@qntx/wallet-worker 0.6.0 → 0.7.0

package/dist/browser.d.mts

@@ -1,6 +1,5 @@
 import { Wallet, WalletOptions } from "@qntx/wallet";
 import { PasskeyCeremony } from "@qntx/wallet/host";
-//#region src/browser/passkey.d.ts
 type WebAuthnRp = {
   /** RP id — the origin's effective domain, e.g. `location.hostname`. */
   readonly id: string;
@@ -12,9 +11,6 @@ type WebAuthnRp = {
  * `assert` runs a discoverable (or allowCredentials-scoped) get with the same eval shape.
  */
 export declare function createWebAuthnPasskey(rp: WebAuthnRp): PasskeyCeremony;
-//#endregion
-//#region src/browser/index.d.ts
 export declare function createWebWallet(options: WalletOptions): Promise<Wallet>;
-//#endregion
 export type { WebAuthnRp };
 //# sourceMappingURL=browser.d.mts.map

package/dist/browser.mjs

@@ -1,6 +1,6 @@
 import { WalletError } from "@qntx/wallet";
 import { PASSKEY_PURPOSE_VAULT, PASSKEY_PURPOSE_WALLET, connectKernel } from "@qntx/wallet/host";
-//#region src/browser/passkey.ts
+// src/browser/passkey.ts
 /**
 * The WebAuthn passkey ceremony (main thread only): `navigator.credentials` with the PRF extension.
 * A wallet passkey derives the wallet seed from `PRF(walletSalt)`; the vault factor derives the
@@ -134,8 +134,7 @@ function createWebAuthnPasskey(rp) {
 		assert
 	};
 }
-//#endregion
-//#region src/browser/index.ts
+// src/browser/index.ts
 /**
 * The Web host: `createWebWallet` spawns the bundled kernel worker (dist/kernel.worker.js) whose
 * vault lives in the worker's own IndexedDB. Lock destroys the worker; the vault survives in
@@ -251,7 +250,6 @@ async function createWebWallet(options) {
 	});
 	return wallet;
 }
-//#endregion
 export { createWebAuthnPasskey, createWebWallet };
 
 //# sourceMappingURL=browser.mjs.map

package/dist/browser.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"browser.mjs","names":[],"sources":["../src/browser/passkey.ts","../src/browser/index.ts"],"sourcesContent":["/**\n * The WebAuthn passkey ceremony (main thread only): `navigator.credentials` with the PRF extension.\n * A wallet passkey derives the wallet seed from `PRF(walletSalt)`; the vault factor derives the\n * vault KEK from `PRF(vaultSalt)` on the same credential. Every ceremony output is checked for\n * `prf.enabled`, PRF results and the user-verification flag — a credential that cannot prove UV\n * never reaches the kernel.\n */\nimport { WalletError } from \"@qntx/wallet\";\nimport { PASSKEY_PURPOSE_VAULT, PASSKEY_PURPOSE_WALLET } from \"@qntx/wallet/host\";\nimport type { PasskeyCeremony, PrfResult, PrfSalts } from \"@qntx/wallet/host\";\n\nexport type WebAuthnRp = {\n  /** RP id — the origin's effective domain, e.g. `location.hostname`. */\n  readonly id: string;\n  readonly name: string;\n};\n\nconst UV_FLAG = 0x04; // authenticator-data flags byte (offset 32), bit 2 = user verified\nconst BE_FLAG = 0x08; // bit 3 = credential is backup-eligible (multi-device capable)\nconst BS_FLAG = 0x10; // bit 4 = credential is currently backed up (synced)\n\nfunction factorUnavailable(message: string): WalletError {\n  return new WalletError(\"factor-unavailable\", message);\n}\n\nfunction cancelled(message: string): WalletError {\n  return new WalletError(\"cancelled\", message);\n}\n\nfunction mapCeremonyError(error: unknown): never {\n  if (\n    error instanceof DOMException &&\n    (error.name === \"NotAllowedError\" || error.name === \"AbortError\")\n  ) {\n    throw cancelled(\"the passkey ceremony was cancelled\");\n  }\n  if (error instanceof WalletError) {\n    throw error;\n  }\n  throw factorUnavailable(\"the passkey ceremony failed\");\n}\n\n/** The UV bit of an authenticator-data blob (flags byte at offset 32, bit 0x04). */\nfunction userVerified(authenticatorData: ArrayBuffer): boolean {\n  return (\n    authenticatorData.byteLength > 32 &&\n    // oxlint-disable-next-line eslint/no-bitwise -- flags bit test\n    (new DataView(authenticatorData).getUint8(32) & UV_FLAG) !== 0\n  );\n}\n\n/**\n * Whether the credential is backed up off-device (flags byte at offset 32): synced requires both BE\n * (the credential is eligible for backup) and BS (the authenticator actually backs it up).\n */\nfunction credentialSynced(authenticatorData: ArrayBuffer): boolean {\n  return (\n    authenticatorData.byteLength > 32 &&\n    // oxlint-disable-next-line eslint/no-bitwise -- flags bit test\n    (new DataView(authenticatorData).getUint8(32) & (BE_FLAG | BS_FLAG)) === (BE_FLAG | BS_FLAG)\n  );\n}\n\nfunction prfEval(salts: PrfSalts): AuthenticationExtensionsPRFValues {\n  // The constructor copy narrows Uint8Array<ArrayBufferLike> to Uint8Array<ArrayBuffer> —\n  // the DOM BufferSource does not admit shared-array-buffer views.\n  return salts.second === undefined\n    ? { first: new Uint8Array(salts.first) }\n    : { first: new Uint8Array(salts.first), second: new Uint8Array(salts.second) };\n}\n\n/** A detached copy of a BufferSource — the returned Uint8Array owns its own fresh buffer. */\nfunction copyBufferSource(source: BufferSource): Uint8Array {\n  const view =\n    source instanceof ArrayBuffer\n      ? new Uint8Array(source)\n      : new Uint8Array(source.buffer, source.byteOffset, source.byteLength);\n  return new Uint8Array(view);\n}\n\nfunction readPrfResult(\n  credential: PublicKeyCredential,\n  results: AuthenticationExtensionsPRFValues | undefined,\n  wantSecond: boolean,\n  synced: boolean,\n  userHandle?: ArrayBuffer,\n): PrfResult {\n  const first = results?.first;\n  const second = results?.second;\n  if (first === undefined || (wantSecond && second === undefined)) {\n    throw factorUnavailable(\"the passkey produced no PRF output\");\n  }\n  // Copy into fresh Uint8Arrays and drop every reference to the extension's ArrayBuffers.