w3pk 0.10.4 → 0.10.5

package/README.md

@@ -59,7 +59,6 @@ const endpoints = await w3pk.getEndpoints(1)
 - EIP-7951 PRIMARY mode (P-256 passkey signing)
 - Build verification (IPFS CID hashing + DAO-maintained onchain registry)
 - Three-layer backup & recovery (passkey sync, encrypted backups, social recovery)
-- AI-powered host app inspection
 
 ## API
 
@@ -428,53 +427,6 @@ console.log('Onchain CID:', onchainCid)
 console.log('Verified:', isValid ? '✅' : '❌')
 ```
 
-### Security Inspection
-
-> **⚠️ Privacy Notice:** This optional feature sends application source code to an external API (Rukh) for AI analysis. User IP address will be visible to the API server.
-
-Analyze web3 applications to understand their transaction and signing methods:
-
-**Browser (analyze current page):**
-```typescript
-import { inspect, inspectNow } from 'w3pk'
-
-// Full inspection with custom options
-const result = await inspect({
-  appUrl: 'https://example.com',
-  rukhUrl: 'https://rukh.w3hc.org',
-  model: 'anthropic',
-  focusMode: 'transactions'
-})
-console.log(result.report)
-
-// Quick console inspection
-await inspectNow()  // Logs report directly to console
-```
-
-**Note:** Inspection API calls are sponsored by the [W3HC (Web3 Hackers Collective)](https://w3hc.org).
-
-**Node.js (analyze local files):**
-```typescript
-import { inspect, gatherCode } from 'w3pk/inspect/node'
-
-// Generate security report via Rukh API
-const report = await inspect(
-  '../my-dapp',           // App path
-  'https://rukh.w3hc.org', // Rukh API URL
-  'w3pk',                  // Context
-  'anthropic',             // Model
-  'transactions'           // Focus mode
-)
-
-// Or just gather code for analysis
-const result = await gatherCode({
-  appPath: '../my-dapp',
-  focusMode: 'transactions',
-  maxFileSizeKB: 500
-})
-console.log(`Analyzed ${result.includedFiles.length} files`)
-```
-
 ## Security & Verification
 
 ### Onchain Build Registry
@@ -493,7 +445,6 @@ Host applications should verify their installed W3PK build against this registry
 - [Integration Guidelines](./docs/INTEGRATION_GUIDELINES.md)
 - [API Reference](./docs/API_REFERENCE.md)
 - [Build Verification](./docs/BUILD_VERIFICATION.md)
-- [Security Inspection](./docs/INSPECTION.md)
 - [EIP-7951](./docs/EIP-7951.md)
 - [Security Architecture](./docs/SECURITY.md)
 - [Post-Quantum Cryptography](./docs/POST_QUANTUM.md) - Quantum-safe migration roadmap

package/dist/index.d.mts

@@ -537,6 +537,13 @@ interface Web3PasskeyConfig {
      * Requires: snarkjs, circomlibjs
      */
     zkProofs?: ZKProofConfig;
+    /**
+     * WebAuthn user verification for login, registration and signing
+     * (default: 'required'). With 'preferred', authenticators that can skip
+     * the biometric/PIN check (security keys, unlocked password managers)
+     * sign in with one click. PRF-derived secrets always require it.
+     */
+    userVerification?: 'required' | 'preferred';
 }
 
 /**
@@ -2230,111 +2237,6 @@ declare function getChainById(chainId: number, options?: ChainlistOptions): Prom
  */
 declare function clearCache(): void;
 
-/**
- * Browser Inspection Module
- *
- * Provides client-side code inspection capabilities for analyzing running web3 applications.
- * Fetches JavaScript sources from the current page and analyzes transaction/signing patterns
- * to generate security reports via the Rukh API.
- *
- * This module is designed to be used directly in the browser console or embedded in
- * web applications to help end-users understand the security posture of the apps they use.
