@pasosdejesus/m 0.23.0 → 0.24.0

package/dist/test-utils/wallet-mocks.js

@@ -0,0 +1,114 @@
+/**
+ * Mocks to test the wallet core in Node (`m/REQ/14` Fase 4).
+ *
+ * The wallet core needs three browser-only surfaces to be testable outside a
+ * browser: `localStorage` (destinations), `crypto.subtle` (Node 20+ already has it
+ * as a global) and `WebAuthn` (`navigator.credentials`, `PublicKeyCredential`).
+ * `IndexedDB` is not emulated here: the core tests use `MemoryStorage`, and the
+ * `IndexedDBStorage` tests need the optional `fake-indexeddb` devDependency
+ * (`installIndexedDB`).
+ *
+ * "Y todo lo que hagáis, hacedlo de corazón, como para el Señor y no para los hombres" (Colosenses 3:23)
+ */
+import { toBase64 } from '../wallet/crypto.js';
+const RAW_ID = new Uint8Array([1, 2, 3, 4]);
+function defineGlobal(key, value) {
+    Object.defineProperty(globalThis, key, { value, configurable: true, writable: true });
+}
+/** Minimal in-memory `localStorage` (Node has none) and installs it on `globalThis`. */
+export function installLocalStorage() {
+    const store = new Map();
+    const storage = {
+        get length() {
+            return store.size;
+        },
+        clear: () => store.clear(),
+        getItem: (key) => (store.has(key) ? store.get(key) : null),
+        key: (index) => [...store.keys()][index] ?? null,
+        removeItem: (key) => {
+            store.delete(key);
+        },
+        setItem: (key, value) => {
+            store.set(key, String(value));
+        },
+    };
+    defineGlobal('localStorage', storage);
+    return storage;
+}
+/**
+ * Installs a fake IndexedDB from the optional `fake-indexeddb` devDependency.
+ * Throws a clear message when it is not installed so `IndexedDBStorage` tests are
+ * skipped instead of failing obscurely.
+ */
+export async function installIndexedDB() {
+    const specifier = 'fake-indexeddb/auto';
+    try {
+        await import(/* @vite-ignore */ specifier);
+    }
+    catch {
+        throw new Error('installIndexedDB requires the optional devDependency `fake-indexeddb` (pnpm add -D fake-indexeddb)');
+    }
+}
+/**
+ * Deterministic WebAuthn mock for `web-authn.ts`/`biometric.ts`: installs
+ * `globalThis.PublicKeyCredential` and `globalThis.navigator.credentials` so the
+ * L1/L2 layers can be exercised without hardware.
+ */
+export function mockWebAuthn(opts = {}) {
+    const prfSecret = opts.prfSecret ?? new Uint8Array(32).fill(7);
+    const credentialId = toBase64(RAW_ID);
+    const calls = { create: 0, get: 0 };
+    let cancelNext = opts.cancelNext ?? false;
+    const prfResult = () => prfSecret.buffer.slice(prfSecret.byteOffset, prfSecret.byteOffset + prfSecret.byteLength);
+    const credentials = {
+        create: async () => {
+            calls.create += 1;
+            return {
+                rawId: RAW_ID.buffer.slice(0),
+                getClientExtensionResults: () => ({ prf: { enabled: opts.prfSupported !== false } }),
+            };
+        },
+        get: async () => {
+            calls.get += 1;
+            if (cancelNext) {
+                cancelNext = false;
+                throw Object.assign(new Error('The operation either timed out or was not allowed.'), {
+                    name: 'NotAllowedError',
+                });
+            }
+            return {
+                rawId: RAW_ID.buffer.slice(0),
+                getClientExtensionResults: () => ({ prf: { results: { first: prfResult() } } }),
+            };
+        },
+    };
+    defineGlobal('PublicKeyCredential', {
+        isUserVerifyingPlatformAuthenticatorAvailable: async () => opts.userVerifying !== false,
+        getClientCapabilities: async () => ({
+            'extension:prf': opts.prfSupported !== false,
+        }),
+        signalUnknownCredential: async () => { },
+    });
+    defineGlobal('navigator', { credentials });
+    return {
+        credentialId,
+        calls,
+        reset() {
+            calls.create = 0;
+            calls.get = 0;
+            cancelNext = false;
+        },
+    };
+}
+/**
+ * One-call setup for wallet tests: installs `localStorage`, tries `fake-indexeddb`
+ * and installs a default WebAuthn mock. Returns the WebAuthn mock so a test can
+ * inspect or reset it. Used by the `wallet-setup` vitest file.
+ */
+export function setupWalletTests(options = {}) {
+    installLocalStorage();
+    if (options.indexedDB !== false)
+        void installIndexedDB().catch(() => undefined);
+    return mockWebAuthn(options);
+}
+//# sourceMappingURL=wallet-mocks.js.map

