@interocitor/core 0.0.0-beta.2

package/dist/storage/credential-store.js

@@ -0,0 +1,309 @@
+/**
+ * Credential Store — pluggable persistence for key material.
+ *
+ * Safari ITP wipes localStorage after 7 days of inactivity.
+ * That kills the passphrase and device ID. Lost key = lost data.
+ *
+ * This module provides:
+ *  - `LocalStorageCredentialStore` — current behaviour, extracted.
+ *  - `WebAuthnCredentialStore`    — OS keychain via navigator.credentials + largeBlob.
+ *  - `createCredentialStore()`    — auto-detects best backend.
+ *
+ * The engine uses `CredentialStore` for all key material persistence.
+ * Apps never touch this directly unless they want a custom backend.
+ */
+// ─── localStorage backend ────────────────────────────────────────────
+export class LocalStorageCredentialStore {
+    constructor(dbName) {
+        this.dbName = dbName;
+    }
+    keyKey() { return `interocitor-key:${this.dbName}`; }
+    get deviceKey() { return 'interocitor-device-id'; }
+    async save(creds) {
+        localStorage.setItem(this.keyKey(), creds.passphrase);
+        localStorage.setItem(this.deviceKey, creds.deviceId);
+    }
+    async load() {
+        const passphrase = localStorage.getItem(this.keyKey());
+        const deviceId = localStorage.getItem(this.deviceKey);
+        if (!passphrase || !deviceId)
+            return null;
+        return { passphrase, deviceId };
+    }
+    async clear() {
+        localStorage.removeItem(this.keyKey());
+        // Device ID intentionally kept — shared across meshes, survives credential clear.
+    }
+}
+// ─── WebAuthn + largeBlob backend ────────────────────────────────────
+/**
+ * Stores credentials in the OS keychain via WebAuthn `largeBlob` extension.
+ *
+ * Survives Safari ITP, browser data clears, and profile resets.
+ * Requires a platform authenticator with largeBlob support (Touch ID,
+ * Face ID, Windows Hello). Falls back gracefully — `save()` rejects
+ * if the authenticator doesn't support largeBlob.
+ *
+ * Flow:
+ *  1. `save()` → `navigator.credentials.create()` with largeBlob write.
+ *     User sees a biometric prompt. Credential ID stored in localStorage
+ *     as a hint for faster `load()`, but not required.
+ *  2. `load()` → `navigator.credentials.get()` with largeBlob read.
+ *     User sees a biometric prompt. Returns the blob.
+ *  3. If localStorage hint is gone (ITP wipe), load uses an empty
+ *     allowCredentials list — the authenticator picks the right one.
+ */
+export class WebAuthnCredentialStore {
+    constructor(dbName, rpId = globalThis.location?.hostname ?? 'localhost', 
+    /** Human-readable app name shown in biometric prompts and OS keychain. */
+    displayName = 'Interocitor') {
+        this.dbName = dbName;
+        this.rpId = rpId;
+        this.displayName = displayName;
+        this.encoder = new TextEncoder();
+        this.decoder = new TextDecoder();
+    }
+    credIdKey() {
+        return `${WebAuthnCredentialStore.CRED_ID_KEY_PREFIX}${this.dbName}`;
+    }
+    encode(creds) {
+        return this.encoder.encode(JSON.stringify(creds));
+    }
+    decode(blob) {
+        return JSON.parse(this.decoder.decode(blob));
+    }
+    /** Read credential ID hint from localStorage (best-effort, survives only if ITP hasn't wiped). */
+    loadCredentialIdHint() {
+        try {
+            const stored = localStorage.getItem(this.credIdKey());
+            if (!stored)
+                return null;
+            const raw = Uint8Array.from(atob(stored), c => c.charCodeAt(0));
+            return raw.buffer;
+        }
+        catch {
+            return null;
+        }
+    }
+    saveCredentialIdHint(rawId) {
+        try {
+            const bytes = new Uint8Array(rawId);
+            let binary = '';
+            for (let i = 0; i < bytes.length; i++)
+                binary += String.fromCharCode(bytes[i]);
+            const b64 = btoa(binary);
+            localStorage.setItem(this.credIdKey(), b64);
+        }
+        catch { /* best-effort */ }
+    }
+    async save(creds) {
+        const blob = this.encode(creds);
+        const challenge = crypto.getRandomValues(new Uint8Array(32));
+        const userId = crypto.getRandomValues(new Uint8Array(16));
+        const credential = await navigator.credentials.create({
