@interncom/diplomatic 0.23.0 → 0.25.0

package/dist/web/objEq.d.ts

@@ -0,0 +1 @@
+export declare function objEq(a: unknown, b: unknown): boolean;

package/dist/web/shared/auth.d.ts

@@ -1,9 +1,9 @@
 import { IClock } from "./clock.ts";
 import { type IAuthTimestamp } from "./codecs/authTimestamp.ts";
 import { Status } from "./consts.ts";
-import type { Identity } from "./crypto/enclave.ts";
+import type { BagManager } from "./crypto/bagman.ts";
 import type { IHostCrypto } from "./types.ts";
 import { ValStat } from "./valstat.ts";
 export type EncodedAuthTimestamp = Uint8Array;
-export declare function makeAuthTimestamp(identity: Pick<Identity, "publicKey" | "sign">, ts: Date): Promise<ValStat<IAuthTimestamp>>;
+export declare function makeAuthTimestamp(identity: BagManager, ts: Date): Promise<ValStat<IAuthTimestamp>>;
 export declare function validateAuthTimestamp(authTS: IAuthTimestamp, crypto: IHostCrypto, clock: IClock): Promise<Status>;

package/dist/web/shared/bag.d.ts

@@ -1,19 +1,21 @@
-import type { IKDM } from "./codecs/kdm.ts";
 import { IMessageHead } from "./codecs/messageHead.ts";
 import type { HostRlm } from "./crypto/derivation.ts";
-import { type DecryptCipher, Enclave, type Identity } from "./crypto/enclave.ts";
+import { BagManager } from "./crypto/bagman.ts";
 import { EncodedMessage } from "./message.ts";
 import { type ValStat } from "./valstat.ts";
 import type { Hash, IBag, ICrypto, IHostCrypto, IMessage, IMessageWithHash } from "./types.ts";
 export declare function bagSigMsg(rlm: HostRlm, headCph: Uint8Array): Uint8Array;
 export declare function bagSigValid(bag: IBag, verifyKey: CryptoKey, crypto: IHostCrypto): Promise<boolean>;
-export declare function sealBag(msg: IMessage, identity: Identity, crypto: ICrypto, enclave: Enclave, hostKDM?: IKDM, realmKDM?: IKDM): Promise<ValStat<IBag>>;
+export declare function sealBag(msg: IMessage, bagMgr: BagManager, crypto: ICrypto): Promise<ValStat<IBag>>;
 export interface IOpenBag {
     msgHead: IMessageHead;
     bod?: EncodedMessage;
     headHash: Hash;
 }
-export declare function openBagBody(headEnc: Uint8Array, bodyCph: Uint8Array | undefined, cipher: DecryptCipher, crypto: ICrypto, 
+export type BagDecrypt = {
+    decrypt: (data: Uint8Array) => Promise<ValStat<Uint8Array>>;
+};
+export declare function openBagBody(headEnc: Uint8Array, bodyCph: Uint8Array | undefined, cipher: BagDecrypt, crypto: ICrypto, 
 /** When set (e.g. from peek), skip blake3(headEnc). */
 headHashKnown?: Hash): Promise<ValStat<IOpenBag>>;
-export declare function openBag(bag: IBag, verifyKey: CryptoKey, crypto: ICrypto, enclave: Enclave, hostKDM?: IKDM, realms?: readonly IKDM[]): Promise<ValStat<IMessageWithHash>>;
+export declare function openBag(bag: IBag, verifyKey: CryptoKey, crypto: ICrypto, bagMgr: BagManager): Promise<ValStat<IMessageWithHash>>;

package/dist/web/shared/blobs.d.ts

@@ -0,0 +1,25 @@
+import type { EntityID, IEntRev, IMessage, IMsgEntBody } from "./types.ts";
+import { ValStat } from "./valstat.ts";
+/** Head typ prefix. The rest is an app mime, such as "image/jpeg". */
+export declare const blobPrefix = "blob:";
+export declare function blobTyp(mime: string): string;
+export declare function isBlobTyp(typ: string | undefined): typ is string;
+export declare function mimeOf(typ: string | undefined): string | undefined;
+export interface IBlobWrite {
+    tags?: string[];
+    pid?: EntityID;
+}
+export interface IBlobUpdate extends IBlobWrite {
+    mime?: string;
+}
+type BlobMsg = {
+    typ: string;
+    bod: Uint8Array;
+};
+export declare function openBlob(bod: Uint8Array): ValStat<IMsgEntBody<Uint8Array>>;
+export declare function insertBlobMsg(mime: string, bytes: Uint8Array, opts?: IBlobWrite): ValStat<BlobMsg>;
+export declare function updateBlobMsg(prev: IMessage | undefined, bytes: Uint8Array, opts?: IBlobUpdate): ValStat<BlobMsg & {
+    prior: IEntRev;
+}>;
+export declare function blobBytes(msg: IMessage | undefined): ValStat<Uint8Array>;
+export {};

