@mdbase-dev/sdk 0.0.0-stage → 0.1.0-beta.149

package/dist/app-grant/setup-attempt.d.ts

@@ -0,0 +1,12 @@
+import type { AppGrantStore, StoredAppGrant } from "./grant-store.js";
+export interface PrivateSetupJournal {
+    load(): Promise<string | undefined>;
+    begin(mid: string): Promise<string>;
+    clear(mid: string): Promise<void>;
+}
+export declare function protectedSetupJournal(input: {
+    store(): Promise<AppGrantStore>;
+    grant(): Promise<StoredAppGrant>;
+    assertCurrent(grant: StoredAppGrant): Promise<unknown>;
+    aad: Uint8Array;
+}): PrivateSetupJournal;

package/dist/app-grant/setup-attempt.js

@@ -0,0 +1,62 @@
+/** An encrypted original-MID register, deliberately NOT an ordinary write/replay journal. */
+import { mdbaseError } from "../errors.js";
+const uuid = /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/;
+export function protectedSetupJournal(input) {
+    const aad = new Uint8Array([...input.aad, ...new TextEncoder().encode("\0declared-setup-attempt-v1")]);
+    const fail = () => mdbaseError("unavailable", "Protected Native setup attempt storage is unavailable.", "grant_storage");
+    async function context() {
+        const grant = await input.grant();
+        await input.assertCurrent(grant);
+        const store = await input.store();
+        if (!store.getSetupAttempt || !store.putSetupAttemptIfAbsent || !store.deleteSetupAttempt)
+            throw fail();
+        return { grant, store };
+    }
+    async function decode(bytes, grant) {
+        let plain;
+        try {
+            if (bytes.length < 29 || bytes.length > 2048)
+                throw fail();
+            plain = new Uint8Array(await crypto.subtle.decrypt({ name: "AES-GCM", iv: bytes.slice(0, 12), additionalData: aad }, grant.refreshKey, bytes.slice(12)));
+            const row = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(plain));
+            const noise = Array.from(grant.noisePublicKey, b => b.toString(16).padStart(2, "0")).join("");
+            if (row.version !== 1 || !uuid.test(row.mid) || row.noise !== noise || Object.keys(row).sort().join(",") !== "mid,noise,version")
+                throw fail();
+            await input.assertCurrent(grant);
+            return row.mid;
+        }
+        catch {
+            throw fail();
+        }
+        finally {
+            plain?.fill(0);
+        }
+    }
+    return {
+        async load() { const { grant, store } = await context(), b = await store.getSetupAttempt(grant.collection); await input.assertCurrent(grant); return b ? decode(b, grant) : undefined; },
+        async begin(mid) {
+            if (!uuid.test(mid))
+                throw fail();
+            const { grant, store } = await context(), iv = crypto.getRandomValues(new Uint8Array(12));
+            const plain = new TextEncoder().encode(JSON.stringify({ version: 1, mid, noise: Array.from(grant.noisePublicKey, b => b.toString(16).padStart(2, "0")).join("") }));
+            let encrypted;
+            try {
+                encrypted = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: aad }, grant.refreshKey, plain));
+            }
+            finally {
+                plain.fill(0);
+            }
+            await input.assertCurrent(grant);
+            const result = await store.putSetupAttemptIfAbsent(grant.collection, new Uint8Array([...iv, ...encrypted]));
+            return decode(result, grant);
+        },
+        async clear(mid) {
+            const { grant, store } = await context(), b = await store.getSetupAttempt(grant.collection);
+            if (b && await decode(b, grant) === mid) {
+                await input.assertCurrent(grant);
+                await store.deleteSetupAttempt(grant.collection, b);
+            }
+        },
+    };
+}
+//# sourceMappingURL=setup-attempt.js.map

package/dist/app-grant/setup-attempt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-attempt.js","sourceRoot":"","sources":["../../src/app-grant/setup-attempt.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAO3C,MAAM,IAAI,GAAC,+CAA+C,CAAC;AAC3D,MAAM,UAAU,qBAAqB,CAAC,KAErC;IACC,MAAM,GAAG,GAAC,IAAI,UAAU,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,EAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC;IACpG,MAAM,IAAI,GAAC,GAAE,EAAE,CAAA,WAAW,CAAC,aAAa,EAAC,wDAAwD,EAAC,eAAe,CAAC,CAAC;IACnH,KAAK,UAAU,OAAO;QACpB,MAAM,KAAK,GAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,KAAK,GAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAChC,IAAG,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,KAAK,CAAC,kBAAkB;YAAE,MAAM,IAAI,EAAE,CAAC;QACvG,OAAO,EAAC,KAAK,EAAC,KAAK,EAAC,CAAC;IACvB,CAAC;IACD,KAAK,UAAU,MAAM,CAAC,KAAgB,EAAC,KAAoB;QACzD,IAAI,KAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,IAAG,KAAK,CAAC,MAAM,GAAC,EAAE,IAAI,KAAK,CAAC,MAAM,GAAC,IAAI;gBAAE,MAAM,IAAI,EAAE,CAAC;YACtD,KAAK,GAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAC,IAAI,EAAC,SAAS,EAAC,EAAE,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAC,EAAE,CAAC,EAAC,cAAc,EAAC,GAAG,EAAC,EAAC,KAAK,CAAC,UAAU,EAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7I,MAAM,GAAG,GAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAC,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1E,MAAM,KAAK,GAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxF,IAAG,GAAG,CAAC,OAAO,KAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,KAAG,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAG,mBAAmB;gBAAE,MAAM,IAAI,EAAE,CAAC;YACxI,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,GAAG,CAAC,GAAG,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YAAA,MAAM,IAAI,EAAE,CAAC;QAAA,CAAC;gBAAS,CAAC;YAAA,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAAA,CAAC;IACnD,CAAC;IACD,OAAO;QACL,KAAK,CAAC,IAAI,KAAG,MAAM,EAAC,KAAK,EAAC,KAAK,EAAC,GAAC,MAAM,OAAO,EAAE,EAAE,CAAC,GAAC,MAAM,KAAK,CAAC,eAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA,CAAC,CAAA,MAAM,CAAC,CAAC,EAAC,KAAK,CAAC,CAAA,CAAC,CAAA,SAAS,CAAC,CAAA,CAAC;QAC1K,KAAK,CAAC,KAAK,CAAC,GAAG;YACb,IAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,EAAE,CAAC;YACjC,MAAM,EAAC,KAAK,EAAC,KAAK,EAAC,GAAC,MAAM,OAAO,EAAE,EAAC,EAAE,GAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YAClF,MAAM,KAAK,GAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,OAAO,EAAC,CAAC,EAAC,GAAG,EAAC,KAAK,EAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAC,CAAC,CAAC,CAAC;YACxJ,IAAI,SAAoB,CAAC;YACzB,IAAI,CAAC;gBAAA,SAAS,GAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAC,IAAI,EAAC,SAAS,EAAC,EAAE,EAAC,cAAc,EAAC,GAAG,EAAC,EAAC,KAAK,CAAC,UAAU,EAAC,KAAK,CAAC,CAAC,CAAC;YAAA,CAAC;oBAAQ,CAAC;gBAAA,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAA,CAAC;YACnJ,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,MAAM,GAAC,MAAM,KAAK,CAAC,uBAAwB,CAAC,KAAK,CAAC,UAAU,EAAC,IAAI,UAAU,CAAC,CAAC,GAAG,EAAE,EAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACzG,OAAO,MAAM,CAAC,MAAM,EAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG;YACb,MAAM,EAAC,KAAK,EAAC,KAAK,EAAC,GAAC,MAAM,OAAO,EAAE,EAAC,CAAC,GAAC,MAAM,KAAK,CAAC,eAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACrF,IAAG,CAAC,IAAI,MAAM,MAAM,CAAC,CAAC,EAAC,KAAK,CAAC,KAAG,GAAG,EAAC,CAAC;gBAAA,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAAA,MAAM,KAAK,CAAC,kBAAmB,CAAC,KAAK,CAAC,UAAU,EAAC,CAAC,CAAC,CAAC;YAAA,CAAC;QAC7H,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/app-grant/setup-producer.d.ts

