@limrun/ui 0.14.0-rc.5 → 0.14.1

package/src/core/device-install/storage/browser-storage.ts

@@ -1,325 +0,0 @@
-import forge from 'node-forge';
-import type {
-  DeviceInstallSigningMode,
-  ProvisioningProfileInfo,
-  PutSigningAssetsInput,
-  StoredPairRecord,
-  StoredSigningAssets,
-} from '../types';
-import type { PairRecordPayload } from '../types';
-
-const PAIRING_DB_NAME = 'limbuild-device-pairing';
-const PAIRING_DB_VERSION = 1;
-const PAIRING_STORE_NAME = 'pairRecords';
-const SIGNING_DB_NAME = 'limbuild-device-signing';
-const SIGNING_DB_VERSION = 1;
-const SIGNING_STORE_NAME = 'signingAssets';
-
-export function normalizeUDID(udid?: string) {
-  return (udid ?? '').replace(/-/g, '').replace(/[^a-fA-F0-9]/g, '');
-}
-
-export function normalizeBundleID(bundleID?: string) {
-  return (bundleID ?? '').trim();
-}
-
-export async function getPairRecord(udid?: string) {
-  const normalized = normalizeUDID(udid);
-  if (!normalized) return undefined;
-  const db = await openDB(PAIRING_DB_NAME, PAIRING_DB_VERSION, PAIRING_STORE_NAME, 'udid');
-  return requestToPromise<StoredPairRecord | undefined>(
-    db.transaction(PAIRING_STORE_NAME, 'readonly').objectStore(PAIRING_STORE_NAME).get(normalized),
-  );
-}
-
-export async function putPairRecord(record: PairRecordPayload, metadata: { productName?: string } = {}) {
-  const normalized = normalizeUDID(record.udid);
-  if (!normalized) throw new Error('Cannot store pair record without a UDID.');
-  const stored: StoredPairRecord = {
-    ...record,
-    udid: normalized,
-    productName: metadata.productName,
-    updatedAt: new Date().toISOString(),
-  };
-  const db = await openDB(PAIRING_DB_NAME, PAIRING_DB_VERSION, PAIRING_STORE_NAME, 'udid');
-  await requestToPromise(
-    db.transaction(PAIRING_STORE_NAME, 'readwrite').objectStore(PAIRING_STORE_NAME).put(stored),
-  );
-  return stored;
-}
-
-export async function getSigningAssets({
-  deviceUDID,
-  bundleID,
-  signingMode = 'development',
-}: {
-  deviceUDID?: string;
-  bundleID?: string;
-  signingMode?: DeviceInstallSigningMode;
-}) {
-  const normalizedBundleID = normalizeBundleID(bundleID);
-  if (!normalizedBundleID) return undefined;
-  const normalizedUDID = normalizeUDID(deviceUDID);
-  const bundleScoped = await getSigningAssetsByID(signingAssetID('bundle', normalizedBundleID, signingMode));
-  if (bundleScoped) return bundleScoped;
-  if (normalizedUDID) {
-    const exact = await getSigningAssetsByID(signingAssetID(normalizedUDID, normalizedBundleID, signingMode));
-    if (exact) return exact;
-  }
-  const candidates = await findSigningAssetsForBundle(normalizedBundleID, signingMode);
-  return candidates[0];
-}
-
-export async function getLatestSigningAssets(signingMode: DeviceInstallSigningMode = 'development') {
-  const all = await getAllSigningAssets();
-  return all
-    .filter((asset) => (asset.signingMode ?? 'development') === signingMode)
-    .sort((left, right) => new Date(right.updatedAt).getTime() - new Date(left.updatedAt).getTime())[0];
-}
-
-export async function getLatestSigningAssetsWithCertificate(
-  teamID?: string,
-  signingMode: DeviceInstallSigningMode = 'development',
-) {
-  const all = await getAllSigningAssets();
-  return all
-    .filter((asset) => {
-      if (!asset.certificateID || !asset.certificateP12Base64) {
-        return false;
-      }
-      if ((asset.signingMode ?? 'development') !== signingMode) {
-        return false;
-      }
