@mdbase-dev/sdk 0.0.0-stage → 0.1.0-beta.153

package/dist/app-host/wasm-runtime.js

@@ -0,0 +1,1050 @@
+/** Optional first-party app artifact binding. No auth/custody defaults or MemStore fallback. */
+import { decode, encode, encodeSecret } from "../cbor.js";
+import { hashToBytes, uuidToBytes } from "../codec.js";
+import { mdbaseError } from "../errors.js";
+import { WasmRuntime } from "../runtime/wasm.js";
+import { confirmedHead, syncStatus } from "../wire.js";
+import { AppLogPump } from "./log-pump.js";
+import { resourceAssessment, resourceDecisions } from "./collection-control.js";
+import { modelResourcePlan } from "./collection-setup-journal.js";
+/** @internal Bounded resource DATA codec shared with the setup engine. */
+export function resourceJson(value, toCbor, depth = 0, count = { nodes: 0 }) {
+    if (depth > 32 || ++count.nodes > 65536)
+        throw mdbaseError("invalid_request", "resource DATA exceeds bound");
+    if (value === null || typeof value === "boolean" || typeof value === "string"
+        || (typeof value === "number" && Number.isFinite(value)))
+        return value;
+    if (Array.isArray(value))
+        return value.map(child => resourceJson(child, toCbor, depth + 1, count));
+    const map = toCbor ? value !== null && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype
+        ? Object.entries(value) : null : value instanceof Map ? [...value] : null;
+    if (!map)
+        throw mdbaseError("invalid_request", "invalid resource DATA");
+    const result = new Map();
+    for (const [key, child] of map) {
+        if (typeof key !== "string" || result.has(key))
+            throw mdbaseError("invalid_request", "invalid resource DATA");
+        result.set(key, resourceJson(child, toCbor, depth + 1, count));
+    }
+    return toCbor ? result : Object.fromEntries(result);
+}
+export class AppStrictDeviceApprovalError extends Error {
+    reason = "strict_device_approval";
+    constructor() { super("this account uses strict device approval; add this device from your desktop"); this.name = "AppStrictDeviceApprovalError"; }
+}
+const bad = () => mdbaseError("unavailable", "app runtime unavailable; reopen and reconcile");
+function policyPins(v) {
+    if (!(v instanceof Uint8Array) || v.length === 0 || v.length > 64 * 1024)
+        throw bad();
+    return new Uint8Array(v);
+}
+function uint64(v) {
+    if ((typeof v !== "number" || !Number.isSafeInteger(v)) && typeof v !== "bigint")
+        throw bad();
+    const n = BigInt(v);
+    if (n < 0n || n > (1n << 64n) - 1n)
+        throw bad();
+    return n;
+}
+const equalBytes = (a, b) => a.length === b.length && a.every((v, i) => v === b[i]);
+function b32(v) { if (!(v instanceof Uint8Array) || v.length !== 32)
+    throw bad(); return v; }
+/** One module/database lifetime. Call pump.close() before shutdown/SQL close;
+ * terminate Worker before releasing its lease if drain/disposal fails. */
+export class AppWasmRuntime extends WasmRuntime {
+    sqlBinding;
+    attempted = false;
+    active = false;
+    retired = false;
+    collection = null;
+    deviceId = null;
+    connectorId = null;
+    cpPin = null;
+    deviceAttempted = false;
+    deviceActive = false;
+    deviceRegistered = false;
+    devicePin = null;
+    installationId = null;
+    publicIdentity = null;
+    noiseEnvelope = null;
+    cloudSource = null;
+    cloudCallback = null;
+    cloudCollection = null;
+    cloudPurpose = null;
+    cloudIssued = false;
+    privateAttempted = false;
+    privateSource = null;
+    prospectiveCollection = null;
+    privatePurpose = null;
+    sasCommitment = null;
+    privateEnrolAcknowledged = false;
+    endpoint = null;
+    logGeneration = 0n;
+    pump = null;
+    transport = null;
+    constructor(x, sqlBinding) {
+        super(x);
+        this.sqlBinding = sqlBinding;
+    }
+    get sql() { return this.sqlBinding.sql; }
+    get app() { return this.x; }
+    static async create(bytes, sql) {
+        if (sql.needsRecovery)
+            throw bad();
+        return this.instantiateApp(bytes, sql);
+    }
+    /** Device-only module with DENYING SQL import. Collection trust/database is
+     * deliberately not required/created while registering a fresh installation. */
+    static async createDevice(bytes) { return this.instantiateApp(bytes, null); }
+    static async instantiateApp(bytes, sql) {
+        const binding = { sql, exports: null, run: null };
+        const x = await this.load(bytes, exports => { binding.exports = exports; binding.run = sql?.import(exports) ?? null; return { host_app_sql: (p, n) => binding.run?.(p, n) ?? 0n }; });
+        const names = ["rt_app_account_key_unlock", "rt_app_account_key_status", "rt_app_account_key_device_setup", "rt_app_private_collection_pin", "rt_app_private_enrol_restore", "rt_app_private_enrol_commitment", "rt_app_private_create_sign", "rt_app_private_device_enrol_sign", "rt_app_device_open", "rt_app_device_registered", "rt_app_device_adopt", "rt_app_device_retire", "rt_app_cp_enrol_sign", "rt_app_verify_handover", "rt_app_cp_bind_connector", "rt_app_cp_log_token_sign", "rt_app_open", "rt_app_log_bind", "rt_app_log_generation", "rt_app_log_reconnect", "rt_app_log_http_sign", "rt_app_log_calls", "rt_app_log_reply", "rt_app_log_no_response", "rt_app_log_retire", "rt_app_log_push", "rt_app_observations", "rt_app_shutdown"];
+        if (!(x.memory instanceof WebAssembly.Memory) || names.some(name => typeof x[name] !== "function"))
+            throw bad();
+        return new AppWasmRuntime(x, binding);
+    }
+    /** The app artifact never uses a legacy/config-default MemStore path. */
+    open(_config) { throw bad(); }
+    fail() { try {
+        if (this.active || this.attempted)
+            this.sql?.fence();
+    }
