@novasamatech/host-papp 0.8.4 → 0.8.6

package/dist/sso/auth/impl.d.ts

@@ -17,6 +17,8 @@ export type AuthComponent = ReturnType<typeof createAuth>;
 export type OnAuthSuccess = (event: {
     session: StoredUserSession;
     identityChatPrivateKey: Uint8Array;
+    /** `papp_encr_pub` — PApp's P-256 SSO ECDH public key. */
+    ssoEncPubKey: Uint8Array;
 }) => Promise<void> | void;
 type Params = {
     hostMetadata?: HostMetadata;

package/dist/sso/auth/impl.js

@@ -1,5 +1,6 @@
 import { createAccountId, createLocalSessionAccount, createRemoteSessionAccount } from '@novasamatech/statement-store';
 import { ResultAsync, errAsync, okAsync } from 'neverthrow';
+import { createSharedSecret } from '../../crypto.js';
 import { createFlowId, emitHostPappDebugMessage } from '../../debugBus.js';
 import { AbortError } from '../../helpers/abortError.js';
 import { createState, readonly } from '../../helpers/state.js';
@@ -148,21 +149,30 @@ export function createAuth({ hostMetadata, deviceIdentity, deviceIdentityStore,
     };
     function persistAndNotify(identity, success, _flowId) {
         const localAccount = createLocalSessionAccount(createAccountId(identity.statementAccountPublicKey));
-        const remoteAccount = createRemoteSessionAccount(createAccountId(success.peerStatementAccountId ?? new Uint8Array(32)), success.deviceEncPubKey);
-        const session = createStoredUserSession(localAccount, remoteAccount, createAccountId(success.rootAccountId ?? new Uint8Array(32)), {
+        if (!success.peerStatementAccountId) {
+            return errAsync(new Error("Can't derive peerStatementAccountId from statement proof signer"));
+        }
+        const sharedSecret = createSharedSecret(identity.encryptionPrivateKey, success.ssoEncPubKey);
+        const remoteAccount = createRemoteSessionAccount(createAccountId(success.peerStatementAccountId), sharedSecret);
+        const session = createStoredUserSession(localAccount, remoteAccount, createAccountId(success.rootAccountId), {
             identityAccountId: createAccountId(success.identityAccountId),
             identityChatPublicKey: success.identityChatPublicKey,
+            ssoEncPubKey: success.ssoEncPubKey,
+            rootEntropySource: success.rootEntropySource,
         });
         return userSecretRepository
             .write(session.id, {
             ssSecret: identity.statementAccountSecret,
             encrSecret: identity.encryptionPrivateKey,
-            entropy: new Uint8Array(0),
             identityChatPrivateKey: success.identityChatPrivateKey,
         })
             .andThen(() => ssoSessionRepository.add(session))
             .andThen(() => onAuthSuccess
-            ? ResultAsync.fromPromise(Promise.resolve(onAuthSuccess({ session, identityChatPrivateKey: success.identityChatPrivateKey })), toError).map(() => session)
+            ? ResultAsync.fromPromise(Promise.resolve(onAuthSuccess({
+                session,
+                identityChatPrivateKey: success.identityChatPrivateKey,
+                ssoEncPubKey: success.ssoEncPubKey,
+            })), toError).map(() => session)
             : okAsync(session));
     }
 }

