@qntx/wallet-native 0.6.0 → 0.7.0

package/WalletNative.podspec

@@ -59,7 +59,7 @@ Pod::Spec.new do |s|
 
   # The kernel's backends.spark binds the qs_* C ABI; the prebuilt
   # QntxSpark.xcframework ships inside the SparkNative pod.
-  s.frameworks = "LocalAuthentication", "Security"
+  s.frameworks = "LocalAuthentication", "Security", "AuthenticationServices", "UIKit"
 
   s.dependency 'NostrNative'
   s.dependency 'SparkNative'

package/cpp/host/Passkey.hpp

@@ -7,10 +7,11 @@ namespace qntx {
 
 // The platform passkey authenticator behind `__qntx.passkey` (W6). The kernel
 // builds the WebAuthn request JSON and parses the response JSON itself; the
-// platform only runs the system ceremony. Android: Credential Manager. iOS:
-// not yet available (W6c needs an associated domain) — every call completes
-// `unavailable`. Each function has exactly one strong definition per platform
-// (PasskeyAndroid.cpp, PasskeyIos.mm); host tests link a fake.
+// platform only runs the system ceremony. Android: Credential Manager. iOS
+// (W6c): ASAuthorization platform passkeys with the PRF extension on iOS 18+,
+// unavailable below or without the associated domain. Each function has
+// exactly one strong definition per platform (PasskeyAndroid.cpp,
+// PasskeyIos.mm); host tests link a fake.
 
 // The binding maps each status to the kernel's error code: cancelled →
 // "cancelled", unavailable → "factor-unavailable", failed → "unavailable".

package/cpp/platform/PasskeyIos.mm

@@ -1,20 +1,487 @@
-// iOS passkey authenticator: not available yet. Native passkeys need the
-// app's associated domain (webcredentials), which the current free signing
-// team cannot provision; W6c implements ASAuthorization with PRF once a paid
-// team exists. Until then every ceremony reports `unavailable`, which the
-// kernel surfaces as factor-unavailable (no passkey wallet on this platform).
+// iOS passkey authenticator (W6c): ASAuthorization platform passkeys with the
+// PRF extension (iOS 18+). The kernel builds the WebAuthn request JSON and
+// parses the response JSON itself; this file only reads the fields the system
+// ceremony needs, runs one ASAuthorizationController at a time and repacks the
+// credential into the browser `toJSON()` shape the kernel parses. A ceremony
+// requested while the scene is still activating — e.g. right after a system
+// Face ID prompt resigns it — waits for UISceneDidActivateNotification instead
+// of failing before any sheet appears. PRF outputs are encoded straight into
+// the response JSON — no copies are kept and they are never logged.
 #include "../host/Passkey.hpp"
 