@@ -0,0 +1,31 @@
+/** Native's bounded review DTO is data, never app-side setup authority. */
+import { type CborValue } from "../cbor.js";
+import { type AppResourceAssessment } from "../app-host/collection-control.js";
+import { type Receipt } from "../wire.js";
+import type { Session } from "../session.js";
+export declare const hex: (b: Uint8Array) => string;
+export declare function hashBytes(s: string): Uint8Array;
+export interface NativeSetupReview {
+    readonly kind: "review";
+    readonly ticket: Uint8Array;
+    readonly revision: Uint8Array;
+    readonly assessment: AppResourceAssessment;
+    readonly declaration: string;
+    readonly application: string;
+    readonly promoted: number;
+    readonly retained: number;
+    readonly records: readonly {
+        path: string;
+        action: "create" | "skip";
+    }[];
+}
+export type NativeSetupReply = NativeSetupReview | {
+    kind: "pending";
+    ticket: Uint8Array;
+} | {
+    kind: "receipt";
+    receipt: Receipt;
+} | {
+    kind: "cancelled";
+};
+export declare function setupRequest(s: Session, action: string, fields: readonly (readonly [number, CborValue])[], signal?: AbortSignal): Promise<NativeSetupReply>;

package/dist/app-grant/setup-producer.js

@@ -0,0 +1,65 @@
+/** Native's bounded review DTO is data, never app-side setup authority. */
+import { decode, encode, Float64 } from "../cbor.js";
+import { mdbaseError } from "../errors.js";
+import { resourceAssessment } from "../app-host/collection-control.js";
+import { receipt } from "../wire.js";
+const bad = () => mdbaseError("internal", "Invalid Native setup reply.", "declared_setup_codec");
+export const hex = (b) => Array.from(b, v => v.toString(16).padStart(2, "0")).join("");
+export function hashBytes(s) {
+    if (!/^sha256:[a-f0-9]{64}$/.test(s))
+        throw bad();
+    return Uint8Array.from(s.slice(7).match(/../g), v => parseInt(v, 16));
+}
+function numeric(v) { if (!(v instanceof Map) || [...v.keys()].some(k => typeof k !== "number"))
+    throw bad(); return v; }
+function fixed(v, n) { if (!(v instanceof Uint8Array) || v.length !== n)
+    throw bad(); return v.slice(); }
+function object(v) {
+    if (v instanceof Float64)
+        return v.value;
+    if (v instanceof Map) {
+        if ([...v.keys()].some(k => typeof k !== "string"))
+            throw bad();
+        return Object.fromEntries([...v].map(([k, x]) => [k, object(x)]));
+    }
+    if (Array.isArray(v))
+        return v.map(object);
+    if (v === null || ["string", "boolean", "number"].includes(typeof v))
+        return v;
+    throw bad();
+}
+export async function setupRequest(s, action, fields, signal) {
+    const input = encode(new Map([[0, 1], [1, action], ...fields].sort(([a], [b]) => Number(a) - Number(b))));
+    let bytes;
+    try {
+        bytes = await s.declaredSetup(input, signal);
+        const m = numeric(decode(bytes));
+        if (m.get(0) !== 1)
+            throw bad();
+        const kind = m.get(1), expected = kind === "review" ? [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10] : kind === "pending" ? [0, 1, 2] : kind === "receipt" ? [0, 1, 3] : kind === "cancelled" ? [0, 1] : [];
+        if (m.size !== expected.length || expected.some(k => !m.has(k)))
+            throw bad();
+        if (kind === "cancelled")
+            return { kind };
+        if (kind === "receipt")
+            return { kind, receipt: receipt.dec(m.get(3)) };
+        const ticket = fixed(m.get(2), 16);
+        if (kind === "pending")
+            return { kind, ticket };
+        if (kind !== "review" || !["ready", "setup_required", "incompatible"].includes(m.get(3)) || typeof m.get(8) !== "string")
+            throw bad();
+        const impact = numeric(m.get(9)), rows = m.get(10);
+        if (!(impact instanceof Map) || impact.size !== 2 || ![impact.get(0), impact.get(1)].every(n => Number.isSafeInteger(n) && Number(n) >= 0 && Number(n) <= 256) || !Array.isArray(rows) || rows.length > 32)
+            throw bad();
+        const records = rows.map(row => { const r = numeric(row); if (r.size !== 2 || typeof r.get(0) !== "string" || !["create", "skip"].includes(r.get(1)))
+            throw bad(); return Object.freeze({ path: r.get(0), action: r.get(1) }); });
+        return { kind, ticket, revision: fixed(m.get(4), 32), declaration: hex(fixed(m.get(7), 32)), application: m.get(8),
+            promoted: impact.get(0), retained: impact.get(1), records: Object.freeze(records),
+            assessment: resourceAssessment({ status: m.get(3) === "ready" ? "current" : m.get(3) === "incompatible" ? "conflict" : "provision", assessmentDigest: "sha256:" + hex(fixed(m.get(5), 32)), review: object(m.get(6)) }, true) };
+    }
+    finally {
+        input.fill(0);
+        bytes?.fill(0);
+    }
+}
+//# sourceMappingURL=setup-producer.js.map