package/dist/web/shared/client.d.ts

@@ -1,23 +1,26 @@
 import { IClock } from "./clock.ts";
-import type { IKDM } from "./codecs/kdm.ts";
+import { type IKDM } from "./codecs/kdm.ts";
 import type { IBagPeekItem } from "./codecs/peekItem.ts";
 import type { IBagPullItem } from "./codecs/pullItem.ts";
 import { Status } from "./consts.ts";
-import { Enclave, type Identity } from "./crypto/enclave.ts";
+import type { BagManager } from "./crypto/bagman.ts";
+import type { Enclave } from "./crypto/enclave.ts";
 import { type HostRlm } from "./crypto/derivation.ts";
-import type { HostHandle, IBag, ICrypto, IHostConnectionInfo, IHostMetadata, IMessage, ITransport, PushReceiver } from "./types.ts";
+import type { HostHandle, IBag, ICrypto, IHostMetadata, IMessage, ITransport, PushReceiver } from "./types.ts";
 import { ValStat } from "./valstat.ts";
+export declare function hostBagMgrs(enclave: Enclave, idKDM: IKDM, realms?: readonly IKDM[]): Promise<ValStat<BagManager[]>>;
 export default class DiplomaticClientAPI<Handle extends HostHandle> {
     #private;
-    enclave: Enclave;
     crypto: ICrypto;
-    private host;
     clock: IClock;
     private transport;
     private updateHostMeta;
-    constructor(enclave: Enclave, crypto: ICrypto, host: IHostConnectionInfo<Handle>, clock: IClock, transport: ITransport, updateHostMeta: (meta: IHostMetadata) => Promise<Status>);
+    constructor(bagMgrs: BagManager[], crypto: ICrypto, clock: IClock, transport: ITransport, updateHostMeta: (meta: IHostMetadata) => Promise<Status>);
     private call;
-    identity: () => Promise<ValStat<Identity>>;
+    bagMgrFor(realm?: IKDM): BagManager | undefined;
+    bagMgrs(): readonly BagManager[];
+    add(bagMgr: BagManager): void;
+    identity: () => Promise<ValStat<BagManager>>;
     hostRlm: (realm?: IKDM) => Promise<ValStat<HostRlm>>;
     seal: (msg: IMessage, realm?: IKDM) => Promise<ValStat<IBag>>;
     register: () => Promise<ValStat<void>>;

package/dist/web/shared/codec.d.ts

@@ -14,12 +14,15 @@ export declare class Decoder {
     readDate(): ValStat<Date>;
     readVarInt(): ValStat<number>;
     readVarString(): ValStat<string>;
+    readVarStrings(): ValStat<string[]>;
     readBytes(num: number): ValStat<Uint8Array>;
     readVarBytes(): ValStat<Uint8Array>;
     readStruct<T>(codec: ICodecStruct<T>): ValStat<T>;
     readStructs<T>(codec: ICodecStruct<T>): ValStat<T[]>;
     readBytesSeq(len: number): ValStat<Uint8Array[]>;
     done(): boolean;
+    remaining(): number;
+    readRest(): Uint8Array;
     consumed(): number;
 }
 export declare class Encoder {
@@ -28,6 +31,7 @@ export declare class Encoder {
     writeDate(ts: Date): Status;
     writeVarInt(n: number): Status;
     writeVarString(s: string): Status;
+    writeVarStrings(strs: string[]): Status;
     prependBytes(bytes: Uint8Array): void;
     /**
      * Append a copy of `bytes`. Parts must not alias caller buffers — callers

package/dist/web/shared/codecs/ent.d.ts

@@ -0,0 +1,5 @@
+import { ICodecStruct } from "../codec.ts";
+import { IMsgEntBody } from "../types.ts";
+import { ValStat } from "../valstat.ts";
+export declare const entCodec: ICodecStruct<IMsgEntBody<Uint8Array>>;
+export declare function encodeEnt(ent: IMsgEntBody<Uint8Array>): ValStat<Uint8Array>;

package/dist/web/shared/codecs/file.d.ts

@@ -1,8 +1,7 @@
 import { ICodecStruct } from "../codec.ts";
-import { IFileHead } from "./fileHead.ts";
+import { type IFileHead } from "./fileHead.ts";
 export interface IFile {
     head: IFileHead;
-    indexEnc: Uint8Array;
-    bodyEnc: Uint8Array;
+    chunks: Uint8Array;
 }
 export declare const fileCodec: ICodecStruct<IFile>;

