feat(server,platform): retain and expose session identity material (#403)

* feat(server,platform): retain and expose session identity material

The v2 pairing handshake carries three values the core consumed and then
discarded: the identity chat X25519 private key, the answering device's
encryption public key, and the peer's statement account id. A host adopting
core pairing had no way to reach them, so it had to keep a second duplicate
pairing alive purely to harvest them.

Retain rather than derive. The wallet chooses the chat key and every peer
already addresses that identity by the matching public key, so a value
derived host-side would name an identity nobody can reach. The pairing host
provably cannot recompute it either: the derivation needs raw BIP-39 entropy,
which only a signing host holds.

Split the read paths by sensitivity. Public material rides SessionUiInfo
(chat_public_key, device_enc_public_key, peer_statement_account_id) so a host
that only addresses the identity never touches a secret. The secrets sit
behind explicit CoreAdmin calls, because SessionUiInfo rides every AuthState
broadcast to all registered AuthPresenters and would push them to hosts that
never asked. Both secrets are reachable over wasm and UniFFI.

Give the responder its own device encryption key. It previously advertised
the SSO channel key as device_enc_pub_key, which makes every device sharing
an identity indistinguishable. The key is now random and persisted under
CoreStorageKey::DeviceEncryptionKey, matching the provider, and the CLI host
anchors that slot to its bootstrap directory so a user switch cannot
regenerate the identity peers address this install by.

Verified field-for-field against the Android provider and the host-papp
consumer: the handshake layout, the X25519 basepoint derivation of the chat
public key, and the statement-signer origin of the peer account id all match.

SessionInfo gains fields mid-struct, so its SCALE layout changes. The blob is
unversioned and decode rejects short input, so sessions persisted by an
earlier build no longer decode and those users re-pair once.

Refs #384

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(server,host): close the device-key race and the empty-key fallback

Move the device-key serialization guard from SigningHost onto RuntimeServices
and bundle it with the read. The key is reachable from both roles now, so a
guard owned by one of them left the CoreAdmin and pairing-runtime paths free
to race a first-time read against pairing, generate a second secret, and
overwrite the one peers were told to address. `device_encryption_secret` is
the only way to reach the key, so no caller can forget to hold it.

Reject instead of resolving with an empty key when the worker host runtime is
disposed. Callers encrypt with whatever comes back, so a zero-length secret
is the one answer that must never be handed out.

* fix(server,host): address PR review nits

Move the execution-kind doc comment onto execution_kind(), warn on a
malformed stored device encryption key, and cover the provider's
getDeviceEncryptionKey hex/rejection paths.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: johnthecat