+#import <AuthenticationServices/AuthenticationServices.h>
+#import <Foundation/Foundation.h>
+#import <UIKit/UIKit.h>
+#import <os/log.h>
+
+#include <mutex>
+#include <string>
+#include <utility>
+
+@class QntxPasskeySession;
+
+namespace {
+
+os_log_t passkeyLog() {
+  static os_log_t log = os_log_create("org.qntx.wallet", "passkey");
+  return log;
+}
+
+// The session — and the controller it owns once the ceremony actually runs —
+// stays alive only while a call is in flight (controller.delegate is weak).
+// It is touched on the main thread only; the mutex pairs the one-in-flight
+// check with the clear on completion. A parked session (scene not yet active)
+// has no controller yet, so the busy check looks at the session.
+std::mutex g_mutex;
+QntxPasskeySession* g_session = nil;
+
+// Strict base64url decode (padding restored); nil on any invalid character.
+NSData* _Nullable base64urlDecode(NSString* _Nullable value) {
+  if (value == nil) {
+    return nil;
+  }
+  NSMutableString* standard = [NSMutableString stringWithCapacity:value.length + 3];
+  for (NSUInteger i = 0; i < value.length; i += 1) {
+    const unichar c = [value characterAtIndex:i];
+    if (c == '-') {
+      [standard appendString:@"+"];
+    } else if (c == '_') {
+      [standard appendString:@"/"];
+    } else if ((c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9')) {
+      [standard appendFormat:@"%C", c];
+    } else {
+      return nil;
+    }
+  }
+  if (standard.length % 4 == 1) {
+    return nil;
+  }
+  while (standard.length % 4 != 0) {
+    [standard appendString:@"="];
+  }
+  return [[NSData alloc] initWithBase64EncodedString:standard options:0];
+}
+
+NSString* base64urlEncode(NSData* data) {
+  NSString* standard = [data base64EncodedStringWithOptions:0];
+  standard = [standard stringByReplacingOccurrencesOfString:@"+" withString:@"-"];
+  standard = [standard stringByReplacingOccurrencesOfString:@"/" withString:@"_"];
+  while ([standard hasSuffix:@"="]) {
+    standard = [standard substringToIndex:standard.length - 1];
+  }
+  return standard;
+}
+
+NSDictionary<NSString*, id>* _Nullable dictOf(_Nullable id value) {
+  return [value isKindOfClass:NSDictionary.class] ? (NSDictionary<NSString*, id>*)value : nil;
+}
+
+NSString* _Nullable stringOf(_Nullable id value) {
+  return [value isKindOfClass:NSString.class] ? (NSString*)value : nil;
+}
+
+NSArray* _Nullable arrayOf(_Nullable id value) {
+  return [value isKindOfClass:NSArray.class] ? (NSArray*)value : nil;
+}
+
+NSDictionary<NSString*, id>* _Nullable jsonOf(const std::string& json) {
+  NSData* data = [NSData dataWithBytes:json.data() length:json.size()];
+  return dictOf([NSJSONSerialization JSONObjectWithData:data options:0 error:nil]);
+}
+
+// The extensions.prf.eval block the kernel always sends; nil when missing or
+// malformed (eval.second is optional).
+ASAuthorizationPublicKeyCredentialPRFAssertionInputValues* _Nullable prfEval(
+    NSDictionary<NSString*, id>* request) API_AVAILABLE(ios(18.0)) {
+  NSDictionary* eval = dictOf(dictOf(dictOf(request[@"extensions"])[@"prf"])[@"eval"]);
+  NSData* first = base64urlDecode(stringOf(eval[@"first"]));
+  if (first == nil) {
+    return nil;
+  }
+  NSData* second = nil;
+  if (eval[@"second"] != nil) {
+    second = base64urlDecode(stringOf(eval[@"second"]));
+    if (second == nil) {
+      return nil;
+    }
+  }
+  return [[ASAuthorizationPublicKeyCredentialPRFAssertionInputValues alloc]
+      initWithSaltInput1:first
+              saltInput2:second];
+}
+
+ASPresentationAnchor _Nullable activeKeyWindow() {
+  for (UIScene* scene in UIApplication.sharedApplication.connectedScenes) {
+    if ([scene isKindOfClass:UIWindowScene.class] &&
+        scene.activationState == UISceneActivationStateForegroundActive) {
+      UIWindow* window = ((UIWindowScene*)scene).keyWindow;
+      if (window != nil) {
+        return window;
+      }
+    }
+  }
+  return nil;
+}
+
+// A window scene on its way to the foreground — e.g. right after a system
+// Face ID prompt resigns the app's scene. Once it activates, its key window
+// can anchor the passkey sheet.
+BOOL hasInactiveWindowScene() {
+  for (UIScene* scene in UIApplication.sharedApplication.connectedScenes) {
+    if ([scene isKindOfClass:UIWindowScene.class] &&
+        scene.activationState == UISceneActivationStateForegroundInactive &&
+        ((UIWindowScene*)scene).keyWindow != nil) {
+      return YES;
+    }
+  }
+  return NO;
+}
+
+std::string jsonString(NSDictionary<NSString*, id>* json) {
+  NSData* data = [NSJSONSerialization dataWithJSONObject:json options:0 error:nil];
+  if (data == nil) {
+    return {};
+  }
+  return std::string(static_cast<const char*>(data.bytes), data.length);
+}
+
+} // namespace
+
+API_AVAILABLE(ios(18.0))
+@interface QntxPasskeySession : NSObject <ASAuthorizationControllerDelegate,
+                                          ASAuthorizationControllerPresentationContextProviding>
+- (instancetype)initWithDone:(qntx::PasskeyDone)done
+                     request:(ASAuthorizationRequest*)request;
+// Runs the ceremony now, or parks it until the window scene activates.
+- (void)start;
+// Cancels a parked wait or the running ceremony; completes through finish:.
+- (void)cancelCeremony;
+- (void)finish:(qntx::PasskeyResult)result;
+@end
+
+@implementation QntxPasskeySession {
+  qntx::PasskeyDone _done;
+  ASAuthorizationRequest* _request;
+  ASPresentationAnchor _anchor;
+  ASAuthorizationController* _controller;
+  NSObject* _observer;
+}
+
+- (instancetype)initWithDone:(qntx::PasskeyDone)done
+                     request:(ASAuthorizationRequest*)request {
+  self = [super init];
+  if (self != nil) {
+    _done = std::move(done);
+    _request = request;
+  }
+  return self;
+}
+
+// A ceremony started while the scene is still activating fails before any
+// sheet appears — like Keystore.kt's whenResumed, park on an inactive window
+// scene and run it at UISceneDidActivateNotification. A scene that is fully
+// absent still reports `unavailable`.
+- (void)start {
+  ASPresentationAnchor anchor = activeKeyWindow();
+  if (anchor != nil) {
+    [self performWithAnchor:anchor];
+    return;
+  }
+  if (hasInactiveWindowScene()) {
+    _observer = [NSNotificationCenter.defaultCenter
+        addObserverForName:UISceneDidActivateNotification
+                    object:nil
+                     queue:NSOperationQueue.mainQueue
+                usingBlock:^(NSNotification*) {
+                  [self sceneActivated];
+                }];
+    return;
+  }
+  [self finish:qntx::PasskeyResult{qntx::PasskeyStatus::unavailable, {}}];
+}
+
+- (void)sceneActivated {
+  [NSNotificationCenter.defaultCenter removeObserver:_observer];
+  _observer = nil;
+  ASPresentationAnchor anchor = activeKeyWindow();
+  if (anchor == nil) {
+    [self finish:qntx::PasskeyResult{qntx::PasskeyStatus::unavailable, {}}];
+    return;
+  }
+  [self performWithAnchor:anchor];
+}
+
+- (void)performWithAnchor:(ASPresentationAnchor)anchor {
+  _anchor = anchor;
+  _controller =
+      [[ASAuthorizationController alloc] initWithAuthorizationRequests:@[ _request ]];
+  _controller.delegate = self;
+  _controller.presentationContextProvider = self;
+  [_controller performRequests];
+}
+
+- (void)cancelCeremony {
+  if (_observer != nil) {
+    [NSNotificationCenter.defaultCenter removeObserver:_observer];
+    _observer = nil;
+    [self finish:qntx::PasskeyResult{qntx::PasskeyStatus::cancelled, {}}];
+    return;
+  }
+  [_controller cancel];
+}
+
+// Runs exactly once per session; clears the in-flight session before
+// invoking the kernel completion.
+- (void)finish:(qntx::PasskeyResult)result {
+  qntx::PasskeyDone done;
+  {
+    std::lock_guard<std::mutex> lock(g_mutex);
+    if (g_session != self) {
+      return;
+    }
+    g_session = nil;
+    done = std::move(_done);
+    _done = nullptr;
+  }
+  if (_observer != nil) {
+    [NSNotificationCenter.defaultCenter removeObserver:_observer];
+    _observer = nil;
+  }
+  done(std::move(result));
+}
+
+- (ASPresentationAnchor)presentationAnchorForAuthorizationController:
+    (ASAuthorizationController*)controller {
+  return _anchor;
+}
+
+- (void)authorizationController:(ASAuthorizationController*)controller
+    didCompleteWithAuthorization:(ASAuthorization*)authorization {
+  NSMutableDictionary<NSString*, id>* extensions = [NSMutableDictionary new];
+  NSMutableDictionary<NSString*, id>* response = [NSMutableDictionary new];
+  std::string credentialId;
+  if ([authorization.credential
+          isKindOfClass:ASAuthorizationPlatformPublicKeyCredentialRegistration.class]) {
+    auto* credential = (ASAuthorizationPlatformPublicKeyCredentialRegistration*)
+        authorization.credential;
+    NSString* id64 = base64urlEncode(credential.credentialID);
+    credentialId = std::string(id64.UTF8String);
+    response[@"clientDataJSON"] = base64urlEncode(credential.rawClientDataJSON);
+    if (credential.rawAttestationObject != nil) {
+      response[@"attestationObject"] = base64urlEncode(credential.rawAttestationObject);
+    }
+    if (credential.prf != nil) {
+      NSMutableDictionary<NSString*, id>* prf =
+          [@{ @"enabled" : @(credential.prf.isSupported) } mutableCopy];
+      if (credential.prf.first != nil) {
+        NSMutableDictionary<NSString*, id>* results =
+            [@{ @"first" : base64urlEncode(credential.prf.first) } mutableCopy];
+        if (credential.prf.second != nil) {
+          results[@"second"] = base64urlEncode(credential.prf.second);
+        }
+        prf[@"results"] = results;
+      }
+      extensions[@"prf"] = prf;
+    }
+  } else if ([authorization.credential
+                 isKindOfClass:ASAuthorizationPlatformPublicKeyCredentialAssertion.class]) {
+    auto* credential = (ASAuthorizationPlatformPublicKeyCredentialAssertion*)
+        authorization.credential;
+    NSString* id64 = base64urlEncode(credential.credentialID);
+    credentialId = std::string(id64.UTF8String);
+    response[@"clientDataJSON"] = base64urlEncode(credential.rawClientDataJSON);
+    response[@"authenticatorData"] = base64urlEncode(credential.rawAuthenticatorData);
+    response[@"signature"] = base64urlEncode(credential.signature);
+    response[@"userHandle"] = base64urlEncode(credential.userID);
+    if (credential.prf != nil) {
+      NSMutableDictionary<NSString*, id>* results =
+          [@{ @"first" : base64urlEncode(credential.prf.first) } mutableCopy];
+      if (credential.prf.second != nil) {
+        results[@"second"] = base64urlEncode(credential.prf.second);
+      }
+      extensions[@"prf"] = @{ @"results" : results };
+    }
+  } else {
+    [self finish:qntx::PasskeyResult{qntx::PasskeyStatus::failed, {}}];
+    return;
+  }
+  std::string json = jsonString(@{
+    @"id" : @(credentialId.c_str()),
+    @"rawId" : @(credentialId.c_str()),
+    @"type" : @"public-key",
+    @"authenticatorAttachment" : @"platform",
+    @"response" : response,
+    @"clientExtensionResults" : extensions,
+  });
+  if (json.empty()) {
+    [self finish:qntx::PasskeyResult{qntx::PasskeyStatus::failed, {}}];
+    return;
+  }
+  [self finish:qntx::PasskeyResult{qntx::PasskeyStatus::ok, std::move(json)}];
+}
+
+- (void)authorizationController:(ASAuthorizationController*)controller
+           didCompleteWithError:(NSError*)error {
+  qntx::PasskeyStatus status = qntx::PasskeyStatus::failed;
+  if ([error.domain isEqualToString:ASAuthorizationErrorDomain]) {
+    switch (error.code) {
+      case ASAuthorizationErrorCanceled:
+        status = qntx::PasskeyStatus::cancelled;
+        break;
+      case ASAuthorizationErrorNotHandled:
+      case ASAuthorizationErrorFailed:
+      case ASAuthorizationErrorNotInteractive:
+        status = qntx::PasskeyStatus::unavailable;
+        break;
+      default:
+        // 1010 = ASAuthorizationErrorDeviceNotConfiguredForPasskeyCreation,
+        // compared raw so the iOS 19 symbol needs no availability guard.
+        status = error.code == 1010 ? qntx::PasskeyStatus::unavailable
+                                    : qntx::PasskeyStatus::failed;
+    }
+  }
+  // Domain and code only — userInfo/localizedDescription can name the account.
+  os_log_error(
+      passkeyLog(),
+      "passkey ceremony failed: %{public}@/%ld",
+      error.domain,
+      static_cast<long>(error.code));
+  [self finish:qntx::PasskeyResult{status, {}}];
+}
+
+@end
+
+namespace {
+
+ASAuthorizationPlatformPublicKeyCredentialRegistrationRequest* _Nullable registrationRequest(
+    NSDictionary<NSString*, id>* request) API_AVAILABLE(ios(18.0)) {
+  NSDictionary* rp = dictOf(request[@"rp"]);
+  NSDictionary* user = dictOf(request[@"user"]);
+  NSString* rpId = stringOf(rp[@"id"]);
+  NSString* name = stringOf(user[@"name"]);
+  NSData* challenge = base64urlDecode(stringOf(request[@"challenge"]));
+  NSData* userId = base64urlDecode(stringOf(user[@"id"]));
+  ASAuthorizationPublicKeyCredentialPRFAssertionInputValues* eval = prfEval(request);
+  if (rpId == nil || name == nil || challenge == nil || userId == nil || eval == nil) {
+    return nil;
+  }
+  auto* provider = [[ASAuthorizationPlatformPublicKeyCredentialProvider alloc]
+      initWithRelyingPartyIdentifier:rpId];
+  auto* platform = [provider createCredentialRegistrationRequestWithChallenge:challenge
+                                                                       name:name
+                                                                     userID:userId];
+  platform.userVerificationPreference =
+      ASAuthorizationPublicKeyCredentialUserVerificationPreferenceRequired;
+  platform.attestationPreference = ASAuthorizationPublicKeyCredentialAttestationKindNone;
+  platform.prf = [[ASAuthorizationPublicKeyCredentialPRFRegistrationInput alloc]
+      initWithInputValues:eval];
+  return platform;
+}
+
+ASAuthorizationPlatformPublicKeyCredentialAssertionRequest* _Nullable assertionRequest(
+    NSDictionary<NSString*, id>* request) API_AVAILABLE(ios(18.0)) {
+  NSString* rpId = stringOf(request[@"rpId"]);
+  NSData* challenge = base64urlDecode(stringOf(request[@"challenge"]));
+  ASAuthorizationPublicKeyCredentialPRFAssertionInputValues* eval = prfEval(request);
+  if (rpId == nil || challenge == nil || eval == nil) {
+    return nil;
+  }
+  auto* provider = [[ASAuthorizationPlatformPublicKeyCredentialProvider alloc]
+      initWithRelyingPartyIdentifier:rpId];
+  auto* platform = [provider createCredentialAssertionRequestWithChallenge:challenge];
+  if (request[@"allowCredentials"] != nil) {
+    NSArray* allow = arrayOf(request[@"allowCredentials"]);
+    if (allow == nil) {
+      return nil;
+    }
+    NSMutableArray<ASAuthorizationPlatformPublicKeyCredentialDescriptor*>* descriptors =
+        [NSMutableArray arrayWithCapacity:allow.count];
+    for (id item in allow) {
+      NSData* credentialId = base64urlDecode(stringOf(dictOf(item)[@"id"]));
+      if (credentialId == nil) {
+        return nil;
+      }
+      [descriptors addObject:[[ASAuthorizationPlatformPublicKeyCredentialDescriptor alloc]
+                                 initWithCredentialID:credentialId]];
+    }
+    platform.allowedCredentials = descriptors;
+  }
+  platform.userVerificationPreference =
+      ASAuthorizationPublicKeyCredentialUserVerificationPreferenceRequired;
+  platform.prf = [[ASAuthorizationPublicKeyCredentialPRFAssertionInput alloc]
+      initWithInputValues:eval
+      perCredentialInputValues:nil];
+  return platform;
+}
+
+// Claims the single in-flight slot and runs the ceremony (main thread). A nil
+// request means the JSON was malformed, a busy slot a second concurrent call.
+// AuthenticationServices may deliver the delegate callback synchronously, so
+// the mutex never spans a call into it — or into `done`.
+void run(ASAuthorizationRequest* _Nullable request, qntx::PasskeyDone done)
+    API_AVAILABLE(ios(18.0)) {
+  if (request == nil) {
+    done(qntx::PasskeyResult{qntx::PasskeyStatus::failed, {}});
+    return;
+  }
+  QntxPasskeySession* session;
+  {
+    std::lock_guard<std::mutex> lock(g_mutex);
+    if (g_session == nil) {
+      session = g_session = [[QntxPasskeySession alloc] initWithDone:std::move(done)
+                                                            request:request];
+    } else {
+      session = nil;
+    }
+  }
+  if (session == nil) {
+    done(qntx::PasskeyResult{qntx::PasskeyStatus::failed, {}});
+    return;
+  }
+  [session start];
+}
+
+} // namespace
+
 namespace qntx {
 
