w3pk 0.10.4 → 0.10.5

package/docs/SECURITY.md

@@ -3614,142 +3614,6 @@ console.log('Write this down:', mnemonic)
 - **MetaMask:** Attacker needs password. Weak passwords can be brute-forced. Strong passwords with vault encryption are resistant.
 - **Hardware Wallet:** Private keys in secure element. Cannot be extracted even with physical access (except advanced hardware attacks).
 
-## Security Inspection Tools
-
-w3pk includes built-in security inspection capabilities to help developers and end-users analyze web3 applications and understand their transaction and signing methods.
-
-### Why Inspection Matters
-
-Many users interact with web3 applications without fully understanding:
-- What transactions the app can initiate
-- Which signing methods are used
-- How their private keys or wallets are being accessed
-- What permissions they're granting
-
-The w3pk inspection tools provide **transparency** by analyzing application code and generating detailed security reports.
-
-### Browser-Based Inspection
-
-End-users can inspect any web3 application directly from their browser console:
-
-```typescript
-import { inspectNow } from 'w3pk'
-
-// Run inspection and view report in console
-await inspectNow()
-```
-
-**What it does:**
-- Fetches all JavaScript files from the current page
-- Extracts transaction and signing-related code snippets
-- Sends code to Rukh API for AI-powered analysis
-- Generates a security report listing all methods
-
-**Use cases:**
-- End-users auditing dApps before connecting wallets
-- Security researchers analyzing application behavior
-- Developers verifying their own implementations
-
-### Node.js-Based Inspection
-
-Developers can scan local application files during development or in CI/CD:
-
-```typescript
-import { inspect } from 'w3pk/inspect/node'
-
-const report = await inspect(
-  '../my-dapp',
-  'https://rukh.w3hc.org',
-  'w3pk',
-  'anthropic',
-  'transactions'
-)
-```
-
-**What it does:**
-- Recursively scans application source files
-- Filters for transaction-relevant code
-- Generates comprehensive markdown documentation
-- Sends to Rukh API for security analysis
-
-**Use cases:**
-- Pre-deployment security audits
-- CI/CD security checks
-- Documentation generation
-- Code review assistance
-
-### Focus Modes
-
-Both browser and Node.js inspection support focus modes:
-
-**`transactions` mode (default):**
-- Only analyzes transaction and signing code
-- Filters for keywords: `signMessage`, `sendTransaction`, `Contract`, `authorization`, etc.
-- Faster analysis, more focused reports
-- Recommended for security audits
-
-**`all` mode:**
-- Analyzes all application code
-- Comprehensive but slower
-- May include irrelevant code in report
-- Use for complete application analysis
-
-### Privacy and Security
-
-**Data handling:**
-- Code is sent to Rukh API for analysis
-- Rukh uses AI models (Anthropic Claude, Mistral, OpenAI)
-- No code is stored permanently by default
-- Reports are generated on-demand
-- API calls are sponsored by the [W3HC (Web3 Hackers Collective)](https://w3hc.org)
-
-**Recommendations:**
-- Use self-hosted Rukh instance for sensitive code
-- Review reports before sharing externally
-- Inspection tools are read-only (no modifications)
-- Browser inspection requires CORS-enabled scripts
-
-### Integration with Development Workflow
-
-```bash
-# Add to package.json scripts
-{
-  "scripts": {
-    "security:inspect": "tsx scripts/inspect.ts"
-  }
-}
-```
-
-```typescript
-// scripts/inspect.ts
-import { inspect } from 'w3pk/inspect/node'
-import fs from 'fs/promises'
-
-const report = await inspect(
-  process.cwd(),
-  'https://rukh.w3hc.org',
-  'w3pk',
-  'anthropic',
-  'transactions'
-)
-
-await fs.writeFile('SECURITY_REPORT.md', report)
-console.log('✅ Security report generated')
-```
-
-### Empowering End-Users
-
-The browser inspection tools are designed for non-technical users:
-
-```javascript
-// Users can run this in any browser console
-await w3pk.inspectNow()
-```
-
-This democratizes security analysis and helps users make informed decisions about which dApps to trust.
-
----
-
 ## Post-Quantum Cryptography
 
 w3pk is preparing for the future quantum computing threat. While quantum computers capable of breaking current cryptography (ECDSA, secp256k1) are estimated to be **10-15 years away**, we have a comprehensive migration roadmap in place.

