feat(storage): add the encrypted vault, PIN keys, lockout, session and migrations

Records are one ByteArray each: a readable TLV header plus an
encrypt-then-MAC box whose aad binds the entry ID and the header. The
device key seals unlocked entries and pending items; a random master key,
wrapped under a PBKDF2 PIN key, seals locked ones. Wrong PINs are counted
before the check, with delays on the trusted clock and an uptime fallback.
Bytes.toUtf8 validates UTF-8 first, because the native conversion crashes
on invalid input.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 35 insertions, 0 deletions

diff --git a/source/storage/VaultError.mc b/source/storage/VaultError.mc
new file mode 100644
index 0000000..7320ce4
--- /dev/null
+++ b/source/storage/VaultError.mc
@@ -0,0 +1,35 @@
+// Author:  cirakg & claude ai
+// Summary: The one exception type the storage layer throws, with a code the UI turns into a message.
+
+import Toybox.Lang;
+
+class VaultError extends Lang.Exception {
+
+    // The session is locked and the operation needs the master key.
+    static const LOCKED = 1;
+    // A record or the PIN wrap failed to decode or verify.
+    static const DAMAGED = 2;
+    // Application.Storage refused a write (store full).
+    static const FULL = 3;
+    // The entry cap is reached, or one record would be too big.
+    static const LIMIT = 4;
+    // No entry with that ID.
+    static const NOT_FOUND = 5;
+    // The data was written by a newer app version; nothing may be changed.
+    static const NEWER_SCHEMA = 6;
+    // The entry failed validation (see Entry.validate()).
+    static const INVALID = 7;
+    // A wrong-PIN delay is running; try again later.
+    static const LOCKED_OUT = 8;
+    // The operation needs a PIN and none is set, or a PIN is already set.
+    static const NO_PIN = 9;
+    static const PIN_EXISTS = 10;
+
+    var code as Number;
+
+    function initialize(errorCode as Number, message as String) {
+        Exception.initialize();
+        code = errorCode;
+        mMessage = message;
+    }
+}