@novasamatech/host-papp 0.8.5 → 0.8.7-0

package/LICENSE

@@ -0,0 +1,176 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

package/dist/sso/auth/impl.d.ts

@@ -17,13 +17,8 @@ export type AuthComponent = ReturnType<typeof createAuth>;
 export type OnAuthSuccess = (event: {
     session: StoredUserSession;
     identityChatPrivateKey: Uint8Array;
-    /**
-     * `papp_encr_pub` from Mobile SSO spec v0.2.2. `null` when the peer
-     * shipped a pre-v0.2.2 `HandshakeSuccessV2` body (no `sso_encr_pub_key`
-     * field on the wire). The host's SSO session transport stays inactive
-     * while null; chat is unaffected since it uses `identityChatPrivateKey`.
-     */
-    ssoEncPubKey: Uint8Array | null;
+    /** `papp_encr_pub` — PApp's P-256 SSO ECDH public key. */
+    ssoEncPubKey: Uint8Array;
 }) => Promise<void> | void;
 type Params = {
     hostMetadata?: HostMetadata;

package/dist/sso/auth/impl.js

@@ -1,5 +1,6 @@
 import { createAccountId, createLocalSessionAccount, createRemoteSessionAccount } from '@novasamatech/statement-store';
 import { ResultAsync, errAsync, okAsync } from 'neverthrow';
+import { createSharedSecret } from '../../crypto.js';
 import { createFlowId, emitHostPappDebugMessage } from '../../debugBus.js';
 import { AbortError } from '../../helpers/abortError.js';
 import { createState, readonly } from '../../helpers/state.js';
@@ -148,17 +149,26 @@ export function createAuth({ hostMetadata, deviceIdentity, deviceIdentityStore,
     };
     function persistAndNotify(identity, success, _flowId) {
         const localAccount = createLocalSessionAccount(createAccountId(identity.statementAccountPublicKey));
-        const remoteAccount = createRemoteSessionAccount(createAccountId(success.peerStatementAccountId ?? new Uint8Array(32)), success.deviceEncPubKey);
-        const session = createStoredUserSession(localAccount, remoteAccount, createAccountId(success.rootAccountId ?? new Uint8Array(32)), {
+        if (!success.peerStatementAccountId) {
+            return errAsync(new Error("Can't derive peerStatementAccountId from statement proof signer"));
+        }
+        const sharedSecret = createSharedSecret(identity.encryptionPrivateKey, success.ssoEncPubKey);
+        const remoteAccount = createRemoteSessionAccount(createAccountId(success.peerStatementAccountId), sharedSecret);
+        const session = createStoredUserSession(localAccount, remoteAccount, createAccountId(success.rootAccountId), {
             identityAccountId: createAccountId(success.identityAccountId),
             identityChatPublicKey: success.identityChatPublicKey,
-            ssoEncPubKey: success.ssoEncPubKey ?? undefined,
+            ssoEncPubKey: success.ssoEncPubKey,
+            rootEntropySource: success.rootEntropySource,
+            // The peer device's long-lived P-256 encryption key. Persisted (rather
+            // than derived into `remoteAccount.publicKey`, which is the SSO shared
+            // secret consumed by the session manager's `createEncryption`) so the
+            // host's device-sync channel can address the paired device by ECDH.
+            deviceEncPubKey: success.deviceEncPubKey,
         });
         return userSecretRepository
             .write(session.id, {
             ssSecret: identity.statementAccountSecret,
             encrSecret: identity.encryptionPrivateKey,
-            entropy: new Uint8Array(0),
             identityChatPrivateKey: success.identityChatPrivateKey,
         })
             .andThen(() => ssoSessionRepository.add(session))