\n  return {\n    credentialId: copyBufferSource(credential.rawId),\n    first: copyBufferSource(first),\n    ...(second === undefined ? {} : { second: copyBufferSource(second) }),\n    ...(userHandle === undefined ? {} : { userHandle: copyBufferSource(userHandle) }),\n    synced,\n  };\n}\n\nfunction checkCredential(credential: unknown): PublicKeyCredential {\n  if (!(credential instanceof PublicKeyCredential)) {\n    throw factorUnavailable(\"the authenticator returned no public-key credential\");\n  }\n  return credential;\n}\n\n/**\n * The WebAuthn ceremony. `create` registers a resident credential with `prf.eval` over the salts;\n * when the extension returns no results a single assertion over the new credential produces them.\n * `assert` runs a discoverable (or allowCredentials-scoped) get with the same eval shape.\n */\nexport function createWebAuthnPasskey(rp: WebAuthnRp): PasskeyCeremony {\n  async function assert(input: {\n    readonly credentialIds?: ReadonlyArray<Uint8Array>;\n    readonly salts: PrfSalts;\n  }): Promise<PrfResult> {\n    let credential: PublicKeyCredential;\n    try {\n      credential = checkCredential(\n        await navigator.credentials.get({\n          publicKey: {\n            rpId: rp.id,\n            challenge: crypto.getRandomValues(new Uint8Array(32)),\n            userVerification: \"required\",\n            ...(input.credentialIds === undefined\n              ? {}\n              : {\n                  allowCredentials: input.credentialIds.map((id) => ({\n                    type: \"public-key\" as const,\n                    id: new Uint8Array(id),\n                  })),\n                }),\n            extensions: { prf: { eval: prfEval(input.salts) } },\n          },\n        }),\n      );\n    } catch (error) {\n      mapCeremonyError(error);\n    }\n    const { response } = credential;\n    if (!(response instanceof AuthenticatorAssertionResponse)) {\n      throw factorUnavailable(\"the authenticator returned no assertion response\");\n    }\n    if (!userVerified(response.authenticatorData)) {\n      throw factorUnavailable(\"the passkey assertion was not user-verified\");\n    }\n    return readPrfResult(\n      credential,\n      credential.getClientExtensionResults().prf?.results,\n      input.salts.second !== undefined,\n      credentialSynced(response.authenticatorData),\n      response.userHandle ?? undefined,\n    );\n  }\n\n  return {\n    create: async (input) => {\n      const userId = new Uint8Array(16);\n      userId[0] = input.purpose === \"wallet\" ? PASSKEY_PURPOSE_WALLET : PASSKEY_PURPOSE_VAULT;\n      crypto.getRandomValues(userId.subarray(1));\n      let credential: PublicKeyCredential;\n      try {\n        credential = checkCredential(\n          await navigator.credentials.create({\n            publicKey: {\n              rp: { id: rp.id, name: rp.name },\n              user: {\n                id: userId,\n                name: input.name,\n                displayName: input.name,\n              },\n              challenge: crypto.getRandomValues(new Uint8Array(32)),\n              pubKeyCredParams: [\n                { type: \"public-key\", alg: -7 },\n                { type: \"public-key\", alg: -257 },\n              ],\n              authenticatorSelection: {\n                residentKey: \"required\",\n                userVerification: \"required\",\n              },\n              extensions: { prf: { eval: prfEval(input.salts) } },\n            },\n          }),\n        );\n      } catch (error) {\n        mapCeremonyError(error);\n      }\n      const { response } = credential;\n      if (!(response instanceof AuthenticatorAttestationResponse)) {\n        throw factorUnavailable(\"the authenticator returned no attestation response\");\n      }\n      const extensions = credential.getClientExtensionResults();\n      if (extensions.prf?.enabled !== true) {\n        throw factorUnavailable(\"the authenticator does not support the PRF extension\");\n      }\n      if (extensions.prf.results === undefined) {\n        // Some authenticators omit creation-time PRF outputs: one assertion over the new\n        // credential produces them (it is that response whose UV and BE/BS flags get read).\n        return assert({\n          credentialIds: [copyBufferSource(credential.rawId)],\n          salts: input.salts,\n        });\n      }\n      const authenticatorData = response.getAuthenticatorData();\n      if (!userVerified(authenticatorData)) {\n        throw factorUnavailable(\"the passkey creation was not user-verified\");\n      }\n      return readPrfResult(\n        credential,\n        extensions.prf.results,\n        input.salts.second !