ios/truapi-host/Sources/TrUAPIHost/truapi_platform.swift

@@ -1121,6 +1121,23 @@ public struct SessionUiInfo: Equatable, Hashable {
      * Wallet identity account id used for People-chain username lookup.
      */
     public var identityAccountId: Bytes32?
+    /**
+     * X25519 public key addressing this identity in chat. Public counterpart
+     * of the key [`CoreAdmin::get_session_chat_identity_key`] serves.
+     */
+    public var chatPublicKey: Bytes32?
+    /**
+     * X25519 public key of the wallet device that answered pairing. Hosts
+     * running their own encrypted device-sync channel key it against this.
+     */
+    public var deviceEncPublicKey: Bytes32?
+    /**
+     * Statement-store account id the paired wallet signs every session-channel
+     * statement with. Whether it is scoped to the wallet device or to the
+     * wallet identity is the wallet's choice, so hosts must not treat it as a
+     * device discriminator; use [`Self::device_enc_public_key`] for that.
+     */
+    public var peerStatementAccountId: Bytes32?
     /**
      * Short username from the People-chain identity record.
      */
@@ -1139,6 +1156,20 @@ public struct SessionUiInfo: Equatable, Hashable {
         /**
          * Wallet identity account id used for People-chain username lookup.
          */identityAccountId: Bytes32?,
+        /**
+         * X25519 public key addressing this identity in chat. Public counterpart
+         * of the key [`CoreAdmin::get_session_chat_identity_key`] serves.
+         */chatPublicKey: Bytes32?,
+        /**
+         * X25519 public key of the wallet device that answered pairing. Hosts
+         * running their own encrypted device-sync channel key it against this.
+         */deviceEncPublicKey: Bytes32?,
+        /**
+         * Statement-store account id the paired wallet signs every session-channel
+         * statement with. Whether it is scoped to the wallet device or to the
+         * wallet identity is the wallet's choice, so hosts must not treat it as a
+         * device discriminator; use [`Self::device_enc_public_key`] for that.
+         */peerStatementAccountId: Bytes32?,
         /**
          * Short username from the People-chain identity record.
          */liteUsername: String?,
@@ -1147,6 +1178,9 @@ public struct SessionUiInfo: Equatable, Hashable {
          */fullUsername: String?) {
         self.publicKey = publicKey
         self.identityAccountId = identityAccountId
+        self.chatPublicKey = chatPublicKey
+        self.deviceEncPublicKey = deviceEncPublicKey
+        self.peerStatementAccountId = peerStatementAccountId
         self.liteUsername = liteUsername
         self.fullUsername = fullUsername
     }
@@ -1169,6 +1203,9 @@ public struct FfiConverterTypeSessionUiInfo: FfiConverterRustBuffer {
             try SessionUiInfo(
                 publicKey: FfiConverterTypeBytes32.read(from: &buf),
                 identityAccountId: FfiConverterOptionTypeBytes32.read(from: &buf),
+                chatPublicKey: FfiConverterOptionTypeBytes32.read(from: &buf),
+                deviceEncPublicKey: FfiConverterOptionTypeBytes32.read(from: &buf),
+                peerStatementAccountId: FfiConverterOptionTypeBytes32.read(from: &buf),
                 liteUsername: FfiConverterOptionString.read(from: &buf),
                 fullUsername: FfiConverterOptionString.read(from: &buf)
         )
@@ -1177,6 +1214,9 @@ public struct FfiConverterTypeSessionUiInfo: FfiConverterRustBuffer {
     public static func write(_ value: SessionUiInfo, into buf: inout [UInt8]) {
         FfiConverterTypeBytes32.write(value.publicKey, into: &buf)
         FfiConverterOptionTypeBytes32.write(value.identityAccountId, into: &buf)
+        FfiConverterOptionTypeBytes32.write(value.chatPublicKey, into: &buf)
+        FfiConverterOptionTypeBytes32.write(value.deviceEncPublicKey, into: &buf)
+        FfiConverterOptionTypeBytes32.write(value.peerStatementAccountId, into: &buf)
         FfiConverterOptionString.write(value.liteUsername, into: &buf)
         FfiConverterOptionString.write(value.fullUsername, into: &buf)
     }

ios/truapi-host/Sources/TrUAPIHost/truapi_server.swift

@@ -2432,6 +2432,12 @@ public func FfiConverterTypeNativeCustomRendererSubscription_lower(_ value: Nati
  */
 public protocol NativeProductExecutionProtocol: AnyObject, Sendable {
 
+    /**
+     * Read this device's X25519 encryption secret, for device sync against a
+     * peer's `deviceEncPublicKey`. Generated and persisted on first read.
+     */
+    func deviceEncryptionKey() throws  -> Bytes32
+
     /**
      * Notify this execution's chain adapter that a connection closed.
      */
@@ -2473,6 +2479,12 @@ public protocol NativeProductExecutionProtocol: AnyObject, Sendable {
      */
     func renderCustomMessage(messageId: String, messageType: String, payload: Data, observer: NativeCustomRendererObserver) throws  -> NativeCustomRendererSubscription
 
+    /**
+     * Read the active session's X25519 chat identity private key, or `None`
+     * when no session is active.
+     */
+    func sessionChatIdentityKey() throws  -> Bytes32?
+
     /**
      * Update a product-scoped permission authorization.
      */
@@ -2554,6 +2566,19 @@ open class NativeProductExecution: NativeProductExecutionProtocol, @unchecked Se
 
 
 