package/dist/web/shared/codecs/fileHead.d.ts

@@ -1,10 +1,12 @@
 import { ICodecStruct } from "../codec.ts";
-import { Hash } from "../types.ts";
+import type { Hash } from "../types.ts";
+import { type ValStat } from "../valstat.ts";
+import { type IFileRealm } from "./fileRealm.ts";
 export interface IFileHead {
-    lbl: string;
-    idx: number;
-    num: number;
+    nonce: Uint8Array;
+    realms: IFileRealm[];
     hsh: Hash;
     sig: Uint8Array;
 }
+export declare function fileHeadPreimage(nonce: Uint8Array, realms: readonly IFileRealm[]): ValStat<Uint8Array>;
 export declare const fileHeadCodec: ICodecStruct<IFileHead>;

package/dist/web/shared/codecs/fileIndexItem.d.ts

@@ -3,6 +3,5 @@ export interface IFileIndexItem {
     kdm: Uint8Array;
     headCph: Uint8Array;
     lenBody: number;
-    offBody?: number;
 }
 export declare const fileIndexItemCodec: ICodecStruct<IFileIndexItem>;

package/dist/web/shared/codecs/fileRealm.d.ts

@@ -0,0 +1,9 @@
+import { ICodecStruct } from "../codec.ts";
+import type { Hash } from "../types.ts";
+import { type IKDM } from "./kdm.ts";
+export interface IFileRealm {
+    realm: IKDM;
+    num: number;
+    hsh: Hash;
+}
+export declare const fileRealmCodec: ICodecStruct<IFileRealm>;

package/dist/web/shared/codecs/kdm.d.ts

@@ -3,4 +3,5 @@ export interface IKDM {
     label: string;
     index: number;
 }
+export declare function kdmEq(k1: IKDM, k2: IKDM): boolean;
 export declare const kdmCodec: ICodecStruct<IKDM>;

package/dist/web/shared/crypto/bagman.d.ts

@@ -0,0 +1,19 @@
+import type { IKDM } from "../codecs/kdm.ts";
+import type { PublicKey } from "../types.ts";
+import { type ValStat } from "../valstat.ts";
+import type { HostRlm, PDK } from "./derivation.ts";
+export declare class BagManager {
+    #private;
+    readonly publicKey: PublicKey;
+    private idnt;
+    private realm;
+    readonly rlm: HostRlm;
+    readonly idKDM: Readonly<IKDM>;
+    readonly realmKDM: Readonly<IKDM>;
+    private constructor();
+    static init(idnt: PDK["Identity"], realm: PDK["RealmKey"], rlm: HostRlm, idKDM: IKDM, realmKDM: IKDM): Promise<ValStat<BagManager>>;
+    sign(message: Uint8Array | string): Promise<ValStat<Uint8Array>>;
+    bagKDM(msgHeadEnc: Uint8Array): Promise<ValStat<Uint8Array>>;
+    encrypt(kdm: Uint8Array, data: Uint8Array): Promise<ValStat<Uint8Array>>;
+    decrypt(kdm: Uint8Array, data: Uint8Array): Promise<ValStat<Uint8Array>>;
+}

package/dist/web/shared/crypto/binary.d.ts

@@ -0,0 +1 @@
+export declare function bytesEqual(a: Uint8Array, b: Uint8Array): boolean;

package/dist/web/shared/crypto/derivation.d.ts

@@ -11,6 +11,7 @@ export declare const Purpose: {
     readonly RealmKey: "diplomatic.realmKey.v1";
     readonly RealmID: "diplomatic.realmID.v1";
     readonly HostRLM: "diplomatic.hostRLM.v1";
+    readonly Export: "diplomatic.export.v1";
 };
 export type Purpose = typeof Purpose[keyof typeof Purpose];
 declare const pdkSymbol: unique symbol;