package/dist/sso/auth/scale/handshakeV2.d.ts

@@ -10,7 +10,7 @@
  *
  * `Success` carries:
  *   - `identityAccountId`     — user identity sr25519 accountId (32 bytes).
- *                               Adressing for chat / username lookup / session
+ *                               Addressing for chat / username lookup / session
  *                               topic derivation.
  *   - `rootAccountId`         — user root sr25519 accountId (32 bytes). Parent
  *                               for soft-derivation of product accounts; PApp
@@ -23,11 +23,13 @@
  *                               P-256 uncompressed). Tells the host which key to
  *                               use when addressing chat envelopes back to the
  *                               authorising PApp device.
- *
- * Total wire length of `Success` is 32 + 32 + 32 + 65 = 161 bytes. Transit security
- * comes from the outer envelope's ECDH-AES wrap; no per-field signature is
- * carried — multi-device authorisation is asserted by the user-identity-signed
- * roster events (`DeviceAdded`/`DeviceRemoved`) published separately.
+ *   - `ssoEncPubKey`          — `papp_encr_pub` (65 bytes, P-256 uncompressed); see
+ *                               the `HandshakeSuccessV2` codec doc below.
+ *   - `rootEntropySource`     — 32 bytes; `blake2b256_keyed(rootAccountSecret,
+ *                               "product-entropy-derivation")` per RFC-0007 (layer 1).
+ *                               Lets the host derive product entropy deterministically
+ *                               (`host_derive_entropy`) without ever holding the raw
+ *                               root account secret. See the codec doc below.
  */
 export declare const MetadataKey: import("scale-ts").Codec<{
     tag: "Custom";
@@ -96,10 +98,6 @@ export declare const HandshakeProposalV2: import("scale-ts").Codec<{
         value: undefined;
     }, string][];
 }>;
-/**
- * V2 lives at SCALE discriminant 1; index 0 is reserved for legacy V1 which
- * neither side emits. The `_v1Reserved` slot pushes V2 to discriminant 1.
- */
 export declare const VersionedHandshakeProposal: import("scale-ts").Codec<{
     tag: "_v1Reserved";
     value: undefined;
@@ -131,121 +129,21 @@ export declare const VersionedHandshakeProposal: import("scale-ts").Codec<{
         }, string][];
     };
 }>;
-/**
- * 32 + 32 + 32 + 65 + 65 = 226 bytes (spec v0.2.2).
- *
- * `ssoEncPubKey` is `papp_encr_pub` per spec § Encrypted response — V2 — the
- * P-256 public key PApp uses for SSO session ECDH. Required to compute
- * `shared_secret_session = ECDH(host_encr_secret, ssoEncPubKey)`. PApp keypair
- * derivation is implementation-defined: Android derives under `//wallet//sso`
- * (`SsoDerivationDomains.SSO_DERIVATION_DOMAIN`); iOS currently reuses
- * `//wallet//chat`. The host treats this field as opaque public material —
- * which keypair PApp picked is invisible here.
- */
 export declare const HandshakeSuccessV2: import("scale-ts").Codec<{
     identityAccountId: Uint8Array<ArrayBufferLike>;
     rootAccountId: Uint8Array<ArrayBufferLike>;
     identityChatPrivateKey: Uint8Array<ArrayBufferLike>;
     ssoEncPubKey: Uint8Array<ArrayBufferLike>;
     deviceEncPubKey: Uint8Array<ArrayBufferLike>;
+    rootEntropySource: Uint8Array<ArrayBufferLike>;
 }>;
-export type HandshakeSuccessV2Value = {
-    identityAccountId: Uint8Array;
-    /** Nullable for v0.2 peers (Android `feature/location-for-handshake`). */
-    rootAccountId: Uint8Array | null;
-    identityChatPrivateKey: Uint8Array;
-    /**
-     * Nullable for v0.2 / v0.2.1 peers (any PApp build that does not yet ship
-     * spec v0.2.2). The host's SSO session transport stays inactive while
-     * null — sign/vrf/etc operations fail at the boundary until PApp emits
-     * the new field.
-     */
-    ssoEncPubKey: Uint8Array | null;
-    deviceEncPubKey: Uint8Array;
-};
-/** 32 + 32 + 32 + 65 = 161 bytes (spec v0.2.1) */
-export declare const HandshakeSuccessV2_v021: import("scale-ts").Codec<{
-    identityAccountId: Uint8Array<ArrayBufferLike>;
-    rootAccountId: Uint8Array<ArrayBufferLike>;
-    identityChatPrivateKey: Uint8Array<ArrayBufferLike>;
-    deviceEncPubKey: Uint8Array<ArrayBufferLike>;
-}>;
-/** 32 + 32 + 65 = 129 bytes (spec v0.2 — Android `feature/location-for-handshake`) */
-export declare const HandshakeSuccessV2Legacy: import("scale-ts").Codec<{
-    identityAccountId: Uint8Array<ArrayBufferLike>;
-    identityChatPrivateKey: Uint8Array<ArrayBufferLike>;
-    deviceEncPubKey: Uint8Array<ArrayBufferLike>;
-}>;
-export type DecodedHandshakeResponseV2 = {
-    tag: 'Pending';
-    value: {
-        tag: 'AllowanceAllocation';
-        value: undefined;
-    };
-} | {
-    tag: 'Success';
-    value: HandshakeSuccessV2Value;
-} | {
-    tag: 'Failed';
-    value: string;
-};
-/**
- * Length-dispatched decoder for the inner `EncryptedHandshakeResponseV2`
- * plaintext. Three Success body shapes are accepted, one per spec rev:
- *
- *   226 bytes (spec v0.2.2) — includes `ssoEncPubKey` (`papp_encr_pub`).
- *   161 bytes (spec v0.2.1) — `ssoEncPubKey` absent; surfaced as `null`.
- *   129 bytes (spec v0.2)   — `rootAccountId` AND `ssoEncPubKey` absent.
- *
- * Older peers degrade gracefully: chat continues to work via
- * `identityChatPrivateKey`, but the SSO session transport (which needs
- * `ssoEncPubKey` to derive `shared_secret_session`) stays inactive on
- * the host until the peer upgrades.
- */
-export declare const decodeEncryptedHandshakeResponseV2: (bytes: Uint8Array) => DecodedHandshakeResponseV2;
-/**
- * Derive the user identity chat P-256 public key from the shared private
- * scalar received in `HandshakeSuccessV2`. Both desktop and mobile must derive
- * identically (uncompressed 65-byte form) so downstream session topics agree.
- */
+/** Derive the identity chat P-256 public key (uncompressed) from its private scalar. */
 export declare const deriveIdentityChatPublicKey: (privateKey: Uint8Array) => Uint8Array;
-/**
- * Inner Pending sub-statuses. Only `AllowanceAllocation` today.
- *
- * Encoded with its own SCALE discriminant byte — the peer's SCALE library does
- * NOT elide enum-variant indices for sealed interfaces (verified on the wire:
- * `Pending(AllowanceAllocation)` arrives as `0x00 0x00`). Both sides must keep
- * the discriminant when encoding so dispatch agrees.
- */
 export declare const HandshakeStatusV2: import("scale-ts").Codec<{
     tag: "AllowanceAllocation";
     value: undefined;
 }>;
-export type EncryptedHandshakeResponseV2Value = {
-    tag: 'Pending';
-    value: {
-        tag: 'AllowanceAllocation';
-        value: undefined;
-    };
-} | {
-    tag: 'Success';
-    value: HandshakeSuccessV2Value;
-} | {
-    tag: 'Failed';
-    value: string;
-};
-/**
- * Inner handshake response variant. Wire shape (matches peer SCALE encoding):
- *
- *   - Pending → 0x00 || HandshakeStatusV2 (today: 0x00 for AllowanceAllocation), 2 bytes total
- *   - Success → 0x01 || HandshakeSuccessV2 (161 bytes), 162 bytes total
- *   - Failed  → 0x02 || SCALE-encoded UTF-8 reason string
- *
- * Earlier builds shipped a custom length-dispatched codec assuming elision —
- * that assumption was wrong and produced false `Failed("")` reads on every
- * `Pending` response. Native scale-ts `Enum` preserves the discriminant and
- * matches the peer's wire format directly.
- */
+/** Inner handshake response variant. */
 export declare const EncryptedHandshakeResponseV2: import("scale-ts").Codec<{
     tag: "Failed";
     value: string;
@@ -263,6 +161,7 @@ export declare const EncryptedHandshakeResponseV2: import("scale-ts").Codec<{
         identityChatPrivateKey: Uint8Array<ArrayBufferLike>;
         ssoEncPubKey: Uint8Array<ArrayBufferLike>;
         deviceEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
     };
 }>;
 export declare const HandshakeResponseV2: import("scale-ts").Codec<{