+            publicKey: {
+                rp: { name: this.displayName, id: this.rpId },
+                user: {
+                    id: userId,
+                    name: `${this.displayName.toLowerCase().replaceAll(/\s+/g, '-')}:${this.dbName}`,
+                    displayName: this.displayName,
+                },
+                challenge,
+                pubKeyCredParams: [
+                    { type: 'public-key', alg: -7 }, // ES256
+                    { type: 'public-key', alg: -257 }, // RS256
+                ],
+                authenticatorSelection: {
+                    authenticatorAttachment: 'platform',
+                    residentKey: 'required',
+                    userVerification: 'required',
+                },
+                extensions: {
+                    largeBlob: { support: 'required' },
+                },
+            },
+        });
+        if (!credential)
+            throw new Error('WebAuthn credential creation cancelled');
+        // Write the blob in a separate get() call — largeBlob write requires
+        // an assertion, not registration, on most platforms.
+        this.saveCredentialIdHint(credential.rawId);
+        await this.writeLargeBlob(credential.rawId, blob);
+    }
+    async writeLargeBlob(credentialId, blob) {
+        const challenge = crypto.getRandomValues(new Uint8Array(32));
+        const assertion = await navigator.credentials.get({
+            publicKey: {
+                challenge,
+                rpId: this.rpId,
+                allowCredentials: [{
+                        type: 'public-key',
+                        id: credentialId,
+                    }],
+                userVerification: 'required',
+                extensions: {
+                    largeBlob: { write: blob },
+                },
+            },
+        });
+        if (!assertion)
+            throw new Error('WebAuthn assertion cancelled');
+        const results = assertion.getClientExtensionResults?.();
+        if (!results?.largeBlob?.written) {
+            throw new Error('largeBlob write failed — authenticator may not support it');
+        }
+    }
+    async load() {
+        const challenge = crypto.getRandomValues(new Uint8Array(32));
+        const credentialIdHint = this.loadCredentialIdHint();
+        const assertion = await navigator.credentials.get({
+            publicKey: {
+                challenge,
+                rpId: this.rpId,
+                // If we have the hint, scope to it. Otherwise let the authenticator
+                // show all resident credentials for this RP (discoverable flow).
+                allowCredentials: credentialIdHint
+                    ? [{ type: 'public-key', id: credentialIdHint }]
+                    : [],
+                userVerification: 'required',
+                extensions: {
+                    largeBlob: { read: true },
+                },
+            },
+        });
+        if (!assertion)
+            return null;
+        const results = assertion.getClientExtensionResults?.();
+        const blob = results?.largeBlob?.blob;
+        if (!blob)
+            return null;
+        // Got credentials back — re-save the hint in case localStorage was wiped.
+        this.saveCredentialIdHint(assertion.rawId);
+        return this.decode(blob);
+    }
+    async clear() {
+        // Can't programmatically delete WebAuthn credentials.
+        // Remove the localStorage hint; the credential stays in the keychain
+        // but won't be found without the hint (or user manually picks it).
+        try {
+            localStorage.removeItem(this.credIdKey());
+        }
+        catch { /* ok */ }
+    }
+}
+WebAuthnCredentialStore.CRED_ID_KEY_PREFIX = 'interocitor-cred:';
+// ─── Auto-detection ──────────────────────────────────────────────────
+/** Check if WebAuthn with largeBlob is likely available. */
+async function isWebAuthnLargeBlobAvailable() {
+    if (globalThis.PublicKeyCredential === undefined)
+        return false;
+    try {
+        // Check platform authenticator availability
+        const available = await PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
+        if (!available)
+            return false;
+        // No standard way to check largeBlob support without creating a credential.