package/dist/app-grant/setup-producer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-producer.js","sourceRoot":"","sources":["../../src/app-grant/setup-producer.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAkB,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAA8B,MAAM,mCAAmC,CAAC;AACnG,OAAO,EAAE,OAAO,EAAgB,MAAM,YAAY,CAAC;AAEnD,MAAM,GAAG,GAAC,GAAE,EAAE,CAAA,WAAW,CAAC,UAAU,EAAC,6BAA6B,EAAC,sBAAsB,CAAC,CAAC;AAC3F,MAAM,CAAC,MAAM,GAAG,GAAC,CAAC,CAAY,EAAC,EAAE,CAAA,KAAK,CAAC,IAAI,CAAC,CAAC,EAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC1F,MAAM,UAAU,SAAS,CAAC,CAAQ;IAChC,IAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,GAAG,EAAE,CAAC;IACjD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAE,EAAC,CAAC,CAAA,EAAE,CAAA,QAAQ,CAAC,CAAC,EAAC,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC;AACD,SAAS,OAAO,CAAC,CAAqB,IAAwB,IAAG,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,IAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,OAAO,CAAC,KAAG,QAAQ,CAAC;IAAC,MAAM,GAAG,EAAE,CAAC,CAAA,OAAO,CAA0B,CAAC,CAAA,CAAC;AAChL,SAAS,KAAK,CAAC,CAAqB,EAAC,CAAQ,IAAc,IAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,IAAE,CAAC,CAAC,MAAM,KAAG,CAAC;IAAC,MAAM,GAAG,EAAE,CAAC,CAAA,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA,CAAC;AACrI,SAAS,MAAM,CAAC,CAAW;IACzB,IAAG,CAAC,YAAY,OAAO;QAAC,OAAO,CAAC,CAAC,KAAK,CAAC;IACvC,IAAG,CAAC,YAAY,GAAG,EAAC,CAAC;QAAA,IAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,OAAO,CAAC,KAAG,QAAQ,CAAC;YAAC,MAAM,GAAG,EAAE,CAAC;QAAA,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC,EAAC,EAAE,CAAA,CAAC,CAAC,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAAA,CAAC;IAC9I,IAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,IAAG,CAAC,KAAG,IAAI,IAAI,CAAC,QAAQ,EAAC,SAAS,EAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAC1E,MAAM,GAAG,EAAE,CAAC;AACd,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,CAAS,EAAC,MAAa,EAAC,MAA+C,EAAC,MAAmB;IAC5H,MAAM,KAAK,GAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC,EAAC,CAAC,CAAC,EAAC,MAAM,CAAC,EAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC,CAAC,EAAC,EAAE,CAAA,MAAM,CAAC,CAAC,CAAC,GAAC,MAAM,CAAC,CAAC,CAAC,CAAyB,CAAC,CAAC,CAAC;IACvH,IAAI,KAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,KAAK,GAAC,MAAM,CAAC,CAAC,aAAa,CAAC,KAAK,EAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAC,IAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAG,CAAC;YAAC,MAAM,GAAG,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAC,QAAQ,GAAC,IAAI,KAAG,QAAQ,CAAA,CAAC,CAAA,CAAC,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,EAAE,CAAC,CAAA,CAAC,CAAA,IAAI,KAAG,SAAS,CAAA,CAAC,CAAA,CAAC,CAAC,EAAC,CAAC,EAAC,CAAC,CAAC,CAAA,CAAC,CAAA,IAAI,KAAG,SAAS,CAAA,CAAC,CAAA,CAAC,CAAC,EAAC,CAAC,EAAC,CAAC,CAAC,CAAA,CAAC,CAAA,IAAI,KAAG,WAAW,CAAA,CAAC,CAAA,CAAC,CAAC,EAAC,CAAC,CAAC,CAAA,CAAC,CAAA,EAAE,CAAC;QACpJ,IAAG,CAAC,CAAC,IAAI,KAAG,QAAQ,CAAC,MAAM,IAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM,GAAG,EAAE,CAAC;QACrE,IAAG,IAAI,KAAG,WAAW;YAAE,OAAO,EAAC,IAAI,EAAC,CAAC;QACrC,IAAG,IAAI,KAAG,SAAS;YAAC,OAAO,EAAC,IAAI,EAAC,OAAO,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,EAAC,CAAC;QACjE,MAAM,MAAM,GAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAC,EAAE,CAAC,CAAC;QAChC,IAAG,IAAI,KAAG,SAAS;YAAC,OAAO,EAAC,IAAI,EAAC,MAAM,EAAC,CAAC;QACzC,IAAG,IAAI,KAAG,QAAQ,IAAE,CAAC,CAAC,OAAO,EAAC,gBAAgB,EAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAW,CAAC,IAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAG,QAAQ;YAAC,MAAM,GAAG,EAAE,CAAC;QACpI,MAAM,MAAM,GAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAC,IAAI,GAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAG,CAAC,CAAC,MAAM,YAAY,GAAG,CAAC,IAAE,MAAM,CAAC,IAAI,KAAG,CAAC,IAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA,EAAE,CAAA,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAE,MAAM,CAAC,CAAC,CAAC,IAAE,CAAC,IAAE,MAAM,CAAC,CAAC,CAAC,IAAE,GAAG,CAAC,IAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAE,IAAI,CAAC,MAAM,GAAC,EAAE;YAAC,MAAM,GAAG,EAAE,CAAC;QAC/L,MAAM,OAAO,GAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA,EAAE,GAAC,MAAM,CAAC,GAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA,IAAG,CAAC,CAAC,IAAI,KAAG,CAAC,IAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAG,QAAQ,IAAE,CAAC,CAAC,QAAQ,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAW,CAAC;YAAC,MAAM,GAAG,EAAE,CAAC,CAAA,OAAO,MAAM,CAAC,MAAM,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAW,EAAC,MAAM,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAoB,EAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;QAC/O,OAAO,EAAC,IAAI,EAAC,MAAM,EAAC,QAAQ,EAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAC,EAAE,CAAC,EAAC,WAAW,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAC,EAAE,CAAC,CAAC,EAAC,WAAW,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAW;YAChH,QAAQ,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAW,EAAC,QAAQ,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAW,EAAC,OAAO,EAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;YAChG,UAAU,EAAC,kBAAkB,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAG,OAAO,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAG,cAAc,CAAA,CAAC,CAAA,UAAU,CAAA,CAAC,CAAA,WAAW,EAAC,gBAAgB,EAAC,SAAS,GAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAC,EAAE,CAAC,CAAC,EAAC,MAAM,EAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,EAAC,EAAC,IAAI,CAAC,EAAC,CAAC;IAC5M,CAAC;YAAQ,CAAC;QAAA,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAA,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAAA,CAAC;AAC1C,CAAC"}

package/dist/app-grant/setup.d.ts

@@ -0,0 +1,11 @@
+import { type MdbaseSetupPlan, type MdbaseSetupPlanOptions } from "../application/setup.js";
+export type MdbasePrivateSetupStatus = "ready" | "setup_required" | "incompatible";
+export interface MdbasePrivateSetup {
+    assess(options?: {
+        signal?: AbortSignal;
+    }): Promise<MdbasePrivateSetupStatus>;
+    plan(options?: MdbaseSetupPlanOptions): Promise<MdbaseSetupPlan>;
+    apply(plan: MdbaseSetupPlan, options?: {
+        signal?: AbortSignal;
+    }): Promise<MdbasePrivateSetupStatus>;
+}