package/dist/sso/auth/scale/handshakeV2.js

@@ -10,7 +10,7 @@
  *
  * `Success` carries:
  *   - `identityAccountId`     — user identity sr25519 accountId (32 bytes).
- *                               Adressing for chat / username lookup / session
+ *                               Addressing for chat / username lookup / session
  *                               topic derivation.
  *   - `rootAccountId`         — user root sr25519 accountId (32 bytes). Parent
  *                               for soft-derivation of product accounts; PApp
@@ -23,18 +23,20 @@
  *                               P-256 uncompressed). Tells the host which key to
  *                               use when addressing chat envelopes back to the
  *                               authorising PApp device.
- *
- * Total wire length of `Success` is 32 + 32 + 32 + 65 = 161 bytes. Transit security
- * comes from the outer envelope's ECDH-AES wrap; no per-field signature is
- * carried — multi-device authorisation is asserted by the user-identity-signed
- * roster events (`DeviceAdded`/`DeviceRemoved`) published separately.
+ *   - `ssoEncPubKey`          — `papp_encr_pub` (65 bytes, P-256 uncompressed); see
+ *                               the `HandshakeSuccessV2` codec doc below.
+ *   - `rootEntropySource`     — 32 bytes; `blake2b256_keyed(rootAccountSecret,
+ *                               "product-entropy-derivation")` per RFC-0007 (layer 1).
+ *                               Lets the host derive product entropy deterministically
+ *                               (`host_derive_entropy`) without ever holding the raw
+ *                               root account secret. See the codec doc below.
  */
 import { p256 } from '@noble/curves/nist.js';
 import { Bytes, Enum, Struct, Tuple, Vector, _void, str } from 'scale-ts';
 const AccountIdCodec = Bytes(32);
 const PublicKeyCodec = Bytes(65);
 const PrivateKeyCodec = Bytes(32);
-// ── Proposal ────────────────────────────────────────────────────────────
+const EntropySourceCodec = Bytes(32);
 export const MetadataKey = Enum({
     Custom: str,
     HostName: _void,
@@ -52,146 +54,27 @@ export const HandshakeProposalV2 = Struct({
     device: Device,
     metadata: Vector(MetadataEntry),
 });
-/**
- * V2 lives at SCALE discriminant 1; index 0 is reserved for legacy V1 which
- * neither side emits. The `_v1Reserved` slot pushes V2 to discriminant 1.
- */
 export const VersionedHandshakeProposal = Enum({
     _v1Reserved: _void,
     V2: HandshakeProposalV2,
 });
-// ── Response (V2) ───────────────────────────────────────────────────────
-/**
- * 32 + 32 + 32 + 65 + 65 = 226 bytes (spec v0.2.2).
- *
- * `ssoEncPubKey` is `papp_encr_pub` per spec § Encrypted response — V2 — the
- * P-256 public key PApp uses for SSO session ECDH. Required to compute
- * `shared_secret_session = ECDH(host_encr_secret, ssoEncPubKey)`. PApp keypair
- * derivation is implementation-defined: Android derives under `//wallet//sso`
- * (`SsoDerivationDomains.SSO_DERIVATION_DOMAIN`); iOS currently reuses
- * `//wallet//chat`. The host treats this field as opaque public material —
- * which keypair PApp picked is invisible here.
- */
+// V2 Response
 export const HandshakeSuccessV2 = Struct({
     identityAccountId: AccountIdCodec,
     rootAccountId: AccountIdCodec,
     identityChatPrivateKey: PrivateKeyCodec,
+    /** PApp's P-256 SSO ECDH public key (`papp_encr_pub`). */
     ssoEncPubKey: PublicKeyCodec,
     deviceEncPubKey: PublicKeyCodec,
+    /** Layer-1 source for deterministic product entropy derivation (RFC-0007). */
+    rootEntropySource: EntropySourceCodec,
 });
-/** 32 + 32 + 32 + 65 = 161 bytes (spec v0.2.1) */
-export const HandshakeSuccessV2_v021 = Struct({
-    identityAccountId: AccountIdCodec,
-    rootAccountId: AccountIdCodec,
-    identityChatPrivateKey: PrivateKeyCodec,
-    deviceEncPubKey: PublicKeyCodec,
-});
-/** 32 + 32 + 65 = 129 bytes (spec v0.2 — Android `feature/location-for-handshake`) */
-export const HandshakeSuccessV2Legacy = Struct({
-    identityAccountId: AccountIdCodec,
-    identityChatPrivateKey: PrivateKeyCodec,
-    deviceEncPubKey: PublicKeyCodec,
-});
-/**
- * Length-dispatched decoder for the inner `EncryptedHandshakeResponseV2`
- * plaintext. Three Success body shapes are accepted, one per spec rev:
- *
- *   226 bytes (spec v0.2.2) — includes `ssoEncPubKey` (`papp_encr_pub`).
- *   161 bytes (spec v0.2.1) — `ssoEncPubKey` absent; surfaced as `null`.