package/dist/sso/auth/scale/handshakeV2.d.ts

@@ -10,7 +10,7 @@
  *
  * `Success` carries:
  *   - `identityAccountId`     — user identity sr25519 accountId (32 bytes).
- *                               Adressing for chat / username lookup / session
+ *                               Addressing for chat / username lookup / session
  *                               topic derivation.
  *   - `rootAccountId`         — user root sr25519 accountId (32 bytes). Parent
  *                               for soft-derivation of product accounts; PApp
@@ -23,11 +23,13 @@
  *                               P-256 uncompressed). Tells the host which key to
  *                               use when addressing chat envelopes back to the
  *                               authorising PApp device.
- *
- * Total wire length of `Success` is 32 + 32 + 32 + 65 = 161 bytes. Transit security
- * comes from the outer envelope's ECDH-AES wrap; no per-field signature is
- * carried — multi-device authorisation is asserted by the user-identity-signed
- * roster events (`DeviceAdded`/`DeviceRemoved`) published separately.
+ *   - `ssoEncPubKey`          — `papp_encr_pub` (65 bytes, P-256 uncompressed); see
+ *                               the `HandshakeSuccessV2` codec doc below.
+ *   - `rootEntropySource`     — 32 bytes; `blake2b256_keyed(rootAccountSecret,
+ *                               "product-entropy-derivation")` per RFC-0007 (layer 1).
+ *                               Lets the host derive product entropy deterministically
+ *                               (`host_derive_entropy`) without ever holding the raw
+ *                               root account secret. See the codec doc below.
  */
 export declare const MetadataKey: import("scale-ts").Codec<{
     tag: "Custom";
@@ -96,10 +98,6 @@ export declare const HandshakeProposalV2: import("scale-ts").Codec<{
         value: undefined;
     }, string][];
 }>;
-/**
- * V2 lives at SCALE discriminant 1; index 0 is reserved for legacy V1 which
- * neither side emits. The `_v1Reserved` slot pushes V2 to discriminant 1.
- */
 export declare const VersionedHandshakeProposal: import("scale-ts").Codec<{
     tag: "_v1Reserved";
     value: undefined;
@@ -131,89 +129,21 @@ export declare const VersionedHandshakeProposal: import("scale-ts").Codec<{
         }, string][];
     };
 }>;
-/** 32 + 32 + 32 + 65 = 161 bytes (spec v0.2.1) */
 export declare const HandshakeSuccessV2: import("scale-ts").Codec<{
     identityAccountId: Uint8Array<ArrayBufferLike>;
     rootAccountId: Uint8Array<ArrayBufferLike>;
     identityChatPrivateKey: Uint8Array<ArrayBufferLike>;
+    ssoEncPubKey: Uint8Array<ArrayBufferLike>;
     deviceEncPubKey: Uint8Array<ArrayBufferLike>;
+    rootEntropySource: Uint8Array<ArrayBufferLike>;
 }>;
-export type HandshakeSuccessV2Value = {
-    identityAccountId: Uint8Array;
-    /** Nullable for v0.2 peers (Android `feature/location-for-handshake`). */
-    rootAccountId: Uint8Array | null;
-    identityChatPrivateKey: Uint8Array;
-    deviceEncPubKey: Uint8Array;
-};
-/** 32 + 32 + 65 = 129 bytes (spec v0.2 — Android `feature/location-for-handshake`) */
-export declare const HandshakeSuccessV2Legacy: import("scale-ts").Codec<{
-    identityAccountId: Uint8Array<ArrayBufferLike>;
-    identityChatPrivateKey: Uint8Array<ArrayBufferLike>;
-    deviceEncPubKey: Uint8Array<ArrayBufferLike>;
-}>;
-export type DecodedHandshakeResponseV2 = {
-    tag: 'Pending';
-    value: {
-        tag: 'AllowanceAllocation';
-        value: undefined;
-    };
-} | {
-    tag: 'Success';
-    value: HandshakeSuccessV2Value;
-} | {
-    tag: 'Failed';
-    value: string;
-};
-/**
- * Length-dispatched decoder for the inner `EncryptedHandshakeResponseV2`
- * plaintext. v0.2 (Android) ships 129-byte Success bodies without
- * `rootAccountId`; v0.2.1 ships 161-byte bodies with it. Surfaces
- * `rootAccountId: null` for the legacy case — chat doesn't need it.
- */
-export declare const decodeEncryptedHandshakeResponseV2: (bytes: Uint8Array) => DecodedHandshakeResponseV2;
-/**
- * Derive the user identity chat P-256 public key from the shared private
- * scalar received in `HandshakeSuccessV2`. Both desktop and mobile must derive
- * identically (uncompressed 65-byte form) so downstream session topics agree.
- */
+/** Derive the identity chat P-256 public key (uncompressed) from its private scalar. */
 export declare const deriveIdentityChatPublicKey: (privateKey: Uint8Array) => Uint8Array;
-/**
- * Inner Pending sub-statuses. Only `AllowanceAllocation` today.
- *
- * Encoded with its own SCALE discriminant byte — the peer's SCALE library does
- * NOT elide enum-variant indices for sealed interfaces (verified on the wire:
- * `Pending(AllowanceAllocation)` arrives as `0x00 0x00`). Both sides must keep
- * the discriminant when encoding so dispatch agrees.
- */
 export declare const HandshakeStatusV2: import("scale-ts").Codec<{
     tag: "AllowanceAllocation";
     value: undefined;
 }>;
-export type EncryptedHandshakeResponseV2Value = {
-    tag: 'Pending';
-    value: {
-        tag: 'AllowanceAllocation';
-        value: undefined;
-    };
-} | {
-    tag: 'Success';
-    value: HandshakeSuccessV2Value;
-} | {
-    tag: 'Failed';
-    value: string;
-};
-/**
- * Inner handshake response variant. Wire shape (matches peer SCALE encoding):
- *
- *   - Pending → 0x00 || HandshakeStatusV2 (today: 0x00 for AllowanceAllocation), 2 bytes total
- *   - Success → 0x01 || HandshakeSuccessV2 (161 bytes), 162 bytes total
- *   - Failed  → 0x02 || SCALE-encoded UTF-8 reason string
- *
- * Earlier builds shipped a custom length-dispatched codec assuming elision —
- * that assumption was wrong and produced false `Failed("")` reads on every
- * `Pending` response. Native scale-ts `Enum` preserves the discriminant and
- * matches the peer's wire format directly.
- */
+/** Inner handshake response variant. */
 export declare const EncryptedHandshakeResponseV2: import("scale-ts").Codec<{
     tag: "Failed";
     value: string;
@@ -229,7 +159,9 @@ export declare const EncryptedHandshakeResponseV2: import("scale-ts").Codec<{
         identityAccountId: Uint8Array<ArrayBufferLike>;
         rootAccountId: Uint8Array<ArrayBufferLike>;
         identityChatPrivateKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
         deviceEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
     };
 }>;
 export declare const HandshakeResponseV2: import("scale-ts").Codec<{

