wative-core 1.2.2 → 2.2.1

package/examples/01-quick-start.test.cjs

@@ -0,0 +1,37 @@
+// 01 — Quick start. Open a workspace, create an HD account, derive wallets,
+// lock down. The shortest end-to-end demo.
+
+const test = require("node:test");
+const assert = require("node:assert");
+const { mkdtempSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const { join } = require("node:path");
+
+const { Workspace } = require("wative-core");
+
+test("quick start — open, create HD account, derive wallets, lock", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-quickstart-"));
+  const password = "your-workspace-password";
+
+  const ws = await Workspace.open({ path: root, password });
+  assert.strictEqual(ws.locked, false);
+
+  const account = await ws.accounts.create(
+    "Trading Desk",
+    password,
+    "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about",
+  );
+  assert.strictEqual(account.wallets.length, 1);
+
+  await account.deriveWallets(4);
+  assert.strictEqual(account.wallets.length, 5);
+
+  const wallet = account.wallets[0];
+  const evm = wallet.addresses.find((a) => a.vm === "evm");
+  const svm = wallet.addresses.find((a) => a.vm === "svm");
+  assert.ok(evm && evm.publicKey.startsWith("0x"));
+  assert.ok(svm && svm.publicKey.length >= 32);
+
+  await ws.lock();
+  assert.strictEqual(ws.locked, true);
+});

package/examples/02-hd-account.test.cjs

@@ -0,0 +1,71 @@
+// 02 — HD account flows. derive / slice wallets, dump mnemonic, reset password,
+// reopen a locked workspace.
+
+const test = require("node:test");
+const assert = require("node:assert");
+const { mkdtempSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const { join } = require("node:path");
+
+const { Workspace } = require("wative-core");
+
+const MNEMONIC =
+  "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";
+
+test("HD account — derive, slice, dump mnemonic", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-hd-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const acc = await ws.accounts.create("Desk", "wsp-pwd", MNEMONIC);
+  await acc.deriveWallets(10);
+  assert.strictEqual(acc.wallets.length, 11);
+
+  await acc.sliceWallets(6);
+  assert.strictEqual(acc.wallets.length, 6);
+
+  assert.strictEqual(acc.dumpMnemonic(), MNEMONIC);
+
+  await ws.lock();
+});
+
+test("HD account — own password + resetPassword", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-hd-pwd-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const sub = await ws.accounts.create("SubAccount", "sub-pwd", MNEMONIC, undefined, {
+    hasOwnPassword: true,
+  });
+  assert.strictEqual(sub.locked, false);
+
+  sub.lock();
+  assert.strictEqual(sub.locked, true);
+
+  await assert.rejects(sub.tryUnlock("wrong"), (err) => err.code === "BAD_PASSWORD");
+  await sub.tryUnlock("sub-pwd");
+
+  await sub.resetPassword("sub-pwd", "new-sub-pwd");
+  sub.lock();
+  await assert.rejects(sub.tryUnlock("sub-pwd"), (err) => err.code === "BAD_PASSWORD");
+  await sub.tryUnlock("new-sub-pwd");
+
+  await ws.lock();
+});
+
+test("HD account — round-trip across lock + reopen", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-hd-reopen-"));
+  let ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const acc = await ws.accounts.create("Persistent", "wsp-pwd", MNEMONIC);
+  await acc.deriveWallets(2);
+  const firstAddr = acc.wallets[0].addresses[0].publicKey;
+
+  await ws.lock();
+
+  ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+  const reopened = ws.accounts.bySlug(acc.slug);
+  assert.ok(reopened);
+  assert.strictEqual(reopened.wallets.length, 3);
+  assert.strictEqual(reopened.wallets[0].addresses[0].publicKey, firstAddr);
+
+  await ws.lock();
+});

