feat(storage): add the encrypted vault, PIN keys, lockout, session and migrations

Records are one ByteArray each: a readable TLV header plus an
encrypt-then-MAC box whose aad binds the entry ID and the header. The
device key seals unlocked entries and pending items; a random master key,
wrapped under a PBKDF2 PIN key, seals locked ones. Wrong PINs are counted
before the check, with delays on the trusted clock and an uptime fallback.
Bytes.toUtf8 validates UTF-8 first, because the native conversion crashes
on invalid input.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 27 insertions, 0 deletions

diff --git a/source/storage/TimeSource.mc b/source/storage/TimeSource.mc
new file mode 100644
index 0000000..426a56a
--- /dev/null
+++ b/source/storage/TimeSource.mc
@@ -0,0 +1,27 @@
+// Author:  cirakg & claude ai
+// Summary: The clocks the PIN lockout uses, behind a class so tests can inject a fake clock.
+//
+// Lockout delays use the trusted clock (GPS-synced, not user-adjustable) when
+// it is synced, and the system uptime timer otherwise (README 7.6). Tests
+// replace this class with one whose clocks they set by hand, which makes the
+// lockout schedule, restarts and clock loss testable.
+
+import Toybox.Lang;
+import Toybox.System;
+
+class TimeSource {
+
+    function initialize() {
+    }
+
+    // Trusted unix time in seconds, or null when the trusted clock isn't synced.
+    function trustedUnix() as Long? {
+        return Clock.trustedUnix();
+    }
+
+    // Milliseconds from the system timer. It restarts at zero when the watch
+    // restarts and wraps after about 24.8 days.
+    function uptimeMs() as Number {
+        return System.getTimer();
+    }
+}