package/dist/app-grant/setup.js

@@ -0,0 +1,222 @@
+import { MdbaseError, isMdbaseError, mdbaseError } from "../errors.js";
+import { uuidToBytes } from "../codec.js";
+import { isReplicaResponseProblem } from "../session.js";
+import { resourceDecisions } from "../app-host/collection-control.js";
+import { setupPlan, setupRecords } from "../application/setup.js";
+import { manifestDigest } from "../application/registration.js";
+import { hashBytes, setupRequest } from "./setup-producer.js";
+const changed = (mid, cause) => new MdbaseError(mdbaseError("conflict", "This collection changed since setup was reviewed. Review it again.", "setup_changed").toProblem(), { ...(mid ? { mutationId: mid } : {}), ...(cause ? { cause } : {}) });
+const unknown = (mid, cause) => new MdbaseError(mdbaseError("outcome_unknown", "Reconcile the original setup before trying again.", "setup_outcome_unknown").toProblem(), { mutationId: mid, ...(cause ? { cause } : {}) });
+const unavailable = () => mdbaseError("unavailable", "Native setup is unavailable.", "resource_setup_unavailable");
+function pause(signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted)
+            return reject(mdbaseError("cancelled", "Setup cancelled."));
+        const abort = () => { clearTimeout(timer); reject(mdbaseError("cancelled", "Setup cancelled.")); };
+        const timer = setTimeout(() => { signal?.removeEventListener("abort", abort); resolve(); }, 100);
+        signal?.addEventListener("abort", abort, { once: true });
+    });
+}
+/** @internal Construction neither activates nor replaces the held grant. */
+export function privateCollectionSetup(input) {
+    const { client, journal } = input;
+    const declared = input.operations.includes("assess_collection_setup") && input.operations.includes("apply_collection_setup");
+    const plans = new WeakMap();
+    const noops = new WeakSet();
+    let busy = false;
+    async function exclusive(work) { if (busy)
+        throw mdbaseError("rate_limited", "A setup operation is already running."); busy = true; try {
+        return await work();
+    }
+    finally {
+        busy = false;
+    } }
+    async function fence(s, signal) { if (!s)
+        await client.readyForRead(signal); await input.assertCurrent(); if (signal?.aborted)
+        throw mdbaseError("cancelled", "Setup cancelled."); if (s && (s.closed || client.currentSession() !== s))
+        throw changed(); }
+    async function cancel(s, ticket) { try {
+        await setupRequest(s, "cancel", [[2, ticket]], AbortSignal.timeout(1000));
+    }
+    catch { /* no write is issued by cancel */ } }
+    async function native(options = {}) {
+        await fence(undefined, options.signal);
+        const s = await client.readyForRead(options.signal);
+        await fence(s, options.signal);
+        const expected = await manifestDigest(input.manifest);
+        await fence(s, options.signal);
+        const decisions = resourceDecisions(options.adopt === undefined ? {} : { adopt: options.adopt }), records = setupRecords(options.records);
+        const fields = [];
+        if (decisions.adopt && Object.keys(decisions.adopt).length)
+            fields.push([3, new Map(Object.entries(decisions.adopt).map(([p, h]) => [p, hashBytes(h)]))]);
+        if (records.length)
+            fields.push([4, records.map(r => new Map([[0, r.path], [1, r.document]]))]);
+        let ticket;
+        try {
+            let reply = await setupRequest(s, "assess", fields, options.signal);
+            await fence(s, options.signal);
+            for (let polls = 0; reply.kind === "pending"; polls++) {
+                ticket = reply.ticket;
+                if (polls >= 512)
+                    throw unavailable();
+                await pause(options.signal);
+                await fence(s, options.signal);
+                reply = await setupRequest(s, "poll", [[2, ticket]], options.signal);
+                await fence(s, options.signal);
+            }
+            if (reply.kind !== "review")
+                throw unavailable();
+            ticket = reply.ticket;
+            if (reply.declaration !== expected || reply.application !== input.manifest?.id)
+                throw changed();
+            if (reply.records.length !== records.length || reply.records.some((r, i) => r.path !== records[i].path))
+                throw unavailable();
+            return { s, review: reply, options: { records, ...(decisions.adopt ? { adopt: Object.freeze({ ...decisions.adopt }) } : {}) } };
+        }
+        catch (e) {
+            if (ticket)
+                await cancel(s, ticket);
+            throw e;
+        }
+    }
+    async function reconcile(signal) {
+        await fence(undefined, signal);
+        const mid = await journal.load();
+        await fence(undefined, signal);
+        if (!mid)
+            return;
+        let r;
+        try {
+            r = await client.receipt(mid, signal);
+        }
+        catch (e) {
+            throw unknown(mid, e);
+        }
+        await fence(undefined, signal);
+        if (r.mutation !== mid || (r.state !== "confirmed" && r.state !== "rejected"))
+            throw unknown(mid);
+        await journal.clear(mid);
+    }
+    const api = {
+        async assess(options = {}) {
+            const p = await api.plan(options), bound = plans.get(p);
+            // Assessment does not return a usable plan: release its original review,
+            // rather than occupying Native\'s bounded slot until the next page expires.
+            if (bound) {
+                await cancel(bound.session, bound.review.ticket);
+                await fence(bound.session, options.signal);
+            }
+            return p.status === "current" ? "ready" : p.status === "conflict" ? "incompatible" : "setup_required";
+        },
+        async plan(options = {}) {
+            return exclusive(async () => {
+                await fence(undefined, options.signal);
+                if (!declared) {
+                    if (input.operations.includes("apply_collection_setup") || input.operations.includes("assess_collection_setup"))
+                        throw unavailable();
+                    const empty = setupPlan({ status: "current", assessmentDigest: `sha256:${"0".repeat(64)}`, review: { configuration: [], packs: [], staged: [] } }, { canManage: false, canCreateRecords: false, records: [] });
+                    noops.add(empty);
+                    return empty;
+                }
+                await reconcile(options.signal);
+                const { s, review, options: original } = await native(options);
+                let result = setupPlan(review.assessment, { canManage: true, canCreateRecords: s.hello.grant.capabilities.includes("records.create"), records: review.records.map(r => ({ path: r.path, free: r.action === "create" })) });
+                if (review.promoted) {
+                    const changes = Object.freeze([...result.changes, { kind: "record", target: "Existing files", message: `Recognize ${review.promoted} existing ${review.promoted === 1 ? "file" : "files"} as notes, preserving their contents.` }]);
+                    result = Object.freeze({ ...result, changes, summary: `This app will make ${changes.length} ${changes.length === 1 ? "change" : "changes"} to this collection.` });
+                }
+                plans.set(result, { session: s, review, options: original, consumed: false });
+                return result;
+            });
+        },
+        async apply(plan, options = {}) {
+            return exclusive(async () => {
+                if (noops.has(plan)) {
+                    await fence(undefined, options.signal);
+                    return "ready";
+                }
+                let bound = plans.get(plan);
+                if (!bound)
+                    throw new TypeError("setup.apply needs the original plan returned by setup.plan");
+                if (bound.consumed)
+                    throw changed();
+                if (plan.refusal)
+                    throw mdbaseError(plan.refusal.code === "setup_conflict" ? "conflict" : "forbidden", plan.refusal.message, plan.refusal.code);
+                await fence(bound.session, options.signal);
+                if (plan.status === "current") {
+                    const after = await native({ signal: options.signal });
+                    await cancel(after.s, after.review.ticket);
+                    if (after.review.assessment.status !== "current")
+                        throw changed();
+                    return "ready";
+                }
+                bound.consumed = true;
+                for (let retry = 0;; retry++) {
+                    const mid = crypto.randomUUID();
+                    let original;
+                    try {
+                        original = await journal.begin(mid);
+                    }
+                    catch (e) {
+                        throw unknown(mid, e);
+                    }
+                    if (original !== mid)
+                        throw unknown(original);
+                    let dispatched = false, terminal = false;
+                    try {
+                        await fence(bound.session, options.signal);
+                        dispatched = true;
+                        const reply = await setupRequest(bound.session, "apply", [[2, bound.review.ticket], [3, uuidToBytes(mid)], [4, bound.review.revision], [5, hashBytes(plan.digest)]], options.signal);
+                        await input.assertCurrent();
+                        if (reply.kind !== "receipt" || reply.receipt.mutation !== mid)
+                            throw unknown(mid);
+                        const r = reply.receipt.state === "pending" ? await client.awaitReceipt(mid, 30_000, options.signal) : reply.receipt;
+                        await input.assertCurrent();
+                        if (r.mutation !== mid || (r.state !== "confirmed" && r.state !== "rejected"))
+                            throw unknown(mid);
+                        terminal = true;
+                        await journal.clear(mid);
+                        if (r.state === "rejected" || (r.conflicts?.length ?? 0) > 0 || r.status !== undefined && r.status !== "applied")
+                            throw changed(mid, r.problem);
+                        const after = await native({ signal: options.signal });
+                        if (after.review.assessment.status !== "current")
+                            throw unavailable();
+                        await cancel(after.s, after.review.ticket);
+                        return "ready";
+                    }
+                    catch (e) {
+                        if (!dispatched || terminal || isReplicaResponseProblem(e) && e.code !== "outcome_unknown") {
+                            await journal.clear(mid);
+                            // Only a certified pre-mutation refusal permits a fresh attempt.
+                            // Another plan can retire this ticket without changing its consented work.
+                            if (!terminal && isReplicaResponseProblem(e) && e.code === "not_found") {
+                                if (retry)
+                                    throw changed(mid, e);
+                                await fence(bound.session, options.signal);
+                                const fresh = await native({ ...bound.options, signal: options.signal });
+                                try {
+                                    await fence(bound.session, options.signal);
+                                    if (fresh.s !== bound.session || fresh.review.assessment.assessmentDigest !== plan.digest
+                                        || fresh.review.assessment.status !== "provision"
+                                        || fresh.review.promoted !== bound.review.promoted || fresh.review.retained !== bound.review.retained
+                                        || fresh.review.records.some((r, i) => r.action !== bound.review.records[i]?.action))
+                                        throw changed(mid, e);
+                                }
+                                catch (error) {
+                                    await cancel(fresh.s, fresh.review.ticket);
+                                    throw error;
+                                }
+                                bound = { ...bound, review: fresh.review };
+                                continue;
+                            }
+                            throw new MdbaseError((isMdbaseError(e) ? e : changed()).toProblem(), { mutationId: mid, cause: e });
+                        }
+                        throw unknown(mid, e);
+                    }
+                }
+            });
+        },
+    };
+    return Object.freeze(api);
+}
+//# sourceMappingURL=setup.js.map