package/examples/03-pk-account.test.cjs

@@ -0,0 +1,59 @@
+// 03 — PK account flows. Heterogeneous private keys, one wallet per import.
+
+const test = require("node:test");
+const assert = require("node:assert");
+const { mkdtempSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const { join } = require("node:path");
+
+const { Workspace } = require("wative-core");
+
+const EVM_PK = "0x4f3edf983ac636a65a842ce7c78d9aa706d3b113bce9c46f30d7d21715b23b1d";
+const SVM_PK = "xtGWcHvQsr5ue8zG2F5fm31bW8vyn597Y92gUWaZZg3S1Z6FeJMATL8KU3xJMGbLfALnokcct9y5wYtCRrwNXZW";
+
+test("PK account — create from EVM key + import a Solana key", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-pk-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const acc = await ws.accounts.create(
+    "External Hot Wallet",
+    "wsp-pwd",
+    EVM_PK,
+    undefined,
+    { kind: "PK" },
+  );
+  assert.strictEqual(acc.organizationType, "PK");
+  assert.strictEqual(acc.wallets.length, 1);
+  assert.strictEqual(acc.wallets[0].addresses[0].vm, "evm");
+
+  await acc.importPrivateKey(SVM_PK, "svm");
+  assert.strictEqual(acc.wallets.length, 2);
+  assert.strictEqual(acc.wallets[1].addresses[0].vm, "svm");
+
+  await ws.lock();
+});
+
+test("PK account — duplicate import is rejected", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-pk-dup-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const acc = await ws.accounts.create("HotWallet", "wsp-pwd", EVM_PK, undefined, { kind: "PK" });
+  await assert.rejects(acc.importPrivateKey(EVM_PK, "evm"), (err) => err.code === "PARAMETER_ERROR");
+
+  await ws.lock();
+});
+
+test("PK account — drop a wallet (account keeps at least one)", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-pk-drop-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const acc = await ws.accounts.create("HotWallet", "wsp-pwd", EVM_PK, undefined, { kind: "PK" });
+  await acc.importPrivateKey(SVM_PK, "svm");
+
+  await acc.wallets.drop(acc.wallets[1]);
+  assert.strictEqual(acc.wallets.length, 1);
+
+  await assert.rejects(acc.wallets.drop(acc.wallets[0]), (err) => err.code === "UNSUPPORTED_OP");
+
+  await ws.lock();
+});

package/examples/04-network-management.test.cjs

@@ -0,0 +1,94 @@
+// 04 — Network management. Pre-loaded networks, add custom networks,
+// override an existing network's RPC URL, drop user networks.
+
+const test = require("node:test");
+const assert = require("node:assert");
+const { mkdtempSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const { join } = require("node:path");
+
+const { Workspace, Network } = require("wative-core");
+
+test("network — 10 pre-loaded networks ship at workspace open", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-net-builtin-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const slugs = ws.networks.map((n) => n.slug).sort();
+  assert.deepStrictEqual(slugs, [
+    "arbitrum", "arbitrum-sepolia", "base", "bnbchain", "ethereum", "optimism",
+    "sepolia", "solana", "solana-devnet", "solana-testnet",
+  ]);
+
+  assert.strictEqual(Network.ArbitrumSepolia.chainId, 421614);
+  assert.strictEqual(Network.Ethereum.chainId, 1);
+  assert.strictEqual(Network.Solana.vm, "svm");
+  assert.strictEqual(ws.networks.bySlug("ethereum").chainId, 1);
+  assert.strictEqual(ws.networks.bySlug("arbitrum-sepolia").vm, "evm");
+  assert.strictEqual(ws.networks.byChainId(8453).slug, "base");
+
+  await ws.lock();
+});
+
+test("network — add a brand-new user network", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-net-add-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const monad = new Network({
+    slug: "monad-testnet",
+    name: "Monad Testnet",
+    chainId: 10143,
+    rpcUrl: "https://testnet-rpc.monad.xyz",
+    nativeCurrency: { name: "Monad", symbol: "MON", decimals: 18 },
+    vm: "evm",
+  });
+  await ws.networks.add(monad);
+
+  assert.strictEqual(ws.networks.length, 11);
+  assert.strictEqual(ws.networks.bySlug("monad-testnet").chainId, 10143);
+  await assert.rejects(ws.networks.add(monad), (err) => err.code === "PARAMETER_ERROR");
+
+  await ws.lock();
+});
+
+test("network — override a pre-loaded RPC URL via update()", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-net-override-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const eth = ws.networks.bySlug("ethereum");
+  const customEth = new Network({
+    ...eth,
+    rpcUrl: "https://eth-mainnet.g.alchemy.com/v2/YOUR_KEY",
+  });
+  await ws.networks.update(customEth);
+
+  assert.strictEqual(
+    ws.networks.bySlug("ethereum").rpcUrl,
+    "https://eth-mainnet.g.alchemy.com/v2/YOUR_KEY",
+  );
+  assert.strictEqual(ws.networks.length, 10);
+
+  await ws.lock();
+});
+
+test("network — drop user network; pre-loaded networks reject drop", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-net-drop-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const custom = new Network({
+    slug: "my-net",
+    name: "My Net",
+    chainId: 99999,
+    rpcUrl: "https://rpc.example",
+    nativeCurrency: { name: "Foo", symbol: "FOO", decimals: 18 },
+    vm: "evm",
+  });
+  await ws.networks.add(custom);
+
+  await ws.networks.drop(custom);
+  assert.strictEqual(ws.networks.bySlug("my-net"), null);
+
+  const eth = ws.networks.bySlug("ethereum");
+  await assert.rejects(ws.networks.drop(eth), (err) => err.code === "UNSUPPORTED_OP");
+
+  await ws.lock();
+});

