@qntx/wallet-native 0.5.2 → 0.7.0

package/WalletNative.podspec

@@ -59,7 +59,7 @@ Pod::Spec.new do |s|
 
   # The kernel's backends.spark binds the qs_* C ABI; the prebuilt
   # QntxSpark.xcframework ships inside the SparkNative pod.
-  s.frameworks = "LocalAuthentication", "Security"
+  s.frameworks = "LocalAuthentication", "Security", "AuthenticationServices", "UIKit"
 
   s.dependency 'NostrNative'
   s.dependency 'SparkNative'

package/android/build.gradle

@@ -14,20 +14,10 @@ def reactNativeArchitectures() {
   return value ? value.split(",") : ["x86", "x86_64", "armeabi-v7a", "arm64-v8a"]
 }
 
-def isNewArchitectureEnabled() {
-  return rootProject.hasProperty("newArchEnabled") && rootProject.getProperty("newArchEnabled") == "true"
-}
-
 apply plugin: "com.android.library"
 apply plugin: 'org.jetbrains.kotlin.android'
 apply from: '../nitrogen/generated/android/WalletNative+autolinking.gradle'
 
-if (isNewArchitectureEnabled()) {
-  apply plugin: "com.facebook.react"
-
-
-}
-
 def getExtOrDefault(name) {
   return rootProject.ext.has(name) ? rootProject.ext.get(name) : project.properties["WalletNative_" + name]
 }
@@ -133,23 +123,12 @@ android {
     targetCompatibility JavaVersion.VERSION_1_8
   }
 
-  sourceSets {
-    main {
-      if (isNewArchitectureEnabled()) {
-        java.srcDirs += [
-          "${project.buildDir}/generated/source/codegen/java"
-        ]
-      }
-    }
-  }
 }
 
 dependencies {
-  // For > 0.71, this is replaced by `com.facebook.react:react-android:$version` by the React
-  // gradle plugin — it supplies the fbjni/ReactAndroid prefab packages the generated CMake
-  // autolinking file finds with find_package.
-  //noinspection GradleDynamicVersion
-  implementation "com.facebook.react:react-native:+"
+  // The app's React Native Gradle plugin pins the version; the prefab packages (fbjni, ReactAndroid)
+  // are what the generated CMake autolinking file finds with find_package.
+  implementation "com.facebook.react:react-android"
 
   // Hermes engine prefab — the kernel runtime links hermesvm/libhermes
   implementation "com.facebook.react:hermes-android"

package/cpp/host/Passkey.hpp

@@ -7,10 +7,11 @@ namespace qntx {
 
 // The platform passkey authenticator behind `__qntx.passkey` (W6). The kernel
 // builds the WebAuthn request JSON and parses the response JSON itself; the
-// platform only runs the system ceremony. Android: Credential Manager. iOS:
-// not yet available (W6c needs an associated domain) — every call completes
-// `unavailable`. Each function has exactly one strong definition per platform
-// (PasskeyAndroid.cpp, PasskeyIos.mm); host tests link a fake.
+// platform only runs the system ceremony. Android: Credential Manager. iOS
+// (W6c): ASAuthorization platform passkeys with the PRF extension on iOS 18+,
+// unavailable below or without the associated domain. Each function has
+// exactly one strong definition per platform (PasskeyAndroid.cpp,
+// PasskeyIos.mm); host tests link a fake.
 
 // The binding maps each status to the kernel's error code: cancelled →
 // "cancelled", unavailable → "factor-unavailable", failed → "unavailable".

package/cpp/platform/PasskeyIos.mm

@@ -1,20 +1,487 @@
-// iOS passkey authenticator: not available yet. Native passkeys need the
-// app's associated domain (webcredentials), which the current free signing
-// team cannot provision; W6c implements ASAuthorization with PRF once a paid
-// team exists. Until then every ceremony reports `unavailable`, which the
-// kernel surfaces as factor-unavailable (no passkey wallet on this platform).
+// iOS passkey authenticator (W6c): ASAuthorization platform passkeys with the
+// PRF extension (iOS 18+). The kernel builds the WebAuthn request JSON and
+// parses the response JSON itself; this file only reads the fields the system
+// ceremony needs, runs one ASAuthorizationController at a time and repacks the
+// credential into the browser `toJSON()` shape the kernel parses. A ceremony
+// requested while the scene is still activating — e.g. right after a system
+// Face ID prompt resigns it — waits for UISceneDidActivateNotification instead
+// of failing before any sheet appears. PRF outputs are encoded straight into
+// the response JSON — no copies are kept and they are never logged.
 #include "../host/Passkey.hpp"
 