-      return !teamID || !asset.teamID || asset.teamID === teamID;
-    })
-    .sort((left, right) => new Date(right.updatedAt).getTime() - new Date(left.updatedAt).getTime())[0];
-}
-
-export async function putSigningAssets(input: PutSigningAssetsInput) {
-  const normalizedBundleID = normalizeBundleID(input.bundleID);
-  if (!normalizedBundleID) {
-    throw new Error('Cannot store signing assets without a bundle ID.');
-  }
-  const normalizedUDID = normalizeUDID(input.deviceUDID);
-  const signingMode = input.signingMode ?? 'development';
-  const id = signingAssetID('bundle', normalizedBundleID, signingMode);
-  const stored: StoredSigningAssets = {
-    ...input,
-    id,
-    deviceUDID: normalizedUDID || undefined,
-    signingMode,
-    bundleID: normalizedBundleID,
-    updatedAt: new Date().toISOString(),
-  };
-  const db = await openDB(SIGNING_DB_NAME, SIGNING_DB_VERSION, SIGNING_STORE_NAME, 'id');
-  await requestToPromise(
-    db.transaction(SIGNING_STORE_NAME, 'readwrite').objectStore(SIGNING_STORE_NAME).put(stored),
-  );
-  return stored;
-}
-
-export async function findSigningAssetsForBundle(
-  bundleID?: string,
-  signingMode: DeviceInstallSigningMode = 'development',
-) {
-  const normalized = normalizeBundleID(bundleID);
-  if (!normalized) return [];
-  const all = await getAllSigningAssets();
-  return all.filter(
-    (asset) => asset.bundleID === normalized && (asset.signingMode ?? 'development') === signingMode,
-  );
-}
-
-export function profileContainsDevice(profile: ProvisioningProfileInfo, deviceUDID?: string) {
-  const normalized = normalizeUDID(deviceUDID);
-  return !!normalized && profile.provisionedDevices.some((device) => normalizeUDID(device) === normalized);
-}
-
-export function profileMatchesBundleID(profile: ProvisioningProfileInfo, bundleID?: string) {
-  const expected = normalizeBundleID(bundleID);
-  const profileBundleID = normalizeBundleID(profile.bundleID);
-  if (!expected || !profileBundleID) return false;
-  if (profileBundleID === expected) return true;
-  if (profileBundleID === '*') return true;
-  if (!profileBundleID.endsWith('.*')) return false;
-  const prefix = profileBundleID.slice(0, -1);
-  return expected.startsWith(prefix);
-}
-
-export async function parseProvisioningProfile(file: File) {
-  return parseProvisioningProfileBytes(new Uint8Array(await file.arrayBuffer()));
-}
-
-export function parseProvisioningProfileBase64(base64: string) {
-  const binary = atob(base64);
-  const bytes = new Uint8Array(binary.length);
-  for (let index = 0; index < binary.length; index += 1) {
-    bytes[index] = binary.charCodeAt(index);
-  }
-  return parseProvisioningProfileBytes(bytes);
-}
-
-export function parseProvisioningProfileBytes(bytes: Uint8Array) {
-  const text = new TextDecoder('latin1').decode(bytes);
-  const start = text.indexOf('<?xml');
-  const end = text.indexOf('</plist>');
-  if (start < 0 || end < start) {
-    throw new Error('Provisioning profile plist not found.');
-  }
-  const xml = text.slice(start, end + '</plist>'.length);
-  // Defensively reject entity declarations before parsing: they are the vector
-  // for XML entity-expansion (billion-laughs) attacks and never appear in a
-  // real provisioning profile. The standard Apple `<!DOCTYPE plist PUBLIC ...>`
-  // (an external DTD reference with no internal entity subset) is benign —
-  // browsers' DOMParser does not fetch it — so it is intentionally allowed.
