release(v4.3.0): browser persistence via @shade/storage-indexeddb

Ship an official IndexedDB-backed StorageProvider so browser-based Shade
consumers persist identity, prekeys, sessions, retired identities,
peer-verification state and stream-resume rows across tab refresh and
browser restart. Closes the gap that forced browser apps onto
storage:"memory" (regenerated identity each load, orphaned device
records server-side).

- New package @shade/storage-indexeddb (4.3.0): full StorageProvider
  conformance, schema v1, idb-backed; bumpPeerIdentityVersion is wrapped
  in a single readwrite IDB transaction (atomic, vs SQLite's
  read-then-upsert race).
- @shade/sdk resolveStorage() accepts { type: 'indexeddb', dbName? } via
  dynamic import (lazy, optional dep — same pattern as
  @shade/storage-postgres). Named StorageSpec type now reused by
  ResolvedConfig.
- Tests: 16 new tests in shade-storage-indexeddb (StorageProvider
  surface + peer-verifications + full E2EE conversation surviving a
  simulated tab reload). Run on fake-indexeddb.
- Lockstep version bump 4.2.1 → 4.3.0 across all 25 packages.
- Publish scripts updated to include the new package.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/shade-storage-indexeddb/tests/peer-verifications.test.ts

@@ -0,0 +1,99 @@
+import 'fake-indexeddb/auto';
+import { describe, test, expect, beforeEach, afterEach } from 'bun:test';
+import { IndexedDBStorage } from '../src/index.js';
+
+function uniqueDbName(): string {
+  return `shade-test-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+}
+
+async function deleteDb(dbName: string): Promise<void> {
+  await new Promise<void>((resolve, reject) => {
+    const req = indexedDB.deleteDatabase(dbName);
+    req.onsuccess = () => resolve();
+    req.onerror = () => reject(req.error);
+    req.onblocked = () => resolve();
+  });
+}
+
+describe('IndexedDBStorage — peer_verifications (V3.3)', () => {
+  let dbName: string;
+  let storage: IndexedDBStorage;
+
+  beforeEach(async () => {
+    dbName = uniqueDbName();
+    storage = await IndexedDBStorage.create({ dbName });
+  });
+
+  afterEach(async () => {
+    await storage.close();
+    await deleteDb(dbName);
+  });
+
+  test('round trip: save → get → remove', async () => {
+    await storage.savePeerVerification({
+      peerAddress: 'bob',
+      fingerprint: '12345 67890 12345 67890 12345 67890 12345 67890 12345 67890 12345 67890',
+      verifiedAt: 1_700_000_000_000,
+      verifiedBy: 'user',
+      identityVersion: 1,
+    });
+
+    const v = await storage.getPeerVerification('bob');
+    expect(v).not.toBeNull();
+    expect(v!.peerAddress).toBe('bob');
+    expect(v!.verifiedBy).toBe('user');
+    expect(v!.identityVersion).toBe(1);
+
+    await storage.removePeerVerification('bob');
+    expect(await storage.getPeerVerification('bob')).toBeNull();
+  });
+
+  test('upsert overwrites on duplicate peer_address', async () => {
+    await storage.savePeerVerification({
+      peerAddress: 'bob',
+      fingerprint: 'fp-1',
+      verifiedAt: 1,
+      verifiedBy: 'user',
+      identityVersion: 1,
+    });
+    await storage.savePeerVerification({
+      peerAddress: 'bob',
+      fingerprint: 'fp-2',
+      verifiedAt: 2,
+      verifiedBy: 'transitive',
+      identityVersion: 2,
+    });
+
+    const v = await storage.getPeerVerification('bob');
+    expect(v!.fingerprint).toBe('fp-2');
+    expect(v!.verifiedBy).toBe('transitive');
+    expect(v!.identityVersion).toBe(2);
+  });
+
+  test('identity-version starts at 1 and increments via bump', async () => {
+    expect(await storage.getPeerIdentityVersion('alice')).toBe(1);
+    expect(await storage.bumpPeerIdentityVersion('alice')).toBe(2);
+    expect(await storage.bumpPeerIdentityVersion('alice')).toBe(3);
+    expect(await storage.getPeerIdentityVersion('alice')).toBe(3);
+    // Independent counter per peer
+    expect(await storage.getPeerIdentityVersion('bob')).toBe(1);
+  });
+
+  test('survives reopen', async () => {
+    await storage.savePeerVerification({
+      peerAddress: 'bob',
+      fingerprint: 'fp',
+      verifiedAt: 42,
+      verifiedBy: 'user',
+      identityVersion: 5,
+    });
+    await storage.bumpPeerIdentityVersion('bob');
+    await storage.close();
+
+    storage = await IndexedDBStorage.create({ dbName });
+    const v = await storage.getPeerVerification('bob');
+    expect(v!.fingerprint).toBe('fp');
+    expect(v!.identityVersion).toBe(5);
+    expect(await storage.getPeerIdentityVersion('bob')).toBe(2);
+  });
+});