@mdbase-dev/sdk 0.0.0-stage → 0.1.0-beta.149

package/dist/app-host/device-key-idb.js

@@ -0,0 +1,176 @@
+/** Bounded first-party original-device ciphertext IO. No CryptoKey/seed export,
+ * replacement, delete, generic KV, collection SQL or implicit recovery. */
+import { currentAppOrigin, isAppOrigin } from "./app-origin.js";
+import { uuidToBytes } from "../codec.js";
+const STORE = "original-device-keys", KEY = "custody", MAX = 256;
+const fail = () => new Error("app device key custody store unavailable");
+function bytes(value) {
+    if (!(value instanceof Uint8Array) || !value.length || value.length > MAX)
+        throw fail();
+    return new Uint8Array(value);
+}
+export class AppIndexedDbDeviceKeyProtectedStore {
+    db;
+    source;
+    scope;
+    namespace;
+    origin;
+    closed = false;
+    current;
+    owned;
+    constructor(db, source, scope, namespace, origin) {
+        this.db = db;
+        this.source = source;
+        this.scope = scope;
+        this.namespace = namespace;
+        this.origin = origin;
+        this.current = source.isCurrent;
+        this.owned = source.installationOwned;
+        db.onversionchange = () => this.close();
+    }
+    static async open(options) {
+        try {
+            return await this.openChecked(options);
+        }
+        catch {
+            throw fail();
+        }
+    }
+    static async openChecked(options) {
+        // Snapshot ALL option/scope/authority inputs before an IDB wait or upgrade.
+        const { source, signal, mode, origin } = options;
+        const scope = Object.freeze({ accountId: source.accountId, connectorId: source.connectorId, deviceId: source.deviceId, installationId: source.installationId });
+        const current = source.isCurrent, owned = source.installationOwned;
+        const isCurrent = () => { try {
+            return !signal.aborted && source.isCurrent === current && source.installationOwned === owned && current.call(source) === true && owned.call(source) === true && Object.keys(scope).every(k => source[k] === scope[k]);
+        }
+        catch {
+            return false;
+        } };
+        const ids = [scope.accountId, scope.connectorId, scope.deviceId, scope.installationId].map(v => { const b = uuidToBytes(v); if (b.every(v => v === 0))
+            throw fail(); return Array.from(b, v => v.toString(16).padStart(2, "0")).join(""); });
+        if (!isAppOrigin(origin, options.allowLoopbackHttp === true, options.allowNativeLoopbackHttp === true ? "native" : undefined) || currentAppOrigin() !== origin || !["fresh", "existing"].includes(mode) || !isCurrent() || !globalThis.indexedDB)
+            throw fail();
+        const namespace = `mdbase.app-device-keys.v1:${ids.join(":")}`, name = `mdbase.app.device-keys.v1.${ids.join(".")}`;
+        const db = await new Promise((resolve, reject) => {
+            const request = indexedDB.open(name, 1);
+            let abandoned = false;
+            const stop = () => { abandoned = true; reject(fail()); };
+            signal.addEventListener("abort", stop, { once: true });
+            const finish = () => signal.removeEventListener("abort", stop);
+            request.onblocked = stop;
+            request.onupgradeneeded = () => { if (abandoned || mode !== "fresh" || !isCurrent() || request.result.objectStoreNames.length !== 0) {
+                request.transaction?.abort();
+                return;
+            } request.result.createObjectStore(STORE); };
+            request.onerror = () => { finish(); reject(fail()); };
+            request.onsuccess = () => { finish(); if (abandoned || !isCurrent() || request.result.objectStoreNames.length !== 1 || !request.result.objectStoreNames.contains(STORE)) {
+                request.result.close();
+                reject(fail());
+                return;
+            } resolve(request.result); };
+        });
+        const out = new AppIndexedDbDeviceKeyProtectedStore(db, source, scope, namespace, origin);
+        try {
+            out.check(signal);
+            const record = await out.read(namespace, { signal });
+            try {
+                if ((mode === "fresh") !== (record === null))
+                    throw fail();
+                out.check(signal);
+                return out;
+            }
+            finally {
+                record?.fill(0);
+            }
+        }
+        catch {
+            out.close();
+            throw fail();
+        }
+    }
+    check(signal, namespace = this.namespace) {
+        try {
+            if (this.closed || signal.aborted || namespace !== this.namespace || currentAppOrigin() !== this.origin || this.source.isCurrent !== this.current || this.source.installationOwned !== this.owned || this.current.call(this.source) !== true || this.owned.call(this.source) !== true || Object.keys(this.scope).some(k => this.source[k] !== this.scope[k]))
+                throw fail();
+        }
+        catch {
+            throw fail();
+        }
+    }
+    async read(namespace, options) {
+        const result = await this.transaction("readonly", namespace, options.signal, null);
+        try {
+            this.check(options.signal, namespace);
+            return result;
+        }
+        catch {
+            if (result instanceof Uint8Array)
+                result.fill(0);
+            throw fail();
+        }
+    }
+    async create(namespace, encrypted, options) {
+        this.check(options.signal, namespace);
+        const value = bytes(encrypted);
+        try {
+            const result = await this.transaction("readwrite", namespace, options.signal, value);
+            this.check(options.signal, namespace);
+            return result === true;
+        }
+        finally {
+            value.fill(0);
+        }
+    }
+    transaction(mode, namespace, signal, next) {
+        return new Promise((resolve, reject) => {
+            this.check(signal, namespace);
+            const tx = this.db.transaction(STORE, mode, { durability: "strict" }), store = tx.objectStore(STORE);
+            let result = null, failed = false;