-void passkeyCreate(std::string, PasskeyDone done) {
-  done(PasskeyResult{PasskeyStatus::unavailable, {}});
+void passkeyCreate(std::string requestJson, PasskeyDone done) {
+  auto json = std::make_shared<std::string>(std::move(requestJson));
+  auto finish = std::make_shared<PasskeyDone>(std::move(done));
+  dispatch_async(dispatch_get_main_queue(), ^{
+    if (@available(iOS 18.0, *)) {
+      run(registrationRequest(jsonOf(*json)), std::move(*finish));
+    } else {
+      (*finish)(PasskeyResult{PasskeyStatus::unavailable, {}});
+    }
+  });
 }
 
-void passkeyGet(std::string, PasskeyDone done) {
-  done(PasskeyResult{PasskeyStatus::unavailable, {}});
+void passkeyGet(std::string requestJson, PasskeyDone done) {
+  auto json = std::make_shared<std::string>(std::move(requestJson));
+  auto finish = std::make_shared<PasskeyDone>(std::move(done));
+  dispatch_async(dispatch_get_main_queue(), ^{
+    if (@available(iOS 18.0, *)) {
+      run(assertionRequest(jsonOf(*json)), std::move(*finish));
+    } else {
+      (*finish)(PasskeyResult{PasskeyStatus::unavailable, {}});
+    }
+  });
 }
 
-void passkeyCancel() {}
+void passkeyCancel() {
+  dispatch_async(dispatch_get_main_queue(), ^{
+    if (@available(iOS 18.0, *)) {
+      QntxPasskeySession* session;
+      {
+        std::lock_guard<std::mutex> lock(g_mutex);
+        session = g_session;
+      }
+      // A parked wait completes `cancelled`; a running ceremony is cancelled —
+      // both answer through finish:, so this runs off the lock.
+      [session cancelCeremony];
+    }
+  });
+}
 
