@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/client/index.js

@@ -0,0 +1,17 @@
+export { createDomainScope } from "../data/domainScope.js";
+export { enqueueReconciliationForEvents, } from "../sync/reconciliation/index.js";
+export { createUnavailableDirectCheckout, DirectCheckoutUnavailableError, } from "./billing/directCheckout.js";
+export { createRevenueCatPurchases, createUnavailablePurchases, PurchaseAbortedError, PurchaseAlreadyOwnedError, PurchaseCancelledError, PurchaseIdentityPendingError, PurchaseProviderStalledError, PurchasesUnavailableError, } from "./billing/purchases.js";
+export { Blobs } from "./blobs.js";
+export { createContainerDocumentObjectSyncState } from "./containerContents.js";
+export { Database, } from "./database.js";
+export { DEFAULT_DOCUMENT_ID } from "./documents.js";
+export { Events, } from "./events.js";
+export { IDENTITY_KEY_PACKAGE_FORMAT, } from "./identityKeyPackage.js";
+export { createBrowserLocalKeyring, createBrowserLocalKeyringManifestStore, createIndexedDbLocalKeyringManifestStore, createIndexedDbWrappingKeyKeystore, createLocalKeyring, createLocalStorageLocalKeyringManifestStore, createMemoryLocalKeyringManifestStore, createMemoryWrappingKeyKeystore, createWebViewLocalKeyring, decodeLocalKeyringSqliteKey, encodeLocalKeyringSqliteKey, LOCAL_KEYRING_MANIFEST_FORMAT, localKeyringScopeKey, normalizeLocalKeyringScope, parseLocalKeyringManifest, serializeLocalKeyringManifest, WRAPPED_LOCAL_SECRET_FORMAT, } from "./localKeyring/index.js";
+export { createPinCodeBrowserLocalKeyring, createPinCodeWrappingKeyKeystore, isPinCodeWrappedLocalSecretEnvelope, } from "./localKeyring/localKeyringPinCode.js";
+export { createBrowserNetworkStatusSource, Network, } from "./network.js";
+export { PurgedOrganizationRecoveryBillingRequiredError } from "./session/sessionRecoveryErrors.js";
+export { SyncBillingGate, } from "./syncBillingGate.js";
+export { Tearleads, } from "./Tearleads.js";
+//# sourceMappingURL=index.js.map

package/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAoB,MAAM,qBAAqB,CAAC;AAK1E,OAAO,EACL,8BAA8B,GAE/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,+BAA+B,EAK/B,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,GAO1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAyB,KAAK,EAAE,MAAM,SAAS,CAAC;AAgDvD,OAAO,EAAE,sCAAsC,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EACL,QAAQ,GAKT,MAAM,YAAY,CAAC;AAuBpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EACL,MAAM,GAGP,MAAM,UAAU,CAAC;AASlB,OAAO,EACL,2BAA2B,GAE5B,MAAM,sBAAsB,CAAC;AAyB9B,OAAO,EACL,yBAAyB,EACzB,sCAAsC,EACtC,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,6BAA6B,EAC7B,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,gCAAgC,EAChC,OAAO,GAIR,MAAM,WAAW,CAAC;AAuCnB,OAAO,EAAE,8CAA8C,EAAE,MAAM,iCAAiC,CAAC;AAajG,OAAO,EACL,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,SAAS,GACV,MAAM,aAAa,CAAC","sourcesContent":["export { createDomainScope, type DomainScope } from \"../data/domainScope\";\nexport type {\n  LocalProjectionReconciledDelta,\n  LocalProjectionSnapshot,\n} from \"../stores/local-projection\";\nexport {\n  enqueueReconciliationForEvents,\n  type ReconciliationService,\n} from \"../sync/reconciliation\";\nexport {\n  createUnavailableDirectCheckout,\n  type DirectCheckoutAppearance,\n  type DirectCheckoutCapability,\n  type DirectCheckoutConfirmation,\n  type DirectCheckoutSession,\n  DirectCheckoutUnavailableError,\n} from \"./billing/directCheckout\";\nexport {\n  createRevenueCatPurchases,\n  createUnavailablePurchases,\n  PurchaseAbortedError,\n  PurchaseAlreadyOwnedError,\n  PurchaseCancelledError,\n  PurchaseIdentityPendingError,\n  PurchaseProviderStalledError,\n  type PurchasesCapability,\n  PurchasesUnavailableError,\n  type RevenueCatBackend,\n  type RevenueCatCustomerInfo,\n  type RevenueCatPackage,\n  type RevenueCatPurchasesConfig,\n  type SyncPurchaseResult,\n  type SyncSubscriptionOption,\n} from \"./billing/purchases\";\nexport { type BlobStoreFactory, Blobs } from \"./blobs\";\nexport type {\n  BlobInfo,\n  BlobInfoAttachmentKind,\n  BlobInfoDocumentReference,\n  BlobInfoInput,\n  BlobInfoList,\n  BlobInfoSort,\n  BlobInfoSortDirection,\n  BlobInfoSortKey,\n  ContainerContents,\n  ContainerContentsContextValue,\n  ContainerContentsStore,\n  ContainerContentsStoreOptions,\n  ContainerDocumentLinkInput,\n  ContainerDocumentLinks,\n  ContainerDocumentObjectSyncState,\n  ContainerDocumentObjectSyncStatus,\n  ContainerDocumentQueries,\n  ContainerDocumentSidebarRow,\n  ContainerInfo,\n  ContainerInfoInput,\n  ContainerItemRow,\n  ContainerItemSort,\n  ContainerItemSortDirection,\n  ContainerItemSortKey,\n  ContainerNode,\n  ContainerShareAccessLevel,\n  DocumentAttributionRangesInput,\n  DocumentAttributionRangesPage,\n  DocumentInfo,\n  DocumentInfoInput,\n  LinkDocumentToContainerInput,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  OpenContainerDocumentInput,\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n  PurgeDocumentInput,\n  PurgeDocumentResult,\n  SetActiveDocumentContainerInput,\n  SetLinkedContainerIdsForDocument,\n  UnlinkDocumentFromContainerInput,\n} from \"./containerContents\";\nexport { createContainerDocumentObjectSyncState } from \"./containerContents\";\nexport {\n  Database,\n  type DatabaseListener,\n  type DatabaseOptions,\n  type DatabaseSnapshot,\n  type DatabaseStatus,\n} from \"./database\";\nexport type {\n  DeviceFirst,\n  DeviceFirstContainerContents,\n  LocalProjectionView,\n} from \"./deviceFirst\";\nexport type {\n  DocumentAttachmentStatus,\n  DocumentAttachmentUpload,\n  DocumentContextValue,\n  DocumentList,\n  DocumentSort,\n  DocumentSortDirection,\n  DocumentSortKey,\n  DocumentStore,\n  DocumentSubscriptionOptions,\n  Documents,\n  DocumentsRuntime,\n  ListDocumentsInput,\n  OpenDocumentInput,\n  OpenDocumentOptions,\n  PersistedDocumentListener,\n} from \"./documents\";\nexport { DEFAULT_DOCUMENT_ID } from \"./documents\";\nexport {\n  Events,\n  type EventsListener,\n  type EventsSnapshot,\n} from \"./events\";\nexport type { FileSaver, SaveFileRequest } from \"./fileSaver\";\nexport type {\n  Identity,\n  IdentityGenerationResult,\n  IdentityListener,\n  IdentityOptions,\n  IdentitySnapshot,\n} from \"./identity\";\nexport {\n  IDENTITY_KEY_PACKAGE_FORMAT,\n  type IdentityKeyPackage,\n} from \"./identityKeyPackage\";\nexport type {\n  BrowserLocalKeyringOptions,\n  IndexedDbLocalKeyringManifestStoreOptions,\n  IndexedDbWrappingKeyKeystoreOptions,\n  LocalKeyPurpose,\n  LocalKeyring,\n  LocalKeyringManifest,\n  LocalKeyringManifestFormat,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  LocalKeyringOptions,\n  LocalKeyringScope,\n  LocalKeyringSession,\n  LocalSecretContext,\n  LocalStorageLocalKeyringManifestStoreOptions,\n  NormalizedLocalKeyringScope,\n  UnwrapLocalSecretInput,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappedLocalSecretFormat,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n  WrappingKeyMaterialStorage,\n} from \"./localKeyring\";\nexport {\n  createBrowserLocalKeyring,\n  createBrowserLocalKeyringManifestStore,\n  createIndexedDbLocalKeyringManifestStore,\n  createIndexedDbWrappingKeyKeystore,\n  createLocalKeyring,\n  createLocalStorageLocalKeyringManifestStore,\n  createMemoryLocalKeyringManifestStore,\n  createMemoryWrappingKeyKeystore,\n  createWebViewLocalKeyring,\n  decodeLocalKeyringSqliteKey,\n  encodeLocalKeyringSqliteKey,\n  LOCAL_KEYRING_MANIFEST_FORMAT,\n  localKeyringScopeKey,\n  normalizeLocalKeyringScope,\n  parseLocalKeyringManifest,\n  serializeLocalKeyringManifest,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./localKeyring\";\nexport type {\n  LocalKeyringPinCode,\n  PinCodeBrowserLocalKeyringOptions,\n  PinCodeWrappingKeyKeystoreOptions,\n} from \"./localKeyring/localKeyringPinCode\";\nexport {\n  createPinCodeBrowserLocalKeyring,\n  createPinCodeWrappingKeyKeystore,\n  isPinCodeWrappedLocalSecretEnvelope,\n} from \"./localKeyring/localKeyringPinCode\";\nexport type { Logger } from \"./logger\";\nexport {\n  createBrowserNetworkStatusSource,\n  Network,\n  type NetworkListener,\n  type NetworkMode,\n  type NetworkStatusSource,\n} from \"./network\";\nexport type {\n  AddOrganizationGroupUserInput,\n  ImportedOrganizationUser,\n  LocalOrganizationSummary,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGrantRef,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  Organizations,\n  OrganizationUserDetail,\n  RemoveOrganizationGroupUserInput,\n} from \"./organizations\";\nexport type {\n  SecurityIncident,\n  SecurityIncidentListener,\n  SecurityIncidentObjectKind,\n  SecurityIncidents,\n} from \"./securityIncidents\";\nexport { PurgedOrganizationRecoveryBillingRequiredError } from \"./session/sessionRecoveryErrors\";\nexport type {\n  CreateOrganizationOptions,\n  Session,\n  SessionContext,\n  SessionCreateOrganizationResult,\n  SessionListener,\n  SessionRecoverOrganizationResult,\n  SessionRegistrationRefusal,\n  SessionRegistrationResult,\n  SessionSnapshot,\n  UserSession,\n} from \"./session/sessionTypes\";\nexport {\n  SyncBillingGate,\n  type SyncBillingGateListener,\n} from \"./syncBillingGate\";\nexport {\n  type ClientDatabaseOptions,\n  type ClientOptions,\n  Tearleads,\n} from \"./Tearleads\";\nexport type {\n  ResolvedUserIdentity,\n  UserIdentities,\n} from \"./userIdentities\";\n"]}