package/dist/test-utils/wallet-mocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-mocks.js","sourceRoot":"","sources":["../../src/test-utils/wallet-mocks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAE9C,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAE3C,SAAS,YAAY,CAAC,GAAW,EAAE,KAAc;IAC/C,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;AACvF,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;IACvC,MAAM,OAAO,GAAY;QACvB,IAAI,MAAM;YACR,OAAO,KAAK,CAAC,IAAI,CAAA;QACnB,CAAC;QACD,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;QAC1B,OAAO,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9E,GAAG,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI;QACxD,UAAU,EAAE,CAAC,GAAW,EAAE,EAAE;YAC1B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC;QACD,OAAO,EAAE,CAAC,GAAW,EAAE,KAAa,EAAE,EAAE;YACtC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QAC/B,CAAC;KACF,CAAA;IACD,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;IACrC,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,SAAS,GAAG,qBAAqB,CAAA;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAA;IACH,CAAC;AACH,CAAC;AAoBD;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAyB,EAAE;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC9D,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;IACrC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAA;IACnC,IAAI,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAA;IAEzC,MAAM,SAAS,GAAG,GAAgB,EAAE,CAClC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAgB,CAAA;IAE1G,MAAM,WAAW,GAAG;QAClB,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,KAAK,CAAC,MAAM,IAAI,CAAC,CAAA;YACjB,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC7B,yBAAyB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,KAAK,KAAK,EAAE,EAAE,CAAC;aACrF,CAAA;QACH,CAAC;QACD,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,KAAK,CAAC,GAAG,IAAI,CAAC,CAAA;YACd,IAAI,UAAU,EAAE,CAAC;gBACf,UAAU,GAAG,KAAK,CAAA;gBAClB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oDAAoD,CAAC,EAAE;oBACnF,IAAI,EAAE,iBAAiB;iBACxB,CAAC,CAAA;YACJ,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC7B,yBAAyB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC;aAChF,CAAA;QACH,CAAC;KACF,CAAA;IAED,YAAY,CAAC,qBAAqB,EAAE;QAClC,6CAA6C,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,KAAK;QACvF,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAClC,eAAe,EAAE,IAAI,CAAC,YAAY,KAAK,KAAK;SAC7C,CAAC;QACF,uBAAuB,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;KACxC,CAAC,CAAA;IACF,YAAY,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;IAE1C,OAAO;QACL,YAAY;QACZ,KAAK;QACL,KAAK;YACH,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;YAChB,KAAK,CAAC,GAAG,GAAG,CAAC,CAAA;YACb,UAAU,GAAG,KAAK,CAAA;QACpB,CAAC;KACF,CAAA;AACH,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkC,EAAE;IACnE,mBAAmB,EAAE,CAAA;IACrB,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK;QAAE,KAAK,gBAAgB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC/E,OAAO,YAAY,CAAC,OAAO,CAAC,CAAA;AAC9B,CAAC"}

package/dist/test-utils/wallet-mocks.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=wallet-mocks.test.d.ts.map

package/dist/test-utils/wallet-mocks.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-mocks.test.d.ts","sourceRoot":"","sources":["../../src/test-utils/wallet-mocks.test.ts"],"names":[],"mappings":""}

package/dist/test-utils/wallet-mocks.test.js

@@ -0,0 +1,55 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import { assertUserVerification, createPrfCredential, detectPlatformSupport, evaluatePrf, hasRecentUserVerification, } from '../wallet/web-authn.js';
+import { clearDestinations, isKnownDestination, rememberDestination, setDestinationsPrefix, } from '../wallet/destinations.js';
+import { installLocalStorage, mockWebAuthn } from './wallet-mocks.js';
+afterEach(() => {
+    clearDestinations();
+});
+describe('installLocalStorage', () => {
+    it('provides a working in-memory localStorage on globalThis', () => {
+        const storage = installLocalStorage();
+        storage.setItem('a', '1');
+        expect(globalThis.localStorage.getItem('a')).toBe('1');
+        expect(storage.length).toBe(1);
+        expect(storage.key(0)).toBe('a');
+        storage.removeItem('a');
+        expect(storage.getItem('a')).toBeNull();
+    });
+});
+describe('destinations with mocked localStorage', () => {
+    it('remembers and reports known destinations', () => {
+        installLocalStorage();
+        setDestinationsPrefix('test.destinations.');
+        const wallet = '0xABC';
+        const dest = '0xDeF';
+        expect(isKnownDestination(wallet, dest)).toBe(false);
+        rememberDestination(wallet, dest);
+        expect(isKnownDestination(wallet, dest)).toBe(true);
+        expect(globalThis.localStorage.getItem('test.destinations.0xabc')).toContain('0xdef');
+    });
+});
+describe('mockWebAuthn', () => {
+    it('reports platform support and creates a PRF credential', async () => {
+        const mock = mockWebAuthn();
+        const support = await detectPlatformSupport();
+        expect(support).toEqual({ webauthn: true, userVerifying: true, prf: true });
+        const credential = await createPrfCredential('alice');
+        expect(credential.prfEnabled).toBe(true);
+        expect(credential.credentialId).toBe(mock.credentialId);
+    });
+    it('evaluates the PRF and marks the user verified', async () => {
+        const secret = new Uint8Array(32).fill(9);
+        mockWebAuthn({ prfSecret: secret });
+        const result = await evaluatePrf('AQIDBA==', new Uint8Array(32));
+        expect(Array.from(result ?? [])).toEqual(Array.from(secret));
+        await assertUserVerification('AQIDBA==');
+        expect(hasRecentUserVerification()).toBe(true);
+    });
+    it('surfaces a cancellation as NotAllowedError', async () => {
+        mockWebAuthn({ cancelNext: true });
+        await expect(evaluatePrf('AQIDBA==', new Uint8Array(32))).rejects.toMatchObject({
+            name: 'NotAllowedError',
+        });
+    });
+});
+//# sourceMappingURL=wallet-mocks.test.js.map

