@qntx/wallet-worker 0.0.0-stage → 0.2.0

package/LICENSE-APACHE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 QuantX
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,65 @@
-# Temporary Holding Version
+# @qntx/wallet-worker
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Web and Node host for [`@qntx/wallet`](https://www.npmjs.com/package/@qntx/wallet): spawns the
+wallet kernel in a Worker (`dist/kernel.worker.js` / `dist/kernel.node.js`, bundled), keeps the
+encrypted vault in IndexedDB (Web) or a main-thread memory store (Node), and runs the WebAuthn
+PRF passkey ceremony on the main thread. Peer dependency: the exact `@qntx/wallet` release this
+kernel was built against — the host/kernel protocol requires it.
+
+```bash
+npm install @qntx/wallet-worker @qntx/wallet
+```
+
+## Web
+
+`@qntx/wallet-worker/browser`:
+
+```ts
+import { createWebWallet } from "@qntx/wallet-worker/browser";
+
+const wallet = await createWebWallet({
+  passkey: {
+    rpId: "app.example.com",
+    rpName: "Example",
+    walletSalt: "example/wallet",
+    vaultSalt: "example/vault",
+  },
+  autoLock: { platform: "web", idleMinutes: 15 },
+});
+
+const created = await wallet.wallets.createWithPasskey({ name: "Example Wallet" });
+await wallet.vault.unlock({ kind: "passkey" });
+
+import { nostr } from "@qntx/wallet/nostr";
+
+const key = await nostr(wallet).deriveKey(created.walletId, 0);
+const signer = nostr(wallet).signer(key.ref);
+```
+
+## Node (tests and demos)
+
+`@qntx/wallet-worker/node` runs the same kernel in a `node:worker_threads` Worker with an
+in-memory vault store. `createSoftwarePasskey(seed)` is a **test-only** WebAuthn stand-in —
+deterministic, no authenticator, anyone holding the seed owns the wallet:
+
+```ts
+import { createNodeWallet, createSoftwarePasskey } from "@qntx/wallet-worker/node";
+
+const wallet = await createNodeWallet({
+  passkey: { rpId: "qntx.test", rpName: "test", walletSalt: "t/wallet", vaultSalt: "t/vault" },
+  autoLock: { platform: "web", idleMinutes: 15 },
+  authenticator: createSoftwarePasskey(seed),
+});
+```
+
+## Security notes
+
+- Secrets exist only inside the kernel Worker; lock destroys the worker, the vault image
+  (ciphertext + public headers) persists in the store.
+- The Web host is a **hot wallet**. CSP needs `worker-src 'self'`; Vite needs
+  `optimizeDeps.exclude: ["@qntx/wallet-worker"]`.
+- `@qntx/wallet/host` is for host packages only — not application API.
+
+## License
+
+MIT OR Apache-2.0

package/dist/browser.d.mts

@@ -0,0 +1,20 @@
+import { Wallet, WalletOptions } from "@qntx/wallet";
+import { PasskeyCeremony } from "@qntx/wallet/host";
+//#region src/browser/passkey.d.ts
+type WebAuthnRp = {
+  /** RP id — the origin's effective domain, e.g. `location.hostname`. */
+  readonly id: string;
+  readonly name: string;
+};
+/**
+ * The WebAuthn ceremony. `create` registers a resident credential with `prf.eval` over the salts;
+ * when the extension returns no results a single assertion over the new credential produces them.
+ * `assert` runs a discoverable (or allowCredentials-scoped) get with the same eval shape.
+ */
+export declare function createWebAuthnPasskey(rp: WebAuthnRp): PasskeyCeremony;
+//#endregion
+//#region src/browser/index.d.ts
+export declare function createWebWallet(options: WalletOptions): Promise<Wallet>;
+//#endregion
+export type { WebAuthnRp };
+//# sourceMappingURL=browser.d.mts.map

package/dist/browser.mjs

@@ -0,0 +1,227 @@
+import { WalletError } from "@qntx/wallet";
+import { connectKernel } from "@qntx/wallet/host";
+//#region src/browser/passkey.ts
+/**
+* The WebAuthn passkey ceremony (main thread only): `navigator.credentials` with the PRF extension.
+* A wallet passkey derives the wallet seed from `PRF(walletSalt)`; the vault factor derives the
+* vault KEK from `PRF(vaultSalt)` on the same credential. Every ceremony output is checked for
+* `prf.enabled`, PRF results and the user-verification flag — a credential that cannot prove UV
+* never reaches the kernel.
