@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/client/localKeyring/indexedDbKeystore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"indexedDbKeystore.js","sourceRoot":"","sources":["indexedDbKeystore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EACL,6BAA6B,EAC7B,YAAY,EAEZ,oBAAoB,EACpB,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAWhF,MAAM,qCAAqC,GACzC,YAAY,CAAC;AACf,MAAM,2BAA2B,GAAG,mBAAmB,CAAC;AACxD,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AAChE,MAAM,gCAAgC,GAAG,cAAc,CAAC;AAUxD,SAAS,0BAA0B;IACjC,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,UAAU,CAAC,SAAS,CAAC;AAC9B,CAAC;AAED,MAAM,4BAA4B;IACvB,QAAQ,CAAS;IACT,UAAU,CAA2B;IACrC,kBAAkB,CAA6B;IAEhE,YAAY,OAAwD;QAClE,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,6BAA6B,CAAC;QAC5E,IAAI,CAAC,kBAAkB;YACrB,OAAO,EAAE,kBAAkB,IAAI,qCAAqC,CAAC;QACvE,MAAM,eAAe,GACnB,OAAO,EAAE,eAAe,IAAI,gCAAgC,CAAC;QAC/D,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,2BAA2B,CAAC;QAEjE,oBAAoB,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;QAC9D,oBAAoB,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QACrE,oBAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,iCAAiC,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU,GAAG,IAAI,wBAAwB,CAAC;YAC7C,YAAY;YACZ,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,0BAA0B,EAAE;YAC7D,OAAO,EAAE,OAAO;YAChB,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAwB;QAC9C,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,KAAwB;QAExB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAA+B;YACzC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,CAAC,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;SAC5C,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,sEAAsE;YACtE,2EAA2E;YAC3E,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EACjB,OAAO,EACP,QAAQ,GACe;QACvB,OAAO,kBAAkB,CAAC;YACxB,OAAO;YACP,QAAQ;YACR,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EACf,OAAO,EACP,MAAM,EACN,SAAS,GACY;QACrB,OAAO,gBAAgB,CAAC;YACtB,OAAO;YACP,MAAM;YACN,SAAS;YACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAC/E,2EAA2E;IAC3E,wEAAwE;IACxE,4BAA4B;IACpB,KAAK,CAAC,yBAAyB;QAGrC,IAAI,IAAI,CAAC,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CACzC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAChC,IAAI,EACJ,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;YACF,MAAM,WAAW,GAAG,IAAI,UAAU,CAChC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAC1C,CAAC;YACF,OAAO,EAAE,WAAW,EAAE,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/D,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CACzC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;QACF,6BAA6B,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IAEO,YAAY,CAClB,MAAkC;QAElC,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,KAAa;QACzC,MAAM,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5D,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,KAAa;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,8BAA8B,CAAC;YAC5C,KAAK;YACL,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,GAAG,CAAC;QACpB,CAAC;QAED,yEAAyE;QACzE,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC;YACH,OAAO,MAAM,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACjD,CAAC;gBAAS,CAAC;YACT,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,KAAa;QACvC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1E,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,SAAmD;QAEnD,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,KAAwB;QAClD,OAAO,aAAa,MAAM,yBAAyB,CACjD,0BAA0B,CAAC,KAAK,CAAC,CAClC,EAAE,CAAC;IACN,CAAC;CACF;AAED,MAAM,UAAU,kCAAkC,CAChD,UAA+C,EAAE;IAEjD,OAAO,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC","sourcesContent":["import { unwrapAesGcmSecret, wrapAesGcmSecret } from \"./aesGcmWrapping\";\nimport { IndexedDbStoreConnection } from \"./indexedDbStoreConnection\";\nimport {\n  assertAesGcmWrappingCryptoKey,\n  hasErrorName,\n  type IndexedDbWrappingKeyRecord,\n  importRawWrappingKey,\n  readIndexedDbWrappingKeyRecord,\n  readWrappingKeyMaterial,\n} from \"./indexedDbWrappingKeyRecord\";\nimport { assertNonEmptyString } from \"./primitives\";\nimport { localWrappingKeyScopeHash, normalizeLocalKeyringScope } from \"./scope\";\nimport type {\n  LocalKeyringScope,\n  UnwrapLocalSecretInput,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n  WrappingKeyMaterialStorage,\n} from \"./types\";\n\nconst DEFAULT_WRAPPING_KEY_MATERIAL_STORAGE: WrappingKeyMaterialStorage =\n  \"crypto-key\";\nconst BROWSER_INDEXED_DB_PROVIDER = \"browser-indexeddb\";\nconst BROWSER_KEYRING_DATABASE_NAME = \"tearleads-local-keyring\";\nconst BROWSER_WRAPPING_KEYS_STORE_NAME = \"wrappingKeys\";\n\nexport interface IndexedDbWrappingKeyKeystoreOptions {\n  readonly databaseName?: string | undefined;\n  readonly indexedDB?: IDBFactory | undefined;\n  readonly keyMaterialStorage?: WrappingKeyMaterialStorage | undefined;\n  readonly objectStoreName?: string | undefined;\n  readonly provider?: string | undefined;\n}\n\nfunction getDefaultIndexedDbFactory(): IDBFactory {\n  if (typeof globalThis.indexedDB === \"undefined\") {\n    throw new Error(\"Browser local keyring IndexedDB is unavailable.