@mdbase-dev/sdk 0.0.0-stage → 0.1.0-beta.153

package/dist/app-host/owner.d.ts

@@ -0,0 +1,103 @@
+/** First-party app ownership. Web Locks + exclusive SQLite handles are required;
+ * a Worker is not an isolation boundary against JavaScript on this origin. */
+export interface AppInstallationScope {
+    readonly account: string;
+    readonly installation: string;
+}
+export interface AppReplicaScope extends AppInstallationScope {
+    readonly collection: string;
+}
+export declare class AppReplicaOwnerError extends Error {
+    readonly reason: "invalid_scope" | "unavailable" | "busy" | "aborted" | "initialization_failed" | "shutdown_failed";
+    constructor(reason: "invalid_scope" | "unavailable" | "busy" | "aborted" | "initialization_failed" | "shutdown_failed");
+}
+/** Identical account/install/collection namespace to the app sahpool adapter. */
+export declare function appReplicaLockName(scope: AppReplicaScope): string;
+/** Installation custody is single-owner across collection switches, BEFORE keys
+ * are unwrapped or a native module opens. Collection locks alone do not do this. */
+export declare function appInstallationLockName(scope: AppInstallationScope): string;
+export interface AppLockPort {
+    request(name: string, options: {
+        mode: "exclusive";
+        ifAvailable: true;
+    }, hold: (lock: object | null) => Promise<void>): Promise<void>;
+}
+export interface AppReplicaLease {
+    /** Call only AFTER all owned Workers/ports are stopped. Idempotent. */
+    release(): Promise<void>;
+}
+/** Nonwaiting acquisition. Busy means attach to the owner or retry, never open a
+ * second store. Signal cancels ACQUISITION only; it must not unlock a live Worker. */
+export declare function acquireAppReplicaLease(locks: AppLockPort | undefined, scope: AppReplicaScope, signal?: AbortSignal): Promise<AppReplicaLease>;
+export declare function acquireAppInstallationLease(locks: AppLockPort | undefined, scope: AppInstallationScope, signal?: AbortSignal): Promise<AppReplicaLease>;
+/** Origin-local pre-account sign-in slot. No placeholder account or device keys.
+ * Keep this lease until all pairing IO and protected ledger handles are closed. */
+/** Opaque registry identifier, bounded for origin-local storage/lock namespaces. */
+export declare function isAppInstallationId(value: unknown): value is string;
+/** The same bounded protected owner used by the sign-in and grant stores. */
+export declare function isInstallationOwner(v: unknown): v is string;
+export declare function acquireAppSignInLease(locks: AppLockPort | undefined, scope: Readonly<{
+    cpOrigin: string;
+    appId: string;
+    owner?: string;
+    storageNamespace?: string;
+}>, signal?: AbortSignal): Promise<AppReplicaLease>;
+/** Internal scoped-facade bridge. The root holds its real pre-account guard
+ * (legacy v1 by default, namespace-specific when declared) for its lifetime;
+ * its fixed root/child composition borrows that guard while each protected store
+ * also takes its real owner-v2 lease. All native custody requests pass through.
+ * Compatibility consumer: older owned SDK builds whose sole sign-in lease is v1.
+ * Remove this bridge only when those builds are no longer supported. */
+export declare function createAppSignInRootGuard(locks: AppLockPort, scope: Readonly<{
+    cpOrigin: string;
+    appId: string;
+    storageNamespace?: string;
+}>, signal: AbortSignal): {
+    locks: AppLockPort;
+    close(): Promise<void>;
+};
+/** Waiting (not owning) side of the Web Locks API. */
+export interface AppLockWaitPort {
+    request(name: string, options: {
+        mode: "shared";
+        signal: AbortSignal;
+    }, granted: (lock: object | null) => Promise<void>): Promise<void>;
+}
+/** Resolves once no other tab holds this app's sign-in slot (the "open in
+ * another tab" case). Shared and released at once: it never owns the slot, so
+ * the caller still acquires it normally and may lose to a faster tab. */
+export declare function waitForAppSignInRelease(locks: AppLockWaitPort, scope: Readonly<{
+    cpOrigin: string;
+    appId: string;
+    storageNamespace?: string;
+}>, signal: AbortSignal): Promise<void>;
+export interface AppOwnedWorker {
+    /** Drain/close RPCs, keys and database handles. Does not certify any receipt. */
+    stop(): Promise<void>;
+    /** Fail-stop the Worker, even if graceful stop rejected or never completed. */
+    terminate(): void;
+}
+export interface AppInstallationCustodyAuthority {
+    readonly scope: Readonly<AppInstallationScope>;
+    /** Owned initialization/lifetime only: true AFTER installation acquisition,
+     * false once close/abort begins, even while termination retains the leases.
