feat(android): device key, bundle key and node identities held natively

Keystore-wrapped store, a Kotlin port of keyring.js and transcripts.js held
to the shared vectors, the same keys/device/secrets bridge as the desktop,
and a native confirmation before browser access is widened.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 40 insertions, 0 deletions

diff --git a/packages/meshbay-android/app/src/main/assets/bridge/meshbay-bridge.js b/packages/meshbay-android/app/src/main/assets/bridge/meshbay-bridge.js
index 350e087..c6e1f53 100644
--- a/packages/meshbay-android/app/src/main/assets/bridge/meshbay-bridge.js
+++ b/packages/meshbay-android/app/src/main/assets/bridge/meshbay-bridge.js
@@ -62,6 +62,46 @@
     fetch: (url, init) => call('hub:fetch', url, init),
 
     resolveStun: (urls) => call('ice:resolve-stun', urls),
+
+    // The device's hub key: generated, held and used natively. The page asks
+    // for a signature and never sees a key — it parses hostile input.
+    device: {
+      ensure: () => call('device:ensure'),
+      publicKey: () => call('device:public'),
+      sign: (username) => call('device:sign', username),
+      forget: () => call('device:forget'),
+    },
+
+    // The bundle key and the identity on every node, held natively: the page
+    // is told public keys and handed signatures and agreements. A signature is
+    // asked for by kind and fields, never by bytes.
+    keys: {
+      available: () => call('keys:available'),
+      deriveSession: (o) => call('keys:derive-session', o),
+      commitPending: (u) => call('keys:commit-pending', u),
+      dropPending: (u) => call('keys:drop-pending', u),
+      hasSession: (u) => call('keys:has-session', u),
+      forgetSession: (u) => call('keys:forget-session', u),
+      identity: (u, n) => call('keys:identity', u, n),
+      openBundle: (u, n, o) => call('keys:open-bundle', u, n, o),
+      mint: (u, n) => call('keys:mint', u, n),
+      sealBundle: (u, n, o) => call('keys:seal-bundle', u, n, o),
+      sealRecovery: (u, n, m, name) => call('keys:seal-recovery', u, n, m, name),
+      markSealed: (u, n, fp) => call('keys:mark-sealed', u, n, fp),
+      fingerprint: (u) => call('keys:fingerprint', u),
+      sign: (u, n, kind, fields) => call('keys:sign', u, n, kind, fields),
+      shared: (u, n, peer) => call('keys:shared', u, n, peer),
+      playlistKey: (u) => call('keys:playlist-key', u),
+      browserAccess: (u) => call('keys:browser-access', u),
+      setBrowserAccess: (u, on) => call('keys:set-browser-access', u, on),
+      createdHere: (u) => call('keys:created-here', u),
+    },
+
+    // Whether the OS protects what is stored. The store itself is not
+    // reachable from here.
+    secrets: {
+      backend: () => call('secrets:backend'),
+    },
   };
 
   const freeze = (o) => {