Transport V2: cut over SDKs, proxy, and Maple

[AnthonyRonning]

Summary

• cuts the TypeScript and Rust OpenSecret SDKs to Transport V2 whole-request envelopes with attested session binding, response binding, and unordered replay protection
• keeps authority scoped to anonymous, user, platform, and API-key sessions; credentials move inside the encrypted boundary and steady-state clients persist only opaque authentication bundles
• adds stable client-held cache roots for Tinfoil namespaces without exposing them to Maple infrastructure
• persists proxy cache roots locally with owner-only atomic storage, redacted configuration, and a 0.4.0 source-compatible boundary
• integrates Transport V2 across Maple web, desktop, Agent, proxy, login, refresh, logout, and OAuth flows
• adds a signed browser-to-native handoff that binds the verified browser identity to the exact retained attested native session
• retains a narrowly isolated lazy @opensecret/react-v1 bridge only for already-released unversioned desktop OAuth continuations
• retires exhausted sessions for the next request without retrying any potentially dispatched request

This PR is the cutover layer above #872 in GitHub stack #874. Existing published clients remain on /v1; the new SDK major is V2-only and does not fall back. The matching OpenSecret server change is OpenSecretCloud/opensecret#337 at 6df5f92f8ba6909b6c8051e9b6b4c80bce4d6b6b.

Native OAuth handoff

The native process creates and retains a credential-free attested v2 session plus a fresh attempt secret. The hosted HTTPS URL carries the public native session ID in its query and the attempt only in the fragment. Hosted trusted code removes the fragment after storing it for the flow.

After browser authentication, the hosted SDK mints a five-minute backend-signed grant. The return custom-scheme URL contains only that grant, the public native session ID for stale-callback correlation, and a safe internal destination. It does not contain the raw attempt, an auth bundle, access or resumption descriptors, or the client cache root.

Tauri rejects a mismatched public session before consuming pending state, then supplies the locally retained raw attempt inside the encrypted redemption request on the exact original anonymous session. On success the Rust SDK transitions that same session into the bound user authority and exports an origin-bound opaque auth bundle over local IPC. Duplicate exact callbacks reuse only the completed local result; ambiguous send or response loss retires the attempt and requires restart.

The raw attempt is hidden from the forwarding HTTP path but remains visible to trusted same-origin hosted JavaScript. That trusted hosted code boundary is explicit.

Security properties

• no outer user JWT, platform JWT, or API key on V2 requests
• credential, operation, method/path/query/body, request identity, and response session are authenticated inside the envelope
• unordered per-session request IDs reject duplicates without assuming arrival order
• principal and generation compare-and-swap fences prevent stale login, refresh, logout, OAuth, or bundle-import operations from crossing account generations
• no transparent resend after a request may have reached the enclave
• fresh login is required when moving from V1 client state to V2
• the native handoff grant exposes only a commitment to the native attempt, preventing a return-channel observer from minting a replacement account grant

Validation

• backend full gate: 645 tests passed, 38 ignored; strict Clippy and format passed
• frontend full suite: 817 tests passed; typecheck, build, and formatting passed
• focused JavaScript and TypeScript native-handoff suites: 25 passed
• focused Tauri native OAuth tests: 3 passed
• Rust SDK: full library suite, strict Clippy, rustdoc, and package validation passed
• Maple commit gate: 403 desktop library tests plus 3 binary tests passed; 2 model or subprocess cases ignored
• dependency provenance confirms exactly one in-tree OpenSecret SDK and proxy crate
• SDK integration is pinned to the exact backend commit above
• independent backend contract and Maple client security reviews found no remaining material P0-P2 issue
• git diff --check

Review and rollout boundaries

• no packages are published by this PR
• no backend, proxy, or Maple deployment is performed by this PR
• no live hosted auth or OAuth integration was run because it requires an updated backend deployment and production provider credentials
• OS custom-scheme delivery and distributed multi-origin affinity remain integration or rollout proofs
• Windows credential-path compilation remains CI-only; macOS local persistence paths were exercised locally
• OpenSecret ingress must accept the V2 encrypted request cap, preserve application/octet-stream, and avoid full request or response buffering before deployment

[cloudflare-workers-and-pages]

Deploying maple with    Cloudflare Pages

Latest commit:	ca2b329
Status:	✅  Deploy successful!
Preview URL:	https://ce703cff.maple-ca8.pages.dev
Branch Preview URL:	https://codex-session-v2-cutover.maple-ca8.pages.dev

View logs