package/client/listenerSet.js

@@ -0,0 +1,27 @@
+/**
+ * The one subscription primitive for client facade state: subscribe returns
+ * an unsubscribe handle, and notify isolates subscribers so one failure
+ * cannot block later subscribers.
+ */
+export function createListenerSet() {
+    const listeners = new Set();
+    return {
+        subscribe: (listener) => {
+            listeners.add(listener);
+            return () => {
+                listeners.delete(listener);
+            };
+        },
+        notify: (...args) => {
+            for (const listener of listeners) {
+                try {
+                    listener(...args);
+                }
+                catch {
+                    // Keep one subscriber failure from blocking later subscribers.
+                }
+            }
+        },
+    };
+}
+//# sourceMappingURL=listenerSet.js.map

package/client/listenerSet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listenerSet.js","sourceRoot":"","sources":["listenerSet.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEtD,OAAO;QACL,SAAS,EAAE,CAAC,QAAkC,EAAgB,EAAE;YAC9D,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE;gBACV,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,CAAC,GAAG,IAAW,EAAQ,EAAE;YAC/B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACH,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;gBACpB,CAAC;gBAAC,MAAM,CAAC;oBACP,+DAA+D;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The one subscription primitive for client facade state: subscribe returns\n * an unsubscribe handle, and notify isolates subscribers so one failure\n * cannot block later subscribers.\n */\nexport function createListenerSet<TArgs extends ReadonlyArray<unknown> = []>() {\n  const listeners = new Set<(...args: TArgs) => void>();\n\n  return {\n    subscribe: (listener: (...args: TArgs) => void): (() => void) => {\n      listeners.add(listener);\n      return () => {\n        listeners.delete(listener);\n      };\n    },\n    notify: (...args: TArgs): void => {\n      for (const listener of listeners) {\n        try {\n          listener(...args);\n        } catch {\n          // Keep one subscriber failure from blocking later subscribers.\n        }\n      }\n    },\n  };\n}\n"]}

package/client/localKeyring/aesGcmWrapping.js

@@ -0,0 +1,94 @@
+import { base64ToBytes, bytesToBase64 } from "../../internal/encoding/index.js";
+import { assertEnvelopeContextMatches, assertWrappedLocalSecretEnvelope, } from "./envelope.js";
+import { copyBytes, randomBytes } from "./primitives.js";
+import { localSecretAdditionalData } from "./scope.js";
+import { WRAPPED_LOCAL_SECRET_FORMAT, } from "./types.js";
+const AES_GCM_IV_BYTES = 12;
+const AES_GCM_WRAPPING_ALGORITHM = "aes-256-gcm";
+/**
+ * Validates an envelope against the unwrapping keystore's context, provider,
+ * and AES-GCM algorithm, and returns its required base64 IV. Shared by every
+ * AES-GCM-sealing keystore so the checks and error messages stay identical.
+ */
+export function assertUnwrappableAesGcmEnvelope(input) {
+    const { envelope } = input;
+    assertWrappedLocalSecretEnvelope(envelope);
+    assertEnvelopeContextMatches({
+        actual: envelope.context,
+        expected: input.context,
+    });
+    if (envelope.provider !== input.provider) {
+        throw new Error("Wrapped local secret provider is unsupported.");
+    }
+    if (envelope.algorithm !== input.algorithm) {
+        throw new Error("Wrapped local secret algorithm is unsupported.");
+    }
+    if (!envelope.iv) {
+        throw new Error("Wrapped local secret IV is required.");
+    }
+    return envelope.iv;
+}
+/** Builds the sealed envelope literal every AES-GCM keystore persists. */
+export function sealAesGcmEnvelope(input) {
+    return {
+        algorithm: input.algorithm,
+        ciphertext: bytesToBase64(input.ciphertext),
+        context: input.context,
+        format: WRAPPED_LOCAL_SECRET_FORMAT,
+        iv: bytesToBase64(input.iv),
+        keyId: input.keyId,
+        provider: input.provider,
+        version: 1,
+        wrappedAt: new Date().toISOString(),
+    };
+}
+export async function unwrapAesGcmSecret(input) {
+    const { context, envelope } = input;
+    const iv = assertUnwrappableAesGcmEnvelope({
+        algorithm: AES_GCM_WRAPPING_ALGORITHM,
+        context,
+        envelope,
+        provider: input.provider,
+    });
+    const key = await input.resolveKey(envelope.keyId);
+    if (!key) {
+        throw new Error("Wrapping key is unavailable.");
+    }
+    try {
+        return new Uint8Array(await crypto.subtle.decrypt({
+            additionalData: localSecretAdditionalData(context),
+            iv: copyBytes(base64ToBytes(iv)),
+            name: "AES-GCM",
+        }, key, copyBytes(base64ToBytes(envelope.ciphertext))));
+    }
+    catch (error) {
+        throw new Error("Wrapped local secret could not be unwrapped.", {
+            cause: error,
+        });
+    }
+}
+export async function wrapAesGcmSecret(input) {
+    const { context, handle } = input;
+    if (handle.provider !== input.provider) {
+        throw new Error("Wrapping key handle provider is unsupported.");
+    }
+    const key = await input.resolveKey(handle.keyId);
+    if (!key) {
+        throw new Error("Wrapping key is unavailable.");
+    }
+    const iv = randomBytes(AES_GCM_IV_BYTES);
+    const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
+        additionalData: localSecretAdditionalData(context),
+        iv,
+        name: "AES-GCM",
+    }, key, copyBytes(input.plaintext)));
+    return sealAesGcmEnvelope({
+        algorithm: AES_GCM_WRAPPING_ALGORITHM,
+        ciphertext,
+        context,
+        iv,
+        keyId: handle.keyId,
+        provider: input.provider,
+    });
+}
+//# sourceMappingURL=aesGcmWrapping.js.map