\");\n  }\n\n  return globalThis.indexedDB;\n}\n\nclass IndexedDbWrappingKeyKeystore implements WrappingKeyKeystore {\n  readonly provider: string;\n  private readonly connection: IndexedDbStoreConnection;\n  private readonly keyMaterialStorage: WrappingKeyMaterialStorage;\n\n  constructor(options: IndexedDbWrappingKeyKeystoreOptions | undefined) {\n    const databaseName = options?.databaseName ?? BROWSER_KEYRING_DATABASE_NAME;\n    this.keyMaterialStorage =\n      options?.keyMaterialStorage ?? DEFAULT_WRAPPING_KEY_MATERIAL_STORAGE;\n    const objectStoreName =\n      options?.objectStoreName ?? BROWSER_WRAPPING_KEYS_STORE_NAME;\n    this.provider = options?.provider ?? BROWSER_INDEXED_DB_PROVIDER;\n\n    assertNonEmptyString(databaseName, \"IndexedDB database name\");\n    assertNonEmptyString(objectStoreName, \"IndexedDB object store name\");\n    assertNonEmptyString(this.provider, \"IndexedDB wrapping key provider\");\n    this.connection = new IndexedDbStoreConnection({\n      databaseName,\n      indexedDB: options?.indexedDB ?? getDefaultIndexedDbFactory(),\n      keyPath: \"keyId\",\n      objectStoreName,\n    });\n  }\n\n  close(): void {\n    this.connection.close();\n  }\n\n  async deleteWrappingKey(scope: LocalKeyringScope): Promise<void> {\n    await this.deleteStoredKey(await this.wrappingKeyId(scope));\n  }\n\n  async getOrCreateWrappingKey(\n    scope: LocalKeyringScope,\n  ): Promise<WrappingKeyHandle> {\n    const keyId = await this.wrappingKeyId(scope);\n    const existingKey = await this.loadStoredKey(keyId);\n    if (existingKey) {\n      return { keyId, provider: this.provider };\n    }\n\n    const record: IndexedDbWrappingKeyRecord = {\n      createdAt: new Date().toISOString(),\n      keyId,\n      provider: this.provider,\n      ...(await this.createWrappingKeyMaterial()),\n    };\n    try {\n      await this.addStoredKey(record);\n    } catch (error) {\n      if (!hasErrorName(error, \"ConstraintError\")) {\n        throw error;\n      }\n      const racedKey = await this.loadStoredKey(keyId);\n      if (!racedKey) {\n        throw error;\n      }\n    } finally {\n      // IndexedDB serializes the value when add() is called, so the freshly\n      // generated raw key bytes can be wiped from memory once the write settles.\n      record.keyMaterial?.fill(0);\n    }\n\n    return { keyId, provider: this.provider };\n  }\n\n  async unwrapSecret({\n    context,\n    envelope,\n  }: UnwrapLocalSecretInput): Promise<Uint8Array<ArrayBuffer>> {\n    return unwrapAesGcmSecret({\n      context,\n      envelope,\n      provider: this.provider,\n      resolveKey: (keyId) => this.loadStoredKey(keyId),\n    });\n  }\n\n  async wrapSecret({\n    context,\n    handle,\n    plaintext,\n  }: WrapLocalSecretInput): Promise<WrappedLocalSecretEnvelope> {\n    return wrapAesGcmSecret({\n      context,\n      handle,\n      plaintext,\n      provider: this.provider,\n      resolveKey: (keyId) => this.loadStoredKey(keyId),\n    });\n  }\n\n  // Mints fresh wrapping-key material in whichever shape this keystore persists:\n  // a live non-extractable CryptoKey (\"crypto-key\"), or exported raw AES-256\n  // bytes (\"raw-bytes\") for WebView shells that cannot structured-clone a\n  // CryptoKey into IndexedDB.\n  private async createWrappingKeyMaterial(): Promise<\n    Pick<IndexedDbWrappingKeyRecord, \"key\" | \"keyMaterial\">\n  > {\n    if (this.keyMaterialStorage === \"raw-bytes\") {\n      const key = await crypto.subtle.generateKey(\n        { length: 256, name: \"AES-GCM\" },\n        true,\n        [\"encrypt\", \"decrypt\"],\n      );\n      const keyMaterial = new Uint8Array(\n        await crypto.subtle.exportKey(\"raw\", key),\n      );\n      return { keyMaterial: readWrappingKeyMaterial(keyMaterial) };\n    }\n\n    const key = await crypto.subtle.generateKey(\n      { length: 256, name: \"AES-GCM\" },\n      false,\n      [\"encrypt\", \"decrypt\"],\n    );\n    assertAesGcmWrappingCryptoKey(key);\n    return { key };\n  }\n\n  private addStoredKey(\n    record: IndexedDbWrappingKeyRecord,\n  ): Promise<IDBValidKey> {\n    return this.writeStoredKey((store) => store.add(record));\n  }\n\n  private async deleteStoredKey(keyId: string): Promise<void> {\n    await this.writeStoredKey((store) => store.delete(keyId));\n  }\n\n  private async loadStoredKey(keyId: string): Promise<CryptoKey | null> {\n    const record = await this.readStoredKey(keyId);\n    if (record === undefined) {\n      return null;\n    }\n\n    const parsed = readIndexedDbWrappingKeyRecord({\n      keyId,\n      keyMaterialStorage: this.keyMaterialStorage,\n      provider: this.provider,\n      value: record,\n    });\n    if (parsed.key) {\n      return parsed.key;\n    }\n\n    // Wipe the raw bytes read out of IndexedDB once they have been imported.\n    const keyMaterial = readWrappingKeyMaterial(parsed.keyMaterial);\n    try {\n      return await importRawWrappingKey(keyMaterial);\n    } finally {\n      keyMaterial.fill(0);\n    }\n  }\n\n  private async readStoredKey(keyId: string): Promise<unknown | undefined> {\n    return this.connection.request(\"readonly\", (store) => store.get(keyId));\n  }\n\n  private async writeStoredKey<T>(\n    operation: (store: IDBObjectStore) => IDBRequest<T>,\n  ): Promise<T> {\n    return this.connection.request(\"readwrite\", operation);\n  }\n\n  private async wrappingKeyId(scope: LocalKeyringScope): Promise<string> {\n    return `indexeddb:${await localWrappingKeyScopeHash(\n      normalizeLocalKeyringScope(scope),\n    )}`;\n  }\n}\n\nexport function createIndexedDbWrappingKeyKeystore(\n  options: IndexedDbWrappingKeyKeystoreOptions = {},\n): WrappingKeyKeystore {\n  return new IndexedDbWrappingKeyKeystore(options);\n}\n"]}

