@mdbase-dev/sdk 0.0.0-stage → 0.1.0-beta.149

package/dist/app-host/cp-people.js

@@ -0,0 +1,145 @@
+/** Fixed, pinned CP people GETs. No record payload, path, key, or issuer inference. */
+import { LOCAL_APPLICATION_BUILD, localApplicationHttpOrigin } from "../application/local-build.js";
+import { uuidToBytes } from "../codec.js";
+import { mdbaseError, MdbaseError } from "../errors.js";
+const unavailable = () => mdbaseError("unavailable", "people metadata is unavailable", "people_response");
+function object(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw unavailable();
+    return value;
+}
+function endpoint(value) {
+    if (typeof value === "number" && !Number.isSafeInteger(value))
+        throw unavailable();
+    const result = BigInt(value);
+    if (result < 0n || result > (1n << 64n) - 1n)
+        throw unavailable();
+    return result;
+}
+/** Shares the genuine registered-device session pin, never its signing authority. */
+export class AppCpPeopleAuthority {
+    session;
+    cpOrigin;
+    rawOrigin;
+    collection;
+    connector;
+    device;
+    ep;
+    fetchImpl;
+    lifetime = new AbortController();
+    constructor(session, options = {}) {
+        this.session = session;
+        this.rawOrigin = session.cpOrigin;
+        const url = new URL(this.rawOrigin);
+        if (url.username || url.password || url.pathname !== "/" || url.search || url.hash ||
+            (url.protocol !== "https:" && !(options.allowLoopbackHttp === true && url.protocol === "http:" && (LOCAL_APPLICATION_BUILD ? localApplicationHttpOrigin(session.cpOrigin) : ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))))
+            throw mdbaseError("invalid_request", "invalid people CP origin", "people_binding");
+        this.cpOrigin = url.origin;
+        this.collection = session.collection;
+        this.connector = session.connectorId;
+        this.device = session.deviceId;
+        this.ep = endpoint(session.endpoint);
+        for (const id of [this.collection, this.connector, this.device])
+            if (uuidToBytes(id).every(value => value === 0))
+                throw mdbaseError("invalid_request", "nil people binding", "people_binding");
+        this.fetchImpl = options.fetch ?? globalThis.fetch;
+        if (!this.isCurrent())
+            throw mdbaseError("unauthenticated", "people scope is not current", "people_fenced");
+    }
+    isCurrent() {
+        try {
+            return !this.lifetime.signal.aborted && this.session.isCurrent() === true && this.session.cpOrigin === this.rawOrigin && this.session.collection === this.collection && this.session.connectorId === this.connector && this.session.deviceId === this.device && endpoint(this.session.endpoint) === this.ep;
+        }
+        catch {
+            return false;
+        }
+    }
+    check(signal) {
+        signal?.throwIfAborted();
+        if (!this.isCurrent())
+            throw mdbaseError("unauthenticated", "people scope changed", "people_fenced");
+    }
+    async request(resource, options = {}) {
+        if (resource !== "identity" && resource !== "members")
+            throw mdbaseError("invalid_request", "invalid people resource");
+        this.check(options.signal);
+        const ctrl = new AbortController(), abort = () => ctrl.abort();
+        options.signal?.addEventListener("abort", abort, { once: true });
+        this.lifetime.signal.addEventListener("abort", abort, { once: true });
+        const timer = setTimeout(abort, 15_000);
+        timer.unref?.();
+        const bytes = new Uint8Array(1024 * 1024);
+        let count = 0;
+        let response, reader;
+        try {
+            const bearer = await this.session.connectorBearer({ signal: ctrl.signal });
+            this.check(options.signal);
+            if (ctrl.signal.aborted)
+                throw unavailable();
+            if (typeof bearer !== "string" || !/^(idev_|ct_)/.test(bearer) || bearer.length > 16 * 1024 || /[^\x21-\x7e]/.test(bearer))
+                throw mdbaseError("unauthenticated", "invalid people credential", "people_binding");
+            const fetchImpl = this.fetchImpl;
+            response = await fetchImpl(`${this.cpOrigin}/v1/authorities/${this.collection}/${resource}?device_id=${this.device}`, {
+                method: "GET", headers: { authorization: `Bearer ${bearer}` }, signal: ctrl.signal,
+                // Default cache mode so Chrome reuses the CORS preflight; the CP sends Cache-Control: no-store.
+                redirect: "error", credentials: "omit", cache: "default", referrerPolicy: "no-referrer",
+            });
+            this.check(options.signal);
+            if (ctrl.signal.aborted)
+                throw unavailable();
+            const length = response.headers.get("content-length");
+            if (length !== null && /^(0|[1-9][0-9]*)$/.test(length) && Number(length) > bytes.length)
+                throw unavailable();
+            if (!response.body)
+                throw unavailable();
+            reader = response.body.getReader();
+            for (;;) {
+                const { done, value } = await reader.read();
+                try {
+                    this.check(options.signal);
+                    if (ctrl.signal.aborted)
+                        throw unavailable();
+                    if (done)
+                        break;
+                    if (count + value.length > bytes.length)
+                        throw unavailable();
+                    bytes.set(value, count);
+                    count += value.length;
+                }
+                finally {
+                    value?.fill(0);
+                }
+            }
+            const body = object(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, count))));
+            this.check(options.signal);
+            if (response.status === 401)
+                throw mdbaseError("unauthenticated", "people credential is no longer current", "people_fenced");
+            if (response.status === 403) {
+                const error = object(body.error);
+                throw mdbaseError("forbidden", "people access was refused", resource === "members" && error.code === "people_permission_declined" ? "people_permission_declined" : "people_access");
+            }
+            if (response.status === 404)
+                throw mdbaseError("upgrade_required", "people metadata is unsupported", "people_unsupported");
+            if (!response.ok)
+                throw unavailable();
+            return body;
+        }
+        catch (error) {
+            this.check(options.signal);
+            if (error instanceof MdbaseError)
+                throw error;
+            throw unavailable();
+        }
+        finally {
+            ctrl.abort();
+            bytes.fill(0);
+            void (reader?.cancel() ?? response?.body?.cancel())?.catch(() => { });
+            reader?.releaseLock();
+            clearTimeout(timer);
+            options.signal?.removeEventListener("abort", abort);
+            this.lifetime.signal.removeEventListener("abort", abort);
+        }
+    }
+    close() { this.lifetime.abort(); }
+}
+//# sourceMappingURL=cp-people.js.map