+*/
+const PURPOSE_WALLET = 1;
+const PURPOSE_VAULT = 2;
+const UV_FLAG = 4;
+function factorUnavailable(message) {
+	return new WalletError("factor-unavailable", message);
+}
+function cancelled(message) {
+	return new WalletError("cancelled", message);
+}
+function mapCeremonyError(error) {
+	if (error instanceof DOMException && (error.name === "NotAllowedError" || error.name === "AbortError")) throw cancelled("the passkey ceremony was cancelled");
+	if (error instanceof WalletError) throw error;
+	throw factorUnavailable("the passkey ceremony failed");
+}
+/** The UV bit of an authenticator-data blob (flags byte at offset 32, bit 0x04). */
+function userVerified(authenticatorData) {
+	return authenticatorData.byteLength > 32 && (new DataView(authenticatorData).getUint8(32) & UV_FLAG) !== 0;
+}
+function prfEval(salts) {
+	return salts.second === void 0 ? { first: new Uint8Array(salts.first) } : {
+		first: new Uint8Array(salts.first),
+		second: new Uint8Array(salts.second)
+	};
+}
+/** A detached copy of a BufferSource — the returned Uint8Array owns its own fresh buffer. */
+function copyBufferSource(source) {
+	const view = source instanceof ArrayBuffer ? new Uint8Array(source) : new Uint8Array(source.buffer, source.byteOffset, source.byteLength);
+	return new Uint8Array(view);
+}
+function readPrfResult(credential, results, wantSecond) {
+	const first = results?.first;
+	const second = results?.second;
+	if (first === void 0 || wantSecond && second === void 0) throw factorUnavailable("the passkey produced no PRF output");
+	return {
+		credentialId: copyBufferSource(credential.rawId),
+		first: copyBufferSource(first),
+		...second === void 0 ? {} : { second: copyBufferSource(second) }
+	};
+}
+function checkCredential(credential) {
+	if (!(credential instanceof PublicKeyCredential)) throw factorUnavailable("the authenticator returned no public-key credential");
+	return credential;
+}
+/**
+* The WebAuthn ceremony. `create` registers a resident credential with `prf.eval` over the salts;
+* when the extension returns no results a single assertion over the new credential produces them.
+* `assert` runs a discoverable (or allowCredentials-scoped) get with the same eval shape.
+*/
+function createWebAuthnPasskey(rp) {
+	async function assert(input) {
+		let credential;
+		try {
+			credential = checkCredential(await navigator.credentials.get({ publicKey: {
+				rpId: rp.id,
+				challenge: crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)),
+				userVerification: "required",
+				...input.credentialIds === void 0 ? {} : { allowCredentials: input.credentialIds.map((id) => ({
+					type: "public-key",
+					id: new Uint8Array(id)
+				})) },
+				extensions: { prf: { eval: prfEval(input.salts) } }
+			} }));
+		} catch (error) {
+			mapCeremonyError(error);
+		}
+		const { response } = credential;
+		if (!(response instanceof AuthenticatorAssertionResponse)) throw factorUnavailable("the authenticator returned no assertion response");
+		if (!userVerified(response.authenticatorData)) throw factorUnavailable("the passkey assertion was not user-verified");
+		return readPrfResult(credential, credential.getClientExtensionResults().prf?.results, input.salts.second !== void 0);
+	}
+	return {
+		create: async (input) => {
+			const userId = /* @__PURE__ */ new Uint8Array(16);
+			userId[0] = input.purpose === "wallet" ? PURPOSE_WALLET : PURPOSE_VAULT;
+			crypto.getRandomValues(userId.subarray(1));
+			let credential;
+			try {
+				credential = checkCredential(await navigator.credentials.create({ publicKey: {
+					rp: {
+						id: rp.id,
+						name: rp.name
+					},
+					user: {
+						id: userId,
+						name: input.name,
+						displayName: input.name
+					},
+					challenge: crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)),
+					pubKeyCredParams: [{
+						type: "public-key",
+						alg: -7
+					}, {
+						type: "public-key",
+						alg: -257
+					}],
+					authenticatorSelection: {
+						residentKey: "required",
+						userVerification: "required"
+					},
+					extensions: { prf: { eval: prfEval(input.salts) } }
+				} }));
+			} catch (error) {
+				mapCeremonyError(error);
+			}
+			const { response } = credential;
+			if (!(response instanceof AuthenticatorAttestationResponse)) throw factorUnavailable("the authenticator returned no attestation response");
+			const extensions = credential.getClientExtensionResults();
+			if (extensions.prf?.enabled !== true) throw factorUnavailable("the authenticator does not support the PRF extension");
+			if (extensions.prf.results === void 0) return assert({
+				credentialIds: [copyBufferSource(credential.rawId)],
+				salts: input.salts
+			});
+			if (!userVerified(response.getAuthenticatorData())) throw factorUnavailable("the passkey creation was not user-verified");
+			return readPrfResult(credential, extensions.prf.results, input.salts.second !== void 0);
+		},
+		assert
+	};
+}
+//#endregion
+//#region src/browser/index.ts
+/**
+* The Web host: `createWebWallet` spawns the bundled kernel worker (dist/kernel.worker.js) whose
+* vault lives in the worker's own IndexedDB. Lock destroys the worker; the vault survives in
+* IndexedDB, so the respawned worker reloads it. Page lifecycle locks: 5 minutes hidden or
+* `pagehide`. The WebAuthn ceremony runs on the main thread.