+    finally {
+        this.active = false;
+        this.deviceActive = false;
+        this.discard();
+    } }
+    guard(f) {
+        try {
+            return f();
+        }
+        catch {
+            this.fail();
+            throw bad();
+        }
+    }
+    /** One attempt. The caller must unwrap keys before this SYNCHRONOUS operation. */
+    openAppConsuming(c) {
+        let encoded = null;
+        try {
+            if (this.attempted || this.deviceAttempted || !this.sql || this.sql.needsRecovery)
+                throw bad();
+            this.attempted = true;
+            const endpoint = uint64(c.endpoint);
+            if (!Array.isArray(c.trustedRoots) || c.trustedRoots.length < 1 || c.trustedRoots.length > 64 || !Array.isArray(c.trustedSigners) || c.trustedSigners.length > 1_024)
+                throw bad();
+            if (!Number.isSafeInteger(c.sqliteVersion) || c.sqliteVersion < 0 || c.sqliteVersion > 0xffff_ffff)
+                throw bad();
+            const state = c.state === "e2e" ? 0 : c.state === "cloud_copy" ? 1 : -1;
+            const opened = c.opened === "fresh" ? 0 : c.opened === "existing" ? 1 : c.opened === "unclean" ? 2 : -1;
+            if (state < 0 || opened < 0 || typeof c.cloudCopyOptIn !== "boolean" || (state === 1) !== c.cloudCopyOptIn)
+                throw bad();
+            encoded = encodeSecret(new Map([
+                [0, 3], [1, uuidToBytes(c.collection)], [2, uuidToBytes(c.replicaId)], [3, uuidToBytes(c.deviceId)],
+                [4, endpoint], [5, c.trustedRoots.map(b32)], [6, c.trustedSigners.map(uuidToBytes)], [7, hashToBytes(c.expectedGenesis)],
+                [8, state], [9, c.cloudCopyOptIn], [10, b32(c.signSecretKey)], [11, b32(c.kemSecretKey)], [12, opened], [13, c.sqliteVersion], [16, policyPins(c.policyPins)],
+            ]));
+            if (encoded.length > 64 * 1024)
+                throw bad();
+            const error = this.guard(() => this.takeOut(this.app.rt_app_open(...this.put(encoded))));
+            if (error.length)
+                throw bad();
+            this.collection = c.collection;
+            this.deviceId = c.deviceId;
+            this.endpoint = endpoint;
+            this.active = true;
+            this.markOpened();
+        }
+        catch {
+            this.retireLog();
+            this.fail();
+            throw bad();
+        }
+        finally {
+            encoded?.fill(0);
+            c.signSecretKey?.fill(0);
+            c.kemSecretKey?.fill(0);
+        }
+    }
+    tick() { if (this.active && !this.retired)
+        this.guard(() => super.tick()); }
+    connect(options = {}) {
+        if (!this.active || this.retired || (options.collection !== undefined && (typeof options.collection !== "string" || options.collection.toLowerCase() !== this.collection?.toLowerCase())))
+            throw bad();
+        const port = super.connect(options), send = port.send.bind(port), close = port.close.bind(port);
+        port.send = frame => this.guard(() => send(frame));
+        port.close = () => this.guard(() => close());
+        return port;
+    }
+    /** Trusted host READ on its actual held port. Native admission/publication
+     * remains authoritative. There is no caller-selected session or MemStore path. */
+    executeBases(port, request) {
+        return this.readBases(port, request, "execute");
+    }
+    /** Separate native metadata READ exports; never caller sessions or Query RPC. */
+    discoverBases(port, operation, request) {
+        if (operation !== "list-views" && operation !== "read-view-source")
+            throw bad();
+        return this.readBases(port, request, operation);
+    }
+    readBases(port, request, operation) {
+        const session = this.sessionForPort(port);
+        const native = operation === "execute" ? this.app.rt_app_bases_execute : operation === "list-views" ? this.app.rt_app_bases_list_views : this.app.rt_app_bases_read_view_source;
+        if (!this.active || this.retired || !this.sql || this.sql.needsRecovery || session === null || typeof native !== "function")
+            throw bad();
+        if (!(request instanceof Uint8Array) || !request.length || request.length > 128 * 1024)
+            throw mdbaseError("invalid_request", "Bases request bytes exceed bound");
+        const owned = new Uint8Array(request);
+        try {
+            const out = this.guard(() => {
+                const packed = uint64(native.call(this.app, session, ...this.put(owned)));
+                const length = Number(packed & 0xffffffffn);
+                if (!length || length > (operation === "execute" ? 16 : 1) * 1024 * 1024)
+                    throw bad();
+                return this.takeOut(packed);
+            });
+            if (!this.active || this.retired || this.sql.needsRecovery || this.sessionForPort(port) !== session) {
+                out.fill(0);
+                throw bad();
+            }
+            return out;
+        }
+        finally {
+            owned.fill(0);
+        }
+    }
+    setupResources(port, operation, manifest, expectedDigest, decisions) {
+        const session = this.sessionForPort(port), native = this.app.rt_app_resources;
+        if (!this.active || this.retired || !this.sql || this.sql.needsRecovery || session === null || typeof native !== "function")
+            throw mdbaseError("unavailable", "resource setup unsupported", "resource_setup_unsupported");
+        if (operation !== "assess" && operation !== "apply")
+            throw bad();
+        if (operation === "apply" && (typeof expectedDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(expectedDigest)))
+            throw bad();
+        // A fifth member carries reviewed decisions and asks assess for the review.