== undefined,\n        credentialSynced(authenticatorData),\n      );\n    },\n    assert,\n  };\n}\n","/**\n * The Web host: `createWebWallet` spawns the bundled kernel worker (dist/kernel.worker.js) whose\n * vault lives in the worker's own IndexedDB. Lock destroys the worker; the vault survives in\n * IndexedDB, so the respawned worker reloads it. `pagehide` locks immediately; the idle timer is\n * refreshed by user-presence signals, not request traffic. The WebAuthn ceremony runs on the main\n * thread.\n */\nimport { WalletError } from \"@qntx/wallet\";\nimport type { Wallet, WalletOptions } from \"@qntx/wallet\";\nimport { connectKernel } from \"@qntx/wallet/host\";\nimport type { MainPort } from \"@qntx/wallet/host\";\nimport type { ProtocolValue } from \"@qntx/wallet/protocol\";\n\nimport type { BrowserWorkerInit } from \"../shared.ts\";\nimport { createWebAuthnPasskey } from \"./passkey.ts\";\n\nconst LISTENER_OPTIONS = { capture: true, passive: true };\nconst ACTIVITY_EVENTS = [\"pointerdown\", \"pointermove\", \"keydown\", \"wheel\", \"touchstart\"];\n\n/**\n * The browser's user-presence source: direct input on the page, or returning to a visible tab.\n * Capture-phase passive listeners do a single boolean check per event — high-frequency signals\n * (scroll, pointermove) cost nothing. Returns the unsubscribe the wallet owns.\n */\nfunction subscribePresence(onActivity: () => void): () => void {\n  for (const type of ACTIVITY_EVENTS) {\n    globalThis.addEventListener(type, onActivity, LISTENER_OPTIONS);\n  }\n  const onVisible = (): void => {\n    if (document.visibilityState === \"visible\") {\n      onActivity();\n    }\n  };\n  document.addEventListener(\"visibilitychange\", onVisible);\n  return () => {\n    for (const type of ACTIVITY_EVENTS) {\n      globalThis.removeEventListener(type, onActivity, LISTENER_OPTIONS);\n    }\n    document.removeEventListener(\"visibilitychange\", onVisible);\n  };\n}\n\nasync function bestEffort(task: () => Promise<unknown>): Promise<void> {\n  try {\n    await task();\n  } catch {\n    // Lifecycle hooks and persistence hints must never surface failures.\n  }\n}\n\nexport async function createWebWallet(options: WalletOptions): Promise<Wallet> {\n  const { autoLock } = options;\n  if (autoLock.platform !== \"web\") {\n    throw new WalletError(\"invalid-input\", \"createWebWallet accepts only the web autoLock policy\");\n  }\n  // The page sends only the idle choice; the worker owns the maximum session duration.\n  const init: BrowserWorkerInit = { t: \"init\", idleMinutes: autoLock.idleMinutes };\n  const ceremony = createWebAuthnPasskey({\n    id: options.passkey.rpId,\n    name: options.passkey.rpName,\n  });\n\n  const spawn = (): MainPort => {\n    // Keep this exact `new Worker(new URL(\"…\", import.meta.url))` shape: bundlers (Vite,\n    // webpack, Parcel, esbuild-based tools) recognize only this literal form as a worker entry and\n    // bundle the kernel with its chunks and spark.wasm. A precomputed URL is copied as one opaque\n    // asset, and the worker then dies loading its first chunk.\n    const worker = new Worker(new URL(\"kernel.worker.js\", import.meta.url), {\n      type: \"module\",\n      name: \"qntx-wallet\",\n    });\n    // oxlint-disable-next-line unicorn/require-post-message-target-origin -- Worker.postMessage takes a transfer list, not an origin\n    worker.postMessage(init); // the kernel validates it strictly before startKernel\n    return {\n      post: (message: ProtocolValue, transfer: ArrayBuffer[]) => {\n        worker.postMessage(message, transfer);\n      },\n      listen: (handler) => {\n        const listener = (event: MessageEvent): void => {\n          handler(event.data);\n        };\n        worker.addEventListener(\"message\", listener);\n        return () => {\n          worker.removeEventListener(\"message\", listener);\n        };\n      },\n      onExit: (handler) => {\n        // Web Workers have no exit event; error/messageerror are the only death signals.\n        const listener = (): void => {\n          handler(\"crashed\");\n        };\n        worker.addEventListener(\"error\", listener);\n        worker.addEventListener(\"messageerror\", listener);\n        return () => {\n          worker.removeEventListener(\"error\", listener);\n          worker.removeEventListener(\"messageerror\", listener);\n        };\n      },\n      terminate: () => {\n        worker.terminate();\n      },\n    };\n  };\n\n  const wallet = await connectKernel({\n    factors: \"software\",\n    spawn,\n    passkey: options.passkey,\n    ceremony,\n    setTimer: (delayMs, fn) => {\n      const timer = globalThis.setTimeout(fn, delayMs);\n      return () => {\n        globalThis.clearTimeout(timer);\n      };\n    },\n    presence: subscribePresence,\n    onDestroy: () => {\n      globalThis.removeEventListener(\"pagehide\", onPageHide);\n    },\n  });\n\n  // Page lifecycle: lock on pagehide. A BFCache-frozen page still runs the queued locked-event\n  // handler on restore, so the wallet respawns then — terminating the worker directly would\n  // leave the wallet pointing at a dead port.\n  const onPageHide = (): void => {\n    void bestEffort(async () => wallet.vault.lock());\n  };\n  globalThis.addEventListener(\"pagehide\", onPageHide);\n\n  // Ask the browser to persist the vault once it exists — a denied request is fine.