-  if (/<!ENTITY/i.test(xml)) {
-    throw new Error('Provisioning profile plist contains a disallowed ENTITY declaration.');
-  }
-  const doc = new DOMParser().parseFromString(xml, 'application/xml');
-  if (doc.querySelector('parsererror')) {
-    throw new Error('Provisioning profile plist could not be parsed.');
-  }
-  const dict = doc.querySelector('plist > dict');
-  if (!dict) {
-    throw new Error('Provisioning profile plist dictionary not found.');
-  }
-  const value = readPlistValue(dict);
-  if (!isRecord(value)) {
-    throw new Error('Provisioning profile plist has an unexpected shape.');
-  }
-  const entitlements = isRecord(value.Entitlements) ? value.Entitlements : {};
-  const applicationIdentifier = stringValue(entitlements['application-identifier']);
-  const bundleID = bundleIDFromApplicationIdentifier(applicationIdentifier);
-  return {
-    name: stringValue(value.Name),
-    uuid: stringValue(value.UUID),
-    teamID:
-      stringValue(entitlements['com.apple.developer.team-identifier']) ??
-      stringArrayValue(value.TeamIdentifier)[0],
-    applicationIdentifier,
-    bundleID,
-    provisionedDevices: stringArrayValue(value.ProvisionedDevices),
-    certificateSerialNumbers: certificateSerialNumbers(stringArrayValue(value.DeveloperCertificates)),
-    getTaskAllow: booleanValue(entitlements['get-task-allow']),
-    expirationDate: stringValue(value.ExpirationDate),
-  } satisfies ProvisioningProfileInfo;
-}
-
-/**
- * Normalizes a certificate serial number for comparison: uppercase hex
- * without leading zeros, the format Apple's portal reports in serialNum.
- */
-export function normalizeCertificateSerial(serial?: string) {
-  const normalized = (serial ?? '').replace(/^0+/, '').toUpperCase();
-  return normalized || undefined;
-}
-
-/**
- * Reads the serial numbers of the DER certificates embedded in a profile's
- * DeveloperCertificates array. Unparseable entries are skipped: a profile
- * with an exotic certificate should degrade to weaker filtering, not fail
- * the whole parse.
- */
-function certificateSerialNumbers(developerCertificatesBase64: string[]) {
-  const serials: string[] = [];
-  for (const entry of developerCertificatesBase64) {
-    try {
-      // Plist <data> payloads wrap base64 across lines; atob rejects whitespace.
-      const der = atob(entry.replace(/\s+/g, ''));
-      const certificate = forge.pki.certificateFromAsn1(forge.asn1.fromDer(forge.util.createBuffer(der)));
-      const serial = normalizeCertificateSerial(certificate.serialNumber);
-      if (serial && !serials.includes(serial)) serials.push(serial);
-    } catch {
-      // Skip certificates forge cannot parse.
