@interncom/diplomatic 0.23.0 → 0.24.0

package/dist/cli/shared/crypto/enclave.d.ts

@@ -1,61 +1,38 @@
 import type { BundleHost } from "../codecs/bundleHost.ts";
 import type { IKDM } from "../codecs/kdm.ts";
+import type { MasterSeed, SealedMasterKey } from "../seed.ts";
+import type { ValStat } from "../valstat.ts";
+import type { PDK } from "./derivation.ts";
+import type { DHKEReq, DHKEResp } from "./pairing.ts";
+import type { LargeBlobCreateOpts, LargeBlobRp } from "../webauthn/largeBlob.ts";
+import type { BindPrior, PasskeyPrfOpts, PrfBinding, PrfBound, PrfSealedMaster } from "./prf.ts";
 import { Status } from "../consts.ts";
-import { type MasterSeed, type SealedMasterKey } from "../seed.ts";
-import type { PublicKey } from "../types.ts";
-import { type ValStat } from "../valstat.ts";
-import { type HostRlm, type PDK } from "./derivation.ts";
-import { type DHKEReq, type DHKEResp, PairRequest } from "./pairing.ts";
-import { type LargeBlobCreateOpts, type LargeBlobRp } from "../webauthn/largeBlob.ts";
-import { type BindPrior, type PasskeyPrfOpts, type PrfBinding, type PrfBound, type PrfSealedMaster } from "./prf.ts";
-export type EncryptCipher = {
-    encrypt: (data: Uint8Array) => Promise<ValStat<Uint8Array>>;
-};
-export type DecryptCipher = {
-    decrypt: (data: Uint8Array) => Promise<ValStat<Uint8Array>>;
-};
-/** Encrypt + decrypt capability for one KDM. */
-export type DerivedCipher = EncryptCipher & DecryptCipher;
-/** Which ops the caller needs; only those methods are present on the handle. */
-export type CipherUsage = "encrypt" | "decrypt" | "both";
-/** Return shape of `deriveCipher` for a given usage (type-level enforcement). */
-export type CipherForUsage<U extends CipherUsage> = {
-    encrypt: EncryptCipher;
-    decrypt: DecryptCipher;
-    both: DerivedCipher;
-}[U];
-/**
- * KDM-scoped signing identity: public key is public; sign/kdmFor re-enter
- * the enclave so the private key never leaves. Used for hosts, export files, etc.
- */
-export type Identity = {
-    readonly publicKey: PublicKey;
-    sign: (message: Uint8Array | string) => Promise<ValStat<Uint8Array>>;
-    /** Per-bag 8-byte KDM (bag-kdm PDK child keyed by the encoded head). */
-    kdmFor: (msgHeadEnc: Uint8Array) => Promise<ValStat<Uint8Array>>;
-};
+import { PairRequest } from "./pairing.ts";
+import { BagManager } from "./bagman.ts";
 /** Minimum musec length (Mandatory User-Space Entropy Contribution). */
 export declare const MUSEC_MIN_LEN = 32;
 export declare function fromSeedHosts(buf: Uint8Array): ValStat<{
-    enclave: Enclave;
+    enclave: OuterEnclave;
     hosts: BundleHost[];
 }>;
 /** Brand `bytes` as {@link MasterSeed} only if length is {@link MASTER_SEED_LEN}. */
 export declare function asMasterSeed(bytes: Uint8Array): ValStat<MasterSeed>;
-export declare class Enclave {
+declare class OuterEnclave {
     #private;
     private constructor();
     /**
      * New enclave: blake3(OS CSPRNG ‖ musec). musec is required (MUSEC_MIN_LEN).
-     * Mix stays in this method; musec is wiped before return.
+     * Musec is wiped on every return, including rejection and a throw from the
+     * OS generator. A rejected digest is wiped. The stored seed is that digest
+     * buffer, so the success path must not wipe it.
      */
-    static fromRandom(musec: Uint8Array): Promise<ValStat<Enclave>>;
+    static fromRandom(musec: Uint8Array): Promise<ValStat<OuterEnclave>>;
     /**
      * Construct from raw master seed bytes (import / bootstrap only).
      * Copies the seed so callers may zero their buffer after success.
      * Prefer {@link fromRandom} or {@link unsealWithPasskey} for normal flows.
