feat(server,platform): retain and expose session identity material

ios/truapi-host/Sources/TrUAPIHost/truapi_platform.swift

@@ -1121,6 +1121,23 @@ public struct SessionUiInfo: Equatable, Hashable {
      * Wallet identity account id used for People-chain username lookup.
      */
     public var identityAccountId: Bytes32?
+    /**
+     * X25519 public key addressing this identity in chat. Public counterpart
+     * of the key [`CoreAdmin::get_session_chat_identity_key`] serves.
+     */
+    public var chatPublicKey: Bytes32?
+    /**
+     * X25519 public key of the wallet device that answered pairing. Hosts
+     * running their own encrypted device-sync channel key it against this.
+     */
+    public var deviceEncPublicKey: Bytes32?
+    /**
+     * Statement-store account id the paired wallet signs every session-channel
+     * statement with. Whether it is scoped to the wallet device or to the
+     * wallet identity is the wallet's choice, so hosts must not treat it as a
+     * device discriminator; use [`Self::device_enc_public_key`] for that.
+     */
+    public var peerStatementAccountId: Bytes32?
     /**
      * Short username from the People-chain identity record.
      */
@@ -1139,6 +1156,20 @@ public struct SessionUiInfo: Equatable, Hashable {
         /**
          * Wallet identity account id used for People-chain username lookup.
          */identityAccountId: Bytes32?,
+        /**
+         * X25519 public key addressing this identity in chat. Public counterpart
+         * of the key [`CoreAdmin::get_session_chat_identity_key`] serves.
+         */chatPublicKey: Bytes32?,
+        /**
+         * X25519 public key of the wallet device that answered pairing. Hosts
+         * running their own encrypted device-sync channel key it against this.
+         */deviceEncPublicKey: Bytes32?,
+        /**
+         * Statement-store account id the paired wallet signs every session-channel
+         * statement with. Whether it is scoped to the wallet device or to the
+         * wallet identity is the wallet's choice, so hosts must not treat it as a
+         * device discriminator; use [`Self::device_enc_public_key`] for that.
+         */peerStatementAccountId: Bytes32?,
         /**
          * Short username from the People-chain identity record.
          */liteUsername: String?,
@@ -1147,6 +1178,9 @@ public struct SessionUiInfo: Equatable, Hashable {
          */fullUsername: String?) {
         self.publicKey = publicKey
         self.identityAccountId = identityAccountId
+        self.chatPublicKey = chatPublicKey
+        self.deviceEncPublicKey = deviceEncPublicKey
+        self.peerStatementAccountId = peerStatementAccountId
         self.liteUsername = liteUsername
         self.fullUsername = fullUsername
     }
@@ -1169,6 +1203,9 @@ public struct FfiConverterTypeSessionUiInfo: FfiConverterRustBuffer {
             try SessionUiInfo(
                 publicKey: FfiConverterTypeBytes32.read(from: &buf),
                 identityAccountId: FfiConverterOptionTypeBytes32.read(from: &buf),
+                chatPublicKey: FfiConverterOptionTypeBytes32.read(from: &buf),
+                deviceEncPublicKey: FfiConverterOptionTypeBytes32.read(from: &buf),
+                peerStatementAccountId: FfiConverterOptionTypeBytes32.read(from: &buf),
                 liteUsername: FfiConverterOptionString.read(from: &buf),
                 fullUsername: FfiConverterOptionString.read(from: &buf)
         )
@@ -1177,6 +1214,9 @@ public struct FfiConverterTypeSessionUiInfo: FfiConverterRustBuffer {
     public static func write(_ value: SessionUiInfo, into buf: inout [UInt8]) {
         FfiConverterTypeBytes32.write(value.publicKey, into: &buf)
         FfiConverterOptionTypeBytes32.write(value.identityAccountId, into: &buf)
+        FfiConverterOptionTypeBytes32.write(value.chatPublicKey, into: &buf)
+        FfiConverterOptionTypeBytes32.write(value.deviceEncPublicKey, into: &buf)
+        FfiConverterOptionTypeBytes32.write(value.peerStatementAccountId, into: &buf)
         FfiConverterOptionString.write(value.liteUsername, into: &buf)
         FfiConverterOptionString.write(value.fullUsername, into: &buf)
     }

ios/truapi-host/Sources/TrUAPIHost/truapi_server.swift

@@ -2390,6 +2390,12 @@ public func FfiConverterTypeNativeCustomRendererSubscription_lower(_ value: Nati
  */
 public protocol NativeProductExecutionProtocol: AnyObject, Sendable {
 