+     * Trusted first-party host callback, not key isolation or a readiness proof. */
+    isCurrent(): boolean;
+}
+export interface OwnedAppWorker<W extends AppOwnedWorker> {
+    worker: W;
+    readonly scope: Readonly<AppReplicaScope>;
+    /** Stops/terminates before unlocking, including aborted openings. */
+    close(): Promise<void>;
+}
+/** Create a Worker only after exclusive ownership. Its initialization receives the
+ * caller's scope signal; no subscriptions are exposed until initialization resolves.
+ * Lifetime abort closes the Worker, never just the owner lock. */
+export declare function openOwnedAppWorker<W extends AppOwnedWorker>(options: {
+    locks: AppLockPort | undefined;
+    scope: AppReplicaScope;
+    create(scope: Readonly<AppReplicaScope>): W;
+    initialize(worker: W, signal: AbortSignal | undefined, scope: Readonly<AppReplicaScope>, installation: AppInstallationCustodyAuthority): Promise<void>;
+    signal?: AbortSignal;
+    closeTimeoutMs?: number;
+}): Promise<OwnedAppWorker<W>>;

package/dist/app-host/owner.js

@@ -0,0 +1,262 @@
+export class AppReplicaOwnerError extends Error {
+    reason;
+    constructor(reason) {
+        super(`app replica owner: ${reason}`);
+        this.reason = reason;
+        this.name = "AppReplicaOwnerError";
+    }
+}
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Identical account/install/collection namespace to the app sahpool adapter. */
+export function appReplicaLockName(scope) {
+    const ids = [scope.account, scope.installation, scope.collection];
+    if (ids.some((id) => typeof id !== "string" || !UUID.test(id)))
+        throw new AppReplicaOwnerError("invalid_scope");
+    return `mdbase-app-${ids.map((id) => id.toLowerCase()).join("-")}`;
+}
+/** Installation custody is single-owner across collection switches, BEFORE keys
+ * are unwrapped or a native module opens. Collection locks alone do not do this. */
+export function appInstallationLockName(scope) {
+    const ids = [scope.account, scope.installation];
+    if (ids.some(id => typeof id !== "string" || !UUID.test(id)))
+        throw new AppReplicaOwnerError("invalid_scope");
+    return `mdbase-app-installation-${ids.map(id => id.toLowerCase()).join("-")}`;
+}
+/** Nonwaiting acquisition. Busy means attach to the owner or retry, never open a
+ * second store. Signal cancels ACQUISITION only; it must not unlock a live Worker. */
+export function acquireAppReplicaLease(locks, scope, signal) {
+    return acquireNamedLease(locks, appReplicaLockName(scope), signal);
+}
+export function acquireAppInstallationLease(locks, scope, signal) {
+    return acquireNamedLease(locks, appInstallationLockName(scope), signal);
+}
+/** Origin-local pre-account sign-in slot. No placeholder account or device keys.