-    }
-  }
-  return serials;
-}
-
-async function getSigningAssetsByID(id?: string) {
-  if (!id) return undefined;
-  const db = await openDB(SIGNING_DB_NAME, SIGNING_DB_VERSION, SIGNING_STORE_NAME, 'id');
-  return requestToPromise<StoredSigningAssets | undefined>(
-    db.transaction(SIGNING_STORE_NAME, 'readonly').objectStore(SIGNING_STORE_NAME).get(id),
-  );
-}
-
-async function getAllSigningAssets() {
-  const db = await openDB(SIGNING_DB_NAME, SIGNING_DB_VERSION, SIGNING_STORE_NAME, 'id');
-  return requestToPromise<StoredSigningAssets[]>(
-    db.transaction(SIGNING_STORE_NAME, 'readonly').objectStore(SIGNING_STORE_NAME).getAll(),
-  );
-}
-
-function signingAssetID(deviceUDID: string, bundleID: string, signingMode: DeviceInstallSigningMode) {
-  return `${signingMode}:${deviceUDID}:${bundleID}`;
-}
-
-function bundleIDFromApplicationIdentifier(applicationIdentifier?: string) {
-  if (!applicationIdentifier) return undefined;
-  const dot = applicationIdentifier.indexOf('.');
-  return dot >= 0 ? applicationIdentifier.slice(dot + 1) : undefined;
-}
-
-function readPlistValue(element: Element): unknown {
-  switch (element.tagName) {
-    case 'dict':
-      return readPlistDict(element);
-    case 'array':
-      return Array.from(element.children).map(readPlistValue);
-    case 'string':
-    case 'date':
-      return element.textContent ?? '';
-    default:
-      return element.textContent ?? '';
-  }
-}
-
-function readPlistDict(dict: Element) {
-  const result: Record<string, unknown> = {};
-  const children = Array.from(dict.children);
-  for (let index = 0; index < children.length; index += 2) {
-    const key = children[index];
-    const value = children[index + 1];
-    if (!key || key.tagName !== 'key' || !value) continue;
-    result[key.textContent ?? ''] = readPlistValue(value);
-  }
-  return result;
-}
-
-function stringValue(value: unknown) {
-  return typeof value === 'string' && value ? value : undefined;
-}
-
-function stringArrayValue(value: unknown) {
-  return Array.isArray(value) ? value.filter((item): item is string => typeof item === 'string') : [];
-}
-
-function booleanValue(value: unknown) {
-  return typeof value === 'boolean' ? value : undefined;
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
-function openDB(dbName: string, dbVersion: number, storeName: string, keyPath: string) {
-  return new Promise<IDBDatabase>((resolve, reject) => {
-    const request = indexedDB.open(dbName, dbVersion);
-    request.onupgradeneeded = () => {
-      const db = request.result;
-      if (!db.objectStoreNames.contains(storeName)) {
-        db.createObjectStore(storeName, { keyPath });
-      }
-    };
-    request.onsuccess = () => resolve(request.result);
-    request.onerror = () => reject(request.error ?? new Error('Open IndexedDB failed'));
-  });
-}
-
-function requestToPromise<T = unknown>(request: IDBRequest<T>) {
-  return new Promise<T>((resolve, reject) => {
-    request.onsuccess = () => resolve(request.result);
-    request.onerror = () => reject(request.error ?? new Error('IndexedDB request failed'));
-  });
-}

package/src/core/device-install/storage/index.ts

@@ -1,2 +0,0 @@
-export * from './browser-storage';
-export * from './secret-store';

package/src/core/device-install/storage/secret-store.ts

@@ -1,332 +0,0 @@
-/**
- * A pluggable store for Apple signing secrets.
- *
- * Credential material always lands in the browser first (the Apple relay
- * only proxies); the browser then writes it into a store implementing this
- * interface. Limrun's org secret store is the default implementation, an
- * IndexedDB-backed one keeps everything local, and customers can bring
- * their own store by implementing the same interface.
- */
-
-export const APPLE_CERTIFICATE_SECRET_TYPE = 'appleCertificate';
-export const APPLE_PROVISIONING_PROFILE_SECRET_TYPE = 'appleProvisioningProfile';
-export const APP_STORE_CONNECT_API_KEY_SECRET_TYPE = 'appStoreConnectApiKey';
-
-export type SigningSecretType =
-  | typeof APPLE_CERTIFICATE_SECRET_TYPE
-  | typeof APPLE_PROVISIONING_PROFILE_SECRET_TYPE
-  | typeof APP_STORE_CONNECT_API_KEY_SECRET_TYPE;
-
-export type SigningSecretMetadata = {
-  type: string;
-  name: string;
-  createdAt?: string;
-};
-
-/** Type-specific flat key-value payload of a signing secret. */
-export type SigningSecretData = Record<string, string>;
-
-export type SigningSecret = SigningSecretMetadata & {
-  data: SigningSecretData;
-};
-
-export interface SigningSecretStore {
-  /**
-   * Stores a secret. When a secret with the same type and name already
-   * exists its data is overwritten. Returns the stored secret; callers
-   * should use the returned data.