package/client/localKeyring/indexedDbManifestStore.d.ts

@@ -0,0 +1,8 @@
+import type { LocalKeyringManifestStore } from "./types.js";
+export interface IndexedDbLocalKeyringManifestStoreOptions {
+    readonly databaseName?: string | undefined;
+    readonly indexedDB?: IDBFactory | undefined;
+    readonly objectStoreName?: string | undefined;
+}
+export declare function isIndexedDbAvailable(): boolean;
+export declare function createIndexedDbLocalKeyringManifestStore(options?: IndexedDbLocalKeyringManifestStoreOptions): LocalKeyringManifestStore;

package/client/localKeyring/indexedDbManifestStore.js

@@ -0,0 +1,85 @@
+import { IndexedDbStoreConnection } from "./indexedDbStoreConnection.js";
+import { parseLocalKeyringManifest, serializeLocalKeyringManifest, } from "./manifest.js";
+import { assertNonEmptyString } from "./primitives.js";
+import { localKeyringScopeKey } from "./scope.js";
+/**
+ * IndexedDB database/store holding one manifest record per keyring scope, kept
+ * separate from the wrapping-key database so the two never coordinate versions.
+ */
+const BROWSER_KEYRING_MANIFEST_DATABASE_NAME = "tearleads-local-keyring-manifests";
+const BROWSER_KEYRING_MANIFEST_STORE_NAME = "manifests";
+export function isIndexedDbAvailable() {
+    // Require a usable factory, not merely a defined global: test environments stub
+    // `indexedDB` with a non-functional placeholder, and a real persistent database
+    // (which needs a working IndexedDB anyway) is the only place this store runs.
+    return (typeof globalThis.indexedDB === "object" &&
+        globalThis.indexedDB !== null &&
+        typeof globalThis.indexedDB.open === "function");
+}
+function getDefaultIndexedDb() {
+    if (!isIndexedDbAvailable()) {
+        throw new Error("Browser local keyring manifest storage requires IndexedDB.");
+    }
+    return globalThis.indexedDB;
+}
+function readManifestRecordValue(record) {
+    if (typeof record !== "object" || record === null) {
+        return null;
+    }
+    const manifest = Reflect.get(record, "manifest");
+    return typeof manifest === "string" ? manifest : null;
+}
+/**
+ * Persists keyring manifests in IndexedDB, where the wrapping key already lives.
+ * The point is shared eviction fate: the manifest holds the wrapped root key that
+ * derives the database's cipher key, so storing it in localStorage (evicted far
+ * more aggressively — e.g. Safari ITP's script-writable-storage cap) lets the
+ * keyring be lost while the OPFS-persisted, encrypted database survives, minting a
+ * fresh root on the next boot and yielding SQLITE_NOTADB. IndexedDB shares the
+ * origin's storage bucket with OPFS, so the manifest and database are evicted
+ * together (a clean reset) or survive together — and unlike main-thread OPFS file
+ * writes (unsupported on WebKit), IndexedDB works in every context the keyring
+ * runs in.
+ */
+class IndexedDbLocalKeyringManifestStore {
+    connection;
+    constructor(options = {}) {
+        const databaseName = options.databaseName ?? BROWSER_KEYRING_MANIFEST_DATABASE_NAME;
+        const objectStoreName = options.objectStoreName ?? BROWSER_KEYRING_MANIFEST_STORE_NAME;
+        assertNonEmptyString(databaseName, "IndexedDB database name");
+        assertNonEmptyString(objectStoreName, "IndexedDB object store name");
+        this.connection = new IndexedDbStoreConnection({
+            databaseName,
+            indexedDB: options.indexedDB ?? getDefaultIndexedDb(),
+            keyPath: "scopeKey",
+            objectStoreName,
+        });
+    }
+    close() {
+        this.connection.close();
+    }
+    async deleteManifest(scope) {
+        await this.write((store) => store.delete(localKeyringScopeKey(scope)));
+    }
+    async loadManifest(scope) {
+        const record = await this.read(localKeyringScopeKey(scope));
+        const serialized = readManifestRecordValue(record);
+        return serialized ? parseLocalKeyringManifest(serialized) : null;
+    }
+    async saveManifest(manifest) {
+        await this.write((store) => store.put({
+            scopeKey: localKeyringScopeKey(manifest.scope),
+            manifest: serializeLocalKeyringManifest(manifest),
+        }));
+    }
+    async read(scopeKey) {
+        return this.connection.request("readonly", (store) => store.get(scopeKey));
+    }
+    async write(operation) {
+        return this.connection.request("readwrite", operation);
+    }
+}
+export function createIndexedDbLocalKeyringManifestStore(options = {}) {
+    return new IndexedDbLocalKeyringManifestStore(options);
+}
+//# sourceMappingURL=indexedDbManifestStore.js.map

package/client/localKeyring/indexedDbManifestStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"indexedDbManifestStore.js","sourceRoot":"","sources":["indexedDbManifestStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EACL,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAO/C;;;GAGG;AACH,MAAM,sCAAsC,GAC1C,mCAAmC,CAAC;AACtC,MAAM,mCAAmC,GAAG,WAAW,CAAC;AAQxD,MAAM,UAAU,oBAAoB;IAClC,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,OAAO,CACL,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ;QACxC,UAAU,CAAC,SAAS,KAAK,IAAI;QAC7B,OAAO,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,UAAU,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB;IAC1B,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,SAAS,CAAC;AAC9B,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAe;IAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACjD,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,kCAAkC;IACrB,UAAU,CAA2B;IAEtD,YAAY,UAAqD,EAAE;QACjE,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,IAAI,sCAAsC,CAAC;QACjE,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,IAAI,mCAAmC,CAAC;QACjE,oBAAoB,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;QAC9D,oBAAoB,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU,GAAG,IAAI,wBAAwB,CAAC;YAC7C,YAAY;YACZ,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,mBAAmB,EAAE;YACrD,OAAO,EAAE,UAAU;YACnB,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAwB;QAC3C,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,KAAwB;QAExB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACnD,OAAO,UAAU,CAAC,CAAC,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAA8B;QAC/C,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACzB,KAAK,CAAC,GAAG,CAAC;YACR,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC9C,QAAQ,EAAE,6BAA6B,CAAC,QAAQ,CAAC;SAClD,CAAC,CACH,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,QAAgB;QACjC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,SAAmD;QAEnD,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;CACF;AAED,MAAM,UAAU,wCAAwC,CACtD,UAAqD,EAAE;IAEvD,OAAO,IAAI,kCAAkC,CAAC,OAAO,CAAC,CAAC;AACzD,CAAC","sourcesContent":["import { IndexedDbStoreConnection } from \"./indexedDbStoreConnection\";\nimport {\n  parseLocalKeyringManifest,\n  serializeLocalKeyringManifest,\n} from \"./manifest\";\nimport { assertNonEmptyString } from \"./primitives\";\nimport { localKeyringScopeKey } from \"./scope\";\nimport type {\n  LocalKeyringManifest,\n  LocalKeyringManifestStore,\n  LocalKeyringScope,\n} from \"./types\";\n\n/**\n * IndexedDB database/store holding one manifest record per keyring scope, kept\n * separate from the wrapping-key database so the two never coordinate versions.\n */\nconst BROWSER_KEYRING_MANIFEST_DATABASE_NAME =\n  \"tearleads-local-keyring-manifests\";\nconst BROWSER_KEYRING_MANIFEST_STORE_NAME = \"manifests\";\n\nexport interface IndexedDbLocalKeyringManifestStoreOptions {\n  readonly databaseName?: string | undefined;\n  readonly indexedDB?: IDBFactory | undefined;\n  readonly objectStoreName?: string | undefined;\n}\n\nexport function isIndexedDbAvailable(): boolean {\n  // Require a usable factory, not merely a defined global: test environments stub\n  // `indexedDB` with a non-functional placeholder, and a real persistent database\n  // (which needs a working IndexedDB anyway) is the only place this store runs.\n  return (\n    typeof globalThis.indexedDB === \"object\" &&\n    globalThis.indexedDB !== null &&\n    typeof globalThis.indexedDB.open === \"function\"\n  );\n}\n\nfunction getDefaultIndexedDb(): IDBFactory {\n  if (!isIndexedDbAvailable()) {\n    throw new Error(\n      \"Browser local keyring manifest storage requires IndexedDB.\",\n    );\n  }\n  return globalThis.indexedDB;\n}\n\nfunction readManifestRecordValue(record: unknown): string | null {\n  if (typeof record !== \"object\" || record === null) {\n    return null;\n  }\n  const manifest = Reflect.get(record, \"manifest\");\n  return typeof manifest === \"string\" ? manifest : null;\n}\n\n/**\n * Persists keyring manifests in IndexedDB, where the wrapping key already lives.\n * The point is shared eviction fate: the manifest holds the wrapped root key that\n * derives the database's cipher key, so storing it in localStorage (evicted far\n * more aggressively — e.g. Safari ITP's script-writable-storage cap) lets the\n * keyring be lost while the OPFS-persisted, encrypted database survives, minting a\n * fresh root on the next boot and yielding SQLITE_NOTADB. IndexedDB shares the\n * origin's storage bucket with OPFS, so the manifest and database are evicted\n * together (a clean reset) or survive together — and unlike main-thread OPFS file\n * writes (unsupported on WebKit), IndexedDB works in every context the keyring\n * runs in.\n */\nclass IndexedDbLocalKeyringManifestStore implements LocalKeyringManifestStore {\n  private readonly connection: IndexedDbStoreConnection;\n\n  constructor(options: IndexedDbLocalKeyringManifestStoreOptions = {}) {\n    const databaseName =\n      options.databaseName ?? BROWSER_KEYRING_MANIFEST_DATABASE_NAME;\n    const objectStoreName =\n      options.objectStoreName ?? BROWSER_KEYRING_MANIFEST_STORE_NAME;\n    assertNonEmptyString(databaseName, \"IndexedDB database name\");\n    assertNonEmptyString(objectStoreName, \"IndexedDB object store name\");\n    this.connection = new IndexedDbStoreConnection({\n      databaseName,\n      indexedDB: options.indexedDB ?? getDefaultIndexedDb(),\n      keyPath: \"scopeKey\",\n      objectStoreName,\n    });\n  }\n\n  close(): void {\n    this.connection.close();\n  }\n\n  async deleteManifest(scope: LocalKeyringScope): Promise<void> {\n    await this.write((store) => store.delete(localKeyringScopeKey(scope)));\n  }\n\n  async loadManifest(\n    scope: LocalKeyringScope,\n  ): Promise<LocalKeyringManifest | null> {\n    const record = await this.read(localKeyringScopeKey(scope));\n    const serialized = readManifestRecordValue(record);\n    return serialized ? parseLocalKeyringManifest(serialized) : null;\n  }\n\n  async saveManifest(manifest: LocalKeyringManifest): Promise<void> {\n    await this.write((store) =>\n      store.put({\n        scopeKey: localKeyringScopeKey(manifest.scope),\n        manifest: serializeLocalKeyringManifest(manifest),\n      }),\n    );\n  }\n\n  private async read(scopeKey: string): Promise<unknown> {\n    return this.connection.request(\"readonly\", (store) => store.get(scopeKey));\n  }\n\n  private async write<T>(\n    operation: (store: IDBObjectStore) => IDBRequest<T>,\n  ): Promise<T> {\n    return this.connection.request(\"readwrite\", operation);\n  }\n}\n\nexport function createIndexedDbLocalKeyringManifestStore(\n  options: IndexedDbLocalKeyringManifestStoreOptions = {},\n): LocalKeyringManifestStore {\n  return new IndexedDbLocalKeyringManifestStore(options);\n}\n"]}