package/dist/app-host/cp-people.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cp-people.js","sourceRoot":"","sources":["../../src/app-host/cp-people.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAKxD,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,gCAAgC,EAAE,iBAAiB,CAAC,CAAC;AAC1G,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,WAAW,EAAE,CAAC;IACrF,OAAO,KAAgC,CAAC;AAC1C,CAAC;AACD,SAAS,QAAQ,CAAC,KAAsB;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,MAAM,WAAW,EAAE,CAAC;IACnF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,MAAM,GAAG,EAAE,IAAI,MAAM,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE;QAAE,MAAM,WAAW,EAAE,CAAC;IAClE,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,qFAAqF;AACrF,MAAM,OAAO,oBAAoB;IASF;IARZ,QAAQ,CAAS;IACjB,SAAS,CAAS;IAC1B,UAAU,CAAS;IACX,SAAS,CAAS;IAClB,MAAM,CAAS;IACf,EAAE,CAAS;IACX,SAAS,CAA0B;IACnC,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;IAClD,YAA6B,OAAqB,EAAE,UAA8B,EAAE;QAAvD,YAAO,GAAP,OAAO,CAAc;QAChD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;YAC9E,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,iBAAiB,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,0BAA0B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3O,MAAM,WAAW,CAAC,iBAAiB,EAAE,0BAA0B,EAAE,gBAAgB,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QAAC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;QAAC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjJ,KAAK,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC;YAAE,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC;gBAAE,MAAM,WAAW,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;QAC/L,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,MAAM,WAAW,CAAC,iBAAiB,EAAE,6BAA6B,EAAE,eAAe,CAAC,CAAC;IAC9G,CAAC;IACD,SAAS;QACP,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAAC,CAAC;QACpT,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IACzB,CAAC;IACO,KAAK,CAAC,MAAoB;QAChC,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,MAAM,WAAW,CAAC,iBAAiB,EAAE,sBAAsB,EAAE,eAAe,CAAC,CAAC;IACvG,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,QAAgC,EAAE,UAAgC,EAAE;QAChF,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,WAAW,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;QACvH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,EAAE,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/D,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxI,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAAE,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;QACrF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QACzD,IAAI,QAA8B,EAAE,MAA2D,CAAC;QAChG,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACvG,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,WAAW,EAAE,CAAC;YAC7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;gBACxH,MAAM,WAAW,CAAC,iBAAiB,EAAE,2BAA2B,EAAE,gBAAgB,CAAC,CAAC;YACtF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,QAAQ,mBAAmB,IAAI,CAAC,UAAU,IAAI,QAAQ,cAAc,IAAI,CAAC,MAAM,EAAE,EAAE;gBACpH,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;gBAClF,gGAAgG;gBAChG,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa;aACxF,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,WAAW,EAAE,CAAC;YACzE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACtD,IAAI,MAAM,KAAK,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM;gBAAE,MAAM,WAAW,EAAE,CAAC;YAC9G,IAAI,CAAC,QAAQ,CAAC,IAAI;gBAAE,MAAM,WAAW,EAAE,CAAC;YAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5E,SAAS,CAAC;gBACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,CAAC;oBAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;wBAAE,MAAM,WAAW,EAAE,CAAC;oBAAC,IAAI,IAAI;wBAAE,MAAM;oBAC9F,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;wBAAE,MAAM,WAAW,EAAE,CAAC;oBAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;oBAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC/G,CAAC;wBAAS,CAAC;oBAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;YAC/B,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC3B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,WAAW,CAAC,iBAAiB,EAAE,wCAAwC,EAAE,eAAe,CAAC,CAAC;YAC7H,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,WAAW,CAAC,WAAW,EAAE,2BAA2B,EAAE,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,4BAA4B,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YACtL,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,WAAW,CAAC,kBAAkB,EAAE,gCAAgC,EAAE,oBAAoB,CAAC,CAAC;YAC3H,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,WAAW,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC3B,IAAI,KAAK,YAAY,WAAW;gBAAE,MAAM,KAAK,CAAC;YAC9C,MAAM,WAAW,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAAC,MAAM,EAAE,WAAW,EAAE,CAAC;YACzH,YAAY,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrI,CAAC;IACH,CAAC;IACD,KAAK,KAAW,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;CACzC"}