-   */
-  put(type: SigningSecretType, name: string, data: SigningSecretData): Promise<SigningSecret>;
-  /** Returns the secret including its data, or undefined when absent. */
-  get(type: SigningSecretType, name: string): Promise<SigningSecret | undefined>;
-  /** Lists metadata of all stored signing secrets, never their data. */
-  list(): Promise<SigningSecretMetadata[]>;
-  /** Deletes a secret; resolves even when the secret does not exist. */
-  delete(type: SigningSecretType, name: string): Promise<void>;
-}
-
-/**
- * Apple's certificate types as defined by the App Store Connect API
- * (https://developer.apple.com/documentation/appstoreconnectapi/certificatetype).
- */
-export type AppleCertificateType =
-  | 'DEVELOPMENT'
-  | 'DISTRIBUTION'
-  | 'IOS_DEVELOPMENT'
-  | 'IOS_DISTRIBUTION'
-  | 'MAC_APP_DEVELOPMENT'
-  | 'MAC_APP_DISTRIBUTION'
-  | 'MAC_INSTALLER_DISTRIBUTION'
-  | 'DEVELOPER_ID_APPLICATION'
-  | 'DEVELOPER_ID_INSTALLER'
-  | 'DEVELOPER_ID_KEXT'
-  | 'PASS_TYPE_ID'
-  | 'PASS_TYPE_ID_WITH_NFC';
-
-/** Data payload of an appleCertificate secret. */
-export type AppleCertificateSecretData = {
-  certificateP12Base64: string;
-  /** Which of Apple's certificate types the p12 holds. */
-  certificateType: AppleCertificateType;
-  certificatePassword?: string;
-  teamID?: string;
-  /** Apple's portal certificate id, never a Limrun DB id. */
-  certificateID?: string;
-  /** The certificate's serial number: uppercase hex, no leading zeros. */
-  serialNumber?: string;
-  expirationDate?: string;
-};
-
-/**
- * Data payload of an appleProvisioningProfile secret. The
- * certificateSerialNumbers, bundleIDs and deviceIDs fields duplicate what
- * the signed profile binds (as comma-separated lists) so profiles can be
- * filtered by certificate, bundle ID or device without parsing every
- * entry. Certificates are referenced by serial number, the identifier
- * Apple embeds in the profile itself.
- */
-export type AppleProvisioningProfileSecretData = {
-  provisioningProfileBase64: string;
-  certificateSerialNumbers?: string;
-  bundleIDs?: string;
-  deviceIDs?: string;
-  teamID?: string;
-  profileName?: string;
-  uuid?: string;
-  expirationDate?: string;
-};
-
-/**
- * Data payload of an appStoreConnectApiKey secret: the private half of an
- * App Store Connect API key plus the identifiers needed to sign JWTs with
- * it. Apple serves the private key exactly once, so the stored copy is the
- * only one.
- */
-export type AppStoreConnectApiKeySecretData = {
-  /** Base64 of the .p8 private key PEM. */
-  privateKeyP8Base64: string;
-  /** Apple's key ID, e.g. 2X9R4HXF34. */
-  keyId: string;
-  /** Issuer ID for team keys. Absent for individual keys. */
-  issuerId?: string;
-  nickname?: string;
-  teamID?: string;
-  expirationDate?: string;
-};
-
-function compactData(data: Record<string, string | undefined>): SigningSecretData {
-  const result: SigningSecretData = {};
-  for (const [key, value] of Object.entries(data)) {
-    if (value) result[key] = value;
-  }
-  return result;
-}
-
-/** Stores an Apple certificate bundle, conventionally named `${teamID}/${certificateType}`. */
-export async function putAppleCertificateSecret(
-  store: SigningSecretStore,
-  name: string,
-  data: AppleCertificateSecretData,
-) {
-  return store.put(APPLE_CERTIFICATE_SECRET_TYPE, name, compactData(data));
-}
-
-/**
- * Stores a provisioning profile, conventionally named `${teamID}/${uuid}`
- * so a team can hold many profiles for the same bundle ID and certificate
- * set; consumers select by the reference fields, not by name.
