@qntx/wallet-native 0.0.0-stage → 0.4.0

package/cpp/runtime/platform/KernelPbkdf2.cpp

@@ -0,0 +1,198 @@
+#include "KernelPbkdf2.hpp"
+
+#include <stdexcept>
+#include <string>
+
+#if defined(__APPLE__)
+#include <CommonCrypto/CommonCryptoError.h>
+#include <CommonCrypto/CommonKeyDerivation.h>
+#endif
+
+#if defined(__APPLE__)
+
+qntx::SecretBytes qntx::kernelPbkdf2(
+    KernelPbkdf2Hash hash,
+    const SecretBytes& password,
+    const SecretBytes& salt,
+    uint32_t iterations,
+    size_t length) {
+  const CCPseudoRandomAlgorithm algorithm =
+      hash == KernelPbkdf2Hash::sha256 ? kCCPRFHmacAlgSHA256 : kCCPRFHmacAlgSHA512;
+  SecretBytes out(length);
+  const int status = CCKeyDerivationPBKDF(
+      kCCPBKDF2,
+      reinterpret_cast<const char*>(password.data()),
+      password.size(),
+      salt.data(),
+      salt.size(),
+      algorithm,
+      iterations,
+      out.data(),
+      out.size());
+  if (status != kCCSuccess) {
+    throw std::runtime_error("CCKeyDerivationPBKDF failed: " + std::to_string(status));
+  }
+  return out;
+}
+
+#elif defined(__ANDROID__)
+
+namespace {
+
+JavaVM* g_vm = nullptr;
+jclass g_class = nullptr;
+jmethodID g_derive = nullptr;
+
+// Attaches the current thread to the JVM for the scope's lifetime.
+struct JniScope {
+  JNIEnv* env = nullptr;
+  bool mustDetach = false;
+
+  JniScope() {
+    if (g_vm == nullptr) {
+      throw std::runtime_error("kernelPbkdf2OnLoad was not called");
+    }
+    if (g_vm->GetEnv(reinterpret_cast<void**>(&env), JNI_VERSION_1_6) == JNI_EDETACHED) {
+      if (g_vm->AttachCurrentThread(&env, nullptr) != JNI_OK) {
+        throw std::runtime_error("AttachCurrentThread failed");
+      }
+      mustDetach = true;
+    }
+  }
+  ~JniScope() {
+    if (mustDetach) {
+      g_vm->DetachCurrentThread();
+    }
+  }
+  JniScope(const JniScope&) = delete;
+  JniScope& operator=(const JniScope&) = delete;
+};
+
+class JniByteArray {
+ public:
+  JniByteArray(JNIEnv* env, const qntx::SecretBytes& bytes) : env_(env) {
+    array_ = env->NewByteArray(static_cast<jsize>(bytes.size()));
+    if (array_ == nullptr) {
+      throw std::runtime_error("NewByteArray failed");
+    }
+    if (bytes.size() > 0) {
+      env->SetByteArrayRegion(
+          array_, 0, static_cast<jsize>(bytes.size()),
+          reinterpret_cast<const jbyte*>(bytes.data()));
+    }
+  }
+  ~JniByteArray() {
+    if (array_ != nullptr) {
+      // Wipe the heap copy before releasing the local ref.