package/client/localKeyring/indexedDbStoreConnection.js

@@ -0,0 +1,129 @@
+function indexedDbRequest(request) {
+    return new Promise((resolve, reject) => {
+        request.onerror = () => {
+            reject(request.error ?? new Error("IndexedDB request failed."));
+        };
+        request.onsuccess = () => {
+            resolve(request.result);
+        };
+    });
+}
+function indexedDbTransactionDone(transaction) {
+    return new Promise((resolve, reject) => {
+        transaction.onabort = () => {
+            reject(transaction.error ?? new Error("IndexedDB transaction aborted."));
+        };
+        transaction.onerror = () => {
+            reject(transaction.error ?? new Error("IndexedDB transaction failed."));
+        };
+        transaction.oncomplete = () => {
+            resolve();
+        };
+    });
+}
+async function runIndexedDbRequest(transaction, request) {
+    const transactionDone = indexedDbTransactionDone(transaction);
+    try {
+        const [result] = await Promise.all([
+            indexedDbRequest(request),
+            transactionDone,
+        ]);
+        return result;
+    }
+    catch (error) {
+        await transactionDone.catch(() => undefined);
+        throw error;
+    }
+}
+export class IndexedDbStoreConnection {
+    activeTransactions = new Set();
+    options;
+    closed = false;
+    database = null;
+    databasePromise = null;
+    constructor(options) {
+        this.options = options;
+    }
+    close() {
+        if (this.closed) {
+            return;
+        }
+        this.closed = true;
+        for (const transaction of this.activeTransactions) {
+            try {
+                transaction.abort();
+            }
+            catch {
+                // The transaction may already have completed between iteration and abort.
+            }
+        }
+        this.activeTransactions.clear();
+        const database = this.database;
+        database?.close();
+        this.database = null;
+        const databasePromise = this.databasePromise;
+        this.databasePromise = null;
+        if (!database) {
+            void databasePromise?.then((openedDatabase) => openedDatabase.close(), () => undefined);
+        }
+    }
+    async request(mode, operation) {
+        this.assertOpen();
+        const database = await this.openDatabase();
+        this.assertOpen();
+        const transaction = database.transaction(this.options.objectStoreName, mode);
+        this.activeTransactions.add(transaction);
+        try {
+            const store = transaction.objectStore(this.options.objectStoreName);
+            return await runIndexedDbRequest(transaction, operation(store));
+        }
+        finally {
+            this.activeTransactions.delete(transaction);
+        }
+    }
+    assertOpen() {
+        if (this.closed) {
+            throw new Error("IndexedDB connection is closed.");
+        }
+    }
+    async openDatabase() {
+        this.assertOpen();
+        if (this.databasePromise) {
+            return this.databasePromise;
+        }
+        this.databasePromise = new Promise((resolve, reject) => {
+            const request = this.options.indexedDB.open(this.options.databaseName, 1);
+            request.onerror = () => {
+                this.databasePromise = null;
+                reject(request.error ?? new Error("IndexedDB open failed."));
+            };
+            request.onupgradeneeded = () => {
+                const database = request.result;
+                if (!database.objectStoreNames.contains(this.options.objectStoreName)) {
+                    database.createObjectStore(this.options.objectStoreName, {
+                        keyPath: this.options.keyPath,
+                    });
+                }
+            };
+            request.onsuccess = () => {
+                const database = request.result;
+                if (this.closed) {
+                    database.close();
+                    reject(new Error("IndexedDB connection is closed."));
+                    return;
+                }
+                this.database = database;
+                database.onversionchange = () => {
+                    database.close();
+                    if (this.database === database) {
+                        this.database = null;
+                        this.databasePromise = null;
+                    }
+                };
+                resolve(database);
+            };
+        });
+        return this.databasePromise;
+    }
+}
+//# sourceMappingURL=indexedDbStoreConnection.js.map