package/docs/notes/old-computer.md

@@ -0,0 +1,99 @@
+---
+title: Passkey access from old computers
+description: Spec for letting people on old computers register and log in to w3pk-based apps such as Genji, with a single click where their authenticator allows it.
+date: 2026-10-26
+locale: en_US
+author: Julien Béranger
+model: Claude Opus 5.5
+---
+
+## Goal
+
+People on old computers can create a w3pk wallet and log in. Where their authenticator allows it, signing in takes one click with no biometric prompt.
+
+Sites like [GitHub](https://github.com/) and [npm](https://www.npmjs.com/) feel lighter because of two things. First, they don't always request [user verification](https://www.w3.org/TR/webauthn-3/#user-verification) (UV). Second, many of their users keep passkeys in password managers like [1Password](https://1password.com/) or [Bitwarden](https://bitwarden.com/), which count an unlocked vault as verified. The site never controls whether a prompt appears. The [authenticator](https://www.w3.org/TR/webauthn-3/#authenticator) does.
+
+## Why old computers fail today
+
+An old computer without a fingerprint reader can still use passkeys. [macOS](https://developer.apple.com/passkeys/) falls back to the login password. [Windows Hello](https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/) falls back to a PIN. [Google Password Manager](https://passwords.google/) falls back to its own PIN.
+
+The real blocker is in [`src/auth/register.ts`](../../src/auth/register.ts). Registration sets [`authenticatorAttachment: "platform"`](https://www.w3.org/TR/webauthn-3/#enumdef-authenticatorattachment), which rejects machines without a built-in authenticator: older Windows, [Linux](https://en.wikipedia.org/wiki/Linux), or computers without a [TPM](https://en.wikipedia.org/wiki/Trusted_Platform_Module). It also shuts out what they could use instead:
+
+- a phone, through a QR code ([hybrid transport](https://www.w3.org/TR/webauthn-3/#dom-authenticatortransport-hybrid))
+- a USB or NFC [security key](https://en.wikipedia.org/wiki/Security_token)
+- a password manager
+
+Browsers without the [Web Authentication API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API) can't be helped by any passkey option. A password-encrypted wallet for them is out of scope here.
+
+## Changes in w3pk
+
+### 1. Allow any authenticator at registration
+
+Remove `authenticatorAttachment: "platform"` from `authenticatorSelection` in [`src/auth/register.ts`](../../src/auth/register.ts). Keep `residentKey: "required"`, so that login without a username still works.
+
+### 2. Add a `userVerification` setting
+
+Add the setting to `Web3PasskeyConfig` in [`src/core/config.ts`](../../src/core/config.ts):
+
+```ts
+/**
+ * WebAuthn user verification for login, registration and signing
+ * (default: 'required'). With 'preferred', authenticators that can skip
+ * the biometric/PIN check (security keys, unlocked password managers)
+ * sign in with one click. PRF-derived secrets always require it.
+ */
+userVerification?: 'required' | 'preferred';
+```
+
+Pass it through to:
+
+- `authenticatorSelection.userVerification` in [`src/auth/register.ts`](../../src/auth/register.ts)
+- the login assertion in [`src/auth/authenticate.ts`](../../src/auth/authenticate.ts)
+- the signing assertion in [`src/core/sdk.ts`](../../src/core/sdk.ts) (`userVerification: 'required'` near the WebAuthn signature request)
+
+The default stays `'required'`, so apps that don't set it behave as before.
+
+### 3. Keep PRF calls verified
+
+The [PRF extension](https://www.w3.org/TR/webauthn-3/#prf-extension) is built on the [CTAP2](https://fidoalliance.org/specifications/) `hmac-secret` extension, which keeps two separate secrets per credential: one for verified assertions and one for unverified ones. An unverified assertion can therefore return a *different* PRF output, which would silently derive a different session key or sync secret.
+
+- [`src/auth/prf.ts`](../../src/auth/prf.ts) and [`src/auth/sync-auth.ts`](../../src/auth/sync-auth.ts) always pass `userVerification: "required"`, whatever the config says.
+- In [`src/auth/authenticate.ts`](../../src/auth/authenticate.ts) and [`src/auth/register.ts`](../../src/auth/register.ts), read the [UV flag](https://www.w3.org/TR/webauthn-3/#authdata-flags-uv) (bit 2 of `authenticatorData[32]`). If UV is not set, drop `prfOutput`. The session then falls back to the in-memory path that already handles authenticators without PRF.