package/dist/sso/auth/scale/handshakeV2.js

@@ -10,7 +10,7 @@
  *
  * `Success` carries:
  *   - `identityAccountId`     — user identity sr25519 accountId (32 bytes).
- *                               Adressing for chat / username lookup / session
+ *                               Addressing for chat / username lookup / session
  *                               topic derivation.
  *   - `rootAccountId`         — user root sr25519 accountId (32 bytes). Parent
  *                               for soft-derivation of product accounts; PApp
@@ -23,18 +23,20 @@
  *                               P-256 uncompressed). Tells the host which key to
  *                               use when addressing chat envelopes back to the
  *                               authorising PApp device.
- *
- * Total wire length of `Success` is 32 + 32 + 32 + 65 = 161 bytes. Transit security
- * comes from the outer envelope's ECDH-AES wrap; no per-field signature is
- * carried — multi-device authorisation is asserted by the user-identity-signed
- * roster events (`DeviceAdded`/`DeviceRemoved`) published separately.
+ *   - `ssoEncPubKey`          — `papp_encr_pub` (65 bytes, P-256 uncompressed); see
+ *                               the `HandshakeSuccessV2` codec doc below.
+ *   - `rootEntropySource`     — 32 bytes; `blake2b256_keyed(rootAccountSecret,
+ *                               "product-entropy-derivation")` per RFC-0007 (layer 1).
+ *                               Lets the host derive product entropy deterministically
+ *                               (`host_derive_entropy`) without ever holding the raw
+ *                               root account secret. See the codec doc below.
  */
 import { p256 } from '@noble/curves/nist.js';
 import { Bytes, Enum, Struct, Tuple, Vector, _void, str } from 'scale-ts';
 const AccountIdCodec = Bytes(32);
 const PublicKeyCodec = Bytes(65);
 const PrivateKeyCodec = Bytes(32);
-// ── Proposal ────────────────────────────────────────────────────────────
+const EntropySourceCodec = Bytes(32);
 export const MetadataKey = Enum({
     Custom: str,
     HostName: _void,
@@ -52,106 +54,27 @@ export const HandshakeProposalV2 = Struct({
     device: Device,
     metadata: Vector(MetadataEntry),
 });
-/**
- * V2 lives at SCALE discriminant 1; index 0 is reserved for legacy V1 which
- * neither side emits. The `_v1Reserved` slot pushes V2 to discriminant 1.
- */
 export const VersionedHandshakeProposal = Enum({
     _v1Reserved: _void,
     V2: HandshakeProposalV2,
 });
-// ── Response (V2) ───────────────────────────────────────────────────────
-/** 32 + 32 + 32 + 65 = 161 bytes (spec v0.2.1) */
+// V2 Response
 export const HandshakeSuccessV2 = Struct({
     identityAccountId: AccountIdCodec,
     rootAccountId: AccountIdCodec,
     identityChatPrivateKey: PrivateKeyCodec,
+    /** PApp's P-256 SSO ECDH public key (`papp_encr_pub`). */
+    ssoEncPubKey: PublicKeyCodec,
     deviceEncPubKey: PublicKeyCodec,
+    /** Layer-1 source for deterministic product entropy derivation (RFC-0007). */
+    rootEntropySource: EntropySourceCodec,
 });
-/** 32 + 32 + 65 = 129 bytes (spec v0.2 — Android `feature/location-for-handshake`) */
-export const HandshakeSuccessV2Legacy = Struct({
-    identityAccountId: AccountIdCodec,
-    identityChatPrivateKey: PrivateKeyCodec,
-    deviceEncPubKey: PublicKeyCodec,
-});
-/**
- * Length-dispatched decoder for the inner `EncryptedHandshakeResponseV2`
- * plaintext. v0.2 (Android) ships 129-byte Success bodies without
- * `rootAccountId`; v0.2.1 ships 161-byte bodies with it. Surfaces