      */
-    static fromBytes(bytes: Uint8Array): ValStat<Enclave>;
+    static fromBytes(bytes: Uint8Array): ValStat<OuterEnclave>;
     /**
      * UV + PRF ceremony, then AEAD-seal master. Returns sealed ciphertext + public
      * meta only — never PRF output. Sealed blob on disk is useless without a
@@ -77,23 +54,23 @@ export declare class Enclave {
     static unsealWithPasskey(bindings: readonly PrfBinding[], opts: PasskeyPrfOpts & {
         salt: Uint8Array;
     }): Promise<ValStat<{
-        enclave: Enclave;
+        enclave: OuterEnclave;
         credId: Uint8Array;
     }>>;
     /**
      * AEAD-seal master under caller-supplied PRF IKM (CLI hmac-secret).
      * Wipes `ikm` before return. Ciphertext only — never the seed.
      */
-    sealWithIkm(ikm: Uint8Array): Promise<ValStat<SealedMasterKey>>;
+    sealWithIKM(ikm: Uint8Array): Promise<ValStat<SealedMasterKey>>;
     /**
      * Unseal a PRF binding given IKM (CLI hmac-secret eval). Returns Enclave.
      * Wipes `ikm` before return.
      */
-    static unsealWithIkm(sealed: SealedMasterKey, ikm: Uint8Array): Promise<ValStat<Enclave>>;
+    static unsealWithIKM(sealed: SealedMasterKey, ikm: Uint8Array): Promise<ValStat<OuterEnclave>>;
     /**
      * UV + write IdentityBundle (seed + hosts) to largeBlob.
-     * Encode stays here; {@link writeLargeBlob} does the UV write. Nothing
-     * seed-bearing is returned. Prefer empty `hosts` for seed-only backup.
+     * Inner encodes the wire and {@link writeLargeBlob} does the UV write.
+     * Nothing seed-bearing is returned. Prefer empty `hosts` for seed-only backup.
      *
      * Pass `opts.credId` to write an existing credential (one UV). Omit it to
      * create a largeBlob-capable credential then write (two UV). Returns the
@@ -112,7 +89,7 @@ export declare class Enclave {
     static fromLargeBlob(opts?: LargeBlobRp & {
         credId?: Uint8Array;
     }): Promise<ValStat<{
-        enclave: Enclave;
+        enclave: OuterEnclave;
         hosts: BundleHost[];
         credId: Uint8Array;
     }>>;
@@ -123,7 +100,7 @@ export declare class Enclave {
      * Paced mode erases the previous line before the next (Enter between).
      * Web bundles set DIP_CLI_DUMP=false; the write is compiled out.
      */
-    dumpToTty(): Promise<Status>;
+    dumpToTTY(): Promise<Status>;
     static pairRequest(): Promise<ValStat<PairRequest>>;
     /**
      * Seals seed+hosts for dhkeReq. Returns dhkeResp to send back.
@@ -149,19 +126,7 @@ export declare class Enclave {
         id: number;
         persist?: boolean;
     }): Worker;
-    realmID(realmKDM: IKDM): Promise<ValStat<PDK["RealmID"]>>;
-    hostRlm(realmKDM: IKDM, hostKDM: IKDM): Promise<ValStat<PDK["HostRLM"]>>;
-    realmForRlm(hostKDM: IKDM, rlm: HostRlm, realms: readonly IKDM[]): Promise<ValStat<IKDM>>;
-    /**
-     * Cipher for public KDM under a realm (default: nullKDM). Does not hold
-     * key bytes; each op re-enters the enclave. `usage` selects the shape:
-     * `"encrypt"` → `{ encrypt }`, `"decrypt"` → `{ decrypt }`, `"both"` → both.
-     */
-    deriveCipher<U extends CipherUsage>(kdm: Uint8Array, usage: U, realmKDM?: IKDM): CipherForUsage<U>;
-    /**
-     * Identity from the identity PDK + KDM. Private key stays in the enclave;
-     * only publicKey and capability methods are returned.
-     */
-    deriveIdentity(kdm: IKDM): Promise<ValStat<Identity>>;
+    bagman(idKDM: IKDM, realmKDM: IKDM): Promise<ValStat<BagManager>>;
     fingerprint(kdm?: Uint8Array | IKDM): Promise<ValStat<PDK["Fingerprint"]>>;
 }
+export { OuterEnclave as Enclave };