+      std::vector<jbyte> zeros(env_->GetArrayLength(array_), 0);
+      env_->SetByteArrayRegion(array_, 0, static_cast<jsize>(zeros.size()), zeros.data());
+      env_->DeleteLocalRef(array_);
+    }
+  }
+  JniByteArray(const JniByteArray&) = delete;
+  JniByteArray& operator=(const JniByteArray&) = delete;
+  jbyteArray get() const {
+    return array_;
+  }
+
+ private:
+  JNIEnv* env_;
+  jbyteArray array_ = nullptr;
+};
+
+std::string describeJavaException(JNIEnv* env) {
+  if (!env->ExceptionCheck()) {
+    return {};
+  }
+  jthrowable throwable = env->ExceptionOccurred();
+  env->ExceptionClear();
+  auto objectClass = env->GetObjectClass(throwable);
+  auto toStringId = env->GetMethodID(objectClass, "toString", "()Ljava/lang/String;");
+  auto message = static_cast<jstring>(
+      env->CallObjectMethod(throwable, toStringId));
+  std::string text = "java exception";
+  if (message != nullptr) {
+    const char* utf = env->GetStringUTFChars(message, nullptr);
+    if (utf != nullptr) {
+      text = utf;
+      env->ReleaseStringUTFChars(message, utf);
+    }
+    env->DeleteLocalRef(message);
+  }
+  env->DeleteLocalRef(objectClass);
+  env->DeleteLocalRef(throwable);
+  return text;
+}
+
+} // namespace
+
+JavaVM* qntx::kernelJavaVM() {
+  return g_vm;
+}
+
+void qntx::kernelPbkdf2OnLoad(JNIEnv* env, const char* className) {
+  if (env->GetJavaVM(&g_vm) != JNI_OK) {
+    throw std::runtime_error("GetJavaVM failed");
+  }
+  jclass local = env->FindClass(className);
+  if (local == nullptr) {
+    env->ExceptionClear();
+    throw std::runtime_error(std::string("pbkdf2 helper class not found: ") + className);
+  }
+  g_class = static_cast<jclass>(env->NewGlobalRef(local));
+  env->DeleteLocalRef(local);
+  g_derive = env->GetStaticMethodID(
+      g_class, "derive", "(Ljava/lang/String;[B[BII)[B");
+  if (g_derive == nullptr) {
+    env->ExceptionClear();
+    throw std::runtime_error("KernelPbkdf2.derive not found");
+  }
+}
+
+qntx::SecretBytes qntx::kernelPbkdf2(
+    KernelPbkdf2Hash hash,
+    const SecretBytes& password,
+    const SecretBytes& salt,
+    uint32_t iterations,
+    size_t length) {
+  JniScope scope;
+  JNIEnv* env = scope.env;
+
+  jstring algorithm = env->NewStringUTF(
+      hash == KernelPbkdf2Hash::sha256 ? "HmacSHA256" : "HmacSHA512");
+  JniByteArray passwordArray(env, password);
+  JniByteArray saltArray(env, salt);
+
+  auto result = static_cast<jbyteArray>(env->CallStaticObjectMethod(
+      g_class,
+      g_derive,
+      algorithm,
+      passwordArray.get(),
+      saltArray.get(),
+      static_cast<jint>(iterations),
+      static_cast<jint>(length)));
+  env->DeleteLocalRef(algorithm);
+  if (result == nullptr) {
+    throw std::runtime_error("pbkdf2 failed: " + describeJavaException(env));
+  }
+  const jsize size = env->GetArrayLength(result);
+  SecretBytes out(static_cast<size_t>(size));
+  env->GetByteArrayRegion(result, 0, size, reinterpret_cast<jbyte*>(out.data()));
+  std::vector<jbyte> zeros(size, 0);
+  env->SetByteArrayRegion(result, 0, size, zeros.data());
+  env->DeleteLocalRef(result);
+  return out;
+}
+
+#else
+
+qntx::SecretBytes qntx::kernelPbkdf2(
+    KernelPbkdf2Hash,
+    const SecretBytes&,
+    const SecretBytes&,
+    uint32_t,
+    size_t) {
+  throw std::runtime_error("kernelPbkdf2: unsupported platform");
+}
+
+#endif

package/cpp/runtime/platform/KernelPbkdf2.hpp

@@ -0,0 +1,38 @@
+#pragma once
+
+#include "../KernelBuffer.hpp"
+
+#include <cstdint>
+#include <vector>
+
+#ifdef __ANDROID__
+#include <jni.h>
+#endif
+
+namespace qntx {
+
+enum class KernelPbkdf2Hash { sha256, sha512 };
+
+// Synchronous PBKDF2: iOS/macOS via CommonCrypto, Android via JNI into
+// javax.crypto.Mac. Callers run it on the KDF worker thread — never on the
+// kernel thread. Throws std::runtime_error on failure. Inputs and the result
+// are SecretBytes, so any path that drops them still wipes them.
+SecretBytes kernelPbkdf2(
+    KernelPbkdf2Hash hash,
+    const SecretBytes& password,
+    const SecretBytes& salt,
+    uint32_t iterations,
+    size_t length);
+
+#ifdef __ANDROID__
+// Called from the module's JNI_OnLoad while the caller's classloader is
+// available; caches the JavaVM and the Java helper's class/method.
+void kernelPbkdf2OnLoad(JNIEnv* env, const char* className);
+
+// The cached JavaVM, or nullptr before kernelPbkdf2OnLoad runs. The kernel
+// thread attaches through this when a probe installs JNI-backed natives
+// (e.g. Nitro's Java-bridged HybridObjectRegistry on Android).