package/dist/test-utils/wallet-mocks.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-mocks.test.js","sourceRoot":"","sources":["../../src/test-utils/wallet-mocks.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACxD,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,WAAW,EACX,yBAAyB,GAC1B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAErE,SAAS,CAAC,GAAG,EAAE;IACb,iBAAiB,EAAE,CAAA;AACrB,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAA;QACrC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACzB,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACtD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC9B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAChC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IACzC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,mBAAmB,EAAE,CAAA;QACrB,qBAAqB,CAAC,oBAAoB,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAA;QACtB,MAAM,IAAI,GAAG,OAAO,CAAA;QACpB,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpD,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACjC,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnD,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACvF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,IAAI,GAAG,YAAY,EAAE,CAAA;QAC3B,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAA;QAC7C,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;QAE3E,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAA;QACrD,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACzC,YAAY,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;QACnC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;QAChE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;QAE5D,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAA;QACxC,MAAM,CAAC,yBAAyB,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,YAAY,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;QAClC,MAAM,MAAM,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC9E,IAAI,EAAE,iBAAiB;SACxB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/test-utils/wallet-setup.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=wallet-setup.d.ts.map

package/dist/test-utils/wallet-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-setup.d.ts","sourceRoot":"","sources":["../../src/test-utils/wallet-setup.ts"],"names":[],"mappings":""}

package/dist/test-utils/wallet-setup.js

@@ -0,0 +1,23 @@
+/**
+ * Vitest setup file for wallet tests (`m/REQ/14` Fase 4).
+ *
+ * Use it as a `setupFiles` entry together with the jsdom environment so the wallet
+ * core tests can run outside a browser without reinventing the mocks:
+ *
+ * ```ts
+ * // vitest.config.ts
+ * export default {
+ *   test: {
+ *     environment: 'jsdom',
+ *     setupFiles: ['@pasosdejesus/m/test-utils/wallet-setup'],
+ *   },
+ * }
+ * ```
+ *
+ * It installs a `localStorage`, tries to load `fake-indexeddb` (optional devDependency)
+ * and installs a WebAuthn mock. For finer control, import `setupWalletTests` from
+ * `@pasosdejesus/m/test-utils` and pass options.
+ */
+import { setupWalletTests } from './wallet-mocks.js';
+setupWalletTests();
+//# sourceMappingURL=wallet-setup.js.map

package/dist/test-utils/wallet-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-setup.js","sourceRoot":"","sources":["../../src/test-utils/wallet-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpD,gBAAgB,EAAE,CAAA"}

package/dist/test-utils/wallet-setup.test.d.ts

@@ -0,0 +1,2 @@
+import './wallet-setup.js';
+//# sourceMappingURL=wallet-setup.test.d.ts.map

package/dist/test-utils/wallet-setup.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-setup.test.d.ts","sourceRoot":"","sources":["../../src/test-utils/wallet-setup.test.ts"],"names":[],"mappings":"AAGA,OAAO,mBAAmB,CAAA"}

package/dist/test-utils/wallet-setup.test.js

@@ -0,0 +1,18 @@
+// @vitest-environment jsdom
+import { describe, expect, it } from 'vitest';
+// Side effect: installs localStorage, fake-indexeddb and a WebAuthn mock.
+import './wallet-setup.js';
+import { createPrfCredential, detectPlatformSupport } from '../wallet/web-authn.js';
+describe('wallet-setup preset (jsdom)', () => {
+    it('provides a DOM, a localStorage and a WebAuthn mock', async () => {
+        expect(typeof document).toBe('object');
+        expect(document.createElement('div')).toBeTruthy();
+        globalThis.localStorage.setItem('k', 'v');
+        expect(globalThis.localStorage.getItem('k')).toBe('v');
+        const support = await detectPlatformSupport();
+        expect(support).toEqual({ webauthn: true, userVerifying: true, prf: true });
+        const credential = await createPrfCredential('alice');
+        expect(credential.prfEnabled).toBe(true);
+    });
+});
+//# sourceMappingURL=wallet-setup.test.js.map

package/dist/test-utils/wallet-setup.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-setup.test.js","sourceRoot":"","sources":["../../src/test-utils/wallet-setup.test.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,0EAA0E;AAC1E,OAAO,mBAAmB,CAAA;AAC1B,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAEnF,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,CAAC,OAAO,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACtC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,CAAA;QAElD,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACzC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAEtD,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAA;QAC7C,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;QAE3E,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAA;QACrD,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/wallet/biometric.d.ts