\n  let persisted = false;\n  const unsubscribe = wallet.subscribe(() => {\n    if (!persisted && wallet.getSnapshot().vault !== \"uninitialized\") {\n      persisted = true;\n      unsubscribe();\n      void bestEffort(async () => navigator.storage.persist());\n    }\n  });\n\n  return wallet;\n}\n\nexport { createWebAuthnPasskey } from \"./passkey.ts\";\nexport type { WebAuthnRp } from \"./passkey.ts\";\n"],"mappings":";;;;;;;;;;AAiBA,MAAM,UAAU;AAIhB,SAAS,kBAAkB,SAA8B;CACvD,OAAO,IAAI,YAAY,sBAAsB,OAAO;AACtD;AAEA,SAAS,UAAU,SAA8B;CAC/C,OAAO,IAAI,YAAY,aAAa,OAAO;AAC7C;AAEA,SAAS,iBAAiB,OAAuB;CAC/C,IACE,iBAAiB,iBAChB,MAAM,SAAS,qBAAqB,MAAM,SAAS,eAEpD,MAAM,UAAU,oCAAoC;CAEtD,IAAI,iBAAiB,aACnB,MAAM;CAER,MAAM,kBAAkB,6BAA6B;AACvD;;AAGA,SAAS,aAAa,mBAAyC;CAC7D,OACE,kBAAkB,aAAa,OAE9B,IAAI,SAAS,iBAAiB,CAAC,CAAC,SAAS,EAAE,IAAI,aAAa;AAEjE;;;;;AAMA,SAAS,iBAAiB,mBAAyC;CACjE,OACE,kBAAkB,aAAa,OAE9B,IAAI,SAAS,iBAAiB,CAAC,CAAC,SAAS,EAAE,IAAK,QAAyB;AAE9E;AAEA,SAAS,QAAQ,OAAoD;CAGnE,OAAO,MAAM,WAAW,KAAA,IACpB,EAAE,OAAO,IAAI,WAAW,MAAM,KAAK,EAAE,IACrC;EAAE,OAAO,IAAI,WAAW,MAAM,KAAK;EAAG,QAAQ,IAAI,WAAW,MAAM,MAAM;CAAE;AACjF;;AAGA,SAAS,iBAAiB,QAAkC;CAC1D,MAAM,OACJ,kBAAkB,cACd,IAAI,WAAW,MAAM,IACrB,IAAI,WAAW,OAAO,QAAQ,OAAO,YAAY,OAAO,UAAU;CACxE,OAAO,IAAI,WAAW,IAAI;AAC5B;AAEA,SAAS,cACP,YACA,SACA,YACA,QACA,YACW;CACX,MAAM,QAAQ,SAAS;CACvB,MAAM,SAAS,SAAS;CACxB,IAAI,UAAU,KAAA,KAAc,cAAc,WAAW,KAAA,GACnD,MAAM,kBAAkB,oCAAoC;CAG9D,OAAO;EACL,cAAc,iBAAiB,WAAW,KAAK;EAC/C,OAAO,iBAAiB,KAAK;EAC7B,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,iBAAiB,MAAM,EAAE;EACnE,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,iBAAiB,UAAU,EAAE;EAC/E;CACF;AACF;AAEA,SAAS,gBAAgB,YAA0C;CACjE,IAAI,EAAE,sBAAsB,sBAC1B,MAAM,kBAAkB,qDAAqD;CAE/E,OAAO;AACT;;;;;;AAOA,SAAgB,sBAAsB,IAAiC;CACrE,eAAe,OAAO,OAGC;EACrB,IAAI;EACJ,IAAI;GACF,aAAa,gBACX,MAAM,UAAU,YAAY,IAAI,EAC9B,WAAW;IACT,MAAM,GAAG;IACT,WAAW,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC;IACpD,kBAAkB;IAClB,GAAI,MAAM,kBAAkB,KAAA,IACxB,CAAC,IACD,EACE,kBAAkB,MAAM,cAAc,KAAK,QAAQ;KACjD,MAAM;KACN,IAAI,IAAI,WAAW,EAAE;IACvB,EAAE,EACJ;IACJ,YAAY,EAAE,KAAK,EAAE,MAAM,QAAQ,MAAM,KAAK,EAAE,EAAE;GACpD,EACF,CAAC,CACH;EACF,SAAS,OAAO;GACd,iBAAiB,KAAK;EACxB;EACA,MAAM,EAAE,aAAa;EACrB,IAAI,EAAE,oBAAoB,iCACxB,MAAM,kBAAkB,kDAAkD;EAE5E,IAAI,CAAC,aAAa,SAAS,iBAAiB,GAC1C,MAAM,kBAAkB,6CAA6C;EAEvE,OAAO,cACL,YACA,WAAW,0BAA0B,CAAC,CAAC,KAAK,SAC5C,MAAM,MAAM,WAAW,KAAA,GACvB,iBAAiB,SAAS,iBAAiB,GAC3C,SAAS,cAAc,KAAA,CACzB;CACF;CAEA,OAAO;EACL,QAAQ,OAAO,UAAU;GACvB,MAAM,yBAAS,IAAI,WAAW,EAAE;GAChC,OAAO,KAAK,MAAM,YAAY,WAAW,yBAAyB;GAClE,OAAO,gBAAgB,OAAO,SAAS,CAAC,CAAC;GACzC,IAAI;GACJ,IAAI;IACF,aAAa,gBACX,MAAM,UAAU,YAAY,OAAO,EACjC,WAAW;KACT,IAAI;MAAE,IAAI,GAAG;MAAI,MAAM,GAAG;KAAK;KAC/B,MAAM;MACJ,IAAI;MACJ,MAAM,MAAM;MACZ,aAAa,MAAM;KACrB;KACA,WAAW,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC;KACpD,kBAAkB,CAChB;MAAE,MAAM;MAAc,KAAK;KAAG,GAC9B;MAAE,MAAM;MAAc,KAAK;KAAK,CAClC;KACA,wBAAwB;MACtB,aAAa;MACb,kBAAkB;KACpB;KACA,YAAY,EAAE,KAAK,EAAE,MAAM,QAAQ,MAAM,KAAK,EAAE,EAAE;IACpD,EACF,CAAC,CACH;GACF,SAAS,OAAO;IACd,iBAAiB,KAAK;GACxB;GACA,MAAM,EAAE,aAAa;GACrB,IAAI,EAAE,oBAAoB,mCACxB,MAAM,kBAAkB,oDAAoD;GAE9E,MAAM,aAAa,WAAW,0BAA0B;GACxD,IAAI,WAAW,KAAK,YAAY,MAC9B,MAAM,kBAAkB,sDAAsD;GAEhF,IAAI,WAAW,IAAI,YAAY,KAAA,GAG7B,OAAO,OAAO;IACZ,eAAe,CAAC,iBAAiB,WAAW,KAAK,CAAC;IAClD,OAAO,MAAM;GACf,CAAC;GAEH,MAAM,oBAAoB,SAAS,qBAAqB;GACxD,IAAI,CAAC,aAAa,iBAAiB,GACjC,MAAM,kBAAkB,4CAA4C;GAEtE,OAAO,cACL,YACA,WAAW,IAAI,SACf,MAAM,MAAM,WAAW,KAAA,GACvB,iBAAiB,iBAAiB,CACpC;EACF;EACA;CACF;AACF;;;;;;;;;;AC3MA,MAAM,mBAAmB;CAAE,SAAS;CAAM,SAAS;AAAK;AACxD,MAAM,kBAAkB;CAAC;CAAe;CAAe;CAAW;CAAS;AAAY;;;;;;AAOvF,SAAS,kBAAkB,YAAoC;CAC7D,KAAK,MAAM,QAAQ,iBACjB,WAAW,iBAAiB,MAAM,YAAY,gBAAgB;CAEhE,MAAM,kBAAwB;EAC5B,IAAI,SAAS,oBAAoB,WAC/B,WAAW;CAEf;CACA,SAAS,iBAAiB,oBAAoB,SAAS;CACvD,aAAa;EACX,KAAK,MAAM,QAAQ,iBACjB,WAAW,oBAAoB,MAAM,YAAY,gBAAgB;EAEnE,SAAS,oBAAoB,oBAAoB,SAAS;CAC5D;AACF;AAEA,eAAe,WAAW,MAA6C;CACrE,IAAI;EACF,MAAM,KAAK;CACb,QAAQ,CAER;AACF;AAEA,eAAsB,gBAAgB,SAAyC;CAC7E,MAAM,EAAE,aAAa;CACrB,IAAI,SAAS,aAAa,OACxB,MAAM,IAAI,YAAY,iBAAiB,sDAAsD;CAG/F,MAAM,OAA0B;EAAE,GAAG;EAAQ,aAAa,SAAS;CAAY;CAC/E,MAAM,WAAW,sBAAsB;EACrC,IAAI,QAAQ,QAAQ;EACpB,MAAM,QAAQ,QAAQ;CACxB,CAAC;CAED,MAAM,cAAwB;EAK5B,MAAM,SAAS,IAAI,OAAO,IAAI,IAAI,oBAAoB,YAAY,GAAG,GAAG;GACtE,MAAM;GACN,MAAM;EACR,CAAC;EAED,OAAO,YAAY,IAAI;EACvB,OAAO;GACL,OAAO,SAAwB,aAA4B;IACzD,OAAO,YAAY,SAAS,QAAQ;GACtC;GACA,SAAS,YAAY;IACnB,MAAM,YAAY,UAA8B;KAC9C,QAAQ,MAAM,IAAI;IACpB;IACA,OAAO,iBAAiB,WAAW,QAAQ;IAC3C,aAAa;KACX,OAAO,oBAAoB,WAAW,QAAQ;IAChD;GACF;GACA,SAAS,YAAY;IAEnB,MAAM,iBAAuB;KAC3B,QAAQ,SAAS;IACnB;IACA,OAAO,iBAAiB,SAAS,QAAQ;IACzC,OAAO,iBAAiB,gBAAgB,QAAQ;IAChD,aAAa;KACX,OAAO,oBAAoB,SAAS,QAAQ;KAC5C,OAAO,oBAAoB,gBAAgB,QAAQ;IACrD;GACF;GACA,iBAAiB;IACf,OAAO,UAAU;GACnB;EACF;CACF;CAEA,MAAM,SAAS,MAAM,cAAc;EACjC,SAAS;EACT;EACA,SAAS,QAAQ;EACjB;EACA,WAAW,SAAS,OAAO;GACzB,MAAM,QAAQ,WAAW,WAAW,IAAI,OAAO;GAC/C,aAAa;IACX,WAAW,aAAa,KAAK;GAC/B;EACF;EACA,UAAU;EACV,iBAAiB;GACf,WAAW,oBAAoB,YAAY,UAAU;EACvD;CACF,CAAC;CAKD,MAAM,mBAAyB;EAC7B,WAAgB,YAAY,OAAO,MAAM,KAAK,CAAC;CACjD;CACA,WAAW,iBAAiB,YAAY,UAAU;CAGlD,IAAI,YAAY;CAChB,MAAM,cAAc,OAAO,gBAAgB;EACzC,IAAI,CAAC,aAAa,OAAO,YAAY,CAAC,CAAC,UAAU,iBAAiB;GAChE,YAAY;GACZ,YAAY;GACZ,WAAgB,YAAY,UAAU,QAAQ,QAAQ,CAAC;EACzD;CACF,CAAC;CAED,OAAO;AACT"}