+JavaVM* kernelJavaVM();
+#endif
+
+} // namespace qntx

package/dist/index.d.mts

@@ -0,0 +1,44 @@
+import { AutoLockPolicy, PasskeyConfig, Wallet } from "@qntx/wallet";
+import { MainPort } from "@qntx/wallet/host";
+import { ProtocolValue } from "@qntx/wallet/protocol";
+//#region src/host.d.ts
+type KernelExitReason = "locked" | "crashed" | "integrity" | "background";
+/**
+ * Structural mirror of the Nitro `KernelHost` spec (W2b registers the real hybrid object; tests
+ * drive the same shape over an in-memory frame pipe).
+ */
+type KernelHostLike = {
+  readonly start: (backgroundLockSeconds: number) => void;
+  readonly post: (frame: ArrayBuffer) => void;
+  readonly onMessage: (cb: (frame: ArrayBuffer) => void) => void;
+  readonly onExit: (cb: (reason: KernelExitReason) => void) => void;
+  readonly lock: () => void;
+};
+export declare function spawnFromHost(host: KernelHostLike, backgroundLockSeconds: number): MainPort;
+//#endregion
+//#region src/cbor.d.ts
+export declare const FRAME_MAX_BYTES: number;
+type CborErrorCode = "oversize" | "truncated" | "malformed" | "float" | "unsafe-int" | "bigint" | "undefined" | "tag" | "non-string-key" | "duplicate-key" | "indefinite" | "bad-type";
+export declare class CborError extends Error {
+  readonly code: CborErrorCode;
+  constructor(code: CborErrorCode, message: string);
+}
+/** Encode a `ProtocolValue` to a CBOR frame, enforcing the 1 MiB cap. */
+export declare function encodeFrame(value: ProtocolValue): ArrayBuffer;
+/** Decode a CBOR frame back to a `ProtocolValue`, enforcing the 1 MiB cap and strictness. */
+export declare function decodeFrame(frame: ArrayBuffer | Uint8Array): ProtocolValue;
+//#endregion
+//#region src/index.d.ts
+export type NativeWalletOptions = {
+  readonly passkey: PasskeyConfig;
+  readonly autoLock: AutoLockPolicy;
+  /**
+   * The Nitro `KernelHost` hybrid object (or a like-shaped fake for tests). Defaults to
+   * `NitroModules.createHybridObject("KernelHost")` — the only Nitro-registered object.
+   */
+  readonly host?: KernelHostLike;
+};
+export declare function createNativeWallet(options: NativeWalletOptions): Promise<Wallet>;
+//#endregion
+export type { CborErrorCode, KernelExitReason, KernelHostLike };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -0,0 +1,170 @@
+import { WalletError } from "@qntx/wallet";
+import { connectKernel } from "@qntx/wallet/host";
+import { decode, encode } from "cborg";
+//#region src/cbor.ts
+/**
+* CBOR framing for the kernel channel. `ProtocolValue` travels main-side ↔ kernel-side as CBOR; the
+* C++ layer moves bytes only. Decode is deliberately strict: floats, unsafe integers, undefined,
+* tags, non-string map keys, duplicate keys and indefinite-length items are all rejected — the wire
+* format carries exactly one value domain.