package/client/localKeyring/aesGcmWrapping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aesGcmWrapping.js","sourceRoot":"","sources":["aesGcmWrapping.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAEL,2BAA2B,GAG5B,MAAM,SAAS,CAAC;AAEjB,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,0BAA0B,GAAG,aAAa,CAAC;AAWjD;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAK/C;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,gCAAgC,CAAC,QAAQ,CAAC,CAAC;IAC3C,4BAA4B,CAAC;QAC3B,MAAM,EAAE,QAAQ,CAAC,OAAO;QACxB,QAAQ,EAAE,KAAK,CAAC,OAAO;KACxB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,KAOlC;IACC,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,2BAA2B;QACnC,EAAE,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAKxC;IACC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACpC,MAAM,EAAE,GAAG,+BAA+B,CAAC;QACzC,SAAS,EAAE,0BAA0B;QACrC,OAAO;QACP,QAAQ;QACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,UAAU,CACnB,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;YACE,cAAc,EAAE,yBAAyB,CAAC,OAAO,CAAC;YAClD,EAAE,EAAE,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,EAAE,SAAS;SAChB,EACD,GAAG,EACH,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAC9C,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,8CAA8C,EAAE;YAC9D,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAMtC;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;QACE,cAAc,EAAE,yBAAyB,CAAC,OAAO,CAAC;QAClD,EAAE;QACF,IAAI,EAAE,SAAS;KAChB,EACD,GAAG,EACH,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAC3B,CACF,CAAC;IAEF,OAAO,kBAAkB,CAAC;QACxB,SAAS,EAAE,0BAA0B;QACrC,UAAU;QACV,OAAO;QACP,EAAE;QACF,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport {\n  assertEnvelopeContextMatches,\n  assertWrappedLocalSecretEnvelope,\n} from \"./envelope\";\nimport { copyBytes, randomBytes } from \"./primitives\";\nimport { localSecretAdditionalData } from \"./scope\";\nimport {\n  type LocalSecretContext,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n  type WrappedLocalSecretEnvelope,\n  type WrappingKeyHandle,\n} from \"./types\";\n\nconst AES_GCM_IV_BYTES = 12;\nconst AES_GCM_WRAPPING_ALGORITHM = \"aes-256-gcm\";\n\n/**\n * Resolves the AES-GCM key a keystore holds for `keyId`, or `null` when the\n * keystore no longer has it. Keystores differ only in where the key lives\n * (IndexedDB record, in-memory map), not in how the envelope is sealed.\n */\ntype WrappingKeyResolver = (\n  keyId: string,\n) => CryptoKey | null | Promise<CryptoKey | null>;\n\n/**\n * Validates an envelope against the unwrapping keystore's context, provider,\n * and AES-GCM algorithm, and returns its required base64 IV. Shared by every\n * AES-GCM-sealing keystore so the checks and error messages stay identical.\n */\nexport function assertUnwrappableAesGcmEnvelope(input: {\n  readonly algorithm: string;\n  readonly context: LocalSecretContext;\n  readonly envelope: WrappedLocalSecretEnvelope;\n  readonly provider: string;\n}): string {\n  const { envelope } = input;\n  assertWrappedLocalSecretEnvelope(envelope);\n  assertEnvelopeContextMatches({\n    actual: envelope.context,\n    expected: input.context,\n  });\n  if (envelope.provider !== input.provider) {\n    throw new Error(\"Wrapped local secret provider is unsupported.\");\n  }\n  if (envelope.algorithm !== input.algorithm) {\n    throw new Error(\"Wrapped local secret algorithm is unsupported.\");\n  }\n  if (!envelope.iv) {\n    throw new Error(\"Wrapped local secret IV is required.\");\n  }\n  return envelope.iv;\n}\n\n/** Builds the sealed envelope literal every AES-GCM keystore persists. */\nexport function sealAesGcmEnvelope(input: {\n  readonly algorithm: string;\n  readonly ciphertext: Uint8Array;\n  readonly context: LocalSecretContext;\n  readonly iv: Uint8Array;\n  readonly keyId: string;\n  readonly provider: string;\n}): WrappedLocalSecretEnvelope {\n  return {\n    algorithm: input.algorithm,\n    ciphertext: bytesToBase64(input.ciphertext),\n    context: input.context,\n    format: WRAPPED_LOCAL_SECRET_FORMAT,\n    iv: bytesToBase64(input.iv),\n    keyId: input.keyId,\n    provider: input.provider,\n    version: 1,\n    wrappedAt: new Date().toISOString(),\n  };\n}\n\nexport async function unwrapAesGcmSecret(input: {\n  readonly context: LocalSecretContext;\n  readonly envelope: WrappedLocalSecretEnvelope;\n  readonly provider: string;\n  readonly resolveKey: WrappingKeyResolver;\n}): Promise<Uint8Array<ArrayBuffer>> {\n  const { context, envelope } = input;\n  const iv = assertUnwrappableAesGcmEnvelope({\n    algorithm: AES_GCM_WRAPPING_ALGORITHM,\n    context,\n    envelope,\n    provider: input.provider,\n  });\n\n  const key = await input.resolveKey(envelope.keyId);\n  if (!key) {\n    throw new Error(\"Wrapping key is unavailable.\");\n  }\n\n  try {\n    return new Uint8Array(\n      await crypto.subtle.decrypt(\n        {\n          additionalData: localSecretAdditionalData(context),\n          iv: copyBytes(base64ToBytes(iv)),\n          name: \"AES-GCM\",\n        },\n        key,\n        copyBytes(base64ToBytes(envelope.ciphertext)),\n      ),\n    );\n  } catch (error) {\n    throw new Error(\"Wrapped local secret could not be unwrapped.\", {\n      cause: error,\n    });\n  }\n}\n\nexport async function wrapAesGcmSecret(input: {\n  readonly context: LocalSecretContext;\n  readonly handle: WrappingKeyHandle;\n  readonly plaintext: Uint8Array;\n  readonly provider: string;\n  readonly resolveKey: WrappingKeyResolver;\n}): Promise<WrappedLocalSecretEnvelope> {\n  const { context, handle } = input;\n  if (handle.provider !== input.provider) {\n    throw new Error(\"Wrapping key handle provider is unsupported.\");\n  }\n  const key = await input.resolveKey(handle.keyId);\n  if (!key) {\n    throw new Error(\"Wrapping key is unavailable.\");\n  }\n  const iv = randomBytes(AES_GCM_IV_BYTES);\n  const ciphertext = new Uint8Array(\n    await crypto.subtle.encrypt(\n      {\n        additionalData: localSecretAdditionalData(context),\n        iv,\n        name: \"AES-GCM\",\n      },\n      key,\n      copyBytes(input.plaintext),\n    ),\n  );\n\n  return sealAesGcmEnvelope({\n    algorithm: AES_GCM_WRAPPING_ALGORITHM,\n    ciphertext,\n    context,\n    iv,\n    keyId: handle.keyId,\n    provider: input.provider,\n  });\n}\n"]}