package/dist/app-grant/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../src/app-grant/setup.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAC,wBAAwB,EAAe,MAAM,eAAe,CAAC;AAErE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAqD,MAAM,yBAAyB,CAAC;AACrH,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,YAAY,EAA0B,MAAM,qBAAqB,CAAC;AActF,MAAM,OAAO,GAAC,CAAC,GAAW,EAAC,KAAc,EAAC,EAAE,CAAA,IAAI,WAAW,CAAC,WAAW,CAAC,UAAU,EAAC,oEAAoE,EAAC,eAAe,CAAC,CAAC,SAAS,EAAE,EAAC,EAAC,GAAG,CAAC,GAAG,CAAA,CAAC,CAAA,EAAC,UAAU,EAAC,GAAG,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,GAAG,CAAC,KAAK,CAAA,CAAC,CAAA,EAAC,KAAK,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,CAAC,CAAC;AAC3O,MAAM,OAAO,GAAC,CAAC,GAAU,EAAC,KAAc,EAAC,EAAE,CAAA,IAAI,WAAW,CAAC,WAAW,CAAC,iBAAiB,EAAC,mDAAmD,EAAC,uBAAuB,CAAC,CAAC,SAAS,EAAE,EAAC,EAAC,UAAU,EAAC,GAAG,EAAC,GAAG,CAAC,KAAK,CAAA,CAAC,CAAA,EAAC,KAAK,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,CAAC,CAAC;AAC1N,MAAM,WAAW,GAAC,GAAE,EAAE,CAAA,WAAW,CAAC,aAAa,EAAC,8BAA8B,EAAC,4BAA4B,CAAC,CAAC;AAC7G,SAAS,KAAK,CAAC,MAAmB;IAAgB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAC,MAAM,EAAC,EAAE;QACrF,IAAG,MAAM,EAAE,OAAO;YAAC,OAAO,MAAM,CAAC,WAAW,CAAC,WAAW,EAAC,kBAAkB,CAAC,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAC,GAAE,EAAE,GAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA,MAAM,CAAC,WAAW,CAAC,WAAW,EAAC,kBAAkB,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAC,UAAU,CAAC,GAAE,EAAE,GAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAC,KAAK,CAAC,CAAC,CAAA,OAAO,EAAE,CAAC,CAAA,CAAC,EAAC,GAAG,CAAC,CAAC;QACxF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAC,KAAK,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AAAA,CAAC;AACJ,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB,CAAC,KAAuB;IAC5D,MAAM,EAAC,MAAM,EAAC,OAAO,EAAC,GAAC,KAAK,CAAC;IAC7B,MAAM,QAAQ,GAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,yBAAyB,CAAC,IAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IACzH,MAAM,KAAK,GAAC,IAAI,OAAO,EAA8G,CAAC;IACtI,MAAM,KAAK,GAAC,IAAI,OAAO,EAAmB,CAAC;IAC3C,IAAI,IAAI,GAAC,KAAK,CAAC;IACf,KAAK,UAAU,SAAS,CAAI,IAAmB,IAAa,IAAG,IAAI;QAAC,MAAM,WAAW,CAAC,cAAc,EAAC,uCAAuC,CAAC,CAAC,CAAA,IAAI,GAAC,IAAI,CAAC,CAAA,IAAG,CAAC;QAAA,OAAO,MAAM,IAAI,EAAE,CAAC;IAAA,CAAC;YAAO,CAAC;QAAA,IAAI,GAAC,KAAK,CAAC;IAAA,CAAC,CAAA,CAAC;IACtM,KAAK,UAAU,KAAK,CAAC,CAAU,EAAC,MAAmB,IAAE,IAAG,CAAC,CAAC;QAAC,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC,CAAA,IAAG,MAAM,EAAE,OAAO;QAAC,MAAM,WAAW,CAAC,WAAW,EAAC,kBAAkB,CAAC,CAAC,CAAA,IAAG,CAAC,IAAE,CAAC,CAAC,CAAC,MAAM,IAAE,MAAM,CAAC,cAAc,EAAE,KAAG,CAAC,CAAC;QAAC,MAAM,OAAO,EAAE,CAAC,CAAA,CAAC;IAC7P,KAAK,UAAU,MAAM,CAAC,CAAS,EAAC,MAAiB,IAAE,IAAG,CAAC;QAAA,MAAM,YAAY,CAAC,CAAC,EAAC,QAAQ,EAAC,CAAC,CAAC,CAAC,EAAC,MAAM,CAAC,CAAC,EAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAAA,CAAC;IAAA,MAAK,CAAC,CAAA,kCAAkC,CAAA,CAAC,CAAA,CAAC;IACxK,KAAK,UAAU,MAAM,CAAC,UAA+B,EAAE;QACrD,MAAM,KAAK,CAAC,SAAS,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,GAAC,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAA,MAAM,KAAK,CAAC,CAAC,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChF,MAAM,QAAQ,GAAC,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAAA,MAAM,KAAK,CAAC,CAAC,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClF,MAAM,SAAS,GAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,KAAG,SAAS,CAAA,CAAC,CAAA,EAAE,CAAA,CAAC,CAAA,EAAC,KAAK,EAAC,OAAO,CAAC,KAAK,EAAC,CAAC,EAAC,OAAO,GAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5H,MAAM,MAAM,GAAsB,EAAE,CAAC;QACrC,IAAG,SAAS,CAAC,KAAK,IAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC,EAAC,EAAE,CAAA,CAAC,CAAC,EAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClJ,IAAG,OAAO,CAAC,MAAM;YAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,IAAI,GAAG,CAAmB,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC,IAAI,CAAC,EAAC,CAAC,CAAC,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1G,IAAI,MAA2B,CAAC;QAChC,IAAG,CAAC;YACF,IAAI,KAAK,GAAC,MAAM,YAAY,CAAC,CAAC,EAAC,QAAQ,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAAA,MAAM,KAAK,CAAC,CAAC,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7F,KAAI,IAAI,KAAK,GAAC,CAAC,EAAC,KAAK,CAAC,IAAI,KAAG,SAAS,EAAC,KAAK,EAAE,EAAC,CAAC;gBAC9C,MAAM,GAAC,KAAK,CAAC,MAAM,CAAC;gBAAA,IAAG,KAAK,IAAE,GAAG;oBAAC,MAAM,WAAW,EAAE,CAAC;gBACtD,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAAA,MAAM,KAAK,CAAC,CAAC,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC1D,KAAK,GAAC,MAAM,YAAY,CAAC,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC,CAAC,EAAC,MAAM,CAAC,CAAC,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAAA,MAAM,KAAK,CAAC,CAAC,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/F,CAAC;YACD,IAAG,KAAK,CAAC,IAAI,KAAG,QAAQ;gBAAC,MAAM,WAAW,EAAE,CAAC;YAAA,MAAM,GAAC,KAAK,CAAC,MAAM,CAAC;YACjE,IAAG,KAAK,CAAC,WAAW,KAAG,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAI,KAAK,CAAC,QAA0B,EAAE,EAAE;gBAAC,MAAM,OAAO,EAAE,CAAC;YAC7G,IAAG,KAAK,CAAC,OAAO,CAAC,MAAM,KAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAC,CAAC,EAAC,EAAE,CAAA,CAAC,CAAC,IAAI,KAAG,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC;gBAAC,MAAM,WAAW,EAAE,CAAC;YACrH,OAAO,EAAC,CAAC,EAAC,MAAM,EAAC,KAAK,EAAC,OAAO,EAAC,EAAC,OAAO,EAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAA,CAAC,CAAA,EAAC,KAAK,EAAC,MAAM,CAAC,MAAM,CAAC,EAAC,GAAG,SAAS,CAAC,KAAK,EAAC,CAAC,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,EAAC,CAAC;QAChH,CAAC;QAAA,OAAM,CAAC,EAAC,CAAC;YAAA,IAAG,MAAM;gBAAC,MAAM,MAAM,CAAC,CAAC,EAAC,MAAM,CAAC,CAAC;YAAA,MAAM,CAAC,CAAC;QAAA,CAAC;IACtD,CAAC;IACD,KAAK,UAAU,SAAS,CAAC,MAAmB;QAC1C,MAAM,KAAK,CAAC,SAAS,EAAC,MAAM,CAAC,CAAC;QAAA,MAAM,GAAG,GAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAAA,MAAM,KAAK,CAAC,SAAS,EAAC,MAAM,CAAC,CAAC;QAAA,IAAG,CAAC,GAAG;YAAC,OAAO;QAC1G,IAAI,CAAS,CAAC;QAAA,IAAG,CAAC;YAAA,CAAC,GAAC,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAC,MAAM,CAAC,CAAC;QAAA,CAAC;QAAA,OAAM,CAAC,EAAC,CAAC;YAAA,MAAM,OAAO,CAAC,GAAG,EAAC,CAAC,CAAC,CAAC;QAAA,CAAC;QACrF,MAAM,KAAK,CAAC,SAAS,EAAC,MAAM,CAAC,CAAC;QAC9B,IAAG,CAAC,CAAC,QAAQ,KAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,KAAG,WAAW,IAAE,CAAC,CAAC,KAAK,KAAG,UAAU,CAAC;YAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QACxF,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,GAAG,GAAoB;QAC3B,KAAK,CAAC,MAAM,CAAC,OAAO,GAAC,EAAE;YACrB,MAAM,CAAC,GAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAC,KAAK,GAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACnD,yEAAyE;YACzE,4EAA4E;YAC5E,IAAG,KAAK,EAAC,CAAC;gBAAA,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,EAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAAA,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAAA,CAAC;YACrG,OAAO,CAAC,CAAC,MAAM,KAAG,SAAS,CAAA,CAAC,CAAA,OAAO,CAAA,CAAC,CAAA,CAAC,CAAC,MAAM,KAAG,UAAU,CAAA,CAAC,CAAA,cAAc,CAAA,CAAC,CAAA,gBAAgB,CAAC;QAC5F,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,GAAC,EAAE;YAAE,OAAO,SAAS,CAAC,KAAK,IAAE,EAAE;gBAC/C,MAAM,KAAK,CAAC,SAAS,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACtC,IAAG,CAAC,QAAQ,EAAC,CAAC;oBAAA,IAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,yBAAyB,CAAC;wBAAC,MAAM,WAAW,EAAE,CAAC;oBAAA,MAAM,KAAK,GAAC,SAAS,CAAC,EAAC,MAAM,EAAC,SAAS,EAAC,gBAAgB,EAAC,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAC,MAAM,EAAC,EAAC,aAAa,EAAC,EAAE,EAAC,KAAK,EAAC,EAAE,EAAC,MAAM,EAAC,EAAE,EAAC,EAAC,EAAC,EAAC,SAAS,EAAC,KAAK,EAAC,gBAAgB,EAAC,KAAK,EAAC,OAAO,EAAC,EAAE,EAAC,CAAC,CAAC;oBAAA,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;oBAAA,OAAO,KAAK,CAAC;gBAAA,CAAC;gBACrW,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAAA,MAAM,EAAC,CAAC,EAAC,MAAM,EAAC,OAAO,EAAC,QAAQ,EAAC,GAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;gBACxF,IAAI,MAAM,GAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,gBAAgB,EAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAC,OAAO,EAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC,MAAM,KAAG,QAAQ,EAAC,CAAC,CAAC,EAAC,CAAC,CAAC;gBACxM,IAAG,MAAM,CAAC,QAAQ,EAAC,CAAC;oBAAA,MAAM,OAAO,GAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,EAAC,EAAC,IAAI,EAAC,QAAiB,EAAC,MAAM,EAAC,gBAAgB,EAAC,OAAO,EAAC,aAAa,MAAM,CAAC,QAAQ,aAAa,MAAM,CAAC,QAAQ,KAAG,CAAC,CAAA,CAAC,CAAA,MAAM,CAAA,CAAC,CAAA,OAAO,uCAAuC,EAAC,CAAC,CAAC,CAAC;oBAAA,MAAM,GAAC,MAAM,CAAC,MAAM,CAAC,EAAC,GAAG,MAAM,EAAC,OAAO,EAAC,OAAO,EAAC,sBAAsB,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAG,CAAC,CAAA,CAAC,CAAA,QAAQ,CAAA,CAAC,CAAA,SAAS,sBAAsB,EAAC,CAAC,CAAC;gBAAA,CAAC;gBACxY,KAAK,CAAC,GAAG,CAAC,MAAM,EAAC,EAAC,OAAO,EAAC,CAAC,EAAC,MAAM,EAAC,OAAO,EAAC,QAAQ,EAAC,QAAQ,EAAC,KAAK,EAAC,CAAC,CAAC;gBAAA,OAAO,MAAM,CAAC;YACrF,CAAC,CAAC,CAAC;QAAA,CAAC;QACJ,KAAK,CAAC,KAAK,CAAC,IAAI,EAAC,OAAO,GAAC,EAAE;YAAE,OAAO,SAAS,CAAC,KAAK,IAAE,EAAE;gBACrD,IAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAC,CAAC;oBAAA,MAAM,KAAK,CAAC,SAAS,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBAAA,OAAO,OAAgB,CAAC;gBAAA,CAAC;gBACnF,IAAI,KAAK,GAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAAA,IAAG,CAAC,KAAK;oBAAC,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;gBACtH,IAAG,KAAK,CAAC,QAAQ;oBAAC,MAAM,OAAO,EAAE,CAAC;gBAClC,IAAG,IAAI,CAAC,OAAO;oBAAC,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAG,gBAAgB,CAAA,CAAC,CAAA,UAAU,CAAA,CAAC,CAAA,WAAW,EAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACtI,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAAA,IAAG,IAAI,CAAC,MAAM,KAAG,SAAS,EAAC,CAAC;oBAAA,MAAM,KAAK,GAAC,MAAM,MAAM,CAAC,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,CAAC,CAAC;oBAAA,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,EAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBAAA,IAAG,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,KAAG,SAAS;wBAAC,MAAM,OAAO,EAAE,CAAC;oBAAA,OAAO,OAAgB,CAAC;gBAAA,CAAC;gBACzP,KAAK,CAAC,QAAQ,GAAC,IAAI,CAAC;gBACpB,KAAI,IAAI,KAAK,GAAC,CAAC,GAAE,KAAK,EAAE,EAAC,CAAC;oBACxB,MAAM,GAAG,GAAC,MAAM,CAAC,UAAU,EAAE,CAAC;oBAAA,IAAI,QAAe,CAAC;oBAAA,IAAG,CAAC;wBAAA,QAAQ,GAAC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAAA,CAAC;oBAAA,OAAM,CAAC,EAAC,CAAC;wBAAA,MAAM,OAAO,CAAC,GAAG,EAAC,CAAC,CAAC,CAAC;oBAAA,CAAC;oBAAA,IAAG,QAAQ,KAAG,GAAG;wBAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;oBAClK,IAAI,UAAU,GAAC,KAAK,EAAC,QAAQ,GAAC,KAAK,CAAC;oBACpC,IAAG,CAAC;wBACF,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;wBAAA,UAAU,GAAC,IAAI,CAAC;wBAC1D,MAAM,KAAK,GAAC,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAC,OAAO,EAAC,CAAC,CAAC,CAAC,EAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAC,CAAC,CAAC,EAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAC,CAAC,CAAC,EAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAC,CAAC,CAAC,EAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;wBACzK,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;wBAAA,IAAG,KAAK,CAAC,IAAI,KAAG,SAAS,IAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAG,GAAG;4BAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;wBACvG,MAAM,CAAC,GAAC,KAAK,CAAC,OAAO,CAAC,KAAK,KAAG,SAAS,CAAA,CAAC,CAAA,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,CAAC,CAAA,CAAC,CAAA,KAAK,CAAC,OAAO,CAAC;wBAC3G,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;wBAC5B,IAAG,CAAC,CAAC,QAAQ,KAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,KAAG,WAAW,IAAE,CAAC,CAAC,KAAK,KAAG,UAAU,CAAC;4BAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;wBACxF,QAAQ,GAAC,IAAI,CAAC;wBAAA,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;wBACvC,IAAG,CAAC,CAAC,KAAK,KAAG,UAAU,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,IAAE,CAAC,CAAC,GAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAG,SAAS,IAAE,CAAC,CAAC,MAAM,KAAG,SAAS;4BAAC,MAAM,OAAO,CAAC,GAAG,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC;wBACjI,MAAM,KAAK,GAAC,MAAM,MAAM,CAAC,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,CAAC,CAAC;wBAClD,IAAG,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,KAAG,SAAS;4BAAC,MAAM,WAAW,EAAE,CAAC;wBAClE,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,EAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;wBAC1C,OAAO,OAAgB,CAAC;oBAC1B,CAAC;oBAAA,OAAM,CAAC,EAAC,CAAC;wBACR,IAAG,CAAC,UAAU,IAAI,QAAQ,IAAI,wBAAwB,CAAC,CAAC,CAAC,IAAE,CAAC,CAAC,IAAI,KAAG,iBAAiB,EAAC,CAAC;4BACrF,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;4BACzB,iEAAiE;4BACjE,2EAA2E;4BAC3E,IAAG,CAAC,QAAQ,IAAE,wBAAwB,CAAC,CAAC,CAAC,IAAE,CAAC,CAAC,IAAI,KAAG,WAAW,EAAC,CAAC;gCAC/D,IAAG,KAAK;oCAAC,MAAM,OAAO,CAAC,GAAG,EAAC,CAAC,CAAC,CAAC;gCAC9B,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gCAC1C,MAAM,KAAK,GAAC,MAAM,MAAM,CAAC,EAAC,GAAG,KAAK,CAAC,OAAO,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,CAAC,CAAC;gCACnE,IAAG,CAAC;oCACF,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oCAC1C,IAAG,KAAK,CAAC,CAAC,KAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,KAAG,IAAI,CAAC,MAAM;2CAC/E,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,KAAG,WAAW;2CAC5C,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAG,KAAK,CAAC,MAAM,CAAC,QAAQ;2CAC9F,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAC,CAAC,EAAC,EAAE,CAAA,CAAC,CAAC,MAAM,KAAG,KAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;wCAAC,MAAM,OAAO,CAAC,GAAG,EAAC,CAAC,CAAC,CAAC;gCAC1G,CAAC;gCAAA,OAAM,KAAK,EAAC,CAAC;oCAAA,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,EAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oCAAA,MAAM,KAAK,CAAC;gCAAA,CAAC;gCACrE,KAAK,GAAC,EAAC,GAAG,KAAK,EAAC,MAAM,EAAC,KAAK,CAAC,MAAM,EAAC,CAAC;gCAAA,SAAS;4BAChD,CAAC;4BACD,MAAM,IAAI,WAAW,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA,CAAC,CAAA,CAAC,CAAA,CAAC,CAAA,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,EAAC,EAAC,UAAU,EAAC,GAAG,EAAC,KAAK,EAAC,CAAC,EAAC,CAAC,CAAC;wBAC7F,CAAC;wBACD,MAAM,OAAO,CAAC,GAAG,EAAC,CAAC,CAAC,CAAC;oBACvB,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;QAAA,CAAC;KACL,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}