+*/
+const FRAME_MAX_BYTES = 1048576;
+var CborError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "CborError";
+		this.code = code;
+	}
+};
+const DECODE_OPTIONS = {
+	strict: true,
+	useMaps: false,
+	rejectDuplicateMapKeys: true,
+	allowUndefined: false,
+	allowIndefinite: false,
+	allowNaN: false,
+	allowInfinity: false,
+	allowBigInt: false
+};
+/** Reject non-safe-integer numbers and non-string map keys; cborg flags cover the rest. */
+function validate(value) {
+	if (value === null || typeof value === "boolean" || typeof value === "string") return;
+	if (typeof value === "number") {
+		if (!Number.isInteger(value)) throw new CborError("float", "cbor frame: non-integer number");
+		if (!Number.isSafeInteger(value)) throw new CborError("unsafe-int", "cbor frame: integer outside the safe range");
+		return;
+	}
+	if (value instanceof Uint8Array) return;
+	if (Array.isArray(value)) {
+		for (const item of value) validate(item);
+		return;
+	}
+	if (typeof value === "object") {
+		for (const [key, item] of Object.entries(value)) {
+			if (typeof key !== "string") throw new CborError("non-string-key", "cbor frame: non-string map key");
+			validate(item);
+		}
+		return;
+	}
+	throw new CborError("bad-type", `cbor frame: unsupported value type ${typeof value}`);
+}
+/** Classify a cborg rejection into the frame error taxonomy. */
+function classify(error) {
+	if (error instanceof CborError) return error;
+	const text = error instanceof Error ? error.message : String(error);
+	for (const [pattern, code] of [
+		[/duplicate key|repeat map key/i, "duplicate-key"],
+		[/indefinite/i, "indefinite"],
+		[/undefined/i, "undefined"],
+		[/bigint|safe integer range/i, "unsafe-int"],
+		[/tag/i, "tag"],
+		[/string/i, "non-string-key"]
+	]) if (pattern.test(text)) return new CborError(code, `cbor frame: ${text}`);
+	return new CborError("malformed", `cbor frame: ${text}`);
+}
+/** Encode a `ProtocolValue` to a CBOR frame, enforcing the 1 MiB cap. */
+function encodeFrame(value) {
+	validate(value);
+	const bytes = encode(value);
+	if (bytes.byteLength > 1048576) throw new CborError("oversize", `cbor frame: ${bytes.byteLength} bytes exceeds the 1 MiB cap`);
+	return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+/** Decode a CBOR frame back to a `ProtocolValue`, enforcing the 1 MiB cap and strictness. */
+function decodeFrame(frame) {
+	const bytes = frame instanceof Uint8Array ? frame : new Uint8Array(frame);
+	if (bytes.byteLength > 1048576) throw new CborError("oversize", `cbor frame: ${bytes.byteLength} bytes exceeds the 1 MiB cap`);
+	if (bytes.byteLength === 0) throw new CborError("truncated", "cbor frame: empty frame");
+	try {
+		const value = decode(bytes, DECODE_OPTIONS);
+		validate(value);
+		return value;
+	} catch (error) {
+		throw classify(error);
+	}
+}
+//#endregion
+//#region src/host.ts
+function spawnFromHost(host, backgroundLockSeconds) {
+	const exitHandlers = /* @__PURE__ */ new Set();
+	let exited = false;
+	const exit = (reason) => {
+		if (exited) return;
+		exited = true;
+		for (const handler of exitHandlers) handler(reason);
+		host.lock();
+	};
+	host.onMessage((frame) => {
+		let message;
+		try {
+			message = decodeFrame(frame);
+		} catch {
+			exit("crashed");
+			return;
+		}
+		dispatch(message);
+	});
+	host.onExit((reason) => {
+		exit(reason === "background" ? "background" : "crashed");
+	});
+	const messageHandlers = /* @__PURE__ */ new Set();
+	const dispatch = (message) => {
+		for (const handler of messageHandlers) handler(message);
+	};
+	host.start(backgroundLockSeconds);
+	return {
+		post: (message, transfer) => {
+			const frame = encodeFrame(message);
+			host.post(frame);
+			for (const buffer of transfer) new Uint8Array(buffer).fill(0);
+		},
+		listen: (handler) => {
+			messageHandlers.add(handler);
+			return () => {
+				messageHandlers.delete(handler);
+			};
+		},
+		onExit: (handler) => {
+			exitHandlers.add(handler);
+			return () => {
+				exitHandlers.delete(handler);
+			};
+		},
+		terminate: () => {
+			exit("crashed");
+		}
+	};
+}
+//#endregion
+//#region src/index.ts
+/**
+* `@qntx/wallet-native`: the RN host entry. `createNativeWallet` adapts a `KernelHost` (Nitro
+* hybrid from W2b, or any object with the same shape) to the wallet `connectKernel` entry — the
+* returned `Wallet` is the same type as the web/node host.