package/dist/app-host/cp-problem.d.ts

@@ -0,0 +1,34 @@
+/** A bounded, sanitized control-plane (or log server) refusal. Only the public
+ * problem vocabulary is kept: never messages, stacks or other response fields. */
+export interface AppServerProblem {
+    readonly status: number;
+    /** One of the 15 SDK codes, or a specific CP code (`collection_migrating`, `account_suspended`, `collection_unavailable`, ...). */
+    readonly code: string | null;
+    /** The specific cause (`details.reason`). */
+    readonly reason: string | null;
+    readonly retryAfterMs: number | null;
+    /** https only, for `update_required`. */
+    readonly updateUrl: string | null;
+}
+/** Outcomes apps must be able to tell apart. */
+export type AppServerOutcome = "collection_not_yet_migrated" | "collection_migrating" | "account_suspended" | "update_required" | "account_collection_quota_exceeded";
+/** True only for a problem this module parsed (never an adapter-supplied lookalike). */
+export declare function isAppServerProblem(value: unknown): value is AppServerProblem;
+/** Server-directed retry is clamped to 5 s..10 min. */
+export declare const MIN_SERVER_RETRY_MS = 5000, MAX_SERVER_RETRY_MS = 600000;
+/** Where an update link goes when the server's is missing or not allowlisted. */
+export declare const DEFAULT_UPDATE_URL = "https://mdbase.dev/downloads/";
+/** An update link only to mdbase.dev (or a subdomain) or the declared CP
+ * origin, https, without credentials or control characters; otherwise null. */
+export declare function trustedUpdateUrl(value: unknown, cpOrigin?: string | null): string | null;
+/** Re-validate a problem that crossed a boundary (an SDK error's `server`
+ * argument, a structured-cloned snapshot): exact fields, the public name
+ * grammar, the clamped retry and an allowlisted link, else null. The result
+ * is a fresh parser-genuine object; the input is never kept. */
+export declare function sanitizeAppServerProblem(value: unknown, cpOrigin?: string | null): AppServerProblem | null;
+/** Parse a non-2xx response's already-read JSON body (or `undefined` if none). */
+export declare function appServerProblem(status: number, body: unknown, headers?: Pick<Headers, "get"> | null, cpOrigin?: string | null): AppServerProblem;
+/** Classify the outcomes that need their own user copy. */
+export declare function appServerOutcome(problem: AppServerProblem | null | undefined): AppServerOutcome | null;
+/** Decode a bounded JSON error body; `undefined` if it is not JSON. */
+export declare function appServerBody(bytes: Uint8Array): unknown;