+*/
+const MAX_SESSION_MS = 432e5;
+const HIDDEN_LOCK_MS = 3e5;
+async function bestEffort(task) {
+	try {
+		await task();
+	} catch {}
+}
+async function createWebWallet(options) {
+	const { autoLock } = options;
+	if (autoLock.platform !== "web") throw new WalletError("invalid-input", "createWebWallet accepts only the web autoLock policy");
+	const init = {
+		t: "init",
+		idleMs: autoLock.idleMinutes * 6e4,
+		maxSessionMs: MAX_SESSION_MS
+	};
+	const kernelUrl = new URL("kernel.worker.js", import.meta.url);
+	const ceremony = createWebAuthnPasskey({
+		id: options.passkey.rpId,
+		name: options.passkey.rpName
+	});
+	const spawn = () => {
+		const worker = new Worker(kernelUrl, {
+			type: "module",
+			name: "qntx-wallet"
+		});
+		worker.postMessage(init);
+		return {
+			post: (message, transfer) => {
+				worker.postMessage(message, transfer);
+			},
+			listen: (handler) => {
+				const listener = (event) => {
+					handler(event.data);
+				};
+				worker.addEventListener("message", listener);
+				return () => {
+					worker.removeEventListener("message", listener);
+				};
+			},
+			onExit: (handler) => {
+				const listener = () => {
+					handler();
+				};
+				worker.addEventListener("error", listener);
+				worker.addEventListener("messageerror", listener);
+				return () => {
+					worker.removeEventListener("error", listener);
+					worker.removeEventListener("messageerror", listener);
+				};
+			},
+			terminate: () => {
+				worker.terminate();
+			}
+		};
+	};
+	const wallet = await connectKernel({
+		spawn,
+		passkey: options.passkey,
+		ceremony,
+		onDestroy: () => {
+			document.removeEventListener("visibilitychange", onVisibility);
+			globalThis.removeEventListener("pagehide", onPageHide);
+			globalThis.clearTimeout(hiddenTimer);
+		}
+	});
+	let hiddenTimer = 0;
+	const onVisibility = () => {
+		if (document.visibilityState === "hidden") hiddenTimer = globalThis.setTimeout(() => {
+			bestEffort(async () => wallet.vault.lock());
+		}, HIDDEN_LOCK_MS);
+		else globalThis.clearTimeout(hiddenTimer);
+	};
+	const onPageHide = () => {
+		bestEffort(async () => wallet.vault.lock());
+	};
+	document.addEventListener("visibilitychange", onVisibility);
+	globalThis.addEventListener("pagehide", onPageHide);
+	let persisted = false;
+	const unsubscribe = wallet.subscribe(() => {
+		if (!persisted && wallet.getSnapshot().vault !== "uninitialized") {
+			persisted = true;
+			unsubscribe();
+			bestEffort(async () => navigator.storage.persist());
+		}
+	});
+	return wallet;
+}
+//#endregion
+export { createWebAuthnPasskey, createWebWallet };
+
+//# sourceMappingURL=browser.mjs.map

package/dist/browser.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.mjs","names":[],"sources":["../src/browser/passkey.ts","../src/browser/index.ts"],"sourcesContent":["/**\n * The WebAuthn passkey ceremony (main thread only): `navigator.credentials` with the PRF extension.\n * A wallet passkey derives the wallet seed from `PRF(walletSalt)`; the vault factor derives the\n * vault KEK from `PRF(vaultSalt)` on the same credential. Every ceremony output is checked for\n * `prf.enabled`, PRF results and the user-verification flag — a credential that cannot prove UV\n * never reaches the kernel.