+*/
+const setTimer = (delayMs, fn) => {
+	const id = setTimeout(fn, delayMs);
+	return () => {
+		clearTimeout(id);
+	};
+};
+async function defaultHost() {
+	const { NitroModules } = await import("react-native-nitro-modules");
+	return NitroModules.createHybridObject("KernelHost");
+}
+async function createNativeWallet(options) {
+	const { autoLock } = options;
+	const host = options.host ?? await defaultHost();
+	if (autoLock.platform !== "native") throw new WalletError("invalid-input", "createNativeWallet accepts only the native autoLock policy");
+	return connectKernel({
+		spawn: () => spawnFromHost(host, autoLock.backgroundSeconds),
+		factors: "hardware",
+		passkey: options.passkey,
+		ceremony: void 0,
+		setTimer
+	});
+}
+//#endregion
+export { CborError, FRAME_MAX_BYTES, createNativeWallet, decodeFrame, encodeFrame, spawnFromHost };
+
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/cbor.ts","../src/host.ts","../src/index.ts"],"sourcesContent":["/**\n * CBOR framing for the kernel channel. `ProtocolValue` travels main-side ↔ kernel-side as CBOR; the\n * C++ layer moves bytes only. Decode is deliberately strict: floats, unsafe integers, undefined,\n * tags, non-string map keys, duplicate keys and indefinite-length items are all rejected — the wire\n * format carries exactly one value domain.\n */\nimport { decode, encode } from \"cborg\";\nimport type { DecodeOptions } from \"cborg\";\n\nimport type { ProtocolValue } from \"@qntx/wallet/protocol\";\n\nexport const FRAME_MAX_BYTES: number = 1024 * 1024;\n\nexport type CborErrorCode =\n  | \"oversize\"\n  | \"truncated\"\n  | \"malformed\"\n  | \"float\"\n  | \"unsafe-int\"\n  | \"bigint\"\n  | \"undefined\"\n  | \"tag\"\n  | \"non-string-key\"\n  | \"duplicate-key\"\n  | \"indefinite\"\n  | \"bad-type\";\n\nexport class CborError extends Error {\n  readonly code: CborErrorCode;\n  constructor(code: CborErrorCode, message: string) {\n    super(message);\n    this.name = \"CborError\";\n    this.code = code;\n  }\n}\n\nconst DECODE_OPTIONS: DecodeOptions = {\n  strict: true,\n  useMaps: false,\n  rejectDuplicateMapKeys: true,\n  allowUndefined: false,\n  allowIndefinite: false,\n  allowNaN: false,\n  allowInfinity: false,\n  allowBigInt: false,\n};\n\n/** Reject non-safe-integer numbers and non-string map keys; cborg flags cover the rest. */\nfunction validate(value: unknown): asserts value is ProtocolValue {\n  if (value === null || typeof value === \"boolean\" || typeof value === \"string\") {\n    return;\n  }\n  if (typeof value === \"number\") {\n    if (!Number.isInteger(value)) {\n      throw new CborError(\"float\", \"cbor frame: non-integer number\");\n    }\n    if (!Number.isSafeInteger(value)) {\n      throw new CborError(\"unsafe-int\", \"cbor frame: integer outside the safe range\");\n    }\n    return;\n  }\n  if (value instanceof Uint8Array) {\n    return;\n  }\n  if (Array.isArray(value)) {\n    for (const item of value) {\n      validate(item);\n    }\n    return;\n  }\n  if (typeof value === \"object\") {\n    // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- the object came from a CBOR map\n    for (const [key, item] of Object.entries(value as Record<string, unknown>)) {\n      if (typeof key !