- *   129 bytes (spec v0.2)   — `rootAccountId` AND `ssoEncPubKey` absent.
- *
- * Older peers degrade gracefully: chat continues to work via
- * `identityChatPrivateKey`, but the SSO session transport (which needs
- * `ssoEncPubKey` to derive `shared_secret_session`) stays inactive on
- * the host until the peer upgrades.
- */
-export const decodeEncryptedHandshakeResponseV2 = (bytes) => {
-    if (bytes.length === 0)
-        throw new Error('EncryptedHandshakeResponseV2: empty plaintext');
-    const tag = bytes[0];
-    // `slice` not `subarray` — scale-ts decoders read from buffer byteOffset 0.
-    const body = bytes.slice(1);
-    if (tag === 0) {
-        if (body.length === 0)
-            throw new Error('EncryptedHandshakeResponseV2: Pending body empty');
-        return { tag: 'Pending', value: { tag: 'AllowanceAllocation', value: undefined } };
-    }
-    if (tag === 1) {
-        if (body.length === 226) {
-            const decoded = HandshakeSuccessV2.dec(body);
-            return {
-                tag: 'Success',
-                value: {
-                    identityAccountId: decoded.identityAccountId,
-                    rootAccountId: decoded.rootAccountId,
-                    identityChatPrivateKey: decoded.identityChatPrivateKey,
-                    ssoEncPubKey: decoded.ssoEncPubKey,
-                    deviceEncPubKey: decoded.deviceEncPubKey,
-                },
-            };
-        }
-        if (body.length === 161) {
-            const decoded = HandshakeSuccessV2_v021.dec(body);
-            return {
-                tag: 'Success',
-                value: {
-                    identityAccountId: decoded.identityAccountId,
-                    rootAccountId: decoded.rootAccountId,
-                    identityChatPrivateKey: decoded.identityChatPrivateKey,
-                    ssoEncPubKey: null,
-                    deviceEncPubKey: decoded.deviceEncPubKey,
-                },
-            };
-        }
-        if (body.length === 129) {
-            const decoded = HandshakeSuccessV2Legacy.dec(body);
-            return {
-                tag: 'Success',
-                value: {
-                    identityAccountId: decoded.identityAccountId,
-                    rootAccountId: null,
-                    identityChatPrivateKey: decoded.identityChatPrivateKey,
-                    ssoEncPubKey: null,
-                    deviceEncPubKey: decoded.deviceEncPubKey,
-                },
-            };
-        }
-        throw new Error(`EncryptedHandshakeResponseV2: Success body length ${body.length} not in {129, 161, 226}`);
-    }
-    if (tag === 2) {
-        return { tag: 'Failed', value: str.dec(body) };
-    }
-    throw new Error(`EncryptedHandshakeResponseV2: unknown variant tag ${tag}`);
-};
-/**
- * Derive the user identity chat P-256 public key from the shared private
- * scalar received in `HandshakeSuccessV2`. Both desktop and mobile must derive
- * identically (uncompressed 65-byte form) so downstream session topics agree.
- */
+/** Derive the identity chat P-256 public key (uncompressed) from its private scalar. */
 export const deriveIdentityChatPublicKey = (privateKey) => p256.getPublicKey(privateKey, false);
-/**
- * Inner Pending sub-statuses. Only `AllowanceAllocation` today.
- *
- * Encoded with its own SCALE discriminant byte — the peer's SCALE library does
- * NOT elide enum-variant indices for sealed interfaces (verified on the wire:
- * `Pending(AllowanceAllocation)` arrives as `0x00 0x00`). Both sides must keep
- * the discriminant when encoding so dispatch agrees.
- */
 export const HandshakeStatusV2 = Enum({
     AllowanceAllocation: _void,
 });
-/**
- * Inner handshake response variant. Wire shape (matches peer SCALE encoding):
- *
- *   - Pending → 0x00 || HandshakeStatusV2 (today: 0x00 for AllowanceAllocation), 2 bytes total
- *   - Success → 0x01 || HandshakeSuccessV2 (161 bytes), 162 bytes total
- *   - Failed  → 0x02 || SCALE-encoded UTF-8 reason string
- *
- * Earlier builds shipped a custom length-dispatched codec assuming elision —
- * that assumption was wrong and produced false `Failed("")` reads on every
- * `Pending` response. Native scale-ts `Enum` preserves the discriminant and
- * matches the peer's wire format directly.
- */
+/** Inner handshake response variant. */
 export const EncryptedHandshakeResponseV2 = Enum({
     Pending: HandshakeStatusV2,
     Success: HandshakeSuccessV2,