package/dist/web/shared/crypto/enclave.d.ts

@@ -1,61 +1,38 @@
 import type { BundleHost } from "../codecs/bundleHost.ts";
 import type { IKDM } from "../codecs/kdm.ts";
+import type { MasterSeed, SealedMasterKey } from "../seed.ts";
+import type { ValStat } from "../valstat.ts";
+import type { PDK } from "./derivation.ts";
+import type { DHKEReq, DHKEResp } from "./pairing.ts";
+import type { LargeBlobCreateOpts, LargeBlobRp } from "../webauthn/largeBlob.ts";
+import type { BindPrior, PasskeyPrfOpts, PrfBinding, PrfBound, PrfSealedMaster } from "./prf.ts";
 import { Status } from "../consts.ts";
-import { type MasterSeed, type SealedMasterKey } from "../seed.ts";
-import type { PublicKey } from "../types.ts";
-import { type ValStat } from "../valstat.ts";
-import { type HostRlm, type PDK } from "./derivation.ts";
-import { type DHKEReq, type DHKEResp, PairRequest } from "./pairing.ts";
-import { type LargeBlobCreateOpts, type LargeBlobRp } from "../webauthn/largeBlob.ts";
-import { type BindPrior, type PasskeyPrfOpts, type PrfBinding, type PrfBound, type PrfSealedMaster } from "./prf.ts";
-export type EncryptCipher = {
-    encrypt: (data: Uint8Array) => Promise<ValStat<Uint8Array>>;
-};
-export type DecryptCipher = {
-    decrypt: (data: Uint8Array) => Promise<ValStat<Uint8Array>>;
-};
-/** Encrypt + decrypt capability for one KDM. */
-export type DerivedCipher = EncryptCipher & DecryptCipher;
-/** Which ops the caller needs; only those methods are present on the handle. */
-export type CipherUsage = "encrypt" | "decrypt" | "both";
-/** Return shape of `deriveCipher` for a given usage (type-level enforcement). */
-export type CipherForUsage<U extends CipherUsage> = {
-    encrypt: EncryptCipher;
-    decrypt: DecryptCipher;
-    both: DerivedCipher;
-}[U];
-/**
- * KDM-scoped signing identity: public key is public; sign/kdmFor re-enter
- * the enclave so the private key never leaves. Used for hosts, export files, etc.
- */
-export type Identity = {
-    readonly publicKey: PublicKey;
-    sign: (message: Uint8Array | string) => Promise<ValStat<Uint8Array>>;
-    /** Per-bag 8-byte KDM (bag-kdm PDK child keyed by the encoded head). */
-    kdmFor: (msgHeadEnc: Uint8Array) => Promise<ValStat<Uint8Array>>;
-};
+import { PairRequest } from "./pairing.ts";
+import { BagManager } from "./bagman.ts";
 /** Minimum musec length (Mandatory User-Space Entropy Contribution). */
 export declare const MUSEC_MIN_LEN = 32;
 export declare function fromSeedHosts(buf: Uint8Array): ValStat<{
-    enclave: Enclave;
+    enclave: OuterEnclave;
     hosts: BundleHost[];
 }>;
 /** Brand `bytes` as {@link MasterSeed} only if length is {@link MASTER_SEED_LEN}. */
 export declare function asMasterSeed(bytes: Uint8Array): ValStat<MasterSeed>;
-export declare class Enclave {
+declare class OuterEnclave {
     #private;
     private constructor();
     /**
      * New enclave: blake3(OS CSPRNG ‖ musec). musec is required (MUSEC_MIN_LEN).
-     * Mix stays in this method; musec is wiped before return.
+     * Musec is wiped on every return, including rejection and a throw from the
+     * OS generator. A rejected digest is wiped. The stored seed is that digest
+     * buffer, so the success path must not wipe it.
      */
-    static fromRandom(musec: Uint8Array): Promise<ValStat<Enclave>>;
+    static fromRandom(musec: Uint8Array): Promise<ValStat<OuterEnclave>>;
     /**
      * Construct from raw master seed bytes (import / bootstrap only).
      * Copies the seed so callers may zero their buffer after success.
      * Prefer {@link fromRandom} or {@link unsealWithPasskey} for normal flows.
      */
-    static fromBytes(bytes: Uint8Array): ValStat<Enclave>;
+    static fromBytes(bytes: Uint8Array): ValStat<OuterEnclave>;
     /**
      * UV + PRF ceremony, then AEAD-seal master. Returns sealed ciphertext + public
      * meta only — never PRF output. Sealed blob on disk is useless without a
@@ -77,23 +54,23 @@ export declare class Enclave {
     static unsealWithPasskey(bindings: readonly PrfBinding[], opts: PasskeyPrfOpts & {
         salt: Uint8Array;
     }): Promise<ValStat<{
-        enclave: Enclave;
+        enclave: OuterEnclave;
         credId: Uint8Array;
     }>>;
     /**
      * AEAD-seal master under caller-supplied PRF IKM (CLI hmac-secret).
      * Wipes `ikm` before return. Ciphertext only — never the seed.
      */
-    sealWithIkm(ikm: Uint8Array): Promise<ValStat<SealedMasterKey>>;
+    sealWithIKM(ikm: Uint8Array): Promise<ValStat<SealedMasterKey>>;
     /**
      * Unseal a PRF binding given IKM (CLI hmac-secret eval). Returns Enclave.
      * Wipes `ikm` before return.
      */
-    static unsealWithIkm(sealed: SealedMasterKey, ikm: Uint8Array): Promise<ValStat<Enclave>>;
+    static unsealWithIKM(sealed: SealedMasterKey, ikm: Uint8Array): Promise<ValStat<OuterEnclave>>;
     /**
      * UV + write IdentityBundle (seed + hosts) to largeBlob.
-     * Encode stays here; {@link writeLargeBlob} does the UV write. Nothing
-     * seed-bearing is returned. Prefer empty `hosts` for seed-only backup.
+     * Inner encodes the wire and {@link writeLargeBlob} does the UV write.
+     * Nothing seed-bearing is returned. Prefer empty `hosts` for seed-only backup.
      *
      * Pass `opts.credId` to write an existing credential (one UV). Omit it to
      * create a largeBlob-capable credential then write (two UV). Returns the
@@ -112,7 +89,7 @@ export declare class Enclave {
     static fromLargeBlob(opts?: LargeBlobRp & {
         credId?: Uint8Array;
     }): Promise<ValStat<{
-        enclave: Enclave;
+        enclave: OuterEnclave;
         hosts: BundleHost[];
         credId: Uint8Array;
     }>>;
@@ -123,7 +100,7 @@ export declare class Enclave {
      * Paced mode erases the previous line before the next (Enter between).
      * Web bundles set DIP_CLI_DUMP=false; the write is compiled out.
      */
-    dumpToTty(): Promise<Status>;
+    dumpToTTY(): Promise<Status>;
     static pairRequest(): Promise<ValStat<PairRequest>>;
     /**
      * Seals seed+hosts for dhkeReq. Returns dhkeResp to send back.
@@ -149,19 +126,8 @@ export declare class Enclave {
         id: number;
         persist?: boolean;
     }): Worker;
-    realmID(realmKDM: IKDM): Promise<ValStat<PDK["RealmID"]>>;
-    hostRlm(realmKDM: IKDM, hostKDM: IKDM): Promise<ValStat<PDK["HostRLM"]>>;
-    realmForRlm(hostKDM: IKDM, rlm: HostRlm, realms: readonly IKDM[]): Promise<ValStat<IKDM>>;
-    /**
-     * Cipher for public KDM under a realm (default: nullKDM). Does not hold
-     * key bytes; each op re-enters the enclave. `usage` selects the shape:
-     * `"encrypt"` → `{ encrypt }`, `"decrypt"` → `{ decrypt }`, `"both"` → both.
-     */
-    deriveCipher<U extends CipherUsage>(kdm: Uint8Array, usage: U, realmKDM?: IKDM): CipherForUsage<U>;
-    /**
-     * Identity from the identity PDK + KDM. Private key stays in the enclave;
-     * only publicKey and capability methods are returned.
-     */
-    deriveIdentity(kdm: IKDM): Promise<ValStat<Identity>>;
+    exportKey(nonce: Uint8Array): Promise<ValStat<PDK["Export"]>>;
+    bagman(idKDM: IKDM, realmKDM: IKDM): Promise<ValStat<BagManager>>;
     fingerprint(kdm?: Uint8Array | IKDM): Promise<ValStat<PDK["Fingerprint"]>>;
 }
+export { OuterEnclave as Enclave };