package/dist/cli/shared/endpoint.d.ts

@@ -2,21 +2,20 @@ import { IClock } from "./clock.ts";
 import { Decoder, Encoder } from "./codec.ts";
 import { IAuthTimestamp } from "./codecs/authTimestamp.ts";
 import { Status } from "./consts.ts";
-import { Enclave, type Identity } from "./crypto/enclave.ts";
+import type { BagManager } from "./crypto/bagman.ts";
 import { ICrypto, IProtoHost } from "./types.ts";
 import { ValStat } from "./valstat.ts";
 interface IProtoClient {
     crypto: ICrypto;
-    enclave: Enclave;
     clock: IClock;
 }
 export interface IAuthenticatedEndpoint<ReqInput, Resp> {
-    encodeReq(client: IProtoClient, identity: Identity, authTS: IAuthTimestamp, body: ReqInput, reqEnc: Encoder): Promise<Status>;
+    encodeReq(client: IProtoClient, identity: BagManager, authTS: IAuthTimestamp, body: ReqInput, reqEnc: Encoder): Promise<Status>;
     handleReq(host: IProtoHost, reqDec: Decoder, respEnc: Encoder): Promise<Status>;
     decodeResp(respDec: Decoder): ValStat<Resp>;
 }
 export interface IAuthData {
-    identity: Identity;
+    identity: BagManager;
     authTS: IAuthTimestamp;
 }
 export {};

package/dist/cli/shared/sync.d.ts

@@ -1,11 +1,9 @@
 import { IBagPeekItem } from "./codecs/peekItem.ts";
-import type { IKDM } from "./codecs/kdm.ts";
-import { type HostRlm } from "./crypto/derivation.ts";
-import { Enclave } from "./crypto/enclave.ts";
+import { BagManager } from "./crypto/bagman.ts";
 import { ICrypto } from "./types.ts";
 import { ValStat } from "./valstat.ts";
 export interface IDecryptedBagPeekItem {
     kdm: Uint8Array;
     headEnc: Uint8Array;
 }
-export declare function decryptPeekItem(item: IBagPeekItem, verifyKey: CryptoKey, enclave: Enclave, crypto: ICrypto, rlm: HostRlm, realm?: IKDM): Promise<ValStat<IDecryptedBagPeekItem>>;
+export declare function decryptPeekItem(item: IBagPeekItem, verifyKey: CryptoKey, bagMgr: BagManager, crypto: ICrypto): Promise<ValStat<IDecryptedBagPeekItem>>;

package/dist/cli/shared/types.d.ts

@@ -151,11 +151,6 @@ export interface ICrypto extends IHostCrypto {
     signEd25519: (message: Uint8Array | string, secKey: PrivateKey) => Promise<Uint8Array>;
     blake3: (data: Uint8Array, opts?: Blake3Opts) => Promise<Hash>;
 }
-export interface IMsgpackCodec {
-    encode: (source: unknown) => Uint8Array;
-    decode: (packed: ArrayBuffer | Uint8Array) => unknown;
-    decodeAsync: (stream: ReadableStream<Uint8Array>) => Promise<unknown>;
-}
 export interface IProtoHost {
     storage: IStorage;
     crypto: IHostCrypto;

