@mdbase-dev/sdk 0.0.0-stage → 0.1.0-beta.153

package/dist/app-host/log-push.js

@@ -0,0 +1,376 @@
+/** The log's push socket, owned by the Worker that owns the replica. One socket
+ * per open collection: `hello` over a single-use HTTP nonce (`n`), `subscribe`,
+ * then `items`/`head`/`closed` pushes go straight to the native replica. Requests
+ * never use this socket (the server refuses them); they stay on signed HTTPS.
+ *
+ * No timers poll the log. The socket keeps itself alive with text pings that the
+ * Durable Object answers without waking. A lost socket reconnects with backoff
+ * and catches up from the head the subscription returns; focus, visibility and
+ * `online` reconnect at once. Once every tab is hidden and pending writes are
+ * sent, the owner suspends the socket; showing a tab resumes and catches up.
+ *
+ * Framing stays extensible: `hello` negotiates the API version, every binary
+ * frame carries its type at key 0 (1 response, 2 push) and every push a string
+ * `kind` at key 1. Unknown frame types, push kinds and text messages are ignored,
+ * never an error, so later message kinds need no protocol rework. */
+import { labLoopbackHttpOrigin } from "../application/local-build.js";
+import { decode, encode } from "../cbor.js";
+import { uuidToBytes } from "../codec.js";
+/** Close codes set by the log (`deploy/cloudflare-do`). */
+export const LOG_CLOSE_EXPIRED = 4401, LOG_CLOSE_FORBIDDEN = 4403, LOG_CLOSE_GONE = 4410;
+const PING_MS = 30_000, PONG_MS = 10_000, HEALTHY_MS = 60_000, MAX_BACKOFF_MS = 60_000;
+/** A socket that is not subscribed this long after it was made is treated as
+ * lost: a blocked or hung socket may never fire `close`. */
+const OPEN_MS = 15_000;
+/** Attempts after a `hello` the runtime could not sign before push counts as
+ * unavailable; a later focus, visibility or `online` tries again. */
+const UNSIGNED_ATTEMPTS = 4;
+const INLINE_BYTES = 64 * 1024, MAX_FRAME = 1024 * 1024;
+function wsOrigin(input, loopback) {
+    const u = new URL(input);
+    if (u.protocol === "https:")
+        return `wss://${u.host}`;
+    if (loopback && labLoopbackHttpOrigin(input))
+        return `ws://${u.host}`;
+    throw new Error("app log push: origin");
+}
+const hex = (b) => [...b].map(v => v.toString(16).padStart(2, "0")).join("");
+const request = (id, method, params) => encode(new Map([[0, 0], [1, id], [2, method], [3, params]]));
+function errorOf(m) {
+    const e = m.get(3);
+    if (!(e instanceof Map))
+        return null;
+    const code = e.get(0), reason = e.get(1);
+    return { code: typeof code === "string" ? code : "unavailable", reason: typeof reason === "string" ? reason : "" };
+}
+export class AppLogPushChannel {
+    source;
+    events;
+    base;
+    collectionBytes;
+    Ws;
+    random;
+    now;
+    socket = null;
+    connecting = false;
+    closed = false;
+    finished = null;
+    unsupported = false;
+    paused = false;
+    isLive = false;
+    attempts = 0;
+    liveSince = 0;
+    retry = null;
+    ping = null;
+    pongDue = null;
+    opening = null;
+    unsigned = 0;
+    life = new AbortController();
+    token = null;
+    constructor(source, events, options = {}) {
+        this.source = source;
+        this.events = events;
+        this.base = wsOrigin(source.origin, options.allowLoopbackHttp === true);
+        this.collectionBytes = uuidToBytes(source.collection);
+        const Ws = options.WebSocket ?? globalThis.WebSocket;
+        if (typeof Ws !== "function")
+            throw new Error("app log push: no WebSocket");
+        this.Ws = Ws;
+        this.random = options.random ?? Math.random;
+        this.now = options.now ?? Date.now;
+    }
+    /** Live: subscribed, so other devices' changes arrive as they commit. */
+    get live() { return this.isLive; }
+    /** Push is not available (an older runtime); callers fall back to event wakes. */