package/dist/web/shared/crypto/exim.d.ts

@@ -0,0 +1,22 @@
+import { type IKDM } from "../codecs/kdm.ts";
+import { ICrypto, IMessageHead } from "../types.ts";
+import { ValStat } from "../valstat.ts";
+import { type PDK } from "./derivation.ts";
+import { Enclave } from "./enclave.ts";
+export interface IExportMsg {
+    head: IMessageHead;
+    body?: Uint8Array;
+}
+export interface IExportRealm {
+    realm: IKDM;
+    msgs: IExportMsg[];
+}
+export declare namespace Exim {
+    const defaultFileExtension = "dpl";
+    function exportNonce(file: Uint8Array): ValStat<Uint8Array>;
+    function sealExport(realms: Iterable<IExportRealm>, crypto: ICrypto, key: PDK["Export"], nonce: Uint8Array): Promise<ValStat<Uint8Array>>;
+    function exportFile(enclave: Enclave, crypto: ICrypto, realms: Iterable<IExportRealm>): Promise<ValStat<Uint8Array>>;
+    function encodeFile(realms: Iterable<IExportRealm>, crypto: ICrypto, key: PDK["Export"], nonce: Uint8Array): Promise<ValStat<Uint8Array>>;
+    function decodeFile(file: Uint8Array, crypto: ICrypto, key: PDK["Export"]): Promise<ValStat<IExportRealm[]>>;
+    function migrateFile(file: Uint8Array, crypto: ICrypto, keyIn: PDK["Export"], keyOut: PDK["Export"], nonce: Uint8Array, transform: (realms: Iterable<IExportRealm>) => Iterable<IExportRealm> | Promise<Iterable<IExportRealm>>): Promise<ValStat<Uint8Array>>;
+}