+        const reviewing = decisions !== undefined;
+        const request = [1, operation === "apply" ? 1 : 0, resourceJson(manifest, true), expectedDigest ?? null];
+        if (reviewing)
+            request.push(resourceJson(resourceDecisions(decisions), true));
+        const input = encode(request);
+        if (!input.length || input.length > 512 * 1024) {
+            input.fill(0);
+            throw mdbaseError("invalid_request", "resource DATA exceeds bound");
+        }
+        let output;
+        try {
+            output = this.guard(() => {
+                const packed = uint64(native.call(this.app, session, ...this.put(input)));
+                const length = Number(packed & 0xffffffffn);
+                if (!length || length > 512 * 1024)
+                    throw bad();
+                return this.takeOut(packed);
+            });
+            if (!this.active || this.retired || this.sql.needsRecovery || this.sessionForPort(port) !== session)
+                throw bad();
+            const response = this.guard(() => decode(output));
+            if (!Array.isArray(response) || response.length !== 3 || response[0] !== 1 || typeof response[1] !== "boolean")
+                throw bad();
+            if (response[1] === false)
+                throw mdbaseError("unavailable", "resource setup unavailable", "resource_setup_unavailable");
+            const value = resourceJson(response[2], false);
+            return operation === "assess" ? resourceAssessment(value, reviewing) : modelResourcePlan(value);
+        }
+        finally {
+            input.fill(0);
+            output?.fill(0);
+        }
+    }
+    /** True only when native holds a FINAL rejected receipt for exactly this
+     * mutation on the port's own session. Anything else, including errors, is false. */
+    resourceRejected(port, mutationId) {
+        let bytes = null;
+        try {
+            const session = this.sessionForPort(port), native = this.app.rt_app_receipt_rejected;
+            if (!this.active || this.retired || session === null || typeof native !== "function" || !/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/.test(mutationId))
+                return false;
+            bytes = uuidToBytes(mutationId);
+            const answer = this.guard(() => native.call(this.app, session, ...this.put(bytes)));
+            return answer === 1 && this.active && !this.retired && this.sessionForPort(port) === session;
+        }
+        catch {
+            return false;
+        }
+        finally {
+            bytes?.fill(0);
+        }
+    }
+    /** Positive ONLY from native verified-policy signature + retained prefix and
+     * live READ session. Ordinary unavailable stays hosted; no saved implication. */
+    verifyHandover(port, source, witness) {
+        let bytes = null, device = null;
+        try {
+            const session = this.sessionForPort(port), collection = source.collection, deviceId = source.deviceId;
+            if (!this.active || this.retired || session === null || collection !== this.collection || source.isCurrent() !== true || !(witness instanceof Uint8Array) || witness.length > 64 * 1024)
+                return null;
+            bytes = new Uint8Array(witness);
+            device = uuidToBytes(deviceId);
+            const out = this.guard(() => this.takeOut(this.app.rt_app_verify_handover(session, ...this.put(device), ...this.put(bytes))));
+            if (out.length === 0 || this.sessionForPort(port) !== session || source.isCurrent() !== true || source.collection !== collection || source.deviceId !== deviceId)
+                return null;
+            const head = this.guard(() => confirmedHead.dec(decode(out)));
+            if (head.seq === 0 || [head.chain, head.policyGeneration, head.catalogGeneration].some(h => h === `sha256:${"00".repeat(32)}`))
+                return null;
+            return head;
+        }
+        catch {
+            return null;
+        }
+        finally {
+            bytes?.fill(0);
+            device?.fill(0);
+        }
+    }
+    /** One authenticated connector bootstrap pin before any LS binding. */
+    bindCpConnector(pin) {
+        let bytes = null;
+        try {
+            if (!this.active || this.retired || this.pump || this.cpPin || pin.isCurrent() !== true || pin.deviceId !== this.deviceId || pin.collection !== this.collection)
+                throw bad();
+            const connectorId = pin.connectorId;
+            bytes = uuidToBytes(connectorId);
+            if (bytes.every(b => b === 0))
+                throw bad();
+            if (this.guard(() => this.app.rt_app_cp_bind_connector(...this.put(bytes))) !== 1)
+                throw bad();
+            this.connectorId = connectorId;
+            this.cpPin = pin;
+        }
+        catch {
+            throw bad();
+        }
+        finally {
+            bytes?.fill(0);
+        }
+    }
+    deviceCurrent() {
+        try {
+            const pin = this.devicePin;
+            return this.deviceActive && !this.retired && pin !== null && pin.isCurrent() === true && pin.connectorId === this.connectorId && pin.deviceId === this.deviceId && pin.installationId === this.installationId;
+        }
+        catch {
+            return false;
+        }
+    }
+    publicResult(out) {
+        if (out.length > 1024)
+            throw bad();
+        const decoded = decode(out);
+        if (!(decoded instanceof Map))
+            throw bad();
+        const m = decoded;
+        if (m.size !== 4 || [0, 1, 2, 3].some(k => !m.has(k)))
+            throw bad();
+        const publicKey = (k) => { const value = m.get(k); if (!(value instanceof Uint8Array) || value.length !== 32 || value.every(b => b === 0))
+            throw bad(); return new Uint8Array(value); };
+        return { m, identity: Object.freeze({ signPublicKey: publicKey(0), kemPublicKey: publicKey(1), noisePublicKey: publicKey(2) }) };
+    }
+    /** Phase1 ONLY; no roots/genesis/Core/SQL/LS/RPC. Async protected outer
+     * unwrap precedes this sync native operation. Exactly one fresh/restore
+     * attempt, consuming BOTH sign/KEM loans; no caller Noise secret. */
+    openDeviceConsuming(c) {
+        let encoded = null;
+        try {
+            if (this.deviceAttempted || this.attempted || this.retired)
+                throw bad();
+            this.deviceAttempted = true;
+            const pin = c.pin;
+            this.devicePin = pin;
+            this.connectorId = pin.connectorId;
+            this.deviceId = pin.deviceId;
+            this.installationId = pin.installationId;
+            this.deviceActive = true;
+            if (!this.deviceCurrent())
+                throw bad();
+            const ids = [this.connectorId, this.deviceId, this.installationId].map(uuidToBytes);
+            if (ids.some(id => id.every(b => b === 0)))
+                throw bad();
+            const opened = c.opened;
+            if (opened.mode !== "fresh" && opened.mode !== "existing")
+                throw bad();
+            if (opened.mode === "existing" && (!(opened.envelope instanceof Uint8Array) || !opened.envelope.length || opened.envelope.length > 1024))