- *
- * @module inspect/browser
- */
-/**
- * Configuration options for browser-based application inspection
- */
-interface BrowserInspectOptions {
-    /**
-     * The origin/URL of the app to inspect
-     * @default window.location.origin
-     */
-    appUrl?: string;
-    /**
-     * Rukh API endpoint
-     * @default 'https://rukh.w3hc.org'
-     */
-    rukhUrl?: string;
-    /**
-     * Context to use for analysis
-     * @default 'w3pk'
-     */
-    context?: string;
-    /**
-     * AI model to use
-     * @default 'anthropic'
-     */
-    model?: "anthropic" | "mistral" | "openai";
-    /**
-     * Focus mode for analysis
-     * @default 'transactions'
-     */
-    focusMode?: "transactions" | "all";
-    /**
-     * Maximum total size in KB for all collected code (prevents exceeding API token limits)
-     * @default 100
-     */
-    maxTotalSizeKB?: number;
-}
-/**
- * Result of a browser-based inspection
- */
-interface BrowserInspectResult {
-    /**
-     * The security report markdown generated by Rukh API
-     */
-    report: string;
-    /**
-     * List of JavaScript file paths that were analyzed
-     */
-    analyzedFiles: string[];
-    /**
-     * The application URL that was inspected
-     */
-    appUrl: string;
-}
-/**
- * Inspects the currently running web application and returns a security report
- *
- * This function can be called by end-users in their browser console to analyze
- * the security of the web application they're currently using.
- *
- * @param options - Configuration options
- * @returns A security report analyzing transaction and signing methods
- *
- * @example
- * ```typescript
- * // In browser console or app code:
- * import { inspect } from 'w3pk';
- *
- * const report = await inspect();
- * console.log(report.report);
- * ```
- *
- * @example
- * ```typescript
- * // With custom options:
- * const report = await inspect({
- *   appUrl: 'https://w3pk.w3hc.org',
- *   model: 'anthropic',
- *   focusMode: 'transactions'
- * });
- * ```
- */
-declare function inspect(options?: BrowserInspectOptions): Promise<BrowserInspectResult>;
-/**
- * Quick inspection helper that logs the report to console
- * Perfect for use in browser DevTools console
- *
- * @example
- * ```javascript
- * // In browser console:
- * await w3pk.inspectNow()
- * ```
- */
-declare function inspectNow(options?: BrowserInspectOptions): Promise<void>;
-
 interface MLKemKeypair {
     publicKey: Uint8Array;
     privateKey: Uint8Array;
@@ -2437,4 +2339,4 @@ declare function mlkemDecryptWithKey(payload: EncryptedPayload, privateKey: stri
 
 declare function createWeb3Passkey(config?: Web3PasskeyConfig): Web3Passkey;
 
-export { ApiError, AuthenticationError, type BackupMethod, type BackupStatus, type BrowserInspectOptions, type BrowserInspectResult, CryptoError, DEFAULT_MODE, DEFAULT_TAG, type DeviceInfo, type EIP1193Provider, type EIP7702Authorization, type EncryptedBackupInfo, type EncryptedPayload, type Guardian, type GuardianInvite, type MLKemKeypair, type PasskeySelectionResult, type PrfSecret, PrfUnsupportedError, type QRBackupOptions, type RecoveryProgress, type RecoveryScenario, type RecoveryShare, RecoverySimulator, RegistrationError, type SecurityScore, type SignAuthorizationParams, type SimulationResult, type SiweMessage, type SocialRecoveryConfig, SocialRecoveryManager, type StealthAddressConfig, StealthAddressModule, type StealthAddressResult, type StealthKeys, StorageError, SyncBootstrapError, type SyncBootstrapReason, type SyncCapabilities, SyncRequiredError, type SyncStatus, type SyncVault, type UserInfo, WalletError, type WalletInfo, WalletMissingError, Web3Passkey, type Web3PasskeyConfig, Web3PasskeyError, arrayBufferToBase64Url, assertEthereumAddress, assertMnemonic, assertUsername, authenticateWithPasskey, base64ToArrayBuffer, base64UrlDecode, base64UrlToArrayBuffer, canControlStealthAddress, checkStealthAddress, clearCache, computeStealthPrivateKey, createSiweMessage, createWalletFromMnemonic, createWeb3Passkey, createWeb3Passkey