+        // We rely on the 'required' support flag during create() to fail fast.
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Create the best available credential store.
+ *
+ * Prefers WebAuthn (survives ITP) when available, falls back to
+ * localStorage. Returns a `FallbackCredentialStore` that tries
+ * WebAuthn first and uses localStorage as backup on every operation.
+ */
+export function createCredentialStore(dbName, displayName) {
+    return new FallbackCredentialStore(dbName, displayName);
+}
+/**
+ * Tries WebAuthn on save/load; falls back to localStorage on failure.
+ *
+ * Save: always writes localStorage (silent). WebAuthn only written via
+ * explicit `secureWithBiometrics()` call — never automatically on first
+ * key generation. This avoids a confusing biometric prompt on first open.
+ *
+ * Load: tries localStorage first (fast). If empty (ITP wipe?), tries
+ * WebAuthn recovery (biometric prompt — user understands why at this point).
+ */
+class FallbackCredentialStore {
+    constructor(dbName, displayName) {
+        this.dbName = dbName;
+        this.displayName = displayName;
+        this.webauthn = null;
+        this.webauthnChecked = false;
+        this.ls = new LocalStorageCredentialStore(dbName);
+    }
+    async getWebAuthn() {
+        if (this.webauthnChecked)
+            return this.webauthn;
+        this.webauthnChecked = true;
+        if (await isWebAuthnLargeBlobAvailable()) {
+            this.webauthn = new WebAuthnCredentialStore(this.dbName, undefined, this.displayName);
+        }
+        return this.webauthn;
+    }
+    async save(creds) {
+        // Save to localStorage only (silent, no prompt).
+        // WebAuthn enrollment happens via secureWithBiometrics().
+        await this.ls.save(creds);
+    }
+    /**
+     * Persist current credentials to the OS keychain via biometrics.
+     * Call this when the user takes an intentional action — after pairing,
+     * after a "Secure my keys" button press, etc. Not on first open.
+     *
+     * Returns true if saved, false if WebAuthn unavailable or user cancelled.
+     */
+    async secureWithBiometrics() {
+        const creds = await this.ls.load();
+        if (!creds)
+            return false;
+        const wa = await this.getWebAuthn();
+        if (!wa)
+            return false;
+        try {
+            await wa.save(creds);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async load() {
+        // Silent primary path only. No biometric prompt here.
+        return this.ls.load();
+    }
+    async restoreWithBiometrics() {
+        const wa = await this.getWebAuthn();
+        if (!wa)
+            return null;
+        try {
+            const restored = await wa.load();
+            if (restored) {
+                // Re-populate localStorage for normal silent opens after restore.
+                await this.ls.save(restored);
+                return restored;
+            }
+        }
+        catch {
+            // unavailable / cancelled / not found
+        }
+        return null;
+    }
+    async clear() {
+        await this.ls.clear();
+        const wa = await this.getWebAuthn();
+        if (wa) {
+            try {
+                await wa.clear();
+            }
+            catch { /* best-effort */ }
+        }
+    }
+}
+//# sourceMappingURL=credential-store.js.map

package/dist/storage/credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../../src/storage/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAkCH,wEAAwE;AAExE,MAAM,OAAO,2BAA2B;IACtC,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAEvC,MAAM,KAAa,OAAO,mBAAmB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrE,IAAY,SAAS,KAAa,OAAO,uBAAuB,CAAC,CAAC,CAAC;IAEnE,KAAK,CAAC,IAAI,CAAC,KAAwB;QACjC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACtD,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACvC,kFAAkF;IACpF,CAAC;CACF;AAED,wEAAwE;AAExE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,uBAAuB;IAKlC,YACmB,MAAc,EACd,OAAe,UAAU,CAAC,QAAQ,EAAE,QAAQ,IAAI,WAAW;IAC5E,0EAA0E;IACzD,cAAsB,aAAa;QAHnC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAuD;QAE3D,gBAAW,GAAX,WAAW,CAAwB;QAPrC,YAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAC5B,YAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAO1C,CAAC;IAEI,SAAS;QACf,OAAO,GAAG,uBAAuB,CAAC,kBAAkB,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IACvE,CAAC;IAEO,MAAM,CAAC,KAAwB