package/client/localKeyring/browser.d.ts

@@ -0,0 +1,52 @@
+import type { LocalKeyring, LocalKeyringManifestStorage, LocalKeyringManifestStore, WrappingKeyMaterialStorage } from "./types.js";
+export interface BrowserLocalKeyringOptions {
+    readonly databaseName?: string | undefined;
+    readonly indexedDB?: IDBFactory | undefined;
+    readonly keyMaterialStorage?: WrappingKeyMaterialStorage | undefined;
+    /** Explicit manifest store; overrides the default IndexedDB/localStorage selection. */
+    readonly manifestStore?: LocalKeyringManifestStore | undefined;
+    /** localStorage-backed manifest storage (forces the localStorage store). */
+    readonly manifestStorage?: LocalKeyringManifestStorage | undefined;
+    readonly manifestStoragePrefix?: string | undefined;
+    readonly objectStoreName?: string | undefined;
+    readonly provider?: string | undefined;
+    readonly now?: (() => Date) | undefined;
+}
+/**
+ * Selects the manifest store for a browser keyring: IndexedDB when available (so
+ * the manifest shares the OPFS-persisted database's eviction bucket — the fix for
+ * the cipher-key/database desync that produced SQLITE_NOTADB — and lives where the
+ * wrapping key already does), otherwise localStorage. Falling back to localStorage
+ * is safe precisely where IndexedDB is absent: there is no persistent database to
+ * desync from in that case.
+ */
+export declare function createBrowserLocalKeyringManifestStore(options?: {
+    readonly indexedDB?: IDBFactory | undefined;
+    readonly prefix?: string | undefined;
+    readonly storage?: LocalKeyringManifestStorage | undefined;
+}): LocalKeyringManifestStore;
+/**
+ * Selects the browser manifest backend (IndexedDB when available, else
+ * localStorage). Every browser-family keyring — including the PIN-code
+ * variant — must resolve through this one helper so a manifest is always
+ * written where every reader looks for it.
+ */
+export declare function resolveBrowserLocalKeyringManifestStore(options: {
+    readonly indexedDB?: IDBFactory | undefined;
+    readonly manifestStorage?: LocalKeyringManifestStorage | undefined;
+    readonly manifestStoragePrefix?: string | undefined;
+    readonly manifestStore?: LocalKeyringManifestStore | undefined;
+}): LocalKeyringManifestStore;
+export declare function createBrowserLocalKeyring(options?: BrowserLocalKeyringOptions): LocalKeyring;
+/**
+ * Browser local keyring tuned for WKWebView-based desktop/mobile shells
+ * (Electrobun, Capacitor). Identical to {@link createBrowserLocalKeyring} except
+ * the IndexedDB wrapping key is persisted as raw exported bytes instead of a live
+ * CryptoKey object. WKWebView serializes a CryptoKey by writing a "WebCrypto
+ * master key" to the macOS keychain, which fails with `errSecInteractionNotAllowed`
+ * (-25308) in an unsigned app and aborts the IndexedDB write (and can crash the
+ * WebContent process). Persisting raw bytes avoids the keychain entirely, at the
+ * cost of an extractable wrapping key at rest — acceptable for a local shell whose
+ * IndexedDB is already only reachable by the signed-in OS user.
+ */
+export declare function createWebViewLocalKeyring(options?: BrowserLocalKeyringOptions): LocalKeyring;

package/client/localKeyring/browser.js

@@ -0,0 +1,72 @@
+import { createIndexedDbWrappingKeyKeystore } from "./indexedDbKeystore.js";
+import { createIndexedDbLocalKeyringManifestStore, isIndexedDbAvailable, } from "./indexedDbManifestStore.js";
+import { createLocalStorageLocalKeyringManifestStore } from "./localStorageManifestStore.js";
+import { createLocalKeyring } from "./service.js";
+/**
+ * Selects the manifest store for a browser keyring: IndexedDB when available (so
+ * the manifest shares the OPFS-persisted database's eviction bucket — the fix for
+ * the cipher-key/database desync that produced SQLITE_NOTADB — and lives where the
+ * wrapping key already does), otherwise localStorage. Falling back to localStorage
+ * is safe precisely where IndexedDB is absent: there is no persistent database to
+ * desync from in that case.
+ */
+export function createBrowserLocalKeyringManifestStore(options = {}) {
+    if (options.indexedDB || isIndexedDbAvailable()) {
+        return createIndexedDbLocalKeyringManifestStore({
+            indexedDB: options.indexedDB,
+        });
+    }
+    return createLocalStorageLocalKeyringManifestStore({
+        prefix: options.prefix,
+        storage: options.storage,
+    });
+}
+/**
+ * Selects the browser manifest backend (IndexedDB when available, else
+ * localStorage). Every browser-family keyring — including the PIN-code
+ * variant — must resolve through this one helper so a manifest is always
+ * written where every reader looks for it.
+ */
+export function resolveBrowserLocalKeyringManifestStore(options) {
+    return (options.manifestStore ??
+        (options.manifestStorage
+            ? createLocalStorageLocalKeyringManifestStore({
+                prefix: options.manifestStoragePrefix,
+                storage: options.manifestStorage,
+            })
+            : createBrowserLocalKeyringManifestStore({
+                indexedDB: options.indexedDB,
+                prefix: options.manifestStoragePrefix,
+            })));
+}
+export function createBrowserLocalKeyring(options = {}) {
+    return createLocalKeyring({
+        keystore: createIndexedDbWrappingKeyKeystore({
+            databaseName: options.databaseName,
+            indexedDB: options.indexedDB,
+            keyMaterialStorage: options.keyMaterialStorage,
+            objectStoreName: options.objectStoreName,
+            provider: options.provider,
+        }),
+        manifestStore: resolveBrowserLocalKeyringManifestStore(options),
+        now: options.now,
+    });
+}
+/**
+ * Browser local keyring tuned for WKWebView-based desktop/mobile shells
+ * (Electrobun, Capacitor). Identical to {@link createBrowserLocalKeyring} except
+ * the IndexedDB wrapping key is persisted as raw exported bytes instead of a live
+ * CryptoKey object. WKWebView serializes a CryptoKey by writing a "WebCrypto
+ * master key" to the macOS keychain, which fails with `errSecInteractionNotAllowed`
+ * (-25308) in an unsigned app and aborts the IndexedDB write (and can crash the
+ * WebContent process). Persisting raw bytes avoids the keychain entirely, at the
+ * cost of an extractable wrapping key at rest — acceptable for a local shell whose
+ * IndexedDB is already only reachable by the signed-in OS user.
+ */
+export function createWebViewLocalKeyring(options = {}) {
+    return createBrowserLocalKeyring({
+        ...options,
+        keyMaterialStorage: options.keyMaterialStorage ?? "raw-bytes",
+    });
+}
+//# sourceMappingURL=browser.js.map

