@waaskey/sdk 0.3.0 → 0.3.1

package/dist/index.d.cts

@@ -609,24 +609,6 @@ interface VerifiedWasmLoaderOptions {
  * ```
  */
 declare function createVerifiedClientWasmLoader(options: VerifiedWasmLoaderOptions): ClientWasmLoader;
-/**
- * Convenience loader for the Waaskey client-wasm engine — dynamically imports `@waaskey/client-wasm`
- * (the wasm-pack/bundler build, auto-initialized on import) and returns it as a {@link ClientWasmModule}:
- *
- * ```ts
- * import { Waaskey, WasmMpcCore, loadClientWasm } from '@waaskey/sdk';
- * const waaskey = new Waaskey({ apiKey, mpc: new WasmMpcCore(loadClientWasm), shareStore });
- * ```
- *
- * ⚠️ **No integrity verification (issue #40).** A bundler-target build instantiates the wasm on
- * import, so its bytes cannot be checked first. For production — where a registry compromise or
- * dependency-confusion attack on `@waaskey/client-wasm` could exfiltrate the plaintext device share
- * — use {@link createVerifiedClientWasmLoader} with a vendored `.wasm` and the pinned SHA-384 instead.
- *
- * `@waaskey/client-wasm` is an OPTIONAL peer dependency pinned to {@link CLIENT_WASM_VERSION}: install
- * it alongside the SDK in apps that create wallets. The indirect import specifier keeps it out of
- * static module resolution — so a missing install fails here with an actionable message, not at build.
- */
 declare const loadClientWasm: ClientWasmLoader;
 
 /**

package/dist/index.d.ts

@@ -609,24 +609,6 @@ interface VerifiedWasmLoaderOptions {
  * ```
  */
 declare function createVerifiedClientWasmLoader(options: VerifiedWasmLoaderOptions): ClientWasmLoader;
-/**
- * Convenience loader for the Waaskey client-wasm engine — dynamically imports `@waaskey/client-wasm`
- * (the wasm-pack/bundler build, auto-initialized on import) and returns it as a {@link ClientWasmModule}:
- *
- * ```ts
- * import { Waaskey, WasmMpcCore, loadClientWasm } from '@waaskey/sdk';
- * const waaskey = new Waaskey({ apiKey, mpc: new WasmMpcCore(loadClientWasm), shareStore });
- * ```
- *
- * ⚠️ **No integrity verification (issue #40).** A bundler-target build instantiates the wasm on
- * import, so its bytes cannot be checked first. For production — where a registry compromise or
- * dependency-confusion attack on `@waaskey/client-wasm` could exfiltrate the plaintext device share
- * — use {@link createVerifiedClientWasmLoader} with a vendored `.wasm` and the pinned SHA-384 instead.
- *
- * `@waaskey/client-wasm` is an OPTIONAL peer dependency pinned to {@link CLIENT_WASM_VERSION}: install
- * it alongside the SDK in apps that create wallets. The indirect import specifier keeps it out of
- * static module resolution — so a missing install fails here with an actionable message, not at build.
- */
 declare const loadClientWasm: ClientWasmLoader;
 
 /**

package/dist/index.js

@@ -2373,14 +2373,30 @@ function createVerifiedClientWasmLoader(options) {
     return mod;
   };
 }
+var clientWasm;
 var loadClientWasm = async () => {
+  return clientWasm ??= importAndInit();
+};
+async function importAndInit() {
+  let mod;
   try {
-    const mod = await import(CLIENT_WASM_PACKAGE);
-    return mod;
+    mod = await import(CLIENT_WASM_PACKAGE);
   } catch (cause) {
     throw new Error("Waaskey: creating a wallet needs the wasm engine \u2014 install '@waaskey/client-wasm' alongside '@waaskey/sdk'.", { cause });
   }
-};
+  const init = mod["default"] ?? mod["init"];
+  if (typeof init === "function") {
+    try {
+      await init();
+    } catch (cause) {
+      throw new Error(
+        "Waaskey: the wasm engine failed to initialize. In the browser this loader fetches the `.wasm` next to the module \u2014 serve it, or pass a loader built with `createVerifiedClientWasmLoader({ wasmUrl, expectedSha384 })`. On Node use `NodeWorkerMpcCore` from `@waaskey/sdk/node`, which loads the binary from disk in a worker thread.",
+        { cause }
+      );
+    }
+  }
+  return mod;
+}
 function toBase64(bytes) {
   let binary = "";
   for (const byte of bytes) binary += String.fromCharCode(byte);