@@ -0,0 +1,33 @@
+export declare const PRF_SALT_BYTES = 32;
+export declare const HKDF_SALT_BYTES = 16;
+/** Stored (non-secret) material needed to re-derive the wrapping key. */
+export interface BiometricRecord {
+    v: 1;
+    address: string;
+    credentialId: string;
+    prfSalt: string;
+    hkdfSalt: string;
+    iv: string;
+    data: string;
+    createdAt: number;
+}
+export declare function readBiometricRecord(): Promise<BiometricRecord | null>;
+export declare function writeBiometricRecord(record: BiometricRecord): Promise<void>;
+export declare function deleteBiometricRecord(): Promise<void>;
+/**
+ * Drops the sealed copy **and** tells the authenticator the passkey is gone
+ * (R-#246 §14 item 1). Used when the user turns the gesture off or deletes the
+ * wallet: before this, the orphan passkey stayed in the OS list.
+ */
+export declare function forgetBiometricCredential(): Promise<void>;
+/** Encrypts `privateKey` with the key derived from the PRF secret of `prfSalt`. */
+export declare function sealWithPrfSecret(prfSecret: Uint8Array, prfSalt: Uint8Array, privateKey: `0x${string}`, { address, credentialId }: {
+    address: string;
+    credentialId: string;
+}): Promise<BiometricRecord>;
+/** Decrypts the sealed key with the PRF secret. Throws `auth-failed` on failure. */
+export declare function unsealWithPrfSecret(prfSecret: Uint8Array, record: BiometricRecord): Promise<`0x${string}`>;
+export declare function wipePrfSecret(secret: Uint8Array | null | undefined): void;
+/** Fresh salt for a `prf.eval` call; stored next to the sealed record. */
+export declare function newPrfSalt(): Uint8Array;
+//# sourceMappingURL=biometric.d.ts.map

package/dist/wallet/biometric.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"biometric.d.ts","sourceRoot":"","sources":["../../src/wallet/biometric.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,cAAc,KAAK,CAAA;AAChC,eAAO,MAAM,eAAe,KAAK,CAAA;AAEjC,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC9B,CAAC,EAAE,CAAC,CAAA;IACJ,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB;AAgBD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAK3E;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjF;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAE3D;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAI/D;AAED,mFAAmF;AACnF,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,KAAK,MAAM,EAAE,EACzB,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACnE,OAAO,CAAC,eAAe,CAAC,CAmB1B;AAED,oFAAoF;AACpF,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,UAAU,EACrB,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAYxB;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAEzE;AAED,0EAA0E;AAC1E,wBAAgB,UAAU,IAAI,UAAU,CAEvC"}