+                throw bad();
+            encoded = encodeSecret(new Map([[0, 1], [1, ids[0]], [2, ids[1]], [3, ids[2]], [4, opened.mode === "fresh" ? 0 : 1], [5, b32(c.signSecretKey)], [6, b32(c.kemSecretKey)], [7, opened.mode === "fresh" ? new Uint8Array() : new Uint8Array(opened.envelope)]]));
+            const out = this.guard(() => this.takeOut(this.app.rt_app_device_open(...this.put(encoded))));
+            if (!out.length || !this.deviceCurrent())
+                throw bad();
+            const result = this.guard(() => { const { m, identity } = this.publicResult(out); const wrapped = m.get(3); if (!(wrapped instanceof Uint8Array) || !wrapped.length || wrapped.length > 1024)
+                throw bad(); return { ...identity, envelope: new Uint8Array(wrapped) }; });
+            this.publicIdentity = { signPublicKey: new Uint8Array(result.signPublicKey), kemPublicKey: new Uint8Array(result.kemPublicKey), noisePublicKey: new Uint8Array(result.noisePublicKey) };
+            this.noiseEnvelope = new Uint8Array(result.envelope);
+            return Object.freeze(result);
+        }
+        catch {
+            this.retireLog();
+            throw bad();
+        }
+        finally {
+            encoded?.fill(0);
+            c.signSecretKey?.fill(0);
+            c.kemSecretKey?.fill(0);
+        }
+    }
+    /** Public binding check for this exact DEVICE-only custody result. Not an
+     * account/app grant, collection readiness or independent key attestation. */
+    deviceCustodyCurrent(pin, custody) {
+        try {
+            return this.deviceCurrent() && !this.active && this.publicIdentity !== null && this.noiseEnvelope !== null && pin.isCurrent() === true && pin.connectorId === this.connectorId && pin.deviceId === this.deviceId && pin.installationId === this.installationId && custody.envelope instanceof Uint8Array && custody.envelope.length === this.noiseEnvelope.length && custody.envelope.every((b, i) => b === this.noiseEnvelope[i]) && ["signPublicKey", "kemPublicKey", "noisePublicKey"].every(k => custody[k] instanceof Uint8Array && custody[k].length === 32 && custody[k].every((b, i) => b === this.publicIdentity[k][i]));
+        }
+        catch {
+            return false;
+        }
+    }
+    /** HOST ONLY actual authenticated response/protected stored receipt. Never
+     * inferred from ciphertext, same account, persistence or zero pending. */
+    acknowledgeDeviceRegistration(receipt) {
+        let encoded = null;
+        try {
+            if (!this.deviceCurrent() || this.active || this.deviceRegistered || !this.publicIdentity || receipt.connectorId !== this.connectorId || receipt.deviceId !== this.deviceId || receipt.installationId !== this.installationId)
+                throw bad();
+            for (const k of ["signPublicKey", "kemPublicKey", "noisePublicKey"])
+                if (b32(receipt[k]).some((b, i) => b !== this.publicIdentity[k][i]))
+                    throw bad();
+            encoded = encodeSecret(new Map([[0, uuidToBytes(receipt.connectorId)], [1, uuidToBytes(receipt.deviceId)], [2, uuidToBytes(receipt.installationId)], [3, new Uint8Array(receipt.signPublicKey)], [4, new Uint8Array(receipt.kemPublicKey)], [5, new Uint8Array(receipt.noisePublicKey)]]));
+            if (this.guard(() => this.app.rt_app_device_registered(...this.put(encoded))) !== 1 || !this.deviceCurrent())
+                throw bad();
+            this.deviceRegistered = true;
+        }
+        catch {
+            this.retireLog();
+            throw bad();
+        }
+        finally {
+            encoded?.fill(0);
+        }
+    }
+    /** Once-pinned CLOUD COPY purpose. Requires actual original registration,
+     * no private/SAS context and no seed re-loan, roots or SQL effects. */
+    prepareCloudCopyCollection(pin) {
+        let encoded = null;
+        try {
+            if (pin.approvalMode === "strict")
+                throw new AppStrictDeviceApprovalError();
+            if (this.cloudSource || this.privateAttempted || !this.deviceCurrent() || !this.deviceRegistered || this.active || pin.approvalMode !== "password-ak1" || !["create", "join"].includes(pin.purpose))
+                throw bad();
+            this.cloudSource = pin;
+            this.cloudCallback = pin.isCurrent;
+            this.cloudCollection = pin.collection;
+            this.cloudPurpose = pin.purpose;
+            if (!this.cloudCopyCollectionCurrent(pin))
+                throw bad();
+            const collection = uuidToBytes(pin.collection);
+            if (collection.every(v => v === 0))
+                throw bad();
+            encoded = encodeSecret(new Map([[0, collection], [1, pin.purpose === "create" ? 0 : 1]]));
+            if (this.guard(() => this.app.rt_app_cloud_copy_pin(...this.put(encoded))) !== 1 || !this.cloudCopyCollectionCurrent(pin))
+                throw bad();
+        }
+        catch (error) {
+            this.retireLog();
+            if (error instanceof AppStrictDeviceApprovalError)
+                throw error;
+            throw bad();
+        }
+        finally {
+            encoded?.fill(0);
+        }
+    }
+    cloudCopyCollectionCurrent(source) {
+        try {
+            const p = this.cloudSource;
+            return this.deviceCurrent() && !this.active && this.deviceRegistered && p !== null && (!source || source === p) && p.isCurrent === this.cloudCallback && p.isCurrent() === true && p.connectorId === this.connectorId && p.deviceId === this.deviceId && p.installationId === this.installationId && p.collection === this.cloudCollection && p.purpose === this.cloudPurpose && p.approvalMode === "password-ak1";
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Fixed native create domain; no configurable digest/subject/signer. */
+    signCloudCopyCreate(challenge) { return this.signCloudCopy(challenge, "create"); }
+    /** Fixed native join domain; no private enrol/SAS state. */
+    signCloudCopyJoin(challenge) { return this.signCloudCopy(challenge, "join"); }
+    signCloudCopy(challenge, purpose) {
+        let owned = null, signature = null;
+        try {
+            if (this.cloudIssued || !this.cloudCopyCollectionCurrent() || this.cloudPurpose !== purpose)
+                throw bad();
+            this.cloudIssued = true;
+            owned = new Uint8Array(b32(challenge));
+            signature = this.guard(() => this.takeOut(purpose === "create" ? this.app.rt_app_cloud_copy_create_sign(...this.put(owned)) : this.app.rt_app_cloud_copy_join_sign(...this.put(owned))));
+            if (signature.length !== 64 || !this.cloudCopyCollectionCurrent())
+                throw bad();
+            return signature;
+        }
+        catch {
+            signature?.fill(0);
+            this.retireLog();
+            throw bad();
+        }
+        finally {
+            owned?.fill(0);
+        }
+    }
+    /** Host-only ONCE, registered DEVICE phase. No Core/SQL/readiness; no caller
+     * fresh JS commit/secret. Existing must come from exact platform-protected
+     * public marker; never regenerate after uncertain enrolment. */
