codec.ts";
+import { type HostRlm } from "../crypto/derivation.ts";
 export interface IBagNotifItem {
     seq: number;
+    rlm: HostRlm;
     headCph: Uint8Array;
     bodyCph?: Uint8Array;
 }

package/dist/web/shared/crypto/bagman.d.ts

@@ -0,0 +1,19 @@
+import type { IKDM } from "../codecs/kdm.ts";
+import type { PublicKey } from "../types.ts";
+import { type ValStat } from "../valstat.ts";
+import type { HostRlm, PDK } from "./derivation.ts";
+export declare class BagManager {
+    #private;
+    readonly publicKey: PublicKey;
+    private idnt;
+    private realm;
+    readonly rlm: HostRlm;
+    readonly idKDM: Readonly<IKDM>;
+    readonly realmKDM: Readonly<IKDM>;
+    private constructor();
+    static init(idnt: PDK["Identity"], realm: PDK["RealmKey"], rlm: HostRlm, idKDM: IKDM, realmKDM: IKDM): Promise<ValStat<BagManager>>;
+    sign(message: Uint8Array | string): Promise<ValStat<Uint8Array>>;
+    bagKDM(msgHeadEnc: Uint8Array): Promise<ValStat<Uint8Array>>;
+    encrypt(kdm: Uint8Array, data: Uint8Array): Promise<ValStat<Uint8Array>>;
+    decrypt(kdm: Uint8Array, data: Uint8Array): Promise<ValStat<Uint8Array>>;
+}

package/dist/web/shared/crypto/binary.d.ts

@@ -0,0 +1 @@
+export declare function bytesEqual(a: Uint8Array, b: Uint8Array): boolean;

package/dist/web/shared/crypto/derivation.d.ts

@@ -0,0 +1,45 @@
+import { type IKDM } from "../codecs/kdm.ts";
+import { type ValStat } from "../valstat.ts";
+export declare const Purpose: {
+    readonly Identity: "diplomatic.identity.v1";
+    readonly Cipher: "diplomatic.cipher.v1";
+    readonly Bind: "diplomatic.bind.v1";
+    readonly BindTag: "diplomatic.bindtag.v1";
+    readonly Fingerprint: "diplomatic.fingerprint.v1";
+    readonly Pair: "diplomatic.qrpair.v1";
+    readonly BagKdm: "diplomatic.bagkdm.v1";
+    readonly RealmKey: "diplomatic.realmKey.v1";
+    readonly RealmID: "diplomatic.realmID.v1";
+    readonly HostRLM: "diplomatic.hostRLM.v1";
+};
+export type Purpose = typeof Purpose[keyof typeof Purpose];
+declare const pdkSymbol: unique symbol;
+export type PurposeDerivedKey<P extends Purpose> = Uint8Array & {
+    readonly [pdkSymbol]: P;
+};
+declare const childKeySymbol: unique symbol;
+export type ChildKey<P extends Purpose> = Uint8Array & {
+    readonly [childKeySymbol]: P;
+};
+export type PDK = {
+    [K in keyof typeof Purpose]: ChildKey<(typeof Purpose)[K]>;
+};
+/** Host-stamped bag rlm. Peek, pull, and bag signatures use this. */
+export type HostRlm = PDK["HostRLM"];
+export declare const nullKDM: IKDM;
+export declare function asChildKey<P extends Purpose>(bytes: Uint8Array, _purpose: P): ValStat<ChildKey<P>>;
+export declare function asHostRlm(bytes: Uint8Array): ValStat<HostRlm>;
+export declare function derivePDK<P extends Purpose>({ parent, purpose, }: {
+    parent: Uint8Array;
+    purpose: P;
+}): Promise<ValStat<PurposeDerivedKey<P>>>;
+export declare function deriveChild<P extends Purpose>({ pdk, kdm, }: {
+    pdk: PurposeDerivedKey<P>;
+    kdm: Uint8Array | IKDM;
+}): Promise<ValStat<ChildKey<P>>>;
+export declare function deriveKey<P extends Purpose>({ parent, purpose, kdm, }: {
+    parent: Uint8Array;
+    purpose: P;
+    kdm: Uint8Array | IKDM;
+}): Promise<ValStat<ChildKey<P>>>;
+export {};