package/dist/app-host/app-environment.d.ts

@@ -0,0 +1,27 @@
+/** Explicit first-party build environment. This validates the public output of
+ * the shared build verifier; it does NOT authenticate arbitrary caller context.
+ * Release manifest/tool/asset authentication must precede this selection. */
+import type { AppBundledReleaseTrust } from "./cloud-copy-bootstrap.js";
+export interface AppEnvironmentSelection {
+    readonly environment: "lab" | "staging" | "production" | "local";
+    readonly appOrigin: string;
+    readonly cpOrigin: string;
+    readonly logOrigin: string;
+    readonly assetSha256: string;
+    readonly allowLoopbackHttp: boolean;
+    /** Native app-origin storage only; never CP/log HTTP or test trust. */
+    readonly allowNativeLoopbackHttp: boolean;
+}
+/** No environment or app-origin default. CP/log origins come only from the
+ * preauthenticated build release, whose environment must match exactly.
+ * LAB app loopback is explicit; production loopback requires a native manifest.
+ * Same-origin storage preservation is an app gate, not a runtime fallback. */
+export declare function selectAppEnvironment(input: {
+    environment: "lab" | "staging" | "production" | "local";
+    appOrigin: string;
+    platform?: "native";
+    release: AppBundledReleaseTrust;
+}): AppEnvironmentSelection;
+/** Only a previously validated immutable selection, not a copied/redirect object.
+ * Not a hostile same-origin JS boundary or native grant/READ authority. */
+export declare function isAppEnvironmentSelection(value: unknown): value is AppEnvironmentSelection;