 } // namespace qntx

package/dist/index.d.mts

@@ -1,7 +1,6 @@
 import { AutoLockPolicy, PasskeyConfig, Wallet } from "@qntx/wallet";
 import { MainPort } from "@qntx/wallet/host";
 import { ProtocolValue } from "@qntx/wallet/protocol";
-//#region src/host.d.ts
 type KernelExitReason = "locked" | "crashed" | "integrity" | "background";
 /**
  * Structural mirror of the Nitro `KernelHost` spec (W2b registers the real hybrid object; tests
@@ -15,8 +14,6 @@ type KernelHostLike = {
   readonly lock: () => void;
 };
 export declare function spawnFromHost(host: KernelHostLike, backgroundLockSeconds: number): MainPort;
-//#endregion
-//#region src/cbor.d.ts
 export declare const FRAME_MAX_BYTES: number;
 type CborErrorCode = "oversize" | "truncated" | "malformed" | "float" | "unsafe-int" | "bigint" | "undefined" | "tag" | "non-string-key" | "duplicate-key" | "indefinite" | "bad-type";
 export declare class CborError extends Error {
@@ -27,8 +24,6 @@ export declare class CborError extends Error {
 export declare function encodeFrame(value: ProtocolValue): ArrayBuffer;
 /** Decode a CBOR frame back to a `ProtocolValue`, enforcing the 1 MiB cap and strictness. */
 export declare function decodeFrame(frame: ArrayBuffer | Uint8Array): ProtocolValue;
-//#endregion
-//#region src/index.d.ts
 export type NativeWalletOptions = {
   readonly passkey: PasskeyConfig;
   readonly autoLock: AutoLockPolicy;
@@ -39,6 +34,5 @@ export type NativeWalletOptions = {
   readonly host?: KernelHostLike;
 };
 export declare function createNativeWallet(options: NativeWalletOptions): Promise<Wallet>;
-//#endregion
 export type { CborErrorCode, KernelExitReason, KernelHostLike };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import { WalletError } from "@qntx/wallet";
 import { connectKernel } from "@qntx/wallet/host";
 import { decode, encode } from "cborg";
-//#region src/cbor.ts
+// src/cbor.ts
 /**
 * CBOR framing for the kernel channel. `ProtocolValue` travels main-side ↔ kernel-side as CBOR; the
 * C++ layer moves bytes only. Decode is deliberately strict: floats, unsafe integers, undefined,
@@ -83,8 +83,7 @@ function decodeFrame(frame) {
 		throw classify(error);
 	}
 }
-//#endregion
-//#region src/host.ts
+// src/host.ts
 function spawnFromHost(host, backgroundLockSeconds) {
 	const exitHandlers = /* @__PURE__ */ new Set();
 	let exited = false;
@@ -135,8 +134,7 @@ function spawnFromHost(host, backgroundLockSeconds) {
 		}
 	};
 }
-//#endregion
-//#region src/index.ts
+// src/index.ts
 /**
 * `@qntx/wallet-native`: the RN host entry. `createNativeWallet` adapts a `KernelHost` (Nitro
 * hybrid from W2b, or any object with the same shape) to the wallet `connectKernel` entry — the
@@ -164,7 +162,6 @@ async function createNativeWallet(options) {
 		setTimer
 	});
 }
-//#endregion
 export { CborError, FRAME_MAX_BYTES, createNativeWallet, decodeFrame, encodeFrame, spawnFromHost };
 