+    /**
+     * Read this device's X25519 encryption secret, for device sync against a
+     * peer's `deviceEncPublicKey`. Generated and persisted on first read.
+     */
+open func deviceEncryptionKey()throws  -> Bytes32  {
+    return try  FfiConverterTypeBytes32_lift(try rustCallWithError(FfiConverterTypeHostRejection_lift) {
+        uniffiCallStatus in
+    uniffi_truapi_server_fn_method_nativeproductexecution_device_encryption_key(
+            self.uniffiCloneHandle(),uniffiCallStatus
+    )
+})
+}
+
     /**
      * Notify this execution's chain adapter that a connection closed.
      */
@@ -2656,6 +2681,19 @@ open func renderCustomMessage(messageId: String, messageType: String, payload: D
         FfiConverterCallbackInterfaceNativeCustomRendererObserver_lower(observer),uniffiCallStatus
     )
 })
+}
+
+    /**
+     * Read the active session's X25519 chat identity private key, or `None`
+     * when no session is active.
+     */
+open func sessionChatIdentityKey()throws  -> Bytes32?  {
+    return try  FfiConverterOptionTypeBytes32.lift(try rustCallWithError(FfiConverterTypeHostRejection_lift) {
+        uniffiCallStatus in
+    uniffi_truapi_server_fn_method_nativeproductexecution_session_chat_identity_key(
+            self.uniffiCloneHandle(),uniffiCallStatus
+    )
+})
 }
 
     /**
@@ -5831,6 +5869,30 @@ fileprivate struct FfiConverterOptionTypeProductAccountId: FfiConverterRustBuffe
     }
 }
 
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+fileprivate struct FfiConverterOptionTypeBytes32: FfiConverterRustBuffer {
+    typealias SwiftType = Bytes32?
+
+    public static func write(_ value: SwiftType, into buf: inout [UInt8]) {
+        guard let value = value else {
+            writeInt(&buf, Int8(0))
+            return
+        }
+        writeInt(&buf, Int8(1))
+        FfiConverterTypeBytes32.write(value, into: &buf)
+    }
+
+    public static func read(from buf: inout (data: Data, offset: Data.Index)) throws -> SwiftType {
+        switch try readInt(&buf) as Int8 {
+        case 0: return nil
+        case 1: return try FfiConverterTypeBytes32.read(from: &buf)
+        default: throw UniffiInternalError.unexpectedOptionalTag
+        }
+    }
+}
+
 #if swift(>=5.8)
 @_documentation(visibility: private)
 #endif
@@ -6217,6 +6279,9 @@ private let initializationResult: InitializationResult = {
     if (uniffi_truapi_server_checksum_method_nativechatcallbacks_list_rooms() != 21374) {
         return InitializationResult.apiChecksumMismatch
     }
+    if (uniffi_truapi_server_checksum_method_nativeproductexecution_device_encryption_key() != 18707) {
+        return InitializationResult.apiChecksumMismatch
+    }
     if (uniffi_truapi_server_checksum_method_nativeproductexecution_notify_chain_closed() != 59343) {
         return InitializationResult.apiChecksumMismatch
     }
@@ -6241,6 +6306,9 @@ private let initializationResult: InitializationResult = {
     if (uniffi_truapi_server_checksum_method_nativeproductexecution_render_custom_message() != 17716) {
         return InitializationResult.apiChecksumMismatch
     }
+    if (uniffi_truapi_server_checksum_method_nativeproductexecution_session_chat_identity_key() != 3903) {
+        return InitializationResult.apiChecksumMismatch
+    }
     if (uniffi_truapi_server_checksum_method_nativeproductexecution_set_permission_authorization_status() != 14164) {
         return InitializationResult.apiChecksumMismatch
     }