package/dist/app-host/cp-problem.js

@@ -0,0 +1,114 @@
+const NAME = /^[a-z][a-z0-9_]{0,63}$/;
+const genuine = new WeakSet();
+/** True only for a problem this module parsed (never an adapter-supplied lookalike). */
+export function isAppServerProblem(value) {
+    return typeof value === "object" && value !== null && genuine.has(value);
+}
+/** Server-directed retry is clamped to 5 s..10 min. */
+export const MIN_SERVER_RETRY_MS = 5_000, MAX_SERVER_RETRY_MS = 600_000;
+const MIN_RETRY = MIN_SERVER_RETRY_MS, MAX_RETRY = MAX_SERVER_RETRY_MS;
+/** Where an update link goes when the server's is missing or not allowlisted. */
+export const DEFAULT_UPDATE_URL = "https://mdbase.dev/downloads/";
+const name = (value) => typeof value === "string" && NAME.test(value) ? value : null;
+const clampRetry = (ms) => Math.min(MAX_RETRY, Math.max(MIN_RETRY, Math.round(ms)));
+function retryAfter(details, headers) {
+    const ms = details?.retry_after_ms, seconds = details?.retry_after_seconds;
+    if (typeof ms === "number" && Number.isFinite(ms) && ms >= 0)
+        return clampRetry(ms);
+    if (typeof seconds === "number" && Number.isFinite(seconds) && seconds >= 0)
+        return clampRetry(seconds * 1000);
+    const header = headers?.get("retry-after")?.trim();
+    if (header && /^[0-9]{1,6}$/.test(header))
+        return clampRetry(Number(header) * 1000);
+    return null;
+}
+/** An update link only to mdbase.dev (or a subdomain) or the declared CP
+ * origin, https, without credentials or control characters; otherwise null. */
+export function trustedUpdateUrl(value, cpOrigin = null) {
+    if (typeof value !== "string" || value.length > 2048 || /[\u0000-\u0020\u007f]/.test(value))
+        return null;
+    try {
+        const url = new URL(value);
+        if (url.protocol !== "https:" || url.username || url.password || url.port)
+            return null;
+        const host = url.hostname;
+        return host === "mdbase.dev" || host.endsWith(".mdbase.dev") || (cpOrigin !== null && url.origin === cpOrigin) ? url.href : null;
+    }
+    catch {
+        return null;
+    }
+}
+const FIELDS = "code,reason,retryAfterMs,status,updateUrl";
+/** Re-validate a problem that crossed a boundary (an SDK error's `server`
+ * argument, a structured-cloned snapshot): exact fields, the public name
+ * grammar, the clamped retry and an allowlisted link, else null. The result
+ * is a fresh parser-genuine object; the input is never kept. */
+export function sanitizeAppServerProblem(value, cpOrigin = null) {
+    try {
+        if (isAppServerProblem(value))
+            return value;
+        if (typeof value !== "object" || value === null || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype
+            || Object.keys(value).sort().join(",") !== FIELDS)
+            return null;
+        const v = value;
+        const status = v.status, retry = v.retryAfterMs;
+        if (typeof status !== "number" || !Number.isSafeInteger(status) || status < 0 || status > 999)
+            return null;
+        if ((v.code !== null && name(v.code) === null) || (v.reason !== null && name(v.reason) === null))
+            return null;
+        if (retry !== null && (typeof retry !== "number" || !Number.isFinite(retry) || retry < 0))
+            return null;
+        if (v.updateUrl !== null && typeof v.updateUrl !== "string")
+            return null;
+        const problem = Object.freeze({ status, code: name(v.code), reason: name(v.reason),
+            retryAfterMs: retry === null ? null : clampRetry(retry), updateUrl: trustedUpdateUrl(v.updateUrl, cpOrigin) });
+        genuine.add(problem);
+        return problem;
+    }
+    catch {
+        return null; /* hostile getters/proxies */
+    }
+}
+/** Parse a non-2xx response's already-read JSON body (or `undefined` if none). */
+export function appServerProblem(status, body, headers = null, cpOrigin = null) {
+    const error = body && typeof body === "object" && !Array.isArray(body) ? body.error : undefined;
+    const e = error && typeof error === "object" && !Array.isArray(error) ? error : null;
+    const d = e?.details && typeof e.details === "object" && !Array.isArray(e.details) ? e.details : null;
+    const problem = Object.freeze({
+        status: Number.isSafeInteger(status) ? status : 0,
+        code: name(e?.code),
+        reason: name(d?.reason),
+        retryAfterMs: retryAfter(d, headers),
+        updateUrl: trustedUpdateUrl(d?.update_url, cpOrigin),
+    });
+    genuine.add(problem);
+    return problem;
+}
+/** Classify the outcomes that need their own user copy. */
+export function appServerOutcome(problem) {
+    if (!problem)
+        return null;
+    const names = [problem.reason, problem.code];
+    if (problem.status === 429 && problem.code === "account_collection_quota_exceeded")
+        return "account_collection_quota_exceeded";
+    if (names.includes("collection_not_yet_migrated"))
+        return "collection_not_yet_migrated";
+    if (names.includes("collection_migrating"))
+        return "collection_migrating";
+    if (names.includes("account_suspended"))
+        return "account_suspended";
+    // CP: 409 collection_unavailable {reason: moved_to_next_runtime, update_url}.
+    if (names.some(n => n === "moved_to_next_runtime" || n === "collection_moved" || n === "client_update_required") || problem.status === 426)
+        return "update_required";
+    return null;
+}
+/** Decode a bounded JSON error body; `undefined` if it is not JSON. */
+export function appServerBody(bytes) {
+    try {
+        return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=cp-problem.js.map