;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,CAAC;IAEO,MAAM,CAAC,IAAiB;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,kGAAkG;IAC1F,oBAAoB;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,OAAO,GAAG,CAAC,MAAqB,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,KAAkB;QAC7C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;gBAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAwB;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAE1D,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC;YACpD,SAAS,EAAE;gBACT,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE;gBAC7C,IAAI,EAAE;oBACJ,EAAE,EAAE,MAAM;oBACV,IAAI,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE;oBAChF,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B;gBACD,SAAS;gBACT,gBAAgB,EAAE;oBAChB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAI,QAAQ;oBAC3C,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAG,QAAQ;iBAC7C;gBACD,sBAAsB,EAAE;oBACtB,uBAAuB,EAAE,UAAU;oBACnC,WAAW,EAAE,UAAU;oBACvB,gBAAgB,EAAE,UAAU;iBAC7B;gBACD,UAAU,EAAE;oBACV,SAAS,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE;iBACK;aAC1C;SACF,CAA+B,CAAC;QAEjC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAE3E,qEAAqE;QACrE,qDAAqD;QACrD,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAE5C,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,YAAyB,EAAE,IAAgB;QACtE,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAE7D,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC;YAChD,SAAS,EAAE;gBACT,SAAS;gBACT,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,gBAAgB,EAAE,CAAC;wBACjB,IAAI,EAAE,YAAqB;wBAC3B,EAAE,EAAE,YAAY;qBACjB,CAAC;gBACF,gBAAgB,EAAE,UAAU;gBAC5B,UAAU,EAAE;oBACV,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACa;aAC1C;SACF,CAA+B,CAAC;QAEjC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAEhE,MAAM,OAAO,GAAI,SAAiB,CAAC,yBAAyB,EAAE,EAAS,CAAC;QACxE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,gBAAgB,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAErD,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC;YAChD,SAAS,EAAE;gBACT,SAAS;gBACT,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,oEAAoE;gBACpE,iEAAiE;gBACjE,gBAAgB,EAAE,gBAAgB;oBAChC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC;oBACzD,CAAC,CAAC,EAAE;gBACN,gBAAgB,EAAE,UAAU;gBAC5B,UAAU,EAAE;oBACV,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;iBACc;aAC1C;SACF,CAA+B,CAAC;QAEjC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,MAAM,OAAO,GAAI,SAAiB,CAAC,yBAAyB,EAAE,EAAS,CAAC;QACxE,MAAM,IAAI,GAAG,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,0EAA0E;QAC1E,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAE3C,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,sDAAsD;QACtD,qEAAqE;QACrE,mEAAmE;QACnE,IAAI,CAAC;YAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;IACvE,CAAC;;AAlJuB,0CAAkB,GAAG,mBAAmB,AAAtB,CAAuB;AAqJnE,wEAAwE;AAExE,4DAA4D;AAC5D,KAAK,UAAU,4BAA4B;IACzC,IAAI,UAAU,CAAC,mBAAmB,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,CAAC;QACH,4CAA4C;QAC5C,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,6CAA6C,EAAE,CAAC;QAC5F,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,4EAA4E;QAC5E,uEAAuE;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,WAAoB;IACxE,OAAO,IAAI,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,uBAAuB;IAK3B,YACmB,MAAc,EACd,WAAoB;QADpB,WAAM,GAAN,MAAM,CAAQ;QACd,gBAAW,GAAX,WAAW,CAAS;QAL/B,aAAQ,GAAmC,IAAI,CAAC;QAChD,oBAAe,GAAG,KAAK,CAAC;QAM9B,IAAI,CAAC,EAAE,GAAG,IAAI,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QAC/C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,IAAI,MAAM,4BAA4B,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAwB;QACjC,iDAAiD;QACjD,0DAA0D;QAC1D,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB;QACxB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEzB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAEtB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,sDAAsD;QACtD,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAErB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,QAAQ,EAAE,CAAC;gBACb,kEAAkE;gBAClE,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC7B,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,EAAE,EAAE,CAAC;YACP,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;CACF"}

package/dist/storage/local-store.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Local storage layer — IndexedDB
+ *
+ * This is a cache, not the source of truth.