+{"version":3,"file":"browser.mjs","names":[],"sources":["../src/browser/passkey.ts","../src/browser/index.ts"],"sourcesContent":["/**\n * The WebAuthn passkey ceremony (main thread only): `navigator.credentials` with the PRF extension.\n * A wallet passkey derives the wallet seed from `PRF(walletSalt)`; the vault factor derives the\n * vault KEK from `PRF(vaultSalt)` on the same credential. Every ceremony output is checked for\n * `prf.enabled`, PRF results and the user-verification flag — a credential that cannot prove UV\n * never reaches the kernel.\n */\nimport { WalletError } from \"@qntx/wallet\";\nimport { PASSKEY_PURPOSE_VAULT, PASSKEY_PURPOSE_WALLET } from \"@qntx/wallet/host\";\nimport type { PasskeyCeremony, PrfResult, PrfSalts } from \"@qntx/wallet/host\";\n\nexport type WebAuthnRp = {\n  /** RP id — the origin's effective domain, e.g. `location.hostname`. */\n  readonly id: string;\n  readonly name: string;\n};\n\nconst UV_FLAG = 0x04; // authenticator-data flags byte (offset 32), bit 2 = user verified\nconst BE_FLAG = 0x08; // bit 3 = credential is backup-eligible (multi-device capable)\nconst BS_FLAG = 0x10; // bit 4 = credential is currently backed up (synced)\n\nfunction factorUnavailable(message: string): WalletError {\n  return new WalletError(\"factor-unavailable\", message);\n}\n\nfunction cancelled(message: string): WalletError {\n  return new WalletError(\"cancelled\", message);\n}\n\nfunction mapCeremonyError(error: unknown): never {\n  if (\n    error instanceof DOMException &&\n    (error.name === \"NotAllowedError\" || error.name === \"AbortError\")\n  ) {\n    throw cancelled(\"the passkey ceremony was cancelled\");\n  }\n  if (error instanceof WalletError) {\n    throw error;\n  }\n  throw factorUnavailable(\"the passkey ceremony failed\");\n}\n\n/** The UV bit of an authenticator-data blob (flags byte at offset 32, bit 0x04). */\nfunction userVerified(authenticatorData: ArrayBuffer): boolean {\n  return (\n    authenticatorData.byteLength > 32 &&\n    // oxlint-disable-next-line eslint/no-bitwise -- flags bit test\n    (new DataView(authenticatorData).getUint8(32) & UV_FLAG) !== 0\n  );\n}\n\n/**\n * Whether the credential is backed up off-device (flags byte at offset 32): synced requires both BE\n * (the credential is eligible for backup) and BS (the authenticator actually backs it up).\n */\nfunction credentialSynced(authenticatorData: ArrayBuffer): boolean {\n  return (\n    authenticatorData.byteLength > 32 &&\n    // oxlint-disable-next-line eslint/no-bitwise -- flags bit test\n    (new DataView(authenticatorData).getUint8(32) & (BE_FLAG | BS_FLAG)) === (BE_FLAG | BS_FLAG)\n  );\n}\n\nfunction prfEval(salts: PrfSalts): AuthenticationExtensionsPRFValues {\n  // The constructor copy narrows Uint8Array<ArrayBufferLike> to Uint8Array<ArrayBuffer> —\n  // the DOM BufferSource does not admit shared-array-buffer views.\n  return salts.second === undefined\n    ? { first: new Uint8Array(salts.first) }\n    : { first: new Uint8Array(salts.first), second: new Uint8Array(salts.second) };\n}\n\n/** A detached copy of a BufferSource — the returned Uint8Array owns its own fresh buffer. */\nfunction copyBufferSource(source: BufferSource): Uint8Array {\n  const view =\n    source instanceof ArrayBuffer\n      ? new Uint8Array(source)\n      : new Uint8Array(source.buffer, source.byteOffset, source.byteLength);\n  return new Uint8Array(view);\n}\n\nfunction readPrfResult(\n  credential: PublicKeyCredential,\n  results: AuthenticationExtensionsPRFValues | undefined,\n  wantSecond: boolean,\n  synced: boolean,\n  userHandle?: ArrayBuffer,\n): PrfResult {\n  const first = results?.first;\n  const second = results?.second;\n  if (first === undefined || (wantSecond && second === undefined)) {\n    throw factorUnavailable(\"the passkey produced no PRF output\");\n  }\n  // Copy into fresh Uint8Arrays and drop every reference to the extension's ArrayBuffers.\n  return {\n    credentialId: copyBufferSource(credential.rawId),\n    first: copyBufferSource(first),\n    ...(second === undefined ? {} : { second: copyBufferSource(second) }),\n    ...(userHandle === undefined ? {} : { userHandle: copyBufferSource(userHandle) }),\n    synced,\n  };\n}\n\nfunction checkCredential(credential: unknown): PublicKeyCredential {\n  if (!(credential instanceof PublicKeyCredential)) {\n    throw factorUnavailable(\"the authenticator returned no public-key credential\");\n  }\n  return credential;\n}\n\n/**\n * The WebAuthn ceremony. `create` registers a resident credential with `prf.eval` over the salts;\n * when the extension returns no results a single assertion over the new credential produces them.\n * `assert` runs a discoverable (or allowCredentials-scoped) get with the same eval shape.\n */\nexport function createWebAuthnPasskey(rp: WebAuthnRp): PasskeyCeremony {\n  async function assert(input: {\n    readonly credentialIds?: ReadonlyArray<Uint8Array>;\n    readonly salts: PrfSalts;\n  }): Promise<PrfResult> {\n    let credential: PublicKeyCredential;\n    try {\n      credential = checkCredential(\n        await navigator.credentials.get({\n          publicKey: {\n            rpId: rp.id,\n            challenge: crypto.getRandomValues(new Uint8Array(32)),\n            userVerification: \"required\",\n            ...