+#import <AuthenticationServices/AuthenticationServices.h>
+#import <Foundation/Foundation.h>
+#import <UIKit/UIKit.h>
+#import <os/log.h>
+
+#include <mutex>
+#include <string>
+#include <utility>
+
+@class QntxPasskeySession;
+
+namespace {
+
+os_log_t passkeyLog() {
+  static os_log_t log = os_log_create("org.qntx.wallet", "passkey");
+  return log;
+}
+
+// The session — and the controller it owns once the ceremony actually runs —
+// stays alive only while a call is in flight (controller.delegate is weak).
+// It is touched on the main thread only; the mutex pairs the one-in-flight
+// check with the clear on completion. A parked session (scene not yet active)
+// has no controller yet, so the busy check looks at the session.
+std::mutex g_mutex;
+QntxPasskeySession* g_session = nil;
+
+// Strict base64url decode (padding restored); nil on any invalid character.
+NSData* _Nullable base64urlDecode(NSString* _Nullable value) {
+  if (value == nil) {
+    return nil;
+  }
+  NSMutableString* standard = [NSMutableString stringWithCapacity:value.length + 3];
+  for (NSUInteger i = 0; i < value.length; i += 1) {
+    const unichar c = [value characterAtIndex:i];
+    if (c == '-') {
+      [standard appendString:@"+"];
+    } else if (c == '_') {
+      [standard appendString:@"/"];
+    } else if ((c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9')) {
+      [standard appendFormat:@"%C", c];
+    } else {
+      return nil;
+    }
+  }
+  if (standard.length % 4 == 1) {
+    return nil;
+  }
+  while (standard.length % 4 != 0) {
+    [standard appendString:@"="];
+  }
+  return [[NSData alloc] initWithBase64EncodedString:standard options:0];
+}
+
+NSString* base64urlEncode(NSData* data) {
+  NSString* standard = [data base64EncodedStringWithOptions:0];
+  standard = [standard stringByReplacingOccurrencesOfString:@"+" withString:@"-"];
+  standard = [standard stringByReplacingOccurrencesOfString:@"/" withString:@"_"];
+  while ([standard hasSuffix:@"="]) {
+    standard = [standard substringToIndex:standard.length - 1];
+  }
+  return standard;
+}
+
+NSDictionary<NSString*, id>* _Nullable dictOf(_Nullable id value) {
+  return [value isKindOfClass:NSDictionary.class] ? (NSDictionary<NSString*, id>*)value : nil;
+}
+
+NSString* _Nullable stringOf(_Nullable id value) {
+  return [value isKindOfClass:NSString.class] ? (NSString*)value : nil;
+}
+
+NSArray* _Nullable arrayOf(_Nullable id value) {
+  return [value isKindOfClass:NSArray.class] ? (NSArray*)value : nil;
+}
+
+NSDictionary<NSString*, id>* _Nullable jsonOf(const std::string& json) {
+  NSData* data = [NSData dataWithBytes:json.data() length:json.size()];
+  return dictOf([NSJSONSerialization JSONObjectWithData:data options:0 error:nil]);
+}
+
+// The extensions.prf.eval block the kernel always sends; nil when missing or
+// malformed (eval.second is optional).
+ASAuthorizationPublicKeyCredentialPRFAssertionInputValues* _Nullable prfEval(
+    NSDictionary<NSString*, id>* request) API_AVAILABLE(ios(18.0)) {
+  NSDictionary* eval = dictOf(dictOf(dictOf(request[@"extensions"])[@"prf"])[@"eval"]);
+  NSData* first = base64urlDecode(stringOf(eval[@"first"]));
+  if (first == nil) {
+    return nil;
+  }
+  NSData* second = nil;
+  if (eval[@"second"] != nil) {
+    second = base64urlDecode(stringOf(eval[@"second"]));
+    if (second == nil) {
+      return nil;
+    }
+  }
+  return [[ASAuthorizationPublicKeyCredentialPRFAssertionInputValues alloc]
+      initWithSaltInput1:first
+              saltInput2:second];
+}
+
+ASPresentationAnchor _Nullable activeKeyWindow() {
+  for (UIScene* scene in UIApplication.sharedApplication.connectedScenes) {
+    if ([scene isKindOfClass:UIWindowScene.class] &&
+        scene.activationState == UISceneActivationStateForegroundActive) {
+      UIWindow* window = ((UIWindowScene*)scene).keyWindow;
+      if (window != nil) {
+        return window;
+      }
+    }
+  }
+  return nil;
+}
+
+// A window scene on its way to the foreground — e.g. right after a system
+// Face ID prompt resigns the app's scene. Once it activates, its key window
+// can anchor the passkey sheet.