+
+### 4. Tests and docs
+
+- Unit tests:
+  - the registration options no longer contain `authenticatorAttachment`
+  - `userVerification` reaches login, registration and signing
+  - PRF calls stay `required` when the config says `'preferred'`
+  - `prfOutput` is ignored when the UV flag is clear
+- Document the option in [`docs/API_REFERENCE.md`](../API_REFERENCE.md) and [`docs/INTEGRATION_GUIDELINES.md`](../INTEGRATION_GUIDELINES.md), and the wider authenticator support in [`docs/BROWSER_COMPATIBILITY.md`](../BROWSER_COMPATIBILITY.md).
+- Add a `CHANGELOG.md` entry.
+
+## Changes in Genji
+
+[Genji](https://github.com/w3hc/genji) needs these changes once a w3pk release ships the option:
+
+- **Opt in.** Bump `w3pk` and pass `userVerification: 'preferred'` to `createWeb3Passkey` in `src/context/W3PK.tsx`.
+- **Fix the wording.** In `src/translations/index.ts`, rewrite the security text that promises a fingerprint is always required (the "derived using a WebAuthn signature, which requires your biometric authentication" paragraph). Also adjust the session texts that say each visit asks for biometric/PIN. Lines that say "biometric or PIN" can stay, since that is still true on most devices.
+- **No sign-up gate to fix.** `isPlatformAuthenticatorAvailable()` in `src/utils/browserDetection.ts` is not called anywhere, so nothing blocks registration on the Genji side. Leave it unused, or use it only to show a hint ("No built-in authenticator found: use your phone or a security key").
+
+## Out of scope: the wallet key is not tied to verification
+
+`deriveEncryptionKeyFromWebAuthn()` in [`src/wallet/crypto.ts`](../../src/wallet/crypto.ts) derives the wallet's [AES-GCM](https://en.wikipedia.org/wiki/Galois/Counter_Mode) key from `credentialId` and `publicKey`. Both are stored in the browser and neither is secret. So the stored wallet is protected by app logic, not by the biometric or PIN check, and loosening user verification doesn't weaken it any further.
+
+The real fix is to encrypt the wallet under the PRF secret. That needs its own issue in w3pk.
+
+## Done when
+
+- [ ] A computer with no built-in authenticator can register through a phone (QR code) or a security key.
+- [ ] With `userVerification: 'preferred'`, a security key or an unlocked password manager logs in with one click.
+- [ ] PRF-derived session and sync keys are identical before and after the change for verified logins.
+- [ ] An unverified login gets an in-memory session, never a different persistent session key.
+- [ ] Genji uses the option, and its copy no longer promises a fingerprint check.
+
+## Further reading
+
+- [Web Authentication Level 3](https://www.w3.org/TR/webauthn-3/)
+- [Passkeys developer guide](https://passkeys.dev/)
+- [FIDO Alliance specifications](https://fidoalliance.org/specifications/)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "w3pk",
-  "version": "0.10.4",
+  "version": "0.10.5",
   "description": "WebAuthn SDK for passwordless authentication, encrypted wallets, ERC-5564 stealth addresses, and zero-knowledge proofs",
   "author": "Julien Béranger",
   "license": "GPL-3.0",
@@ -63,16 +63,6 @@
       "types": "./dist/chainlist/index.d.ts",
       "import": "./dist/chainlist/index.mjs",
       "require": "./dist/chainlist/index.js"
-    },
-    "./inspect": {
-      "types": "./dist/inspect/index.d.ts",
-      "import": "./dist/inspect/index.mjs",
-      "require": "./dist/inspect/index.js"
-    },
-    "./inspect/node": {
-      "types": "./dist/inspect/node.d.ts",
-      "import": "./dist/inspect/node.mjs",
-      "require": "./dist/inspect/node.js"
     }
   },
   "sideEffects": false,
@@ -83,33 +73,6 @@
     "docs/",
     "scripts/compute-build-hash.mjs"
   ],
-  "scripts": {
-    "build": "tsup",
-    "build:zk": "npm run build && npm run compile:circuits",