\n */\nimport { WalletError } from \"@qntx/wallet\";\nimport type { PasskeyCeremony, PrfResult, PrfSalts } from \"@qntx/wallet/host\";\n\nexport type WebAuthnRp = {\n  /** RP id — the origin's effective domain, e.g. `location.hostname`. */\n  readonly id: string;\n  readonly name: string;\n};\n\nconst PURPOSE_WALLET = 0x01;\nconst PURPOSE_VAULT = 0x02;\nconst UV_FLAG = 0x04; // authenticator-data flags byte (offset 32), bit 2 = user verified\n\nfunction factorUnavailable(message: string): WalletError {\n  return new WalletError(\"factor-unavailable\", message);\n}\n\nfunction cancelled(message: string): WalletError {\n  return new WalletError(\"cancelled\", message);\n}\n\nfunction mapCeremonyError(error: unknown): never {\n  if (\n    error instanceof DOMException &&\n    (error.name === \"NotAllowedError\" || error.name === \"AbortError\")\n  ) {\n    throw cancelled(\"the passkey ceremony was cancelled\");\n  }\n  if (error instanceof WalletError) {\n    throw error;\n  }\n  throw factorUnavailable(\"the passkey ceremony failed\");\n}\n\n/** The UV bit of an authenticator-data blob (flags byte at offset 32, bit 0x04). */\nfunction userVerified(authenticatorData: ArrayBuffer): boolean {\n  return (\n    authenticatorData.byteLength > 32 &&\n    // oxlint-disable-next-line eslint/no-bitwise -- flags bit test\n    (new DataView(authenticatorData).getUint8(32) & UV_FLAG) !== 0\n  );\n}\n\nfunction prfEval(salts: PrfSalts): AuthenticationExtensionsPRFValues {\n  // The constructor copy narrows Uint8Array<ArrayBufferLike> to Uint8Array<ArrayBuffer> —\n  // the DOM BufferSource does not admit shared-array-buffer views.\n  return salts.second === undefined\n    ? { first: new Uint8Array(salts.first) }\n    : { first: new Uint8Array(salts.first), second: new Uint8Array(salts.second) };\n}\n\n/** A detached copy of a BufferSource — the returned Uint8Array owns its own fresh buffer. */\nfunction copyBufferSource(source: BufferSource): Uint8Array {\n  const view =\n    source instanceof ArrayBuffer\n      ? new Uint8Array(source)\n      : new Uint8Array(source.buffer, source.byteOffset, source.byteLength);\n  return new Uint8Array(view);\n}\n\nfunction readPrfResult(\n  credential: PublicKeyCredential,\n  results: AuthenticationExtensionsPRFValues | undefined,\n  wantSecond: boolean,\n): PrfResult {\n  const first = results?.first;\n  const second = results?.second;\n  if (first === undefined || (wantSecond && second === undefined)) {\n    throw factorUnavailable(\"the passkey produced no PRF output\");\n  }\n  // Copy into fresh Uint8Arrays and drop every reference to the extension's ArrayBuffers.\n  return {\n    credentialId: copyBufferSource(credential.rawId),\n    first: copyBufferSource(first),\n    ...(second === undefined ? {} : { second: copyBufferSource(second) }),\n  };\n}\n\nfunction checkCredential(credential: unknown): PublicKeyCredential {\n  if (!(credential instanceof PublicKeyCredential)) {\n    throw factorUnavailable(\"the authenticator returned no public-key credential\");\n  }\n  return credential;\n}\n\n/**\n * The WebAuthn ceremony. `create` registers a resident credential with `prf.eval` over the salts;\n * when the extension returns no results a single assertion over the new credential produces them.