+    get available() { return !this.unsupported && this.finished === null && !this.closed; }
+    /** Closed on purpose while every tab is hidden; `resume` reconnects. */
+    get suspended() { return this.paused; }
+    start() { void this.connect(); }
+    /** Focus, visibility or `online`: reconnect now if not connected. */
+    nudge() {
+        this.unsupported = false;
+        this.unsigned = 0;
+        if (this.paused || this.socket || this.connecting || !this.available)
+            return;
+        this.attempts = 0;
+        this.clearRetry();
+        void this.connect();
+    }
+    /** Every tab hidden and nothing left to send: close the socket (code 1000)
+     * and stop reconnecting. Nothing is lost: `resume` catches up from the head. */
+    suspend() {
+        if (this.paused || !this.available)
+            return;
+        this.paused = true;
+        this.clearRetry();
+        this.drop(1000, "hidden");
+    }
+    resume() {
+        if (!this.paused) {
+            this.nudge();
+            return;
+        }
+        this.paused = false;
+        this.nudge();
+    }
+    close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        this.life.abort();
+        this.clearRetry();
+        this.drop(1000, "closed");
+    }
+    clearRetry() { if (this.retry !== null)
+        clearTimeout(this.retry); this.retry = null; }
+    clearPing() {
+        if (this.ping !== null)
+            clearInterval(this.ping);
+        this.ping = null;
+        if (this.pongDue !== null)
+            clearTimeout(this.pongDue);
+        this.pongDue = null;
+        if (this.opening !== null)
+            clearTimeout(this.opening);
+        this.opening = null;
+    }
+    setLive(live) {
+        if (this.isLive === live)
+            return;
+        this.isLive = live;
+        if (live)
+            this.liveSince = this.now();
+        try {
+            this.events.live(live);
+        }
+        catch { /* observer cannot break the channel */ }
+    }
+    end(reason) {
+        if (this.finished || this.closed)
+            return;
+        this.finished = reason;
+        this.clearRetry();
+        this.drop(1000, reason);
+        try {
+            this.events.ended(reason);
+        }
+        catch { /* terminal either way */ }
+    }
+    drop(code, why) {
+        this.clearPing();
+        const s = this.socket;
+        this.socket = null;
+        if (s) {
+            s.onopen = s.onmessage = s.onclose = s.onerror = null;
+            try {
+                s.close(code, why);
+            }
+            catch { /* already closed */ }
+        }
+        this.setLive(false);
+    }
+    /** Full-jitter backoff, 1 s → 60 s; reset after a minute of a healthy socket. */
+    schedule(immediate = false) {
+        if (this.paused || !this.available || this.retry !== null)
+            return;
+        const wait = immediate ? 0 : Math.floor(this.random() * Math.min(MAX_BACKOFF_MS, 1_000 * 2 ** Math.min(this.attempts, 6)));
+        this.attempts++;
+        this.retry = setTimeout(() => { this.retry = null; void this.connect(); }, wait);
+    }
+    async connect() {
+        if (this.paused || this.socket || this.connecting || !this.available)
+            return;
+        if (!this.source.isCurrent()) {
+            this.close();
+            return;
+        }
+        this.connecting = true;
+        let token, nonce, sig;
+        try {
+            const signal = this.life.signal;
+            token = await this.source.accessToken({ signal });
+            nonce = await this.source.nonce({ signal });
+            if (this.paused || !this.available || !this.source.isCurrent())
+                return;
+            sig = this.source.signHello(nonce, token);
+            // Not signable now (a runtime without it, or not ready yet): retry with
+            // backoff a few times, then wait for the next focus, visibility or online.