+            const abort = () => { failed = true; try {
+                tx.abort();
+            }
+            catch { /* possible committed result remains uncertain */ } };
+            const finish = () => signal.removeEventListener("abort", abort);
+            signal.addEventListener("abort", abort, { once: true });
+            tx.onabort = tx.onerror = () => { finish(); if (result instanceof Uint8Array)
+                result.fill(0); reject(fail()); };
+            tx.oncomplete = () => { finish(); try {
+                this.check(signal, namespace);
+                if (failed)
+                    throw fail();
+                resolve(result);
+            }
+            catch {
+                if (result instanceof Uint8Array)
+                    result.fill(0);
+                reject(fail());
+            } };
+            const request = store.get(KEY);
+            request.onsuccess = () => { let prior = null; try {
+                this.check(signal, namespace);
+                prior = request.result === undefined ? null : bytes(request.result);
+                if (mode === "readonly") {
+                    result = prior;
+                    prior = null;
+                }
+                else {
+                    result = prior === null;
+                    if (result === true && next !== null)
+                        store.add(new Uint8Array(next), KEY);
+                }
+            }
+            catch {
+                abort();
+            }
+            finally {
+                prior?.fill(0);
+            } };
+        });
+    }
+    close() { if (!this.closed) {
+        this.closed = true;
+        this.db.close();
+    } }
+}
+//# sourceMappingURL=device-key-idb.js.map

package/dist/app-host/device-key-idb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-key-idb.js","sourceRoot":"","sources":["../../src/app-host/device-key-idb.ts"],"names":[],"mappings":"AAAA;2EAC2E;AAC3E,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,KAAK,GAAC,sBAAsB,EAAE,GAAG,GAAC,SAAS,EAAE,GAAG,GAAC,GAAG,CAAC;AAC3D,MAAM,IAAI,GAAC,GAAE,EAAE,CAAA,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;AACrE,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAC,GAAG;QAAE,MAAM,IAAI,EAAE,CAAC;IACtF,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AASD,MAAM,OAAO,mCAAmC;IAIT;IAAkC;IACpD;IACA;IAAoC;IAL/C,MAAM,GAAC,KAAK,CAAC;IACJ,OAAO,CAAsC;IAC7C,KAAK,CAA8C;IACpE,YAAqC,EAAe,EAAmB,MAA8B,EAClF,KAA4F,EAC5F,SAAiB,EAAmB,MAAc;QAFhC,OAAE,GAAF,EAAE,CAAa;QAAmB,WAAM,GAAN,MAAM,CAAwB;QAClF,UAAK,GAAL,KAAK,CAAuF;QAC5F,cAAS,GAAT,SAAS,CAAQ;QAAmB,WAAM,GAAN,MAAM,CAAQ;QACnE,IAAI,CAAC,OAAO,GAAC,MAAM,CAAC,SAAS,CAAC;QAAC,IAAI,CAAC,KAAK,GAAC,MAAM,CAAC,iBAAiB,CAAC;QACnE,EAAE,CAAC,eAAe,GAAC,GAAE,EAAE,CAAA,IAAI,CAAC,KAAK,EAAE,CAAC;IACtC,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAqC;QACrD,IAAI,CAAC;YAAC,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,EAAE,CAAC;QAAC,CAAC;IACzE,CAAC;IACO,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAqC;QACpE,4EAA4E;QAC5E,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,IAAI,EAAC,MAAM,EAAC,GAAC,OAAO,CAAC;QAC1C,MAAM,KAAK,GAAC,MAAM,CAAC,MAAM,CAAC,EAAC,SAAS,EAAC,MAAM,CAAC,SAAS,EAAC,WAAW,EAAC,MAAM,CAAC,WAAW,EAAC,QAAQ,EAAC,MAAM,CAAC,QAAQ,EAAC,cAAc,EAAC,MAAM,CAAC,cAAc,EAAC,CAAC,CAAC;QACrJ,MAAM,OAAO,GAAC,MAAM,CAAC,SAAS,EAAC,KAAK,GAAC,MAAM,CAAC,iBAAiB,CAAC;QAC9D,MAAM,SAAS,GAAC,GAAE,EAAE,GAAC,IAAG,CAAC;YAAA,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,KAAG,OAAO,IAAI,MAAM,CAAC,iBAAiB,KAAG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAG,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAG,IAAI,IAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAA4B,CAAC,KAAK,CAAC,CAAC,CAAA,EAAE,CAAA,MAAM,CAAC,CAAC,CAAC,KAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAAA,CAAC;QAAA,MAAK,CAAC;YAAA,OAAO,KAAK,CAAC;QAAA,CAAC,CAAA,CAAC,CAAC;QACtR,MAAM,GAAG,GAAC,CAAC,KAAK,CAAC,SAAS,EAAC,KAAK,CAAC,WAAW,EAAC,KAAK,CAAC,QAAQ,EAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,GAAC,MAAM,CAAC,GAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA,IAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,KAAG,CAAC,CAAC;YAAC,MAAM,IAAI,EAAE,CAAC,CAAA,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,EAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;QACtN,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,iBAAiB,KAAG,IAAI,EAAE,OAAO,CAAC,uBAAuB,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,gBAAgB,EAAE,KAAG,MAAM,IAAI,CAAC,CAAC,OAAO,EAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS;YAAE,MAAM,IAAI,EAAE,CAAC;QAC1P,MAAM,SAAS,GAAC,6BAA6B,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAC,IAAI,GAAC,6BAA6B,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/G,MAAM,EAAE,GAAC,MAAM,IAAI,OAAO,CAAc,CAAC,OAAO,EAAC,MAAM,EAAC,EAAE;YACxD,MAAM,OAAO,GAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAC,CAAC,CAAC,CAAC;YAAA,IAAI,SAAS,GAAC,KAAK,CAAC;YACzD,MAAM,IAAI,GAAC,GAAE,EAAE,GAAC,SAAS,GAAC,IAAI,CAAC,CAAA,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA,CAAC,CAAC;YAChD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAC,IAAI,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC;YAAA,MAAM,MAAM,GAAC,GAAE,EAAE,CAAA,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAC,IAAI,CAAC,CAAC;YAC5G,OAAO,CAAC,SAAS,GAAC,IAAI,CAAC;YACvB,OAAO,CAAC,eAAe,GAAC,GAAE,EAAE,GAAC,IAAG,SAAS,IAAI,IAAI,KAAG,OAAO,IAAI,CAAC,SAAS,EAAE,IAAI,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAG,CAAC,EAAC,CAAC;gBAAA,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC;gBAAA,OAAO;YAAA,CAAC,CAAA,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAA,CAAC,CAAC;YAC1M,OAAO,CAAC,OAAO,GAAC,GAAE,EAAE,GAAC,MAAM,EAAE,CAAC,CAAA,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA,CAAC,CAAC;YAC/C,OAAO,CAAC,SAAS,GAAC,GAAE,EAAE,GAAC,MAAM,EAAE,CAAC,CAAA,IAAG,SAAS,IAAI,CAAC,SAAS,EAAE,IAAI,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAC,CAAC;gBAAA,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAAA,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBAAA,OAAO;YAAA,CAAC,CAAA,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA,CAAC,CAAC;QAC1O,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAC,IAAI,mCAAmC,CAAC,EAAE,EAAC,MAAM,EAAC,KAAK,EAAC,SAAS,EAAC,MAAM,CAAC,CAAC;QACpF,IAAI,CAAC;YAAA,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAAA,MAAM,MAAM,GAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,EAAC,EAAC,MAAM,EAAC,CAAC,CAAC;YAAA,IAAI,CAAC;gBAAA,IAAG,CAAC,IAAI,KAAG,OAAO,CAAC,KAAG,CAAC,MAAM,KAAG,IAAI,CAAC;oBAAC,MAAM,IAAI,EAAE,CAAC;gBAAA,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAAA,OAAO,GAAG,CAAC;YAAA,CAAC;oBAAO,CAAC;gBAAA,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAAA,CAAC;QAAA,CAAC;QAAA,MAAK,CAAC;YAAA,GAAG,CAAC,KAAK,EAAE,CAAC;YAAA,MAAM,IAAI,EAAE,CAAC;QAAA,CAAC;IACzN,CAAC;IACO,KAAK,CAAC,MAAmB,EAAE,SAAS,GAAC,IAAI,CAAC,SAAS;QACzD,IAAI,CAAC;YACH,IAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,SAAS,KAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,EAAE,KAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,KAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,KAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAG,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAG,IAAI,IAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAiC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAC,MAAM,IAAI,EAAE,CAAC;QAC5X,CAAC;QAAA,MAAK,CAAC;YAAA,MAAM,IAAI,EAAE,CAAC;QAAA,CAAC;IACvB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,OAA6B;QACzD,MAAM,MAAM,GAAC,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAC,SAAS,EAAC,OAAO,CAAC,MAAM,EAAC,IAAI,CAAC,CAAC;QAC9E,IAAI,CAAC;YAAA,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAC,SAAS,CAAC,CAAC;YAAA,OAAO,MAAyB,CAAC;QAAA,CAAC;QAAA,MAAK,CAAC;YAAA,IAAG,MAAM,YAAY,UAAU;gBAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAA,MAAM,IAAI,EAAE,CAAC;QAAA,CAAC;IACjJ,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,SAAqB,EAAE,OAA6B;QAClF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAC,SAAS,CAAC,CAAC;QAAA,MAAM,KAAK,GAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC;YAAA,MAAM,MAAM,GAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAC,SAAS,EAAC,OAAO,CAAC,MAAM,EAAC,KAAK,CAAC,CAAC;YAAA,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAC,SAAS,CAAC,CAAC;YAAA,OAAO,MAAM,KAAG,IAAI,CAAC;QAAA,CAAC;gBAAO,CAAC;YAAA,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAA,CAAC;IACzK,CAAC;IACO,WAAW,CAAC,IAAwB,EAAE,SAAiB,EAAE,MAAmB,EAAE,IAAqB;QACzG,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAC,MAAM,EAAC,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAC,SAAS,CAAC,CAAC;YAAA,MAAM,EAAE,GAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAC,IAAI,EAAC,EAAC,UAAU,EAAC,QAAQ,EAAC,CAAC,EAAC,KAAK,GAAC,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACxH,IAAI,MAAM,GAA0B,IAAI,EAAC,MAAM,GAAC,KAAK,CAAC;YACtD,MAAM,KAAK,GAAC,GAAE,EAAE,GAAC,MAAM,GAAC,IAAI,CAAC,CAAA,IAAG,CAAC;gBAAA,EAAE,CAAC,KAAK,EAAE,CAAC;YAAA,CAAC;YAAA,MAAK,CAAC,CAAA,iDAAiD,CAAA,CAAC,CAAA,CAAC,CAAC;YACvG,MAAM,MAAM,GAAC,GAAE,EAAE,CAAA,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAC,KAAK,CAAC,CAAC;YAC3D,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAC,KAAK,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC;YACnD,EAAE,CAAC,OAAO,GAAC,EAAE,CAAC,OAAO,GAAC,GAAE,EAAE,GAAC,MAAM,EAAE,CAAC,CAAA,IAAG,MAAM,YAAY,UAAU;gBAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA,CAAC,CAAC;YACpG,EAAE,CAAC,UAAU,GAAC,GAAE,EAAE,GAAC,MAAM,EAAE,CAAC,CAAA,IAAG,CAAC;gBAAA,IAAI,CAAC,KAAK,CAAC,MAAM,EAAC,SAAS,CAAC,CAAC;gBAAA,IAAG,MAAM;oBAAC,MAAM,IAAI,EAAE,CAAC;gBAAA,OAAO,CAAC,MAAM,CAAC,CAAC;YAAA,CAAC;YAAA,MAAK,CAAC;gBAAA,IAAG,MAAM,YAAY,UAAU;oBAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAA,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAAA,CAAC,CAAA,CAAC,CAAC;YAC5K,MAAM,OAAO,GAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO,CAAC,SAAS,GAAC,GAAE,EAAE,GAAC,IAAI,KAAK,GAAiB,IAAI,CAAC,CAAA,IAAG,CAAC;gBAAA,IAAI,CAAC,KAAK,CAAC,MAAM,EAAC,SAAS,CAAC,CAAC;gBAAA,KAAK,GAAC,OAAO,CAAC,MAAM,KAAG,SAAS,CAAA,CAAC,CAAA,IAAI,CAAA,CAAC,CAAA,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAAA,IAAG,IAAI,KAAG,UAAU,EAAC,CAAC;oBAAA,MAAM,GAAC,KAAK,CAAC;oBAAA,KAAK,GAAC,IAAI,CAAC;gBAAA,CAAC;qBAAI,CAAC;oBAAA,MAAM,GAAC,KAAK,KAAG,IAAI,CAAC;oBAAA,IAAG,MAAM,KAAG,IAAI,IAAI,IAAI,KAAG,IAAI;wBAAC,KAAK,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAC,GAAG,CAAC,CAAC;gBAAA,CAAC;YAAA,CAAC;YAAA,MAAK,CAAC;gBAAA,KAAK,EAAE,CAAC;YAAA,CAAC;oBAAO,CAAC;gBAAA,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAAA,CAAC,CAAA,CAAC,CAAC;QAC5U,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,KAAU,IAAG,CAAC,IAAI,CAAC,MAAM,EAAC,CAAC;QAAA,IAAI,CAAC,MAAM,GAAC,IAAI,CAAC;QAAA,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAAA,CAAC,CAAA,CAAC;CACpE"}

package/dist/app-host/device-key-provider.d.ts

@@ -0,0 +1,33 @@
+import type { AppDeviceKeyCustodyPin } from "./device-key-custody.js";
+export interface AppIndexedDbDeviceKeyProviderOptions {
+    readonly source: AppDeviceKeyCustodyPin;
+    readonly origin: string;
+    readonly mode: "fresh" | "existing";
+    readonly signal: AbortSignal;
+    /** Owned isolated loopback fixtures only, never arbitrary HTTP. */
+    readonly allowLoopbackHttp?: boolean;
+    readonly allowNativeLoopbackHttp?: boolean;
+}
+export declare class AppIndexedDbDeviceKeyProvider {
+    private readonly source;
+    private readonly origin;
+    private readonly lifetime;
+    private db;
+    private value;
+    private closed;
+    private loaned;
+    private readonly scope;
+    private readonly current;
+    private readonly owned;
+    private constructor();
+    static open(options: AppIndexedDbDeviceKeyProviderOptions): Promise<AppIndexedDbDeviceKeyProvider>;
+    private check;
+    private openDatabase;
+    private transaction;
+    /** Single first-party handle loan, for constructing original key + Noise
+     * custody under the SAME scope. No raw export/sign/DH or arbitrary KV. */
+    deviceCustodyKek(options: {
+        signal: AbortSignal;
+    }): CryptoKey;
+    close(): void;
+}

package/dist/app-host/device-key-provider.js

@@ -0,0 +1,181 @@
+/** First-party browser platform KEK, NOT a third-party grant/keychain API.