+BOOL hasInactiveWindowScene() {
+  for (UIScene* scene in UIApplication.sharedApplication.connectedScenes) {
+    if ([scene isKindOfClass:UIWindowScene.class] &&
+        scene.activationState == UISceneActivationStateForegroundInactive &&
+        ((UIWindowScene*)scene).keyWindow != nil) {
+      return YES;
+    }
+  }
+  return NO;
+}
+
+std::string jsonString(NSDictionary<NSString*, id>* json) {
+  NSData* data = [NSJSONSerialization dataWithJSONObject:json options:0 error:nil];
+  if (data == nil) {
+    return {};
+  }
+  return std::string(static_cast<const char*>(data.bytes), data.length);
+}
+
+} // namespace
+
+API_AVAILABLE(ios(18.0))
+@interface QntxPasskeySession : NSObject <ASAuthorizationControllerDelegate,
+                                          ASAuthorizationControllerPresentationContextProviding>
+- (instancetype)initWithDone:(qntx::PasskeyDone)done
+                     request:(ASAuthorizationRequest*)request;
+// Runs the ceremony now, or parks it until the window scene activates.
+- (void)start;
+// Cancels a parked wait or the running ceremony; completes through finish:.
+- (void)cancelCeremony;
+- (void)finish:(qntx::PasskeyResult)result;
+@end
+
+@implementation QntxPasskeySession {
+  qntx::PasskeyDone _done;
+  ASAuthorizationRequest* _request;
+  ASPresentationAnchor _anchor;
+  ASAuthorizationController* _controller;
+  NSObject* _observer;
+}
+
+- (instancetype)initWithDone:(qntx::PasskeyDone)done
+                     request:(ASAuthorizationRequest*)request {
+  self = [super init];
+  if (self != nil) {
+    _done = std::move(done);
+    _request = request;
+  }
+  return self;
+}
+
+// A ceremony started while the scene is still activating fails before any
+// sheet appears — like Keystore.kt's whenResumed, park on an inactive window
+// scene and run it at UISceneDidActivateNotification. A scene that is fully
+// absent still reports `unavailable`.
+- (void)start {
+  ASPresentationAnchor anchor = activeKeyWindow();
+  if (anchor != nil) {
+    [self performWithAnchor:anchor];
+    return;
+  }
+  if (hasInactiveWindowScene()) {
+    _observer = [NSNotificationCenter.defaultCenter
+        addObserverForName:UISceneDidActivateNotification
+                    object:nil
+                     queue:NSOperationQueue.mainQueue
+                usingBlock:^(NSNotification*) {
+                  [self sceneActivated];
+                }];
+    return;
+  }
+  [self finish:qntx::PasskeyResult{qntx::PasskeyStatus::unavailable, {}}];
+}
+
+- (void)sceneActivated {
+  [NSNotificationCenter.defaultCenter removeObserver:_observer];
+  _observer = nil;
+  ASPresentationAnchor anchor = activeKeyWindow();
+  if (anchor == nil) {
+    [self finish:qntx::PasskeyResult{qntx::PasskeyStatus::unavailable, {}}];
+    return;
+  }
+  [self performWithAnchor:anchor];
+}
+
+- (void)performWithAnchor:(ASPresentationAnchor)anchor {
+  _anchor = anchor;
+  _controller =
+      [[ASAuthorizationController alloc] initWithAuthorizationRequests:@[ _request ]];
+  _controller.delegate = self;
+  _controller.presentationContextProvider = self;
+  [_controller performRequests];
+}
+
+- (void)cancelCeremony {
+  if (_observer != nil) {
+    [NSNotificationCenter.defaultCenter removeObserver:_observer];
+    _observer = nil;
+    [self finish:qntx::PasskeyResult{qntx::PasskeyStatus::cancelled, {}}];
+    return;
+  }
+  [_controller cancel];
+}
+
+// Runs exactly once per session; clears the in-flight session before
+// invoking the kernel completion.
+- (void)finish:(qntx::PasskeyResult)result {
+  qntx::PasskeyDone done;
+  {
+    std::lock_guard<std::mutex> lock(g_mutex);
+    if (g_session != self) {
+      return;
+    }
+    g_session = nil;
+    done = std::move(_done);
+    _done = nullptr;
+  }
+  if (_observer != nil) {
+    [NSNotificationCenter.defaultCenter removeObserver:_observer];
+    _observer = nil;
+  }
+  done(std::move(result));
+}
+
+- (ASPresentationAnchor)presentationAnchorForAuthorizationController:
+    (ASAuthorizationController*)controller {
+  return _anchor;
+}
+
+- (void)authorizationController:(ASAuthorizationController*)controller