package/client/localKeyring/indexedDbStoreConnection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"indexedDbStoreConnection.js","sourceRoot":"","sources":["indexedDbStoreConnection.ts"],"names":[],"mappings":"AAOA,SAAS,gBAAgB,CAAI,OAAsB;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE;YACrB,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;QAClE,CAAC,CAAC;QACF,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE;YACvB,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,wBAAwB,CAAC,WAA2B;IAC3D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,WAAW,CAAC,OAAO,GAAG,GAAG,EAAE;YACzB,MAAM,CAAC,WAAW,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC;QACF,WAAW,CAAC,OAAO,GAAG,GAAG,EAAE;YACzB,MAAM,CAAC,WAAW,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC;QACF,WAAW,CAAC,UAAU,GAAG,GAAG,EAAE;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,WAA2B,EAC3B,OAAsB;IAEtB,MAAM,eAAe,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjC,gBAAgB,CAAC,OAAO,CAAC;YACzB,eAAe;SAChB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,OAAO,wBAAwB;IAClB,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,OAAO,CAAkC;IAClD,MAAM,GAAG,KAAK,CAAC;IACf,QAAQ,GAAuB,IAAI,CAAC;IACpC,eAAe,GAAgC,IAAI,CAAC;IAE5D,YAAY,OAAwC;QAClD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,WAAW,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,0EAA0E;YAC5E,CAAC;QACH,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAEhC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,QAAQ,EAAE,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,KAAK,eAAe,EAAE,IAAI,CACxB,CAAC,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,EAC1C,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CACX,IAAwB,EACxB,SAAmD;QAEnD,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CACtC,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,IAAI,CACL,CAAC;QACF,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACpE,OAAO,MAAM,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,eAAe,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,eAAe,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE;gBACrB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;gBAC5B,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;YAC/D,CAAC,CAAC;YACF,OAAO,CAAC,eAAe,GAAG,GAAG,EAAE;gBAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;gBAChC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;oBACtE,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE;wBACvD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;qBAC9B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC;YACF,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE;gBACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;gBAChC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChB,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACjB,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;oBACrD,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;gBACzB,QAAQ,CAAC,eAAe,GAAG,GAAG,EAAE;oBAC9B,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACjB,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBAC/B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;wBACrB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;oBAC9B,CAAC;gBACH,CAAC,CAAC;gBACF,OAAO,CAAC,QAAQ,CAAC,CAAC;YACpB,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF","sourcesContent":["interface IndexedDbStoreConnectionOptions {\n  readonly databaseName: string;\n  readonly indexedDB: IDBFactory;\n  readonly keyPath: string;\n  readonly objectStoreName: string;\n}\n\nfunction indexedDbRequest<T>(request: IDBRequest<T>): Promise<T> {\n  return new Promise((resolve, reject) => {\n    request.onerror = () => {\n      reject(request.error ?? new Error(\"IndexedDB request failed.\"));\n    };\n    request.onsuccess = () => {\n      resolve(request.result);\n    };\n  });\n}\n\nfunction indexedDbTransactionDone(transaction: IDBTransaction): Promise<void> {\n  return new Promise((resolve, reject) => {\n    transaction.onabort = () => {\n      reject(transaction.error ?? new Error(\"IndexedDB transaction aborted.\"));\n    };\n    transaction.onerror = () => {\n      reject(transaction.error ?? new Error(\"IndexedDB transaction failed.\"));\n    };\n    transaction.oncomplete = () => {\n      resolve();\n    };\n  });\n}\n\nasync function runIndexedDbRequest<T>(\n  transaction: IDBTransaction,\n  request: IDBRequest<T>,\n): Promise<T> {\n  const transactionDone = indexedDbTransactionDone(transaction);\n  try {\n    const [result] = await Promise.all([\n      indexedDbRequest(request),\n      transactionDone,\n    ]);\n    return result;\n  } catch (error) {\n    await transactionDone.catch(() => undefined);\n    throw error;\n  }\n}\n\nexport class IndexedDbStoreConnection {\n  private readonly activeTransactions = new Set<IDBTransaction>();\n  private readonly options: IndexedDbStoreConnectionOptions;\n  private closed = false;\n  private database: IDBDatabase | null = null;\n  private databasePromise: Promise<IDBDatabase> | null = null;\n\n  constructor(options: IndexedDbStoreConnectionOptions) {\n    this.options = options;\n  }\n\n  close(): void {\n    if (this.closed) {\n      return;\n    }\n\n    this.closed = true;\n    for (const transaction of this.activeTransactions) {\n      try {\n        transaction.abort();\n      } catch {\n        // The transaction may already have completed between iteration and abort.\n      }\n    }\n    this.activeTransactions.clear();\n\n    const database = this.database;\n    database?.close();\n    this.database = null;\n    const databasePromise = this.databasePromise;\n    this.databasePromise = null;\n    if (!database) {\n      void databasePromise?.then(\n        (openedDatabase) => openedDatabase.close(),\n        () => undefined,\n      );\n    }\n  }\n\n  async request<T>(\n    mode: IDBTransactionMode,\n    operation: (store: IDBObjectStore) => IDBRequest<T>,\n  ): Promise<T> {\n    this.assertOpen();\n    const database = await this.openDatabase();\n    this.assertOpen();\n    const transaction = database.transaction(\n      this.options.objectStoreName,\n      mode,\n    );\n    this.activeTransactions.add(transaction);\n    try {\n      const store = transaction.objectStore(this.options.objectStoreName);\n      return await runIndexedDbRequest(transaction, operation(store));\n    } finally {\n      this.activeTransactions.delete(transaction);\n    }\n  }\n\n  private assertOpen(): void {\n    if (this.closed) {\n      throw new Error(\"IndexedDB connection is closed.\");\n    }\n  }\n\n  private async openDatabase(): Promise<IDBDatabase> {\n    this.assertOpen();\n    if (this.databasePromise) {\n      return this.databasePromise;\n    }\n\n    this.databasePromise = new Promise((resolve, reject) => {\n      const request = this.options.indexedDB.open(this.options.databaseName, 1);\n      request.onerror = () => {\n        this.databasePromise = null;\n        reject(request.error ?? new Error(\"IndexedDB open failed.\"));\n      };\n      request.onupgradeneeded = () => {\n        const database = request.result;\n        if (!database.objectStoreNames.contains(this.options.objectStoreName)) {\n          database.createObjectStore(this.options.objectStoreName, {\n            keyPath: this.options.keyPath,\n          });\n        }\n      };\n      request.onsuccess = () => {\n        const database = request.result;\n        if (this.closed) {\n          database.close();\n          reject(new Error(\"IndexedDB connection is closed.\"));\n          return;\n        }\n        this.database = database;\n        database.onversionchange = () => {\n          database.close();\n          if (this.database === database) {\n            this.database = null;\n            this.databasePromise = null;\n          }\n        };\n        resolve(database);\n      };\n    });\n\n    return this.databasePromise;\n  }\n}\n"]}