package/dist/app-host/app-environment.js

@@ -0,0 +1,48 @@
+import { isAppOrigin } from "./app-origin.js";
+import { applicationEnvironmentAllowed, applicationLoopbackAllowed, LOCAL_APPLICATION_BUILD, localApplicationHttpOrigin, localApplicationEnvironment, localApplicationOrigin } from "../application/local-build.js";
+const selections = new WeakSet();
+const invalid = () => new Error("app environment: explicit authenticated build context required");
+function origin(value, loopbackAllowed) {
+    if (typeof value !== "string" || !value.length)
+        throw invalid();
+    const u = new URL(value);
+    const loopback = loopbackAllowed && u.protocol === "http:" && (LOCAL_APPLICATION_BUILD ? localApplicationHttpOrigin(value) : ["127.0.0.1", "localhost", "[::1]"].includes(u.hostname));
+    if (u.origin !== value || u.username || u.password || (u.protocol !== "https:" && !loopback))
+        throw invalid();
+    return value;
+}
+/** No environment or app-origin default. CP/log origins come only from the
+ * preauthenticated build release, whose environment must match exactly.
+ * LAB app loopback is explicit; production loopback requires a native manifest.
+ * Same-origin storage preservation is an app gate, not a runtime fallback. */
+export function selectAppEnvironment(input) {
+    const { environment, release } = input;
+    if (!applicationEnvironmentAllowed(environment) || !release ||
+        release.schema !== "mdbn-app-trust/release/1" || release.environment !== environment ||
+        !/^[0-9a-f]{64}$/.test(release.assetSha256) ||
+        !release.source || release.source.repository !== "mdbase-dev/mdbase-connect" ||
+        !/^[0-9a-f]{40}$/.test(release.source.commit) ||
+        !/^[A-Za-z0-9.+-]{1,64}$/.test(release.source.version) ||
+        !Array.isArray(release.trustedRoots) || !release.trustedRoots.length || release.trustedRoots.length > 64 ||
+        release.trustedRoots.some(root => !(root instanceof Uint8Array) || root.length !== 32 || root.every(b => b === 0)) ||
+        !(release.policyPins instanceof Uint8Array) || !release.policyPins.length || release.policyPins.length > 65536)
+        throw invalid();
+    const local = localApplicationEnvironment(environment);
+    const cpOrigin = origin(release.cpOrigin, local), logOrigin = origin(release.logOrigin, local);
+    const appOrigin = input.appOrigin;
+    if (local && ![cpOrigin, logOrigin, appOrigin].every(localApplicationOrigin))
+        throw invalid();
+    if (!isAppOrigin(appOrigin, applicationLoopbackAllowed(environment), input.platform))
+        throw invalid();
+    const selected = Object.freeze({ environment, appOrigin, cpOrigin, logOrigin, assetSha256: release.assetSha256,
+        allowLoopbackHttp: applicationLoopbackAllowed(environment) && new URL(appOrigin).protocol === "http:",
+        allowNativeLoopbackHttp: input.platform === "native" && isAppOrigin(appOrigin, false, "native") && new URL(appOrigin).protocol === "http:" });
+    selections.add(selected);
+    return selected;
+}
+/** Only a previously validated immutable selection, not a copied/redirect object.
+ * Not a hostile same-origin JS boundary or native grant/READ authority. */
+export function isAppEnvironmentSelection(value) {
+    return !!value && typeof value === "object" && selections.has(value);
+}
+//# sourceMappingURL=app-environment.js.map

package/dist/app-host/app-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-environment.js","sourceRoot":"","sources":["../../src/app-host/app-environment.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAWpN,MAAM,UAAU,GAAG,IAAI,OAAO,EAAU,CAAC;AACzC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;AAClG,SAAS,MAAM,CAAC,KAAc,EAAE,eAAwB;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,OAAO,EAAE,CAAC;IAChE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,QAAQ,GAAG,eAAe,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvL,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAC9G,OAAO,KAAK,CAAC;AACf,CAAC;AACD;;;8EAG8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,KAKpC;IACC,MAAM,EAAC,WAAW,EAAE,OAAO,EAAC,GAAG,KAAK,CAAC;IACrC,IAAI,CAAC,6BAA6B,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO;QACvD,OAAO,CAAC,MAAM,KAAK,0BAA0B,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW;QACpF,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QAC3C,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,2BAA2B;QAC5E,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7C,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QACtD,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE;QACxG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAClH,CAAC,CAAC,OAAO,CAAC,UAAU,YAAY,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,KAAK;QAAE,MAAM,OAAO,EAAE,CAAC;IACpI,MAAM,KAAK,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,IAAI,KAAK,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAC9F,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,0BAA0B,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IACtG,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;QAC3G,iBAAiB,EAAE,0BAA0B,CAAC,WAAW,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,KAAK,OAAO;QACrG,uBAAuB,EAAE,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,KAAK,OAAO,EAAC,CAAC,CAAC;IAC/I,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAAC,OAAO,QAAQ,CAAC;AAC5C,CAAC;AACD;2EAC2E;AAC3E,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC"}

package/dist/app-host/app-origin.d.ts

@@ -0,0 +1,7 @@
+export type AppOriginPlatform = "web" | "mobile" | "extension" | "native";
+/** Origin of a URL, including app schemes whose WHATWG origin is opaque. */
+export declare function urlOrigin(url: URL): string;
+export declare function appOriginPlatform(value: unknown, loopbackHttp?: boolean, platform?: "native"): AppOriginPlatform | null;
+export declare const isAppOrigin: (value: unknown, loopbackHttp?: boolean, platform?: "native") => boolean;
+/** This document's or Worker's own app origin, or null outside a browser. */
+export declare function currentAppOrigin(): string | null;

package/dist/app-host/app-origin.js

@@ -0,0 +1,49 @@
+import { isNativeLoopbackOrigin } from "@mdbase-dev/connect-protocol/manifest";
+/** App origins the SDK can run under: https (and LAB loopback http) web
+ * origins, declared native IPv4 loopback HTTP on any port, Capacitor's iOS `capacitor://<host>` and browser-extension pages.
+ * Browsers may report custom app schemes as an opaque "null" origin, so the
+ * canonical form is always `<scheme>//<host>`. Exact match, no wildcards. */
+import { LOCAL_APPLICATION_BUILD, localApplicationHttpOrigin } from "../application/local-build.js";
+const LOOPBACK = ["localhost", "127.0.0.1", "[::1]"];
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+/** Origin of a URL, including app schemes whose WHATWG origin is opaque. */
+export function urlOrigin(url) {
+    return url.protocol === "https:" || url.protocol === "http:" ? url.origin : `${url.protocol}//${url.host}`;
+}
+export function appOriginPlatform(value, loopbackHttp = false, platform) {
+    if (typeof value !== "string" || value.length > 512)
+        return null;
+    let u;
+    try {
+        u = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    if (u.username || u.password || u.search || u.hash || !["", "/"].includes(u.pathname) || urlOrigin(u) !== value)
+        return null;
+    switch (u.protocol) {
+        case "https:": return "web";
+        case "http:": return platform === "native" && isNativeLoopbackOrigin(value) ? "native" : loopbackHttp && (LOCAL_APPLICATION_BUILD ? localApplicationHttpOrigin(value) : LOOPBACK.includes(u.hostname)) ? "web" : null;
+        case "capacitor:": return !u.port && /^[a-z0-9.-]{1,253}$/.test(u.hostname) ? "mobile" : null;
+        case "chrome-extension:": return /^[a-p]{32}$/.test(u.host) ? "extension" : null;
+        case "moz-extension:": return UUID.test(u.host) ? "extension" : null;
+        default: return null;
+    }
+}
+export const isAppOrigin = (value, loopbackHttp = false, platform) => appOriginPlatform(value, loopbackHttp, platform) !== null;
+/** This document's or Worker's own app origin, or null outside a browser. */
+export function currentAppOrigin() {
+    const location = globalThis.location;
+    if (!location)
+        return null;
+    if (typeof location.origin === "string" && location.origin !== "null")
+        return location.origin;
+    try {
+        return urlOrigin(new URL(location.href));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=app-origin.js.map

package/dist/app-host/app-origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-origin.js","sourceRoot":"","sources":["../../src/app-host/app-origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,sBAAsB,EAAC,MAAM,uCAAuC,CAAC;AAC7E;;;6EAG6E;AAC7E,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AACpG,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AACrD,MAAM,IAAI,GAAG,gEAAgE,CAAC;AAG9E,4EAA4E;AAC5E,MAAM,UAAU,SAAS,CAAC,GAAQ;IAChC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;AAC7G,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc,EAAE,YAAY,GAAG,KAAK,EAAE,QAAmB;IACzF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,CAAM,CAAC;IAAC,IAAI,CAAC;QAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAC9D,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC7H,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC;QAC5B,KAAK,OAAO,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACtN,KAAK,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9F,KAAK,mBAAmB,CAAC,CAAC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QACjF,KAAK,gBAAgB,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC;IACvB,CAAC;AACH,CAAC;AACD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAc,EAAE,YAAY,GAAG,KAAK,EAAE,QAAmB,EAAW,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,KAAK,IAAI,CAAC;AAE7J,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAgC,CAAC;IAC7D,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC;IAC9F,IAAI,CAAC;QAAC,OAAO,SAAS,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1E,CAAC"}