+ * Stores only a nonextractable CryptoKey, never raw KEK/device secrets. Same
+ * origin XSS can still invoke it; IDB/strict durability is not OS key isolation
+ * or a physical durability/Saved guarantee. Explicit fresh/existing only. */
+import { currentAppOrigin, isAppOrigin } from "./app-origin.js";
+import { uuidToBytes } from "../codec.js";
+const STORE = "device-key-kek", KEY = "original-device-kek";
+const fail = () => new Error("app device key provider unavailable; preserve storage and reopen");
+function key(value) {
+    // Genuine platform key handle, not metadata alone; IDB clones into this realm.
+    if (typeof globalThis.CryptoKey !== "function" || !(value instanceof CryptoKey) || value.type !== "secret" || value.extractable || value.algorithm.name !== "AES-GCM" || value.algorithm.length !== 256 || value.usages.length !== 2 || !value.usages.includes("encrypt") || !value.usages.includes("decrypt"))
+        throw fail();
+    return value;
+}
+function record(value) {
+    if (value === undefined)
+        return null;
+    if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).length !== 2 || !Object.hasOwn(value, "version") || !Object.hasOwn(value, "key") || value.version !== 1)
+        throw fail();
+    return key(value.key);
+}
+export class AppIndexedDbDeviceKeyProvider {
+    source;
+    origin;
+    lifetime;
+    db = null;
+    value = null;
+    closed = false;
+    loaned = false;
+    scope;
+    current;
+    owned;
+    constructor(source, origin, lifetime) {
+        this.source = source;
+        this.origin = origin;
+        this.lifetime = lifetime;
+        this.scope = Object.freeze({ accountId: source.accountId, connectorId: source.connectorId, deviceId: source.deviceId, installationId: source.installationId });
+        this.current = source.isCurrent;
+        this.owned = source.installationOwned;
+    }
+    static async open(options) {
+        let out = null;
+        try {
+            const { source, origin, mode, signal } = options;
+            out = new AppIndexedDbDeviceKeyProvider(source, origin, signal);
+            const ids = Object.values(out.scope).map(v => { const bytes = uuidToBytes(v); if (bytes.every(b => b === 0))
+                throw fail(); return Array.from(bytes, b => b.toString(16).padStart(2, "0")).join(""); });
+            if (!isAppOrigin(origin, options.allowLoopbackHttp === true, options.allowNativeLoopbackHttp === true ? "native" : undefined) || !["fresh", "existing"].includes(mode) || !globalThis.indexedDB || !globalThis.crypto?.subtle || typeof globalThis.CryptoKey !== "function")
+                throw fail();
+            out.check(signal);
+            const generate = crypto.subtle.generateKey.bind(crypto.subtle);
+            const name = `mdbase.app.device-key-kek.v1.${ids.join(".")}`;
+            const db = await out.openDatabase(name, mode);
+            out.db = db;
+            db.onversionchange = () => out.close();
+            out.check(signal);
+            const old = await out.transaction("readonly", signal, null);
+            out.check(signal);
+            if (mode === "existing") {
+                if (old === null || typeof old === "boolean")
+                    throw fail();
+                out.value = old;
+            }
+            else {
+                if (old !== null)
+                    throw fail();
+                const next = key(await generate({ name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]));
+                out.check(signal);
+                if (await out.transaction("readwrite", signal, next) !== true)
+                    throw fail();
+                out.check(signal);
+                out.value = next;
+            }
+            out.check(signal);
+            return out;
+        }
+        catch {
+            out?.close();
+            throw fail();
+        }
+    }
+    check(signal) {
+        try {
+            if (this.closed || this.lifetime.aborted || signal.aborted || currentAppOrigin() !== this.origin || this.source.isCurrent !== this.current || this.source.installationOwned !== this.owned || this.current.call(this.source) !== true || this.owned.call(this.source) !== true || Object.entries(this.scope).some(([k, v]) => this.source[k] !== v))
+                throw fail();
+        }
+        catch {
+            throw fail();
+        }
+    }
+    openDatabase(name, mode) {
+        return new Promise((resolve, reject) => {
+            this.check(this.lifetime);
+            const request = indexedDB.open(name, 1);
+            let abandoned = false, created = false;
+            const stop = () => { abandoned = true; reject(fail()); };
+            this.lifetime.addEventListener("abort", stop, { once: true });
+            const finish = () => this.lifetime.removeEventListener("abort", stop);
+            request.onblocked = stop;
+            request.onupgradeneeded = () => { try {
+                this.check(this.lifetime);
+                if (abandoned || mode !== "fresh" || request.result.objectStoreNames.length !== 0)
+                    throw fail();
+                request.result.createObjectStore(STORE);
+                created = true;
+            }
+            catch {
+                request.transaction?.abort();
+            } };
+            request.onerror = () => { finish(); reject(fail()); };
+            request.onsuccess = () => { finish(); try {
+                this.check(this.lifetime);
+                if (abandoned || (mode === "fresh" && !created) || request.result.objectStoreNames.length !== 1 || !request.result.objectStoreNames.contains(STORE))
+                    throw fail();
+                resolve(request.result);
+            }
+            catch {
+                request.result.close();
+                reject(fail());
+            } };