package/dist/web/shared/crypto/enclave.d.ts

@@ -1,98 +1,38 @@
 import type { BundleHost } from "../codecs/bundleHost.ts";
+import type { IKDM } from "../codecs/kdm.ts";
+import type { MasterSeed, SealedMasterKey } from "../seed.ts";
+import type { ValStat } from "../valstat.ts";
+import type { PDK } from "./derivation.ts";
+import type { DHKEReq, DHKEResp } from "./pairing.ts";
+import type { LargeBlobCreateOpts, LargeBlobRp } from "../webauthn/largeBlob.ts";
+import type { BindPrior, PasskeyPrfOpts, PrfBinding, PrfBound, PrfSealedMaster } from "./prf.ts";
 import { Status } from "../consts.ts";
-import { MASTER_SEED_LEN, type MasterSeed, type SealedMasterKey } from "../seed.ts";
-import type { ICrypto, PublicKey } from "../types.ts";
-import { type ValStat } from "../valstat.ts";
-import { type DHKEReq, type DHKEResp } from "./pairing.ts";
-import { type LargeBlobCreateOpts, type LargeBlobRp } from "../webauthn/largeBlob.ts";
-import { type PrfCeremony, type PrfCreateOpts, type PrfEvalOpts, type PrfRp } from "../webauthn/prf.ts";
-export type { LargeBlobCreateOpts, LargeBlobRp };
-export type { PrfCreateOpts, PrfEvalOpts, PrfRp };
-/** Options for PRF seal/unseal ceremonies (no raw PRF bytes). */
-export type PasskeyPrfOpts = PrfCreateOpts & {
-    credId?: Uint8Array | readonly Uint8Array[];
-    /** Seal only: create a PRF credential first when no credId is known. */
-    createCredIfNeeded?: boolean;
-};
-/** One binding to try on unseal (cred id + sealed master). */
-export type PrfBinding = {
-    sealedMaster: SealedMasterKey;
-    credId: Uint8Array;
-};
-/** Durable PRF-sealed master + public ceremony facts (never includes PRF output). */
-export type PrfSealedMaster = PrfCeremony & {
-    sealedMaster: SealedMasterKey;
-    salt: Uint8Array;
-};
-/** One existing keyring member used to prove this enclave matches the list. */
-export type BindPrior = {
-    credId: Uint8Array;
-    tag: Uint8Array;
-};
-/** Seal + bind-tag from {@link Enclave.bind} (tag is not a global fingerprint). */
-export type PrfBound = PrfSealedMaster & {
-    tag: Uint8Array;
-};
-export type EncryptCipher = {
-    encrypt: (data: Uint8Array) => Promise<Uint8Array>;
-};
-export type DecryptCipher = {
-    decrypt: (data: Uint8Array) => Promise<Uint8Array>;
-};
-/** Encrypt + decrypt capability for one KDM. */
-export type DerivedCipher = EncryptCipher & DecryptCipher;
-/** Which ops the caller needs; only those methods are present on the handle. */
-export type CipherUsage = "encrypt" | "decrypt" | "both";
-/** Return shape of `deriveCipher` for a given usage (type-level enforcement). */
-export type CipherForUsage<U extends CipherUsage> = {
-    encrypt: EncryptCipher;
-    decrypt: DecryptCipher;
-    both: DerivedCipher;
-}[U];
-/**
- * Path-scoped signing identity: public key is public; sign/kdmFor re-enter
- * the enclave so the private key never leaves. Used for hosts, export files, etc.
- */
-export type Identity = {
-    readonly publicKey: PublicKey;
-    sign: (message: Uint8Array | string) => Promise<Uint8Array>;
-    /** Per-bag KDM mixed with this identity's private key (see bag seal). */
-    kdmFor: (msgHeadEnc: Uint8Array) => Promise<Uint8Array>;
-};
-declare const SEAL_BIND_DOMAIN: Uint8Array<ArrayBufferLike>;