package/client/localKeyring/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EACL,wCAAwC,EACxC,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,2CAA2C,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAsB/C;;;;;;;GAOG;AACH,MAAM,UAAU,sCAAsC,CACpD,UAII,EAAE;IAEN,IAAI,OAAO,CAAC,SAAS,IAAI,oBAAoB,EAAE,EAAE,CAAC;QAChD,OAAO,wCAAwC,CAAC;YAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,2CAA2C,CAAC;QACjD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uCAAuC,CAAC,OAKvD;IACC,OAAO,CACL,OAAO,CAAC,aAAa;QACrB,CAAC,OAAO,CAAC,eAAe;YACtB,CAAC,CAAC,2CAA2C,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,qBAAqB;gBACrC,OAAO,EAAE,OAAO,CAAC,eAAe;aACjC,CAAC;YACJ,CAAC,CAAC,sCAAsC,CAAC;gBACrC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,OAAO,CAAC,qBAAqB;aACtC,CAAC,CAAC,CACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,UAAsC,EAAE;IAExC,OAAO,kBAAkB,CAAC;QACxB,QAAQ,EAAE,kCAAkC,CAAC;YAC3C,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC;QACF,aAAa,EAAE,uCAAuC,CAAC,OAAO,CAAC;QAC/D,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAsC,EAAE;IAExC,OAAO,yBAAyB,CAAC;QAC/B,GAAG,OAAO;QACV,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,WAAW;KAC9D,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { createIndexedDbWrappingKeyKeystore } from \"./indexedDbKeystore\";\nimport {\n  createIndexedDbLocalKeyringManifestStore,\n  isIndexedDbAvailable,\n} from \"./indexedDbManifestStore\";\nimport { createLocalStorageLocalKeyringManifestStore } from \"./localStorageManifestStore\";\nimport { createLocalKeyring } from \"./service\";\nimport type {\n  LocalKeyring,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  WrappingKeyMaterialStorage,\n} from \"./types\";\n\nexport interface BrowserLocalKeyringOptions {\n  readonly databaseName?: string | undefined;\n  readonly indexedDB?: IDBFactory | undefined;\n  readonly keyMaterialStorage?: WrappingKeyMaterialStorage | undefined;\n  /** Explicit manifest store; overrides the default IndexedDB/localStorage selection. */\n  readonly manifestStore?: LocalKeyringManifestStore | undefined;\n  /** localStorage-backed manifest storage (forces the localStorage store). */\n  readonly manifestStorage?: LocalKeyringManifestStorage | undefined;\n  readonly manifestStoragePrefix?: string | undefined;\n  readonly objectStoreName?: string | undefined;\n  readonly provider?: string | undefined;\n  readonly now?: (() => Date) | undefined;\n}\n\n/**\n * Selects the manifest store for a browser keyring: IndexedDB when available (so\n * the manifest shares the OPFS-persisted database's eviction bucket — the fix for\n * the cipher-key/database desync that produced SQLITE_NOTADB — and lives where the\n * wrapping key already does), otherwise localStorage. Falling back to localStorage\n * is safe precisely where IndexedDB is absent: there is no persistent database to\n * desync from in that case.\n */\nexport function createBrowserLocalKeyringManifestStore(\n  options: {\n    readonly indexedDB?: IDBFactory | undefined;\n    readonly prefix?: string | undefined;\n    readonly storage?: LocalKeyringManifestStorage | undefined;\n  } = {},\n): LocalKeyringManifestStore {\n  if (options.indexedDB || isIndexedDbAvailable()) {\n    return createIndexedDbLocalKeyringManifestStore({\n      indexedDB: options.indexedDB,\n    });\n  }\n  return createLocalStorageLocalKeyringManifestStore({\n    prefix: options.prefix,\n    storage: options.storage,\n  });\n}\n\n/**\n * Selects the browser manifest backend (IndexedDB when available, else\n * localStorage). Every browser-family keyring — including the PIN-code\n * variant — must resolve through this one helper so a manifest is always\n * written where every reader looks for it.\n */\nexport function resolveBrowserLocalKeyringManifestStore(options: {\n  readonly indexedDB?: IDBFactory | undefined;\n  readonly manifestStorage?: LocalKeyringManifestStorage | undefined;\n  readonly manifestStoragePrefix?: string | undefined;\n  readonly manifestStore?: LocalKeyringManifestStore | undefined;\n}): LocalKeyringManifestStore {\n  return (\n    options.manifestStore ??\n    (options.manifestStorage\n      ? createLocalStorageLocalKeyringManifestStore({\n          prefix: options.manifestStoragePrefix,\n          storage: options.manifestStorage,\n        })\n      : createBrowserLocalKeyringManifestStore({\n          indexedDB: options.indexedDB,\n          prefix: options.manifestStoragePrefix,\n        }))\n  );\n}\n\nexport function createBrowserLocalKeyring(\n  options: BrowserLocalKeyringOptions = {},\n): LocalKeyring {\n  return createLocalKeyring({\n    keystore: createIndexedDbWrappingKeyKeystore({\n      databaseName: options.databaseName,\n      indexedDB: options.indexedDB,\n      keyMaterialStorage: options.keyMaterialStorage,\n      objectStoreName: options.objectStoreName,\n      provider: options.provider,\n    }),\n    manifestStore: resolveBrowserLocalKeyringManifestStore(options),\n    now: options.now,\n  });\n}\n\n/**\n * Browser local keyring tuned for WKWebView-based desktop/mobile shells\n * (Electrobun, Capacitor). Identical to {@link createBrowserLocalKeyring} except\n * the IndexedDB wrapping key is persisted as raw exported bytes instead of a live\n * CryptoKey object. WKWebView serializes a CryptoKey by writing a \"WebCrypto\n * master key\" to the macOS keychain, which fails with `errSecInteractionNotAllowed`\n * (-25308) in an unsigned app and aborts the IndexedDB write (and can crash the\n * WebContent process). Persisting raw bytes avoids the keychain entirely, at the\n * cost of an extractable wrapping key at rest — acceptable for a local shell whose\n * IndexedDB is already only reachable by the signed-in OS user.\n */\nexport function createWebViewLocalKeyring(\n  options: BrowserLocalKeyringOptions = {},\n): LocalKeyring {\n  return createBrowserLocalKeyring({\n    ...options,\n    keyMaterialStorage: options.keyMaterialStorage ?? \"raw-bytes\",\n  });\n}\n"]}

package/client/localKeyring/envelope.d.ts

@@ -0,0 +1,8 @@
+import { type LocalSecretContext, type NormalizedLocalKeyringScope, type WrappedLocalSecretEnvelope } from "./types.js";
+export declare function assertEnvelopeContextMatches(input: {
+    readonly actual: LocalSecretContext;
+    readonly expected: LocalSecretContext;
+}): void;
+export declare function assertWrappedLocalSecretEnvelope(envelope: WrappedLocalSecretEnvelope): void;
+export declare function readLocalKeyringScope(value: unknown): NormalizedLocalKeyringScope;
+export declare function readWrappedLocalSecretEnvelope(value: unknown): WrappedLocalSecretEnvelope;