+ * If cleared, the app rehydrates from cloud.
+ *
+ * Stores:
+ *  - rows: the current merged state of all tables
+ *  - outbox: change entries pending upload
+ *  - cursors: byte offsets into each device's change log
+ *  - meta: device ID, last snapshot epoch, etc.
+ */
+import type { Row, ChangeEntry, LocalStoreAdapter, DatabaseSchemaDefinition, WhereClause } from '../core/types.ts';
+/**
+ * Default IndexedDB-backed local persistence layer used by {@link SyncEngine}.
+ *
+ * Most applications do not need to interact with this class directly unless
+ * they are supplying a custom `localStoreFactory` or swapping local storage at
+ * runtime for testing or advanced integrations.
+ */
+export declare class LocalStore implements LocalStoreAdapter {
+    private db;
+    private readonly dbName;
+    private readonly dbVersion;
+    private readonly schema?;
+    /**
+     * @param dbName    IndexedDB database name. Use distinct names to isolate
+     *                  multiple engine instances on the same origin.
+     *                  Default: "interocitor"
+     * @param dbVersion IndexedDB schema version. Default: 1
+     */
+    constructor(dbName?: string, dbVersion?: number, schema?: DatabaseSchemaDefinition);
+    open(): Promise<void>;
+    close(): void;
+    private ensureDB;
+    private rowKey;
+    getRow(table: string, rowId: string): Promise<Row | undefined>;
+    putRow(row: Row): Promise<void>;
+    putRows(rows: Row[]): Promise<void>;
+    getTable(table: string): Promise<Row[]>;
+    queryWhere(table: string, clause: WhereClause): Promise<Row[]>;
+    getTableNames(): Promise<string[]>;
+    getAllRows(): Promise<Row[]>;
+    clearRows(): Promise<void>;
+    pushOutbox(entry: ChangeEntry): Promise<void>;
+    drainOutbox(): Promise<ChangeEntry[]>;
+    outboxSize(): Promise<number>;
+    getCursor(deviceId: string): Promise<number>;
+    setCursor(deviceId: string, offset: number): Promise<void>;
+    getAllCursors(): Promise<Record<string, number>>;
+    getMeta(key: string): Promise<unknown>;
+    setMeta(key: string, value: unknown): Promise<void>;
+    /** Nuke everything. Used before full rehydration. */
+    clearAll(): Promise<void>;
+}
+//# sourceMappingURL=local-store.d.ts.map

package/dist/storage/local-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-store.d.ts","sourceRoot":"","sources":["../../src/storage/local-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,GAAG,EACH,WAAW,EACX,iBAAiB,EACjB,wBAAwB,EAGxB,WAAW,EAEZ,MAAM,kBAAkB,CAAC;AA0O1B;;;;;;GAMG;AACH,qBAAa,UAAW,YAAW,iBAAiB;IAClD,OAAO,CAAC,EAAE,CAA4B;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA2B;IAEnD;;;;;OAKG;gBACS,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,wBAAwB;IAO5E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,KAAK,IAAI,IAAI;IAKb,OAAO,CAAC,QAAQ;IAOhB,OAAO,CAAC,MAAM;IAIR,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAQ9D,MAAM,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAS/B,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAYnC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IASvC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAgC9D,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAelC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAO5B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAS1B,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAO7C,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAUrC,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAQ7B,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAO5C,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1D,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAehD,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzD,qDAAqD;IAC/C,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAQhC"}