(input.credentialIds === undefined\n              ? {}\n              : {\n                  allowCredentials: input.credentialIds.map((id) => ({\n                    type: \"public-key\" as const,\n                    id: new Uint8Array(id),\n                  })),\n                }),\n            extensions: { prf: { eval: prfEval(input.salts) } },\n          },\n        }),\n      );\n    } catch (error) {\n      mapCeremonyError(error);\n    }\n    const { response } = credential;\n    if (!(response instanceof AuthenticatorAssertionResponse)) {\n      throw factorUnavailable(\"the authenticator returned no assertion response\");\n    }\n    if (!userVerified(response.authenticatorData)) {\n      throw factorUnavailable(\"the passkey assertion was not user-verified\");\n    }\n    return readPrfResult(\n      credential,\n      credential.getClientExtensionResults().prf?.results,\n      input.salts.second !== undefined,\n      credentialSynced(response.authenticatorData),\n      response.userHandle ?? undefined,\n    );\n  }\n\n  return {\n    create: async (input) => {\n      const userId = new Uint8Array(16);\n      userId[0] = input.purpose === \"wallet\" ? PASSKEY_PURPOSE_WALLET : PASSKEY_PURPOSE_VAULT;\n      crypto.getRandomValues(userId.subarray(1));\n      let credential: PublicKeyCredential;\n      try {\n        credential = checkCredential(\n          await navigator.credentials.create({\n            publicKey: {\n              rp: { id: rp.id, name: rp.name },\n              user: {\n                id: userId,\n                name: input.name,\n                displayName: input.name,\n              },\n              challenge: crypto.getRandomValues(new Uint8Array(32)),\n              pubKeyCredParams: [\n                { type: \"public-key\", alg: -7 },\n                { type: \"public-key\", alg: -257 },\n              ],\n              authenticatorSelection: {\n                residentKey: \"required\",\n                userVerification: \"required\",\n              },\n              extensions: { prf: { eval: prfEval(input.salts) } },\n            },\n          }),\n        );\n      } catch (error) {\n        mapCeremonyError(error);\n      }\n      const { response } = credential;\n      if (!(response instanceof AuthenticatorAttestationResponse)) {\n        throw factorUnavailable(\"the authenticator returned no attestation response\");\n      }\n      const extensions = credential.getClientExtensionResults();\n      if (extensions.prf?.enabled !== true) {\n        throw factorUnavailable(\"the authenticator does not support the PRF extension\");\n      }\n      if (extensions.prf.results === undefined) {\n        // Some authenticators omit creation-time PRF outputs: one assertion over the new\n        // credential produces them (it is that response whose UV and BE/BS flags get read).\n        return assert({\n          credentialIds: [copyBufferSource(credential.rawId)],\n          salts: input.salts,\n        });\n      }\n      const authenticatorData = response.getAuthenticatorData();\n      if (!userVerified(authenticatorData)) {\n        throw factorUnavailable(\"the passkey creation was not user-verified\");\n      }\n      return readPrfResult(\n        credential,\n        extensions.prf.results,\n        input.salts.second !== undefined,\n        credentialSynced(authenticatorData),\n      );\n    },\n    assert,\n  };\n}\n","/**\n * The Web host: `createWebWallet` spawns the bundled kernel worker (dist/kernel.worker.js) whose\n * vault lives in the worker's own IndexedDB. Lock destroys the worker; the vault survives in\n * IndexedDB, so the respawned worker reloads it. `pagehide` locks immediately; the idle timer is\n * refreshed by user-presence signals, not request traffic. The WebAuthn ceremony runs on the main\n * thread.\n */\nimport { WalletError } from \"@qntx/wallet\";\nimport type { Wallet, WalletOptions } from \"@qntx/wallet\";\nimport { connectKernel } from \"@qntx/wallet/host\";\nimport type { MainPort } from \"@qntx/wallet/host\";\nimport type { ProtocolValue } from \"@qntx/wallet/protocol\";\n\nimport type { BrowserWorkerInit } from \"../shared.ts\";\nimport { createWebAuthnPasskey } from \"./passkey.ts\";\n\nconst LISTENER_OPTIONS = { capture: true, passive: true };\nconst ACTIVITY_EVENTS = [\"pointerdown\", \"pointermove\", \"keydown\", \"wheel\", \"touchstart\"];\n\n/**\n * The browser's user-presence source: direct input on the page, or returning to a visible tab.\n * Capture-phase passive listeners do a single boolean check per event — high-frequency signals\n * (scroll, pointermove) cost nothing. Returns the unsubscribe the wallet owns.\n */\nfunction subscribePresence(onActivity: () => void): () => void {\n  for (const type of ACTIVITY_EVENTS) {\n    globalThis.addEventListener(type, onActivity, LISTENER_OPTIONS);\n  }\n  const onVisible = (): void => {\n    if (document.visibilityState === \"visible\") {\n      onActivity();\n    }\n  };\n  document.addEventListener(\"visibilitychange\", onVisible);\n  return () => {\n    for (const type of ACTIVITY_EVENTS) {\n      globalThis.removeEventListener(type, onActivity, LISTENER_OPTIONS);\n    }\n    document.removeEventListener(\"visibilitychange\", onVisible);\n  };\n}\n\nasync function bestEffort(task: () => Promise<unknown>): Promise<void> {\n  try {\n    await task();\n  } catch {\n    // Lifecycle hooks and persistence hints must never surface failures.