package/client/localKeyring/indexedDbWrappingKeyRecord.js

@@ -0,0 +1,90 @@
+import { readObject, readString } from "./jsonReaders.js";
+import { copyBytes } from "./primitives.js";
+const WRAPPING_KEY_BYTES = 32;
+export function hasErrorName(error, expectedName) {
+    if (!error || typeof error !== "object") {
+        return false;
+    }
+    if ("name" in error &&
+        typeof error.name === "string" &&
+        error.name === expectedName) {
+        return true;
+    }
+    if ("cause" in error) {
+        return hasErrorName(error.cause, expectedName);
+    }
+    return false;
+}
+function isCryptoKey(value) {
+    return typeof CryptoKey !== "undefined" && value instanceof CryptoKey;
+}
+export function assertAesGcmWrappingCryptoKey(key) {
+    const algorithm = key.algorithm;
+    const algorithmLength = "length" in algorithm && typeof algorithm.length === "number"
+        ? algorithm.length
+        : null;
+    if (key.type !== "secret" ||
+        key.extractable ||
+        algorithm.name !== "AES-GCM" ||
+        algorithmLength !== 256 ||
+        !key.usages.includes("decrypt") ||
+        !key.usages.includes("encrypt")) {
+        throw new Error("IndexedDB wrapping key must be a non-extractable AES-GCM secret key.");
+    }
+}
+export function readWrappingKeyMaterial(value) {
+    const bytes = value instanceof Uint8Array
+        ? value
+        : value instanceof ArrayBuffer
+            ? new Uint8Array(value)
+            : null;
+    if (!bytes || bytes.byteLength !== WRAPPING_KEY_BYTES) {
+        throw new Error("IndexedDB wrapping key material must be 32 raw AES-256 bytes.");
+    }
+    return bytes;
+}
+// Re-import the persisted raw bytes as a non-extractable runtime key: the bytes
+// at rest are extractable (that is the cost of the "raw-bytes" mode), but the
+// in-memory CryptoKey handed to encrypt/decrypt stays non-extractable. The
+// temporary copy is wiped once WebCrypto has imported it so the raw key material
+// does not linger in memory.
+export async function importRawWrappingKey(keyMaterial) {
+    const keyBytes = copyBytes(keyMaterial);
+    try {
+        return await crypto.subtle.importKey("raw", keyBytes, { length: 256, name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+    }
+    finally {
+        keyBytes.fill(0);
+    }
+}
+export function readIndexedDbWrappingKeyRecord(input) {
+    const record = readObject(input.value, "IndexedDB wrapping key record");
+    const keyId = readString(record, "keyId");
+    if (keyId !== input.keyId) {
+        throw new Error("IndexedDB wrapping key id does not match.");
+    }
+    const provider = readString(record, "provider");
+    if (provider !== input.provider) {
+        throw new Error("IndexedDB wrapping key provider does not match.");
+    }
+    const createdAt = readString(record, "createdAt");
+    if (input.keyMaterialStorage === "raw-bytes") {
+        const keyMaterial = record.get("keyMaterial");
+        if (keyMaterial === undefined) {
+            throw new Error("IndexedDB wrapping key record is missing its raw key material.");
+        }
+        return {
+            createdAt,
+            keyId,
+            keyMaterial: readWrappingKeyMaterial(keyMaterial),
+            provider,
+        };
+    }
+    const key = record.get("key");
+    if (!isCryptoKey(key)) {
+        throw new Error("IndexedDB wrapping key record is missing its CryptoKey.");
+    }
+    assertAesGcmWrappingCryptoKey(key);
+    return { createdAt, key, keyId, provider };
+}
+//# sourceMappingURL=indexedDbWrappingKeyRecord.js.map

package/client/localKeyring/indexedDbWrappingKeyRecord.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"indexedDbWrappingKeyRecord.js","sourceRoot":"","sources":["indexedDbWrappingKeyRecord.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAc9B,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,YAAoB;IAC/D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IACE,MAAM,IAAI,KAAK;QACf,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,KAAK,CAAC,IAAI,KAAK,YAAY,EAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;QACrB,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,SAAS,KAAK,WAAW,IAAI,KAAK,YAAY,SAAS,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,GAAc;IAC1D,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAChC,MAAM,eAAe,GACnB,QAAQ,IAAI,SAAS,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ;QAC3D,CAAC,CAAC,SAAS,CAAC,MAAM;QAClB,CAAC,CAAC,IAAI,CAAC;IACX,IACE,GAAG,CAAC,IAAI,KAAK,QAAQ;QACrB,GAAG,CAAC,WAAW;QACf,SAAS,CAAC,IAAI,KAAK,SAAS;QAC5B,eAAe,KAAK,GAAG;QACvB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/B,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,MAAM,KAAK,GACT,KAAK,YAAY,UAAU;QACzB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,KAAK,YAAY,WAAW;YAC5B,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC;YACvB,CAAC,CAAC,IAAI,CAAC;IACb,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,kBAAkB,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,2EAA2E;AAC3E,iFAAiF;AACjF,6BAA6B;AAC7B,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAuB;IAEvB,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAClC,KAAK,EACL,QAAQ,EACR,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAK9C;IACC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,kBAAkB,KAAK,WAAW,EAAE,CAAC;QAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS;YACT,KAAK;YACL,WAAW,EAAE,uBAAuB,CAAC,WAAW,CAAC;YACjD,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,6BAA6B,CAAC,GAAG,CAAC,CAAC;IAEnC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7C,CAAC","sourcesContent":["import { readObject, readString } from \"./jsonReaders\";\nimport { copyBytes } from \"./primitives\";\nimport type { WrappingKeyMaterialStorage } from \"./types\";\n\nconst WRAPPING_KEY_BYTES = 32;\n\nexport interface IndexedDbWrappingKeyRecord {\n  readonly createdAt: string;\n  // Exactly one of `key` / `keyMaterial` is set, per the keystore's\n  // keyMaterialStorage mode. `key` holds a live non-extractable CryptoKey;\n  // `keyMaterial` holds exported raw AES-GCM bytes for WebView shells that\n  // cannot structured-clone a CryptoKey (see WrappingKeyMaterialStorage).\n  readonly key?: CryptoKey;\n  readonly keyId: string;\n  readonly keyMaterial?: Uint8Array;\n  readonly provider: string;\n}\n\nexport function hasErrorName(error: unknown, expectedName: string): boolean {\n  if (!error || typeof error !== \"object\") {\n    return false;\n  }\n  if (\n    \"name\" in error &&\n    typeof error.name === \"string\" &&\n    error.name === expectedName\n  ) {\n    return true;\n  }\n  if (\"cause\" in error) {\n    return hasErrorName(error.cause, expectedName);\n  }\n\n  return false;\n}\n\nfunction isCryptoKey(value: unknown): value is CryptoKey {\n  return typeof CryptoKey !== \"undefined\" && value instanceof CryptoKey;\n}\n\nexport function assertAesGcmWrappingCryptoKey(key: CryptoKey): void {\n  const algorithm = key.algorithm;\n  const algorithmLength =\n    \"length\" in algorithm && typeof algorithm.length === \"number\"\n      ? algorithm.length\n      : null;\n  if (\n    key.type !== \"secret\" ||\n    key.extractable ||\n    algorithm.name !== \"AES-GCM\" ||\n    algorithmLength !== 256 ||\n    !key.usages.includes(\"decrypt\") ||\n    !key.usages.includes(\"encrypt\")\n  ) {\n    throw new Error(\n      \"IndexedDB wrapping key must be a non-extractable AES-GCM secret key.\",\n    );\n  }\n}\n\nexport function readWrappingKeyMaterial(value: unknown): Uint8Array {\n  const bytes =\n    value instanceof Uint8Array\n      ? value\n      : value instanceof ArrayBuffer\n        ? new Uint8Array(value)\n        : null;\n  if (!bytes || bytes.byteLength !== WRAPPING_KEY_BYTES) {\n    throw new Error(\n      \"IndexedDB wrapping key material must be 32 raw AES-256 bytes.\",\n    );\n  }\n  return bytes;\n}\n\n// Re-import the persisted raw bytes as a non-extractable runtime key: the bytes\n// at rest are extractable (that is the cost of the \"raw-bytes\" mode), but the\n// in-memory CryptoKey handed to encrypt/decrypt stays non-extractable. The\n// temporary copy is wiped once WebCrypto has imported it so the raw key material\n// does not linger in memory.\nexport async function importRawWrappingKey(\n  keyMaterial: Uint8Array,\n): Promise<CryptoKey> {\n  const keyBytes = copyBytes(keyMaterial);\n  try {\n    return await crypto.subtle.importKey(\n      \"raw\",\n      keyBytes,\n      { length: 256, name: \"AES-GCM\" },\n      false,\n      [\"encrypt\", \"decrypt\"],\n    );\n  } finally {\n    keyBytes.fill(0);\n  }\n}\n\nexport function readIndexedDbWrappingKeyRecord(input: {\n  readonly keyId: string;\n  readonly keyMaterialStorage: WrappingKeyMaterialStorage;\n  readonly provider: string;\n  readonly value: unknown;\n}): IndexedDbWrappingKeyRecord {\n  const record = readObject(input.value, \"IndexedDB wrapping key record\");\n  const keyId = readString(record, \"keyId\");\n  if (keyId !== input.keyId) {\n    throw new Error(\"IndexedDB wrapping key id does not match.\");\n  }\n  const provider = readString(record, \"provider\");\n  if (provider !== input.provider) {\n    throw new Error(\"IndexedDB wrapping key provider does not match.\");\n  }\n  const createdAt = readString(record, \"createdAt\");\n  if (input.keyMaterialStorage === \"raw-bytes\") {\n    const keyMaterial = record.get(\"keyMaterial\");\n    if (keyMaterial === undefined) {\n      throw new Error(\n        \"IndexedDB wrapping key record is missing its raw key material.\",\n      );\n    }\n    return {\n      createdAt,\n      keyId,\n      keyMaterial: readWrappingKeyMaterial(keyMaterial),\n      provider,\n    };\n  }\n  const key = record.get(\"key\");\n  if (!isCryptoKey(key)) {\n    throw new Error(\"IndexedDB wrapping key record is missing its CryptoKey.\");\n  }\n  assertAesGcmWrappingCryptoKey(key);\n\n  return { createdAt, key, keyId, provider };\n}\n"]}