- * `rootAccountId: null` for the legacy case — chat doesn't need it.
- */
-export const decodeEncryptedHandshakeResponseV2 = (bytes) => {
-    if (bytes.length === 0)
-        throw new Error('EncryptedHandshakeResponseV2: empty plaintext');
-    const tag = bytes[0];
-    // `slice` not `subarray` — scale-ts decoders read from buffer byteOffset 0.
-    const body = bytes.slice(1);
-    if (tag === 0) {
-        if (body.length === 0)
-            throw new Error('EncryptedHandshakeResponseV2: Pending body empty');
-        return { tag: 'Pending', value: { tag: 'AllowanceAllocation', value: undefined } };
-    }
-    if (tag === 1) {
-        if (body.length === 161) {
-            const decoded = HandshakeSuccessV2.dec(body);
-            return {
-                tag: 'Success',
-                value: {
-                    identityAccountId: decoded.identityAccountId,
-                    rootAccountId: decoded.rootAccountId,
-                    identityChatPrivateKey: decoded.identityChatPrivateKey,
-                    deviceEncPubKey: decoded.deviceEncPubKey,
-                },
-            };
-        }
-        if (body.length === 129) {
-            const decoded = HandshakeSuccessV2Legacy.dec(body);
-            return {
-                tag: 'Success',
-                value: {
-                    identityAccountId: decoded.identityAccountId,
-                    rootAccountId: null,
-                    identityChatPrivateKey: decoded.identityChatPrivateKey,
-                    deviceEncPubKey: decoded.deviceEncPubKey,
-                },
-            };
-        }
-        throw new Error(`EncryptedHandshakeResponseV2: Success body length ${body.length} not in {129, 161}`);
-    }
-    if (tag === 2) {
-        return { tag: 'Failed', value: str.dec(body) };
-    }
-    throw new Error(`EncryptedHandshakeResponseV2: unknown variant tag ${tag}`);
-};
-/**
- * Derive the user identity chat P-256 public key from the shared private
- * scalar received in `HandshakeSuccessV2`. Both desktop and mobile must derive
- * identically (uncompressed 65-byte form) so downstream session topics agree.
- */
+/** Derive the identity chat P-256 public key (uncompressed) from its private scalar. */
 export const deriveIdentityChatPublicKey = (privateKey) => p256.getPublicKey(privateKey, false);
-/**
- * Inner Pending sub-statuses. Only `AllowanceAllocation` today.
- *
- * Encoded with its own SCALE discriminant byte — the peer's SCALE library does
- * NOT elide enum-variant indices for sealed interfaces (verified on the wire:
- * `Pending(AllowanceAllocation)` arrives as `0x00 0x00`). Both sides must keep
- * the discriminant when encoding so dispatch agrees.
- */
 export const HandshakeStatusV2 = Enum({
     AllowanceAllocation: _void,
 });
-/**
- * Inner handshake response variant. Wire shape (matches peer SCALE encoding):
- *
- *   - Pending → 0x00 || HandshakeStatusV2 (today: 0x00 for AllowanceAllocation), 2 bytes total
- *   - Success → 0x01 || HandshakeSuccessV2 (161 bytes), 162 bytes total
- *   - Failed  → 0x02 || SCALE-encoded UTF-8 reason string
- *
- * Earlier builds shipped a custom length-dispatched codec assuming elision —
- * that assumption was wrong and produced false `Failed("")` reads on every
- * `Pending` response. Native scale-ts `Enum` preserves the discriminant and
- * matches the peer's wire format directly.
- */
+/** Inner handshake response variant. */
 export const EncryptedHandshakeResponseV2 = Enum({
     Pending: HandshakeStatusV2,
     Success: HandshakeSuccessV2,