+    didCompleteWithAuthorization:(ASAuthorization*)authorization {
+  NSMutableDictionary<NSString*, id>* extensions = [NSMutableDictionary new];
+  NSMutableDictionary<NSString*, id>* response = [NSMutableDictionary new];
+  std::string credentialId;
+  if ([authorization.credential
+          isKindOfClass:ASAuthorizationPlatformPublicKeyCredentialRegistration.class]) {
+    auto* credential = (ASAuthorizationPlatformPublicKeyCredentialRegistration*)
+        authorization.credential;
+    NSString* id64 = base64urlEncode(credential.credentialID);
+    credentialId = std::string(id64.UTF8String);
+    response[@"clientDataJSON"] = base64urlEncode(credential.rawClientDataJSON);
+    if (credential.rawAttestationObject != nil) {
+      response[@"attestationObject"] = base64urlEncode(credential.rawAttestationObject);
+    }
+    if (credential.prf != nil) {
+      NSMutableDictionary<NSString*, id>* prf =
+          [@{ @"enabled" : @(credential.prf.isSupported) } mutableCopy];
+      if (credential.prf.first != nil) {
+        NSMutableDictionary<NSString*, id>* results =
+            [@{ @"first" : base64urlEncode(credential.prf.first) } mutableCopy];
+        if (credential.prf.second != nil) {
+          results[@"second"] = base64urlEncode(credential.prf.second);
+        }
+        prf[@"results"] = results;
+      }
+      extensions[@"prf"] = prf;
+    }
+  } else if ([authorization.credential
+                 isKindOfClass:ASAuthorizationPlatformPublicKeyCredentialAssertion.class]) {
+    auto* credential = (ASAuthorizationPlatformPublicKeyCredentialAssertion*)
+        authorization.credential;
+    NSString* id64 = base64urlEncode(credential.credentialID);
+    credentialId = std::string(id64.UTF8String);
+    response[@"clientDataJSON"] = base64urlEncode(credential.rawClientDataJSON);
+    response[@"authenticatorData"] = base64urlEncode(credential.rawAuthenticatorData);
+    response[@"signature"] = base64urlEncode(credential.signature);
+    response[@"userHandle"] = base64urlEncode(credential.userID);
+    if (credential.prf != nil) {
+      NSMutableDictionary<NSString*, id>* results =
+          [@{ @"first" : base64urlEncode(credential.prf.first) } mutableCopy];
+      if (credential.prf.second != nil) {
+        results[@"second"] = base64urlEncode(credential.prf.second);
+      }
+      extensions[@"prf"] = @{ @"results" : results };
+    }
+  } else {
+    [self finish:qntx::PasskeyResult{qntx::PasskeyStatus::failed, {}}];
+    return;
+  }
+  std::string json = jsonString(@{
+    @"id" : @(credentialId.c_str()),
+    @"rawId" : @(credentialId.c_str()),
+    @"type" : @"public-key",
+    @"authenticatorAttachment" : @"platform",
+    @"response" : response,
+    @"clientExtensionResults" : extensions,
+  });
+  if (json.empty()) {
+    [self finish:qntx::PasskeyResult{qntx::PasskeyStatus::failed, {}}];
+    return;
+  }
+  [self finish:qntx::PasskeyResult{qntx::PasskeyStatus::ok, std::move(json)}];
+}
+
+- (void)authorizationController:(ASAuthorizationController*)controller
+           didCompleteWithError:(NSError*)error {
+  qntx::PasskeyStatus status = qntx::PasskeyStatus::failed;
+  if ([error.domain isEqualToString:ASAuthorizationErrorDomain]) {
+    switch (error.code) {
+      case ASAuthorizationErrorCanceled:
+        status = qntx::PasskeyStatus::cancelled;
+        break;
+      case ASAuthorizationErrorNotHandled:
+      case ASAuthorizationErrorFailed:
+      case ASAuthorizationErrorNotInteractive:
+        status = qntx::PasskeyStatus::unavailable;
+        break;
+      default:
+        // 1010 = ASAuthorizationErrorDeviceNotConfiguredForPasskeyCreation,
+        // compared raw so the iOS 19 symbol needs no availability guard.
+        status = error.code == 1010 ? qntx::PasskeyStatus::unavailable
+                                    : qntx::PasskeyStatus::failed;
+    }
+  }
+  // Domain and code only — userInfo/localizedDescription can name the account.
+  os_log_error(
+      passkeyLog(),
+      "passkey ceremony failed: %{public}@/%ld",
+      error.domain,
+      static_cast<long>(error.code));