package/dist/wallet/biometric.js

@@ -0,0 +1,88 @@
+/**
+ * Layer L2 of https://github.com/pasosdeJesus/learn.tg/issues/246: the wallet key
+ * sealed with the WebAuthn **PRF** secret.
+ *
+ * The private key is never written in plaintext. The stored record only holds the
+ * ciphertext plus the (non-secret) salts and the credential id; the key that opens
+ * it can only be produced by the authenticator, after the user verifies (Face ID /
+ * fingerprint / device password). The password-encrypted record of `wallet.ts` is untouched
+ * and remains the recovery path.
+ */
+import { fromBase64, toBase64, wipe } from './crypto.js';
+import { runInDb, STORE_BIOMETRIC } from './storage/idb.js';
+import { deriveWrappingKey, signalUnknownCredential, toArrayBuffer } from './web-authn.js';
+const KEY = 'current';
+const IV_BYTES = 12;
+export const PRF_SALT_BYTES = 32;
+export const HKDF_SALT_BYTES = 16;
+async function subtle() {
+    const c = globalThis.crypto?.subtle;
+    if (!c)
+        throw new Error('Web Crypto (crypto.subtle) is not available');
+    return c;
+}
+function randomBytes(length) {
+    const c = globalThis.crypto;
+    if (!c?.getRandomValues)
+        throw new Error('crypto.getRandomValues is not available');
+    const bytes = new Uint8Array(length);
+    c.getRandomValues(bytes);
+    return bytes;
+}
+export async function readBiometricRecord() {
+    const value = await runInDb(STORE_BIOMETRIC, 'readonly', (store) => store.get(KEY));
+    return value ?? null;
+}
+export async function writeBiometricRecord(record) {
+    await runInDb(STORE_BIOMETRIC, 'readwrite', (store) => store.put(record, KEY));
+}
+export async function deleteBiometricRecord() {
+    await runInDb(STORE_BIOMETRIC, 'readwrite', (store) => store.delete(KEY));
+}
+/**
+ * Drops the sealed copy **and** tells the authenticator the passkey is gone
+ * (R-#246 §14 item 1). Used when the user turns the gesture off or deletes the
+ * wallet: before this, the orphan passkey stayed in the OS list.
+ */
+export async function forgetBiometricCredential() {
+    const record = await readBiometricRecord().catch(() => null);
+    if (record?.credentialId)
+        await signalUnknownCredential(record.credentialId);
+    await deleteBiometricRecord().catch(() => undefined);
+}
+/** Encrypts `privateKey` with the key derived from the PRF secret of `prfSalt`. */
+export async function sealWithPrfSecret(prfSecret, prfSalt, privateKey, { address, credentialId }) {
+    const hkdfSalt = randomBytes(HKDF_SALT_BYTES);
+    const iv = randomBytes(IV_BYTES);
+    const key = await deriveWrappingKey(prfSecret, hkdfSalt);
+    const data = await (await subtle()).encrypt({ name: 'AES-GCM', iv: toArrayBuffer(iv) }, key, toArrayBuffer(new TextEncoder().encode(privateKey)));
+    return {
+        v: 1,
+        address,
+        credentialId,
+        prfSalt: toBase64(prfSalt),
+        hkdfSalt: toBase64(hkdfSalt),
+        iv: toBase64(iv),
+        data: toBase64(new Uint8Array(data)),
+        createdAt: Date.now(),
+    };
+}
+/** Decrypts the sealed key with the PRF secret. Throws `auth-failed` on failure. */
+export async function unsealWithPrfSecret(prfSecret, record) {
+    const key = await deriveWrappingKey(prfSecret, fromBase64(record.hkdfSalt));
+    try {
+        const plain = await (await subtle()).decrypt({ name: 'AES-GCM', iv: toArrayBuffer(fromBase64(record.iv)) }, key, toArrayBuffer(fromBase64(record.data)));
+        return new TextDecoder().decode(plain);
+    }
+    catch {
+        throw new Error('auth-failed');
+    }
+}
+export function wipePrfSecret(secret) {
+    wipe(secret);
+}
+/** Fresh salt for a `prf.eval` call; stored next to the sealed record. */
+export function newPrfSalt() {
+    return randomBytes(PRF_SALT_BYTES);
+}
+//# sourceMappingURL=biometric.js.map

package/dist/wallet/biometric.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"biometric.js","sourceRoot":"","sources":["../../src/wallet/biometric.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AACxD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAE1F,MAAM,GAAG,GAAG,SAAS,CAAA;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAA;AACnB,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAA;AAChC,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAA;AAcjC,KAAK,UAAU,MAAM;IACnB,MAAM,CAAC,GAAI,UAAkC,CAAC,MAAM,EAAE,MAAM,CAAA;IAC5D,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IACtE,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,CAAC,GAAI,UAAkC,CAAC,MAAM,CAAA;IACpD,IAAI,CAAC,CAAC,EAAE,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IACnF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IACpC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IACxB,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,KAAK,GAAG,MAAM,OAAO,CAA8B,eAAe,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAC9F,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CACf,CAAA;IACD,OAAO,KAAK,IAAI,IAAI,CAAA;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAuB;IAChE,MAAM,OAAO,CAAc,eAAe,EAAE,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;AAC7F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,OAAO,CAAY,eAAe,EAAE,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;AACtF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,MAAM,MAAM,GAAG,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC5D,IAAI,MAAM,EAAE,YAAY;QAAE,MAAM,uBAAuB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IAC5E,MAAM,qBAAqB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;AACtD,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAqB,EACrB,OAAmB,EACnB,UAAyB,EACzB,EAAE,OAAO,EAAE,YAAY,EAA6C;IAEpE,MAAM,QAAQ,GAAG,WAAW,CAAC,eAAe,CAAC,CAAA;IAC7C,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;IAChC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,OAAO,CACzC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC,EAAE,EAC1C,GAAG,EACH,aAAa,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CACpD,CAAA;IACD,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,OAAO;QACP,YAAY;QACZ,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC;QAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC;QAC5B,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;QAChB,IAAI,EAAE,QAAQ,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAA;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAqB,EACrB,MAAuB;IAEvB,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC3E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,OAAO,CAC1C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,EAC7D,GAAG,EACH,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CACvC,CAAA;QACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAkB,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAqC;IACjE,IAAI,CAAC,MAAM,CAAC,CAAA;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,UAAU;IACxB,OAAO,WAAW,CAAC,cAAc,CAAC,CAAA;AACpC,CAAC"}

package/dist/wallet/biometric.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=biometric.test.d.ts.map

package/dist/wallet/biometric.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"biometric.test.d.ts","sourceRoot":"","sources":["../../src/wallet/biometric.test.ts"],"names":[],"mappings":""}