package/dist/web/shared/crypto/export.d.ts

@@ -0,0 +1,5 @@
+import type { IKDM } from "../codecs/kdm.ts";
+import { type ValStat } from "../valstat.ts";
+import { BagManager } from "./bagman.ts";
+import { type PDK } from "./derivation.ts";
+export declare function bagmanForExport(key: PDK["Export"], realmKDM: IKDM): Promise<ValStat<BagManager>>;

package/dist/web/shared/crypto/tty.d.ts

@@ -1,3 +1,3 @@
 import { Status } from "../consts.ts";
 import { type ValStat } from "../valstat.ts";
-export declare function dumpToTty(seed: Uint8Array, fingerprint: () => Promise<ValStat<Uint8Array>>): Promise<Status>;
+export declare function dumpToTTY(seed: Uint8Array, fingerprint: () => Promise<ValStat<Uint8Array>>): Promise<Status>;

package/dist/web/shared/endpoint.d.ts

@@ -2,21 +2,20 @@ import { IClock } from "./clock.ts";
 import { Decoder, Encoder } from "./codec.ts";
 import { IAuthTimestamp } from "./codecs/authTimestamp.ts";
 import { Status } from "./consts.ts";
-import { Enclave, type Identity } from "./crypto/enclave.ts";
+import type { BagManager } from "./crypto/bagman.ts";
 import { ICrypto, IProtoHost } from "./types.ts";
 import { ValStat } from "./valstat.ts";
 interface IProtoClient {
     crypto: ICrypto;
-    enclave: Enclave;
     clock: IClock;
 }
 export interface IAuthenticatedEndpoint<ReqInput, Resp> {
-    encodeReq(client: IProtoClient, identity: Identity, authTS: IAuthTimestamp, body: ReqInput, reqEnc: Encoder): Promise<Status>;
+    encodeReq(client: IProtoClient, identity: BagManager, authTS: IAuthTimestamp, body: ReqInput, reqEnc: Encoder): Promise<Status>;
     handleReq(host: IProtoHost, reqDec: Decoder, respEnc: Encoder): Promise<Status>;
     decodeResp(respDec: Decoder): ValStat<Resp>;
 }
 export interface IAuthData {
-    identity: Identity;
+    identity: BagManager;
     authTS: IAuthTimestamp;
 }
 export {};

package/dist/web/shared/sync.d.ts

@@ -1,11 +1,9 @@
 import { IBagPeekItem } from "./codecs/peekItem.ts";
-import type { IKDM } from "./codecs/kdm.ts";
-import { type HostRlm } from "./crypto/derivation.ts";
-import { Enclave } from "./crypto/enclave.ts";
+import { BagManager } from "./crypto/bagman.ts";
 import { ICrypto } from "./types.ts";
 import { ValStat } from "./valstat.ts";
 export interface IDecryptedBagPeekItem {
     kdm: Uint8Array;
     headEnc: Uint8Array;
 }
-export declare function decryptPeekItem(item: IBagPeekItem, verifyKey: CryptoKey, enclave: Enclave, crypto: ICrypto, rlm: HostRlm, realm?: IKDM): Promise<ValStat<IDecryptedBagPeekItem>>;
+export declare function decryptPeekItem(item: IBagPeekItem, verifyKey: CryptoKey, bagMgr: BagManager, crypto: ICrypto): Promise<ValStat<IDecryptedBagPeekItem>>;

package/dist/web/shared/types.d.ts

@@ -151,11 +151,6 @@ export interface ICrypto extends IHostCrypto {
     signEd25519: (message: Uint8Array | string, secKey: PrivateKey) => Promise<Uint8Array>;
     blake3: (data: Uint8Array, opts?: Blake3Opts) => Promise<Hash>;
 }
-export interface IMsgpackCodec {
-    encode: (source: unknown) => Uint8Array;
-    decode: (packed: ArrayBuffer | Uint8Array) => unknown;
-    decodeAsync: (stream: ReadableStream<Uint8Array>) => Promise<unknown>;
-}
 export interface IProtoHost {
     storage: IStorage;
     crypto: IHostCrypto;