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/cbor.ts","../src/host.ts","../src/index.ts"],"sourcesContent":["/**\n * CBOR framing for the kernel channel. `ProtocolValue` travels main-side ↔ kernel-side as CBOR; the\n * C++ layer moves bytes only. Decode is deliberately strict: floats, unsafe integers, undefined,\n * tags, non-string map keys, duplicate keys and indefinite-length items are all rejected — the wire\n * format carries exactly one value domain.\n */\nimport { decode, encode } from \"cborg\";\nimport type { DecodeOptions } from \"cborg\";\n\nimport type { ProtocolValue } from \"@qntx/wallet/protocol\";\n\nexport const FRAME_MAX_BYTES: number = 1024 * 1024;\n\nexport type CborErrorCode =\n  | \"oversize\"\n  | \"truncated\"\n  | \"malformed\"\n  | \"float\"\n  | \"unsafe-int\"\n  | \"bigint\"\n  | \"undefined\"\n  | \"tag\"\n  | \"non-string-key\"\n  | \"duplicate-key\"\n  | \"indefinite\"\n  | \"bad-type\";\n\nexport class CborError extends Error {\n  readonly code: CborErrorCode;\n  constructor(code: CborErrorCode, message: string) {\n    super(message);\n    this.name = \"CborError\";\n    this.code = code;\n  }\n}\n\nconst DECODE_OPTIONS: DecodeOptions = {\n  strict: true,\n  useMaps: false,\n  rejectDuplicateMapKeys: true,\n  allowUndefined: false,\n  allowIndefinite: false,\n  allowNaN: false,\n  allowInfinity: false,\n  allowBigInt: false,\n};\n\n/** Reject non-safe-integer numbers and non-string map keys; cborg flags cover the rest. */\nfunction validate(value: unknown): asserts value is ProtocolValue {\n  if (value === null || typeof value === \"boolean\" || typeof value === \"string\") {\n    return;\n  }\n  if (typeof value === \"number\") {\n    if (!Number.isInteger(value)) {\n      throw new CborError(\"float\", \"cbor frame: non-integer number\");\n    }\n    if (!Number.isSafeInteger(value)) {\n      throw new CborError(\"unsafe-int\", \"cbor frame: integer outside the safe range\");\n    }\n    return;\n  }\n  if (value instanceof Uint8Array) {\n    return;\n  }\n  if (Array.isArray(value)) {\n    for (const item of value) {\n      validate(item);\n    }\n    return;\n  }\n  if (typeof value === \"object\") {\n    // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- the object came from a CBOR map\n    for (const [key, item] of Object.entries(value as Record<string, unknown>)) {\n      if (typeof key !== \"string\") {\n        throw new CborError(\"non-string-key\", \"cbor frame: non-string map key\");\n      }\n      validate(item);\n    }\n    return;\n  }\n  throw new CborError(\"bad-type\", `cbor frame: unsupported value type ${typeof value}`);\n}\n\n/** Classify a cborg rejection into the frame error taxonomy. */\nfunction classify(error: unknown): CborError {\n  if (error instanceof CborError) {\n    return error;\n  }\n  const text = error instanceof Error ? error.message : String(error);\n  const table: ReadonlyArray<[RegExp, CborErrorCode]> = [\n    [/duplicate key|repeat map key/i, \"duplicate-key\"],\n    [/indefinite/i, \"indefinite\"],\n    [/undefined/i, \"undefined\"],\n    [/bigint|safe integer range/i, \"unsafe-int\"],\n    [/tag/i, \"tag\"],\n    [/string/i, \"non-string-key\"],\n  ];\n  for (const [pattern, code] of table) {\n    if (pattern.test(text)) {\n      return new CborError(code, `cbor frame: ${text}`);\n    }\n  }\n  return new CborError(\"malformed\", `cbor frame: ${text}`);\n}\n\n/** Encode a `ProtocolValue` to a CBOR frame, enforcing the 1 MiB cap. */\nexport function encodeFrame(value: ProtocolValue): ArrayBuffer {\n  validate(value);\n  const bytes = encode(value);\n  if (bytes.byteLength > FRAME_MAX_BYTES) {\n    throw new CborError(\"oversize\", `cbor frame: ${bytes.byteLength} bytes exceeds the 1 MiB cap`);\n  }\n  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);\n}\n\n/** Decode a CBOR frame back to a `ProtocolValue`, enforcing the 1 MiB cap and strictness. */\nexport function decodeFrame(frame: ArrayBuffer | Uint8Array): ProtocolValue {\n  const bytes = frame instanceof Uint8Array ? frame : new Uint8Array(frame);\n  if (bytes.byteLength > FRAME_MAX_BYTES) {\n    throw new CborError(\"oversize\", `cbor frame: ${bytes.byteLength} bytes exceeds the 1 MiB cap`);\n  }\n  if (bytes.byteLength === 0) {\n    throw new CborError(\"truncated\", \"cbor frame: empty frame\");\n  }\n  try {\n    const value: unknown = decode(bytes, DECODE_OPTIONS);\n    validate(value);\n    return value;\n  } catch (error) {\n    throw classify(error);\n  }\n}\n","/**\n * `KernelHost` JS wrapper: CBOR frames over a Nitro-host-shaped channel. The host moves bytes only\n * — encode/decode happens here and in the kernel entry — so a malformed inbound frame can never\n * reach the message domain: the port exits `integrity` and the host runtime is destroyed.\n */\nimport type { MainPort, PortExit } from \"@qntx/wallet/host\";\nimport type { ProtocolValue } from \"@qntx/wallet/protocol\";\n\nimport { decodeFrame, encodeFrame } from \"./cbor.ts\";\n\nexport type KernelExitReason = \"locked\" | \"crashed\" | \"integrity\" | \"background\";\n\n/**\n * Structural mirror of the Nitro `KernelHost` spec (W2b registers the real hybrid object; tests\n * drive the same shape over an in-memory frame pipe).\n */\nexport type KernelHostLike = {\n  readonly start: (backgroundLockSeconds: number) => void;\n  readonly post: (frame: ArrayBuffer) => void;\n  readonly onMessage: (cb: (frame: ArrayBuffer) => void) => void;\n  readonly onExit: (cb: (reason: KernelExitReason) => void) => void;\n  readonly lock: () => void;\n};\n\nexport function spawnFromHost(host: KernelHostLike, backgroundLockSeconds: number): MainPort {\n  const exitHandlers = new Set<(reason: PortExit) => void>();\n  let exited = false;\n\n  const exit = (reason: PortExit): void => {\n    if (exited) {\n      return;\n    }\n    exited = true;\n    for (const handler of exitHandlers) {\n      handler(reason);\n    }\n    host.lock();\n  };\n\n  host.onMessage((frame) => {\n    let message: ProtocolValue;\n    try {\n      message = decodeFrame(frame);\n    } catch {\n      exit(\"crashed\");\n      return;\n    }\n    dispatch(message);\n  });\n\n  // The platform locked the enclave in the background — report it honestly so\n  // the channel takes the lock path, not the crash path.