+            if (!sig) {
+                if (++this.unsigned >= UNSIGNED_ATTEMPTS)
+                    this.unsupported = true;
+                else
+                    this.schedule();
+                return;
+            }
+            this.unsigned = 0;
+        }
+        catch {
+            this.connecting = false;
+            this.schedule();
+            return;
+        }
+        finally {
+            this.connecting = false;
+        }
+        this.token = token;
+        let s;
+        try {
+            s = new this.Ws(`${this.base}/v1/ws?c=${this.source.collection}&n=${hex(nonce)}`);
+        }
+        catch {
+            this.schedule();
+            return;
+        }
+        s.binaryType = "arraybuffer";
+        this.socket = s;
+        const hello = request(1, "hello", new Map([[0, [1, 0]], [1, token], [2, uuidToBytes(this.source.deviceId)], [3, sig]]));
+        sig.fill(0);
+        nonce.fill(0);
+        s.onopen = () => { try {
+            s.send(hello);
+        }
+        catch {
+            this.lost(s, 1006);
+        } };
+        s.onmessage = event => this.message(s, event.data);
+        s.onclose = event => this.lost(s, event.code);
+        s.onerror = () => { };
+        this.opening = setTimeout(() => { this.opening = null; this.lost(s, 1006); }, OPEN_MS);
+    }
+    message(s, data) {
+        if (s !== this.socket)
+            return;
+        if (typeof data === "string") {
+            if (data === "pong" && this.pongDue !== null) {
+                clearTimeout(this.pongDue);
+                this.pongDue = null;
+            }
+            return;
+        }
+        if (!(data instanceof ArrayBuffer) || data.byteLength > MAX_FRAME) {
+            this.lost(s, 1009);
+            return;
+        }
+        const bytes = new Uint8Array(data);
+        let m;
+        try {
+            const v = decode(bytes);
+            if (!(v instanceof Map))
+                throw new Error();
+            m = v;
+        }
+        catch {
+            this.lost(s, 1007);
+            return;
+        }
+        if (m.get(0) === 2) {
+            if (!this.isLive)
+                return;
+            this.deliver(bytes);
+            if (m.get(1) === "closed") {
+                const payload = m.get(2), reason = payload instanceof Map ? payload.get(1) : null;
+                this.end(reason === "gone" ? "gone" : reason === "revoked" ? "revoked" : "forbidden");
+            }
+            return;
+        }
+        if (m.get(0) !== 1)
+            return;
+        const id = m.get(1), error = errorOf(m);
+        if (id === 1) {
+            if (error) {
+                this.refused(s, error);
+                return;
+            }
+            try {
+                s.send(request(2, "subscribe", new Map([[0, this.collectionBytes], [1, 0], [2, INLINE_BYTES]])));
+            }
+            catch {
+                this.lost(s, 1006);
+            }
+            return;
+        }
+        if (id === 2) {
+            if (error) {
+                this.refused(s, error);
+                return;
+            }
+            const result = m.get(2);
+            if (!(result instanceof Map)) {
+                this.lost(s, 1007);
+                return;
+            }
+            const head = result.get(0), chain = result.get(1);
+            this.startPing(s);
+            this.setLive(true);
+            // Catch-up: the subscription's head, as the replica's own `head` push.
+            if ((typeof head === "number" || typeof head === "bigint") && chain instanceof Uint8Array && chain.length === 32)
+                this.deliver(encode(new Map([[0, 2], [1, "head"], [2, new Map([[0, this.collectionBytes], [1, head], [2, chain]])]])));
+        }
+    }
+    deliver(frame) {
+        try {
+            this.events.push(frame);
+        }
+        catch { /* the replica decides; the channel continues */ }
+    }
+    refused(s, e) {
+        if (e.code === "forbidden" && e.reason === "credentials_revoked") {
+            this.end("revoked");
+            return;
+        }
+        if (e.code === "forbidden" || e.code === "not_found") {
+            this.end(e.code === "not_found" ? "gone" : "forbidden");
+            return;
+        }
+        if (e.code === "gone") {
+            this.end("gone");
+            return;
+        }
+        if (e.code === "unauthenticated" && this.token) {
+            this.source.invalidateToken?.(this.token);
+            this.token = null;
+        }
+        this.lost(s, 1008);
+    }
+    startPing(s) {
+        this.clearPing();
+        this.ping = setInterval(() => {
+            if (s !== this.socket || this.pongDue !== null)
+                return;
+            try {
+                s.send("ping");
+            }
+            catch {
+                this.lost(s, 1006);
+                return;
+            }
+            this.pongDue = setTimeout(() => { this.pongDue = null; this.lost(s, 1006); }, PONG_MS);
+        }, PING_MS);
+    }
+    lost(s, code) {
+        if (s !== this.socket)
+            return;
+        const healthy = this.isLive && this.now() - this.liveSince >= HEALTHY_MS;
+        this.drop(1000, "lost");
+        if (code === LOG_CLOSE_FORBIDDEN) {
+            this.end("forbidden");
+            return;
+        }
+        if (code === LOG_CLOSE_GONE) {
+            this.end("gone");
+            return;
+        }
+        if (healthy)
+            this.attempts = 0;
+        if (code === LOG_CLOSE_EXPIRED) {
+            if (this.token)
+                this.source.invalidateToken?.(this.token);
+            this.token = null;
+            this.attempts = 0;