package/dist/web/state.d.ts

@@ -1,8 +1,7 @@
 import { Status } from "./shared/consts";
-import { EntityID, IMessage, IMsgEntBody, IOp, IStateManager } from "./shared/types";
+import { EntityID, IMessage, IOp, IStateManager } from "./shared/types";
 import { ValStat } from "./shared/valstat";
 import type { Applier } from "./types";
-export declare function isMsgEntBody(bodDec: unknown): bodDec is IMsgEntBody;
 export declare function msgToOp(msg: IMessage): ValStat<IOp>;
 type PeerIngestFn = (eids: Iterable<EntityID>) => Promise<void>;
 export declare class StateManager implements IStateManager {

package/dist/web/sync.d.ts

@@ -1,7 +1,7 @@
 import DiplomaticClientAPI from "./shared/client";
-import type { IKDM } from "./shared/codecs/kdm";
+import { type IKDM } from "./shared/codecs/kdm";
 import { Status } from "./shared/consts";
-import { Enclave } from "./shared/crypto/enclave";
+import type { BagManager } from "./shared/crypto/bagman";
 import { Hash, HostHandle, IBag, ICrypto } from "./shared/types";
 import { ValStat } from "./shared/valstat";
 import { ProgressFn } from "./progress";
@@ -21,11 +21,10 @@ export type IPulled = {
     bodyCph?: Uint8Array;
 };
 /** Host connection methods used by sync phases. */
-export type SyncConn<Handle extends HostHandle> = Pick<DiplomaticClientAPI<Handle>, "pull" | "push" | "peek" | "seal" | "identity" | "hostRlm">;
+export type SyncConn<Handle extends HostHandle> = Pick<DiplomaticClientAPI<Handle>, "pull" | "push" | "peek" | "seal" | "identity" | "hostRlm" | "bagMgrFor" | "bagMgrs">;
 export interface ISyncParams<Handle extends HostHandle> {
     conn: SyncConn<Handle>;
     store: IStore<Handle>;
-    enclave: Enclave;
     host: IHostRow<Handle>;
     crypto: ICrypto;
     /** Soft max sealed-bag bytes per push request. Oversized bags go alone. */
@@ -57,14 +56,14 @@ export type IOpened = {
  * Bad bags are dequeued and skipped (not retry-able).
  * Does not exec or push.
  */
-export declare function openPulled<Handle extends HostHandle>(store: IStore<Handle>, enclave: Enclave, crypto: ICrypto, items: IPulled[]): Promise<ValStat<IOpened>>;
+export declare function openPulled<Handle extends HostHandle>(store: IStore<Handle>, bagMgrs: readonly BagManager[], crypto: ICrypto, items: IPulled[]): Promise<ValStat<IOpened>>;
 /**
  * Drop download-queue rows whose head matches archive keys we just stored
  * (import / local apply). One list() + batched deq — not per-row messages.has.
  */
 export declare function deqDownloadsForHeadHashes<Handle extends HostHandle>(store: Pick<IStore<Handle>, "downloads">, hashes: Iterable<Hash>, crypto: ICrypto): Promise<void>;
 /** Discover unseen bags and enqueue download work; advance host lastSeq. */
-export declare function syncPeek<Handle extends HostHandle>({ conn, store, enclave, host, crypto, onProgress, peekProgressEvery, peekConcurrency, realm: realmArg, }: ISyncParams<Handle>): Promise<Status>;
+export declare function syncPeek<Handle extends HostHandle>({ conn, store, host, crypto, onProgress, peekProgressEvery, peekConcurrency, realm: realmArg, }: ISyncParams<Handle>): Promise<Status>;
 /** Seal and upload pending msgs; list once so concurrent enqs wait for next sync. */
 export declare function syncPush<Handle extends HostHandle>({ conn, store, host, maxPushBytes, onProgress }: ISyncParams<Handle>): Promise<Status>;
 /**
@@ -76,7 +75,7 @@ export declare function syncPush<Handle extends HostHandle>({ conn, store, host,
  * All bags are still pulled/opened; EntDB LWW already ignores obsolete ops.
  * Newest-first exec reaches final app state early in a large catch-up.
  */
-export declare function syncPull<Handle extends HostHandle>({ conn, store, enclave, host, crypto, maxPullBytes, onProgress, }: ISyncParams<Handle>, 
+export declare function syncPull<Handle extends HostHandle>({ conn, store, host, crypto, maxPullBytes, onProgress, }: ISyncParams<Handle>, 
 /** After each opened pull batch (e.g. drainApplyQueue / exec). */
 afterOpen?: () => Promise<void>): Promise<Status>;
 export declare function msg2StoredMsgData({ head, body }: IMsgParts, realm?: IKDM): IStoredMessageWrite;
@@ -84,7 +83,7 @@ export declare function msg2StoredMsgData({ head, body }: IMsgParts, realm?: IKD
  * notif → open inline bodies into archive; enq incomplete → scheduleSync.
  * `scheduleSync` runs full peek/push/pull (or worker handoff).
  */
-export declare function handleNotif<Handle extends HostHandle>(bytes: Uint8Array, { conn, store, enclave, host, crypto, onProgress, }: ISyncParams<Handle>, scheduleSync: () => void): Promise<void>;
+export declare function handleNotif<Handle extends HostHandle>(bytes: Uint8Array, { conn, store, host, crypto, onProgress, }: ISyncParams<Handle>, scheduleSync: () => void): Promise<void>;
 /**
  * Full host inventory (PEEK from seq 0 in each realm): set that realm's cursor;
  * optionally enqueue downloads (msgs on host missing locally) and/or uploads