\n * `assert` runs a discoverable (or allowCredentials-scoped) get with the same eval shape.\n */\nexport function createWebAuthnPasskey(rp: WebAuthnRp): PasskeyCeremony {\n  async function assert(input: {\n    readonly credentialIds?: ReadonlyArray<Uint8Array>;\n    readonly salts: PrfSalts;\n  }): Promise<PrfResult> {\n    let credential: PublicKeyCredential;\n    try {\n      credential = checkCredential(\n        await navigator.credentials.get({\n          publicKey: {\n            rpId: rp.id,\n            challenge: crypto.getRandomValues(new Uint8Array(32)),\n            userVerification: \"required\",\n            ...(input.credentialIds === undefined\n              ? {}\n              : {\n                  allowCredentials: input.credentialIds.map((id) => ({\n                    type: \"public-key\" as const,\n                    id: new Uint8Array(id),\n                  })),\n                }),\n            extensions: { prf: { eval: prfEval(input.salts) } },\n          },\n        }),\n      );\n    } catch (error) {\n      mapCeremonyError(error);\n    }\n    const { response } = credential;\n    if (!(response instanceof AuthenticatorAssertionResponse)) {\n      throw factorUnavailable(\"the authenticator returned no assertion response\");\n    }\n    if (!userVerified(response.authenticatorData)) {\n      throw factorUnavailable(\"the passkey assertion was not user-verified\");\n    }\n    return readPrfResult(\n      credential,\n      credential.getClientExtensionResults().prf?.results,\n      input.salts.second !== undefined,\n    );\n  }\n\n  return {\n    create: async (input) => {\n      const userId = new Uint8Array(16);\n      userId[0] = input.purpose === \"wallet\" ? PURPOSE_WALLET : PURPOSE_VAULT;\n      crypto.getRandomValues(userId.subarray(1));\n      let credential: PublicKeyCredential;\n      try {\n        credential = checkCredential(\n          await navigator.credentials.create({\n            publicKey: {\n              rp: { id: rp.id, name: rp.name },\n              user: {\n                id: userId,\n                name: input.name,\n                displayName: input.name,\n              },\n              challenge: crypto.getRandomValues(new Uint8Array(32)),\n              pubKeyCredParams: [\n                { type: \"public-key\", alg: -7 },\n                { type: \"public-key\", alg: -257 },\n              ],\n              authenticatorSelection: {\n                residentKey: \"required\",\n                userVerification: \"required\",\n              },\n              extensions: { prf: { eval: prfEval(input.salts) } },\n            },\n          }),\n        );\n      } catch (error) {\n        mapCeremonyError(error);\n      }\n      const { response } = credential;\n      if (!(response instanceof AuthenticatorAttestationResponse)) {\n        throw factorUnavailable(\"the authenticator returned no attestation response\");\n      }\n      const extensions = credential.getClientExtensionResults();\n      if (extensions.prf?.enabled !