+ * Keep this lease until all pairing IO and protected ledger handles are closed. */
+/** Opaque registry identifier, bounded for origin-local storage/lock namespaces. */
+export function isAppInstallationId(value) {
+    return typeof value === "string" && value.length > 0 && value.length <= 64 && !/[^A-Za-z0-9_-]/.test(value);
+}
+/** The same bounded protected owner used by the sign-in and grant stores. */
+export function isInstallationOwner(v) {
+    return typeof v === "string" && v.length > 0 && v.length <= 256 && !/[\u0000-\u001f\u007f]/.test(v);
+}
+/** Shared by a namespace root and its recovery children. Default callers keep
+ * the legacy app-wide compatibility guard; isolated namespaces never take it. */
+function appSignInRootLockName(scope) {
+    const legacy = appSignInLockName({ cpOrigin: scope.cpOrigin, appId: scope.appId });
+    if (scope.storageNamespace === undefined)
+        return legacy;
+    if (!isInstallationOwner(scope.storageNamespace))
+        throw new AppReplicaOwnerError("invalid_scope");
+    return `mdbase-app-sign-in-namespace-v1-${JSON.stringify([scope.cpOrigin, scope.appId, scope.storageNamespace])}`;
+}
+function appSignInLockName(scope) {
+    const u = new URL(scope.cpOrigin);
+    if (u.origin !== scope.cpOrigin || u.username || u.password || !["https:", "http:"].includes(u.protocol) || !isAppInstallationId(scope.appId))
+        throw new AppReplicaOwnerError("invalid_scope");
+    // Unowned callers retain their original namespace. Owned callers lock the
+    // exact protected store, so a scoped child cannot collide with its live root.
+    if (scope.owner === undefined)
+        return `mdbase-app-sign-in-v1-${scope.appId}-${scope.cpOrigin}`;
+    if (!isInstallationOwner(scope.owner))
+        throw new AppReplicaOwnerError("invalid_scope");
+    return `mdbase-app-sign-in-v2-${JSON.stringify([scope.cpOrigin, scope.owner, scope.appId])}`;
+}
+export function acquireAppSignInLease(locks, scope, signal) {
+    if (scope.storageNamespace !== undefined && (!isInstallationOwner(scope.owner) || scope.owner.startsWith("bundle:")))
+        throw new AppReplicaOwnerError("invalid_scope");
+    const ownedName = appSignInLockName(scope);
+    const legacyName = appSignInRootLockName(scope);
+    if (scope.owner === undefined)
+        return acquireNamedLease(locks, legacyName, signal);
+    return (async () => {
+        // Default owned builds keep the v1 compatibility guard. Namespace roots
+        // use their own guard; each store still takes its exact owner-v2 lease.
+        const legacy = await acquireNamedLease(locks, legacyName, signal);
+        try {
+            const owned = await acquireNamedLease(locks, ownedName, signal);
+            return { release: async () => { await owned.release(); await legacy.release(); } };
+        }
+        catch (error) {
+            await legacy.release();
+            throw error;
+        }
+    })();
+}
+/** Internal scoped-facade bridge. The root holds its real pre-account guard
+ * (legacy v1 by default, namespace-specific when declared) for its lifetime;
+ * its fixed root/child composition borrows that guard while each protected store
+ * also takes its real owner-v2 lease. All native custody requests pass through.
+ * Compatibility consumer: older owned SDK builds whose sole sign-in lease is v1.
+ * Remove this bridge only when those builds are no longer supported. */
+export function createAppSignInRootGuard(locks, scope, signal) {
+    const name = appSignInRootLockName(scope);
+    let root = null, closed = false, borrowers = 0;
+    const guarded = {
+        request: async (requested, options, hold) => {
+            if (closed)
+                throw new AppReplicaOwnerError("aborted");
+            if (requested !== name)
+                return locks.request(requested, options, hold);
+            root ??= acquireNamedLease(locks, name, signal).catch(error => { root = null; throw error; });
+            try {
+                await root;
+            }
+            catch (error) {
+                // Preserve Web Locks ifAvailable semantics and the typed busy outcome.
+                if (error instanceof AppReplicaOwnerError && error.reason === "busy")
+                    return hold(null);
+                throw error;
+            }
+            if (closed)
+                throw new AppReplicaOwnerError("aborted");
+            ++borrowers;
+            try {
+                await hold({});
+            }
+            finally {
+                --borrowers;
+            }
+        },
+    };
+    return { locks: guarded, close: async () => {
+            closed = true;
+            // Closing all original stores must precede releasing the migration guard.