package/dist/wallet/biometric.test.js

@@ -0,0 +1,44 @@
+import { beforeAll, beforeEach, describe, expect, it } from 'vitest';
+import { installIndexedDB, mockWebAuthn } from '../test-utils/wallet-mocks.js';
+import { MemoryStorage } from './storage/memory.js';
+import { createWallet, deleteWallet, hasBiometricUnlock, lockWallet, unlockWithBiometric, enableBiometricUnlock, disableBiometricUnlock, } from './wallet.js';
+import { deleteBiometricRecord, readBiometricRecord } from './biometric.js';
+const password = '12345678';
+beforeAll(async () => {
+    await installIndexedDB();
+});
+describe('biometric unlock (L2) with mocked WebAuthn', () => {
+    let storage;
+    beforeEach(async () => {
+        storage = new MemoryStorage();
+        await lockWallet();
+        await deleteBiometricRecord().catch(() => undefined);
+        mockWebAuthn();
+    });
+    it('seals the key with the PRF secret and re-opens it with one gesture', async () => {
+        const { walletInfo } = await createWallet({ password, storage });
+        const { address } = await enableBiometricUnlock(password, storage);
+        expect(address).toBe(walletInfo.address);
+        expect(await hasBiometricUnlock(storage)).toBe(true);
+        const sealed = await readBiometricRecord();
+        expect(sealed?.address).toBe(walletInfo.address);
+        // El secreto no queda en claro en el registro.
+        expect(JSON.stringify(sealed)).not.toContain('privateKey');
+        await lockWallet();
+        const unlocked = await unlockWithBiometric(storage);
+        expect(unlocked.address).toBe(walletInfo.address);
+    });
+    it('forgets the sealed copy when the biometric unlock is disabled', async () => {
+        await createWallet({ password, storage });
+        await enableBiometricUnlock(password, storage);
+        await disableBiometricUnlock();
+        expect(await hasBiometricUnlock(storage)).toBe(false);
+    });
+    it('cleans the sealed copy when the wallet is deleted', async () => {
+        await createWallet({ password, storage });
+        await enableBiometricUnlock(password, storage);
+        await deleteWallet(storage);
+        expect(await readBiometricRecord().catch(() => null)).toBeNull();
+    });
+});
+//# sourceMappingURL=biometric.test.js.map

package/dist/wallet/biometric.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"biometric.test.js","sourceRoot":"","sources":["../../src/wallet/biometric.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,UAAU,EACV,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAE3E,MAAM,QAAQ,GAAG,UAAU,CAAA;AAE3B,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,gBAAgB,EAAE,CAAA;AAC1B,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,IAAI,OAAsB,CAAA;IAE1B,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,IAAI,aAAa,EAAE,CAAA;QAC7B,MAAM,UAAU,EAAE,CAAA;QAClB,MAAM,qBAAqB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACpD,YAAY,EAAE,CAAA;IAChB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,YAAY,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;QAEhE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAClE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QACxC,MAAM,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEpD,MAAM,MAAM,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC1C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAChD,+CAA+C;QAC/C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;QAE1D,MAAM,UAAU,EAAE,CAAA;QAClB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAA;QACnD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,YAAY,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;QACzC,MAAM,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC9C,MAAM,sBAAsB,EAAE,CAAA;QAC9B,MAAM,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,YAAY,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;QACzC,MAAM,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC9C,MAAM,YAAY,CAAC,OAAO,CAAC,CAAA;QAC3B,MAAM,CAAC,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IAClE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/wallet/crypto.d.ts

@@ -0,0 +1,42 @@
+/** Default work factor (R-#251). */
+export declare const KDF_ITERATIONS = 600000;
+/** Never below the historical value: an old record must not get weaker. */
+export declare const KDF_ITERATIONS_FLOOR = 600000;
+/** Ceiling so a slow phone cannot hang when calibrating (R-#251). */
+export declare const KDF_ITERATIONS_CEILING = 5000000;
+/** Target cost of one derivation on the device (R-#251). */
+export declare const KDF_BUDGET_MS = 400;
+/**
+ * Accepted secret (R-#251): NFKD + trim, so a leading/trailing space or a composed
+ * accent does not lock the user out of their own wallet. Idempotent.
+ */
+export declare function normalizePassword(password: string): string;
+export declare function toBase64(bytes: Uint8Array): string;
+export declare function fromBase64(value: string): Uint8Array;
+export interface EncryptedSecret {
+    kdf: {
+        name: 'PBKDF2';
+        hash: 'SHA-256';
+        iterations: number;
+        salt: string;
+    };
+    cipher: {
+        name: 'AES-GCM';
+        iv: string;
+        data: string;
+    };
+}
+export declare function encryptSecret(plaintext: string, password: string, iterations?: number): Promise<EncryptedSecret>;
+/**
+ * Picks the PBKDF2 work factor for this device (R-#251): measures the floor and
+ * scales it to `budgetMs`, clamped to [floor, ceiling]. The count lives in the
+ * record, so a device that chose 2 M and another that chose 600 k keep working.
+ *
+ * `measure` is injectable so tests do not depend on the machine's speed.
+ */
+export declare function calibrateIterations(measure?: (iterations: number) => Promise<number>, budgetMs?: number): Promise<number>;
+export declare function decryptSecret(secret: EncryptedSecret, password: string): Promise<string>;
+export declare function wipe(bytes: Uint8Array | null | undefined): void;
+/** SHA-256 over bytes. Used by the BIP39 checksum of `isValidMnemonic`. */
+export declare function sha256(bytes: Uint8Array): Promise<Uint8Array>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/wallet/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/wallet/crypto.ts"],"names":[],"mappings":"AAIA,oCAAoC;AACpC,eAAO,MAAM,cAAc,SAAoB,CAAA;AAC/C,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB,SAAoB,CAAA;AACrD,qEAAqE;AACrE,eAAO,MAAM,sBAAsB,UAAY,CAAA;AAC/C,4DAA4D;AAC5D,eAAO,MAAM,aAAa,MAAM,CAAA;AAEhC;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1D;AAsBD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIlD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAKpD;AAwBD,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,IAAI,EAAE,SAAS,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1E,MAAM,EAAE;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACtD;AAED,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,UAAU,GAAE,MAA0B,GACrC,OAAO,CAAC,eAAe,CAAC,CAe1B;AAUD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,GAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAqB,EACpE,QAAQ,GAAE,MAAsB,GAC/B,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAsB9F;AAED,wBAAgB,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAE/D;AAED,2EAA2E;AAC3E,wBAAsB,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAGnE"}