as default, deriveAddressFromP256PublicKey, deriveIndexFromOriginModeAndTag, deriveMLKemKeypair, deriveStealthKeys, deriveWalletFromMnemonic, detectWalletProvider, encodeEIP7702AuthorizationMessage, extractRS, generateBIP39Wallet, generateSiweNonce, generateStealthAddress, getAllChains, getAllTopics, getChainById, getCurrentBuildHash, getCurrentOrigin, getDefaultProvider, getEndpoints, getExplainer, getOriginSpecificAddress, getPackageVersion, getW3pkBuildHash, hashEIP7702AuthorizationMessage, inspect, inspectNow, isStrongPassword, mlkemDecrypt, mlkemDecryptWithKey, mlkemEncrypt, mlkemEncryptWithKey, normalizeOrigin, parseSiweMessage, promptPasskeySelection, requestExternalWalletAuthorization, safeAtob, safeBtoa, searchExplainers, supportsEIP7702Authorization, validateEthereumAddress, validateMnemonic, validateSiweMessage, validateUsername, verifyBuildHash, verifyEIP7702Authorization, verifySiweSignature };
+export { ApiError, AuthenticationError, type BackupMethod, type BackupStatus, CryptoError, DEFAULT_MODE, DEFAULT_TAG, type DeviceInfo, type EIP1193Provider, type EIP7702Authorization, type EncryptedBackupInfo, type EncryptedPayload, type Guardian, type GuardianInvite, type MLKemKeypair, type PasskeySelectionResult, type PrfSecret, PrfUnsupportedError, type QRBackupOptions, type RecoveryProgress, type RecoveryScenario, type RecoveryShare, RecoverySimulator, RegistrationError, type SecurityScore, type SignAuthorizationParams, type SimulationResult, type SiweMessage, type SocialRecoveryConfig, SocialRecoveryManager, type StealthAddressConfig, StealthAddressModule, type StealthAddressResult, type StealthKeys, StorageError, SyncBootstrapError, type SyncBootstrapReason, type SyncCapabilities, SyncRequiredError, type SyncStatus, type SyncVault, type UserInfo, WalletError, type WalletInfo, WalletMissingError, Web3Passkey, type Web3PasskeyConfig, Web3PasskeyError, arrayBufferToBase64Url, assertEthereumAddress, assertMnemonic, assertUsername, authenticateWithPasskey, base64ToArrayBuffer, base64UrlDecode, base64UrlToArrayBuffer, canControlStealthAddress, checkStealthAddress, clearCache, computeStealthPrivateKey, createSiweMessage, createWalletFromMnemonic, createWeb3Passkey, createWeb3Passkey as default, deriveAddressFromP256PublicKey, deriveIndexFromOriginModeAndTag, deriveMLKemKeypair, deriveStealthKeys, deriveWalletFromMnemonic, detectWalletProvider, encodeEIP7702AuthorizationMessage, extractRS, generateBIP39Wallet, generateSiweNonce, generateStealthAddress, getAllChains, getAllTopics, getChainById, getCurrentBuildHash, getCurrentOrigin, getDefaultProvider, getEndpoints, getExplainer, getOriginSpecificAddress, getPackageVersion, getW3pkBuildHash, hashEIP7702AuthorizationMessage, isStrongPassword, mlkemDecrypt, mlkemDecryptWithKey, mlkemEncrypt, mlkemEncryptWithKey, normalizeOrigin, parseSiweMessage, promptPasskeySelection, requestExternalWalletAuthorization, safeAtob, safeBtoa, searchExplainers, supportsEIP7702Authorization, validateEthereumAddress, validateMnemonic, validateSiweMessage, validateUsername, verifyBuildHash, verifyEIP7702Authorization, verifySiweSignature };

package/dist/index.d.ts

@@ -537,6 +537,13 @@ interface Web3PasskeyConfig {
      * Requires: snarkjs, circomlibjs
      */
     zkProofs?: ZKProofConfig;
+    /**
+     * WebAuthn user verification for login, registration and signing
+     * (default: 'required'). With 'preferred', authenticators that can skip
+     * the biometric/PIN check (security keys, unlocked password managers)
+     * sign in with one click. PRF-derived secrets always require it.
+     */
+    userVerification?: 'required' | 'preferred';
 }
 
 /**
@@ -2230,111 +2237,6 @@ declare function getChainById(chainId: number, options?: ChainlistOptions): Prom
  */
 declare function clearCache(): void;
 
-/**
- * Browser Inspection Module
- *
- * Provides client-side code inspection capabilities for analyzing running web3 applications.