package/dist/cli/src/index.d.ts

@@ -9,6 +9,7 @@ import { Enclave } from "../shared/crypto/enclave.ts";
 import { HostHandle, IHostConnectionInfo, IMessage, ITransport } from "../shared/types.ts";
 import { ValStat } from "../shared/valstat.ts";
 export declare class CLIClient<Handle extends HostHandle> {
+    #private;
     private enclave;
     private conn?;
     private clock;
@@ -38,7 +39,6 @@ export declare function initCLIOrPanic<Handle extends URL>({ enclave, host, tran
 /** Load master seed hex from env and construct an Enclave immediately. */
 export declare function loadEnclaveOrPanic(envVar: string): Enclave;
 export declare function loadHostOrPanic(envVar: string): IHostConnectionInfo<URL>;
-export { default as msgpack } from "../bun/src/codec.ts";
 export { Decoder } from "../shared/codec.ts";
 export { notifItemCodec } from "../shared/codecs/notifItem.ts";
 export type { IBagNotifItem } from "../shared/codecs/notifItem.ts";

package/dist/web/client.d.ts

@@ -5,6 +5,7 @@ import { EncodedMessage } from "./shared/message";
 import type { Enclave } from "./shared/crypto/enclave";
 import { EntityID, Hash, HostHandle, ICrypto, IDeleteParams, IEntRev, IHostConnectionInfo, IInsertParams, IMessageHead, IStateManager, ITransport, IUpdateParams } from "./shared/types";
 import { ValStat } from "./shared/valstat";
+import { type IBlobUpdate, type IBlobWrite } from "./shared/blobs";
 import { ApldState, IClient, IDiplomaticClientState, IDiplomaticClientXferState, IHostRow, IStateEmitter, IStore, IStoredMessage, ListMsgsOpts, OpenAccount, ReconcileOpts, ReconcileReport, SetSeedOpts, WipeOpts } from "./types";
 export declare class SyncClient<Handle extends HostHandle> implements IClient<Handle> {
     #private;
@@ -125,13 +126,18 @@ export declare class SyncClient<Handle extends HostHandle> implements IClient<Ha
      */
     private updateWithSkew;
     updateRaw(prior: IEntRev, bod: EncodedMessage | undefined, force?: boolean, typ?: string): Promise<ValStat<IMessageHead>>;
-    insert<T = unknown>(op: IInsertParams<T>): Promise<ValStat<IMessageHead>>;
-    update<T = unknown>(op: IUpdateParams<T>): Promise<ValStat<IMessageHead>>;
+    insert(op: IInsertParams<Uint8Array>): Promise<ValStat<IMessageHead>>;
+    update(op: IUpdateParams<Uint8Array>): Promise<ValStat<IMessageHead>>;
     /**
      * Delete by `{ prior }` (preferred) or `{ eid }` (archive lookup).
      * `force` defaults to true (skew recovery on delete).
      */
     delete(op: IDeleteParams): Promise<ValStat<IMessageHead>>;
+    insertBlob(mime: string, bytes: Uint8Array, opts?: IBlobWrite): Promise<ValStat<IMessageHead>>;
+    updateBlob(eid: EntityID, bytes: Uint8Array, opts?: IBlobUpdate): Promise<ValStat<IMessageHead>>;
+    deleteBlob(eid: EntityID): Promise<ValStat<IMessageHead>>;
+    readBlob(eid: EntityID): Promise<ValStat<Uint8Array>>;
+    private lastMsg;
     /**
      * Latest rev for eid from the message archive.
      * If none, returns ctr -1 so the next write uses ctr 0.