package/client/localKeyring/envelope.js

@@ -0,0 +1,54 @@
+import { readExactString, readNullableString, readObject, readOptionalString, readString, readVersion1, } from "./jsonReaders.js";
+import { assertNonEmptyString } from "./primitives.js";
+import { canonicalLocalSecretContext, localSecretContext, normalizeLocalKeyringScope, } from "./scope.js";
+import { WRAPPED_LOCAL_SECRET_FORMAT, } from "./types.js";
+export function assertEnvelopeContextMatches(input) {
+    if (canonicalLocalSecretContext(input.actual) !==
+        canonicalLocalSecretContext(input.expected)) {
+        throw new Error("Wrapped local secret context does not match.");
+    }
+}
+export function assertWrappedLocalSecretEnvelope(envelope) {
+    if (envelope.format !== WRAPPED_LOCAL_SECRET_FORMAT) {
+        throw new Error("Wrapped local secret envelope format is unsupported.");
+    }
+    if (envelope.version !== 1) {
+        throw new Error("Wrapped local secret envelope version is unsupported.");
+    }
+    assertNonEmptyString(envelope.algorithm, "Wrapped local secret algorithm");
+    assertNonEmptyString(envelope.ciphertext, "Wrapped local secret ciphertext");
+    assertNonEmptyString(envelope.keyId, "Wrapped local secret key id");
+    assertNonEmptyString(envelope.provider, "Wrapped local secret provider");
+    assertNonEmptyString(envelope.wrappedAt, "Wrapped local secret wrappedAt");
+    normalizeLocalKeyringScope(envelope.context.scope);
+    assertNonEmptyString(envelope.context.purpose, "Wrapped local secret purpose");
+}
+export function readLocalKeyringScope(value) {
+    const scope = readObject(value, "scope");
+    return normalizeLocalKeyringScope({
+        accountId: readNullableString(scope, "accountId"),
+        namespace: readString(scope, "namespace"),
+        signingFingerprint: readNullableString(scope, "signingFingerprint"),
+    });
+}
+function readLocalSecretContext(value) {
+    const context = readObject(value, "context");
+    return localSecretContext(readLocalKeyringScope(context.get("scope")), readString(context, "purpose"));
+}
+export function readWrappedLocalSecretEnvelope(value) {
+    const envelope = readObject(value, "rootKeyEnvelope");
+    const parsed = {
+        algorithm: readString(envelope, "algorithm"),
+        ciphertext: readString(envelope, "ciphertext"),
+        context: readLocalSecretContext(envelope.get("context")),
+        format: readExactString(envelope, "format", WRAPPED_LOCAL_SECRET_FORMAT),
+        iv: readOptionalString(envelope, "iv"),
+        keyId: readString(envelope, "keyId"),
+        provider: readString(envelope, "provider"),
+        version: readVersion1(envelope),
+        wrappedAt: readString(envelope, "wrappedAt"),
+    };
+    assertWrappedLocalSecretEnvelope(parsed);
+    return parsed;
+}
+//# sourceMappingURL=envelope.js.map

package/client/localKeyring/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,SAAS,CAAC;AACjB,OAAO,EAGL,2BAA2B,GAE5B,MAAM,SAAS,CAAC;AAEjB,MAAM,UAAU,4BAA4B,CAAC,KAG5C;IACC,IACE,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC;QACzC,2BAA2B,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,QAAoC;IAEpC,IAAI,QAAQ,CAAC,MAAM,KAAK,2BAA2B,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,oBAAoB,CAAC,QAAQ,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;IAC3E,oBAAoB,CAAC,QAAQ,CAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC;IAC7E,oBAAoB,CAAC,QAAQ,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;IACpE,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,EAAE,+BAA+B,CAAC,CAAC;IACzE,oBAAoB,CAAC,QAAQ,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;IAC3E,0BAA0B,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnD,oBAAoB,CAClB,QAAQ,CAAC,OAAO,CAAC,OAAO,EACxB,8BAA8B,CAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc;IAEd,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzC,OAAO,0BAA0B,CAAC;QAChC,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC;QACjD,SAAS,EAAE,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC;QACzC,kBAAkB,EAAE,kBAAkB,CAAC,KAAK,EAAE,oBAAoB,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC7C,OAAO,kBAAkB,CACvB,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAC3C,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,KAAc;IAEd,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC5C,UAAU,EAAE,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC;QAC9C,OAAO,EAAE,sBAAsB,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,EAAE,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,2BAA2B,CAAC;QACxE,EAAE,EAAE,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC;QACtC,KAAK,EAAE,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC;QACpC,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC1C,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC;QAC/B,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC;KACR,CAAC;IACvC,gCAAgC,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import {\n  readExactString,\n  readNullableString,\n  readObject,\n  readOptionalString,\n  readString,\n  readVersion1,\n} from \"./jsonReaders\";\nimport { assertNonEmptyString } from \"./primitives\";\nimport {\n  canonicalLocalSecretContext,\n  localSecretContext,\n  normalizeLocalKeyringScope,\n} from \"./scope\";\nimport {\n  type LocalSecretContext,\n  type NormalizedLocalKeyringScope,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n  type WrappedLocalSecretEnvelope,\n} from \"./types\";\n\nexport function assertEnvelopeContextMatches(input: {\n  readonly actual: LocalSecretContext;\n  readonly expected: LocalSecretContext;\n}): void {\n  if (\n    canonicalLocalSecretContext(input.actual) !==\n    canonicalLocalSecretContext(input.expected)\n  ) {\n    throw new Error(\"Wrapped local secret context does not match.\");\n  }\n}\n\nexport function assertWrappedLocalSecretEnvelope(\n  envelope: WrappedLocalSecretEnvelope,\n): void {\n  if (envelope.format !== WRAPPED_LOCAL_SECRET_FORMAT) {\n    throw new Error(\"Wrapped local secret envelope format is unsupported.\");\n  }\n  if (envelope.version !== 1) {\n    throw new Error(\"Wrapped local secret envelope version is unsupported.\");\n  }\n  assertNonEmptyString(envelope.algorithm, \"Wrapped local secret algorithm\");\n  assertNonEmptyString(envelope.ciphertext, \"Wrapped local secret ciphertext\");\n  assertNonEmptyString(envelope.keyId, \"Wrapped local secret key id\");\n  assertNonEmptyString(envelope.provider, \"Wrapped local secret provider\");\n  assertNonEmptyString(envelope.wrappedAt, \"Wrapped local secret wrappedAt\");\n  normalizeLocalKeyringScope(envelope.context.scope);\n  assertNonEmptyString(\n    envelope.context.purpose,\n    \"Wrapped local secret purpose\",\n  );\n}\n\nexport function readLocalKeyringScope(\n  value: unknown,\n): NormalizedLocalKeyringScope {\n  const scope = readObject(value, \"scope\");\n  return normalizeLocalKeyringScope({\n    accountId: readNullableString(scope, \"accountId\"),\n    namespace: readString(scope, \"namespace\"),\n    signingFingerprint: readNullableString(scope, \"signingFingerprint\"),\n  });\n}\n\nfunction readLocalSecretContext(value: unknown): LocalSecretContext {\n  const context = readObject(value, \"context\");\n  return localSecretContext(\n    readLocalKeyringScope(context.get(\"scope\")),\n    readString(context, \"purpose\"),\n  );\n}\n\nexport function readWrappedLocalSecretEnvelope(\n  value: unknown,\n): WrappedLocalSecretEnvelope {\n  const envelope = readObject(value, \"rootKeyEnvelope\");\n  const parsed = {\n    algorithm: readString(envelope, \"algorithm\"),\n    ciphertext: readString(envelope, \"ciphertext\"),\n    context: readLocalSecretContext(envelope.get(\"context\")),\n    format: readExactString(envelope, \"format\", WRAPPED_LOCAL_SECRET_FORMAT),\n    iv: readOptionalString(envelope, \"iv\"),\n    keyId: readString(envelope, \"keyId\"),\n    provider: readString(envelope, \"provider\"),\n    version: readVersion1(envelope),\n    wrappedAt: readString(envelope, \"wrappedAt\"),\n  } satisfies WrappedLocalSecretEnvelope;\n  assertWrappedLocalSecretEnvelope(parsed);\n  return parsed;\n}\n"]}