package/dist/sso/auth/v2/service.d.ts

@@ -55,6 +55,10 @@ export type StartPairingDeps = {
      * `initialProcessedDataHex` value is up to date.
      */
     onStatementProcessed?: (dataHex: string) => void;
+    /**
+     * Turns on logging for statement store interaction
+     */
+    __DEBUG?: boolean;
 };
 export type Pairing = {
     qrPayload: string;

package/dist/sso/auth/v2/service.js

@@ -23,7 +23,7 @@
  * higher layers drive a UI hook off this and update an onboarding screen.
  */
 import { BehaviorSubject } from 'rxjs';
-import { VersionedHandshakeResponse, decodeEncryptedHandshakeResponseV2 } from '../scale/handshakeV2.js';
+import { EncryptedHandshakeResponseV2, VersionedHandshakeResponse } from '../scale/handshakeV2.js';
 import { decryptResponseEnvelope } from './envelope.js';
 import { buildPairingDeeplink } from './proposal.js';
 import { advance, fromInnerResponse, isTerminal, submitted } from './state.js';
@@ -75,14 +75,13 @@ export const startPairingV2 = (deps) => {
         pollHandle = null;
     };
     const log = (msg, extra) => {
+        if (!deps.__DEBUG)
+            return;
         if (extra === undefined)
             console.info(`[sso-v2] ${msg}`);
         else
             console.info(`[sso-v2] ${msg}`, extra);
     };
-    log(`subscribing to pairing topic ${toHexFull(topic)}`);
-    log(`device statementAccountId ${toHexFull(deps.deviceIdentity.statementAccountPublicKey)}`);
-    log(`device encryptionPublicKey ${toHexFull(deps.deviceIdentity.encryptionPublicKey)}`);
     // One-shot probe: query the topic right away so we know whether any answer
     // statement was already posted before our subscription connected.
     void deps.statementStore.queryStatements({ matchAll: [topic] }).match(statements => log(`queryStatements probe: ${statements.length} statement(s)`), err => log('queryStatements probe failed', err));
@@ -121,7 +120,7 @@ export const startPairingV2 = (deps) => {
         const peerStatementAccountId = extractStatementSigner(statement);
         let next;
         try {
-            next = fromInnerResponse(decodeEncryptedHandshakeResponseV2(innerBytes), peerStatementAccountId);
+            next = fromInnerResponse(EncryptedHandshakeResponseV2.dec(innerBytes), peerStatementAccountId);
         }
         catch (err) {
             log(`inner decode failed; innerBytes (${innerBytes.length}b) = ${toHexFull(innerBytes)}`, err);

package/dist/sso/auth/v2/state.d.ts

@@ -14,7 +14,8 @@
  * The state object is what UIs render and what the chat layer gates on
  * before submitting any V2 statements.
  */
-import type { DecodedHandshakeResponseV2 } from '../scale/handshakeV2.js';
+import type { CodecType } from 'scale-ts';
+import type { EncryptedHandshakeResponseV2, HandshakeSuccessV2 } from '../scale/handshakeV2.js';
 export type HandshakeIdleState = {
     tag: 'Idle';
 };
@@ -25,45 +26,14 @@ export type HandshakePendingState = {
     tag: 'Pending';
     reason: 'AllowanceAllocation';
 };
-export type HandshakeSuccessState = {
+export type HandshakeSuccessState = CodecType<typeof HandshakeSuccessV2> & {
     tag: 'Success';
-    /** User identity sr25519 accountId (32 bytes). */
-    identityAccountId: Uint8Array;
-    /**
-     * User root sr25519 accountId (32 bytes) — the parent for soft-derivation
-     * of product accounts. Nullable: peers on spec v0.2 (Android
-     * `feature/location-for-handshake`) omit this field. Product-account
-     * derivation degrades gracefully when absent; chat does not use it.
-     */
-    rootAccountId: Uint8Array | null;
-    /**
-     * User identity chat P-256 private key (32 bytes raw scalar) shared by
-     * PApp with this device per the multi-device spec. Sensitive; persist in
-     * OS-keychain-backed secure storage and never forward.
-     */
-    identityChatPrivateKey: Uint8Array;
     /**
      * Derived locally from `identityChatPrivateKey` via P-256 scalar
      * multiplication (uncompressed 65-byte form). Both sides MUST derive
      * identically; downstream session topics depend on it.
      */
     identityChatPublicKey: Uint8Array;
-    /**
-     * Encryption public key of the authorising PApp device (65 bytes,
-     * P-256 uncompressed). Used by the host when addressing chat envelopes
-     * back to the authorising device.
-     */
-    deviceEncPubKey: Uint8Array;
-    /**
-     * `papp_encr_pub` from the Mobile SSO spec (v0.2.2 — 65 bytes, P-256
-     * uncompressed). The host's SSO session transport derives
-     * `shared_secret_session = ECDH(host_encr_secret, ssoEncPubKey)` from
-     * this. Nullable because v0.2 and v0.2.1 peers don't ship it; while
-     * null the host's SSO transport stays inactive (sign/vrf/etc continue
-     * to fail at the boundary) and chat keeps working through
-     * `identityChatPrivateKey`.
-     */
-    ssoEncPubKey: Uint8Array | null;
     /**
      * The pairing-topic statement was signed by PApp's device statement
      * account. `HandshakeSuccessV2` doesn't carry it in the encrypted body, so
@@ -81,11 +51,11 @@ export type HandshakeState = HandshakeIdleState | HandshakeSubmittedState | Hand
 export declare const idle: () => HandshakeIdleState;
 export declare const submitted: () => HandshakeSubmittedState;
 /**
- * Translate the length-dispatched-decoded `EncryptedHandshakeResponseV2` into
- * the public state. Pure — no I/O. The caller decrypts the outer envelope and
- * runs `decodeEncryptedHandshakeResponseV2` first.
+ * Translate a decoded `EncryptedHandshakeResponseV2` into the public state.
+ * Pure — no I/O. The caller decrypts the outer envelope and decodes the inner
+ * payload via `EncryptedHandshakeResponseV2.dec` first.
  */
-export declare const fromInnerResponse: (response: DecodedHandshakeResponseV2, peerStatementAccountId?: Uint8Array | null) => HandshakeState;
+export declare const fromInnerResponse: (response: CodecType<typeof EncryptedHandshakeResponseV2>, peerStatementAccountId?: Uint8Array | null) => HandshakeState;
 /**
  * Forward-only transition guard: rejects regressions like Success → Pending.
  * Idempotent on same-tag transitions (returns current by reference) so callers