package/client/localKeyring/jsonReaders.d.ts

@@ -0,0 +1,8 @@
+type ParsedObject = ReadonlyMap<string, unknown>;
+export declare function readObject(value: unknown, label: string): ParsedObject;
+export declare function readString(value: ParsedObject, key: string): string;
+export declare function readExactString<const ExpectedValue extends string>(value: ParsedObject, key: string, expectedValue: ExpectedValue): ExpectedValue;
+export declare function readOptionalString(value: ParsedObject, key: string): string | undefined;
+export declare function readNullableString(value: ParsedObject, key: string): string | null;
+export declare function readVersion1(value: ParsedObject): 1;
+export {};

package/client/localKeyring/jsonReaders.js

@@ -0,0 +1,47 @@
+export function readObject(value, label) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error(`${label} must be an object.`);
+    }
+    return new Map(Object.entries(value));
+}
+export function readString(value, key) {
+    const field = value.get(key);
+    if (typeof field !== "string" || field.length === 0) {
+        throw new Error(`${key} must be a non-empty string.`);
+    }
+    return field;
+}
+export function readExactString(value, key, expectedValue) {
+    const field = readString(value, key);
+    if (field !== expectedValue) {
+        throw new Error(`${key} must be ${expectedValue}.`);
+    }
+    return expectedValue;
+}
+export function readOptionalString(value, key) {
+    const field = value.get(key);
+    if (field === undefined) {
+        return undefined;
+    }
+    if (typeof field !== "string" || field.length === 0) {
+        throw new Error(`${key} must be a non-empty string.`);
+    }
+    return field;
+}
+export function readNullableString(value, key) {
+    const field = value.get(key);
+    if (field === null) {
+        return null;
+    }
+    if (typeof field !== "string" || field.length === 0) {
+        throw new Error(`${key} must be a non-empty string or null.`);
+    }
+    return field;
+}
+export function readVersion1(value) {
+    if (value.get("version") !== 1) {
+        throw new Error("version must be 1.");
+    }
+    return 1;
+}
+//# sourceMappingURL=jsonReaders.js.map

package/client/localKeyring/jsonReaders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonReaders.js","sourceRoot":"","sources":["jsonReaders.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,KAAa;IACtD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAmB,EAAE,GAAW;IACzD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,8BAA8B,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,KAAmB,EACnB,GAAW,EACX,aAA4B;IAE5B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,YAAY,aAAa,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAmB,EACnB,GAAW;IAEX,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,8BAA8B,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAmB,EACnB,GAAW;IAEX,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,sCAAsC,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAmB;IAC9C,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC","sourcesContent":["type ParsedObject = ReadonlyMap<string, unknown>;\n\nexport function readObject(value: unknown, label: string): ParsedObject {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n    throw new Error(`${label} must be an object.`);\n  }\n\n  return new Map(Object.entries(value));\n}\n\nexport function readString(value: ParsedObject, key: string): string {\n  const field = value.get(key);\n  if (typeof field !== \"string\" || field.length === 0) {\n    throw new Error(`${key} must be a non-empty string.`);\n  }\n\n  return field;\n}\n\nexport function readExactString<const ExpectedValue extends string>(\n  value: ParsedObject,\n  key: string,\n  expectedValue: ExpectedValue,\n): ExpectedValue {\n  const field = readString(value, key);\n  if (field !== expectedValue) {\n    throw new Error(`${key} must be ${expectedValue}.`);\n  }\n\n  return expectedValue;\n}\n\nexport function readOptionalString(\n  value: ParsedObject,\n  key: string,\n): string | undefined {\n  const field = value.get(key);\n  if (field === undefined) {\n    return undefined;\n  }\n  if (typeof field !== \"string\" || field.length === 0) {\n    throw new Error(`${key} must be a non-empty string.`);\n  }\n\n  return field;\n}\n\nexport function readNullableString(\n  value: ParsedObject,\n  key: string,\n): string | null {\n  const field = value.get(key);\n  if (field === null) {\n    return null;\n  }\n  if (typeof field !== \"string\" || field.length === 0) {\n    throw new Error(`${key} must be a non-empty string or null.`);\n  }\n\n  return field;\n}\n\nexport function readVersion1(value: ParsedObject): 1 {\n  if (value.get(\"version\") !== 1) {\n    throw new Error(\"version must be 1.\");\n  }\n\n  return 1;\n}\n"]}

package/client/localKeyring/localKeyringPinCode.d.ts

@@ -0,0 +1,18 @@
+import { type BrowserLocalKeyringOptions, type LocalKeyring, type WrappedLocalSecretEnvelope, type WrappingKeyKeystore } from "./index.js";
+import { type LocalKeyringPinCode } from "./localKeyringPinCodeSupport.js";
+export type { LocalKeyringPinCode };
+export interface PinCodeWrappingKeyKeystoreOptions {
+    readonly innerKeystore: WrappingKeyKeystore;
+    readonly kdfIterations?: number | undefined;
+    readonly pinCode: LocalKeyringPinCode;
+    readonly provider?: string | undefined;
+}
+export type PinCodeBrowserLocalKeyringOptions = Omit<BrowserLocalKeyringOptions, "provider"> & {
+    readonly kdfIterations?: number | undefined;
+    readonly pinCode: LocalKeyringPinCode;
+    readonly pinCodeProvider?: string | undefined;
+    readonly wrappingKeyProvider?: string | undefined;
+};
+export declare function createPinCodeWrappingKeyKeystore(options: PinCodeWrappingKeyKeystoreOptions): WrappingKeyKeystore;
+export declare function isPinCodeWrappedLocalSecretEnvelope(envelope: WrappedLocalSecretEnvelope): boolean;
+export declare function createPinCodeBrowserLocalKeyring(options: PinCodeBrowserLocalKeyringOptions): LocalKeyring;