-    "compile:circuits": "node scripts/compile-circuits.js",
-    "dev": "tsup --watch",
-    "test": "tsx test/test.ts && tsx test/comprehensive.test.ts && tsx test/backup.test.ts && tsx test/social-recovery.test.ts && tsx test/recovery-education.test.ts && tsx test/zk/zk.test.ts && tsx test/nft-ownership.test.ts && tsx test/chainlist.test.ts && tsx test/eip7702.test.ts && tsx test/external-wallet.test.ts && tsx test/erc5564.test.ts && tsx test/zk/key-stretching.test.ts && tsx test/username-encoding.test.ts && tsx test/username-validation.test.ts && tsx test/origin-derivation.test.ts && tsx test/build-hash.test.ts && tsx test/credential-checking.test.ts && tsx test/webauthn-native.test.ts && tsx test/persistent-session.test.ts && tsx test/local-storage.test.ts && tsx test/sign-message.test.ts && tsx test/siwe.test.ts && tsx test/requirereauth.test.ts && tsx test/eip7951.test.ts && tsx test/send-transaction.test.ts && tsx test/eip1193-provider.test.ts && tsx test/mlkem.test.ts && tsx test/login-missing-wallet.test.ts && tsx test/backup-status.test.ts && tsx test/eviction-risk.test.ts && tsx test/fresh-device-sync.test.ts && tsx test/prf-secret.test.ts && tsx test/prf-sync.test.ts",
-    "test:basic": "tsx test/test.ts",
-    "test:comprehensive": "tsx test/comprehensive.test.ts",
-    "test:backup": "tsx test/backup.test.ts",
-    "test:social-recovery": "tsx test/social-recovery.test.ts",
-    "test:education": "tsx test/recovery-education.test.ts",
-    "test:username": "tsx test/username-encoding.test.ts && tsx test/username-validation.test.ts",
-    "test:recovery": "tsx test/backup.test.ts && tsx test/social-recovery.test.ts && tsx test/recovery-education.test.ts",
-    "test:zk": "tsx test/zk/zk.test.ts",
-    "test:nft": "tsx test/nft-ownership.test.ts",
-    "test:chainlist": "tsx test/chainlist.test.ts",
-    "test:eip7702": "tsx test/eip7702.test.ts",
-    "test:external-wallet": "tsx test/external-wallet.test.ts",
-    "test:eip7951": "tsx test/eip7951.test.ts",
-    "test:erc5564": "tsx test/erc5564.test.ts",
-    "test:sign-message": "tsx test/sign-message.test.ts",
-    "test:siwe": "tsx test/siwe.test.ts",
-    "prepublishOnly": "pnpm build",
-    "build:hash": "node scripts/compute-build-hash.mjs",
-    "html": "lsof -ti:3000 | xargs kill -9 2>/dev/null || true && tsup && npx serve . -l 3000 & sleep 5 && open http://localhost:3000/standalone/checker.html"
-  },
-  "packageManager": "pnpm@10.6.4",
   "devDependencies": {
     "@types/node": "^25.9.2",
     "@types/qrcode": "^1.5.5",
@@ -134,19 +97,29 @@
     "@noble/hashes": "^2.2.0",
     "mlkem": "^2.7.0"
   },
-  "pnpm": {
-    "overrides": {
-      "jsonpath@<1.2.0": ">=1.2.0",
-      "bn.js@>=5.0.0 <5.2.3": ">=5.2.3",
-      "bn.js@<4.12.3": ">=4.12.3",
-      "minimatch@>=5.0.0 <5.1.7": ">=5.1.7",
-      "rollup@>=4.0.0 <4.59.0": ">=4.59.0",
-      "minimatch@>=5.0.0 <5.1.8": ">=5.1.8",
-      "jsonpath@<=1.2.1": ">=1.3.0",
-      "brace-expansion@>=2.0.0 <2.0.3": ">=2.0.3",
-      "picomatch@>=4.0.0 <4.0.4": ">=4.0.4",
-      "underscore@<=1.13.7": ">=1.13.8",
-      "ws@>=8.0.0 <8.20.1": ">=8.20.1"
-    }
+  "scripts": {
+    "build": "tsup",
+    "build:zk": "npm run build && npm run compile:circuits",
+    "compile:circuits": "node scripts/compile-circuits.js",
+    "dev": "tsup --watch",