\n  }\n}\n\nexport async function createWebWallet(options: WalletOptions): Promise<Wallet> {\n  const { autoLock } = options;\n  if (autoLock.platform !== \"web\") {\n    throw new WalletError(\"invalid-input\", \"createWebWallet accepts only the web autoLock policy\");\n  }\n  // The page sends only the idle choice; the worker owns the maximum session duration.\n  const init: BrowserWorkerInit = { t: \"init\", idleMinutes: autoLock.idleMinutes };\n  const ceremony = createWebAuthnPasskey({\n    id: options.passkey.rpId,\n    name: options.passkey.rpName,\n  });\n\n  const spawn = (): MainPort => {\n    // Keep this exact `new Worker(new URL(\"…\", import.meta.url))` shape: bundlers (Vite,\n    // webpack, Parcel, esbuild-based tools) recognize only this literal form as a worker entry and\n    // bundle the kernel with its chunks and spark.wasm. A precomputed URL is copied as one opaque\n    // asset, and the worker then dies loading its first chunk.\n    const worker = new Worker(new URL(\"kernel.worker.js\", import.meta.url), {\n      type: \"module\",\n      name: \"qntx-wallet\",\n    });\n    // oxlint-disable-next-line unicorn/require-post-message-target-origin -- Worker.postMessage takes a transfer list, not an origin\n    worker.postMessage(init); // the kernel validates it strictly before startKernel\n    return {\n      post: (message: ProtocolValue, transfer: ArrayBuffer[]) => {\n        worker.postMessage(message, transfer);\n      },\n      listen: (handler) => {\n        const listener = (event: MessageEvent): void => {\n          handler(event.data);\n        };\n        worker.addEventListener(\"message\", listener);\n        return () => {\n          worker.removeEventListener(\"message\", listener);\n        };\n      },\n      onExit: (handler) => {\n        // Web Workers have no exit event; error/messageerror are the only death signals.\n        const listener = (): void => {\n          handler(\"crashed\");\n        };\n        worker.addEventListener(\"error\", listener);\n        worker.addEventListener(\"messageerror\", listener);\n        return () => {\n          worker.removeEventListener(\"error\", listener);\n          worker.removeEventListener(\"messageerror\", listener);\n        };\n      },\n      terminate: () => {\n        worker.terminate();\n      },\n    };\n  };\n\n  const wallet = await connectKernel({\n    factors: \"software\",\n    spawn,\n    passkey: options.passkey,\n    ceremony,\n    setTimer: (delayMs, fn) => {\n      const timer = globalThis.setTimeout(fn, delayMs);\n      return () => {\n        globalThis.clearTimeout(timer);\n      };\n    },\n    presence: subscribePresence,\n    onDestroy: () => {\n      globalThis.removeEventListener(\"pagehide\", onPageHide);\n    },\n  });\n\n  // Page lifecycle: lock on pagehide. A BFCache-frozen page still runs the queued locked-event\n  // handler on restore, so the wallet respawns then — terminating the worker directly would\n  // leave the wallet pointing at a dead port.\n  const onPageHide = (): void => {\n    void bestEffort(async () => wallet.vault.lock());\n  };\n  globalThis.addEventListener(\"pagehide\", onPageHide);\n\n  // Ask the browser to persist the vault once it exists — a denied request is fine.\n  let persisted = false;\n  const unsubscribe = wallet.subscribe(() => {\n    if (!persisted && wallet.getSnapshot().vault !== \"uninitialized\") {\n      persisted = true;\n      unsubscribe();\n      void bestEffort(async () => navigator.storage.persist());\n    }\n  });\n\n  return wallet;\n}\n\nexport { createWebAuthnPasskey } from \"./passkey.ts\";\nexport type { WebAuthnRp } from \"./passkey.ts\";\n"],"mappings":";;;;;;;;;;AAiBA,MAAM,UAAU;AAIhB,SAAS,kBAAkB,SAA8B;CACvD,OAAO,IAAI,YAAY,sBAAsB,OAAO;AACtD;AAEA,SAAS,UAAU,SAA8B;CAC/C,OAAO,IAAI,YAAY,aAAa,OAAO;AAC7C;AAEA,SAAS,iBAAiB,OAAuB;CAC/C,IACE,iBAAiB,iBAChB,MAAM,SAAS,qBAAqB,MAAM,SAAS,eAEpD,MAAM,UAAU,oCAAoC;CAEtD,IAAI,iBAAiB,aACnB,MAAM;CAER,MAAM,kBAAkB,6BAA6B;AACvD;;AAGA,SAAS,aAAa,mBAAyC;CAC7D,OACE,kBAAkB,aAAa,OAE9B,IAAI,SAAS,iBAAiB,CAAC,CAAC,SAAS,EAAE,IAAI,aAAa;AAEjE;;;;;AAMA,SAAS,iBAAiB,mBAAyC;CACjE,OACE,kBAAkB,aAAa,OAE9B,IAAI,SAAS,iBAAiB,CAAC,CAAC,SAAS,EAAE,IAAK,QAAyB;AAE9E;AAEA,SAAS,QAAQ,OAAoD;CAGnE,OAAO,MAAM,WAAW,KAAA,IACpB,EAAE,OAAO,IAAI,WAAW,MAAM,KAAK,EAAE,IACrC;EAAE,OAAO,IAAI,WAAW,MAAM,KAAK;EAAG,QAAQ,IAAI,WAAW,MAAM,MAAM;CAAE;AACjF;;AAGA,SAAS,iBAAiB,QAAkC;CAC1D,MAAM,OACJ,kBAAkB,cACd,IAAI,WAAW,MAAM,IACrB,IAAI,WAAW,OAAO,QAAQ,OAAO,YAAY,OAAO,UAAU;CACxE,OAAO,IAAI,WAAW,IAAI;AAC5B;AAEA,SAAS,cACP,YACA,SACA,YACA,QACA,YACW;CACX,MAAM,QAAQ,SAAS;CACvB,MAAM,SAAS,SAAS;CACxB,IAAI,UAAU,KAAA,KAAc,cAAc,WAAW,KAAA,GACnD,MAAM,kBAAkB,oCAAoC;CAG9D,OAAO;EACL,cAAc,iBAAiB,WAAW,KAAK;EAC/C,OAAO,iBAAiB,KAAK;EAC7B,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,iBAAiB,MAAM,EAAE;EACnE,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,iBAAiB,UAAU,EAAE;EAC/E;CACF;AACF;AAEA,SAAS,gBAAgB,YAA0C;CACjE,IAAI,EAAE,sBAAsB,sBAC1B,MAAM,kBAAkB,qDAAqD;CAE/E,OAAO;AACT;;;;;;AAOA,SAAgB,sBAAsB,IAAiC;CACrE,eAAe,OAAO,OAGC;EACrB,IAAI;EACJ,IAAI;GACF,aAAa,gBACX,MAAM,UAAU,YAAY,IAAI,EAC9B,WAAW;IACT,MAAM,GAAG;IACT,WAAW,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC;IACpD,kBAAkB;IAClB,GAAI,MAAM,kBAAkB,KAAA,IACxB,CAAC,IACD,EACE,kBAAkB,MAAM,cAAc,KAAK,QAAQ;KACjD,MAAM;KACN,IAAI,IAAI,WAAW,EAAE;IACvB,EAAE,EACJ;IACJ,YAAY,EAAE,KAAK,EAAE,MAAM,QAAQ,MAAM,KAAK,EAAE,EAAE;GACpD,EACF,CAAC,CACH;EACF,SAAS,OAAO;GACd,iBAAiB,KAAK;EACxB;EACA,MAAM,EAAE,aAAa;EACrB,IAAI,EAAE,oBAAoB,iCACxB,MAAM,kBAAkB,kDAAkD;EAE5E,IAAI,CAAC,aAAa,SAAS,iBAAiB,GAC1C,MAAM,kBAAkB,6CAA6C;EAEvE,OAAO,cACL,YACA,WAAW,0BAA0B,CAAC,CAAC,KAAK,SAC5C,MAAM,MAAM,WAAW,KAAA,GACvB,iBAAiB,SAAS,iBAAiB,GAC3C,SAAS,cAAc,KAAA,CACzB;CACF;CAEA,OAAO;EACL,QAAQ,OAAO,UAAU;GACvB,MAAM,yBAAS,IAAI,WAAW,EAAE;GAChC,OAAO,KAAK,MAAM,YAAY,WAAW,yBAAyB;GAClE,OAAO,gBAAgB,OAAO,SAAS,CAAC,CAAC;GACzC,IAAI;GACJ,IAAI;IACF,aAAa,gBACX,MAAM,UAAU,YAAY,OAAO,EACjC,WAAW;KACT,IAAI;MAAE,IAAI,GAAG;MAAI,MAAM,GAAG;KAAK;KAC/B,MAAM;MACJ,IAAI;MACJ,MAAM,MAAM;MACZ,aAAa,MAAM;KACrB;KACA,WAAW,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC;KACpD,kBAAkB,CAChB;MAAE,MAAM;MAAc,KAAK;KAAG,GAC9B;MAAE,MAAM;MAAc,KAAK;KAAK,CAClC;KACA,wBAAwB;MACtB,aAAa;MACb,kBAAkB;KACpB;KACA,YAAY,EAAE,KAAK,EAAE,MAAM,QAAQ,MAAM,KAAK,EAAE,EAAE;IACpD,EACF,CAAC,CACH;GACF,SAAS,OAAO;IACd,iBAAiB,KAAK;GACxB;GACA,MAAM,EAAE,aAAa;GACrB,IAAI,EAAE,oBAAoB,mCACxB,MAAM,kBAAkB,oDAAoD;GAE9E,MAAM,aAAa,WAAW,0BAA0B;GACxD,IAAI,WAAW,KAAK,YAAY,MAC9B,MAAM,kBAAkB,sDAAsD;GAEhF,IAAI,WAAW,IAAI,YAAY,KAAA,GAG7B,OAAO,OAAO;IACZ,eAAe,CAAC,iBAAiB,WAAW,KAAK,CAAC;IAClD,OAAO,MAAM;GACf,CAAC;GAEH,MAAM,oBAAoB,SAAS,qBAAqB;GACxD,IAAI,CAAC,aAAa,iBAAiB,GACjC,MAAM,kBAAkB,4CAA4C;GAEtE,OAAO,cACL,YACA,WAAW,IAAI,SACf,MAAM,MAAM,WAAW,KAAA,GACvB,iBAAiB,iBAAiB,CACpC;EACF;EACA;CACF;AACF;;;;;;;;;AC3MA,MAAM,mBAAmB;CAAE,SAAS;CAAM,SAAS;AAAK;AACxD,MAAM,kBAAkB;CAAC;CAAe;CAAe;CAAW;CAAS;AAAY;;;;;;AAOvF,SAAS,kBAAkB,YAAoC;CAC7D,KAAK,MAAM,QAAQ,iBACjB,WAAW,iBAAiB,MAAM,YAAY,gBAAgB;CAEhE,MAAM,kBAAwB;EAC5B,IAAI,SAAS,oBAAoB,WAC/B,WAAW;CAEf;CACA,SAAS,iBAAiB,oBAAoB,SAAS;CACvD,aAAa;EACX,KAAK,MAAM,QAAQ,iBACjB,WAAW,oBAAoB,MAAM,YAAY,gBAAgB;EAEnE,SAAS,oBAAoB,oBAAoB,SAAS;CAC5D;AACF;AAEA,eAAe,WAAW,MAA6C;CACrE,IAAI;EACF,MAAM,KAAK;CACb,QAAQ,CAER;AACF;AAEA,eAAsB,gBAAgB,SAAyC;CAC7E,MAAM,EAAE,aAAa;CACrB,IAAI,SAAS,aAAa,OACxB,MAAM,IAAI,YAAY,iBAAiB,sDAAsD;CAG/F,MAAM,OAA0B;EAAE,GAAG;EAAQ,aAAa,SAAS;CAAY;CAC/E,MAAM,WAAW,sBAAsB;EACrC,IAAI,QAAQ,QAAQ;EACpB,MAAM,QAAQ,QAAQ;CACxB,CAAC;CAED,MAAM,cAAwB;EAK5B,MAAM,SAAS,IAAI,OAAO,IAAI,IAAI,oBAAoB,YAAY,GAAG,GAAG;GACtE,MAAM;GACN,MAAM;EACR,CAAC;EAED,OAAO,YAAY,IAAI;EACvB,OAAO;GACL,OAAO,SAAwB,aAA4B;IACzD,OAAO,YAAY,SAAS,QAAQ;GACtC;GACA,SAAS,YAAY;IACnB,MAAM,YAAY,UAA8B;KAC9C,QAAQ,MAAM,IAAI;IACpB;IACA,OAAO,iBAAiB,WAAW,QAAQ;IAC3C,aAAa;KACX,OAAO,oBAAoB,WAAW,QAAQ;IAChD;GACF;GACA,SAAS,YAAY;IAEnB,MAAM,iBAAuB;KAC3B,QAAQ,SAAS;IACnB;IACA,OAAO,iBAAiB,SAAS,QAAQ;IACzC,OAAO,iBAAiB,gBAAgB,QAAQ;IAChD,aAAa;KACX,OAAO,oBAAoB,SAAS,QAAQ;KAC5C,OAAO,oBAAoB,gBAAgB,QAAQ;IACrD;GACF;GACA,iBAAiB;IACf,OAAO,UAAU;GACnB;EACF;CACF;CAEA,MAAM,SAAS,MAAM,cAAc;EACjC,SAAS;EACT;EACA,SAAS,QAAQ;EACjB;EACA,WAAW,SAAS,OAAO;GACzB,MAAM,QAAQ,WAAW,WAAW,IAAI,OAAO;GAC/C,aAAa;IACX,WAAW,aAAa,KAAK;GAC/B;EACF;EACA,UAAU;EACV,iBAAiB;GACf,WAAW,oBAAoB,YAAY,UAAU;EACvD;CACF,CAAC;CAKD,MAAM,mBAAyB;EAC7B,WAAgB,YAAY,OAAO,MAAM,KAAK,CAAC;CACjD;CACA,WAAW,iBAAiB,YAAY,UAAU;CAGlD,IAAI,YAAY;CAChB,MAAM,cAAc,OAAO,gBAAgB;EACzC,IAAI,CAAC,aAAa,OAAO,YAAY,CAAC,CAAC,UAAU,iBAAiB;GAChE,YAAY;GACZ,YAAY;GACZ,WAAgB,YAAY,UAAU,QAAQ,QAAQ,CAAC;EACzD;CACF,CAAC;CAED,OAAO;AACT"}

package/dist/kernel.manifest.json

@@ -1,6 +1,6 @@
 {
-  "protocol": 1,
-  "vaultFormat": 2,
+  "protocol": 2,
+  "vaultFormat": 3,
   "backends": {
     "spark": {
       "abiVersion": 1,
@@ -65,36 +65,36 @@
     }
   ],
   "bundles": [
-    {
-      "file": "kernel.worker.js",
-      "sha256": "50ca92701265a22ae4206c83aa4f1885fd4124b9e35d94983ed5ce2b387f58b9"
-    },
     {
       "file": "browser-1vpxmqwn.js",
       "sha256": "e5afdeec6f071a87cb6a1040ddeb1b9995d53ed2cea239f8f9424dc1d3df601b"
     },
     {
       "file": "kernel.node.js",
-      "sha256": "e2f99d5c064f2627925d679d4d3a4420749d2c0a70b5f49e3916e17125683a35"
-    },
-    {
-      "file": "node-gsare3mw.js",
-      "sha256": "163a8aeb01c8d699a7567eecb90c6d5c859151d1e7322c3be0487eb13940b9c7"
+      "sha256": "e25059b920fe661a3c6624032a69c40dc001d1b5829a5f54b7f23db52387f6c7"
     },
     {
       "file": "worker-366p4fej.js",
       "sha256": "449410efad818a8f1dcfd02840375c1748c61294ad172e4c6c57e9d1d7c81283"
     },
+    {
+      "file": "kernel.worker.js",
+      "sha256": "d51780e0e77202b349d0b2966222877b11e7561f8719d89af4d7ef62a5e6bc42"
+    },
     {
       "file": "signer-gs57sjgx.js",
       "sha256": "e83ab645d9efc41a821e572768e4b28a7902336ccfa692c2101755284b2a7d42"
     },
+    {
+      "file": "worker-gsare3mw.js",
+      "sha256": "163a8aeb01c8d699a7567eecb90c6d5c859151d1e7322c3be0487eb13940b9c7"
+    },
     {
       "file": "node-366p4fej.js",
       "sha256": "449410efad818a8f1dcfd02840375c1748c61294ad172e4c6c57e9d1d7c81283"
     },
     {
-      "file": "worker-gsare3mw.js",
+      "file": "node-gsare3mw.js",
       "sha256": "163a8aeb01c8d699a7567eecb90c6d5c859151d1e7322c3be0487eb13940b9c7"
     }
   ]