- */
-export async function putAppleProvisioningProfileSecret(
-  store: SigningSecretStore,
-  name: string,
-  data: AppleProvisioningProfileSecretData,
-) {
-  return store.put(APPLE_PROVISIONING_PROFILE_SECRET_TYPE, name, compactData(data));
-}
-
-/**
- * Stores an App Store Connect API key, conventionally named
- * `${teamID}/APP_STORE_CONNECT_API_KEY`: one shared key per team.
- */
-export async function putAppStoreConnectApiKeySecret(
-  store: SigningSecretStore,
-  name: string,
-  data: AppStoreConnectApiKeySecretData,
-) {
-  return store.put(APP_STORE_CONNECT_API_KEY_SECRET_TYPE, name, compactData(data));
-}
-
-export type LimrunSecretStoreOptions = {
-  /** Base URL of the Limrun backend API, e.g. https://api.limrun.com */
-  apiUrl: string;
-  /** Bearer token: a user or organization token. */
-  token: string;
-  /** Organization TID owning the secrets. */
-  organizationId: string;
-  /** Custom fetch, mainly for tests. */
-  fetch?: typeof fetch;
-};
-
-type BackendSecretResult = {
-  id: string;
-  type: string;
-  name: string;
-  organizationId: string;
-  data: SigningSecretData;
-  createdAt: string;
-};
-
-/**
- * A SigningSecretStore backed by Limrun's organization secret store
- * (`/v1/organizations/{org}/secrets`). Secrets are stored server-side and
- * shared across the organization.
- */
-export function createLimrunSecretStore(options: LimrunSecretStoreOptions): SigningSecretStore {
-  const doFetch = options.fetch ?? fetch.bind(globalThis);
-  const base = options.apiUrl.replace(/\/+$/, '');
-  const secretUrl = (type: string, name: string) =>
-    `${base}/v1/organizations/${encodeURIComponent(options.organizationId)}/secrets/${encodeURIComponent(
-      type,
-    )}/${encodeURIComponent(name)}`;
-  const headers = {
-    Authorization: `Bearer ${options.token}`,
-    'Content-Type': 'application/json',
-  };
-
-  async function fail(response: Response, action: string): Promise<never> {
-    let message = `${response.status}`;
-    try {
-      const body = (await response.json()) as { message?: string };
-      if (body.message) message = body.message;
-    } catch {
-      // Non-JSON error body; the status code is the best we have.
-    }
-    throw new Error(`Failed to ${action} secret: ${message}`);
-  }
-
-  return {
-    async put(type, name, data) {
-      const response = await doFetch(secretUrl(type, name), {
-        method: 'PUT',
-        headers,
-        body: JSON.stringify({ data, replace: true }),
-      });
-      if (!response.ok) await fail(response, 'store');
-      const result = (await response.json()) as BackendSecretResult;
-      return { type: result.type, name: result.name, createdAt: result.createdAt, data: result.data };
-    },
-    async get(type, name) {
-      const response = await doFetch(secretUrl(type, name), { method: 'GET', headers });
-      if (response.status === 404) return undefined;
-      if (!response.ok) await fail(response, 'fetch');
-      const result = (await response.json()) as BackendSecretResult;
-      return { type: result.type, name: result.name, createdAt: result.createdAt, data: result.data };
-    },
-    async list() {
-      const response = await doFetch(
-        `${base}/v1/organizations/${encodeURIComponent(options.organizationId)}/secrets`,
-        { method: 'GET', headers },
-      );
-      if (!response.ok) await fail(response, 'list');
-      const result = (await response.json()) as Omit<BackendSecretResult, 'data'>[];
-      return result
-        .filter(
-          (s) =>
-            s.type === APPLE_CERTIFICATE_SECRET_TYPE ||
-            s.type === APPLE_PROVISIONING_PROFILE_SECRET_TYPE ||
-            s.type === APP_STORE_CONNECT_API_KEY_SECRET_TYPE,
-        )
-        .map((s) => ({ type: s.type, name: s.name, createdAt: s.createdAt }));
-    },
-    async delete(type, name) {
-      const response = await doFetch(secretUrl(type, name), { method: 'DELETE', headers });
-      if (response.status === 404) return;
-      if (!response.ok) await fail(response, 'delete');
-    },
-  };
-}
-
-const SECRETS_DB_NAME = 'limrun-signing-secrets';
-const SECRETS_DB_VERSION = 1;
-const SECRETS_STORE_NAME = 'secrets';
-
-type BrowserStoredSecret = {
-  id: string;
-  type: string;
-  name: string;
-  data: SigningSecretData;
-  createdAt: string;
-};
-
-/**
- * A SigningSecretStore keeping everything in the browser's IndexedDB.