+        });
+    }
+    transaction(mode, signal, next) {
+        return new Promise((resolve, reject) => {
+            this.check(signal);
+            if (!this.db)
+                throw fail();
+            const tx = this.db.transaction(STORE, mode, { durability: "strict" }), store = tx.objectStore(STORE);
+            let result = null, failed = false;
+            const abort = () => { failed = true; try {
+                tx.abort();
+            }
+            catch { /* commit may already exist: preserve */ } };
+            signal.addEventListener("abort", abort, { once: true });
+            this.lifetime.addEventListener("abort", abort, { once: true });
+            const finish = () => { signal.removeEventListener("abort", abort); this.lifetime.removeEventListener("abort", abort); };
+            tx.onerror = tx.onabort = () => { finish(); result = null; reject(fail()); };
+            tx.oncomplete = () => { finish(); try {
+                this.check(signal);
+                if (failed)
+                    throw fail();
+                resolve(result);
+            }
+            catch {
+                result = null;
+                reject(fail());
+            } };
+            const request = store.get(KEY);
+            request.onsuccess = () => { try {
+                this.check(signal);
+                const old = record(request.result);
+                if (mode === "readonly")
+                    result = old;
+                else {
+                    result = old === null;
+                    if (result === true && next !== null)
+                        store.add({ version: 1, key: key(next) }, KEY);
+                }
+            }
+            catch {
+                abort();
+            } };
+        });
+    }
+    /** Single first-party handle loan, for constructing original key + Noise
+     * custody under the SAME scope. No raw export/sign/DH or arbitrary KV. */
+    deviceCustodyKek(options) {
+        this.check(options.signal);
+        if (this.loaned || !this.value)
+            throw fail();
+        this.loaned = true;
+        return key(this.value);
+    }
+    close() { if (!this.closed) {
+        this.closed = true;
+        this.value = null;
+        this.db?.close();
+        this.db = null;
+    } }
+}
+//# sourceMappingURL=device-key-provider.js.map

package/dist/app-host/device-key-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-key-provider.js","sourceRoot":"","sources":["../../src/app-host/device-key-provider.ts"],"names":[],"mappings":"AAAA;;;6EAG6E;AAC7E,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,KAAK,GAAC,gBAAgB,EAAC,GAAG,GAAC,qBAAqB,CAAC;AACvD,MAAM,IAAI,GAAC,GAAE,EAAE,CAAA,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;AAU7F,SAAS,GAAG,CAAC,KAAc;IACzB,+EAA+E;IAC/E,IAAG,OAAO,UAAU,CAAC,SAAS,KAAG,UAAU,IAAI,CAAC,CAAC,KAAK,YAAY,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,KAAG,QAAQ,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,KAAG,SAAS,IAAK,KAAK,CAAC,SAA6B,CAAC,MAAM,KAAG,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAC,MAAM,IAAI,EAAE,CAAC;IACtU,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAG,KAAK,KAAG,SAAS;QAAC,OAAO,IAAI,CAAC;IACjC,IAAG,CAAC,KAAK,IAAI,OAAO,KAAK,KAAG,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAC,KAAK,CAAC,IAAK,KAA2B,CAAC,OAAO,KAAG,CAAC;QAAC,MAAM,IAAI,EAAE,CAAC;IACzN,OAAO,GAAG,CAAE,KAAuB,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC;AACD,MAAM,OAAO,6BAA6B;IAQH;IAAgD;IAAgC;IAP7G,EAAE,GAAmB,IAAI,CAAC;IAC1B,KAAK,GAAiB,IAAI,CAAC;IAC3B,MAAM,GAAC,KAAK,CAAC;IACb,MAAM,GAAC,KAAK,CAAC;IACJ,KAAK,CAAwF;IAC7F,OAAO,CAAsC;IAC7C,KAAK,CAA8C;IACpE,YAAqC,MAA8B,EAAkB,MAAc,EAAkB,QAAqB;QAArG,WAAM,GAAN,MAAM,CAAwB;QAAkB,WAAM,GAAN,MAAM,CAAQ;QAAkB,aAAQ,GAAR,QAAQ,CAAa;QACxI,IAAI,CAAC,KAAK,GAAC,MAAM,CAAC,MAAM,CAAC,EAAC,SAAS,EAAC,MAAM,CAAC,SAAS,EAAC,WAAW,EAAC,MAAM,CAAC,WAAW,EAAC,QAAQ,EAAC,MAAM,CAAC,QAAQ,EAAC,cAAc,EAAC,MAAM,CAAC,cAAc,EAAC,CAAC,CAAC;QACpJ,IAAI,CAAC,OAAO,GAAC,MAAM,CAAC,SAAS,CAAC;QAAA,IAAI,CAAC,KAAK,GAAC,MAAM,CAAC,iBAAiB,CAAC;IACpE,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAA6C;QAC7D,IAAI,GAAG,GAAoC,IAAI,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,IAAI,EAAC,MAAM,EAAC,GAAC,OAAO,CAAC;YAC1C,GAAG,GAAC,IAAI,6BAA6B,CAAC,MAAM,EAAC,MAAM,EAAC,MAAM,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,GAAC,MAAM,KAAK,GAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA,IAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,KAAG,CAAC,CAAC;gBAAC,MAAM,IAAI,EAAE,CAAC,CAAA,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;YACnL,IAAG,CAAC,WAAW,CAAC,MAAM,EAAC,OAAO,CAAC,iBAAiB,KAAG,IAAI,EAAE,OAAO,CAAC,uBAAuB,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAE,CAAC,CAAC,OAAO,EAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAE,CAAC,UAAU,CAAC,SAAS,IAAE,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,IAAE,OAAO,UAAU,CAAC,SAAS,KAAG,UAAU;gBAAC,MAAM,IAAI,EAAE,CAAC;YAC1Q,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClB,MAAM,QAAQ,GAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAC,gCAAgC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,MAAM,EAAE,GAAC,MAAM,GAAG,CAAC,YAAY,CAAC,IAAI,EAAC,IAAI,CAAC,CAAC;YAAA,GAAG,CAAC,EAAE,GAAC,EAAE,CAAC;YACrD,EAAE,CAAC,eAAe,GAAC,GAAE,EAAE,CAAA,GAAI,CAAC,KAAK,EAAE,CAAC;YAAA,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACtD,MAAM,GAAG,GAAC,MAAM,GAAG,CAAC,WAAW,CAAC,UAAU,EAAC,MAAM,EAAC,IAAI,CAAC,CAAC;YAAA,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1E,IAAG,IAAI,KAAG,UAAU,EAAE,CAAC;gBAAA,IAAG,GAAG,KAAG,IAAI,IAAE,OAAO,GAAG,KAAG,SAAS;oBAAC,MAAM,IAAI,EAAE,CAAC;gBAAA,GAAG,CAAC,KAAK,GAAC,GAAG,CAAC;YAAA,CAAC;iBACpF,CAAC;gBACJ,IAAG,GAAG,KAAG,IAAI;oBAAC,MAAM,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,EAAC,IAAI,EAAC,SAAS,EAAC,MAAM,EAAC,GAAG,EAAC,EAAC,KAAK,EAAC,CAAC,SAAS,EAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAAA,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC1G,IAAG,MAAM,GAAG,CAAC,WAAW,CAAC,WAAW,EAAC,MAAM,EAAC,IAAI,CAAC,KAAG,IAAI;oBAAC,MAAM,IAAI,EAAE,CAAC;gBACtE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAAA,GAAG,CAAC,KAAK,GAAC,IAAI,CAAC;YACnC,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAAA,OAAO,GAAG,CAAC;QAC/B,CAAC;QAAA,MAAK,CAAC;YAAA,GAAG,EAAE,KAAK,EAAE,CAAC;YAAA,MAAM,IAAI,EAAE,CAAC;QAAA,CAAC;IACpC,CAAC;IACO,KAAK,CAAC,MAAmB;QAC/B,IAAI,CAAC;YACH,IAAG,IAAI,CAAC,MAAM,IAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAE,MAAM,CAAC,OAAO,IAAE,gBAAgB,EAAE,KAAG,IAAI,CAAC,MAAM,IAAE,IAAI,CAAC,MAAM,CAAC,SAAS,KAAG,IAAI,CAAC,OAAO,IAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,KAAG,IAAI,CAAC,KAAK,IAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAG,IAAI,IAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAG,IAAI,IAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC,EAAC,EAAE,CAAA,IAAI,CAAC,MAAM,CAAC,CAA4B,CAAC,KAAG,CAAC,CAAC;gBAAC,MAAM,IAAI,EAAE,CAAC;QAC9V,CAAC;QAAA,MAAK,CAAC;YAAA,MAAM,IAAI,EAAE,CAAC;QAAA,CAAC;IACvB,CAAC;IACO,YAAY,CAAC,IAAY,EAAC,IAAwB;QACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAC,MAAM,EAAC,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAA,MAAM,OAAO,GAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAC,CAAC,CAAC,CAAC;YAAA,IAAI,SAAS,GAAC,KAAK,EAAC,OAAO,GAAC,KAAK,CAAC;YACjG,MAAM,IAAI,GAAC,GAAE,EAAE,GAAC,SAAS,GAAC,IAAI,CAAC,CAAA,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA,CAAC,CAAC;YAChD,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAC,IAAI,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC;YAAA,MAAM,MAAM,GAAC,GAAE,EAAE,CAAA,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,OAAO,EAAC,IAAI,CAAC,CAAC;YAC1H,OAAO,CAAC,SAAS,GAAC,IAAI,CAAC;YACvB,OAAO,CAAC,eAAe,GAAC,GAAE,EAAE,GAAC,IAAG,CAAC;gBAAA,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAAA,IAAG,SAAS,IAAE,IAAI,KAAG,OAAO,IAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAG,CAAC;oBAAC,MAAM,IAAI,EAAE,CAAC;gBAAA,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAAA,OAAO,GAAC,IAAI,CAAC;YAAA,CAAC;YAAA,MAAK,CAAC;gBAAA,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC;YAAA,CAAC,CAAA,CAAC,CAAC;YAC7O,OAAO,CAAC,OAAO,GAAC,GAAE,EAAE,GAAC,MAAM,EAAE,CAAC,CAAA,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA,CAAC,CAAC;YAC/C,OAAO,CAAC,SAAS,GAAC,GAAE,EAAE,GAAC,MAAM,EAAE,CAAC,CAAA,IAAG,CAAC;gBAAA,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAAA,IAAG,SAAS,IAAE,CAAC,IAAI,KAAG,OAAO,IAAE,CAAC,OAAO,CAAC,IAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAG,CAAC,IAAE,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAC,MAAM,IAAI,EAAE,CAAC;gBAAA,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAAA,CAAC;YAAA,MAAK,CAAC;gBAAA,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAAA,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAAA,CAAC,CAAA,CAAC,CAAC;QAC5R,CAAC,CAAC,CAAC;IACL,CAAC;IACO,WAAW,CAAC,IAAwB,EAAC,MAAmB,EAAC,IAAoB;QACnF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAC,MAAM,EAAC,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAAA,IAAG,CAAC,IAAI,CAAC,EAAE;gBAAC,MAAM,IAAI,EAAE,CAAC;YAC5C,MAAM,EAAE,GAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAC,IAAI,EAAC,EAAC,UAAU,EAAC,QAAQ,EAAC,CAAC,EAAC,KAAK,GAAC,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAAA,IAAI,MAAM,GAAwB,IAAI,EAAC,MAAM,GAAC,KAAK,CAAC;YAC/I,MAAM,KAAK,GAAC,GAAE,EAAE,GAAC,MAAM,GAAC,IAAI,CAAC,CAAA,IAAG,CAAC;gBAAA,EAAE,CAAC,KAAK,EAAE,CAAC;YAAA,CAAC;YAAA,MAAK,CAAC,CAAA,wCAAwC,CAAA,CAAC,CAAA,CAAC,CAAC;YAC9F,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAC,KAAK,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC;YAAA,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAC,KAAK,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC;YAC7G,MAAM,MAAM,GAAC,GAAE,EAAE,GAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAC,KAAK,CAAC,CAAC,CAAA,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,OAAO,EAAC,KAAK,CAAC,CAAC,CAAA,CAAC,CAAC;YAC/G,EAAE,CAAC,OAAO,GAAC,EAAE,CAAC,OAAO,GAAC,GAAE,EAAE,GAAC,MAAM,EAAE,CAAC,CAAA,MAAM,GAAC,IAAI,CAAC,CAAA,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA,CAAC,CAAC;YACjE,EAAE,CAAC,UAAU,GAAC,GAAE,EAAE,GAAC,MAAM,EAAE,CAAC,CAAA,IAAG,CAAC;gBAAA,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAAA,IAAG,MAAM;oBAAC,MAAM,IAAI,EAAE,CAAC;gBAAA,OAAO,CAAC,MAAM,CAAC,CAAC;YAAA,CAAC;YAAA,MAAK,CAAC;gBAAA,MAAM,GAAC,IAAI,CAAC;gBAAA,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAAA,CAAC,CAAA,CAAC,CAAC;YAC/H,MAAM,OAAO,GAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO,CAAC,SAAS,GAAC,GAAE,EAAE,GAAC,IAAG,CAAC;gBAAA,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAAA,MAAM,GAAG,GAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAAA,IAAG,IAAI,KAAG,UAAU;oBAAC,MAAM,GAAC,GAAG,CAAC;qBAAI,CAAC;oBAAA,MAAM,GAAC,GAAG,KAAG,IAAI,CAAC;oBAAA,IAAG,MAAM,KAAG,IAAI,IAAE,IAAI,KAAG,IAAI;wBAAC,KAAK,CAAC,GAAG,CAAC,EAAC,OAAO,EAAC,CAAC,EAAC,GAAG,EAAC,GAAG,CAAC,IAAI,CAAC,EAAC,EAAC,GAAG,CAAC,CAAC;gBAAA,CAAC;YAAA,CAAC;YAAA,MAAK,CAAC;gBAAA,KAAK,EAAE,CAAC;YAAA,CAAC,CAAA,CAAC,CAAC;QAClO,CAAC,CAAC,CAAC;IACL,CAAC;IACD;8EAC0E;IAC1E,gBAAgB,CAAC,OAA6B;QAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAA,IAAG,IAAI,CAAC,MAAM,IAAE,CAAC,IAAI,CAAC,KAAK;YAAC,MAAM,IAAI,EAAE,CAAC;QAAA,IAAI,CAAC,MAAM,GAAC,IAAI,CAAC;QAAA,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9G,CAAC;IACD,KAAK,KAAU,IAAG,CAAC,IAAI,CAAC,MAAM,EAAC,CAAC;QAAA,IAAI,CAAC,MAAM,GAAC,IAAI,CAAC;QAAA,IAAI,CAAC,KAAK,GAAC,IAAI,CAAC;QAAA,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;QAAA,IAAI,CAAC,EAAE,GAAC,IAAI,CAAC;IAAA,CAAC,CAAA,CAAC;CAClG"}

package/dist/app-host/device-registration.d.ts

@@ -0,0 +1,51 @@
+import type { AppDeviceIdentityPin, AppDeviceRegistrationReceipt, AppNoiseCustodyResult, AppWasmRuntime } from "./wasm-runtime.js";