package/dist/wallet/crypto.js

@@ -0,0 +1,127 @@
+const PBKDF2_ITERATIONS = 600_000;
+const SALT_BYTES = 16;
+const IV_BYTES = 12;
+/** Default work factor (R-#251). */
+export const KDF_ITERATIONS = PBKDF2_ITERATIONS;
+/** Never below the historical value: an old record must not get weaker. */
+export const KDF_ITERATIONS_FLOOR = PBKDF2_ITERATIONS;
+/** Ceiling so a slow phone cannot hang when calibrating (R-#251). */
+export const KDF_ITERATIONS_CEILING = 5_000_000;
+/** Target cost of one derivation on the device (R-#251). */
+export const KDF_BUDGET_MS = 400;
+/**
+ * Accepted secret (R-#251): NFKD + trim, so a leading/trailing space or a composed
+ * accent does not lock the user out of their own wallet. Idempotent.
+ */
+export function normalizePassword(password) {
+    return typeof password === 'string' ? password.normalize('NFKD').trim() : '';
+}
+function subtle() {
+    const c = globalThis.crypto;
+    if (!c?.subtle) {
+        throw new Error('Web Crypto (crypto.subtle) is not available; Node 18+ or a secure browser context is required');
+    }
+    return c.subtle;
+}
+function randomBytes(length) {
+    const c = globalThis.crypto;
+    if (!c?.getRandomValues) {
+        throw new Error('crypto.getRandomValues is not available');
+    }
+    const bytes = new Uint8Array(length);
+    c.getRandomValues(bytes);
+    return bytes;
+}
+export function toBase64(bytes) {
+    let binary = '';
+    for (const b of bytes)
+        binary += String.fromCharCode(b);
+    return btoa(binary);
+}
+export function fromBase64(value) {
+    const binary = atob(value);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return bytes;
+}
+async function deriveKey(password, salt, iterations) {
+    const material = await subtle().importKey('raw', new TextEncoder().encode(password), 'PBKDF2', false, ['deriveKey']);
+    return subtle().deriveKey({
+        name: 'PBKDF2',
+        salt: salt,
+        iterations,
+        hash: 'SHA-256',
+    }, material, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+}
+export async function encryptSecret(plaintext, password, iterations = PBKDF2_ITERATIONS) {
+    const salt = randomBytes(SALT_BYTES);
+    const iv = randomBytes(IV_BYTES);
+    const count = Number.isFinite(iterations) && iterations > 0 ? Math.floor(iterations) : PBKDF2_ITERATIONS;
+    const key = await deriveKey(normalizePassword(password), salt, count);
+    const data = await subtle().encrypt({ name: 'AES-GCM', iv: iv }, key, new TextEncoder().encode(plaintext));
+    return {
+        kdf: { name: 'PBKDF2', hash: 'SHA-256', iterations: count, salt: toBase64(salt) },
+        cipher: { name: 'AES-GCM', iv: toBase64(iv), data: toBase64(new Uint8Array(data)) },
+    };
+}
+/** One derivation with a throwaway salt, used to measure the device cost. */
+async function measureDerivation(iterations) {
+    const salt = randomBytes(SALT_BYTES);
+    const started = Date.now();
+    await deriveKey('calibration-only', salt, iterations);
+    return Date.now() - started;
+}
+/**
+ * Picks the PBKDF2 work factor for this device (R-#251): measures the floor and
+ * scales it to `budgetMs`, clamped to [floor, ceiling]. The count lives in the
+ * record, so a device that chose 2 M and another that chose 600 k keep working.
+ *
+ * `measure` is injectable so tests do not depend on the machine's speed.
+ */
+export async function calibrateIterations(measure = measureDerivation, budgetMs = KDF_BUDGET_MS) {
+    let floorMs = 0;
+    try {
+        floorMs = await measure(KDF_ITERATIONS_FLOOR);
+    }
+    catch {
+        return KDF_ITERATIONS_FLOOR;
+    }
+    if (!Number.isFinite(floorMs) || floorMs <= 0)
+        return KDF_ITERATIONS_FLOOR;
+    const projected = Math.floor((KDF_ITERATIONS_FLOOR * budgetMs) / floorMs);
+    if (!Number.isFinite(projected) || projected < KDF_ITERATIONS_FLOOR) {
+        return KDF_ITERATIONS_FLOOR;
+    }
+    return Math.min(KDF_ITERATIONS_CEILING, projected);
+}
+export async function decryptSecret(secret, password) {
+    const salt = fromBase64(secret.kdf.salt);
+    const iv = fromBase64(secret.cipher.iv);
+    // R-#251: primero con la clave normalizada (NFKD + trim) y, si el registro se
+    // cifró con la clave tal cual la escribió el usuario, con esa misma. Así una clave
+    // con un espacio o un acento compuesto sigue abriendo la billetera.
+    const normalized = normalizePassword(password);
+    const candidates = normalized === password ? [password] : [normalized, password];
+    for (const candidate of candidates) {
+        const key = await deriveKey(candidate, salt, secret.kdf.iterations);
+        try {
+            const plain = await subtle().decrypt({ name: 'AES-GCM', iv: iv }, key, fromBase64(secret.cipher.data));
+            return new TextDecoder().decode(plain);
+        }
+        catch {
+            // se prueba la siguiente variante
+        }
+    }
+    throw new Error('Wrong password or corrupted wallet data');
+}
+export function wipe(bytes) {
+    if (bytes)
+        bytes.fill(0);
+}
+/** SHA-256 over bytes. Used by the BIP39 checksum of `isValidMnemonic`. */
+export async function sha256(bytes) {
+    const digest = await subtle().digest('SHA-256', bytes);
+    return new Uint8Array(digest);
+}
+//# sourceMappingURL=crypto.js.map