+            // A failed drain retains it until Worker termination, never a second owner.
+            if (borrowers !== 0)
+                throw new AppReplicaOwnerError("shutdown_failed");
+            let lease;
+            try {
+                if (!root)
+                    return;
+                lease = await root;
+            }
+            catch {
+                return;
+            } // failed acquisition owns nothing
+            await lease.release();
+        } };
+}
+/** Resolves once no other tab holds this app's sign-in slot (the "open in
+ * another tab" case). Shared and released at once: it never owns the slot, so
+ * the caller still acquires it normally and may lose to a faster tab. */
+export function waitForAppSignInRelease(locks, scope, signal) {
+    try {
+        return locks.request(appSignInRootLockName(scope), { mode: "shared", signal }, async () => { });
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
+}
+function acquireNamedLease(locks, name, signal) {
+    if (!locks)
+        return Promise.reject(new AppReplicaOwnerError("unavailable"));
+    if (signal?.aborted)
+        return Promise.reject(new AppReplicaOwnerError("aborted"));
+    let stopHold;
+    const hold = new Promise((resolve) => { stopHold = resolve; });
+    let acquiredResolve;
+    let acquiredReject;
+    const acquired = new Promise((resolve, reject) => { acquiredResolve = resolve; acquiredReject = reject; });
+    let cancelled = false;
+    const onAbort = () => { cancelled = true; acquiredReject(new AppReplicaOwnerError("aborted")); };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    // Schedule through a microtask so request is assigned even with a synchronous
+    // test/host callback. ifAvailable + signal is forbidden by Web Locks; abort is
+    // handled separately and never unlocks an already acquired owner.
+    const request = Promise.resolve().then(() => locks.request(name, { mode: "exclusive", ifAvailable: true }, async (lock) => {
+        signal?.removeEventListener("abort", onAbort);
+        if (cancelled || signal?.aborted) {
+            acquiredReject(new AppReplicaOwnerError("aborted"));
+            return;
+        }
+        if (!lock) {
+            acquiredReject(new AppReplicaOwnerError("busy"));
+            return;
+        }
+        acquiredResolve({ release: () => { stopHold(); return request; } });
+        await hold;
+    }));
+    void request.catch(() => { signal?.removeEventListener("abort", onAbort); acquiredReject(new AppReplicaOwnerError("unavailable")); });
+    return acquired;
+}
+/** Create a Worker only after exclusive ownership. Its initialization receives the
+ * caller's scope signal; no subscriptions are exposed until initialization resolves.
+ * Lifetime abort closes the Worker, never just the owner lock. */
+export async function openOwnedAppWorker(options) {
+    const timeoutMs = options.closeTimeoutMs ?? 5000;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 30000)
+        throw new RangeError("invalid Worker close timeout");
+    // Pin all scope fields before the first await; callbacks use this snapshot,
+    // not a caller object that may change while waiting for installation ownership.
+    const signal = options.signal;
+    const scope = Object.freeze({ account: options.scope.account, installation: options.scope.installation, collection: options.scope.collection });
+    appReplicaLockName(scope); // validate collection before acquiring either lock
+    const installation = await acquireAppInstallationLease(options.locks, scope, signal);
+    let collection;
+    try {
+        collection = await acquireAppReplicaLease(options.locks, scope, signal);
+    }
+    catch (error) {
+        await installation.release();
+        throw error;
+    }
+    const lease = { release: async () => { await collection.release(); await installation.release(); } };
+    let worker;
+    try {
+        if (signal?.aborted)
+            throw new AppReplicaOwnerError("aborted");
+        worker = options.create(scope);
+    }
+    catch {
+        await lease.release();
+        throw new AppReplicaOwnerError(signal?.aborted ? "aborted" : "initialization_failed");
+    }
+    let closing;
+    const custodyAuthority = Object.freeze({
+        scope: Object.freeze({ account: scope.account, installation: scope.installation }),
+        isCurrent: () => !closing && !signal?.aborted,
+    });
+    let abortOpening;
+    const aborted = new Promise((_, reject) => { abortOpening = () => reject(new AppReplicaOwnerError("aborted")); });
+    const close = () => closing ??= (async () => {
+        signal?.removeEventListener("abort", onAbort);
+        let timer;
+        try {
+            await Promise.race([
+                Promise.resolve().then(() => worker.stop()),
+                new Promise((resolve) => { timer = setTimeout(resolve, timeoutMs); }),
+            ]);
+        }
+        catch {
+            // Fail-stop below; graceful failure is not confirmation or rollback.