+  [self finish:qntx::PasskeyResult{status, {}}];
+}
+
+@end
+
+namespace {
+
+ASAuthorizationPlatformPublicKeyCredentialRegistrationRequest* _Nullable registrationRequest(
+    NSDictionary<NSString*, id>* request) API_AVAILABLE(ios(18.0)) {
+  NSDictionary* rp = dictOf(request[@"rp"]);
+  NSDictionary* user = dictOf(request[@"user"]);
+  NSString* rpId = stringOf(rp[@"id"]);
+  NSString* name = stringOf(user[@"name"]);
+  NSData* challenge = base64urlDecode(stringOf(request[@"challenge"]));
+  NSData* userId = base64urlDecode(stringOf(user[@"id"]));
+  ASAuthorizationPublicKeyCredentialPRFAssertionInputValues* eval = prfEval(request);
+  if (rpId == nil || name == nil || challenge == nil || userId == nil || eval == nil) {
+    return nil;
+  }
+  auto* provider = [[ASAuthorizationPlatformPublicKeyCredentialProvider alloc]
+      initWithRelyingPartyIdentifier:rpId];
+  auto* platform = [provider createCredentialRegistrationRequestWithChallenge:challenge
+                                                                       name:name
+                                                                     userID:userId];
+  platform.userVerificationPreference =
+      ASAuthorizationPublicKeyCredentialUserVerificationPreferenceRequired;
+  platform.attestationPreference = ASAuthorizationPublicKeyCredentialAttestationKindNone;
+  platform.prf = [[ASAuthorizationPublicKeyCredentialPRFRegistrationInput alloc]
+      initWithInputValues:eval];
+  return platform;
+}
+
+ASAuthorizationPlatformPublicKeyCredentialAssertionRequest* _Nullable assertionRequest(
+    NSDictionary<NSString*, id>* request) API_AVAILABLE(ios(18.0)) {
+  NSString* rpId = stringOf(request[@"rpId"]);
+  NSData* challenge = base64urlDecode(stringOf(request[@"challenge"]));
+  ASAuthorizationPublicKeyCredentialPRFAssertionInputValues* eval = prfEval(request);
+  if (rpId == nil || challenge == nil || eval == nil) {
+    return nil;
+  }
+  auto* provider = [[ASAuthorizationPlatformPublicKeyCredentialProvider alloc]
+      initWithRelyingPartyIdentifier:rpId];
+  auto* platform = [provider createCredentialAssertionRequestWithChallenge:challenge];
+  if (request[@"allowCredentials"] != nil) {
+    NSArray* allow = arrayOf(request[@"allowCredentials"]);
+    if (allow == nil) {
+      return nil;
+    }
+    NSMutableArray<ASAuthorizationPlatformPublicKeyCredentialDescriptor*>* descriptors =
+        [NSMutableArray arrayWithCapacity:allow.count];
+    for (id item in allow) {
+      NSData* credentialId = base64urlDecode(stringOf(dictOf(item)[@"id"]));
+      if (credentialId == nil) {
+        return nil;
+      }
+      [descriptors addObject:[[ASAuthorizationPlatformPublicKeyCredentialDescriptor alloc]
+                                 initWithCredentialID:credentialId]];
+    }
+    platform.allowedCredentials = descriptors;
+  }
+  platform.userVerificationPreference =
+      ASAuthorizationPublicKeyCredentialUserVerificationPreferenceRequired;
+  platform.prf = [[ASAuthorizationPublicKeyCredentialPRFAssertionInput alloc]
+      initWithInputValues:eval
+      perCredentialInputValues:nil];
+  return platform;
+}
+
+// Claims the single in-flight slot and runs the ceremony (main thread). A nil
+// request means the JSON was malformed, a busy slot a second concurrent call.
+// AuthenticationServices may deliver the delegate callback synchronously, so
+// the mutex never spans a call into it — or into `done`.
+void run(ASAuthorizationRequest* _Nullable request, qntx::PasskeyDone done)
+    API_AVAILABLE(ios(18.0)) {
+  if (request == nil) {
+    done(qntx::PasskeyResult{qntx::PasskeyStatus::failed, {}});
+    return;
+  }
+  QntxPasskeySession* session;
+  {
+    std::lock_guard<std::mutex> lock(g_mutex);
+    if (g_session == nil) {
+      session = g_session = [[QntxPasskeySession alloc] initWithDone:std::move(done)
+                                                            request:request];
+    } else {
+      session = nil;
+    }
+  }
+  if (session == nil) {
+    done(qntx::PasskeyResult{qntx::PasskeyStatus::failed, {}});
+    return;
+  }
+  [session start];
+}
+
+} // namespace
+
 namespace qntx {
 