package/client/localKeyring/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Public seam for the on-device local keyring: a wrapped account-root secret in
+ * a manifest, HKDF-derived per-purpose keys, and the pluggable
+ * {@link WrappingKeyKeystore} / {@link LocalKeyringManifestStore} backends the
+ * host platform supplies. Implementation lives beside this entry; callers
+ * (including `./localKeyringPinCode`) import from here.
+ */
+export type { BrowserLocalKeyringOptions } from "./browser.js";
+export { createBrowserLocalKeyring, createBrowserLocalKeyringManifestStore, createWebViewLocalKeyring, resolveBrowserLocalKeyringManifestStore, } from "./browser.js";
+export { assertEnvelopeContextMatches, assertWrappedLocalSecretEnvelope, readWrappedLocalSecretEnvelope, } from "./envelope.js";
+export type { IndexedDbWrappingKeyKeystoreOptions } from "./indexedDbKeystore.js";
+export { createIndexedDbWrappingKeyKeystore } from "./indexedDbKeystore.js";
+export type { IndexedDbLocalKeyringManifestStoreOptions } from "./indexedDbManifestStore.js";
+export { createIndexedDbLocalKeyringManifestStore } from "./indexedDbManifestStore.js";
+export { readObject, readString, readVersion1, } from "./jsonReaders.js";
+export type { LocalStorageLocalKeyringManifestStoreOptions } from "./localStorageManifestStore.js";
+export { createLocalStorageLocalKeyringManifestStore } from "./localStorageManifestStore.js";
+export { parseLocalKeyringManifest, serializeLocalKeyringManifest, } from "./manifest.js";
+export { createMemoryLocalKeyringManifestStore, createMemoryWrappingKeyKeystore, } from "./memory.js";
+export { assertNonEmptyString, copyBytes } from "./primitives.js";
+export { canonicalLocalSecretContext, localKeyringScopeKey, normalizeLocalKeyringScope, } from "./scope.js";
+export { createLocalKeyring } from "./service.js";
+export { decodeLocalKeyringSqliteKey, encodeLocalKeyringSqliteKey, } from "./sqliteKey.js";
+export type { LocalKeyPurpose, LocalKeyring, LocalKeyringManifest, LocalKeyringManifestFormat, LocalKeyringManifestStorage, LocalKeyringManifestStore, LocalKeyringOptions, LocalKeyringScope, LocalKeyringSession, LocalSecretContext, NormalizedLocalKeyringScope, UnwrapLocalSecretInput, WrapLocalSecretInput, WrappedLocalSecretEnvelope, WrappedLocalSecretFormat, WrappingKeyHandle, WrappingKeyKeystore, WrappingKeyMaterialStorage, } from "./types.js";
+export { LOCAL_KEYRING_MANIFEST_FORMAT, WRAPPED_LOCAL_SECRET_FORMAT, } from "./types.js";

package/client/localKeyring/index.js

@@ -0,0 +1,14 @@
+export { createBrowserLocalKeyring, createBrowserLocalKeyringManifestStore, createWebViewLocalKeyring, resolveBrowserLocalKeyringManifestStore, } from "./browser.js";
+export { assertEnvelopeContextMatches, assertWrappedLocalSecretEnvelope, readWrappedLocalSecretEnvelope, } from "./envelope.js";
+export { createIndexedDbWrappingKeyKeystore } from "./indexedDbKeystore.js";
+export { createIndexedDbLocalKeyringManifestStore } from "./indexedDbManifestStore.js";
+export { readObject, readString, readVersion1, } from "./jsonReaders.js";
+export { createLocalStorageLocalKeyringManifestStore } from "./localStorageManifestStore.js";
+export { parseLocalKeyringManifest, serializeLocalKeyringManifest, } from "./manifest.js";
+export { createMemoryLocalKeyringManifestStore, createMemoryWrappingKeyKeystore, } from "./memory.js";
+export { assertNonEmptyString, copyBytes } from "./primitives.js";
+export { canonicalLocalSecretContext, localKeyringScopeKey, normalizeLocalKeyringScope, } from "./scope.js";
+export { createLocalKeyring } from "./service.js";
+export { decodeLocalKeyringSqliteKey, encodeLocalKeyringSqliteKey, } from "./sqliteKey.js";
+export { LOCAL_KEYRING_MANIFEST_FORMAT, WRAPPED_LOCAL_SECRET_FORMAT, } from "./types.js";
+//# sourceMappingURL=index.js.map

package/client/localKeyring/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,yBAAyB,EACzB,sCAAsC,EACtC,yBAAyB,EACzB,uCAAuC,GACxC,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,EAChC,8BAA8B,GAC/B,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,kCAAkC,EAAE,MAAM,qBAAqB,CAAC;AAEzE,OAAO,EAAE,wCAAwC,EAAE,MAAM,0BAA0B,CAAC;AACpF,OAAO,EACL,UAAU,EACV,UAAU,EACV,YAAY,GACb,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,2CAA2C,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EACL,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,qCAAqC,EACrC,+BAA+B,GAChC,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,aAAa,CAAC;AAqBrB,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,SAAS,CAAC","sourcesContent":["/**\n * Public seam for the on-device local keyring: a wrapped account-root secret in\n * a manifest, HKDF-derived per-purpose keys, and the pluggable\n * {@link WrappingKeyKeystore} / {@link LocalKeyringManifestStore} backends the\n * host platform supplies. Implementation lives beside this entry; callers\n * (including `./localKeyringPinCode`) import from here.\n */\nexport type { BrowserLocalKeyringOptions } from \"./browser\";\nexport {\n  createBrowserLocalKeyring,\n  createBrowserLocalKeyringManifestStore,\n  createWebViewLocalKeyring,\n  resolveBrowserLocalKeyringManifestStore,\n} from \"./browser\";\nexport {\n  assertEnvelopeContextMatches,\n  assertWrappedLocalSecretEnvelope,\n  readWrappedLocalSecretEnvelope,\n} from \"./envelope\";\nexport type { IndexedDbWrappingKeyKeystoreOptions } from \"./indexedDbKeystore\";\nexport { createIndexedDbWrappingKeyKeystore } from \"./indexedDbKeystore\";\nexport type { IndexedDbLocalKeyringManifestStoreOptions } from \"./indexedDbManifestStore\";\nexport { createIndexedDbLocalKeyringManifestStore } from \"./indexedDbManifestStore\";\nexport {\n  readObject,\n  readString,\n  readVersion1,\n} from \"./jsonReaders\";\nexport type { LocalStorageLocalKeyringManifestStoreOptions } from \"./localStorageManifestStore\";\nexport { createLocalStorageLocalKeyringManifestStore } from \"./localStorageManifestStore\";\nexport {\n  parseLocalKeyringManifest,\n  serializeLocalKeyringManifest,\n} from \"./manifest\";\nexport {\n  createMemoryLocalKeyringManifestStore,\n  createMemoryWrappingKeyKeystore,\n} from \"./memory\";\nexport { assertNonEmptyString, copyBytes } from \"./primitives\";\nexport {\n  canonicalLocalSecretContext,\n  localKeyringScopeKey,\n  normalizeLocalKeyringScope,\n} from \"./scope\";\nexport { createLocalKeyring } from \"./service\";\nexport {\n  decodeLocalKeyringSqliteKey,\n  encodeLocalKeyringSqliteKey,\n} from \"./sqliteKey\";\nexport type {\n  LocalKeyPurpose,\n  LocalKeyring,\n  LocalKeyringManifest,\n  LocalKeyringManifestFormat,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  LocalKeyringOptions,\n  LocalKeyringScope,\n  LocalKeyringSession,\n  LocalSecretContext,\n  NormalizedLocalKeyringScope,\n  UnwrapLocalSecretInput,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappedLocalSecretFormat,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n  WrappingKeyMaterialStorage,\n} from \"./types\";\nexport {\n  LOCAL_KEYRING_MANIFEST_FORMAT,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./types\";\n"]}