+    preparePrivateCollection(pin, opened) {
+        let encoded = null, restoredCommit = null;
+        try {
+            if (pin.approvalMode === "strict")
+                throw new AppStrictDeviceApprovalError();
+            if (this.cloudSource || this.privateAttempted || !this.deviceCurrent() || !this.deviceRegistered || this.active || pin.approvalMode !== "password-ak1" || !["create", "enrol"].includes(pin.purpose))
+                throw bad();
+            this.privateAttempted = true;
+            this.privateSource = pin;
+            this.prospectiveCollection = pin.collection;
+            this.privatePurpose = pin.purpose;
+            if (!this.privateCollectionCurrent())
+                throw bad();
+            const collection = uuidToBytes(pin.collection);
+            if (collection.every(v => v === 0))
+                throw bad();
+            if (opened.mode === "fresh") {
+                encoded = encodeSecret(new Map([[0, collection], [1, pin.purpose === "create" ? 0 : 1]]));
+                if (this.guard(() => this.app.rt_app_private_collection_pin(...this.put(encoded))) !== 1)
+                    throw bad();
+            }
+            else if (opened.mode === "existing") {
+                const m = opened.marker, p = this.publicIdentity;
+                if (pin.purpose !== "enrol" || !p || m.collection !== pin.collection || m.connectorId !== this.connectorId || m.deviceId !== this.deviceId || m.installationId !== this.installationId || typeof m.acknowledged !== "boolean")
+                    throw bad();
+                for (const k of ["signPublicKey", "kemPublicKey", "noisePublicKey"])
+                    if (!equalBytes(b32(m[k]), p[k]))
+                        throw bad();
+                const commit = new Uint8Array(b32(m.sasCommitment));
+                if (commit.every(v => v === 0))
+                    throw bad();
+                restoredCommit = commit;
+                encoded = encodeSecret(new Map([[0, 1], [1, collection], [2, uuidToBytes(m.connectorId)], [3, uuidToBytes(m.deviceId)], [4, uuidToBytes(m.installationId)], [5, new Uint8Array(m.signPublicKey)], [6, new Uint8Array(m.kemPublicKey)], [7, new Uint8Array(m.noisePublicKey)], [8, commit], [9, m.acknowledged]]));
+                this.privateEnrolAcknowledged = m.acknowledged;
+                if (this.guard(() => this.app.rt_app_private_enrol_restore(...this.put(encoded))) !== 1)
+                    throw bad();
+            }
+            else
+                throw bad();
+            if (!this.privateCollectionCurrent())
+                throw bad();
+            if (pin.purpose === "enrol") {
+                const commit = this.guard(() => this.takeOut(this.app.rt_app_private_enrol_commitment()));
+                if (commit.length !== 32 || commit.every(v => v === 0) || (restoredCommit !== null && !equalBytes(commit, restoredCommit)))
+                    throw bad();
+                this.sasCommitment = new Uint8Array(commit);
+            }
+        }
+        catch (error) {
+            this.retireLog();
+            if (error instanceof AppStrictDeviceApprovalError)
+                throw error;
+            throw bad();
+        }
+        finally {
+            encoded?.fill(0);
+        }
+    }
+    /** Actual acknowledged device public receipt, copied; no new authority. */
+    registeredDeviceReceipt() {
+        if (!this.deviceCurrent() || !this.deviceRegistered || !this.publicIdentity)
+            throw bad();
+        const p = this.publicIdentity;
+        return Object.freeze({ connectorId: this.connectorId, deviceId: this.deviceId, installationId: this.installationId, signPublicKey: new Uint8Array(p.signPublicKey), kemPublicKey: new Uint8Array(p.kemPublicKey), noisePublicKey: new Uint8Array(p.noisePublicKey) });
+    }
+    /** Public native-generated/restored marker to protect BEFORE any enrol POST. */
+    privateEnrolMarker() {
+        if (!this.privateCollectionCurrent() || this.privatePurpose !== "enrol" || !this.sasCommitment || !this.publicIdentity)
+            throw bad();
+        const p = this.publicIdentity;
+        return Object.freeze({ connectorId: this.connectorId, deviceId: this.deviceId, installationId: this.installationId, collection: this.prospectiveCollection, sasCommitment: new Uint8Array(this.sasCommitment), acknowledged: this.privateEnrolAcknowledged, signPublicKey: new Uint8Array(p.signPublicKey), kemPublicKey: new Uint8Array(p.kemPublicKey), noisePublicKey: new Uint8Array(p.noisePublicKey) });
+    }
+    privateCollectionCurrent(source) {
+        try {
+            if (source && (source.isCurrent() !== true || source.connectorId !== this.connectorId || source.deviceId !== this.deviceId || source.installationId !== this.installationId || source.collection !== this.prospectiveCollection || source.purpose !== this.privatePurpose || source.approvalMode !== "password-ak1"))
+                return false;
+            const p = this.privateSource;
+            return this.deviceCurrent() && !this.active && this.deviceRegistered && p !== null && p.isCurrent() === true && p.connectorId === this.connectorId && p.deviceId === this.deviceId && p.installationId === this.installationId && p.collection === this.prospectiveCollection && p.purpose === this.privatePurpose && p.approvalMode === "password-ak1";
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Dedicated private-create signature only, no configurable purpose/PK/digest. */
+    signPrivateCreate(challenge) {
+        let owned = null;
+        try {
+            if (!this.privateCollectionCurrent() || this.privatePurpose !== "create")
+                throw bad();
+            owned = new Uint8Array(b32(challenge));
+            const sig = this.guard(() => this.takeOut(this.app.rt_app_private_create_sign(...this.put(owned))));
+            if (sig.length !== 64 || !this.privateCollectionCurrent())
+                throw bad();
+            return sig;
+        }
+        catch {
+            this.retireLog();
+            throw bad();
+        }
+        finally {
+            owned?.fill(0);
+        }
+    }
+    /** Native public SAS commitment + dedicated enrol signature. No r/state or
+     * caller commit; strict approval/Noise handshake is not implemented in v1. */
+    signPrivateDeviceEnrol(challenge) {
+        let owned = null;
+        try {
+            if (!this.privateCollectionCurrent() || this.privatePurpose !== "enrol" || !this.sasCommitment || this.privateEnrolAcknowledged)
+                throw bad();
+            owned = new Uint8Array(b32(challenge));
+            const signature = this.guard(() => this.takeOut(this.app.rt_app_private_device_enrol_sign(...this.put(owned))));
+            if (signature.length !== 64 || !this.privateCollectionCurrent())
+                throw bad();
+            return Object.freeze({ signature, sasCommitment: new Uint8Array(this.sasCommitment) });
+        }
+        catch {
+            this.retireLog();
+            throw bad();
+        }
+        finally {
+            owned?.fill(0);
+        }
+    }
+    /** Phase2 consumes SAME native owners with genuine collection trust metadata.