-void passkeyCreate(std::string, PasskeyDone done) {
-  done(PasskeyResult{PasskeyStatus::unavailable, {}});
+void passkeyCreate(std::string requestJson, PasskeyDone done) {
+  auto json = std::make_shared<std::string>(std::move(requestJson));
+  auto finish = std::make_shared<PasskeyDone>(std::move(done));
+  dispatch_async(dispatch_get_main_queue(), ^{
+    if (@available(iOS 18.0, *)) {
+      run(registrationRequest(jsonOf(*json)), std::move(*finish));
+    } else {
+      (*finish)(PasskeyResult{PasskeyStatus::unavailable, {}});
+    }
+  });
 }
 
-void passkeyGet(std::string, PasskeyDone done) {
-  done(PasskeyResult{PasskeyStatus::unavailable, {}});
+void passkeyGet(std::string requestJson, PasskeyDone done) {
+  auto json = std::make_shared<std::string>(std::move(requestJson));
+  auto finish = std::make_shared<PasskeyDone>(std::move(done));
+  dispatch_async(dispatch_get_main_queue(), ^{
+    if (@available(iOS 18.0, *)) {
+      run(assertionRequest(jsonOf(*json)), std::move(*finish));
+    } else {
+      (*finish)(PasskeyResult{PasskeyStatus::unavailable, {}});
+    }
+  });
 }
 