- * Fetches JavaScript sources from the current page and analyzes transaction/signing patterns
- * to generate security reports via the Rukh API.
- *
- * This module is designed to be used directly in the browser console or embedded in
- * web applications to help end-users understand the security posture of the apps they use.
- *
- * @module inspect/browser
- */
-/**
- * Configuration options for browser-based application inspection
- */
-interface BrowserInspectOptions {
-    /**
-     * The origin/URL of the app to inspect
-     * @default window.location.origin
-     */
-    appUrl?: string;
-    /**
-     * Rukh API endpoint
-     * @default 'https://rukh.w3hc.org'
-     */
-    rukhUrl?: string;
-    /**
-     * Context to use for analysis
-     * @default 'w3pk'
-     */
-    context?: string;
-    /**
-     * AI model to use
-     * @default 'anthropic'
-     */
-    model?: "anthropic" | "mistral" | "openai";
-    /**
-     * Focus mode for analysis
-     * @default 'transactions'
-     */
-    focusMode?: "transactions" | "all";
-    /**
-     * Maximum total size in KB for all collected code (prevents exceeding API token limits)
-     * @default 100
-     */
-    maxTotalSizeKB?: number;
-}
-/**
- * Result of a browser-based inspection
- */
-interface BrowserInspectResult {
-    /**
-     * The security report markdown generated by Rukh API
-     */
-    report: string;
-    /**
-     * List of JavaScript file paths that were analyzed
-     */
-    analyzedFiles: string[];
-    /**
-     * The application URL that was inspected
-     */
-    appUrl: string;
-}
-/**
- * Inspects the currently running web application and returns a security report
- *
- * This function can be called by end-users in their browser console to analyze
- * the security of the web application they're currently using.
- *
- * @param options - Configuration options
- * @returns A security report analyzing transaction and signing methods
- *
- * @example
- * ```typescript
- * // In browser console or app code:
- * import { inspect } from 'w3pk';
- *
- * const report = await inspect();
- * console.log(report.report);
- * ```
- *
- * @example
- * ```typescript
- * // With custom options:
- * const report = await inspect({
- *   appUrl: 'https://w3pk.w3hc.org',
- *   model: 'anthropic',
- *   focusMode: 'transactions'
- * });
- * ```
- */
-declare function inspect(options?: BrowserInspectOptions): Promise<BrowserInspectResult>;
-/**
- * Quick inspection helper that logs the report to console
- * Perfect for use in browser DevTools console
- *
- * @example
- * ```javascript
- * // In browser console:
- * await w3pk.inspectNow()
- * ```
- */
-declare function inspectNow(options?: BrowserInspectOptions): Promise<void>;
-
 interface MLKemKeypair {
     publicKey: Uint8Array;
     privateKey: Uint8Array;
@@ -2437,4 +2339,4 @@ declare function mlkemDecryptWithKey(payload: EncryptedPayload, privateKey: stri
 
 declare function createWeb3Passkey(config?: Web3PasskeyConfig): Web3Passkey;
 
-export { ApiError, AuthenticationError, type BackupMethod, type BackupStatus, type BrowserInspectOptions, type BrowserInspectResult, CryptoError, DEFAULT_MODE, DEFAULT_TAG, type DeviceInfo, type EIP1193Provider, type EIP7702Authorization, type EncryptedBackupInfo, type EncryptedPayload, type Guardian, type GuardianInvite, type MLKemKeypair, type PasskeySelectionResult, type PrfSecret, PrfUnsupportedError, type QRBackupOptions, type RecoveryProgress, type RecoveryScenario, type RecoveryShare, RecoverySimulator, RegistrationError, type SecurityScore, type SignAuthorizationParams, type SimulationResult, type SiweMessage, type SocialRecoveryConfig, SocialRecoveryManager, type StealthAddressConfig, StealthAddressModule, type