\n  host.onExit((reason) => {\n    exit(reason === \"background\" ? \"background\" : \"crashed\");\n  });\n\n  const messageHandlers = new Set<(message: unknown) => void>();\n  const dispatch = (message: unknown): void => {\n    for (const handler of messageHandlers) {\n      handler(message);\n    }\n  };\n\n  host.start(backgroundLockSeconds);\n\n  return {\n    post: (message, transfer) => {\n      const frame = encodeFrame(message);\n      host.post(frame);\n      // Structured clone would neuter transferred buffers on the web; the main↔kernel\n      // contract is the same here — the caller's buffers hold secrets (passwords, PRF\n      // output) and are zeroed once their bytes are inside the frame.\n      for (const buffer of transfer) {\n        new Uint8Array(buffer).fill(0);\n      }\n    },\n    listen: (handler) => {\n      messageHandlers.add(handler);\n      return () => {\n        messageHandlers.delete(handler);\n      };\n    },\n    onExit: (handler) => {\n      exitHandlers.add(handler);\n      return () => {\n        exitHandlers.delete(handler);\n      };\n    },\n    terminate: () => {\n      exit(\"crashed\");\n    },\n  };\n}\n","import { WalletError } from \"@qntx/wallet\";\nimport type { AutoLockPolicy, PasskeyConfig, Wallet } from \"@qntx/wallet\";\nimport type { SetTimer } from \"@qntx/wallet/host\";\n/**\n * `@qntx/wallet-native`: the RN host entry. `createNativeWallet` adapts a `KernelHost` (Nitro\n * hybrid from W2b, or any object with the same shape) to the wallet `connectKernel` entry — the\n * returned `Wallet` is the same type as the web/node host.\n */\nimport { connectKernel } from \"@qntx/wallet/host\";\n\nimport { spawnFromHost } from \"./host.ts\";\nimport type { KernelHostLike } from \"./host.ts\";\nimport type { KernelHost } from \"./specs/kernel-host.nitro.ts\";\n\nexport type NativeWalletOptions = {\n  readonly passkey: PasskeyConfig;\n  readonly autoLock: AutoLockPolicy;\n  /**\n   * The Nitro `KernelHost` hybrid object (or a like-shaped fake for tests). Defaults to\n   * `NitroModules.createHybridObject(\"KernelHost\")` — the only Nitro-registered object.\n   */\n  readonly host?: KernelHostLike;\n};\n\nconst setTimer: SetTimer = (delayMs, fn) => {\n  const id = setTimeout(fn, delayMs);\n  return () => {\n    clearTimeout(id);\n  };\n};\n\nasync function defaultHost(): Promise<KernelHostLike> {\n  const { NitroModules } = await import(\"react-native-nitro-modules\");\n  return NitroModules.createHybridObject<KernelHost>(\"KernelHost\");\n}\n\nexport async function createNativeWallet(options: NativeWalletOptions): Promise<Wallet> {\n  const { autoLock } = options;\n  const host = options.host ?? (await defaultHost());\n  if (autoLock.platform !== \"native\") {\n    throw new WalletError(\n      \"invalid-input\",\n      \"createNativeWallet accepts only the native autoLock policy\",\n    );\n  }\n  // The native host owns the auto-lock signal: the platform layer calls host.lock() on\n  // background expiry — the kernel never sees a presence source here.\n  return connectKernel({\n    spawn: () => spawnFromHost(host, autoLock.backgroundSeconds),\n    factors: \"hardware\",\n    passkey: options.passkey,\n    ceremony: undefined,\n    setTimer,\n  });\n}\n\nexport { spawnFromHost, type KernelHostLike, type KernelExitReason } from \"./host.ts\";\nexport {\n  encodeFrame,\n  decodeFrame,\n  CborError,\n  FRAME_MAX_BYTES,\n  type CborErrorCode,\n} from \"./cbor.ts\";\n"],"mappings":";;;;;;;;;;AAWA,MAAa,kBAA0B;AAgBvC,IAAa,YAAb,cAA+B,MAAM;CACnC;CACA,YAAY,MAAqB,SAAiB;EAChD,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;CACd;AACF;AAEA,MAAM,iBAAgC;CACpC,QAAQ;CACR,SAAS;CACT,wBAAwB;CACxB,gBAAgB;CAChB,iBAAiB;CACjB,UAAU;CACV,eAAe;CACf,aAAa;AACf;;AAGA,SAAS,SAAS,OAAgD;CAChE,IAAI,UAAU,QAAQ,OAAO,UAAU,aAAa,OAAO,UAAU,UACnE;CAEF,IAAI,OAAO,UAAU,UAAU;EAC7B,IAAI,CAAC,OAAO,UAAU,KAAK,GACzB,MAAM,IAAI,UAAU,SAAS,gCAAgC;EAE/D,IAAI,CAAC,OAAO,cAAc,KAAK,GAC7B,MAAM,IAAI,UAAU,cAAc,4CAA4C;EAEhF;CACF;CACA,IAAI,iBAAiB,YACnB;CAEF,IAAI,MAAM,QAAQ,KAAK,GAAG;EACxB,KAAK,MAAM,QAAQ,OACjB,SAAS,IAAI;EAEf;CACF;CACA,IAAI,OAAO,UAAU,UAAU;EAE7B,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,KAAgC,GAAG;GAC1E,IAAI,OAAO,QAAQ,UACjB,MAAM,IAAI,UAAU,kBAAkB,gCAAgC;GAExE,SAAS,IAAI;EACf;EACA;CACF;CACA,MAAM,IAAI,UAAU,YAAY,sCAAsC,OAAO,OAAO;AACtF;;AAGA,SAAS,SAAS,OAA2B;CAC3C,IAAI,iBAAiB,WACnB,OAAO;CAET,MAAM,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;CASlE,KAAK,MAAM,CAAC,SAAS,SAAS;EAP5B,CAAC,iCAAiC,eAAe;EACjD,CAAC,eAAe,YAAY;EAC5B,CAAC,cAAc,WAAW;EAC1B,CAAC,8BAA8B,YAAY;EAC3C,CAAC,QAAQ,KAAK;EACd,CAAC,WAAW,gBAAgB;CAEI,GAChC,IAAI,QAAQ,KAAK,IAAI,GACnB,OAAO,IAAI,UAAU,MAAM,eAAe,MAAM;CAGpD,OAAO,IAAI,UAAU,aAAa,eAAe,MAAM;AACzD;;AAGA,SAAgB,YAAY,OAAmC;CAC7D,SAAS,KAAK;CACd,MAAM,QAAQ,OAAO,KAAK;CAC1B,IAAI,MAAM,aAAA,SACR,MAAM,IAAI,UAAU,YAAY,eAAe,MAAM,WAAW,6BAA6B;CAE/F,OAAO,MAAM,OAAO,MAAM,MAAM,YAAY,MAAM,aAAa,MAAM,UAAU;AACjF;;AAGA,SAAgB,YAAY,OAAgD;CAC1E,MAAM,QAAQ,iBAAiB,aAAa,QAAQ,IAAI,WAAW,KAAK;CACxE,IAAI,MAAM,aAAA,SACR,MAAM,IAAI,UAAU,YAAY,eAAe,MAAM,WAAW,6BAA6B;CAE/F,IAAI,MAAM,eAAe,GACvB,MAAM,IAAI,UAAU,aAAa,yBAAyB;CAE5D,IAAI;EACF,MAAM,QAAiB,OAAO,OAAO,cAAc;EACnD,SAAS,KAAK;EACd,OAAO;CACT,SAAS,OAAO;EACd,MAAM,SAAS,KAAK;CACtB;AACF;;;AC3GA,SAAgB,cAAc,MAAsB,uBAAyC;CAC3F,MAAM,+BAAe,IAAI,IAAgC;CACzD,IAAI,SAAS;CAEb,MAAM,QAAQ,WAA2B;EACvC,IAAI,QACF;EAEF,SAAS;EACT,KAAK,MAAM,WAAW,cACpB,QAAQ,MAAM;EAEhB,KAAK,KAAK;CACZ;CAEA,KAAK,WAAW,UAAU;EACxB,IAAI;EACJ,IAAI;GACF,UAAU,YAAY,KAAK;EAC7B,QAAQ;GACN,KAAK,SAAS;GACd;EACF;EACA,SAAS,OAAO;CAClB,CAAC;CAID,KAAK,QAAQ,WAAW;EACtB,KAAK,WAAW,eAAe,eAAe,SAAS;CACzD,CAAC;CAED,MAAM,kCAAkB,IAAI,IAAgC;CAC5D,MAAM,YAAY,YAA2B;EAC3C,KAAK,MAAM,WAAW,iBACpB,QAAQ,OAAO;CAEnB;CAEA,KAAK,MAAM,qBAAqB;CAEhC,OAAO;EACL,OAAO,SAAS,aAAa;GAC3B,MAAM,QAAQ,YAAY,OAAO;GACjC,KAAK,KAAK,KAAK;GAIf,KAAK,MAAM,UAAU,UACnB,IAAI,WAAW,MAAM,CAAC,CAAC,KAAK,CAAC;EAEjC;EACA,SAAS,YAAY;GACnB,gBAAgB,IAAI,OAAO;GAC3B,aAAa;IACX,gBAAgB,OAAO,OAAO;GAChC;EACF;EACA,SAAS,YAAY;GACnB,aAAa,IAAI,OAAO;GACxB,aAAa;IACX,aAAa,OAAO,OAAO;GAC7B;EACF;EACA,iBAAiB;GACf,KAAK,SAAS;EAChB;CACF;AACF;;;;;;;;ACpEA,MAAM,YAAsB,SAAS,OAAO;CAC1C,MAAM,KAAK,WAAW,IAAI,OAAO;CACjC,aAAa;EACX,aAAa,EAAE;CACjB;AACF;AAEA,eAAe,cAAuC;CACpD,MAAM,EAAE,iBAAiB,MAAM,OAAO;CACtC,OAAO,aAAa,mBAA+B,YAAY;AACjE;AAEA,eAAsB,mBAAmB,SAA+C;CACtF,MAAM,EAAE,aAAa;CACrB,MAAM,OAAO,QAAQ,QAAS,MAAM,YAAY;CAChD,IAAI,SAAS,aAAa,UACxB,MAAM,IAAI,YACR,iBACA,4DACF;CAIF,OAAO,cAAc;EACnB,aAAa,cAAc,MAAM,SAAS,iBAAiB;EAC3D,SAAS;EACT,SAAS,QAAQ;EACjB,UAAU,KAAA;EACV;CACF,CAAC;AACH"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/cbor.ts","../src/host.ts","../src/index.ts"],"sourcesContent":["/**\n * CBOR framing for the kernel channel. `ProtocolValue` travels main-side ↔ kernel-side as CBOR; the\n * C++ layer moves bytes only. Decode is deliberately strict: floats, unsafe integers, undefined,\n * tags, non-string map keys, duplicate keys and indefinite-length items are all rejected — the wire\n * format carries exactly one value domain.