package/dist/app-host/cp-problem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cp-problem.js","sourceRoot":"","sources":["../../src/app-host/cp-problem.ts"],"names":[],"mappings":"AAeA,MAAM,IAAI,GAAG,wBAAwB,CAAC;AACtC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAU,CAAC;AACtC,wFAAwF;AACxF,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AACD,uDAAuD;AACvD,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC;AACxE,MAAM,SAAS,GAAG,mBAAmB,EAAE,SAAS,GAAG,mBAAmB,CAAC;AACvE,iFAAiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAClE,MAAM,IAAI,GAAG,CAAC,KAAc,EAAiB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7G,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE5F,SAAS,UAAU,CAAC,OAAuC,EAAE,OAAoC;IAC/F,MAAM,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,EAAE,mBAAmB,CAAC;IAC3E,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC;IACpF,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC/G,MAAM,MAAM,GAAG,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;+EAC+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,WAA0B,IAAI;IAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,OAAO,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACnI,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,MAAM,MAAM,GAAG,2CAA2C,CAAC;AAC3D;;;gEAGgE;AAChE,MAAM,UAAU,wBAAwB,CAAC,KAAc,EAAE,WAA0B,IAAI;IACrF,IAAI,CAAC;QACH,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS;eACvH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACjE,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC;QAChD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC3G,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9G,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACvG,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzE,MAAM,OAAO,GAAqB,MAAM,CAAC,MAAM,CAAC,EAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YACjG,YAAY,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAe,CAAC,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAC,CAAC,CAAC;QAC1H,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC,CAAC,6BAA6B;IAAC,CAAC;AACxD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,IAAa,EAAE,UAAuC,IAAI,EAAE,WAA0B,IAAI;IACzI,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAgC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7H,MAAM,CAAC,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChH,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjI,MAAM,OAAO,GAAqB,MAAM,CAAC,MAAM,CAAC;QAC9C,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC;QACnB,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC;QACpC,SAAS,EAAE,gBAAgB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC;KACrD,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,gBAAgB,CAAC,OAA4C;IAC3E,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,IAAI,KAAK,mCAAmC;QAAE,OAAO,mCAAmC,CAAC;IAC/H,IAAI,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAAE,OAAO,6BAA6B,CAAC;IACxF,IAAI,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAAE,OAAO,sBAAsB,CAAC;IAC1E,IAAI,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAAE,OAAO,mBAAmB,CAAC;IACpE,8EAA8E;IAC9E,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,uBAAuB,IAAI,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,wBAAwB,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,iBAAiB,CAAC;IACrK,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AACjH,CAAC"}