+     * NO seed re-export/loan/recreation/rebind; device-phase v1 is unchanged. */
+    adoptDevice(c, sql) {
+        let encoded = null;
+        try {
+            if (!this.deviceCurrent() || !this.deviceRegistered || this.attempted || this.active || c.deviceId !== this.deviceId)
+                throw bad();
+            if (this.privateSource && (!this.privateCollectionCurrent() || c.collection !== this.prospectiveCollection))
+                throw bad();
+            if (this.cloudSource && (!this.cloudCopyCollectionCurrent() || c.collection !== this.cloudCollection || c.state !== "cloud_copy" || c.cloudCopyOptIn !== true))
+                throw bad();
+            const pins = policyPins(c.policyPins);
+            if (sql) {
+                if (this.sql || sql.needsRecovery || !this.sqlBinding.exports)
+                    throw bad();
+                this.sqlBinding.sql = sql;
+                this.sqlBinding.run = sql.import(this.sqlBinding.exports);
+            }
+            if (!this.sql || this.sql.needsRecovery)
+                throw bad();
+            this.attempted = true;
+            const endpoint = uint64(c.endpoint), state = c.state === "e2e" ? 0 : c.state === "cloud_copy" ? 1 : -1, opened = c.opened === "fresh" ? 0 : c.opened === "existing" ? 1 : c.opened === "unclean" ? 2 : -1;
+            if (state < 0 || opened < 0 || typeof c.cloudCopyOptIn !== "boolean" || (state === 1) !== c.cloudCopyOptIn || !Array.isArray(c.trustedRoots) || c.trustedRoots.length < 1 || c.trustedRoots.length > 64 || !Array.isArray(c.trustedSigners) || c.trustedSigners.length > 1024 || !Number.isSafeInteger(c.sqliteVersion) || c.sqliteVersion < 0 || c.sqliteVersion > 0xffff_ffff)
+                throw bad();
+            encoded = encodeSecret(new Map([[0, 4], [1, uuidToBytes(c.collection)], [2, uuidToBytes(c.replicaId)], [3, uuidToBytes(c.deviceId)], [4, endpoint], [5, c.trustedRoots.map(b32)], [6, c.trustedSigners.map(uuidToBytes)], [7, hashToBytes(c.expectedGenesis)], [8, state], [9, c.cloudCopyOptIn], [10, null], [11, null], [12, opened], [13, c.sqliteVersion], [14, uuidToBytes(this.connectorId)], [15, uuidToBytes(this.installationId)], [16, pins]]));
+            if (encoded.length > 64 * 1024)
+                throw bad();
+            const error = this.guard(() => this.takeOut(this.app.rt_app_device_adopt(...this.put(encoded))));
+            if (error.length || !this.deviceCurrent())
+                throw bad();
+            this.collection = c.collection;
+            this.endpoint = endpoint;
+            this.active = true;
+            this.markOpened();
+        }
+        catch {
+            this.retireLog();
+            this.fail();
+            throw bad();
+        }
+        finally {
+            encoded?.fill(0);
+        }
+    }
+    /** Separate fixed cp-enrol transcript over internally protected public keys.
+     * Borrowed nonce is independently copied; no key/identity/domain/digest inputs. */
+    signCpEnrol(challenge) {
+        let owned = null;
+        try {
+            if (!this.deviceCurrent() || !this.publicIdentity || this.active || this.pump) {
+                this.retireLog();
+                throw bad();
+            }
+            owned = new Uint8Array(b32(challenge));
+            const out = this.guard(() => this.takeOut(this.app.rt_app_cp_enrol_sign(...this.put(owned))));
+            if (!this.deviceCurrent()) {
+                this.retireLog();
+                throw bad();
+            }
+            if (!out.length)
+                throw bad();
+            const { m, identity } = this.guard(() => this.publicResult(out));
+            const signature = m.get(3);
+            if (!(signature instanceof Uint8Array) || signature.length !== 64 || ["signPublicKey", "kemPublicKey", "noisePublicKey"].some(k => identity[k].some((b, i) => b !== this.publicIdentity[k][i])))
+                throw bad();
+            return Object.freeze({ ...identity, signature: new Uint8Array(signature) });
+        }
+        catch {
+            this.retireLog();
+            throw bad();
+        }
+        finally {
+            owned?.fill(0);
+        }
+    }
+    /** Fixed CP purpose; no method/route/domain/digest or identity override. */
+    signCpLogToken(challenge) {
+        let owned = null;
+        try {
+            if (!this.active || this.retired || !this.cpPin)
+                throw bad();
+            const pin = this.cpPin;
+            let current = false;
+            try {
+                current = pin.isCurrent() === true && pin.connectorId === this.connectorId && pin.deviceId === this.deviceId && pin.collection === this.collection;
+            }
+            catch { /* unavailable identity is not authorization */ }
+            if (!current) {
+                this.retireLog();
+                throw bad();
+            }
+            owned = new Uint8Array(b32(challenge));
+            const sig = this.guard(() => this.takeOut(this.app.rt_app_cp_log_token_sign(...this.put(owned))));
+            if (sig.length !== 64) {
+                sig.fill(0);
+                throw bad();
+            }
+            return sig;
+        }
+        catch {
+            throw bad();
+        }
+        finally {
+            owned?.fill(0);
+        }
+    }
+    /** Host supplies a genuinely authenticated immutable transport, not a true flag. */
+    bindLogTransport(transport) {
+        try {
+            if (!this.active || this.retired || this.pump || this.endpoint === null || this.collection === null || transport.isCurrent() !== true || uint64(transport.endpoint) !== this.endpoint || transport.collection !== this.collection)
+                throw bad();
+        }
+        catch {
+            throw bad();
+        }
+        const bytes = uuidToBytes(this.collection);
+        if (this.guard(() => this.app.rt_app_log_bind(this.endpoint, ...this.put(bytes))) !== 1)
+            throw bad();
+        this.logGeneration = this.guard(() => uint64(this.app.rt_app_log_generation()));
+        if (this.logGeneration === 0n) {
+            this.retireLog();
+            throw bad();
+        }
+        this.pump = new AppLogPump(this, transport, { endpoint: this.endpoint, collection: this.collection });
+        this.transport = transport;
+        return this.pump;
+    }
+    /** HOST ONLY quiet foreground wake: asks the native replica to fetch the log
+     * head over the CURRENT authenticated session so remote entries are learned.