-declare const FP_MODE: Uint8Array<ArrayBufferLike>;
-declare const SEAL_KEY_LEN = 32;
-declare const SEAL_PRF_MIN_LEN = 16;
+import { PairRequest } from "./pairing.ts";
+import { BagManager } from "./bagman.ts";
 /** Minimum musec length (Mandatory User-Space Entropy Contribution). */
-declare const MUSEC_MIN_LEN = 32;
-declare class PairRequest {
-    #private;
-    private constructor();
-    static create(): Promise<ValStat<PairRequest>>;
-    wipe(): void;
-    get dhkeReq(): DHKEReq;
-    finish(dhkeResp: DHKEResp): Promise<ValStat<{
-        enclave: Enclave;
-        hosts: BundleHost[];
-    }>>;
-}
-export type { PairRequest };
+export declare const MUSEC_MIN_LEN = 32;
+export declare function fromSeedHosts(buf: Uint8Array): ValStat<{
+    enclave: OuterEnclave;
+    hosts: BundleHost[];
+}>;
 /** Brand `bytes` as {@link MasterSeed} only if length is {@link MASTER_SEED_LEN}. */
 export declare function asMasterSeed(bytes: Uint8Array): ValStat<MasterSeed>;
-export declare class Enclave {
+declare class OuterEnclave {
     #private;
     private constructor();
     /**
      * New enclave: blake3(OS CSPRNG ‖ musec). musec is required (MUSEC_MIN_LEN).
-     * Mix stays in this method; musec is wiped before return.
+     * Musec is wiped on every return, including rejection and a throw from the
+     * OS generator. A rejected digest is wiped. The stored seed is that digest
+     * buffer, so the success path must not wipe it.
      */
-    static fromRandom(musec: Uint8Array): Promise<ValStat<Enclave>>;
+    static fromRandom(musec: Uint8Array): Promise<ValStat<OuterEnclave>>;
     /**
      * Construct from raw master seed bytes (import / bootstrap only).
      * Copies the seed so callers may zero their buffer after success.
      * Prefer {@link fromRandom} or {@link unsealWithPasskey} for normal flows.
      */
-    static fromBytes(bytes: Uint8Array): ValStat<Enclave>;
+    static fromBytes(bytes: Uint8Array): ValStat<OuterEnclave>;
     /**
      * UV + PRF ceremony, then AEAD-seal master. Returns sealed ciphertext + public
      * meta only — never PRF output. Sealed blob on disk is useless without a
@@ -102,7 +42,7 @@ export declare class Enclave {
      */
     sealWithPasskey(opts?: PasskeyPrfOpts): Promise<ValStat<PrfSealedMaster>>;
     /**
-     * UV + PRF seal, plus a per-cred bind tag (blake3(master ‖ domain ‖ credId)).
+     * UV + PRF seal, plus a per-cred bind tag (bindtag PDK child keyed by credId).
      * Tag compute and compare stay in the enclave. If `prior` is non-empty, every
      * stored tag must match this master or bind fails (one keyring, one master).
      */
@@ -114,23 +54,23 @@ export declare class Enclave {
     static unsealWithPasskey(bindings: readonly PrfBinding[], opts: PasskeyPrfOpts & {
         salt: Uint8Array;
     }): Promise<ValStat<{
-        enclave: Enclave;
+        enclave: OuterEnclave;
         credId: Uint8Array;
     }>>;
     /**
      * AEAD-seal master under caller-supplied PRF IKM (CLI hmac-secret).
      * Wipes `ikm` before return. Ciphertext only — never the seed.
      */
-    sealWithIkm(ikm: Uint8Array): Promise<ValStat<SealedMasterKey>>;
+    sealWithIKM(ikm: Uint8Array): Promise<ValStat<SealedMasterKey>>;
     /**
      * Unseal a PRF binding given IKM (CLI hmac-secret eval). Returns Enclave.