package/dist/web/entdb/idb.d.ts

@@ -10,9 +10,7 @@ export declare const typeParentIndexName = "entity_type_parent_id";
 export declare const tagsIndexName = "entity_tags";
 /** Realm label. Rows in the default realm omit rlm and are not in this index. */
 export declare const realmIndexName = "entity_rlm";
-/** Pre-split EntDB name. New accounts use `ents-<acct>`. */
-export declare const ENT_IDB_NAME = "db";
-/** v15: optional rlm (realm label) index. Omitted on the default realm. */
+/** Current EntDB schema. Default-realm rows omit rlm. */
 export declare const ENT_IDB_VERSION = 15;
 export declare class EntIDB implements IEntDB {
     private name;

package/dist/web/index.d.ts

@@ -11,13 +11,14 @@ import { b64tob, b64urltob, btob64, btob64url, btoh, htob } from "./shared/binar
 import { Clock } from "./shared/clock";
 import { Decoder, Encoder } from "./shared/codec";
 import { eidCodec, genSingletonEID } from "./shared/codecs/eid";
+import { encodeEnt, entCodec } from "./shared/codecs/ent";
 import { Status } from "./shared/consts";
 import { hostHTTPTransport, HTTPTransport } from "./shared/http";
 import { TypedEventEmitter } from "./shared/events";
 import { asSealedMasterKey, MASTER_SEED_LEN, SEALED_MASTER_KEY_LEN, type SealedMasterKey } from "./shared/seed";
 import { EntityID, HostHandle, ICrypto, IDeleteParams, IEntRev, IHostConnectionInfo, IMessage, IMutateOp, type IOp, IStateManager, ITransport, IUpdateParams } from "./shared/types";
 import { Enclave } from "./shared/crypto/enclave";
-import type { Identity } from "./shared/crypto/enclave";
+import type { BagManager } from "./shared/crypto/bagman";
 import { asChildKey, asHostRlm, type ChildKey, type HostRlm, nullKDM, Purpose } from "./shared/crypto/derivation";
 import type { PairRequest } from "./shared/crypto/pairing";
 import type { BindPrior, PrfBound } from "./shared/crypto/prf";
@@ -49,5 +50,5 @@ import type { WipeOpts } from "./types";
 /** Platform advertises largeBlob (not a guarantee the binding key has it). */
 export { largeBlobCapable } from "./shared/webauthn/largeBlob";
 export { webAuthnLastError } from "./shared/webauthn/common";
-export { APLD_APPLIED, APLD_ERROR, APLD_PENDING, apldFromStored, asChildKey, asDHKEReq, asDHKEResp, asHostRlm, asSealedMasterKey, b64tob, b64urltob, btob64, btob64url, btoh, CachedEntDB, checksumEntRevs, checksumSet, Clock, cmpBytes, crypto, Decoder, DEFAULT_PRF_SALT, defaultPeekProgressEvery, defaultWebAuthnRpId, eidCodec, Enclave, encodeEntRev, Encoder, EntDBMemory, EntIDB, EntitiesQuery, EntityID, entStateManager, genSingletonEID, hostHTTPTransport, htob, HTTPTransport, IDBAccountStore, IDBStore, idleProgress, IEntDB, IEntity, isApldState, isLiveEnt, isPendingApply, isTerminalApplyFailure, isTombstone, IStore, KEYRING_MAX, keyringCredIds, keyringKind, keyringLabel, MASTER_SEED_LEN, MemoryStore, normalizeTags, nullEntDB, nullKDM, nullStateManager, openDiplomaticClient, openEntDB, openIDBStore, PasskeySeedStore, prfCapable, PrfSeedStore, Purpose, revFromEntity, revFromHead, SEALED_MASTER_KEY_LEN, setApld, shouldEmitItemProgress, SingletonStateManager, StateManager, Status, SyncClient, TypedEventEmitter, useClient, useClientState, useClientXferState, useStateWatcher, useStateWatcherSuspense, useSyncOnResume, WorkerClient, };