+     * No token, reconnect, status or readiness change; false when unsupported,
+     * not bound, already in flight, or unhealthy. Never retires the log; a trap
+     * fails the runtime exactly like tick(). */
+    requestLogHead() {
+        if (!this.active || this.retired || this.pump === null || typeof this.app.rt_app_log_head !== "function")
+            return false;
+        return this.guard(() => this.app.rt_app_log_head()) === 1;
+    }
+    /** True when this runtime can sign the push socket's `hello`. */
+    get supportsLogPush() { return typeof this.app.rt_app_log_hello_sign === "function"; }
+    /** Fixed ls-hello proof for the push socket of the CURRENT log generation
+     * (`nonce32 ‖ token`). Null when unsupported or refused; never a generic signer. */
+    signLogHello(nonce, token) {
+        let owned = null;
+        try {
+            if (!this.supportsLogPush || !this.active || this.retired || !this.pump || !this.transport || this.logGeneration === 0n || !this.transport.isCurrent())
+                return null;
+            if (!(nonce instanceof Uint8Array) || nonce.length !== 32 || typeof token !== "string" || token.length === 0 || token.length > 16 * 1024 || /[^\x21-\x7e]/.test(token))
+                return null;
+            const t = new TextEncoder().encode(token);
+            owned = new Uint8Array(32 + t.length);
+            owned.set(nonce, 0);
+            owned.set(t, 32);
+            t.fill(0);
+            const generation = this.logGeneration;
+            const signature = this.guard(() => this.takeOut(this.app.rt_app_log_hello_sign(generation, ...this.put(owned))));
+            if (signature.length !== 64) {
+                signature.fill(0);
+                return null;
+            }
+            return signature;
+        }
+        catch {
+            return null;
+        }
+        finally {
+            owned?.fill(0);
+        }
+    }
+    /** HOST ONLY wake AFTER fresh authenticated authority admission: drain/abort
+     * original pump before SAME-owner native session/generation replacement. May
+     * hang: owner must terminate Worker before releasing lease. Not readiness. */
+    async reconnectLogTransport(transport) {
+        const original = this.pump, generation = this.logGeneration, check = () => this.active && !this.retired && this.pump === original && original !== null && this.transport === transport && transport.isCurrent() === true && uint64(transport.endpoint) === this.endpoint && transport.collection === this.collection;
+        try {
+            if (!check())
+                throw bad();
+            await original.drainForAuthenticatedReconnect();
+            if (!check())
+                throw bad();
+            this.pump = null;
+            this.transport = null;
+            const bytes = uuidToBytes(this.collection);
+            try {
+                if (this.guard(() => this.app.rt_app_log_reconnect(this.endpoint, ...this.put(bytes))) !== 1)
+                    throw bad();
+            }
+            finally {
+                bytes.fill(0);
+            }
+            this.logGeneration = this.guard(() => uint64(this.app.rt_app_log_generation()));
+            if (this.logGeneration <= generation || !transport.isCurrent() || this.retired || !this.active)
+                throw bad();
+            this.pump = new AppLogPump(this, transport, { endpoint: this.endpoint, collection: this.collection });
+            this.transport = transport;
+            return this.pump;
+        }
+        catch {
+            this.retireLog();
+            throw bad();
+        }
+    }
+    /** Protected fixed-domain authority callback. Rust checks the original exact
+     * frame or its associated same-address commit; JS digest is NOT signing input. */
+    signLogHttp(proof) {
+        let encoded = null;
+        try {
+            if (!this.active || !this.pump || !this.transport || this.logGeneration === 0n || this.endpoint === null || proof.path !== "/v1/rpc" || proof.collection !== this.collection || uint64(proof.endpoint) !== this.endpoint || !this.transport.isCurrent())
+                throw bad();
+            if (!(proof.frame instanceof Uint8Array) || proof.frame.length === 0 || proof.frame.length > 16 * 1024 * 1024 || !(proof.nonce instanceof Uint8Array) || proof.nonce.length !== 32 || typeof proof.token !== "string" || proof.token.length === 0 || proof.token.length > 16 * 1024 || /[^\x21-\x7e]/.test(proof.token))
+                throw bad();
+            encoded = encodeSecret(new Map([[0, proof.frame], [1, proof.token], [2, proof.nonce]]));
+            const signature = this.guard(() => this.takeOut(this.app.rt_app_log_http_sign(this.endpoint, this.logGeneration, uint64(proof.originalCallId), ...this.put(encoded))));
+            if (signature.length !== 64) {
+                signature.fill(0);
+                throw bad();
+            }
+            return signature;
+        }
+        catch {
+            throw bad();
+        }
+        finally {
+            encoded?.fill(0);
+        }
+    }
+    takeLogCalls() {
+        if (!this.active || this.retired)
+            return [];
+        return this.guard(() => {
+            const bytes = this.takeOut(this.app.rt_app_log_calls());
+            if (!bytes.length)
+                return [];
+            const records = decode(bytes);
+            if (!Array.isArray(records) || records.length > 64)
+                throw bad();
+            return records.map(record => {
+                if (!(record instanceof Map))
+                    throw bad();
+                const fields = record;
+                const endpoint = fields.get(0), frame = fields.get(1), sidecar = fields.get(2);
+                if (uint64(endpoint) !== this.endpoint || !(frame instanceof Uint8Array) || (sidecar !== undefined && !(sidecar instanceof Uint8Array)))
+                    throw bad();
+                return { endpoint: endpoint, frame, ...(sidecar !== undefined ? { sidecar } : {}) };
+            });
+        });
+    }
+    acceptLogReply(id, bytes) {
+        if (!this.active || this.retired)
+            return false;
+        return this.guard(() => this.app.rt_app_log_reply(uint64(id), ...this.put(bytes)) === 1);
+    }
+    logNoResponse(id) { if (this.active && !this.retired)
+        this.guard(() => this.app.rt_app_log_no_response(uint64(id))); }
+    retireLog() {
+        this.logGeneration = 0n;
+        if (this.retired)
+            return;
+        this.retired = true;
+        this.cpPin = null;
+        this.connectorId = null;
+        this.devicePin = null;
+        this.installationId = null;
+        this.privateSource = null;
+        this.prospectiveCollection = null;
+        this.privatePurpose = null;
+        this.sasCommitment?.fill(0);
+        this.sasCommitment = null;
+        this.publicIdentity = null;
+        this.noiseEnvelope?.fill(0);
