@interncom/diplomatic 0.6.3 → 0.7.0

package/dist/web/shared/auth.d.ts

@@ -1,8 +1,9 @@
 import { IClock } from "./clock.ts";
 import { type IAuthTimestamp } from "./codecs/authTimestamp.ts";
 import { Status } from "./consts.ts";
-import type { ICrypto, IHostCrypto, KeyPair } from "./types.ts";
+import type { Identity } from "./crypto/enclave.ts";
+import type { IHostCrypto } from "./types.ts";
 import { ValStat } from "./valstat.ts";
 export type EncodedAuthTimestamp = Uint8Array;
-export declare function makeAuthTimestamp(keys: KeyPair, ts: Date, crypto: ICrypto): Promise<ValStat<IAuthTimestamp>>;
+export declare function makeAuthTimestamp(identity: Pick<Identity, "publicKey" | "sign">, ts: Date): Promise<ValStat<IAuthTimestamp>>;
 export declare function validateAuthTimestamp(authTS: IAuthTimestamp, crypto: IHostCrypto, clock: IClock): Promise<Status>;

package/dist/web/shared/bag.d.ts

@@ -1,17 +1,16 @@
 import { IMessageHead } from "./codecs/messageHead.ts";
-import { Enclave } from "./enclave.ts";
+import { type DecryptCipher, Enclave, type Identity } from "./crypto/enclave.ts";
 import { EncodedMessage } from "./message.ts";
 import { type ValStat } from "./valstat.ts";
-import type { Hash, HostSpecificKeyPair, IBag, ICrypto, IHostCrypto, IMessage, IMessageWithHash, PublicKey } from "./types.ts";
+import type { Hash, IBag, ICrypto, IHostCrypto, IMessage, IMessageWithHash, PublicKey } from "./types.ts";
 export declare function bagSigValid(bag: IBag, pubKey: PublicKey, crypto: IHostCrypto): Promise<boolean>;
-export declare function kdmFor(msgHeadEnc: Uint8Array, keys: HostSpecificKeyPair, crypto: ICrypto): Promise<Uint8Array>;
-export declare function sealBag(msg: IMessage, keys: HostSpecificKeyPair, crypto: ICrypto, enclave: Enclave): Promise<ValStat<IBag>>;
+export declare function sealBag(msg: IMessage, identity: Identity, crypto: ICrypto, enclave: Enclave): Promise<ValStat<IBag>>;
 export interface IOpenBag {
     msgHead: IMessageHead;
     bod?: EncodedMessage;
     headHash: Hash;
 }
-export declare function openBagBody(headEnc: Uint8Array, bodyCph: Uint8Array | undefined, key: Uint8Array, crypto: ICrypto, 
+export declare function openBagBody(headEnc: Uint8Array, bodyCph: Uint8Array | undefined, cipher: DecryptCipher, crypto: ICrypto, 
 /** When set (e.g. from peek), skip blake3(headEnc). */
 headHashKnown?: Hash): Promise<ValStat<IOpenBag>>;
 export declare function openBag(bag: IBag, pubKey: PublicKey, crypto: ICrypto, enclave: Enclave): Promise<ValStat<IMessageWithHash>>;

package/dist/web/shared/client.d.ts

@@ -1,7 +1,7 @@
 import { IClock } from "./clock.ts";
 import { Status } from "./consts.ts";
-import { Enclave } from "./enclave.ts";
-import type { HostHandle, HostSpecificKeyPair, IBag, ICrypto, IHostConnectionInfo, IHostMetadata, IMessage, ITransport, PushReceiver } from "./types.ts";
+import { Enclave, type Identity } from "./crypto/enclave.ts";
+import type { HostHandle, IBag, ICrypto, IHostConnectionInfo, IHostMetadata, IMessage, ITransport, PushReceiver } from "./types.ts";
 import { ValStat } from "./valstat.ts";
 export default class DiplomaticClientAPI<Handle extends HostHandle> {
     enclave: Enclave;
@@ -12,7 +12,7 @@ export default class DiplomaticClientAPI<Handle extends HostHandle> {
     private updateHostMeta;
     constructor(enclave: Enclave, crypto: ICrypto, host: IHostConnectionInfo<Handle>, clock: IClock, transport: ITransport, updateHostMeta: (meta: IHostMetadata) => Promise<Status>);
     private call;
-    keys: () => Promise<HostSpecificKeyPair>;
+    identity: () => Promise<Identity>;
     seal: (msg: IMessage) => Promise<ValStat<IBag>>;
     register: () => Promise<ValStat<void>>;
     peek: (lastSeq: number) => Promise<ValStat<import("./codecs/peekItem.ts").IBagPeekItem[]>>;