package/client/localKeyring/localKeyringPinCode.js

@@ -0,0 +1,142 @@
+import { base64ToBytes } from "../../internal/encoding/index.js";
+import { assertUnwrappableAesGcmEnvelope, sealAesGcmEnvelope, } from "./aesGcmWrapping.js";
+import { assertEnvelopeContextMatches, assertNonEmptyString, copyBytes, createIndexedDbWrappingKeyKeystore, createLocalKeyring, normalizeLocalKeyringScope, resolveBrowserLocalKeyringManifestStore, } from "./index.js";
+import { createPinCodeWrappingKeyId, createPinCodeWrappingKeyMetadata, derivePinCodeWrappingKey, normalizeKdfIterations, PIN_CODE_PROVIDER, PIN_CODE_WRAPPING_ALGORITHM, parsePinCodeWrappingKeyId, parseWrappedLocalSecretEnvelopeBytes, pinCodeAdditionalData, randomAesGcmIv, serializeWrappedLocalSecretEnvelope, } from "./localKeyringPinCodeSupport.js";
+class PinCodeWrappingKeyKeystore {
+    provider;
+    innerKeystore;
+    kdfIterations;
+    pinCode;
+    constructor(options) {
+        this.innerKeystore = options.innerKeystore;
+        this.kdfIterations = normalizeKdfIterations(options.kdfIterations);
+        this.pinCode = options.pinCode;
+        this.provider = options.provider ?? PIN_CODE_PROVIDER;
+        assertNonEmptyString(this.provider, "PIN code wrapping key provider");
+    }
+    close() {
+        this.innerKeystore.close?.();
+    }
+    async deleteWrappingKey(scope) {
+        await this.innerKeystore.deleteWrappingKey(scope);
+    }
+    async getOrCreateWrappingKey(scope) {
+        const innerHandle = await this.innerKeystore.getOrCreateWrappingKey(normalizeLocalKeyringScope(scope));
+        const metadata = createPinCodeWrappingKeyMetadata({
+            innerHandle,
+            iterations: this.kdfIterations,
+        });
+        return {
+            keyId: createPinCodeWrappingKeyId(metadata),
+            provider: this.provider,
+        };
+    }
+    async unwrapSecret({ context, envelope, }) {
+        const iv = assertUnwrappableAesGcmEnvelope({
+            algorithm: PIN_CODE_WRAPPING_ALGORITHM,
+            context,
+            envelope,
+            provider: this.provider,
+        });
+        const metadata = parsePinCodeWrappingKeyId(envelope.keyId);
+        const key = await derivePinCodeWrappingKey({
+            metadata,
+            pinCode: this.pinCode,
+        });
+        let innerEnvelope;
+        try {
+            innerEnvelope = parseWrappedLocalSecretEnvelopeBytes(await crypto.subtle.decrypt({
+                additionalData: pinCodeAdditionalData({
+                    context,
+                    keyId: envelope.keyId,
+                    provider: this.provider,
+                }),
+                iv: copyBytes(base64ToBytes(iv)),
+                name: "AES-GCM",
+            }, key, copyBytes(base64ToBytes(envelope.ciphertext))));
+        }
+        catch (error) {
+            throw new Error("PIN code is incorrect or wrapped local secret could not be unwrapped.", { cause: error });
+        }
+        assertEnvelopeContextMatches({
+            actual: innerEnvelope.context,
+            expected: context,
+        });
+        if (innerEnvelope.provider !== metadata.innerProvider ||
+            innerEnvelope.keyId !== metadata.innerKeyId) {
+            throw new Error("PIN code inner wrapping key does not match.");
+        }
+        return this.innerKeystore.unwrapSecret({
+            context,
+            envelope: innerEnvelope,
+        });
+    }
+    async wrapSecret({ context, handle, plaintext, }) {
+        if (handle.provider !== this.provider) {
+            throw new Error("Wrapping key handle provider is unsupported.");
+        }
+        const metadata = parsePinCodeWrappingKeyId(handle.keyId);
+        const innerEnvelope = await this.innerKeystore.wrapSecret({
+            context,
+            handle: {
+                keyId: metadata.innerKeyId,
+                provider: metadata.innerProvider,
+            },
+            plaintext,
+        });
+        const key = await derivePinCodeWrappingKey({
+            metadata,
+            pinCode: this.pinCode,
+        });
+        const iv = randomAesGcmIv();
+        const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
+            additionalData: pinCodeAdditionalData({
+                context,
+                keyId: handle.keyId,
+                provider: this.provider,
+            }),
+            iv,
+            name: "AES-GCM",
+        }, key, serializeWrappedLocalSecretEnvelope(innerEnvelope)));
+        return sealAesGcmEnvelope({
+            algorithm: PIN_CODE_WRAPPING_ALGORITHM,
+            ciphertext,
+            context,
+            iv,
+            keyId: handle.keyId,
+            provider: this.provider,
+        });
+    }
+}
+export function createPinCodeWrappingKeyKeystore(options) {
+    return new PinCodeWrappingKeyKeystore(options);
+}
+export function isPinCodeWrappedLocalSecretEnvelope(envelope) {
+    return (envelope.provider === PIN_CODE_PROVIDER &&
+        envelope.algorithm === PIN_CODE_WRAPPING_ALGORITHM);
+}
+export function createPinCodeBrowserLocalKeyring(options) {
+    return createLocalKeyring({
+        keystore: createPinCodeWrappingKeyKeystore({
+            innerKeystore: createIndexedDbWrappingKeyKeystore({
+                databaseName: options.databaseName,
+                indexedDB: options.indexedDB,
+                // Must match the non-PIN keyring's mode for the same shell. The inner
+                // keystore reads the wrapping-key record written by whichever keyring
+                // ran first, and the raw-bytes and CryptoKey record formats are not
+                // interchangeable. WKWebView shells (Capacitor/Electrobun)
+                // cannot structured-clone a CryptoKey at all, so without this the PIN
+                // keyring would throw DataCloneError where the plain one works.
+                keyMaterialStorage: options.keyMaterialStorage,
+                objectStoreName: options.objectStoreName,
+                provider: options.wrappingKeyProvider,
+            }),
+            kdfIterations: options.kdfIterations,
+            pinCode: options.pinCode,
+            provider: options.pinCodeProvider,
+        }),
+        manifestStore: resolveBrowserLocalKeyringManifestStore(options),
+        now: options.now,
+    });
+}
+//# sourceMappingURL=localKeyringPinCode.js.map