+        this.noiseEnvelope = null;
+        this.deviceActive = false;
+        this.deviceRegistered = false;
+        if (this.active)
+            this.guard(() => { super.dispose(); this.app.rt_app_log_retire(); });
+        else if (this.deviceAttempted)
+            this.guard(() => this.app.rt_app_device_retire());
+    }
+    /** Current authenticated service push only; transport fences its generation. */
+    pushLog(bytes) {
+        if (!this.active || this.retired || !this.pump || !this.transport)
+            return false;
+        return this.guard(() => {
+            const t = this.transport;
+            if (t.isCurrent() !== true || uint64(t.endpoint) !== this.endpoint || t.collection !== this.collection) {
+                this.retireLog();
+                return false;
+            }
+            return this.app.rt_app_log_push(...this.put(bytes)) === 1;
+        });
+    }
+    accountKeyCurrent(pin) {
+        try {
+            return this.active && !this.retired && pin.isCurrent() === true && pin.approvalMode === "password-ak1" && pin.collection === this.collection && pin.deviceId === this.deviceId && pin.connectorId === this.connectorId && pin.installationId === this.installationId && this.devicePin !== null && this.devicePin.isCurrent() === true && this.devicePin.connectorId === this.connectorId && this.devicePin.deviceId === this.deviceId && this.devicePin.installationId === this.installationId;
+        }
+        catch {
+            return false;
+        }
+    }
+    accountKeyState(bytes) {
+        const value = decode(bytes);
+        if (!(value instanceof Map))
+            throw bad();
+        const m = value;
+        if (m.size !== 2 || !m.has(0) || !m.has(1))
+            throw bad();
+        const state = m.get(0), reason = m.get(1);
+        if (state === 0 || state === 1) {
+            if (reason !== null)
+                throw bad();
+            return Object.freeze({ state: state === 0 ? "pending" : "keyed" });
+        }
+        const reasons = ["not_private", "not_ready", "not_enrolled", "not_authorized", "device_missing", "enrolment_mismatch", "not_keyed", "no_wrap", "inconsistent", "failed", "outcome_unknown"];
+        if (state !== 2 || typeof reason !== "string" || !reasons.includes(reason))
+            throw bad();
+        return Object.freeze({ state: "refused", reason: reason });
+    }
+    /** Protected transient R32 loan, consumed/wiped even when refused/trapped.
+     * Native derives only this collection; pending/queued is NOT keyed. */
+    unlockAccountKeyConsuming(pin, secret) {
+        try {
+            if (pin.approvalMode === "strict")
+                throw new AppStrictDeviceApprovalError();
+            if (!this.accountKeyCurrent(pin))
+                throw bad();
+            b32(secret);
+            const state = this.guard(() => this.accountKeyState(this.takeOut(this.app.rt_app_account_key_unlock(...this.put(secret)))));
+            if (!this.accountKeyCurrent(pin))
+                throw bad();
+            return state;
+        }
+        catch (error) {
+            this.retireLog();
+            if (error instanceof AppStrictDeviceApprovalError)
+                throw error;
+            throw bad();
+        }
+        finally {
+            if (secret instanceof Uint8Array)
+                secret.fill(0);
+        }
+    }
+    /** Protected R32 setup loan, consumed even when refused/trapped. Only an
+     * existing CP-enrolled EXACT recovery device; queued != recovery_keyed, and
+     * recovery_keyed != this app keyed/Saved. Ordinary native KEY_GRANT only. */
+    setupAccountKeyDeviceConsuming(pin, secret) {
+        try {
+            if (pin.approvalMode === "strict")
+                throw new AppStrictDeviceApprovalError();
+            if (!this.accountKeyCurrent(pin))
+                throw bad();
+            b32(secret);
+            const state = this.guard(() => this.accountKeyState(this.takeOut(this.app.rt_app_account_key_device_setup(...this.put(secret)))));
+            if (!this.accountKeyCurrent(pin))
+                throw bad();
+            return state.state === "refused" ? state : Object.freeze({ state: state.state === "keyed" ? "recovery_keyed" : "recovery_pending" });
+        }
+        catch (error) {
+            this.retireLog();
+            if (error instanceof AppStrictDeviceApprovalError)
+                throw error;
+            throw bad();
+        }
+        finally {
+            if (secret instanceof Uint8Array)
+                secret.fill(0);
+        }
+    }
+    /** Actual native applied-policy/trust status; not zero-pending/readback/Saved. */
+    accountKeyStatus(pin) {
+        try {
+            if (!this.accountKeyCurrent(pin))
+                throw bad();
+            const state = this.guard(() => this.accountKeyState(this.takeOut(this.app.rt_app_account_key_status())));
+            if (!this.accountKeyCurrent(pin))
+                throw bad();
+            return state;
+        }
+        catch {
+            this.retireLog();
+            throw bad();
+        }
+    }
+    observations() {
+        if (!this.active || this.retired)
+            throw bad();
+        return this.guard(() => {
+            const value = decode(this.takeOut(this.app.rt_app_observations()));
+            if (!(value instanceof Map))
+                throw bad();
+            const m = value;
+            for (const k of [1, 2, 3, 4])
+                if (typeof m.get(k) !== "boolean")
+                    throw bad();
+            return { status: syncStatus.dec(m.get(0)), keyringRebuilding: m.get(1), keyringRebuildFailed: m.get(2), snapshotInstallAvailable: m.get(3), requiresReopen: m.get(4) };
+        });
+    }
+    /** Drain/abort current generation BEFORE key/runtime/SQL shutdown. May hang;
+     * owner must terminate the Worker before releasing its lease in that case. */
+    async close() {
+        if (this.pump) {
+            await this.pump.close();
+            this.pump = null;
+            this.transport = null;
+        }
+        return this.shutdown();
+    }
+    /** Synchronous clean shutdown only with no undrained pump. Not a saved claim. */
+    shutdown() {
+        if (!this.active) {
+            if (this.deviceAttempted && !this.retired)
+                this.retireLog();
+            this.discard();
+            return false;
+        }
+        if (this.pump) {
+            void this.pump.close().catch(() => { });
+            this.fail();
+            return false;
+        }
+        try {
+            this.retireLog();
+            super.dispose();
+            return this.guard(() => this.app.rt_app_shutdown() === 1) && this.sql !== null && !this.sql.needsRecovery;
+        }
+        finally {
+            this.active = false;
+            this.discard();
+        }
+    }
+    dispose() { this.shutdown(); }
+}
+//# sourceMappingURL=wasm-runtime.js.map