== \"string\") {\n        throw new CborError(\"non-string-key\", \"cbor frame: non-string map key\");\n      }\n      validate(item);\n    }\n    return;\n  }\n  throw new CborError(\"bad-type\", `cbor frame: unsupported value type ${typeof value}`);\n}\n\n/** Classify a cborg rejection into the frame error taxonomy. */\nfunction classify(error: unknown): CborError {\n  if (error instanceof CborError) {\n    return error;\n  }\n  const text = error instanceof Error ? error.message : String(error);\n  const table: ReadonlyArray<[RegExp, CborErrorCode]> = [\n    [/duplicate key|repeat map key/i, \"duplicate-key\"],\n    [/indefinite/i, \"indefinite\"],\n    [/undefined/i, \"undefined\"],\n    [/bigint|safe integer range/i, \"unsafe-int\"],\n    [/tag/i, \"tag\"],\n    [/string/i, \"non-string-key\"],\n  ];\n  for (const [pattern, code] of table) {\n    if (pattern.test(text)) {\n      return new CborError(code, `cbor frame: ${text}`);\n    }\n  }\n  return new CborError(\"malformed\", `cbor frame: ${text}`);\n}\n\n/** Encode a `ProtocolValue` to a CBOR frame, enforcing the 1 MiB cap. */\nexport function encodeFrame(value: ProtocolValue): ArrayBuffer {\n  validate(value);\n  const bytes = encode(value);\n  if (bytes.byteLength > FRAME_MAX_BYTES) {\n    throw new CborError(\"oversize\", `cbor frame: ${bytes.byteLength} bytes exceeds the 1 MiB cap`);\n  }\n  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);\n}\n\n/** Decode a CBOR frame back to a `ProtocolValue`, enforcing the 1 MiB cap and strictness. */\nexport function decodeFrame(frame: ArrayBuffer | Uint8Array): ProtocolValue {\n  const bytes = frame instanceof Uint8Array ? frame : new Uint8Array(frame);\n  if (bytes.byteLength > FRAME_MAX_BYTES) {\n    throw new CborError(\"oversize\", `cbor frame: ${bytes.byteLength} bytes exceeds the 1 MiB cap`);\n  }\n  if (bytes.byteLength === 0) {\n    throw new CborError(\"truncated\", \"cbor frame: empty frame\");\n  }\n  try {\n    const value: unknown = decode(bytes, DECODE_OPTIONS);\n    validate(value);\n    return value;\n  } catch (error) {\n    throw classify(error);\n  }\n}\n","/**\n * `KernelHost` JS wrapper: CBOR frames over a Nitro-host-shaped channel. The host moves bytes only\n * — encode/decode happens here and in the kernel entry — so a malformed inbound frame can never\n * reach the message domain: the port exits `integrity` and the host runtime is destroyed.\n */\nimport type { MainPort, PortExit } from \"@qntx/wallet/host\";\nimport type { ProtocolValue } from \"@qntx/wallet/protocol\";\n\nimport { decodeFrame, encodeFrame } from \"./cbor.ts\";\n\nexport type KernelExitReason = \"locked\" | \"crashed\" | \"integrity\" | \"background\";\n\n/**\n * Structural mirror of the Nitro `KernelHost` spec (W2b registers the real hybrid object; tests\n * drive the same shape over an in-memory frame pipe).\n */\nexport type KernelHostLike = {\n  readonly start: (backgroundLockSeconds: number) => void;\n  readonly post: (frame: ArrayBuffer) => void;\n  readonly onMessage: (cb: (frame: ArrayBuffer) => void) => void;\n  readonly onExit: (cb: (reason: KernelExitReason) => void) => void;\n  readonly lock: () => void;\n};\n\nexport function spawnFromHost(host: KernelHostLike, backgroundLockSeconds: number): MainPort {\n  const exitHandlers = new Set<(reason: PortExit) => void>();\n  let exited = false;\n\n  const exit = (reason: PortExit): void => {\n    if (exited) {\n      return;\n    }\n    exited = true;\n    for (const handler of exitHandlers) {\n      handler(reason);\n    }\n    host.lock();\n  };\n\n  host.onMessage((frame) => {\n    let message: ProtocolValue;\n    try {\n      message = decodeFrame(frame);\n    } catch {\n      exit(\"crashed\");\n      return;\n    }\n    dispatch(message);\n  });\n\n  // The platform locked the enclave in the background — report it honestly so\n  // the channel takes the lock path, not the crash path.