package/dist/web/shared/crypto/enclave.d.ts

@@ -0,0 +1,42 @@
+import type { ICrypto, MasterSeed, PublicKey } from "../types.ts";
+export type EncryptCipher = {
+    encrypt: (data: Uint8Array) => Promise<Uint8Array>;
+};
+export type DecryptCipher = {
+    decrypt: (data: Uint8Array) => Promise<Uint8Array>;
+};
+/** Encrypt + decrypt capability for one KDM. */
+export type DerivedCipher = EncryptCipher & DecryptCipher;
+/** Which ops the caller needs; only those methods are present on the handle. */
+export type CipherUsage = "encrypt" | "decrypt" | "both";
+/** Return shape of `deriveCipher` for a given usage (type-level enforcement). */
+export type CipherForUsage<U extends CipherUsage> = {
+    encrypt: EncryptCipher;
+    decrypt: DecryptCipher;
+    both: DerivedCipher;
+}[U];
+/**
+ * Path-scoped signing identity: public key is public; sign/kdmFor re-enter
+ * the enclave so the private key never leaves. Used for hosts, export files, etc.
+ */
+export type Identity = {
+    readonly publicKey: PublicKey;
+    sign: (message: Uint8Array | string) => Promise<Uint8Array>;
+    /** Per-bag KDM mixed with this identity's private key (see bag seal). */
+    kdmFor: (msgHeadEnc: Uint8Array) => Promise<Uint8Array>;
+};
+export declare class Enclave {
+    #private;
+    constructor(seed: MasterSeed, crypto: ICrypto);
+    /**
+     * Cipher for public KDM. Does not hold key bytes; each op re-enters the
+     * enclave (async, hardware-shaped). `usage` selects the return shape:
+     * `"encrypt"` → `{ encrypt }`, `"decrypt"` → `{ decrypt }`, `"both"` → both.
+     */
+    deriveCipher<U extends CipherUsage>(kdm: Uint8Array, usage: U): CipherForUsage<U>;
+    /**
+     * Path-scoped identity (label+index). Private key stays in the enclave; only
+     * publicKey and capability methods are returned (frozen).
+     */
+    deriveIdentity(keyPath: string, idx?: number): Promise<Identity>;
+}

package/dist/web/shared/endpoint.d.ts

@@ -2,8 +2,8 @@ import { IClock } from "./clock.ts";
 import { Decoder, Encoder } from "./codec.ts";
 import { IAuthTimestamp } from "./codecs/authTimestamp.ts";
 import { Status } from "./consts.ts";
-import { Enclave } from "./enclave.ts";
-import { HostSpecificKeyPair, ICrypto, IProtoHost } from "./types.ts";
+import { Enclave, type Identity } from "./crypto/enclave.ts";
+import { ICrypto, IProtoHost } from "./types.ts";
 import { ValStat } from "./valstat.ts";
 interface IProtoClient {
     crypto: ICrypto;
@@ -11,13 +11,12 @@ interface IProtoClient {
     clock: IClock;
 }
 export interface IAuthenticatedEndpoint<ReqItem, Resp> {
-    encodeReq(client: IProtoClient, keys: HostSpecificKeyPair, authTS: IAuthTimestamp, body: Iterable<ReqItem>, reqEnc: Encoder): Promise<Status>;
+    encodeReq(client: IProtoClient, identity: Identity, authTS: IAuthTimestamp, body: Iterable<ReqItem>, reqEnc: Encoder): Promise<Status>;
     handleReq(host: IProtoHost, reqDec: Decoder, respEnc: Encoder): Promise<Status>;
     decodeResp(respDec: Decoder): ValStat<Resp>;
 }
 export interface IAuthData {
-    keys: HostSpecificKeyPair;
+    identity: Identity;
     authTS: IAuthTimestamp;
 }
-export declare function hostKeys(host: IProtoClient, keyPath: string, idx?: number): Promise<HostSpecificKeyPair>;
 export {};