+            this.schedule(true);
+            return;
+        }
+        this.schedule();
+    }
+}
+//# sourceMappingURL=log-push.js.map

package/dist/app-host/log-push.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-push.js","sourceRoot":"","sources":["../../src/app-host/log-push.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;qEAcqE;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAkB,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,2DAA2D;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,EAAE,mBAAmB,GAAG,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;AACzF,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC;AACvF;4DAC4D;AAC5D,MAAM,OAAO,GAAG,MAAM,CAAC;AACvB;qEACqE;AACrE,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,YAAY,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC;AAkCxD,SAAS,QAAQ,CAAC,KAAa,EAAE,QAAiB;IAChD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,QAAQ,IAAI,qBAAqB,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;AAC1C,CAAC;AACD,MAAM,GAAG,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEzF,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,MAAc,EAAE,MAA8B,EAAE,EAAE,CAC7E,MAAM,CAAC,IAAI,GAAG,CAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,SAAS,OAAO,CAAC,CAAW;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,IAAI,GAAI,CAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,GAAI,CAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACrH,CAAC;AAED,MAAM,OAAO,iBAAiB;IAuBC;IAA2C;IAtBvD,IAAI,CAAS;IACb,eAAe,CAAa;IAC5B,EAAE,CAA8B;IAChC,MAAM,CAAe;IACrB,GAAG,CAAe;IAC3B,MAAM,GAAqB,IAAI,CAAC;IAChC,UAAU,GAAG,KAAK,CAAC;IACnB,MAAM,GAAG,KAAK,CAAC;IACf,QAAQ,GAAyB,IAAI,CAAC;IACtC,WAAW,GAAG,KAAK,CAAC;IACpB,MAAM,GAAG,KAAK,CAAC;IACf,MAAM,GAAG,KAAK,CAAC;IACf,QAAQ,GAAG,CAAC,CAAC;IACb,SAAS,GAAG,CAAC,CAAC;IACd,KAAK,GAAyC,IAAI,CAAC;IACnD,IAAI,GAA0C,IAAI,CAAC;IACnD,OAAO,GAAyC,IAAI,CAAC;IACrD,OAAO,GAAyC,IAAI,CAAC;IACrD,QAAQ,GAAG,CAAC,CAAC;IACb,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IAC7B,KAAK,GAAkB,IAAI,CAAC;IAEpC,YAA6B,MAAwB,EAAmB,MAAwB,EAAE,UAA6B,EAAE;QAApG,WAAM,GAAN,MAAM,CAAkB;QAAmB,WAAM,GAAN,MAAM,CAAkB;QAC9F,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC;QACxE,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC;QACrD,IAAI,OAAO,EAAE,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC5E,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QAAC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;QAAC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAChG,CAAC;IACD,yEAAyE;IACzE,IAAI,IAAI,KAAc,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,kFAAkF;IAClF,IAAI,SAAS,KAAc,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAChG,wEAAwE;IACxE,IAAI,SAAS,KAAc,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,KAAK,KAAW,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACtC,qEAAqE;IACrE,KAAK;QACH,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC7E,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;IAC5D,CAAC;IACD;oFACgF;IAChF,OAAO;QACL,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnE,CAAC;IACD,MAAM;QACJ,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IACpC,CAAC;IACD,KAAK;QACH,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtF,CAAC;IAEO,UAAU,KAAW,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;QAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;IAC5F,SAAS;QACf,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnE,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAC3E,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IAC7E,CAAC;IACO,OAAO,CAAC,IAAa;QAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO;QACjC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,IAAI;YAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1D,IAAI,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,uCAAuC,CAAC,CAAC;IACnF,CAAC;IACO,GAAG,CAAC,MAAqB;QAC/B,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACzC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;QAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnE,IAAI,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;IACxE,CAAC;IACO,IAAI,CAAC,IAAY,EAAE,GAAW;QACpC,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAC1C,IAAI,CAAC,EAAE,CAAC;YAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;YAAC,IAAI,CAAC;gBAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAAC,CAAC;QAC5H,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,iFAAiF;IACzE,QAAQ,CAAC,SAAS,GAAG,KAAK;QAChC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO;QAClE,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3H,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACnF,CAAC;IACO,KAAK,CAAC,OAAO;QACnB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC7E,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QACvD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,KAAa,EAAE,KAAiB,EAAE,GAAsB,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAChC,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YAClD,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBAAE,OAAO;YACvE,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC1C,wEAAwE;YACxE,2EAA2E;YAC3E,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,iBAAiB;oBAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;;oBAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC9G,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;YAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAAC,OAAO;QACnD,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QAAC,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAY,CAAC;QACjB,IAAI,CAAC;YAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,MAAM,CAAC,UAAU,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAC1F,MAAM,CAAC;YAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAClC,CAAC,CAAC,UAAU,GAAG,aAAa,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAChB,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,GAAG,CAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3I,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC,CAAC,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;YAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC,CAAC,OAAO,GAAG,GAAG,EAAE,GAAyB,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACzF,CAAC;IACO,OAAO,CAAC,CAAY,EAAE,IAAa;QACzC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO;QAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,YAAY,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,GAAG,SAAS,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAClG,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAW,CAAC;QAChB,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,IAAI,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAAC,CAAC,GAAG,CAAa,CAAC;QAAC,CAAC;QAC/F,MAAM,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACrC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO;YACzB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,YAAY,GAAG,CAAC,CAAC,CAAE,OAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAChG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACxF,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO;QAC3B,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YACb,IAAI,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC9C,IAAI,CAAC;gBAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,GAAG,CAAoB,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YAC5H,MAAM,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YACb,IAAI,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,CAAC,MAAM,YAAY,GAAG,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC7D,MAAM,IAAI,GAAI,MAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,GAAI,MAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9E,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnB,uEAAuE;YACvE,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,IAAI,KAAK,YAAY,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;gBAC9G,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,CAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,GAAG,CAAoB,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjK,CAAC;IACH,CAAC;IACO,OAAO,CAAC,KAAiB;QAC/B,IAAI,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,gDAAgD,CAAC,CAAC;IAC7F,CAAC;IACO,OAAO,CAAC,CAAY,EAAE,CAAmC;QAC/D,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAClG,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC1H,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACpD,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAAC,CAAC;QACjH,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACrB,CAAC;IACO,SAAS,CAAC,CAAY;QAC5B,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE;YAC3B,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;gBAAE,OAAO;YACvD,IAAI,CAAC;gBAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC7D,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACzF,CAAC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;IACO,IAAI,CAAC,CAAY,EAAE,IAAY;QACrC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC;QACzE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxB,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACpE,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC1D,IAAI,OAAO;YAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,KAAK;gBAAE,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO;QACpE,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;CACF"}

package/dist/app-host/log-token-cache.d.ts

@@ -0,0 +1,28 @@
+/**
+ * P5: the last log token per device and collection, so a reload reuses it
+ * until shortly before it expires instead of minting one (a challenge and a
+ * mint, two CP round trips) on every open. The token is no more powerful than
+ * the device key beside it in this origin's storage, which can mint one; RPCs
+ * are still signed per request. A refused token is dropped; signing out deletes
+ * its scoped records (legacy default sign-out deletes the database).
+ */
+export declare const LOG_TOKEN_DATABASE = "mdbase.app.log-token.v1";
+export interface AppLogToken {
+    readonly value: string;
+    readonly expires: number;
+}
+export interface AppLogTokenCache {
+    read(key: string, now: number): Promise<AppLogToken | null>;
+    write(key: string, token: AppLogToken): Promise<void>;
+    drop(key: string): Promise<void>;
+}
+/** IndexedDB-backed cache; every failure is a miss (mint as before). */
+export declare function idbLogTokenCache(): AppLogTokenCache | null;
+/** Remove only this installation's device tokens, including unlisted collections
+ * and earlier log origins. A pre-pairing slot has no device tokens to erase.
+ * Match the exact CP/connector/device tuple written by AppCpLogAuthority. */
+export declare function eraseAppLogTokens(scope: {
+    readonly cpOrigin: string;
+    readonly connectorId: string | null;
+    readonly deviceId: string | null;
+}): Promise<boolean>;

package/dist/app-host/log-token-cache.js

@@ -0,0 +1,104 @@
+/**
+ * P5: the last log token per device and collection, so a reload reuses it
+ * until shortly before it expires instead of minting one (a challenge and a
+ * mint, two CP round trips) on every open. The token is no more powerful than
+ * the device key beside it in this origin's storage, which can mint one; RPCs
+ * are still signed per request. A refused token is dropped; signing out deletes
+ * its scoped records (legacy default sign-out deletes the database).