== true) {\n        throw factorUnavailable(\"the authenticator does not support the PRF extension\");\n      }\n      if (extensions.prf.results === undefined) {\n        // Some authenticators omit creation-time PRF outputs: one assertion over the new\n        // credential produces them (and it is that response whose UV flag must be checked).\n        return assert({\n          credentialIds: [copyBufferSource(credential.rawId)],\n          salts: input.salts,\n        });\n      }\n      if (!userVerified(response.getAuthenticatorData())) {\n        throw factorUnavailable(\"the passkey creation was not user-verified\");\n      }\n      return readPrfResult(credential, extensions.prf.results, input.salts.second !== undefined);\n    },\n    assert,\n  };\n}\n","/**\n * The Web host: `createWebWallet` spawns the bundled kernel worker (dist/kernel.worker.js) whose\n * vault lives in the worker's own IndexedDB. Lock destroys the worker; the vault survives in\n * IndexedDB, so the respawned worker reloads it. Page lifecycle locks: 5 minutes hidden or\n * `pagehide`. The WebAuthn ceremony runs on the main thread.\n */\nimport { WalletError } from \"@qntx/wallet\";\nimport type { Wallet, WalletOptions } from \"@qntx/wallet\";\nimport { connectKernel } from \"@qntx/wallet/host\";\nimport type { MainPort } from \"@qntx/wallet/host\";\nimport type { ProtocolValue } from \"@qntx/wallet/protocol\";\n\nimport type { BrowserWorkerInit } from \"../shared.ts\";\nimport { createWebAuthnPasskey } from \"./passkey.ts\";\n\nconst MAX_SESSION_MS = 12 * 3_600_000; // fixed: 12 h\nconst HIDDEN_LOCK_MS = 5 * 60_000; // lock after the page has been hidden for 5 minutes\n\nasync function bestEffort(task: () => Promise<unknown>): Promise<void> {\n  try {\n    await task();\n  } catch {\n    // Lifecycle hooks and persistence hints must never surface failures.\n  }\n}\n\nexport async function createWebWallet(options: WalletOptions): Promise<Wallet> {\n  const { autoLock } = options;\n  if (autoLock.platform !== \"web\") {\n    throw new WalletError(\"invalid-input\", \"createWebWallet accepts only the web autoLock policy\");\n  }\n  const init: BrowserWorkerInit = {\n    t: \"init\",\n    idleMs: autoLock.idleMinutes * 60_000,\n    maxSessionMs: MAX_SESSION_MS,\n  };\n  const kernelUrl = new URL(\"kernel.worker.js\", import.meta.url);\n  const ceremony = createWebAuthnPasskey({\n    id: options.passkey.rpId,\n    name: options.passkey.rpName,\n  });\n\n  const spawn = (): MainPort => {\n    const worker = new Worker(kernelUrl, { type: \"module\", name: \"qntx-wallet\" });\n    // oxlint-disable-next-line unicorn/require-post-message-target-origin -- Worker.postMessage takes a transfer list, not an origin\n    worker.postMessage(init); // the kernel validates it strictly before startKernel\n    return {\n      post: (message: ProtocolValue, transfer: ArrayBuffer[]) => {\n        worker.postMessage(message, transfer);\n      },\n      listen: (handler) => {\n        const listener = (event: MessageEvent): void => {\n          handler(event.data);\n        };\n        worker.addEventListener(\"message\", listener);\n        return () => {\n          worker.removeEventListener(\"message\", listener);\n        };\n      },\n      onExit: (handler) => {\n        // Web Workers have no exit event; error/messageerror are the only death signals.