StealthAddressResult, type StealthKeys, StorageError, SyncBootstrapError, type SyncBootstrapReason, type SyncCapabilities, SyncRequiredError, type SyncStatus, type SyncVault, type UserInfo, WalletError, type WalletInfo, WalletMissingError, Web3Passkey, type Web3PasskeyConfig, Web3PasskeyError, arrayBufferToBase64Url, assertEthereumAddress, assertMnemonic, assertUsername, authenticateWithPasskey, base64ToArrayBuffer, base64UrlDecode, base64UrlToArrayBuffer, canControlStealthAddress, checkStealthAddress, clearCache, computeStealthPrivateKey, createSiweMessage, createWalletFromMnemonic, createWeb3Passkey, createWeb3Passkey as default, deriveAddressFromP256PublicKey, deriveIndexFromOriginModeAndTag, deriveMLKemKeypair, deriveStealthKeys, deriveWalletFromMnemonic, detectWalletProvider, encodeEIP7702AuthorizationMessage, extractRS, generateBIP39Wallet, generateSiweNonce, generateStealthAddress, getAllChains, getAllTopics, getChainById, getCurrentBuildHash, getCurrentOrigin, getDefaultProvider, getEndpoints, getExplainer, getOriginSpecificAddress, getPackageVersion, getW3pkBuildHash, hashEIP7702AuthorizationMessage, inspect, inspectNow, isStrongPassword, mlkemDecrypt, mlkemDecryptWithKey, mlkemEncrypt, mlkemEncryptWithKey, normalizeOrigin, parseSiweMessage, promptPasskeySelection, requestExternalWalletAuthorization, safeAtob, safeBtoa, searchExplainers, supportsEIP7702Authorization, validateEthereumAddress, validateMnemonic, validateSiweMessage, validateUsername, verifyBuildHash, verifyEIP7702Authorization, verifySiweSignature };
+export { ApiError, AuthenticationError, type BackupMethod, type BackupStatus, CryptoError, DEFAULT_MODE, DEFAULT_TAG, type DeviceInfo, type EIP1193Provider, type EIP7702Authorization, type EncryptedBackupInfo, type EncryptedPayload, type Guardian, type GuardianInvite, type MLKemKeypair, type PasskeySelectionResult, type PrfSecret, PrfUnsupportedError, type QRBackupOptions, type RecoveryProgress, type RecoveryScenario, type RecoveryShare, RecoverySimulator, RegistrationError, type SecurityScore, type SignAuthorizationParams, type SimulationResult, type SiweMessage, type SocialRecoveryConfig, SocialRecoveryManager, type StealthAddressConfig, StealthAddressModule, type StealthAddressResult, type StealthKeys, StorageError, SyncBootstrapError, type SyncBootstrapReason, type SyncCapabilities, SyncRequiredError, type SyncStatus, type SyncVault, type UserInfo, WalletError, type WalletInfo, WalletMissingError, Web3Passkey, type Web3PasskeyConfig, Web3PasskeyError, arrayBufferToBase64Url, assertEthereumAddress, assertMnemonic, assertUsername, authenticateWithPasskey, base64ToArrayBuffer, base64UrlDecode, base64UrlToArrayBuffer, canControlStealthAddress, checkStealthAddress, clearCache, computeStealthPrivateKey, createSiweMessage, createWalletFromMnemonic, createWeb3Passkey, createWeb3Passkey as default, deriveAddressFromP256PublicKey, deriveIndexFromOriginModeAndTag, deriveMLKemKeypair, deriveStealthKeys, deriveWalletFromMnemonic, detectWalletProvider, encodeEIP7702AuthorizationMessage, extractRS, generateBIP39Wallet, generateSiweNonce, generateStealthAddress, getAllChains, getAllTopics, getChainById, getCurrentBuildHash, getCurrentOrigin, getDefaultProvider, getEndpoints, getExplainer, getOriginSpecificAddress, getPackageVersion, getW3pkBuildHash, hashEIP7702AuthorizationMessage, isStrongPassword, mlkemDecrypt, mlkemDecryptWithKey, mlkemEncrypt, mlkemEncryptWithKey, normalizeOrigin, parseSiweMessage, promptPasskeySelection, requestExternalWalletAuthorization, safeAtob, safeBtoa, searchExplainers, supportsEIP7702Authorization, validateEthereumAddress, validateMnemonic, validateSiweMessage, validateUsername, verifyBuildHash, verifyEIP7702Authorization, verifySiweSignature };