+    /**
+     * Read this device's X25519 encryption secret, for device sync against a
+     * peer's `deviceEncPublicKey`. Generated and persisted on first read.
+     */
+    func deviceEncryptionKey() throws  -> Bytes32
+
     /**
      * Notify this execution's chain adapter that a connection closed.
      */
@@ -2431,6 +2437,12 @@ public protocol NativeProductExecutionProtocol: AnyObject, Sendable {
      */
     func renderCustomMessage(messageId: String, messageType: String, payload: Data, observer: NativeCustomRendererObserver) throws  -> NativeCustomRendererSubscription
 
+    /**
+     * Read the active session's X25519 chat identity private key, or `None`
+     * when no session is active.
+     */
+    func sessionChatIdentityKey() throws  -> Bytes32?
+
     /**
      * Update a product-scoped permission authorization.
      */
@@ -2512,6 +2524,19 @@ open class NativeProductExecution: NativeProductExecutionProtocol, @unchecked Se
 
 
 
+    /**
+     * Read this device's X25519 encryption secret, for device sync against a
+     * peer's `deviceEncPublicKey`. Generated and persisted on first read.
+     */
+open func deviceEncryptionKey()throws  -> Bytes32  {
+    return try  FfiConverterTypeBytes32_lift(try rustCallWithError(FfiConverterTypeHostRejection_lift) {
+        uniffiCallStatus in
+    uniffi_truapi_server_fn_method_nativeproductexecution_device_encryption_key(
+            self.uniffiCloneHandle(),uniffiCallStatus
+    )
+})
+}
+
     /**
      * Notify this execution's chain adapter that a connection closed.
      */
@@ -2614,6 +2639,19 @@ open func renderCustomMessage(messageId: String, messageType: String, payload: D
         FfiConverterCallbackInterfaceNativeCustomRendererObserver_lower(observer),uniffiCallStatus
     )
 })
+}
+
+    /**
+     * Read the active session's X25519 chat identity private key, or `None`
+     * when no session is active.
+     */
+open func sessionChatIdentityKey()throws  -> Bytes32?  {
+    return try  FfiConverterOptionTypeBytes32.lift(try rustCallWithError(FfiConverterTypeHostRejection_lift) {
+        uniffiCallStatus in
+    uniffi_truapi_server_fn_method_nativeproductexecution_session_chat_identity_key(
+            self.uniffiCloneHandle(),uniffiCallStatus
+    )
+})
 }
 
     /**
@@ -5037,6 +5075,30 @@ fileprivate struct FfiConverterOptionTypeProductAccountId: FfiConverterRustBuffe
     }
 }
 
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+fileprivate struct FfiConverterOptionTypeBytes32: FfiConverterRustBuffer {
+    typealias SwiftType = Bytes32?
+
+    public static func write(_ value: SwiftType, into buf: inout [UInt8]) {
+        guard let value = value else {
+            writeInt(&buf, Int8(0))
+            return
+        }
+        writeInt(&buf, Int8(1))
+        FfiConverterTypeBytes32.write(value, into: &buf)
+    }
+
+    public static func read(from buf: inout (data: Data, offset: Data.Index)) throws -> SwiftType {
+        switch try readInt(&buf) as Int8 {
+        case 0: return nil
+        case 1: return try FfiConverterTypeBytes32.read(from: &buf)
+        default: throw UniffiInternalError.unexpectedOptionalTag
+        }
+    }
+}
+
 #if swift(>=5.8)
 @_documentation(visibility: private)
 #endif
@@ -5348,6 +5410,9 @@ private let initializationResult: InitializationResult = {
     if (uniffi_truapi_server_checksum_method_nativechatcallbacks_list_rooms() != 21374) {
         return InitializationResult.apiChecksumMismatch
     }
+    if (uniffi_truapi_server_checksum_method_nativeproductexecution_device_encryption_key() != 18707) {
+        return InitializationResult.apiChecksumMismatch
+    }
     if (uniffi_truapi_server_checksum_method_nativeproductexecution_notify_chain_closed() != 59343) {
         return InitializationResult.apiChecksumMismatch
     }
@@ -5372,6 +5437,9 @@ private let initializationResult: InitializationResult = {
     if (uniffi_truapi_server_checksum_method_nativeproductexecution_render_custom_message() != 17716) {
         return InitializationResult.apiChecksumMismatch
     }
+    if (uniffi_truapi_server_checksum_method_nativeproductexecution_session_chat_identity_key() != 3903) {
+        return InitializationResult.apiChecksumMismatch
+    }
     if (uniffi_truapi_server_checksum_method_nativeproductexecution_set_permission_authorization_status() != 14164) {
         return InitializationResult.apiChecksumMismatch
     }