ios/truapi-host/Sources/truapi_serverFFI/include/truapi_serverFFI.h

@@ -641,6 +641,11 @@ uint64_t uniffi_truapi_server_fn_clone_nativeproductexecution(uint64_t handle, R
 void uniffi_truapi_server_fn_free_nativeproductexecution(uint64_t handle, RustCallStatus *_Nonnull out_status
 );
 #endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_FN_METHOD_NATIVEPRODUCTEXECUTION_DEVICE_ENCRYPTION_KEY
+#define UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_FN_METHOD_NATIVEPRODUCTEXECUTION_DEVICE_ENCRYPTION_KEY
+RustBuffer uniffi_truapi_server_fn_method_nativeproductexecution_device_encryption_key(uint64_t ptr, RustCallStatus *_Nonnull out_status
+);
+#endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_FN_METHOD_NATIVEPRODUCTEXECUTION_NOTIFY_CHAIN_CLOSED
 #define UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_FN_METHOD_NATIVEPRODUCTEXECUTION_NOTIFY_CHAIN_CLOSED
 void uniffi_truapi_server_fn_method_nativeproductexecution_notify_chain_closed(uint64_t ptr, uint32_t connection_id, RustCallStatus *_Nonnull out_status
@@ -681,6 +686,11 @@ void uniffi_truapi_server_fn_method_nativeproductexecution_publish_chat_action(u
 uint64_t uniffi_truapi_server_fn_method_nativeproductexecution_render_custom_message(uint64_t ptr, RustBuffer message_id, RustBuffer message_type, RustBuffer payload, uint64_t observer, RustCallStatus *_Nonnull out_status
 );
 #endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_FN_METHOD_NATIVEPRODUCTEXECUTION_SESSION_CHAT_IDENTITY_KEY
+#define UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_FN_METHOD_NATIVEPRODUCTEXECUTION_SESSION_CHAT_IDENTITY_KEY
+RustBuffer uniffi_truapi_server_fn_method_nativeproductexecution_session_chat_identity_key(uint64_t ptr, RustCallStatus *_Nonnull out_status
+);
+#endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_FN_METHOD_NATIVEPRODUCTEXECUTION_SET_PERMISSION_AUTHORIZATION_STATUS
 #define UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_FN_METHOD_NATIVEPRODUCTEXECUTION_SET_PERMISSION_AUTHORIZATION_STATUS
 void uniffi_truapi_server_fn_method_nativeproductexecution_set_permission_authorization_status(uint64_t ptr, RustBuffer request, RustBuffer status, RustCallStatus *_Nonnull out_status
@@ -1321,6 +1331,12 @@ uint16_t uniffi_truapi_server_checksum_method_nativechatcallbacks_post_custom_me
 #define UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_CHECKSUM_METHOD_NATIVECHATCALLBACKS_LIST_ROOMS
 uint16_t uniffi_truapi_server_checksum_method_nativechatcallbacks_list_rooms(void
 
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_CHECKSUM_METHOD_NATIVEPRODUCTEXECUTION_DEVICE_ENCRYPTION_KEY
+#define UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_CHECKSUM_METHOD_NATIVEPRODUCTEXECUTION_DEVICE_ENCRYPTION_KEY
+uint16_t uniffi_truapi_server_checksum_method_nativeproductexecution_device_encryption_key(void
+
 );
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_CHECKSUM_METHOD_NATIVEPRODUCTEXECUTION_NOTIFY_CHAIN_CLOSED
@@ -1369,6 +1385,12 @@ uint16_t uniffi_truapi_server_checksum_method_nativeproductexecution_publish_cha
 #define UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_CHECKSUM_METHOD_NATIVEPRODUCTEXECUTION_RENDER_CUSTOM_MESSAGE
 uint16_t uniffi_truapi_server_checksum_method_nativeproductexecution_render_custom_message(void
 
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_CHECKSUM_METHOD_NATIVEPRODUCTEXECUTION_SESSION_CHAT_IDENTITY_KEY
+#define UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_CHECKSUM_METHOD_NATIVEPRODUCTEXECUTION_SESSION_CHAT_IDENTITY_KEY
+uint16_t uniffi_truapi_server_checksum_method_nativeproductexecution_session_chat_identity_key(void
+
 );
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_CHECKSUM_METHOD_NATIVEPRODUCTEXECUTION_SET_PERMISSION_AUTHORIZATION_STATUS

js/packages/truapi-host/src/wasm-module.ts

@@ -21,6 +21,8 @@ export interface WorkerPairingHostRuntime extends PermissionAuthorizationRuntime
   disconnectSession(): Promise<void>;
   cancelPairing(): void;
   notifySessionStoreChanged(): void;
+  sessionChatIdentityKey(): Uint8Array | undefined;
+  deviceEncryptionKey(): Promise<Uint8Array>;
   activateStoredSession(): Promise<void>;
   activateExternalSession(blob: Uint8Array): Promise<void>;
   resetSessionState(): Promise<void>;