package/dist/sso/auth/v2/service.d.ts

@@ -55,6 +55,10 @@ export type StartPairingDeps = {
      * `initialProcessedDataHex` value is up to date.
      */
     onStatementProcessed?: (dataHex: string) => void;
+    /**
+     * Turns on logging for statement store interaction
+     */
+    __DEBUG?: boolean;
 };
 export type Pairing = {
     qrPayload: string;

package/dist/sso/auth/v2/service.js

@@ -23,7 +23,7 @@
  * higher layers drive a UI hook off this and update an onboarding screen.
  */
 import { BehaviorSubject } from 'rxjs';
-import { VersionedHandshakeResponse, decodeEncryptedHandshakeResponseV2 } from '../scale/handshakeV2.js';
+import { EncryptedHandshakeResponseV2, VersionedHandshakeResponse } from '../scale/handshakeV2.js';
 import { decryptResponseEnvelope } from './envelope.js';
 import { buildPairingDeeplink } from './proposal.js';
 import { advance, fromInnerResponse, isTerminal, submitted } from './state.js';
@@ -75,14 +75,13 @@ export const startPairingV2 = (deps) => {
         pollHandle = null;
     };
     const log = (msg, extra) => {
+        if (!deps.__DEBUG)
+            return;
         if (extra === undefined)
             console.info(`[sso-v2] ${msg}`);
         else
             console.info(`[sso-v2] ${msg}`, extra);
     };
-    log(`subscribing to pairing topic ${toHexFull(topic)}`);
-    log(`device statementAccountId ${toHexFull(deps.deviceIdentity.statementAccountPublicKey)}`);
-    log(`device encryptionPublicKey ${toHexFull(deps.deviceIdentity.encryptionPublicKey)}`);
     // One-shot probe: query the topic right away so we know whether any answer
     // statement was already posted before our subscription connected.
     void deps.statementStore.queryStatements({ matchAll: [topic] }).match(statements => log(`queryStatements probe: ${statements.length} statement(s)`), err => log('queryStatements probe failed', err));
@@ -121,7 +120,7 @@ export const startPairingV2 = (deps) => {
         const peerStatementAccountId = extractStatementSigner(statement);
         let next;
         try {
-            next = fromInnerResponse(decodeEncryptedHandshakeResponseV2(innerBytes), peerStatementAccountId);
+            next = fromInnerResponse(EncryptedHandshakeResponseV2.dec(innerBytes), peerStatementAccountId);
         }
         catch (err) {
             log(`inner decode failed; innerBytes (${innerBytes.length}b) = ${toHexFull(innerBytes)}`, err);