package/dist/app-host/device-key-custody.d.ts

@@ -0,0 +1,51 @@
+import type { AppDeviceIdentityPin, AppNoiseCustodyResult, AppWasmRuntime } from "./wasm-runtime.js";
+export interface AppDeviceKeyCustodyPin extends AppDeviceIdentityPin {
+    readonly accountId: string;
+    /** Trusted owned-host lifecycle callback, NOT a UI readiness flag. Must bind
+     * the actual installation lease acquired BEFORE unwrap/native device open.
+     * It stays false once closing; failed termination does not release leases. */
+    installationOwned(): boolean;
+}
+export interface AppDeviceKeyProtectedStore {
+    /** Bounded opaque ciphertext only; writes consume/copy before resolving. */
+    read(namespace: string, options: {
+        signal: AbortSignal;
+    }): Promise<Uint8Array | null>;
+    /** Atomic create-only CAS. False preserves existing identity; a possibly
+     * committed/lost-reply write THROWS. No overwrite/delete/retry operation. */
+    create(namespace: string, encrypted: Uint8Array, options: {
+        signal: AbortSignal;
+    }): Promise<boolean>;
+}
+export interface AppOpenOriginalDeviceOptions {
+    readonly signal: AbortSignal;
+    /** Explicit authenticated installation decision, never inferred from null. */
+    readonly mode: "fresh" | "existing";
+    readonly noise: {
+        readonly mode: "fresh";
+    } | {
+        readonly mode: "existing";
+        readonly envelope: Uint8Array;
+    };
+}
+/** The authenticating host supplies its EXISTING persistent nonextractable KEK;
+ * this class never creates a substitute. Nonextractable keys/Workers do not
+ * isolate from same-origin XSS, and ciphertext/CAS are not durability proofs.
+ * One invocation ever per vault/module lifetime, including failed attempts. */
+export declare class AppWebDeviceKeyCustody {
+    private readonly pin;
+    private readonly key;
+    private readonly store;
+    private readonly scope;
+    private readonly namespace;
+    private readonly aad;
+    private readonly current;
+    private readonly owned;
+    private attempted;
+    constructor(pin: AppDeviceKeyCustodyPin, key: CryptoKey, store: AppDeviceKeyProtectedStore);
+    private check;
+    /** Unwrap only while installation ownership is current, hand original loans
+     * synchronously to native openDeviceConsuming exactly once, wipe all JS loans.
+     * Persist fresh encrypted keys BEFORE native open or any enrol request. */
+    openNativeDevice(runtime: Pick<AppWasmRuntime, "openDeviceConsuming" | "retireLog">, options: AppOpenOriginalDeviceOptions): Promise<AppNoiseCustodyResult>;
+}