package/dist/wallet/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/wallet/crypto.ts"],"names":[],"mappings":"AAAA,MAAM,iBAAiB,GAAG,OAAO,CAAA;AACjC,MAAM,UAAU,GAAG,EAAE,CAAA;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAA;AAEnB,oCAAoC;AACpC,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAA;AAC/C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAA;AACrD,qEAAqE;AACrE,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAA;AAC/C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAA;AAEhC;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AAC9E,CAAC;AAED,SAAS,MAAM;IACb,MAAM,CAAC,GAAI,UAAkC,CAAC,MAAM,CAAA;IACpD,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAA;IACH,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAA;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,CAAC,GAAI,UAAkC,CAAC,MAAM,CAAA;IACpD,IAAI,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IACpC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IACxB,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAiB;IACxC,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACvD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;AACrB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACvE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,IAAgB,EAAE,UAAkB;IAC7E,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAA2B,EAC5D,QAAQ,EACR,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAA;IACD,OAAO,MAAM,EAAE,CAAC,SAAS,CACvB;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,IAA8B;QACpC,UAAU;QACV,IAAI,EAAE,SAAS;KAChB,EACD,QAAQ,EACR,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAA;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAiB,EACjB,QAAgB,EAChB,aAAqB,iBAAiB;IAEtC,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;IACpC,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;IAChC,MAAM,KAAK,GACT,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAA;IAC5F,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IACrE,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC,OAAO,CACjC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAA4B,EAAE,EACrD,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAA2B,CAC9D,CAAA;IACD,OAAO;QACL,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE;QACjF,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE;KACpF,CAAA;AACH,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACjD,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC1B,MAAM,SAAS,CAAC,kBAAkB,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IACrD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAA;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAmD,iBAAiB,EACpE,WAAmB,aAAa;IAEhC,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oBAAoB,CAAA;IAC7B,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,oBAAoB,CAAA;IAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,oBAAoB,GAAG,QAAQ,CAAC,GAAG,OAAO,CAAC,CAAA;IACzE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,oBAAoB,EAAE,CAAC;QACpE,OAAO,oBAAoB,CAAA;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAA;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAuB,EAAE,QAAgB;IAC3E,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACxC,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACvC,8EAA8E;IAC9E,mFAAmF;IACnF,oEAAoE;IACpE,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IAChF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACnE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,CAAC,OAAO,CAClC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAA4B,EAAE,EACrD,GAAG,EACH,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CACzD,CAAA;YACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;AAC5D,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAAoC;IACvD,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AAC1B,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAiB;IAC5C,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,KAA+B,CAAC,CAAA;IAChF,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;AAC/B,CAAC"}