+    "test": "tsx test/test.ts && tsx test/comprehensive.test.ts && tsx test/backup.test.ts && tsx test/social-recovery.test.ts && tsx test/recovery-education.test.ts && tsx test/zk/zk.test.ts && tsx test/nft-ownership.test.ts && tsx test/chainlist.test.ts && tsx test/eip7702.test.ts && tsx test/external-wallet.test.ts && tsx test/erc5564.test.ts && tsx test/zk/key-stretching.test.ts && tsx test/username-encoding.test.ts && tsx test/username-validation.test.ts && tsx test/origin-derivation.test.ts && tsx test/build-hash.test.ts && tsx test/credential-checking.test.ts && tsx test/webauthn-native.test.ts && tsx test/persistent-session.test.ts && tsx test/local-storage.test.ts && tsx test/sign-message.test.ts && tsx test/siwe.test.ts && tsx test/requirereauth.test.ts && tsx test/eip7951.test.ts && tsx test/send-transaction.test.ts && tsx test/eip1193-provider.test.ts && tsx test/mlkem.test.ts && tsx test/login-missing-wallet.test.ts && tsx test/backup-status.test.ts && tsx test/eviction-risk.test.ts && tsx test/fresh-device-sync.test.ts && tsx test/prf-secret.test.ts && tsx test/prf-sync.test.ts && tsx test/user-verification.test.ts",
+    "test:basic": "tsx test/test.ts",
+    "test:comprehensive": "tsx test/comprehensive.test.ts",
+    "test:backup": "tsx test/backup.test.ts",
+    "test:social-recovery": "tsx test/social-recovery.test.ts",
+    "test:education": "tsx test/recovery-education.test.ts",
+    "test:username": "tsx test/username-encoding.test.ts && tsx test/username-validation.test.ts",
+    "test:recovery": "tsx test/backup.test.ts && tsx test/social-recovery.test.ts && tsx test/recovery-education.test.ts",
+    "test:zk": "tsx test/zk/zk.test.ts",
+    "test:nft": "tsx test/nft-ownership.test.ts",
+    "test:chainlist": "tsx test/chainlist.test.ts",
+    "test:eip7702": "tsx test/eip7702.test.ts",
+    "test:external-wallet": "tsx test/external-wallet.test.ts",
+    "test:eip7951": "tsx test/eip7951.test.ts",
+    "test:erc5564": "tsx test/erc5564.test.ts",
+    "test:sign-message": "tsx test/sign-message.test.ts",
+    "test:siwe": "tsx test/siwe.test.ts",
+    "build:hash": "node scripts/compute-build-hash.mjs",
+    "html": "lsof -ti:3000 | xargs kill -9 2>/dev/null || true && tsup && npx serve . -l 3000 & sleep 5 && open http://localhost:3000/standalone/checker.html"
   }
 }

package/dist/inspect/browser.d.mts

@@ -1,106 +0,0 @@
-/**
- * Browser Inspection Module
- *
- * Provides client-side code inspection capabilities for analyzing running web3 applications.
- * Fetches JavaScript sources from the current page and analyzes transaction/signing patterns
- * to generate security reports via the Rukh API.
- *
- * This module is designed to be used directly in the browser console or embedded in
- * web applications to help end-users understand the security posture of the apps they use.
- *
- * @module inspect/browser
- */
-/**
- * Configuration options for browser-based application inspection
- */
-interface BrowserInspectOptions {
-    /**
-     * The origin/URL of the app to inspect
-     * @default window.location.origin
-     */
-    appUrl?: string;
-    /**
-     * Rukh API endpoint
-     * @default 'https://rukh.w3hc.org'
-     */
-    rukhUrl?: string;
-    /**
-     * Context to use for analysis
-     * @default 'w3pk'
-     */
-    context?: string;
-    /**
-     * AI model to use
-     * @default 'anthropic'
-     */
-    model?: "anthropic" | "mistral" | "openai";
-    /**
-     * Focus mode for analysis
-     * @default 'transactions'
-     */
-    focusMode?: "transactions" | "all";
-    /**
-     * Maximum total size in KB for all collected code (prevents exceeding API token limits)
-     * @default 100
-     */
-    maxTotalSizeKB?: number;
-}
-/**
- * Result of a browser-based inspection
- */
-interface BrowserInspectResult {
-    /**
-     * The security report markdown generated by Rukh API
-     */
-    report: string;
-    /**
-     * List of JavaScript file paths that were analyzed
-     */
-    analyzedFiles: string[];
-    /**
-     * The application URL that was inspected
-     */
-    appUrl: string;
-}
-/**
- * Inspects the currently running web application and returns a security report
- *
- * This function can be called by end-users in their browser console to analyze
- * the security of the web application they're currently using.
