Device assurance can't be verified server-side (the OS gives only age
bounds, no signed attestation), so it's persisted client-side only. Bind
each cached grant to the region it was captured in so a TX grant can't
unlock another region.
- Add AgeAssuranceDeviceSignals (signals + originRegion); store the
region-tagged record in the persisted cache instead of the raw response
- getAssuredAgeFromDeviceSignals now requires the current region to match
the capture region
- Gate the native age request to native platforms (web returns a
misleading default); web/new-device/declined falls back to KWS
- TX allows ['device', 'kws'] so the fallback path is real
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Eric Bailey
85f6031708