\n  host.onExit((reason) => {\n    exit(reason === \"background\" ? \"background\" : \"crashed\");\n  });\n\n  const messageHandlers = new Set<(message: unknown) => void>();\n  const dispatch = (message: unknown): void => {\n    for (const handler of messageHandlers) {\n      handler(message);\n    }\n  };\n\n  host.start(backgroundLockSeconds);\n\n  return {\n    post: (message, transfer) => {\n      const frame = encodeFrame(message);\n      host.post(frame);\n      // Structured clone would neuter transferred buffers on the web; the main↔kernel\n      // contract is the same here — the caller's buffers hold secrets (passwords, PRF\n      // output) and are zeroed once their bytes are inside the frame.\n      for (const buffer of transfer) {\n        new Uint8Array(buffer).fill(0);\n      }\n    },\n    listen: (handler) => {\n      messageHandlers.add(handler);\n      return () => {\n        messageHandlers.delete(handler);\n      };\n    },\n    onExit: (handler) => {\n      exitHandlers.add(handler);\n      return () => {\n        exitHandlers.delete(handler);\n      };\n    },\n    terminate: () => {\n      exit(\"crashed\");\n    },\n  };\n}\n","import { WalletError } from \"@qntx/wallet\";\nimport type { AutoLockPolicy, PasskeyConfig, Wallet } from \"@qntx/wallet\";\nimport type { SetTimer } from \"@qntx/wallet/host\";\n/**\n * `@qntx/wallet-native`: the RN host entry. `createNativeWallet` adapts a `KernelHost` (Nitro\n * hybrid from W2b, or any object with the same shape) to the wallet `connectKernel` entry — the\n * returned `Wallet` is the same type as the web/node host.\n */\nimport { connectKernel } from \"@qntx/wallet/host\";\n\nimport { spawnFromHost } from \"./host.ts\";\nimport type { KernelHostLike } from \"./host.ts\";\nimport type { KernelHost } from \"./specs/kernel-host.nitro.ts\";\n\nexport type NativeWalletOptions = {\n  readonly passkey: PasskeyConfig;\n  readonly autoLock: AutoLockPolicy;\n  /**\n   * The Nitro `KernelHost` hybrid object (or a like-shaped fake for tests). Defaults to\n   * `NitroModules.createHybridObject(\"KernelHost\")` — the only Nitro-registered object.\n   */\n  readonly host?: KernelHostLike;\n};\n\nconst setTimer: SetTimer = (delayMs, fn) => {\n  const id = setTimeout(fn, delayMs);\n  return () => {\n    clearTimeout(id);\n  };\n};\n\nasync function defaultHost(): Promise<KernelHostLike> {\n  const { NitroModules } = await import(\"react-native-nitro-modules\");\n  return NitroModules.createHybridObject<KernelHost>(\"KernelHost\");\n}\n\nexport async function createNativeWallet(options: NativeWalletOptions): Promise<Wallet> {\n  const { autoLock } = options;\n  const host = options.host ?? (await defaultHost());\n  if (autoLock.platform !== \"native\") {\n    throw new WalletError(\n      \"invalid-input\",\n      \"createNativeWallet accepts only the native autoLock policy\",\n    );\n  }\n  // The native host owns the auto-lock signal: the platform layer calls host.lock() on\n  // background expiry — the kernel never sees a presence source here.