package/dist/sso/auth/v2/state.d.ts

@@ -14,7 +14,8 @@
  * The state object is what UIs render and what the chat layer gates on
  * before submitting any V2 statements.
  */
-import type { DecodedHandshakeResponseV2 } from '../scale/handshakeV2.js';
+import type { CodecType } from 'scale-ts';
+import type { EncryptedHandshakeResponseV2, HandshakeSuccessV2 } from '../scale/handshakeV2.js';
 export type HandshakeIdleState = {
     tag: 'Idle';
 };
@@ -25,35 +26,14 @@ export type HandshakePendingState = {
     tag: 'Pending';
     reason: 'AllowanceAllocation';
 };
-export type HandshakeSuccessState = {
+export type HandshakeSuccessState = CodecType<typeof HandshakeSuccessV2> & {
     tag: 'Success';
-    /** User identity sr25519 accountId (32 bytes). */
-    identityAccountId: Uint8Array;
-    /**
-     * User root sr25519 accountId (32 bytes) — the parent for soft-derivation
-     * of product accounts. Nullable: peers on spec v0.2 (Android
-     * `feature/location-for-handshake`) omit this field. Product-account
-     * derivation degrades gracefully when absent; chat does not use it.
-     */
-    rootAccountId: Uint8Array | null;
-    /**
-     * User identity chat P-256 private key (32 bytes raw scalar) shared by
-     * PApp with this device per the multi-device spec. Sensitive; persist in
-     * OS-keychain-backed secure storage and never forward.
-     */
-    identityChatPrivateKey: Uint8Array;
     /**
      * Derived locally from `identityChatPrivateKey` via P-256 scalar
      * multiplication (uncompressed 65-byte form). Both sides MUST derive
      * identically; downstream session topics depend on it.
      */
     identityChatPublicKey: Uint8Array;
-    /**
-     * Encryption public key of the authorising PApp device (65 bytes,
-     * P-256 uncompressed). Used by the host when addressing chat envelopes
-     * back to the authorising device.
-     */
-    deviceEncPubKey: Uint8Array;
     /**
      * The pairing-topic statement was signed by PApp's device statement
      * account. `HandshakeSuccessV2` doesn't carry it in the encrypted body, so
@@ -71,11 +51,11 @@ export type HandshakeState = HandshakeIdleState | HandshakeSubmittedState | Hand
 export declare const idle: () => HandshakeIdleState;
 export declare const submitted: () => HandshakeSubmittedState;
 /**
- * Translate the length-dispatched-decoded `EncryptedHandshakeResponseV2` into
- * the public state. Pure — no I/O. The caller decrypts the outer envelope and
- * runs `decodeEncryptedHandshakeResponseV2` first.
+ * Translate a decoded `EncryptedHandshakeResponseV2` into the public state.
+ * Pure — no I/O. The caller decrypts the outer envelope and decodes the inner
+ * payload via `EncryptedHandshakeResponseV2.dec` first.
  */
-export declare const fromInnerResponse: (response: DecodedHandshakeResponseV2, peerStatementAccountId?: Uint8Array | null) => HandshakeState;
+export declare const fromInnerResponse: (response: CodecType<typeof EncryptedHandshakeResponseV2>, peerStatementAccountId?: Uint8Array | null) => HandshakeState;
 /**
  * Forward-only transition guard: rejects regressions like Success → Pending.
  * Idempotent on same-tag transitions (returns current by reference) so callers

package/dist/sso/auth/v2/state.js

@@ -18,9 +18,9 @@ import { deriveIdentityChatPublicKey } from '../scale/handshakeV2.js';
 export const idle = () => ({ tag: 'Idle' });
 export const submitted = () => ({ tag: 'Submitted' });
 /**
- * Translate the length-dispatched-decoded `EncryptedHandshakeResponseV2` into
- * the public state. Pure — no I/O. The caller decrypts the outer envelope and
- * runs `decodeEncryptedHandshakeResponseV2` first.
+ * Translate a decoded `EncryptedHandshakeResponseV2` into the public state.
+ * Pure — no I/O. The caller decrypts the outer envelope and decodes the inner
+ * payload via `EncryptedHandshakeResponseV2.dec` first.
  */
 export const fromInnerResponse = (response, peerStatementAccountId = null) => {
     switch (response.tag) {
@@ -35,6 +35,8 @@ export const fromInnerResponse = (response, peerStatementAccountId = null) => {
                 identityChatPrivateKey: response.value.identityChatPrivateKey,
                 identityChatPublicKey: deriveIdentityChatPublicKey(response.value.identityChatPrivateKey),
                 deviceEncPubKey: response.value.deviceEncPubKey,
+                ssoEncPubKey: response.value.ssoEncPubKey,
+                rootEntropySource: response.value.rootEntropySource,
                 peerStatementAccountId,
             };
         case 'Failed':

package/dist/sso/sessionManager/userSession.js

@@ -79,6 +79,12 @@ export function createUserSession({ userSession, statementStore, encryption, sto
         statementStore,
         encryption,
         prover,
+        // V1 sessions historically derived SessionId by feeding the peer's raw
+        // encryption pubkey into khash; preserve that behaviour here so existing
+        // V1 channels stay byte-identical post-refactor. V2 callers (e.g.
+        // polkadot-desktop's V2SsoSession) pass the ECDH-derived shared secret
+        // explicitly per Mobile SSO spec v0.2.2.
+        sessionKey: userSession.remoteAccount.publicKey,
         maxRequestSize: MAX_SSO_REQUEST_SIZE,
     });
     const processedMessages = fieldListView({