- * Nothing leaves the machine; secrets are per-browser-profile.
- */
-export function createBrowserSecretStore(): SigningSecretStore {
-  const idOf = (type: string, name: string) => `${type}:${name}`;
-
-  function open() {
-    return new Promise<IDBDatabase>((resolve, reject) => {
-      const request = indexedDB.open(SECRETS_DB_NAME, SECRETS_DB_VERSION);
-      request.onupgradeneeded = () => {
-        const db = request.result;
-        if (!db.objectStoreNames.contains(SECRETS_STORE_NAME)) {
-          db.createObjectStore(SECRETS_STORE_NAME, { keyPath: 'id' });
-        }
-      };
-      request.onsuccess = () => resolve(request.result);
-      request.onerror = () => reject(request.error ?? new Error('Open IndexedDB failed'));
-    });
-  }
-
-  function toPromise<T = unknown>(request: IDBRequest<T>) {
-    return new Promise<T>((resolve, reject) => {
-      request.onsuccess = () => resolve(request.result);
-      request.onerror = () => reject(request.error ?? new Error('IndexedDB request failed'));
-    });
-  }
-
-  return {
-    async put(type, name, data) {
-      const db = await open();
-      const existing = await toPromise<BrowserStoredSecret | undefined>(
-        db.transaction(SECRETS_STORE_NAME, 'readonly').objectStore(SECRETS_STORE_NAME).get(idOf(type, name)),
-      );
-      const stored: BrowserStoredSecret = {
-        id: idOf(type, name),
-        type,
-        name,
-        data,
-        createdAt: existing?.createdAt ?? new Date().toISOString(),
-      };
-      await toPromise(
-        db.transaction(SECRETS_STORE_NAME, 'readwrite').objectStore(SECRETS_STORE_NAME).put(stored),
-      );
-      return { type, name, createdAt: stored.createdAt, data };
-    },
-    async get(type, name) {
-      const db = await open();
-      const stored = await toPromise<BrowserStoredSecret | undefined>(
-        db.transaction(SECRETS_STORE_NAME, 'readonly').objectStore(SECRETS_STORE_NAME).get(idOf(type, name)),
-      );
-      if (!stored) return undefined;
-      return { type: stored.type, name: stored.name, createdAt: stored.createdAt, data: stored.data };
-    },
-    async list() {
-      const db = await open();
-      const all = await toPromise<BrowserStoredSecret[]>(
-        db.transaction(SECRETS_STORE_NAME, 'readonly').objectStore(SECRETS_STORE_NAME).getAll(),
-      );
-      return all.map((s) => ({ type: s.type, name: s.name, createdAt: s.createdAt }));
-    },
-    async delete(type, name) {
-      const db = await open();
-      await toPromise(
-        db
-          .transaction(SECRETS_STORE_NAME, 'readwrite')
-          .objectStore(SECRETS_STORE_NAME)
-          .delete(idOf(type, name)),
-      );
-    },
-  };
-}