\n        const listener = (): void => {\n          handler();\n        };\n        worker.addEventListener(\"error\", listener);\n        worker.addEventListener(\"messageerror\", listener);\n        return () => {\n          worker.removeEventListener(\"error\", listener);\n          worker.removeEventListener(\"messageerror\", listener);\n        };\n      },\n      terminate: () => {\n        worker.terminate();\n      },\n    };\n  };\n\n  const wallet = await connectKernel({\n    spawn,\n    passkey: options.passkey,\n    ceremony,\n    onDestroy: () => {\n      document.removeEventListener(\"visibilitychange\", onVisibility);\n      globalThis.removeEventListener(\"pagehide\", onPageHide);\n      globalThis.clearTimeout(hiddenTimer);\n    },\n  });\n\n  // Page lifecycle: lock when the page has been hidden for 5 minutes, and on pagehide. A\n  // BFCache-frozen page still runs the queued locked-event handler on restore, so the wallet\n  // respawns then — terminating the worker directly would leave the wallet pointing at a dead\n  // port.\n  let hiddenTimer = 0;\n  const onVisibility = (): void => {\n    if (document.visibilityState === \"hidden\") {\n      hiddenTimer = globalThis.setTimeout(() => {\n        void bestEffort(async () => wallet.vault.lock());\n      }, HIDDEN_LOCK_MS);\n    } else {\n      globalThis.clearTimeout(hiddenTimer);\n    }\n  };\n  const onPageHide = (): void => {\n    void bestEffort(async () => wallet.vault.lock());\n  };\n  document.addEventListener(\"visibilitychange\", onVisibility);\n  globalThis.addEventListener(\"pagehide\", onPageHide);\n\n  // Ask the browser to persist the vault once it exists — a denied request is fine.\n  let persisted = false;\n  const unsubscribe = wallet.subscribe(() => {\n    if (!persisted && wallet.getSnapshot().vault !== \"uninitialized\") {\n      persisted = true;\n      unsubscribe();\n      void bestEffort(async () => navigator.storage.persist());\n    }\n  });\n\n  return wallet;\n}\n\nexport { createWebAuthnPasskey } from \"./passkey.ts\";\nexport type { WebAuthnRp } from \"./passkey.ts\";\n"],"mappings":";;;;;;;;;;AAgBA,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;AACtB,MAAM,UAAU;AAEhB,SAAS,kBAAkB,SAA8B;CACvD,OAAO,IAAI,YAAY,sBAAsB,OAAO;AACtD;AAEA,SAAS,UAAU,SAA8B;CAC/C,OAAO,IAAI,YAAY,aAAa,OAAO;AAC7C;AAEA,SAAS,iBAAiB,OAAuB;CAC/C,IACE,iBAAiB,iBAChB,MAAM,SAAS,qBAAqB,MAAM,SAAS,eAEpD,MAAM,UAAU,oCAAoC;CAEtD,IAAI,iBAAiB,aACnB,MAAM;CAER,MAAM,kBAAkB,6BAA6B;AACvD;;AAGA,SAAS,aAAa,mBAAyC;CAC7D,OACE,kBAAkB,aAAa,OAE9B,IAAI,SAAS,iBAAiB,CAAC,CAAC,SAAS,EAAE,IAAI,aAAa;AAEjE;AAEA,SAAS,QAAQ,OAAoD;CAGnE,OAAO,MAAM,WAAW,KAAA,IACpB,EAAE,OAAO,IAAI,WAAW,MAAM,KAAK,EAAE,IACrC;EAAE,OAAO,IAAI,WAAW,MAAM,KAAK;EAAG,QAAQ,IAAI,WAAW,MAAM,MAAM;CAAE;AACjF;;AAGA,SAAS,iBAAiB,QAAkC;CAC1D,MAAM,OACJ,kBAAkB,cACd,IAAI,WAAW,MAAM,IACrB,IAAI,WAAW,OAAO,QAAQ,OAAO,YAAY,OAAO,UAAU;CACxE,OAAO,IAAI,WAAW,IAAI;AAC5B;AAEA,SAAS,cACP,YACA,SACA,YACW;CACX,MAAM,QAAQ,SAAS;CACvB,MAAM,SAAS,SAAS;CACxB,IAAI,UAAU,KAAA,KAAc,cAAc,WAAW,KAAA,GACnD,MAAM,kBAAkB,oCAAoC;CAG9D,OAAO;EACL,cAAc,iBAAiB,WAAW,KAAK;EAC/C,OAAO,iBAAiB,KAAK;EAC7B,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,iBAAiB,MAAM,EAAE;CACrE;AACF;AAEA,SAAS,gBAAgB,YAA0C;CACjE,IAAI,EAAE,sBAAsB,sBAC1B,MAAM,kBAAkB,qDAAqD;CAE/E,OAAO;AACT;;;;;;AAOA,SAAgB,sBAAsB,IAAiC;CACrE,eAAe,OAAO,OAGC;EACrB,IAAI;EACJ,IAAI;GACF,aAAa,gBACX,MAAM,UAAU,YAAY,IAAI,EAC9B,WAAW;IACT,MAAM,GAAG;IACT,WAAW,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC;IACpD,kBAAkB;IAClB,GAAI,MAAM,kBAAkB,KAAA,IACxB,CAAC,IACD,EACE,kBAAkB,MAAM,cAAc,KAAK,QAAQ;KACjD,MAAM;KACN,IAAI,IAAI,WAAW,EAAE;IACvB,EAAE,EACJ;IACJ,YAAY,EAAE,KAAK,EAAE,MAAM,QAAQ,MAAM,KAAK,EAAE,EAAE;GACpD,EACF,CAAC,CACH;EACF,SAAS,OAAO;GACd,iBAAiB,KAAK;EACxB;EACA,MAAM,EAAE,aAAa;EACrB,IAAI,EAAE,oBAAoB,iCACxB,MAAM,kBAAkB,kDAAkD;EAE5E,IAAI,CAAC,aAAa,SAAS,iBAAiB,GAC1C,MAAM,kBAAkB,6CAA6C;EAEvE,OAAO,cACL,YACA,WAAW,0BAA0B,CAAC,CAAC,KAAK,SAC5C,MAAM,MAAM,WAAW,KAAA,CACzB;CACF;CAEA,OAAO;EACL,QAAQ,OAAO,UAAU;GACvB,MAAM,yBAAS,IAAI,WAAW,EAAE;GAChC,OAAO,KAAK,MAAM,YAAY,WAAW,iBAAiB;GAC1D,OAAO,gBAAgB,OAAO,SAAS,CAAC,CAAC;GACzC,IAAI;GACJ,IAAI;IACF,aAAa,gBACX,MAAM,UAAU,YAAY,OAAO,EACjC,WAAW;KACT,IAAI;MAAE,IAAI,GAAG;MAAI,MAAM,GAAG;KAAK;KAC/B,MAAM;MACJ,IAAI;MACJ,MAAM,MAAM;MACZ,aAAa,MAAM;KACrB;KACA,WAAW,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC;KACpD,kBAAkB,CAChB;MAAE,MAAM;MAAc,KAAK;KAAG,GAC9B;MAAE,MAAM;MAAc,KAAK;KAAK,CAClC;KACA,wBAAwB;MACtB,aAAa;MACb,kBAAkB;KACpB;KACA,YAAY,EAAE,KAAK,EAAE,MAAM,QAAQ,MAAM,KAAK,EAAE,EAAE;IACpD,EACF,CAAC,CACH;GACF,SAAS,OAAO;IACd,iBAAiB,KAAK;GACxB;GACA,MAAM,EAAE,aAAa;GACrB,IAAI,EAAE,oBAAoB,mCACxB,MAAM,kBAAkB,oDAAoD;GAE9E,MAAM,aAAa,WAAW,0BAA0B;GACxD,IAAI,WAAW,KAAK,YAAY,MAC9B,MAAM,kBAAkB,sDAAsD;GAEhF,IAAI,WAAW,IAAI,YAAY,KAAA,GAG7B,OAAO,OAAO;IACZ,eAAe,CAAC,iBAAiB,WAAW,KAAK,CAAC;IAClD,OAAO,MAAM;GACf,CAAC;GAEH,IAAI,CAAC,aAAa,SAAS,qBAAqB,CAAC,GAC/C,MAAM,kBAAkB,4CAA4C;GAEtE,OAAO,cAAc,YAAY,WAAW,IAAI,SAAS,MAAM,MAAM,WAAW,KAAA,CAAS;EAC3F;EACA;CACF;AACF;;;;;;;;;ACnLA,MAAM,iBAAiB;AACvB,MAAM,iBAAiB;AAEvB,eAAe,WAAW,MAA6C;CACrE,IAAI;EACF,MAAM,KAAK;CACb,QAAQ,CAER;AACF;AAEA,eAAsB,gBAAgB,SAAyC;CAC7E,MAAM,EAAE,aAAa;CACrB,IAAI,SAAS,aAAa,OACxB,MAAM,IAAI,YAAY,iBAAiB,sDAAsD;CAE/F,MAAM,OAA0B;EAC9B,GAAG;EACH,QAAQ,SAAS,cAAc;EAC/B,cAAc;CAChB;CACA,MAAM,YAAY,IAAI,IAAI,oBAAoB,YAAY,GAAG;CAC7D,MAAM,WAAW,sBAAsB;EACrC,IAAI,QAAQ,QAAQ;EACpB,MAAM,QAAQ,QAAQ;CACxB,CAAC;CAED,MAAM,cAAwB;EAC5B,MAAM,SAAS,IAAI,OAAO,WAAW;GAAE,MAAM;GAAU,MAAM;EAAc,CAAC;EAE5E,OAAO,YAAY,IAAI;EACvB,OAAO;GACL,OAAO,SAAwB,aAA4B;IACzD,OAAO,YAAY,SAAS,QAAQ;GACtC;GACA,SAAS,YAAY;IACnB,MAAM,YAAY,UAA8B;KAC9C,QAAQ,MAAM,IAAI;IACpB;IACA,OAAO,iBAAiB,WAAW,QAAQ;IAC3C,aAAa;KACX,OAAO,oBAAoB,WAAW,QAAQ;IAChD;GACF;GACA,SAAS,YAAY;IAEnB,MAAM,iBAAuB;KAC3B,QAAQ;IACV;IACA,OAAO,iBAAiB,SAAS,QAAQ;IACzC,OAAO,iBAAiB,gBAAgB,QAAQ;IAChD,aAAa;KACX,OAAO,oBAAoB,SAAS,QAAQ;KAC5C,OAAO,oBAAoB,gBAAgB,QAAQ;IACrD;GACF;GACA,iBAAiB;IACf,OAAO,UAAU;GACnB;EACF;CACF;CAEA,MAAM,SAAS,MAAM,cAAc;EACjC;EACA,SAAS,QAAQ;EACjB;EACA,iBAAiB;GACf,SAAS,oBAAoB,oBAAoB,YAAY;GAC7D,WAAW,oBAAoB,YAAY,UAAU;GACrD,WAAW,aAAa,WAAW;EACrC;CACF,CAAC;CAMD,IAAI,cAAc;CAClB,MAAM,qBAA2B;EAC/B,IAAI,SAAS,oBAAoB,UAC/B,cAAc,WAAW,iBAAiB;GACxC,WAAgB,YAAY,OAAO,MAAM,KAAK,CAAC;EACjD,GAAG,cAAc;OAEjB,WAAW,aAAa,WAAW;CAEvC;CACA,MAAM,mBAAyB;EAC7B,WAAgB,YAAY,OAAO,MAAM,KAAK,CAAC;CACjD;CACA,SAAS,iBAAiB,oBAAoB,YAAY;CAC1D,WAAW,iBAAiB,YAAY,UAAU;CAGlD,IAAI,YAAY;CAChB,MAAM,cAAc,OAAO,gBAAgB;EACzC,IAAI,CAAC,aAAa,OAAO,YAAY,CAAC,CAAC,UAAU,iBAAiB;GAChE,YAAY;GACZ,YAAY;GACZ,WAAgB,YAAY,UAAU,QAAQ,QAAQ,CAAC;EACzD;CACF,CAAC;CAED,OAAO;AACT"}