+export interface AppCpDeviceSession extends AppDeviceIdentityPin {
+    readonly cpOrigin: string;
+    /** Actual first-party platform: Capacitor mobile1, web app-runtime2. */
+    readonly kind: "mobile" | "app-runtime";
+    connectorBearer(options: {
+        signal: AbortSignal;
+    }): Promise<string>;
+}
+/** Platform-protected store; NO deletion/reset/retry surface. A successful
+ * write is NOT collection durability/Saved. Uncertain writes must be preserved. */
+export interface AppDeviceCustodyPersistence {
+    pending(envelope: Uint8Array, options: {
+        signal: AbortSignal;
+    }): Promise<void>;
+    registered(receipt: AppDeviceRegistrationReceipt, options: {
+        signal: AbortSignal;
+    }): Promise<void>;
+}
+export declare class AppDeviceRegistrationError extends Error {
+    readonly reason: "binding" | "fenced" | "unavailable" | "response";
+    constructor(reason: "binding" | "fenced" | "unavailable" | "response");
+}
+/** The runtime has already opened its DEVICE-only phase. Store opaque native
+ * custody BEFORE the single challenge/registration attempt; store the actual
+ * response's exact public receipt BEFORE permitting native collection adoption. */
+export declare class AppCpDeviceRegistration {
+    private readonly runtime;
+    private readonly session;
+    private readonly persistence;
+    private attempted;
+    private readonly lifetime;
+    private readonly origin;
+    private readonly rawOrigin;
+    private readonly scope;
+    private readonly custody;
+    private readonly now;
+    private readonly fetchImpl;
+    constructor(runtime: AppWasmRuntime, session: AppCpDeviceSession, custody: AppNoiseCustodyResult, persistence: AppDeviceCustodyPersistence, options?: {
+        fetch?: typeof globalThis.fetch;
+        now?: () => number;
+        allowLoopbackHttp?: boolean;
+    });
+    private current;
+    private check;
+    private json;
+    register(options: {
+        signal: AbortSignal;
+    }): Promise<AppDeviceRegistrationReceipt>;
+    close(): void;
+}

package/dist/app-host/device-registration.js

@@ -0,0 +1,180 @@
+/** First-party protected device registration ONLY. No collection bootstrap,
+ * private-enrol/create/SAS/Noise handshake, retry or provider activation. */
+import { LOCAL_APPLICATION_BUILD, localApplicationHttpOrigin } from "../application/local-build.js";
+import { uuidToBytes } from "../codec.js";
+export class AppDeviceRegistrationError extends Error {
+    reason;
+    constructor(reason) {
+        super(`app device registration: ${reason}`);
+        this.reason = reason;
+        this.name = "AppDeviceRegistrationError";
+    }
+}
+const fail = (r) => new AppDeviceRegistrationError(r);
+const hex = (b) => Array.from(b, v => v.toString(16).padStart(2, "0")).join("");
+/** The runtime has already opened its DEVICE-only phase. Store opaque native
+ * custody BEFORE the single challenge/registration attempt; store the actual
+ * response's exact public receipt BEFORE permitting native collection adoption. */
+export class AppCpDeviceRegistration {
+    runtime;
+    session;
+    persistence;
+    attempted = false;
+    lifetime = new AbortController();
+    origin;
+    rawOrigin;
+    scope;
+    custody;
+    now;
+    fetchImpl;
+    constructor(runtime, session, custody, persistence, options = {}) {
+        this.runtime = runtime;
+        this.session = session;
+        this.persistence = persistence;
+        try {
+            this.scope = Object.freeze({ connectorId: session.connectorId, deviceId: session.deviceId, installationId: session.installationId, kind: session.kind });
+            for (const id of [this.scope.connectorId, this.scope.deviceId, this.scope.installationId])
+                if (uuidToBytes(id).every(b => b === 0))
+                    throw fail("binding");
+            if (session.kind !== "mobile" && session.kind !== "app-runtime")
+                throw fail("binding");
+            this.rawOrigin = session.cpOrigin;
+            const u = new URL(this.rawOrigin);
+            if (u.username || u.password || u.pathname !== "/" || u.search || u.hash || (u.protocol !== "https:" && !(options.allowLoopbackHttp === true && u.protocol === "http:" && (LOCAL_APPLICATION_BUILD ? localApplicationHttpOrigin(this.rawOrigin) : ["localhost", "127.0.0.1", "[::1]"].includes(u.hostname)))))
+                throw fail("binding");
+            this.origin = u.origin;
+            this.now = options.now ?? Date.now;
+            this.fetchImpl = options.fetch ?? globalThis.fetch;
+            if (!(custody.envelope instanceof Uint8Array) || !custody.envelope.length || custody.envelope.length > 1024)
+                throw fail("binding");
+            if (!runtime.deviceCustodyCurrent(session, custody))
+                throw fail("binding");
+            this.custody = Object.freeze({ signPublicKey: new Uint8Array(custody.signPublicKey), kemPublicKey: new Uint8Array(custody.kemPublicKey), noisePublicKey: new Uint8Array(custody.noisePublicKey), envelope: new Uint8Array(custody.envelope) });
+            if (!this.current())
+                throw fail("binding");
+        }
+        catch {
+            runtime.retireLog();
+            throw fail("binding");
+        }
+    }
+    current() {
+        try {
+            return !this.lifetime.signal.aborted && this.runtime.deviceCustodyCurrent(this.session, this.custody) && this.session.isCurrent() === true && this.session.cpOrigin === this.rawOrigin && this.session.connectorId === this.scope.connectorId && this.session.deviceId === this.scope.deviceId && this.session.installationId === this.scope.installationId && this.session.kind === this.scope.kind;
+        }
+        catch {
+            return false;
+        }
+    }
+    check(signal) { if (!this.current() || signal.aborted) {
+        this.close();