ios/truapi-host/Sources/truapi_serverFFI/include/truapi_serverFFI.h

@@ -641,6 +641,11 @@ uint64_t uniffi_truapi_server_fn_clone_nativeproductexecution(uint64_t handle, R
 void uniffi_truapi_server_fn_free_nativeproductexecution(uint64_t handle, RustCallStatus *_Nonnull out_status
 );
 #endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_FN_METHOD_NATIVEPRODUCTEXECUTION_DEVICE_ENCRYPTION_KEY
+#define UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_FN_METHOD_NATIVEPRODUCTEXECUTION_DEVICE_ENCRYPTION_KEY
+RustBuffer uniffi_truapi_server_fn_method_nativeproductexecution_device_encryption_key(uint64_t ptr, RustCallStatus *_Nonnull out_status
+);
+#endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_FN_METHOD_NATIVEPRODUCTEXECUTION_NOTIFY_CHAIN_CLOSED
 #define UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_FN_METHOD_NATIVEPRODUCTEXECUTION_NOTIFY_CHAIN_CLOSED
 void uniffi_truapi_server_fn_method_nativeproductexecution_notify_chain_closed(uint64_t ptr, uint32_t connection_id, RustCallStatus *_Nonnull out_status
@@ -681,6 +686,11 @@ void uniffi_truapi_server_fn_method_nativeproductexecution_publish_chat_action(u
 uint64_t uniffi_truapi_server_fn_method_nativeproductexecution_render_custom_message(uint64_t ptr, RustBuffer message_id, RustBuffer message_type, RustBuffer payload, uint64_t observer, RustCallStatus *_Nonnull out_status
 );
 #endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_FN_METHOD_NATIVEPRODUCTEXECUTION_SESSION_CHAT_IDENTITY_KEY
+#define UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_FN_METHOD_NATIVEPRODUCTEXECUTION_SESSION_CHAT_IDENTITY_KEY
+RustBuffer uniffi_truapi_server_fn_method_nativeproductexecution_session_chat_identity_key(uint64_t ptr, RustCallStatus *_Nonnull out_status
+);
+#endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_FN_METHOD_NATIVEPRODUCTEXECUTION_SET_PERMISSION_AUTHORIZATION_STATUS
 #define UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_FN_METHOD_NATIVEPRODUCTEXECUTION_SET_PERMISSION_AUTHORIZATION_STATUS
 void uniffi_truapi_server_fn_method_nativeproductexecution_set_permission_authorization_status(uint64_t ptr, RustBuffer request, RustBuffer status, RustCallStatus *_Nonnull out_status
@@ -1281,6 +1291,12 @@ uint16_t uniffi_truapi_server_checksum_method_nativechatcallbacks_post_custom_me
 #define UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_CHECKSUM_METHOD_NATIVECHATCALLBACKS_LIST_ROOMS
 uint16_t uniffi_truapi_server_checksum_method_nativechatcallbacks_list_rooms(void
 
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_CHECKSUM_METHOD_NATIVEPRODUCTEXECUTION_DEVICE_ENCRYPTION_KEY
+#define UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_CHECKSUM_METHOD_NATIVEPRODUCTEXECUTION_DEVICE_ENCRYPTION_KEY
+uint16_t uniffi_truapi_server_checksum_method_nativeproductexecution_device_encryption_key(void
+
 );
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_CHECKSUM_METHOD_NATIVEPRODUCTEXECUTION_NOTIFY_CHAIN_CLOSED
@@ -1329,6 +1345,12 @@ uint16_t uniffi_truapi_server_checksum_method_nativeproductexecution_publish_cha
 #define UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_CHECKSUM_METHOD_NATIVEPRODUCTEXECUTION_RENDER_CUSTOM_MESSAGE
 uint16_t uniffi_truapi_server_checksum_method_nativeproductexecution_render_custom_message(void
 
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_CHECKSUM_METHOD_NATIVEPRODUCTEXECUTION_SESSION_CHAT_IDENTITY_KEY
+#define UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_CHECKSUM_METHOD_NATIVEPRODUCTEXECUTION_SESSION_CHAT_IDENTITY_KEY
+uint16_t uniffi_truapi_server_checksum_method_nativeproductexecution_session_chat_identity_key(void
+
 );
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_TRUAPI_SERVER_CHECKSUM_METHOD_NATIVEPRODUCTEXECUTION_SET_PERMISSION_AUTHORIZATION_STATUS

js/packages/truapi-host/src/wasm-module.ts

@@ -21,6 +21,8 @@ export interface WorkerPairingHostRuntime extends PermissionAuthorizationRuntime
   disconnectSession(): Promise<void>;
   cancelPairing(): void;
   notifySessionStoreChanged(): void;
+  sessionChatIdentityKey(): Uint8Array | undefined;
+  deviceEncryptionKey(): Promise<Uint8Array>;
   free(): void;
 }