-export type { ApldState, Applier, BindPrior, BundleHost, CachedEntDBOptions, ChildKey, DateSpec, DHKEReq, DHKEResp, EntDBMemoryOptions, EntRlm, HostHandle, HostRlm, HostSeqsUpdate, IClient, ICrypto, IDateRange, IDeleteParams, Identity, IDiplomaticClientState, IEntRev, IEntRow, IHostConnectionInfo, IHostRow, IKDM, IMessage, IMutateOp, IOp, IRealm, IStateManager, IStoredMessage, IStoredMessageData, IStoredMessageWrite, ITagRange, ITombstone, ITransport, IUpdateParams, Keyring, KeyringEntry, KeyringRow, ListMsgsOpts, OpenAccount, OpenDiplomaticClientMainOptions, OpenDiplomaticClientOptions, OpenDiplomaticClientWorkerOptions, OpenedDiplomaticClient, OpenEntDBOptions, PairRequest, PasskeySeedStoreOpts, PersistKeyring, PrfBound, PrfRp, PrfSeedStoreOpts, ReconcileOpts, ReconcileReport, SealedMasterKey, SetSeedOpts, SyncProgressEvent, TagSpec, WipeOpts, WorkerClientOptions, };
+export { APLD_APPLIED, APLD_ERROR, APLD_PENDING, apldFromStored, asChildKey, asDHKEReq, asDHKEResp, asHostRlm, asSealedMasterKey, b64tob, b64urltob, btob64, btob64url, btoh, CachedEntDB, checksumEntRevs, checksumSet, Clock, cmpBytes, crypto, Decoder, DEFAULT_PRF_SALT, defaultPeekProgressEvery, defaultWebAuthnRpId, eidCodec, Enclave, encodeEnt, encodeEntRev, Encoder, entCodec, EntDBMemory, EntIDB, EntitiesQuery, EntityID, entStateManager, genSingletonEID, hostHTTPTransport, htob, HTTPTransport, IDBAccountStore, IDBStore, idleProgress, IEntDB, IEntity, isApldState, isLiveEnt, isPendingApply, isTerminalApplyFailure, isTombstone, IStore, KEYRING_MAX, keyringCredIds, keyringKind, keyringLabel, MASTER_SEED_LEN, MemoryStore, normalizeTags, nullEntDB, nullKDM, nullStateManager, openDiplomaticClient, openEntDB, openIDBStore, PasskeySeedStore, prfCapable, PrfSeedStore, Purpose, revFromEntity, revFromHead, SEALED_MASTER_KEY_LEN, setApld, shouldEmitItemProgress, SingletonStateManager, StateManager, Status, SyncClient, TypedEventEmitter, useClient, useClientState, useClientXferState, useStateWatcher, useStateWatcherSuspense, useSyncOnResume, WorkerClient, };
+export type { ApldState, Applier, BagManager, BindPrior, BundleHost, CachedEntDBOptions, ChildKey, DateSpec, DHKEReq, DHKEResp, EntDBMemoryOptions, EntRlm, HostHandle, HostRlm, HostSeqsUpdate, IClient, ICrypto, IDateRange, IDeleteParams, IDiplomaticClientState, IEntRev, IEntRow, IHostConnectionInfo, IHostRow, IKDM, IMessage, IMutateOp, IOp, IRealm, IStateManager, IStoredMessage, IStoredMessageData, IStoredMessageWrite, ITagRange, ITombstone, ITransport, IUpdateParams, Keyring, KeyringEntry, KeyringRow, ListMsgsOpts, OpenAccount, OpenDiplomaticClientMainOptions, OpenDiplomaticClientOptions, OpenDiplomaticClientWorkerOptions, OpenedDiplomaticClient, OpenEntDBOptions, PairRequest, PasskeySeedStoreOpts, PersistKeyring, PrfBound, PrfRp, PrfSeedStoreOpts, ReconcileOpts, ReconcileReport, SealedMasterKey, SetSeedOpts, SyncProgressEvent, TagSpec, WipeOpts, WorkerClientOptions, };