package/dist/app-host/device-key-custody.js

@@ -0,0 +1,128 @@
+/** First-party original sign/KEM custody. No plaintext export, generic signing,
+ * collection SQL, KEK generation, identity replacement or recovery/reset API. */
+import { decode, encode } from "../cbor.js";
+import { uuidToBytes } from "../codec.js";
+const fail = () => new Error("app device key custody unavailable; preserve storage and reopen");
+/** The authenticating host supplies its EXISTING persistent nonextractable KEK;
+ * this class never creates a substitute. Nonextractable keys/Workers do not
+ * isolate from same-origin XSS, and ciphertext/CAS are not durability proofs.
+ * One invocation ever per vault/module lifetime, including failed attempts. */
+export class AppWebDeviceKeyCustody {
+    pin;
+    key;
+    store;
+    scope;
+    namespace;
+    aad;
+    current;
+    owned;
+    attempted = false;
+    constructor(pin, key, store) {
+        this.pin = pin;
+        this.key = key;
+        this.store = store;
+        try {
+            this.scope = Object.freeze({ accountId: pin.accountId, connectorId: pin.connectorId, deviceId: pin.deviceId, installationId: pin.installationId });
+            this.current = pin.isCurrent;
+            this.owned = pin.installationOwned;
+            const ids = [this.scope.accountId, this.scope.connectorId, this.scope.deviceId, this.scope.installationId].map(uuidToBytes);
+            if (ids.some(b => b.every(v => v === 0)) || key.type !== "secret" || key.extractable || key.algorithm.name !== "AES-GCM" || key.algorithm.length !== 256 || !key.usages.includes("encrypt") || !key.usages.includes("decrypt"))
+                throw fail();
+            this.namespace = `mdbase.app-device-keys.v1:${ids.map(b => Array.from(b, v => v.toString(16).padStart(2, "0")).join("")).join(":")}`;
+            this.aad = encode(["mdbase/v1/app-device-keys-platform", ...ids]);
+            this.check(new AbortController().signal);
+        }
+        catch {
+            throw fail();
+        }
+    }
+    check(signal) {
+        try {
+            if (signal.aborted || this.pin.isCurrent !== this.current || this.pin.installationOwned !== this.owned || this.current.call(this.pin) !== true || this.owned.call(this.pin) !== true ||
+                this.pin.accountId !== this.scope.accountId || this.pin.connectorId !== this.scope.connectorId || this.pin.deviceId !== this.scope.deviceId || this.pin.installationId !== this.scope.installationId)
+                throw fail();
+        }
+        catch {
+            throw fail();
+        }
+    }
+    /** Unwrap only while installation ownership is current, hand original loans
+     * synchronously to native openDeviceConsuming exactly once, wipe all JS loans.
+     * Persist fresh encrypted keys BEFORE native open or any enrol request. */
+    async openNativeDevice(runtime, options) {
+        let plain = null, cipher = null, attemptedNative = false;
+        try {
+            if (this.attempted)
+                throw fail();
+            this.attempted = true;
+            const signal = options.signal, mode = options.mode;
+            this.check(signal);
+            if (!["fresh", "existing"].includes(mode) || options.noise.mode !== mode)
+                throw fail();
+            if (options.noise.mode === "existing" && !(options.noise.envelope instanceof Uint8Array))
+                throw fail();
+            const noise = options.noise.mode === "fresh" ? { mode: "fresh" } : { mode: "existing", envelope: new Uint8Array(options.noise.envelope) };
+            if (noise.mode === "existing" && (!noise.envelope.length || noise.envelope.length > 1024))
+                throw fail();
+            const borrowed = await this.store.read(this.namespace, { signal });
+            this.check(signal);
+            if (mode === "fresh") {
+                if (borrowed !== null)
+                    throw fail();
+                plain = globalThis.crypto.getRandomValues(new Uint8Array(64));
+                const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+                const body = new Uint8Array(await globalThis.crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: new Uint8Array(this.aad), tagLength: 128 }, this.key, plain));
+                this.check(signal);
+                cipher = encode(new Map([[0, 1], [1, iv], [2, body]]));
+                if (await this.store.create(this.namespace, cipher, { signal }) !== true)
+                    throw fail();
+                this.check(signal);
+            }
+            else {
+                if (!(borrowed instanceof Uint8Array) || borrowed.length === 0 || borrowed.length > 256)
+                    throw fail();
+                cipher = new Uint8Array(borrowed);
+                const value = decode(cipher);
+                if (!(value instanceof Map))
+                    throw fail();
+                const record = value;
+                if (record.size !== 3 || record.get(0) !== 1)
+                    throw fail();
+                const iv = record.get(1), body = record.get(2);
+                if (!(iv instanceof Uint8Array) || iv.length !== 12 || !(body instanceof Uint8Array) || body.length !== 80)
+                    throw fail();
+                plain = new Uint8Array(await globalThis.crypto.subtle.decrypt({ name: "AES-GCM", iv: new Uint8Array(iv), additionalData: new Uint8Array(this.aad), tagLength: 128 }, this.key, new Uint8Array(body)));
+                this.check(signal);
+                if (plain.length !== 64)
+                    throw fail();
+            }
+            this.check(signal);
+            const nativePin = Object.freeze({ connectorId: this.scope.connectorId, deviceId: this.scope.deviceId, installationId: this.scope.installationId,
+                isCurrent: () => { try {
+                    this.check(signal);
+                    return true;
+                }
+                catch {
+                    return false;
+                } } });
+            attemptedNative = true;
+            const result = runtime.openDeviceConsuming({ pin: nativePin, signSecretKey: plain.subarray(0, 32), kemSecretKey: plain.subarray(32), opened: noise });
+            this.check(signal);
+            return result;
+        }
+        catch {
+            if (attemptedNative) {
+                try {
+                    runtime.retireLog();
+                }
+                catch { /* host must still terminate before unlocking */ }
+            }
+            throw fail();
+        }
+        finally {
+            plain?.fill(0);
+            cipher?.fill(0);
+        }
+    }
+}
+//# sourceMappingURL=device-key-custody.js.map