+ */
+export const LOG_TOKEN_DATABASE = "mdbase.app.log-token.v1";
+const STORE = "tokens";
+/** Reuse a stored token only with at least this much lifetime left. */
+const MIN_LEFT_MS = 60_000;
+function open() {
+    return new Promise(resolve => {
+        let request;
+        try {
+            request = indexedDB.open(LOG_TOKEN_DATABASE, 1);
+        }
+        catch {
+            resolve(null);
+            return;
+        }
+        request.onupgradeneeded = () => { try {
+            request.result.createObjectStore(STORE);
+        }
+        catch { /* resolved as unusable below */ } };
+        request.onsuccess = () => {
+            const db = request.result;
+            db.onversionchange = () => db.close(); // sign-out deletes it
+            resolve(db.objectStoreNames.contains(STORE) ? db : (db.close(), null));
+        };
+        request.onerror = request.onblocked = () => resolve(null);
+    });
+}
+function run(mode, work) {
+    return open().then(db => new Promise(resolve => {
+        if (!db) {
+            resolve(null);
+            return;
+        }
+        let result = null;
+        try {
+            const tx = db.transaction(STORE, mode), request = work(tx.objectStore(STORE));
+            if (request)
+                request.onsuccess = () => { result = request.result ?? null; };
+            tx.oncomplete = () => { db.close(); resolve(result); };
+            tx.onerror = tx.onabort = () => { db.close(); resolve(null); };
+        }
+        catch {
+            db.close();
+            resolve(null);
+        }
+    }));
+}
+/** IndexedDB-backed cache; every failure is a miss (mint as before). */
+export function idbLogTokenCache() {
+    if (typeof indexedDB === "undefined")
+        return null;
+    return Object.freeze({
+        async read(key, now) {
+            const v = await run("readonly", store => store.get(key)).catch(() => null);
+            if (!v || typeof v.value !== "string" || !v.value || v.value.length > 16 * 1024 || /[^\x21-\x7e]/.test(v.value)
+                || typeof v.expires !== "number" || !Number.isSafeInteger(v.expires) || v.expires - now < MIN_LEFT_MS || v.expires - now > 16 * 60_000)
+                return null;
+            return Object.freeze({ value: v.value, expires: v.expires });
+        },
+        async write(key, token) { await run("readwrite", store => store.put({ value: token.value, expires: token.expires }, key)).catch(() => null); },
+        async drop(key) { await run("readwrite", store => store.delete(key)).catch(() => null); },
+    });
+}
+/** Remove only this installation's device tokens, including unlisted collections
+ * and earlier log origins. A pre-pairing slot has no device tokens to erase.
+ * Match the exact CP/connector/device tuple written by AppCpLogAuthority. */
+export async function eraseAppLogTokens(scope) {
+    const { cpOrigin, connectorId, deviceId } = scope;
+    if (!connectorId || !deviceId)
+        return true;
+    const db = await open();
+    if (!db)
+        return false;
+    return new Promise(resolve => {
+        try {
+            const tx = db.transaction(STORE, "readwrite"), cursor = tx.objectStore(STORE).openCursor();
+            cursor.onsuccess = () => {
+                const row = cursor.result;
+                if (!row)
+                    return;
+                if (typeof row.key === "string") {
+                    const parts = row.key.split(" ");
+                    if (parts.length === 5 && parts[0] === cpOrigin && parts[2] === connectorId && parts[3] === deviceId)
+                        row.delete();
+                }
+                row.continue();
+            };
+            tx.oncomplete = () => { db.close(); resolve(true); };
+            tx.onerror = tx.onabort = () => { db.close(); resolve(false); };
+        }
+        catch {
+            db.close();
+            resolve(false);
+        }
+    });
+}
+//# sourceMappingURL=log-token-cache.js.map