package/dist/sso/auth/v2/state.js

@@ -18,9 +18,9 @@ import { deriveIdentityChatPublicKey } from '../scale/handshakeV2.js';
 export const idle = () => ({ tag: 'Idle' });
 export const submitted = () => ({ tag: 'Submitted' });
 /**
- * Translate the length-dispatched-decoded `EncryptedHandshakeResponseV2` into
- * the public state. Pure — no I/O. The caller decrypts the outer envelope and
- * runs `decodeEncryptedHandshakeResponseV2` first.
+ * Translate a decoded `EncryptedHandshakeResponseV2` into the public state.
+ * Pure — no I/O. The caller decrypts the outer envelope and decodes the inner
+ * payload via `EncryptedHandshakeResponseV2.dec` first.
  */
 export const fromInnerResponse = (response, peerStatementAccountId = null) => {
     switch (response.tag) {
@@ -36,6 +36,7 @@ export const fromInnerResponse = (response, peerStatementAccountId = null) => {
                 identityChatPublicKey: deriveIdentityChatPublicKey(response.value.identityChatPrivateKey),
                 deviceEncPubKey: response.value.deviceEncPubKey,
                 ssoEncPubKey: response.value.ssoEncPubKey,
+                rootEntropySource: response.value.rootEntropySource,
                 peerStatementAccountId,
             };
         case 'Failed':

package/dist/sso/userSecretRepository.d.ts

@@ -6,7 +6,6 @@ type StoredUserSecrets = CodecType<typeof StoredUserSecretsCodec>;
 declare const StoredUserSecretsCodec: import("scale-ts").Codec<{
     ssSecret: SsSecret;
     encrSecret: EncrSecret;
-    entropy: Uint8Array<ArrayBufferLike>;
     identityChatPrivateKey: Uint8Array<ArrayBufferLike>;
 }>;
 export type UserSecretRepository = ReturnType<typeof createUserSecretRepository>;

package/dist/sso/userSecretRepository.js

@@ -8,26 +8,17 @@ import { toError } from '../helpers/utils.js';
 const StoredUserSecretsCodec = Struct({
     ssSecret: BrandedBytesCodec(),
     encrSecret: BrandedBytesCodec(),
-    entropy: Bytes(),
     // V2 addition: user identity chat private key (P-256 raw scalar, 32 bytes).
     // Sensitive — kept encrypted at rest alongside the per-session ss/encr secrets.
     identityChatPrivateKey: Bytes(32),
 });
 export function createUserSecretRepository(salt, storage) {
-    const baseKey = 'UserSecrets';
+    const baseKey = 'UserSecretsV2';
     const encode = fromThrowable(StoredUserSecretsCodec.enc, toError);
     const decode = fromThrowable((value) => {
         if (!value)
             return null;
-        try {
-            return StoredUserSecretsCodec.dec(value);
-        }
-        catch {
-            // 0.7.x V1 blobs are missing `identityChatPrivateKey` and decode short.
-            // Treat as absent — a fresh handshake (required after 0.8.0 upgrade)
-            // will overwrite.
-            return null;
-        }
+        return StoredUserSecretsCodec.dec(value);
     }, toError);
     const encrypt = fromThrowable((value) => {
         const aes = getAes(salt);