package/dist/app-host/device-key-custody.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-key-custody.js","sourceRoot":"","sources":["../../src/app-host/device-key-custody.ts"],"names":[],"mappings":"AAAA;iFACiF;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAkB,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuB1C,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;AAChG;;;+EAG+E;AAC/E,MAAM,OAAO,sBAAsB;IAOJ;IAA8C;IAAiC;IAN3F,KAAK,CAAiG;IACtG,SAAS,CAAS;IAClB,GAAG,CAAa;IAChB,OAAO,CAAsC;IAC7C,KAAK,CAA8C;IAC5D,SAAS,GAAG,KAAK,CAAC;IAC1B,YAA6B,GAA2B,EAAmB,GAAc,EAAmB,KAAiC;QAAhH,QAAG,GAAH,GAAG,CAAwB;QAAmB,QAAG,GAAH,GAAG,CAAW;QAAmB,UAAK,GAAL,KAAK,CAA4B;QAC3I,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;YACnJ,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC;YAAC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC;YACjE,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC5H,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,IAAK,GAAG,CAAC,SAA6B,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,MAAM,IAAI,EAAE,CAAC;YAClQ,IAAI,CAAC,SAAS,GAAG,6BAA6B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpI,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,oCAAoC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,EAAE,CAAC;QAAC,CAAC;IAC3B,CAAC;IACO,KAAK,CAAC,MAAmB;QAC/B,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI;gBAChL,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc;gBAAE,MAAM,IAAI,EAAE,CAAC;QACzN,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,EAAE,CAAC;QAAC,CAAC;IAC3B,CAAC;IACD;;+EAE2E;IAC3E,KAAK,CAAC,gBAAgB,CAAC,OAAkE,EAAE,OAAqC;QAC9H,IAAI,KAAK,GAAmC,IAAI,EAAE,MAAM,GAAsB,IAAI,EAAE,eAAe,GAAG,KAAK,CAAC;QAC5G,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YACnD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,IAAI,CAAE,CAAC,OAAO,EAAE,UAAU,CAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI;gBAAE,MAAM,IAAI,EAAE,CAAC;YAClG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,YAAY,UAAU,CAAC;gBAAE,MAAM,IAAI,EAAE,CAAC;YACvG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAmB,EAAE,QAAQ,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5J,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC;gBAAE,MAAM,IAAI,EAAE,CAAC;YACxG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvF,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACrB,IAAI,QAAQ,KAAK,IAAI;oBAAE,MAAM,IAAI,EAAE,CAAC;gBACpC,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC9D,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;gBACjE,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC5L,MAAM,GAAG,MAAM,CAAC,IAAI,GAAG,CAAmB,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC,EAAC,CAAC,CAAC,EAAC,EAAE,CAAC,EAAC,CAAC,CAAC,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpE,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,KAAK,IAAI;oBAAE,MAAM,IAAI,EAAE,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7G,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,CAAC,QAAQ,YAAY,UAAU,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;oBAAE,MAAM,IAAI,EAAE,CAAC;gBACtG,MAAM,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAClC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC7B,IAAI,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC;oBAAE,MAAM,IAAI,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,KAAiC,CAAC;gBACjD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,EAAE,CAAC;gBAC3D,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC/C,IAAI,CAAC,CAAC,EAAE,YAAY,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;oBAAE,MAAM,IAAI,EAAE,CAAC;gBACzH,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC1N,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;oBAAE,MAAM,IAAI,EAAE,CAAC;YACxC,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,MAAM,SAAS,GAAyB,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;gBACnK,SAAS,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;oBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAAC,OAAO,IAAI,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,KAAK,CAAC;gBAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3F,eAAe,GAAG,IAAI,CAAC;YACvB,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAC,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACrJ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAAC,OAAO,MAAM,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YAAC,IAAI,eAAe,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,gDAAgD,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,IAAI,EAAE,CAAC;QAAC,CAAC;gBAClI,CAAC;YAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IAC9C,CAAC;CACF"}

package/dist/app-host/device-key-idb.d.ts

@@ -0,0 +1,31 @@
+import type { AppDeviceKeyCustodyPin, AppDeviceKeyProtectedStore } from "./device-key-custody.js";
+export interface AppIndexedDbDeviceKeyOptions {
+    readonly origin: string;
+    readonly mode: "fresh" | "existing";
+    readonly source: AppDeviceKeyCustodyPin;
+    readonly signal: AbortSignal;
+    readonly allowLoopbackHttp?: boolean;
+    readonly allowNativeLoopbackHttp?: boolean;
+}
+export declare class AppIndexedDbDeviceKeyProtectedStore implements AppDeviceKeyProtectedStore {
+    private readonly db;
+    private readonly source;
+    private readonly scope;
+    private readonly namespace;
+    private readonly origin;
+    private closed;
+    private readonly current;
+    private readonly owned;
+    private constructor();
+    static open(options: AppIndexedDbDeviceKeyOptions): Promise<AppIndexedDbDeviceKeyProtectedStore>;
+    private static openChecked;
+    private check;
+    read(namespace: string, options: {
+        signal: AbortSignal;
+    }): Promise<Uint8Array | null>;
+    create(namespace: string, encrypted: Uint8Array, options: {
+        signal: AbortSignal;
+    }): Promise<boolean>;
+    private transaction;
+    close(): void;
+}