package/dist/app-host/log-token-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-token-cache.js","sourceRoot":"","sources":["../../src/app-host/log-token-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC;AACvB,uEAAuE;AACvE,MAAM,WAAW,GAAG,MAAM,CAAC;AAS3B,SAAS,IAAI;IACX,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAI,OAAyB,CAAC;QAC9B,IAAI,CAAC;YAAC,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACzF,OAAO,CAAC,eAAe,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChI,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE;YACvB,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YAC1B,EAAE,CAAC,eAAe,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,sBAAsB;YAC7D,OAAO,CAAC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QACzE,CAAC,CAAC;QACF,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,GAAG,CAAI,IAAwB,EAAE,IAAqD;IAC7F,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,OAAO,CAAW,OAAO,CAAC,EAAE;QACvD,IAAI,CAAC,EAAE,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnC,IAAI,MAAM,GAAa,IAAI,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9E,IAAI,OAAO;gBAAE,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5E,EAAE,CAAC,UAAU,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,OAAO,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IACxC,CAAC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,gBAAgB;IAC9B,IAAI,OAAO,SAAS,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,GAAW;YACjC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAU,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAkD,CAAC;YACrI,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;mBAC1G,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,GAAG,GAAG,WAAW,IAAI,CAAC,CAAC,OAAO,GAAG,GAAG,GAAG,EAAE,GAAG,MAAM;gBAAE,OAAO,IAAI,CAAC;YACtJ,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,KAAkB,IAAI,MAAM,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnK,KAAK,CAAC,IAAI,CAAC,GAAW,IAAI,MAAM,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KAClG,CAAC,CAAC;AACL,CAAC;AAED;;6EAE6E;AAC7E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAgG;IACtI,MAAM,EAAC,QAAQ,EAAC,WAAW,EAAC,QAAQ,EAAC,GAAC,KAAK,CAAC;IAC5C,IAAG,CAAC,WAAW,IAAE,CAAC,QAAQ;QAAC,OAAO,IAAI,CAAC;IACvC,MAAM,EAAE,GAAC,MAAM,IAAI,EAAE,CAAC;IACtB,IAAG,CAAC,EAAE;QAAC,OAAO,KAAK,CAAC;IACpB,OAAO,IAAI,OAAO,CAAU,OAAO,CAAA,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,EAAE,GAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAC,WAAW,CAAC,EAAC,MAAM,GAAC,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;YACrF,MAAM,CAAC,SAAS,GAAC,GAAE,EAAE;gBACnB,MAAM,GAAG,GAAC,MAAM,CAAC,MAAM,CAAC;gBAAA,IAAG,CAAC,GAAG;oBAAC,OAAO;gBACvC,IAAG,OAAO,GAAG,CAAC,GAAG,KAAG,QAAQ,EAAC,CAAC;oBAC5B,MAAM,KAAK,GAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC/B,IAAG,KAAK,CAAC,MAAM,KAAG,CAAC,IAAE,KAAK,CAAC,CAAC,CAAC,KAAG,QAAQ,IAAE,KAAK,CAAC,CAAC,CAAC,KAAG,WAAW,IAAE,KAAK,CAAC,CAAC,CAAC,KAAG,QAAQ;wBAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBACrG,CAAC;gBACD,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,CAAC,CAAC;YACF,EAAE,CAAC,UAAU,GAAC,GAAE,EAAE,GAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAA,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA,CAAC,CAAC;YAC9C,EAAE,CAAC,OAAO,GAAC,EAAE,CAAC,OAAO,GAAC,GAAE,EAAE,GAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAA,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA,CAAC,CAAC;QACzD,CAAC;QAAA,MAAK,CAAC;YAAA,EAAE,CAAC,KAAK,EAAE,CAAC;YAAA,OAAO,CAAC,KAAK,CAAC,CAAC;QAAA,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/app-host/native-sign-in.d.ts

@@ -0,0 +1,27 @@
+import { type NativeCompletion } from "../app-grant/native-completion.js";
+/** SDK-owned metadata only; original pairing bearer and both custodians stay put. */
+export interface AppNativeAuthorizationContext {
+    readonly requestId: string;
+    readonly accountId: string;
+    readonly appId: string;
+    readonly challenge: string;
+    readonly authorizationId?: string;
+}
+export interface AppNativePreparation {
+    readonly authorizationId: string;
+    readonly applicationId: string;
+    readonly manifestDigest: string;
+}
+export interface AppNativeSelection {
+    readonly requestId: string;
+    readonly authorizationRequestId: string;
+    readonly collectionId: string;
+}
+export interface AppNativeAuthorizationPort {
+    prepare(context: AppNativeAuthorizationContext, signal: AbortSignal): Promise<AppNativePreparation>;
+    finish(selection: AppNativeSelection, signal: AbortSignal): Promise<NativeCompletion>;
+    cancel(): void;
+}
+/** Revalidate transported/protected completion metadata. Original OAuth issuer
+ * has already checked the original keys/PKCE; this does not manufacture authority. */
+export declare function boundNativeCompletion(value: NativeCompletion, selection: AppNativeSelection, account: string, app: string, origin: string, digest: string): NativeCompletion;

package/dist/app-host/native-sign-in.js

@@ -0,0 +1,12 @@
+import { nativeCompletionFromToken } from "../app-grant/native-completion.js";
+/** Revalidate transported/protected completion metadata. Original OAuth issuer
+ * has already checked the original keys/PKCE; this does not manufacture authority. */
+export function boundNativeCompletion(value, selection, account, app, origin, digest) {