      * Wipes `ikm` before return.
      */
-    static unsealWithIkm(sealed: SealedMasterKey, ikm: Uint8Array): Promise<ValStat<Enclave>>;
+    static unsealWithIKM(sealed: SealedMasterKey, ikm: Uint8Array): Promise<ValStat<OuterEnclave>>;
     /**
      * UV + write IdentityBundle (seed + hosts) to largeBlob.
-     * Encode and WebAuthn write complete inside this method; nothing seed-bearing
-     * is returned. Prefer empty `hosts` for seed-only backup.
+     * Inner encodes the wire and {@link writeLargeBlob} does the UV write.
+     * Nothing seed-bearing is returned. Prefer empty `hosts` for seed-only backup.
      *
      * Pass `opts.credId` to write an existing credential (one UV). Omit it to
      * create a largeBlob-capable credential then write (two UV). Returns the
@@ -149,7 +89,7 @@ export declare class Enclave {
     static fromLargeBlob(opts?: LargeBlobRp & {
         credId?: Uint8Array;
     }): Promise<ValStat<{
-        enclave: Enclave;
+        enclave: OuterEnclave;
         hosts: BundleHost[];
         credId: Uint8Array;
     }>>;
@@ -160,7 +100,7 @@ export declare class Enclave {
      * Paced mode erases the previous line before the next (Enter between).
      * Web bundles set DIP_CLI_DUMP=false; the write is compiled out.
      */
-    dumpToTty(): Promise<Status>;
+    dumpToTTY(): Promise<Status>;
     static pairRequest(): Promise<ValStat<PairRequest>>;
     /**
      * Seals seed+hosts for dhkeReq. Returns dhkeResp to send back.
@@ -186,18 +126,7 @@ export declare class Enclave {
         id: number;
         persist?: boolean;
     }): Worker;
-    /**
-     * Cipher for public KDM. Does not hold key bytes; each op re-enters the
-     * enclave (async, hardware-shaped). `usage` selects the return shape:
-     * `"encrypt"` → `{ encrypt }`, `"decrypt"` → `{ decrypt }`, `"both"` → both.
-     */
-    deriveCipher<U extends CipherUsage>(kdm: Uint8Array, usage: U): CipherForUsage<U>;
-    /**
-     * Path-scoped identity (label+index). Private key stays in the enclave; only
-     * publicKey and capability methods are returned (frozen).
-     */
-    deriveIdentity(keyPath: string, idx?: number): Promise<Identity>;
+    bagman(idKDM: IKDM, realmKDM: IKDM): Promise<ValStat<BagManager>>;
+    fingerprint(kdm?: Uint8Array | IKDM): Promise<ValStat<PDK["Fingerprint"]>>;
 }
-/** Derive seal key from PRF output (domain-separated). Used by enclave seal/unseal. */
-export declare function sealKeyFromPrf(crypto: ICrypto, prf: Uint8Array, domain?: Uint8Array): Promise<ValStat<Uint8Array>>;
-export { FP_MODE, MASTER_SEED_LEN, MUSEC_MIN_LEN, SEAL_BIND_DOMAIN, SEAL_KEY_LEN, SEAL_PRF_MIN_LEN, };
+export { OuterEnclave as Enclave };

package/dist/web/shared/crypto/largeBlob.d.ts

@@ -0,0 +1,8 @@
+import { Status } from "../consts.ts";
+import { type ValStat } from "../valstat.ts";
+import { type LargeBlobCreateOpts, type LargeBlobRp } from "../webauthn/largeBlob.ts";
+export declare function largeBlobCredId(opts?: LargeBlobCreateOpts & {
+    credId?: Uint8Array;
+}): Promise<ValStat<Uint8Array>>;
+export declare function writeLargeBlob(credId: Uint8Array, data: Uint8Array, opts?: LargeBlobRp): Promise<Status>;
+export declare function wipeLargeBlob(credId: Uint8Array, opts?: LargeBlobRp): Promise<Status>;