package/client/localKeyring/indexedDbKeystore.d.ts

@@ -0,0 +1,9 @@
+import type { WrappingKeyKeystore, WrappingKeyMaterialStorage } from "./types.js";
+export interface IndexedDbWrappingKeyKeystoreOptions {
+    readonly databaseName?: string | undefined;
+    readonly indexedDB?: IDBFactory | undefined;
+    readonly keyMaterialStorage?: WrappingKeyMaterialStorage | undefined;
+    readonly objectStoreName?: string | undefined;
+    readonly provider?: string | undefined;
+}
+export declare function createIndexedDbWrappingKeyKeystore(options?: IndexedDbWrappingKeyKeystoreOptions): WrappingKeyKeystore;

package/client/localKeyring/indexedDbKeystore.js

@@ -0,0 +1,146 @@
+import { unwrapAesGcmSecret, wrapAesGcmSecret } from "./aesGcmWrapping.js";
+import { IndexedDbStoreConnection } from "./indexedDbStoreConnection.js";
+import { assertAesGcmWrappingCryptoKey, hasErrorName, importRawWrappingKey, readIndexedDbWrappingKeyRecord, readWrappingKeyMaterial, } from "./indexedDbWrappingKeyRecord.js";
+import { assertNonEmptyString } from "./primitives.js";
+import { localWrappingKeyScopeHash, normalizeLocalKeyringScope } from "./scope.js";
+const DEFAULT_WRAPPING_KEY_MATERIAL_STORAGE = "crypto-key";
+const BROWSER_INDEXED_DB_PROVIDER = "browser-indexeddb";
+const BROWSER_KEYRING_DATABASE_NAME = "tearleads-local-keyring";
+const BROWSER_WRAPPING_KEYS_STORE_NAME = "wrappingKeys";
+function getDefaultIndexedDbFactory() {
+    if (typeof globalThis.indexedDB === "undefined") {
+        throw new Error("Browser local keyring IndexedDB is unavailable.");
+    }
+    return globalThis.indexedDB;
+}
+class IndexedDbWrappingKeyKeystore {
+    provider;
+    connection;
+    keyMaterialStorage;
+    constructor(options) {
+        const databaseName = options?.databaseName ?? BROWSER_KEYRING_DATABASE_NAME;
+        this.keyMaterialStorage =
+            options?.keyMaterialStorage ?? DEFAULT_WRAPPING_KEY_MATERIAL_STORAGE;
+        const objectStoreName = options?.objectStoreName ?? BROWSER_WRAPPING_KEYS_STORE_NAME;
+        this.provider = options?.provider ?? BROWSER_INDEXED_DB_PROVIDER;
+        assertNonEmptyString(databaseName, "IndexedDB database name");
+        assertNonEmptyString(objectStoreName, "IndexedDB object store name");
+        assertNonEmptyString(this.provider, "IndexedDB wrapping key provider");
+        this.connection = new IndexedDbStoreConnection({
+            databaseName,
+            indexedDB: options?.indexedDB ?? getDefaultIndexedDbFactory(),
+            keyPath: "keyId",
+            objectStoreName,
+        });
+    }
+    close() {
+        this.connection.close();
+    }
+    async deleteWrappingKey(scope) {
+        await this.deleteStoredKey(await this.wrappingKeyId(scope));
+    }
+    async getOrCreateWrappingKey(scope) {
+        const keyId = await this.wrappingKeyId(scope);
+        const existingKey = await this.loadStoredKey(keyId);
+        if (existingKey) {
+            return { keyId, provider: this.provider };
+        }
+        const record = {
+            createdAt: new Date().toISOString(),
+            keyId,
+            provider: this.provider,
+            ...(await this.createWrappingKeyMaterial()),
+        };
+        try {
+            await this.addStoredKey(record);
+        }
+        catch (error) {
+            if (!hasErrorName(error, "ConstraintError")) {
+                throw error;
+            }
+            const racedKey = await this.loadStoredKey(keyId);
+            if (!racedKey) {
+                throw error;
+            }
+        }
+        finally {
+            // IndexedDB serializes the value when add() is called, so the freshly
+            // generated raw key bytes can be wiped from memory once the write settles.
+            record.keyMaterial?.fill(0);
+        }
+        return { keyId, provider: this.provider };
+    }
+    async unwrapSecret({ context, envelope, }) {
+        return unwrapAesGcmSecret({
+            context,
+            envelope,
+            provider: this.provider,
+            resolveKey: (keyId) => this.loadStoredKey(keyId),
+        });
+    }
+    async wrapSecret({ context, handle, plaintext, }) {
+        return wrapAesGcmSecret({
+            context,
+            handle,
+            plaintext,
+            provider: this.provider,
+            resolveKey: (keyId) => this.loadStoredKey(keyId),
+        });
+    }
+    // Mints fresh wrapping-key material in whichever shape this keystore persists:
+    // a live non-extractable CryptoKey ("crypto-key"), or exported raw AES-256
+    // bytes ("raw-bytes") for WebView shells that cannot structured-clone a
+    // CryptoKey into IndexedDB.
+    async createWrappingKeyMaterial() {
+        if (this.keyMaterialStorage === "raw-bytes") {
+            const key = await crypto.subtle.generateKey({ length: 256, name: "AES-GCM" }, true, ["encrypt", "decrypt"]);
+            const keyMaterial = new Uint8Array(await crypto.subtle.exportKey("raw", key));
+            return { keyMaterial: readWrappingKeyMaterial(keyMaterial) };
+        }
+        const key = await crypto.subtle.generateKey({ length: 256, name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+        assertAesGcmWrappingCryptoKey(key);
+        return { key };
+    }
+    addStoredKey(record) {
+        return this.writeStoredKey((store) => store.add(record));
+    }
+    async deleteStoredKey(keyId) {
+        await this.writeStoredKey((store) => store.delete(keyId));
+    }
+    async loadStoredKey(keyId) {
+        const record = await this.readStoredKey(keyId);
+        if (record === undefined) {
+            return null;
+        }
+        const parsed = readIndexedDbWrappingKeyRecord({
+            keyId,
+            keyMaterialStorage: this.keyMaterialStorage,
+            provider: this.provider,
+            value: record,
+        });
+        if (parsed.key) {
+            return parsed.key;
+        }
+        // Wipe the raw bytes read out of IndexedDB once they have been imported.
+        const keyMaterial = readWrappingKeyMaterial(parsed.keyMaterial);
+        try {
+            return await importRawWrappingKey(keyMaterial);
+        }
+        finally {
+            keyMaterial.fill(0);
+        }
+    }
+    async readStoredKey(keyId) {
+        return this.connection.request("readonly", (store) => store.get(keyId));
+    }
+    async writeStoredKey(operation) {
+        return this.connection.request("readwrite", operation);
+    }
+    async wrappingKeyId(scope) {
+        return `indexeddb:${await localWrappingKeyScopeHash(normalizeLocalKeyringScope(scope))}`;
+    }
+}
+export function createIndexedDbWrappingKeyKeystore(options = {}) {
+    return new IndexedDbWrappingKeyKeystore(options);
+}
+//# sourceMappingURL=indexedDbKeystore.js.map