+    return nativeCompletionFromToken({ native_completion: value, collection_id: selection.collectionId, grant_id: value?.grant_id, application_origin: origin }, {
+        accountId: account, authorizationRequestId: selection.authorizationRequestId, applicationId: app,
+        applicationOrigin: origin, collectionId: selection.collectionId, manifestDigest: digest,
+        declarationId: value?.application_declaration_id, applicationInstallationId: value?.application_installation_id,
+        grantSigningPublicKey: value?.grant_signing_public_key, clientNoisePublicKey: value?.client_noise_public_key,
+    });
+}
+//# sourceMappingURL=native-sign-in.js.map

package/dist/app-host/native-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-sign-in.js","sourceRoot":"","sources":["../../src/app-host/native-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAyB,MAAM,mCAAmC,CAAC;AAkBrG;sFACsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,KAAuB,EAAE,SAA6B,EAAE,OAAe,EAAE,GAAW,EAAE,MAAc,EAAE,MAAc;IACxJ,OAAO,yBAAyB,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE;QAC3J,SAAS,EAAE,OAAO,EAAE,sBAAsB,EAAE,SAAS,CAAC,sBAAsB,EAAE,aAAa,EAAE,GAAG;QAChG,iBAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,cAAc,EAAE,MAAM;QACvF,aAAa,EAAE,KAAK,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,KAAK,EAAE,2BAA2B;QAC/G,qBAAqB,EAAE,KAAK,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,KAAK,EAAE,uBAAuB;KAC7G,CAAC,CAAC;AACL,CAAC"}

package/dist/app-host/noise-custody.d.ts

@@ -0,0 +1,62 @@
+import type { AppDeviceCustodyPersistence } from "./device-registration.js";
+import type { AppDeviceIdentityPin, AppDeviceRegistrationReceipt, AppPrivateEnrolOperationMarker } from "./wasm-runtime.js";
+/** Real persistent platform storage selected by the authenticated host. Writes
+ * must consume/copy borrowed bytes before resolving. NO reset/delete/retry API.
+ * A memory implementation is for tests only and does not qualify custody. */
+export interface AppNoiseProtectedStore {
+    read(namespace: string, options: {
+        signal: AbortSignal;
+    }): Promise<Uint8Array | null>;
+    /** Atomic exact-ciphertext CAS (or equivalent exclusively owned platform
+     * transaction). False preserves another writer; uncertain writes THROW.
+     * Never implement this as an unlocked read followed by a blind overwrite. */
+    compareAndSet(namespace: string, expected: Uint8Array | null, encrypted: Uint8Array, options: {
+        signal: AbortSignal;
+    }): Promise<boolean>;
+}
+export interface AppRestoredNoiseCustody {
+    readonly envelope: Uint8Array;
+    readonly receipt: AppDeviceRegistrationReceipt | null;
+    readonly privateEnrolMarker: AppPrivateEnrolOperationMarker | null;
+}
+/** The KEK is acquired/restored through the platform's persistent protected key
+ * provider. NEVER generate a substitute key on failed lookup/decrypt/reopen.
+ * Workers do NOT isolate keys against same-origin JS/XSS. */
+export declare class AppWebNoiseCustody implements AppDeviceCustodyPersistence {
+    private readonly pin;
+    private readonly key;
+    private readonly store;
+    private readonly scope;
+    private readonly namespace;
+    private readonly aad;
+    constructor(pin: AppDeviceIdentityPin, key: CryptoKey, store: AppNoiseProtectedStore);
+    private check;
+    private receiptValue;
+    private receipt;
+    private markerValue;
+    private marker;
+    /** Async BEFORE sync native device open. Missing is explicit null, not first
+     * install authorization: a host must consult its installation record. Any
+     * existing ciphertext/key/scope failure REFUSES, never regenerates/falls back. */
+    restore(options: {
+        signal: AbortSignal;
+    }): Promise<AppRestoredNoiseCustody | null>;
+    private read;
+    private write;
+    pending(envelope: Uint8Array, options: {
+        signal: AbortSignal;
+    }): Promise<void>;
+    /** Protect PUBLIC exact tuple+commit BEFORE POST. Existing uncertain marker
+     * cannot be replaced/cleared; no r, SAS custody purpose or generic data API. */
+    privateEnrolPending(marker: AppPrivateEnrolOperationMarker, options: {
+        signal: AbortSignal;
+    }): Promise<void>;
+    /** Actual authenticated CP enrol response only, NOT approval/keyed. */
+    privateEnrolAcknowledged(marker: AppPrivateEnrolOperationMarker, options: {
+        signal: AbortSignal;
+    }): Promise<void>;
+    private writePrivateMarker;
+    registered(receipt: AppDeviceRegistrationReceipt, options: {
+        signal: AbortSignal;
+    }): Promise<void>;
+}