package/dist/sso/userSessionRepository.d.ts

@@ -15,16 +15,20 @@ declare const storedUserSessionCodec: import("scale-ts").Codec<{
         pin: string | undefined;
     };
     rootAccountId: AccountId;
-    identityAccountId: AccountId | undefined;
-    identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
-    ssoEncPubKey: Uint8Array<ArrayBufferLike> | undefined;
+    identityAccountId: AccountId;
+    identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+    ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+    rootEntropySource: Uint8Array<ArrayBufferLike>;
+    deviceEncPubKey: Uint8Array<ArrayBufferLike>;
 }>;
 type StoredUserSessionV2Extras = {
-    identityAccountId?: AccountId;
-    identityChatPublicKey?: Uint8Array;
-    ssoEncPubKey?: Uint8Array;
+    identityAccountId: AccountId;
+    identityChatPublicKey: Uint8Array;
+    ssoEncPubKey: Uint8Array;
+    rootEntropySource: Uint8Array;
+    deviceEncPubKey: Uint8Array;
 };
-export declare function createStoredUserSession(localAccount: LocalSessionAccount, remoteAccount: RemoteSessionAccount, rootAccountId: AccountId, extras?: StoredUserSessionV2Extras): StoredUserSession;
+export declare function createStoredUserSession(localAccount: LocalSessionAccount, remoteAccount: RemoteSessionAccount, rootAccountId: AccountId, extras: StoredUserSessionV2Extras): StoredUserSession;
 export declare const createUserSessionRepository: (storage: StorageAdapter) => {
     add(value: {
         id: string;
@@ -38,9 +42,11 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
-        ssoEncPubKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
+        deviceEncPubKey: Uint8Array<ArrayBufferLike>;
     }): import("neverthrow").ResultAsync<{
         id: string;
         localAccount: {
@@ -53,9 +59,11 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
-        ssoEncPubKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
+        deviceEncPubKey: Uint8Array<ArrayBufferLike>;
     }, Error>;
     filter(fn: (value: {
         id: string;
@@ -69,9 +77,11 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
-        ssoEncPubKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
+        deviceEncPubKey: Uint8Array<ArrayBufferLike>;
     }) => boolean): import("neverthrow").ResultAsync<{
         id: string;
         localAccount: {
@@ -84,9 +94,11 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
-        ssoEncPubKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
+        deviceEncPubKey: Uint8Array<ArrayBufferLike>;
     }[], Error>;
     mutate(fn: (value: {
         id: string;
@@ -100,9 +112,11 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
-        ssoEncPubKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
+        deviceEncPubKey: Uint8Array<ArrayBufferLike>;
     }[]) => {
         id: string;
         localAccount: {
@@ -115,9 +129,11 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
-        ssoEncPubKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
+        deviceEncPubKey: Uint8Array<ArrayBufferLike>;
     }[]): import("neverthrow").ResultAsync<{
         id: string;
         localAccount: {
@@ -130,9 +146,11 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
-        ssoEncPubKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
+        deviceEncPubKey: Uint8Array<ArrayBufferLike>;
     }[], Error>;
     read(): import("neverthrow").ResultAsync<{
         id: string;
@@ -146,9 +164,11 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
-        ssoEncPubKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
+        deviceEncPubKey: Uint8Array<ArrayBufferLike>;
     }[], Error>;
     write(value: {
         id: string;
@@ -162,9 +182,11 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
-        ssoEncPubKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
+        deviceEncPubKey: Uint8Array<ArrayBufferLike>;
     }[]): import("neverthrow").ResultAsync<null, Error> | import("neverthrow").ResultAsync<{
         id: string;
         localAccount: {
@@ -177,9 +199,11 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
-        ssoEncPubKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
+        deviceEncPubKey: Uint8Array<ArrayBufferLike>;
     }[], Error>;
     clear(): import("neverthrow").ResultAsync<void, Error>;
     subscribe(fn: (value: {
@@ -194,9 +218,11 @@ export declare const createUserSessionRepository: (storage: StorageAdapter) => {
             pin: string | undefined;
         };
         rootAccountId: AccountId;
-        identityAccountId: AccountId | undefined;
-        identityChatPublicKey: Uint8Array<ArrayBufferLike> | undefined;
-        ssoEncPubKey: Uint8Array<ArrayBufferLike> | undefined;
+        identityAccountId: AccountId;
+        identityChatPublicKey: Uint8Array<ArrayBufferLike>;
+        ssoEncPubKey: Uint8Array<ArrayBufferLike>;
+        rootEntropySource: Uint8Array<ArrayBufferLike>;
+        deviceEncPubKey: Uint8Array<ArrayBufferLike>;
     }[]) => void): VoidFunction;
 };
 export {};