+        throw fail("fenced");
+    } }
+    async json(path, bearer, body, parent) {
+        this.check(parent);
+        const ctrl = new AbortController(), abort = () => ctrl.abort(), timer = setTimeout(abort, 15_000);
+        timer.unref?.();
+        parent.addEventListener("abort", abort, { once: true });
+        this.lifetime.signal.addEventListener("abort", abort, { once: true });
+        const bytes = new Uint8Array(32 * 1024);
+        let count = 0, response = null, reader = null;
+        try {
+            const fetchImpl = this.fetchImpl;
+            response = await fetchImpl(`${this.origin}${path}`, { method: "POST", headers: { authorization: `Bearer ${bearer}`, ...(body === undefined ? {} : { "content-type": "application/json" }) }, body, signal: ctrl.signal, redirect: "error", credentials: "omit", cache: "default", referrerPolicy: "no-referrer" });
+            this.check(parent);
+            if (ctrl.signal.aborted || !response.ok)
+                throw fail("unavailable");
+            // Fetch's decoded stream is authoritative for the cap, not wire length.
+            const length = response.headers.get("content-length");
+            if (length !== null && /^(0|[1-9][0-9]*)$/.test(length) && Number(length) > bytes.length) {
+                ctrl.abort();
+                throw fail("response");
+            }
+            if (!response.body)
+                throw fail("response");
+            reader = response.body.getReader();
+            for (;;) {
+                const { done, value } = await reader.read();
+                try {
+                    this.check(parent);
+                    if (ctrl.signal.aborted)
+                        throw fail("unavailable");
+                    if (done)
+                        break;
+                    if (count + value.length > bytes.length) {
+                        ctrl.abort();
+                        throw fail("response");
+                    }
+                    bytes.set(value, count);
+                    count += value.length;
+                }
+                finally {
+                    value?.fill(0);
+                }
+            }
+            const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, count)));
+            if (!value || typeof value !== "object" || Array.isArray(value))
+                throw fail("response");
+            return value;
+        }
+        catch (e) {
+            this.check(parent);
+            if (e instanceof AppDeviceRegistrationError)
+                throw e;
+            throw fail("unavailable");
+        }
+        finally {
+            bytes.fill(0);
+            void (reader?.cancel() ?? response?.body?.cancel())?.catch(() => { });
+            reader?.releaseLock();
+            clearTimeout(timer);
+            parent.removeEventListener("abort", abort);
+            this.lifetime.signal.removeEventListener("abort", abort);
+        }
+    }
+    async register(options) {
+        let challenge = null, signature = null;
+        try {
+            this.check(options.signal);
+            if (this.attempted)
+                throw fail("fenced");
+            this.attempted = true;
+            await this.persistence.pending(new Uint8Array(this.custody.envelope), options);
+            this.check(options.signal);
+            const bearer = await this.session.connectorBearer(options);
+            this.check(options.signal);
+            if (typeof bearer !== "string" || !bearer || bearer.length > 16 * 1024 || /[^\x21-\x7e]/.test(bearer))
+                throw fail("binding");
+            const issued = await this.json("/v1/next/devices/challenge", bearer, undefined, options.signal);
+            this.check(options.signal);
+            if (typeof issued.challenge !== "string" || !/^[0-9a-f]{64}$/.test(issued.challenge) || typeof issued.expires_at !== "number" || !Number.isSafeInteger(issued.expires_at) || issued.expires_at - this.now() <= 5000 || issued.expires_at - this.now() > 16 * 60_000)
+                throw fail("response");
+            challenge = Uint8Array.from(issued.challenge.match(/../g).map(v => parseInt(v, 16)));
+            const proof = this.runtime.signCpEnrol(challenge);
+            this.check(options.signal);
+            signature = proof.signature;
+            const result = await this.json("/v1/next/devices", bearer, JSON.stringify({ device_id: this.scope.deviceId, kind: this.scope.kind, capabilities: ["collection_mode_switch_v1"], challenge: issued.challenge, sign_pk: hex(proof.signPublicKey), kem_pk: hex(proof.kemPublicKey), noise_pk: hex(proof.noisePublicKey), sig: hex(signature) }), options.signal);
+            this.check(options.signal);
+            if (result.device_id !== this.scope.deviceId)
+                throw fail("response");
+            const receipt = Object.freeze({ connectorId: this.scope.connectorId, deviceId: this.scope.deviceId, installationId: this.scope.installationId, signPublicKey: new Uint8Array(proof.signPublicKey), kemPublicKey: new Uint8Array(proof.kemPublicKey), noisePublicKey: new Uint8Array(proof.noisePublicKey) });
+            await this.persistence.registered(receipt, options);
+            this.check(options.signal);
+            this.runtime.acknowledgeDeviceRegistration(receipt);
+            return receipt;
+        }
+        catch (e) {
+            this.close();
+            if (e instanceof AppDeviceRegistrationError)
+                throw e;
+            throw fail("unavailable");
+        }
+        finally {
+            challenge?.fill(0);
+            signature?.fill(0);
+        }
+    }
+    close() { if (this.lifetime.signal.aborted)
+        return; this.lifetime.abort(); this.custody.envelope.fill(0); this.runtime.retireLog(); }
+}
+//# sourceMappingURL=device-registration.js.map