\n  return connectKernel({\n    spawn: () => spawnFromHost(host, autoLock.backgroundSeconds),\n    factors: \"hardware\",\n    passkey: options.passkey,\n    ceremony: undefined,\n    setTimer,\n  });\n}\n\nexport { spawnFromHost, type KernelHostLike, type KernelExitReason } from \"./host.ts\";\nexport {\n  encodeFrame,\n  decodeFrame,\n  CborError,\n  FRAME_MAX_BYTES,\n  type CborErrorCode,\n} from \"./cbor.ts\";\n"],"mappings":";;;;;;;;;;AAWA,MAAa,kBAA0B;AAgBvC,IAAa,YAAb,cAA+B,MAAM;CACnC;CACA,YAAY,MAAqB,SAAiB;EAChD,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;CACd;AACF;AAEA,MAAM,iBAAgC;CACpC,QAAQ;CACR,SAAS;CACT,wBAAwB;CACxB,gBAAgB;CAChB,iBAAiB;CACjB,UAAU;CACV,eAAe;CACf,aAAa;AACf;;AAGA,SAAS,SAAS,OAAgD;CAChE,IAAI,UAAU,QAAQ,OAAO,UAAU,aAAa,OAAO,UAAU,UACnE;CAEF,IAAI,OAAO,UAAU,UAAU;EAC7B,IAAI,CAAC,OAAO,UAAU,KAAK,GACzB,MAAM,IAAI,UAAU,SAAS,gCAAgC;EAE/D,IAAI,CAAC,OAAO,cAAc,KAAK,GAC7B,MAAM,IAAI,UAAU,cAAc,4CAA4C;EAEhF;CACF;CACA,IAAI,iBAAiB,YACnB;CAEF,IAAI,MAAM,QAAQ,KAAK,GAAG;EACxB,KAAK,MAAM,QAAQ,OACjB,SAAS,IAAI;EAEf;CACF;CACA,IAAI,OAAO,UAAU,UAAU;EAE7B,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,KAAgC,GAAG;GAC1E,IAAI,OAAO,QAAQ,UACjB,MAAM,IAAI,UAAU,kBAAkB,gCAAgC;GAExE,SAAS,IAAI;EACf;EACA;CACF;CACA,MAAM,IAAI,UAAU,YAAY,sCAAsC,OAAO,OAAO;AACtF;;AAGA,SAAS,SAAS,OAA2B;CAC3C,IAAI,iBAAiB,WACnB,OAAO;CAET,MAAM,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;CASlE,KAAK,MAAM,CAAC,SAAS,SAAS;EAP5B,CAAC,iCAAiC,eAAe;EACjD,CAAC,eAAe,YAAY;EAC5B,CAAC,cAAc,WAAW;EAC1B,CAAC,8BAA8B,YAAY;EAC3C,CAAC,QAAQ,KAAK;EACd,CAAC,WAAW,gBAAgB;CAEI,GAChC,IAAI,QAAQ,KAAK,IAAI,GACnB,OAAO,IAAI,UAAU,MAAM,eAAe,MAAM;CAGpD,OAAO,IAAI,UAAU,aAAa,eAAe,MAAM;AACzD;;AAGA,SAAgB,YAAY,OAAmC;CAC7D,SAAS,KAAK;CACd,MAAM,QAAQ,OAAO,KAAK;CAC1B,IAAI,MAAM,aAAA,SACR,MAAM,IAAI,UAAU,YAAY,eAAe,MAAM,WAAW,6BAA6B;CAE/F,OAAO,MAAM,OAAO,MAAM,MAAM,YAAY,MAAM,aAAa,MAAM,UAAU;AACjF;;AAGA,SAAgB,YAAY,OAAgD;CAC1E,MAAM,QAAQ,iBAAiB,aAAa,QAAQ,IAAI,WAAW,KAAK;CACxE,IAAI,MAAM,aAAA,SACR,MAAM,IAAI,UAAU,YAAY,eAAe,MAAM,WAAW,6BAA6B;CAE/F,IAAI,MAAM,eAAe,GACvB,MAAM,IAAI,UAAU,aAAa,yBAAyB;CAE5D,IAAI;EACF,MAAM,QAAiB,OAAO,OAAO,cAAc;EACnD,SAAS,KAAK;EACd,OAAO;CACT,SAAS,OAAO;EACd,MAAM,SAAS,KAAK;CACtB;AACF;;;AC3GA,SAAgB,cAAc,MAAsB,uBAAyC;CAC3F,MAAM,+BAAe,IAAI,IAAgC;CACzD,IAAI,SAAS;CAEb,MAAM,QAAQ,WAA2B;EACvC,IAAI,QACF;EAEF,SAAS;EACT,KAAK,MAAM,WAAW,cACpB,QAAQ,MAAM;EAEhB,KAAK,KAAK;CACZ;CAEA,KAAK,WAAW,UAAU;EACxB,IAAI;EACJ,IAAI;GACF,UAAU,YAAY,KAAK;EAC7B,QAAQ;GACN,KAAK,SAAS;GACd;EACF;EACA,SAAS,OAAO;CAClB,CAAC;CAID,KAAK,QAAQ,WAAW;EACtB,KAAK,WAAW,eAAe,eAAe,SAAS;CACzD,CAAC;CAED,MAAM,kCAAkB,IAAI,IAAgC;CAC5D,MAAM,YAAY,YAA2B;EAC3C,KAAK,MAAM,WAAW,iBACpB,QAAQ,OAAO;CAEnB;CAEA,KAAK,MAAM,qBAAqB;CAEhC,OAAO;EACL,OAAO,SAAS,aAAa;GAC3B,MAAM,QAAQ,YAAY,OAAO;GACjC,KAAK,KAAK,KAAK;GAIf,KAAK,MAAM,UAAU,UACnB,IAAI,WAAW,MAAM,CAAC,CAAC,KAAK,CAAC;EAEjC;EACA,SAAS,YAAY;GACnB,gBAAgB,IAAI,OAAO;GAC3B,aAAa;IACX,gBAAgB,OAAO,OAAO;GAChC;EACF;EACA,SAAS,YAAY;GACnB,aAAa,IAAI,OAAO;GACxB,aAAa;IACX,aAAa,OAAO,OAAO;GAC7B;EACF;EACA,iBAAiB;GACf,KAAK,SAAS;EAChB;CACF;AACF;;;;;;;;ACpEA,MAAM,YAAsB,SAAS,OAAO;CAC1C,MAAM,KAAK,WAAW,IAAI,OAAO;CACjC,aAAa;EACX,aAAa,EAAE;CACjB;AACF;AAEA,eAAe,cAAuC;CACpD,MAAM,EAAE,iBAAiB,MAAM,OAAO;CACtC,OAAO,aAAa,mBAA+B,YAAY;AACjE;AAEA,eAAsB,mBAAmB,SAA+C;CACtF,MAAM,EAAE,aAAa;CACrB,MAAM,OAAO,QAAQ,QAAS,MAAM,YAAY;CAChD,IAAI,SAAS,aAAa,UACxB,MAAM,IAAI,YACR,iBACA,4DACF;CAIF,OAAO,cAAc;EACnB,aAAa,cAAc,MAAM,SAAS,iBAAiB;EAC3D,SAAS;EACT,SAAS,QAAQ;EACjB,UAAU,KAAA;EACV;CACF,CAAC;AACH"}