package/dist/sso/userSessionRepository.js

@@ -2,23 +2,31 @@ import { AccountIdCodec, LocalSessionAccountCodec, RemoteSessionAccountCodec } f
 import { fieldListView } from '@novasamatech/storage-adapter';
 import { nanoid } from 'nanoid';
 import { fromHex, toHex } from 'polkadot-api/utils';
-import { Bytes, Option, Struct, Vector, str } from 'scale-ts';
-// V2 fields trail V1 fields so a future schema rev can append further
-// `Option`-wrapped fields without breaking decode of 0.8.0 blobs.
+import { Bytes, Struct, Vector, str } from 'scale-ts';
 const storedUserSessionCodec = Struct({
     id: str,
     localAccount: LocalSessionAccountCodec,
     remoteAccount: RemoteSessionAccountCodec,
     rootAccountId: AccountIdCodec,
-    identityAccountId: Option(AccountIdCodec),
-    identityChatPublicKey: Option(Bytes(65)),
-    // `papp_encr_pub` (Mobile SSO spec v0.2.2, 65-byte uncompressed P-256).
-    // Persisted so the host can rebuild its SSO session transport
-    // (`shared_secret_session = ECDH(host_encr_secret, ssoEncPubKey)`) on a
-    // cold start without re-running the handshake. `None` for pre-v0.2.2 peers.
-    ssoEncPubKey: Option(Bytes(65)),
+    identityAccountId: AccountIdCodec,
+    identityChatPublicKey: Bytes(65),
+    // `papp_encr_pub` (65-byte uncompressed P-256). Persisted so the host can
+    // rebuild its SSO session transport (`shared_secret_session =
+    // ECDH(host_encr_secret, ssoEncPubKey)`) on a cold start without re-running
+    // the handshake.
+    ssoEncPubKey: Bytes(65),
+    // RFC-0007 layer-1 `rootEntropySource` from the handshake; consumed by the
+    // host's `host_derive_entropy` handler via `deriveProductEntropyFromSource`.
+    rootEntropySource: Bytes(32),
+    // Encryption public key of the authorising PApp device (65-byte uncompressed
+    // P-256), lifted from `HandshakeResponseV2.deviceEncPubKey`. Distinct from
+    // `ssoEncPubKey` (the SSO session keypair) and from `remoteAccount.publicKey`
+    // (the derived SSO shared secret): this is the peer device's long-lived ECDH
+    // key, used by the host's device-sync channel to address the paired device.
+    // Always present — `HandshakeResponseV2` carries it for every V2 pairing.
+    deviceEncPubKey: Bytes(65),
 });
-export function createStoredUserSession(localAccount, remoteAccount, rootAccountId, extras = {}) {
+export function createStoredUserSession(localAccount, remoteAccount, rootAccountId, extras) {
     return {
         id: nanoid(12),
         localAccount,
@@ -27,25 +35,16 @@ export function createStoredUserSession(localAccount, remoteAccount, rootAccount
         identityAccountId: extras.identityAccountId,
         identityChatPublicKey: extras.identityChatPublicKey,
         ssoEncPubKey: extras.ssoEncPubKey,
+        rootEntropySource: extras.rootEntropySource,
+        deviceEncPubKey: extras.deviceEncPubKey,
     };
 }
 export const createUserSessionRepository = (storage) => {
     const codec = Vector(storedUserSessionCodec);
     return fieldListView({
         storage,
-        key: 'SsoSessions',
-        from: x => {
-            try {
-                return codec.dec(fromHex(x));
-            }
-            catch {
-                // 0.7.x V1 blobs use the prior codec shape and won't decode against
-                // V2's extended struct. Treat as empty so the caller (and the
-                // fieldListView mutate machinery) start clean; the next write
-                // overwrites the bad blob.
-                return [];
-            }
-        },
+        key: 'SsoSessionsV3',
+        from: x => codec.dec(fromHex(x)),
         to: x => toHex(codec.enc(x)),
     });
 };

package/dist/sso/userSessionRepository.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sso/userSessionRepository.spec.js

@@ -0,0 +1,28 @@
+import { createAccountId, createLocalSessionAccount, createRemoteSessionAccount } from '@novasamatech/statement-store';
+import { createMemoryAdapter } from '@novasamatech/storage-adapter';
+import { toHex } from 'polkadot-api/utils';
+import { describe, expect, it } from 'vitest';
+import { createStoredUserSession, createUserSessionRepository } from './userSessionRepository.js';
+const bytes = (len, fill) => new Uint8Array(len).fill(fill);
+// remoteAccount.publicKey is a fixed 32-byte field (the SSO shared secret),
+// which is exactly why the peer device's 65-byte encryption key needs its own
+// `deviceEncPubKey` field rather than being squeezed in here.
+const SHARED_SECRET = bytes(32, 0x07);
+const DEVICE_ENC_PUB = bytes(65, 0x04);
+const baseExtras = {
+    identityAccountId: createAccountId(bytes(32, 0x11)),
+    identityChatPublicKey: bytes(65, 0x22),
+    ssoEncPubKey: bytes(65, 0x33),
+    rootEntropySource: bytes(32, 0x44),
+};
+const makeSession = (deviceEncPubKey = DEVICE_ENC_PUB) => createStoredUserSession(createLocalSessionAccount(createAccountId(bytes(32, 0x01))), createRemoteSessionAccount(createAccountId(bytes(32, 0x02)), SHARED_SECRET), createAccountId(bytes(32, 0x55)), { ...baseExtras, deviceEncPubKey });
+describe('userSessionRepository — deviceEncPubKey persistence', () => {
+    it('round-trips deviceEncPubKey through SCALE persistence', async () => {
+        const repo = createUserSessionRepository(createMemoryAdapter());
+        await repo.add(makeSession(DEVICE_ENC_PUB));
+        const stored = (await repo.read())._unsafeUnwrap().at(0);
+        expect(stored?.deviceEncPubKey && toHex(stored.deviceEncPubKey)).toBe(toHex(DEVICE_ENC_PUB));
+        // The 32-byte SSO shared secret stays in remoteAccount.publicKey, untouched.
+        expect(stored && toHex(stored.remoteAccount.publicKey)).toBe(toHex(SHARED_SECRET));
+    });
+});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@novasamatech/host-papp",
   "type": "module",
-  "version": "0.8.5",
+  "version": "0.8.7-0",
   "description": "Polkadot app integration",
   "license": "Apache-2.0",
   "repository": {
@@ -34,10 +34,10 @@
     "@noble/ciphers": "2.2.0",
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
-    "@novasamatech/host-api": "0.8.5",
-    "@novasamatech/scale": "0.8.5",
-    "@novasamatech/statement-store": "0.8.5",
-    "@novasamatech/storage-adapter": "0.8.5",
+    "@novasamatech/host-api": "0.8.7-0",
+    "@novasamatech/scale": "0.8.7-0",
+    "@novasamatech/statement-store": "0.8.7-0",
+    "@novasamatech/storage-adapter": "0.8.7-0",
     "@polkadot-api/utils": "^0.4.0",
     "@polkadot-labs/hdkd-helpers": "^0.0.30",
     "nanoevents": "9.1.0",