\n */\nimport { decode, encode } from \"cborg\";\nimport type { DecodeOptions } from \"cborg\";\n\nimport type { ProtocolValue } from \"@qntx/wallet/protocol\";\n\nexport const FRAME_MAX_BYTES: number = 1024 * 1024;\n\nexport type CborErrorCode =\n  | \"oversize\"\n  | \"truncated\"\n  | \"malformed\"\n  | \"float\"\n  | \"unsafe-int\"\n  | \"bigint\"\n  | \"undefined\"\n  | \"tag\"\n  | \"non-string-key\"\n  | \"duplicate-key\"\n  | \"indefinite\"\n  | \"bad-type\";\n\nexport class CborError extends Error {\n  readonly code: CborErrorCode;\n  constructor(code: CborErrorCode, message: string) {\n    super(message);\n    this.name = \"CborError\";\n    this.code = code;\n  }\n}\n\nconst DECODE_OPTIONS: DecodeOptions = {\n  strict: true,\n  useMaps: false,\n  rejectDuplicateMapKeys: true,\n  allowUndefined: false,\n  allowIndefinite: false,\n  allowNaN: false,\n  allowInfinity: false,\n  allowBigInt: false,\n};\n\n/** Reject non-safe-integer numbers and non-string map keys; cborg flags cover the rest. */\nfunction validate(value: unknown): asserts value is ProtocolValue {\n  if (value === null || typeof value === \"boolean\" || typeof value === \"string\") {\n    return;\n  }\n  if (typeof value === \"number\") {\n    if (!Number.isInteger(value)) {\n      throw new CborError(\"float\", \"cbor frame: non-integer number\");\n    }\n    if (!Number.isSafeInteger(value)) {\n      throw new CborError(\"unsafe-int\", \"cbor frame: integer outside the safe range\");\n    }\n    return;\n  }\n  if (value instanceof Uint8Array) {\n    return;\n  }\n  if (Array.isArray(value)) {\n    for (const item of value) {\n      validate(item);\n    }\n    return;\n  }\n  if (typeof value === \"object\") {\n    // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- the object came from a CBOR map\n    for (const [key, item] of Object.entries(value as Record<string, unknown>)) {\n      if (typeof key !== \"string\") {\n        throw new CborError(\"non-string-key\", \"cbor frame: non-string map key\");\n      }\n      validate(item);\n    }\n    return;\n  }\n  throw new CborError(\"bad-type\", `cbor frame: unsupported value type ${typeof value}`);\n}\n\n/** Classify a cborg rejection into the frame error taxonomy. */\nfunction classify(error: unknown): CborError {\n  if (error instanceof CborError) {\n    return error;\n  }\n  const text = error instanceof Error ? error.message : String(error);\n  const table: ReadonlyArray<[RegExp, CborErrorCode]> = [\n    [/duplicate key|repeat map key/i, \"duplicate-key\"],\n    [/indefinite/i, \"indefinite\"],\n    [/undefined/i, \"undefined\"],\n    [/bigint|safe integer range/i, \"unsafe-int\"],\n    [/tag/i, \"tag\"],\n    [/string/i, \"non-string-key\"],\n  ];\n  for (const [pattern, code] of table) {\n    if (pattern.test(text)) {\n      return new CborError(code, `cbor frame: ${text}`);\n    }\n  }\n  return new CborError(\"malformed\", `cbor frame: ${text}`);\n}\n\n/** Encode a `ProtocolValue` to a CBOR frame, enforcing the 1 MiB cap. */\nexport function encodeFrame(value: ProtocolValue): ArrayBuffer {\n  validate(value);\n  const bytes = encode(value);\n  if (bytes.byteLength > FRAME_MAX_BYTES) {\n    throw new CborError(\"oversize\", `cbor frame: ${bytes.byteLength} bytes exceeds the 1 MiB cap`);\n  }\n  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);\n}\n\n/** Decode a CBOR frame back to a `ProtocolValue`, enforcing the 1 MiB cap and strictness. */\nexport function decodeFrame(frame: ArrayBuffer | Uint8Array): ProtocolValue {\n  const bytes = frame instanceof Uint8Array ? frame : new Uint8Array(frame);\n  if (bytes.byteLength > FRAME_MAX_BYTES) {\n    throw new CborError(\"oversize\", `cbor frame: ${bytes.byteLength} bytes exceeds the 1 MiB cap`);\n  }\n  if (bytes.byteLength === 0) {\n    throw new CborError(\"truncated\", \"cbor frame: empty frame\");\n  }\n  try {\n    const value: unknown = decode(bytes, DECODE_OPTIONS);\n    validate(value);\n    return value;\n  } catch (error) {\n    throw classify(error);\n  }\n}\n","/**\n * `KernelHost` JS wrapper: CBOR frames over a Nitro-host-shaped channel. The host moves bytes only\n * — encode/decode happens here and in the kernel entry — so a malformed inbound frame can never\n * reach the message domain: the port exits `integrity` and the host runtime is destroyed.\n */\nimport type { MainPort, PortExit } from \"@qntx/wallet/host\";\nimport type { ProtocolValue } from \"@qntx/wallet/protocol\";\n\nimport { decodeFrame, encodeFrame } from \"./cbor.ts\";\n\nexport type KernelExitReason = \"locked\" | \"crashed\" | \"integrity\" | \"background\";\n\n/**\n * Structural mirror of the Nitro `KernelHost` spec (W2b registers the real hybrid object; tests\n * drive the same shape over an in-memory frame pipe).\n */\nexport type KernelHostLike = {\n  readonly start: (backgroundLockSeconds: number) => void;\n  readonly post: (frame: ArrayBuffer) => void;\n  readonly onMessage: (cb: (frame: ArrayBuffer) => void) => void;\n  readonly onExit: (cb: (reason: KernelExitReason) => void) => void;\n  readonly lock: () => void;\n};\n\nexport function spawnFromHost(host: KernelHostLike, backgroundLockSeconds: number): MainPort {\n  const exitHandlers = new Set<(reason: PortExit) => void>();\n  let exited = false;\n\n  const exit = (reason: PortExit): void => {\n    if (exited) {\n      return;\n    }\n    exited = true;\n    for (const handler of exitHandlers) {\n      handler(reason);\n    }\n    host.lock();\n  };\n\n  host.onMessage((frame) => {\n    let message: ProtocolValue;\n    try {\n      message = decodeFrame(frame);\n    } catch {\n      exit(\"crashed\");\n      return;\n    }\n    dispatch(message);\n  });\n\n  // The platform locked the enclave in the background — report it honestly so\n  // the channel takes the lock path, not the crash path.