- *
- * @param options - Configuration options
- * @returns A security report analyzing transaction and signing methods
- *
- * @example
- * ```typescript
- * // In browser console or app code:
- * import { inspect } from 'w3pk';
- *
- * const report = await inspect();
- * console.log(report.report);
- * ```
- *
- * @example
- * ```typescript
- * // With custom options:
- * const report = await inspect({
- *   appUrl: 'https://w3pk.w3hc.org',
- *   model: 'anthropic',
- *   focusMode: 'transactions'
- * });
- * ```
- */
-declare function inspect(options?: BrowserInspectOptions): Promise<BrowserInspectResult>;
-/**
- * Quick inspection helper that logs the report to console
- * Perfect for use in browser DevTools console
- *
- * @example
- * ```javascript
- * // In browser console:
- * await w3pk.inspectNow()
- * ```
- */
-declare function inspectNow(options?: BrowserInspectOptions): Promise<void>;
-
-export { type BrowserInspectOptions, type BrowserInspectResult, inspect, inspectNow };

package/dist/inspect/browser.d.ts

@@ -1,106 +0,0 @@
-/**
- * Browser Inspection Module
- *
- * Provides client-side code inspection capabilities for analyzing running web3 applications.
- * Fetches JavaScript sources from the current page and analyzes transaction/signing patterns
- * to generate security reports via the Rukh API.
- *
- * This module is designed to be used directly in the browser console or embedded in
- * web applications to help end-users understand the security posture of the apps they use.
- *
- * @module inspect/browser
- */
-/**
- * Configuration options for browser-based application inspection
- */
-interface BrowserInspectOptions {
-    /**
-     * The origin/URL of the app to inspect
-     * @default window.location.origin
-     */
-    appUrl?: string;
-    /**
-     * Rukh API endpoint
-     * @default 'https://rukh.w3hc.org'
-     */
-    rukhUrl?: string;
-    /**
-     * Context to use for analysis
-     * @default 'w3pk'
-     */
-    context?: string;
-    /**
-     * AI model to use
-     * @default 'anthropic'
-     */
-    model?: "anthropic" | "mistral" | "openai";
-    /**
-     * Focus mode for analysis
-     * @default 'transactions'
-     */
-    focusMode?: "transactions" | "all";
-    /**
-     * Maximum total size in KB for all collected code (prevents exceeding API token limits)
-     * @default 100
-     */
-    maxTotalSizeKB?: number;
-}
-/**
- * Result of a browser-based inspection
- */
-interface BrowserInspectResult {
-    /**
-     * The security report markdown generated by Rukh API
-     */
-    report: string;
-    /**
-     * List of JavaScript file paths that were analyzed
-     */
-    analyzedFiles: string[];
-    /**
-     * The application URL that was inspected
-     */
-    appUrl: string;
-}
-/**
- * Inspects the currently running web application and returns a security report
- *
- * This function can be called by end-users in their browser console to analyze
- * the security of the web application they're currently using.
- *
- * @param options - Configuration options
- * @returns A security report analyzing transaction and signing methods
- *
- * @example
- * ```typescript
- * // In browser console or app code:
- * import { inspect } from 'w3pk';
- *
- * const report = await inspect();
- * console.log(report.report);
- * ```
- *
- * @example
- * ```typescript
- * // With custom options:
- * const report = await inspect({
- *   appUrl: 'https://w3pk.w3hc.org',
- *   model: 'anthropic',
- *   focusMode: 'transactions'
- * });
- * ```
- */
-declare function inspect(options?: BrowserInspectOptions): Promise<BrowserInspectResult>;
-/**
- * Quick inspection helper that logs the report to console
- * Perfect for use in browser DevTools console
- *
- * @example
- * ```javascript
- * // In browser console:
- * await w3pk.inspectNow()
- * ```
- */
-declare function inspectNow(options?: BrowserInspectOptions): Promise<void>;
-
-export { type BrowserInspectOptions, type BrowserInspectResult, inspect, inspectNow };