package/dist/web/shared/exim.d.ts

@@ -1,4 +1,4 @@
-import { Enclave } from "./enclave.ts";
+import { Enclave } from "./crypto/enclave.ts";
 import { ICrypto, IMessageHead } from "./types.ts";
 import { ValStat } from "./valstat.ts";
 export declare const defaultFileExtension = "dpl";

package/dist/web/shared/sync.d.ts

@@ -1,9 +1,9 @@
 import { IBagPeekItem } from "./codecs/peekItem.ts";
-import { Enclave } from "./enclave.ts";
-import { HostSpecificKeyPair, ICrypto } from "./types.ts";
+import { Enclave } from "./crypto/enclave.ts";
+import { ICrypto, PublicKey } from "./types.ts";
 import { ValStat } from "./valstat.ts";
 export interface IDecryptedBagPeekItem {
     kdm: Uint8Array;
     headEnc: Uint8Array;
 }
-export declare function decryptPeekItem(item: IBagPeekItem, hostKeys: HostSpecificKeyPair, enclave: Enclave, crypto: ICrypto): Promise<ValStat<IDecryptedBagPeekItem>>;
+export declare function decryptPeekItem(item: IBagPeekItem, pubKey: PublicKey, enclave: Enclave, crypto: ICrypto): Promise<ValStat<IDecryptedBagPeekItem>>;

package/dist/web/shared/types.d.ts

@@ -14,6 +14,12 @@ export type SerializedContent = Uint8Array;
 export interface IMsgEntBody<T = unknown> {
     gid?: GroupID;
     pid?: EntityID;
+    /**
+     * Optional multi-value tags for reverse multi-ref / label lookup (multiEntry-indexed).
+     * Opaque strings; entDB does not parse semantics. Empty strings and duplicates are
+     * dropped on apply. Omit or [] means no tags.
+     */
+    tags?: string[];
     type: string;
     body?: T;
 }

package/dist/web/stores/idb/seed.d.ts

@@ -1,4 +1,4 @@
-import { Enclave } from "../../shared/enclave";
+import { Enclave } from "../../shared/crypto/enclave";
 import { MasterSeed } from "../../shared/types";
 import { ISeedStore } from "../../types";
 export declare class IDBSeedStore implements ISeedStore {

package/dist/web/stores/memory/seed.d.ts

@@ -1,4 +1,4 @@
-import { Enclave } from "../../shared/enclave";
+import { Enclave } from "../../shared/crypto/enclave";
 import { MasterSeed } from "../../shared/types";
 import { ISeedStore } from "../../types";
 export declare class MemorySeedStore implements ISeedStore {

package/dist/web/sync.d.ts

@@ -1,6 +1,6 @@
 import DiplomaticClientAPI from "./shared/client";
 import { Status } from "./shared/consts";
-import { Enclave } from "./shared/enclave";
+import { Enclave } from "./shared/crypto/enclave";
 import { Hash, HostHandle, IBag, ICrypto } from "./shared/types";
 import { ValStat } from "./shared/valstat";
 import { ProgressFn } from "./progress";
@@ -20,7 +20,7 @@ export type IPulled = {
     bodyCph?: Uint8Array;
 };
 /** Host connection methods used by sync phases. */
-export type SyncConn<Handle extends HostHandle> = Pick<DiplomaticClientAPI<Handle>, "pull" | "push" | "peek" | "seal" | "keys">;
+export type SyncConn<Handle extends HostHandle> = Pick<DiplomaticClientAPI<Handle>, "pull" | "push" | "peek" | "seal" | "identity">;
 export interface ISyncParams<Handle extends HostHandle> {
     conn: SyncConn<Handle>;
     store: IStore<Handle>;

package/dist/web/types.d.ts

@@ -1,6 +1,6 @@
 import type { SyncProgressEvent } from "./progress";
 import { Status } from "./shared/consts";
-import type { Enclave } from "./shared/enclave";
+import type { Enclave } from "./shared/crypto/enclave";
 import type { EncodedMessage } from "./shared/message";
 import type { EntityID, Hash, HostHandle, IDeleteParams, IEntRev, IHostConnectionInfo, IHostMetadata, IInsertParams, IMessageHead, IOp, IUpdateParams, MasterSeed, SerializedContent } from "./shared/types";
 import { ValStat } from "./shared/valstat";