package/dist/sso/userSecretRepository.d.ts

@@ -6,7 +6,6 @@ type StoredUserSecrets = CodecType<typeof StoredUserSecretsCodec>;
 declare const StoredUserSecretsCodec: import("scale-ts").Codec<{
     ssSecret: SsSecret;
     encrSecret: EncrSecret;
-    entropy: Uint8Array<ArrayBufferLike>;
     identityChatPrivateKey: Uint8Array<ArrayBufferLike>;
 }>;
 export type UserSecretRepository = ReturnType<typeof createUserSecretRepository>;

package/dist/sso/userSecretRepository.js

@@ -8,26 +8,17 @@ import { toError } from '../helpers/utils.js';
 const StoredUserSecretsCodec = Struct({
     ssSecret: BrandedBytesCodec(),
     encrSecret: BrandedBytesCodec(),
-    entropy: Bytes(),
     // V2 addition: user identity chat private key (P-256 raw scalar, 32 bytes).
     // Sensitive — kept encrypted at rest alongside the per-session ss/encr secrets.
     identityChatPrivateKey: Bytes(32),
 });
 export function createUserSecretRepository(salt, storage) {
-    const baseKey = 'UserSecrets';
+    const baseKey = 'UserSecretsV2';
     const encode = fromThrowable(StoredUserSecretsCodec.enc, toError);
     const decode = fromThrowable((value) => {
         if (!value)
             return null;
-        try {
-            return StoredUserSecretsCodec.dec(value);
-        }
-        catch {
-            // 0.7.x V1 blobs are missing `identityChatPrivateKey` and decode short.
-            // Treat as absent — a fresh handshake (required after 0.8.0 upgrade)
-            // will overwrite.
-            return null;
-        }
+        return StoredUserSecretsCodec.dec(value);
     }, toError);
     const encrypt = fromThrowable((value) => {
         const aes = getAes(salt);

package/dist/sso/userSessionRepository.d.ts

@@ -15,14 +15,18 @@ declare const storedUserSessionCodec: import("scale-ts").Codec<{
         pin: string | undefined;
     };
     rootAccountId: AccountId;
-    identityAccountId: AccountId | undefined;
-    identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
+    identityAccountId: AccountId;
+    identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+    ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+    rootEntropySource: Uint8Array<ArrayBufferLike>;
 }>;
 type StoredUserSessionV2Extras = {
-    identityAccountId?: AccountId;
-    identityChatPublicKey?: Uint8Array;
+    identityAccountId: AccountId;
+    identityChatPublicKey: Uint8Array;
+    ssoEncPubKey: Uint8Array;
+    rootEntropySource: Uint8Array;
 };
-export declare function createStoredUserSession(localAccount: LocalSessionAccount, remoteAccount: RemoteSessionAccount, rootAccountId: AccountId, extras?: StoredUserSessionV2Extras): StoredUserSession;
+export declare function createStoredUserSession(localAccount: LocalSessionAccount, remoteAccount: RemoteSessionAccount, rootAccountId: AccountId, extras: StoredUserSessionV2Extras): StoredUserSession;
 export declare const createUserSessionRepository: (storage: StorageAdapter) => {
     add(value: {
         id: string;
@@ -36,8 +40,10 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
     }): import("neverthrow").ResultAsync<{
         id: string;
         localAccount: {
@@ -50,8 +56,10 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
     }, Error>;
     filter(fn: (value: {
         id: string;
@@ -65,8 +73,10 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
     }) => boolean): import("neverthrow").ResultAsync<{
         id: string;
         localAccount: {
@@ -79,8 +89,10 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
     }[], Error>;
     mutate(fn: (value: {
         id: string;
@@ -94,8 +106,10 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
     }[]) => {
         id: string;
         localAccount: {
@@ -108,8 +122,10 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
     }[]): import("neverthrow").ResultAsync<{
         id: string;
         localAccount: {
@@ -122,8 +138,10 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
     }[], Error>;
     read(): import("neverthrow").ResultAsync<{
         id: string;
@@ -137,8 +155,10 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
     }[], Error>;
     write(value: {
         id: string;
@@ -152,8 +172,10 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
     }[]): import("neverthrow").ResultAsync<null, Error> | import("neverthrow").ResultAsync<{
         id: string;
         localAccount: {
@@ -166,8 +188,10 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
     }[], Error>;
     clear(): import("neverthrow").ResultAsync<void, Error>;
     subscribe(fn: (value: {
@@ -182,8 +206,10 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
     }[]) => void): VoidFunction;
 };
 export {};