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+        try {
+            worker.terminate();
+        }
+        catch {
+            throw new AppReplicaOwnerError("shutdown_failed");
+        }
+        // If termination fails the lease deliberately stays held: no second writer.
+        await lease.release();
+    })();
+    const onAbort = () => { abortOpening(); void close().catch(() => { }); };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    try {
+        if (signal?.aborted)
+            throw new AppReplicaOwnerError("aborted");
+        await Promise.race([Promise.resolve().then(() => options.initialize(worker, signal, scope, custodyAuthority)), aborted]);
+        if (signal?.aborted || closing)
+            throw new AppReplicaOwnerError("aborted");
+        return { worker, scope, close };
+    }
+    catch {
+        await close();
+        throw new AppReplicaOwnerError(signal?.aborted ? "aborted" : "initialization_failed");
+    }
+}
+//# sourceMappingURL=owner.js.map

package/dist/app-host/owner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner.js","sourceRoot":"","sources":["../../src/app-host/owner.ts"],"names":[],"mappings":"AAIA,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACxB;IAArB,YAAqB,MAA0G;QAC7H,KAAK,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAC;QADnB,WAAM,GAAN,MAAM,CAAoG;QAE7H,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AACD,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAC/E,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,KAAsB;IACvD,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,eAAe,CAAC,CAAC;IAChH,OAAO,cAAc,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACrE,CAAC;AACD;oFACoF;AACpF,MAAM,UAAU,uBAAuB,CAAC,KAA2B;IACjE,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,eAAe,CAAC,CAAC;IAC9G,OAAO,2BAA2B,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAChF,CAAC;AASD;sFACsF;AACtF,MAAM,UAAU,sBAAsB,CAAC,KAA8B,EAAE,KAAsB,EAAE,MAAoB;IACjH,OAAO,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC;AACD,MAAM,UAAU,2BAA2B,CAAC,KAA8B,EAAE,KAA2B,EAAE,MAAoB;IAC3H,OAAO,iBAAiB,CAAC,KAAK,EAAE,uBAAuB,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1E,CAAC;AACD;mFACmF;AACnF,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9G,CAAC;AACD,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,CAAU;IAC5C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACtG,CAAC;AACD;iFACiF;AACjF,SAAS,qBAAqB,CAAC,KAAwE;IACrG,MAAM,MAAM,GAAC,iBAAiB,CAAC,EAAC,QAAQ,EAAC,KAAK,CAAC,QAAQ,EAAC,KAAK,EAAC,KAAK,CAAC,KAAK,EAAC,CAAC,CAAC;IAC5E,IAAG,KAAK,CAAC,gBAAgB,KAAG,SAAS;QAAC,OAAO,MAAM,CAAC;IACpD,IAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAAC,MAAM,IAAI,oBAAoB,CAAC,eAAe,CAAC,CAAC;IAChG,OAAO,mCAAmC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAC,KAAK,CAAC,KAAK,EAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;AAClH,CAAC;AACD,SAAS,iBAAiB,CAAC,KAA6F;IACtH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,eAAe,CAAC,CAAC;IAC/L,0EAA0E;IAC1E,8EAA8E;IAC9E,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,yBAAyB,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC/F,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,eAAe,CAAC,CAAC;IACvF,OAAO,yBAAyB,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AAC/F,CAAC;AACD,MAAM,UAAU,qBAAqB,CAAC,KAA8B,EAAE,KAA6F,EAAE,MAAoB;IACvL,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,eAAe,CAAC,CAAC;IACtK,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACnF,OAAO,CAAC,KAAK,IAAI,EAAE;QACjB,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAChE,OAAO,EAAC,OAAO,EAAE,KAAK,IAAI,EAAE,GAAE,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA,CAAC,EAAC,CAAC;QACjF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAA,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YAAC,MAAM,KAAK,CAAC;QAAA,CAAC;IACxD,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AACD;;;;;wEAKwE;AACxE,MAAM,UAAU,wBAAwB,CAAC,KAAkB,EAAE,KAA6E,EAAE,MAAmB;IAC7J,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,IAAI,GAAoC,IAAI,EAAE,MAAM,GAAG,KAAK,EAAE,SAAS,GAAG,CAAC,CAAC;IAChF,MAAM,OAAO,GAAgB;QAC3B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;YAC1C,IAAI,MAAM;gBAAE,MAAM,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC;YACtD,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACvE,IAAI,KAAK,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAE,IAAI,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC;YAC5F,IAAI,CAAC;gBAAA,MAAM,IAAI,CAAC;YAAA,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAC/B,uEAAuE;gBACvE,IAAI,KAAK,YAAY,oBAAoB,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;oBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxF,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,MAAM;gBAAE,MAAM,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC;YACtD,EAAE,SAAS,CAAC;YACZ,IAAI,CAAC;gBAAA,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;YAAA,CAAC;oBAAS,CAAC;gBAAA,EAAE,SAAS,CAAC;YAAA,CAAC;QAC9C,CAAC;KACF,CAAC;IACF,OAAO,EAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACxC,MAAM,GAAG,IAAI,CAAC;YACd,0EAA0E;YAC1E,4EAA4E;YAC5E,IAAI,SAAS,KAAK,CAAC;gBAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;YACvE,IAAI,KAAsB,CAAC;YAC3B,IAAI,CAAC;gBAAA,IAAI,CAAC,IAAI;oBAAE,OAAO;gBAAC,KAAK,GAAG,MAAM,IAAI,CAAC;YAAA,CAAC;YAAC,MAAM,CAAC;gBAAA,OAAO;YAAA,CAAC,CAAC,kCAAkC;YAC/F,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC,EAAC,CAAC;AACL,CAAC;AAKD;;yEAEyE;AACzE,MAAM,UAAU,uBAAuB,CAAC,KAAsB,EAAE,KAA6E,EAAE,MAAmB;IAChK,IAAI,CAAC;QAAC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IACvG,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;AACjD,CAAC;AACD,SAAS,iBAAiB,CAAC,KAA8B,EAAE,IAAY,EAAE,MAAoB;IAC3F,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3E,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;IAChF,IAAI,QAAqB,CAAC;IAC1B,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,eAAkD,CAAC;IACvD,IAAI,cAAyC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,eAAe,GAAG,OAAO,CAAC,CAAC,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,cAAc,CAAC,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,8EAA8E;IAC9E,+EAA+E;IAC/E,kEAAkE;IAClE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACxH,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,SAAS,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YAAC,cAAc,CAAC,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAClG,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,cAAc,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACxE,eAAe,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,CAAC;IACb,CAAC,CAAC,CAAC,CAAC;IACJ,KAAK,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtI,OAAO,QAAQ,CAAC;AAClB,CAAC;AAsBD;;kEAEkE;AAClE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAOC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,KAAK;QAAE,MAAM,IAAI,UAAU,CAAC,8BAA8B,CAAC,CAAC;IACjI,4EAA4E;IAC5E,gFAAgF;IAChF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IAChJ,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,mDAAmD;IAC9E,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACrF,IAAI,UAA2B,CAAC;IAChC,IAAI,CAAC;QAAC,UAAU,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAChF,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,YAAY,CAAC,OAAO,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IAC5D,MAAM,KAAK,GAAoB,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtH,IAAI,MAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAkC,CAAC;IACvC,MAAM,gBAAgB,GAAoC,MAAM,CAAC,MAAM,CAAC;QACtE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;QAClF,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO;KAC9C,CAAC,CAAC;IACH,IAAI,YAAyB,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,YAAY,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzH,MAAM,KAAK,GAAG,GAAkB,EAAE,CAAC,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;QACzD,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,KAAgD,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC3C,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;aAC5E,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC;YAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QAAC,CAAC;QACxF,4EAA4E;QAC5E,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC,CAAC,EAAE,CAAC;IACL,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACzH,IAAI,MAAM,EAAE,OAAO,IAAI,OAAO;YAAE,MAAM,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC1E,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,EAAE,CAAC;QACd,MAAM,IAAI,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;IACxF,CAAC;AACH,CAAC"}

package/dist/app-host/private-bootstrap.d.ts

@@ -0,0 +1,78 @@
+import type { AppWasmRuntime, AppPrivateCollectionPin, AppPrivateEnrolOperationMarker, AppDeviceRegistrationReceipt } from "./wasm-runtime.js";
+export interface AppCpPrivateSession extends AppPrivateCollectionPin {
+    readonly accountId: string;
+    readonly cpOrigin: string;
+    readonly logOrigin: string;
+    /** Authenticated HOST trust pin, never discovered from this response. */
+    readonly rootPublicKey: Uint8Array;
+    connectorBearer(options: {
+        signal: AbortSignal;
+    }): Promise<string>;
+}
+export interface AppPrivateBootstrapMetadata {
+    readonly collection: string;
+    readonly deviceId: string;
+    readonly logOrigin: string;
+    readonly rootPublicKey: Uint8Array;
+    readonly genesisItem: Uint8Array;
+    readonly expectedGenesis: string;
+    readonly approval: "creator" | "pending";
+    readonly displayName?: string;
+}
+/** Protected exact public operation/completion persistence, not a generic KV or
+ * native grant. Acknowledged enrol restore must supply protected genuine metadata
+ * without repeating proof. Writes resolve only after outcome preservation. */
+export interface AppPrivateBootstrapPersistence {
+    pendingCreate(scope: AppDeviceRegistrationReceipt & {
+        readonly collection: string;
+        readonly displayName?: string;
+    }, options: {
+        signal: AbortSignal;
+    }): Promise<void>;
+    privateEnrolPending(marker: AppPrivateEnrolOperationMarker, options: {
+        signal: AbortSignal;
+    }): Promise<void>;
+    completed(metadata: AppPrivateBootstrapMetadata, options: {
+        signal: AbortSignal;
+    }): Promise<void>;
+    privateEnrolAcknowledged(marker: AppPrivateEnrolOperationMarker, options: {
+        signal: AbortSignal;
+    }): Promise<void>;
+    restoredCompletion(options: {
+        signal: AbortSignal;
+    }): Promise<AppPrivateBootstrapMetadata | null>;
+}
+export declare class AppPrivateBootstrapError extends Error {
+    readonly reason: "binding" | "fenced" | "unavailable" | "response";
+    constructor(reason: "binding" | "fenced" | "unavailable" | "response");
+}
+export declare class AppCpPrivateBootstrap {
+    private readonly runtime;
+    private readonly session;
+    private readonly persistence;
+    private readonly options;
+    private attempted;
+    private readonly lifetime;
+    private readonly scope;
+    private readonly root;
+    private readonly marker;
+    private readonly fetchImpl;
+    private readonly now;
+    private readonly displayName;
+    constructor(runtime: AppWasmRuntime, session: AppCpPrivateSession, persistence: AppPrivateBootstrapPersistence, options?: {
+        fetch?: typeof fetch;
+        now?: () => number;
+        allowLoopbackHttp?: boolean;
+        displayName?: string;
+    });
+    private origin;
+    private current;
+    private markerCopy;
+    private check;
+    private json;
+    private copy;
+    bootstrap(options: {
+        signal: AbortSignal;
+    }): Promise<AppPrivateBootstrapMetadata>;
+    close(): void;
+}