\n  host.onExit((reason) => {\n    exit(reason === \"background\" ? \"background\" : \"crashed\");\n  });\n\n  const messageHandlers = new Set<(message: unknown) => void>();\n  const dispatch = (message: unknown): void => {\n    for (const handler of messageHandlers) {\n      handler(message);\n    }\n  };\n\n  host.start(backgroundLockSeconds);\n\n  return {\n    post: (message, transfer) => {\n      const frame = encodeFrame(message);\n      host.post(frame);\n      // Structured clone would neuter transferred buffers on the web; the main↔kernel\n      // contract is the same here — the caller's buffers hold secrets (passwords, PRF\n      // output) and are zeroed once their bytes are inside the frame.\n      for (const buffer of transfer) {\n        new Uint8Array(buffer).fill(0);\n      }\n    },\n    listen: (handler) => {\n      messageHandlers.add(handler);\n      return () => {\n        messageHandlers.delete(handler);\n      };\n    },\n    onExit: (handler) => {\n      exitHandlers.add(handler);\n      return () => {\n        exitHandlers.delete(handler);\n      };\n    },\n    terminate: () => {\n      exit(\"crashed\");\n    },\n  };\n}\n","import { WalletError } from \"@qntx/wallet\";\nimport type { AutoLockPolicy, PasskeyConfig, Wallet } from \"@qntx/wallet\";\nimport type { SetTimer } from \"@qntx/wallet/host\";\n/**\n * `@qntx/wallet-native`: the RN host entry. `createNativeWallet` adapts a `KernelHost` (Nitro\n * hybrid from W2b, or any object with the same shape) to the wallet `connectKernel` entry — the\n * returned `Wallet` is the same type as the web/node host.\n */\nimport { connectKernel } from \"@qntx/wallet/host\";\n\nimport { spawnFromHost } from \"./host.ts\";\nimport type { KernelHostLike } from \"./host.ts\";\nimport type { KernelHost } from \"./specs/kernel-host.nitro.ts\";\n\nexport type NativeWalletOptions = {\n  readonly passkey: PasskeyConfig;\n  readonly autoLock: AutoLockPolicy;\n  /**\n   * The Nitro `KernelHost` hybrid object (or a like-shaped fake for tests). Defaults to\n   * `NitroModules.createHybridObject(\"KernelHost\")` — the only Nitro-registered object.\n   */\n  readonly host?: KernelHostLike;\n};\n\nconst setTimer: SetTimer = (delayMs, fn) => {\n  const id = setTimeout(fn, delayMs);\n  return () => {\n    clearTimeout(id);\n  };\n};\n\nasync function defaultHost(): Promise<KernelHostLike> {\n  const { NitroModules } = await import(\"react-native-nitro-modules\");\n  return NitroModules.createHybridObject<KernelHost>(\"KernelHost\");\n}\n\nexport async function createNativeWallet(options: NativeWalletOptions): Promise<Wallet> {\n  const { autoLock } = options;\n  const host = options.host ?? (await defaultHost());\n  if (autoLock.platform !== \"native\") {\n    throw new WalletError(\n      \"invalid-input\",\n      \"createNativeWallet accepts only the native autoLock policy\",\n    );\n  }\n  // The native host owns the auto-lock signal: the platform layer calls host.lock() on\n  // background expiry — the kernel never sees a presence source here.\n  return connectKernel({\n    spawn: () => spawnFromHost(host, autoLock.backgroundSeconds),\n    factors: \"hardware\",\n    passkey: options.passkey,\n    ceremony: undefined,\n    setTimer,\n  });\n}\n\nexport { spawnFromHost, type KernelHostLike, type KernelExitReason } from \"./host.ts\";\nexport {\n  encodeFrame,\n  decodeFrame,\n  CborError,\n  FRAME_MAX_BYTES,\n  type CborErrorCode,\n} from \"./cbor.ts\";\n"],"mappings":";;;;;;;;;;AAWA,MAAa,kBAA0B;AAgBvC,IAAa,YAAb,cAA+B,MAAM;CACnC;CACA,YAAY,MAAqB,SAAiB;EAChD,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;CACd;AACF;AAEA,MAAM,iBAAgC;CACpC,QAAQ;CACR,SAAS;CACT,wBAAwB;CACxB,gBAAgB;CAChB,iBAAiB;CACjB,UAAU;CACV,eAAe;CACf,aAAa;AACf;;AAGA,SAAS,SAAS,OAAgD;CAChE,IAAI,UAAU,QAAQ,OAAO,UAAU,aAAa,OAAO,UAAU,UACnE;CAEF,IAAI,OAAO,UAAU,UAAU;EAC7B,IAAI,CAAC,OAAO,UAAU,KAAK,GACzB,MAAM,IAAI,UAAU,SAAS,gCAAgC;EAE/D,IAAI,CAAC,OAAO,cAAc,KAAK,GAC7B,MAAM,IAAI,UAAU,cAAc,4CAA4C;EAEhF;CACF;CACA,IAAI,iBAAiB,YACnB;CAEF,IAAI,MAAM,QAAQ,KAAK,GAAG;EACxB,KAAK,MAAM,QAAQ,OACjB,SAAS,IAAI;EAEf;CACF;CACA,IAAI,OAAO,UAAU,UAAU;EAE7B,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,KAAgC,GAAG;GAC1E,IAAI,OAAO,QAAQ,UACjB,MAAM,IAAI,UAAU,kBAAkB,gCAAgC;GAExE,SAAS,IAAI;EACf;EACA;CACF;CACA,MAAM,IAAI,UAAU,YAAY,sCAAsC,OAAO,OAAO;AACtF;;AAGA,SAAS,SAAS,OAA2B;CAC3C,IAAI,iBAAiB,WACnB,OAAO;CAET,MAAM,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;CASlE,KAAK,MAAM,CAAC,SAAS,SAAS;EAP5B,CAAC,iCAAiC,eAAe;EACjD,CAAC,eAAe,YAAY;EAC5B,CAAC,cAAc,WAAW;EAC1B,CAAC,8BAA8B,YAAY;EAC3C,CAAC,QAAQ,KAAK;EACd,CAAC,WAAW,gBAAgB;CAEI,GAChC,IAAI,QAAQ,KAAK,IAAI,GACnB,OAAO,IAAI,UAAU,MAAM,eAAe,MAAM;CAGpD,OAAO,IAAI,UAAU,aAAa,eAAe,MAAM;AACzD;;AAGA,SAAgB,YAAY,OAAmC;CAC7D,SAAS,KAAK;CACd,MAAM,QAAQ,OAAO,KAAK;CAC1B,IAAI,MAAM,aAAA,SACR,MAAM,IAAI,UAAU,YAAY,eAAe,MAAM,WAAW,6BAA6B;CAE/F,OAAO,MAAM,OAAO,MAAM,MAAM,YAAY,MAAM,aAAa,MAAM,UAAU;AACjF;;AAGA,SAAgB,YAAY,OAAgD;CAC1E,MAAM,QAAQ,iBAAiB,aAAa,QAAQ,IAAI,WAAW,KAAK;CACxE,IAAI,MAAM,aAAA,SACR,MAAM,IAAI,UAAU,YAAY,eAAe,MAAM,WAAW,6BAA6B;CAE/F,IAAI,MAAM,eAAe,GACvB,MAAM,IAAI,UAAU,aAAa,yBAAyB;CAE5D,IAAI;EACF,MAAM,QAAiB,OAAO,OAAO,cAAc;EACnD,SAAS,KAAK;EACd,OAAO;CACT,SAAS,OAAO;EACd,MAAM,SAAS,KAAK;CACtB;AACF;;AC3GA,SAAgB,cAAc,MAAsB,uBAAyC;CAC3F,MAAM,+BAAe,IAAI,IAAgC;CACzD,IAAI,SAAS;CAEb,MAAM,QAAQ,WAA2B;EACvC,IAAI,QACF;EAEF,SAAS;EACT,KAAK,MAAM,WAAW,cACpB,QAAQ,MAAM;EAEhB,KAAK,KAAK;CACZ;CAEA,KAAK,WAAW,UAAU;EACxB,IAAI;EACJ,IAAI;GACF,UAAU,YAAY,KAAK;EAC7B,QAAQ;GACN,KAAK,SAAS;GACd;EACF;EACA,SAAS,OAAO;CAClB,CAAC;CAID,KAAK,QAAQ,WAAW;EACtB,KAAK,WAAW,eAAe,eAAe,SAAS;CACzD,CAAC;CAED,MAAM,kCAAkB,IAAI,IAAgC;CAC5D,MAAM,YAAY,YAA2B;EAC3C,KAAK,MAAM,WAAW,iBACpB,QAAQ,OAAO;CAEnB;CAEA,KAAK,MAAM,qBAAqB;CAEhC,OAAO;EACL,OAAO,SAAS,aAAa;GAC3B,MAAM,QAAQ,YAAY,OAAO;GACjC,KAAK,KAAK,KAAK;GAIf,KAAK,MAAM,UAAU,UACnB,IAAI,WAAW,MAAM,CAAC,CAAC,KAAK,CAAC;EAEjC;EACA,SAAS,YAAY;GACnB,gBAAgB,IAAI,OAAO;GAC3B,aAAa;IACX,gBAAgB,OAAO,OAAO;GAChC;EACF;EACA,SAAS,YAAY;GACnB,aAAa,IAAI,OAAO;GACxB,aAAa;IACX,aAAa,OAAO,OAAO;GAC7B;EACF;EACA,iBAAiB;GACf,KAAK,SAAS;EAChB;CACF;AACF;;;;;;;ACpEA,MAAM,YAAsB,SAAS,OAAO;CAC1C,MAAM,KAAK,WAAW,IAAI,OAAO;CACjC,aAAa;EACX,aAAa,EAAE;CACjB;AACF;AAEA,eAAe,cAAuC;CACpD,MAAM,EAAE,iBAAiB,MAAM,OAAO;CACtC,OAAO,aAAa,mBAA+B,YAAY;AACjE;AAEA,eAAsB,mBAAmB,SAA+C;CACtF,MAAM,EAAE,aAAa;CACrB,MAAM,OAAO,QAAQ,QAAS,MAAM,YAAY;CAChD,IAAI,SAAS,aAAa,UACxB,MAAM,IAAI,YACR,iBACA,4DACF;CAIF,OAAO,cAAc;EACnB,aAAa,cAAc,MAAM,SAAS,iBAAiB;EAC3D,SAAS;EACT,SAAS,QAAQ;EACjB,UAAU,KAAA;EACV;CACF,CAAC;AACH"}