package/dist/web/types.d.ts

@@ -2,6 +2,7 @@ import type { SyncProgressEvent } from "./progress";
 import type { IKDM } from "./shared/codecs/kdm";
 import { Status } from "./shared/consts";
 import type { Enclave } from "./shared/crypto/enclave";
+import type { IBlobUpdate, IBlobWrite } from "./shared/blobs";
 import type { EncodedMessage } from "./shared/message";
 import type { EntityID, Hash, HostHandle, IDeleteParams, IEntRev, IHostConnectionInfo, IHostMetadata, IInsertParams, IMessageHead, IOp, IUpdateParams, SerializedContent } from "./shared/types";
 import { ValStat } from "./shared/valstat";
@@ -339,12 +340,16 @@ export interface IClient<Handle extends HostHandle> {
     disconnect(): Promise<void>;
     insertRaw(content: SerializedContent, typ?: string): Promise<ValStat<IMessageHead>>;
     updateRaw(prior: IEntRev, content: SerializedContent | undefined, force?: boolean, typ?: string): Promise<ValStat<IMessageHead>>;
-    insert<T = unknown>(op: IInsertParams<T>): Promise<ValStat<IMessageHead>>;
-    update<T = unknown>(op: IUpdateParams<T>): Promise<ValStat<IMessageHead>>;
+    insert(op: IInsertParams<Uint8Array>): Promise<ValStat<IMessageHead>>;
+    update(op: IUpdateParams<Uint8Array>): Promise<ValStat<IMessageHead>>;
     /**
      * Delete by `{ prior }` (preferred) or `{ eid }` (archive lookup).
      */
     delete(op: IDeleteParams): Promise<ValStat<IMessageHead>>;
+    insertBlob(mime: string, bytes: Uint8Array, opts?: IBlobWrite): Promise<ValStat<IMessageHead>>;
+    updateBlob(eid: EntityID, bytes: Uint8Array, opts?: IBlobUpdate): Promise<ValStat<IMessageHead>>;
+    deleteBlob(eid: EntityID): Promise<ValStat<IMessageHead>>;
+    readBlob(eid: EntityID): Promise<ValStat<Uint8Array>>;
     /** Allocate an entity id (optional 8-byte id material; else random). */
     genEID(id?: Uint8Array): Promise<ValStat<EntityID>>;
     sync(): Promise<Status>;

package/dist/web/worker/client.d.ts

@@ -30,6 +30,10 @@ export declare class WorkerClient implements IClient<URL> {
     private store;
     /** Main-thread writer: msg archive + local apply for fast UI. */
     private local;
+    insertBlob: IClient<URL>["insertBlob"];
+    updateBlob: IClient<URL>["updateBlob"];
+    deleteBlob: IClient<URL>["deleteBlob"];
+    readBlob: IClient<URL>["readBlob"];
     private nextId;
     private pending;
     /** Max wait for setSeed worker handshake. */
@@ -88,8 +92,8 @@ export declare class WorkerClient implements IClient<URL> {
     /** Local UI write on main (cache notifies in apply's sync prefix); sync via worker. */
     insertRaw(content: SerializedContent, typ?: string): Promise<ValStat<IMessageHead>>;
     updateRaw(prior: IEntRev, content: SerializedContent | undefined, force?: boolean, typ?: string): Promise<ValStat<IMessageHead>>;
-    insert<T = unknown>(op: IInsertParams<T>): Promise<ValStat<IMessageHead>>;
-    update<T = unknown>(op: IUpdateParams<T>): Promise<ValStat<IMessageHead>>;
+    insert(op: IInsertParams<Uint8Array>): Promise<ValStat<IMessageHead>>;
+    update(op: IUpdateParams<Uint8Array>): Promise<ValStat<IMessageHead>>;
     delete(op: IDeleteParams): Promise<ValStat<IMessageHead>>;
     genEID(id?: Uint8Array): Promise<ValStat<EntityID>>;
     sync(): Promise<Status>;