package/dist/sso/userSessionRepository.js

@@ -2,7 +2,7 @@ import { AccountIdCodec, LocalSessionAccountCodec, RemoteSessionAccountCodec } f
 import { fieldListView } from '@novasamatech/storage-adapter';
 import { nanoid } from 'nanoid';
 import { fromHex, toHex } from 'polkadot-api/utils';
-import { Bytes, Option, Struct, Vector, str } from 'scale-ts';
+import { Bytes, Struct, Vector, str } from 'scale-ts';
 // V2 fields trail V1 fields so a future schema rev can append further
 // `Option`-wrapped fields without breaking decode of 0.8.0 blobs.
 const storedUserSessionCodec = Struct({
@@ -10,10 +10,18 @@ const storedUserSessionCodec = Struct({
     localAccount: LocalSessionAccountCodec,
     remoteAccount: RemoteSessionAccountCodec,
     rootAccountId: AccountIdCodec,
-    identityAccountId: Option(AccountIdCodec),
-    identityChatPublicKey: Option(Bytes(65)),
+    identityAccountId: AccountIdCodec,
+    identityChatPublicKey: Bytes(65),
+    // `papp_encr_pub` (65-byte uncompressed P-256). Persisted so the host can
+    // rebuild its SSO session transport (`shared_secret_session =
+    // ECDH(host_encr_secret, ssoEncPubKey)`) on a cold start without re-running
+    // the handshake.
+    ssoEncPubKey: Bytes(65),
+    // RFC-0007 layer-1 `rootEntropySource` from the handshake; consumed by the
+    // host's `host_derive_entropy` handler via `deriveProductEntropyFromSource`.
+    rootEntropySource: Bytes(32),
 });
-export function createStoredUserSession(localAccount, remoteAccount, rootAccountId, extras = {}) {
+export function createStoredUserSession(localAccount, remoteAccount, rootAccountId, extras) {
     return {
         id: nanoid(12),
         localAccount,
@@ -21,25 +29,16 @@ export function createStoredUserSession(localAccount, remoteAccount, rootAccount
         rootAccountId,
         identityAccountId: extras.identityAccountId,
         identityChatPublicKey: extras.identityChatPublicKey,
+        ssoEncPubKey: extras.ssoEncPubKey,
+        rootEntropySource: extras.rootEntropySource,
     };
 }
 export const createUserSessionRepository = (storage) => {
     const codec = Vector(storedUserSessionCodec);
     return fieldListView({
         storage,
-        key: 'SsoSessions',
-        from: x => {
-            try {
-                return codec.dec(fromHex(x));
-            }
-            catch {
-                // 0.7.x V1 blobs use the prior codec shape and won't decode against
-                // V2's extended struct. Treat as empty so the caller (and the
-                // fieldListView mutate machinery) start clean; the next write
-                // overwrites the bad blob.
-                return [];
-            }
-        },
+        key: 'SsoSessionsV2',
+        from: x => codec.dec(fromHex(x)),
         to: x => toHex(codec.enc(x)),
     });
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@novasamatech/host-papp",
   "type": "module",
-  "version": "0.8.4",
+  "version": "0.8.6",
   "description": "Polkadot app integration",
   "license": "Apache-2.0",
   "repository": {
@@ -34,10 +34,10 @@
     "@noble/ciphers": "2.2.0",
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
-    "@novasamatech/host-api": "0.8.4",
-    "@novasamatech/scale": "0.8.4",
-    "@novasamatech/statement-store": "0.8.4",
-    "@novasamatech/storage-adapter": "0.8.4",
+    "@novasamatech/host-api": "0.8.6",
+    "@novasamatech/scale": "0.8.6",
+    "@novasamatech/statement-store": "0.8.6",
+    "@novasamatech/storage-adapter": "0.8.6",
     "@polkadot-api/utils": "^0.4.0",
     "@polkadot-labs/hdkd-helpers": "^0.0.30",
     "nanoevents": "9.1.0",