-void passkeyCancel() {}
+void passkeyCancel() {
+  dispatch_async(dispatch_get_main_queue(), ^{
+    if (@available(iOS 18.0, *)) {
+      QntxPasskeySession* session;
+      {
+        std::lock_guard<std::mutex> lock(g_mutex);
+        session = g_session;
+      }
+      // A parked wait completes `cancelled`; a running ceremony is cancelled —
+      // both answer through finish:, so this runs off the lock.
+      [session cancelCeremony];
+    }
+  });
+}
 
 } // namespace qntx

package/dist/index.d.mts

@@ -1,7 +1,6 @@
 import { AutoLockPolicy, PasskeyConfig, Wallet } from "@qntx/wallet";
 import { MainPort } from "@qntx/wallet/host";
 import { ProtocolValue } from "@qntx/wallet/protocol";
-//#region src/host.d.ts
 type KernelExitReason = "locked" | "crashed" | "integrity" | "background";
 /**
  * Structural mirror of the Nitro `KernelHost` spec (W2b registers the real hybrid object; tests
@@ -15,8 +14,6 @@ type KernelHostLike = {
   readonly lock: () => void;
 };
 export declare function spawnFromHost(host: KernelHostLike, backgroundLockSeconds: number): MainPort;
-//#endregion
-//#region src/cbor.d.ts
 export declare const FRAME_MAX_BYTES: number;
 type CborErrorCode = "oversize" | "truncated" | "malformed" | "float" | "unsafe-int" | "bigint" | "undefined" | "tag" | "non-string-key" | "duplicate-key" | "indefinite" | "bad-type";
 export declare class CborError extends Error {
@@ -27,8 +24,6 @@ export declare class CborError extends Error {
 export declare function encodeFrame(value: ProtocolValue): ArrayBuffer;
 /** Decode a CBOR frame back to a `ProtocolValue`, enforcing the 1 MiB cap and strictness. */
 export declare function decodeFrame(frame: ArrayBuffer | Uint8Array): ProtocolValue;
-//#endregion
-//#region src/index.d.ts
 export type NativeWalletOptions = {
   readonly passkey: PasskeyConfig;
   readonly autoLock: AutoLockPolicy;
@@ -39,6 +34,5 @@ export type NativeWalletOptions = {
   readonly host?: KernelHostLike;
 };
 export declare function createNativeWallet(options: NativeWalletOptions): Promise<Wallet>;
-//#endregion
 export type { CborErrorCode, KernelExitReason, KernelHostLike };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import { WalletError } from "@qntx/wallet";
 import { connectKernel } from "@qntx/wallet/host";
 import { decode, encode } from "cborg";
-//#region src/cbor.ts
+// src/cbor.ts
 /**
 * CBOR framing for the kernel channel. `ProtocolValue` travels main-side ↔ kernel-side as CBOR; the
 * C++ layer moves bytes only. Decode is deliberately strict: floats, unsafe integers, undefined,
@@ -83,8 +83,7 @@ function decodeFrame(frame) {
 		throw classify(error);
 	}
 }
-//#endregion
-//#region src/host.ts
+// src/host.ts
 function spawnFromHost(host, backgroundLockSeconds) {
 	const exitHandlers = /* @__PURE__ */ new Set();
 	let exited = false;
@@ -135,8 +134,7 @@ function spawnFromHost(host, backgroundLockSeconds) {
 		}
 	};
 }
-//#endregion
-//#region src/index.ts
+// src/index.ts
 /**
 * `@qntx/wallet-native`: the RN host entry. `createNativeWallet` adapts a `KernelHost` (Nitro
 * hybrid from W2b, or any object with the same shape) to the wallet `connectKernel` entry — the
@@ -164,7 +162,6 @@ async function createNativeWallet(options) {
 		setTimer
 	});
 }
-//#endregion
 export { CborError, FRAME_MAX_BYTES, createNativeWallet, decodeFrame, encodeFrame, spawnFromHost };
 
 //# sourceMappingURL=index.mjs.map