package/examples/05-asset-management.test.cjs

@@ -0,0 +1,117 @@
+// 05 — Asset management. Pre-loaded tokens, add custom tokens,
+// drop user tokens, search via filter.
+
+const test = require("node:test");
+const assert = require("node:assert");
+const { mkdtempSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const { join } = require("node:path");
+
+const { Workspace, Network, Asset } = require("wative-core");
+
+test("asset — pre-loaded tokens per network", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-asset-builtin-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const ethAssets = await ws.assets(Network.Ethereum);
+  assert.deepStrictEqual(ethAssets.map((a) => a.symbol).sort(), ["ETH", "USDC", "USDT", "WETH"]);
+
+  const solAssets = await ws.assets(Network.Solana);
+  assert.deepStrictEqual(solAssets.map((a) => a.symbol).sort(), ["SOL", "USDC", "USDT", "WSOL"]);
+
+  const sepoliaAssets = await ws.assets("sepolia");
+  assert.strictEqual(sepoliaAssets.length, 1);
+
+  const arbSepoliaAssets = await ws.assets("arbitrum-sepolia");
+  const arbSepoliaUsdc = arbSepoliaAssets.find((a) => a.symbol === "USDC");
+  assert.ok(arbSepoliaUsdc);
+  assert.strictEqual(arbSepoliaUsdc.decimals, 6);
+  assert.strictEqual(arbSepoliaUsdc.contractAddress, "0x75faf114eafb1BDbe2F0316DF893fd58CE46AA4d");
+  assert.strictEqual(arbSepoliaUsdc.native, false);
+
+  await ws.lock();
+});
+
+test("asset — add a custom user token", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-asset-add-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const pepe = new Asset({
+    id: 200,
+    symbol: "PEPE",
+    name: "Pepe",
+    decimals: 18,
+    contractAddress: "0x6982508145454Ce325dDbE47a25d4ec3d2311933",
+    network: Network.Ethereum,
+  });
+  await ws.addAsset(pepe);
+
+  const ethAssets = await ws.assets(Network.Ethereum);
+  assert.strictEqual(ethAssets.length, 5);
+  assert.ok(ethAssets.some((a) => a.id === 200 && a.symbol === "PEPE"));
+
+  await ws.lock();
+});
+
+test("asset — id and address collisions are rejected", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-asset-collide-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const dupId = new Asset({
+    id: 1,
+    symbol: "FAKE",
+    name: "Fake",
+    decimals: 18,
+    contractAddress: "0x1234567890123456789012345678901234567890",
+    network: Network.Ethereum,
+  });
+  await assert.rejects(ws.addAsset(dupId), (err) => err.code === "PARAMETER_ERROR");
+
+  const dupAddr = new Asset({
+    id: 201,
+    symbol: "USDC2",
+    name: "Other USDC",
+    decimals: 6,
+    contractAddress: "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
+    network: Network.Ethereum,
+  });
+  await assert.rejects(ws.addAsset(dupAddr), (err) => err.code === "PARAMETER_ERROR");
+
+  await ws.lock();
+});
+
+test("asset — drop user token; pre-loaded tokens reject drop", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-asset-drop-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const my = new Asset({
+    id: 300,
+    symbol: "MINE",
+    name: "Mine",
+    decimals: 18,
+    contractAddress: "0x1111111111111111111111111111111111111111",
+    network: Network.Ethereum,
+  });
+  await ws.addAsset(my);
+  await ws.dropAsset(300);
+
+  const ethAssets = await ws.assets(Network.Ethereum);
+  assert.ok(!ethAssets.some((a) => a.id === 300));
+
+  await assert.rejects(ws.dropAsset(1), (err) => err.code === "UNSUPPORTED_OP");
+
+  await ws.lock();
+});
+
+test("asset — workspace.filter('Asset', q) finds by symbol or contract address", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-asset-filter-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const bySymbol = await ws.filter("USDC", "Asset");
+  assert.ok(bySymbol && bySymbol.symbol === "USDC");
+
+  const byAddr = await ws.filter("0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48", "Asset");
+  assert.ok(byAddr && byAddr.symbol === "USDC");
+
+  await ws.lock();
+});

package/examples/06-address-signing.test.cjs

@@ -0,0 +1,55 @@
+// 06 — Address signing. Sign personal messages and build transactions
+// fully offline.
+
+const test = require("node:test");
+const assert = require("node:assert");
+const { mkdtempSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const { join } = require("node:path");
+
+const { Workspace, Network } = require("wative-core");
+
+const MNEMONIC =
+  "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";
+
+test("address — signMessage on EVM and SVM", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-sign-msg-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const acc = await ws.accounts.create("Desk", "wsp-pwd", MNEMONIC);
+  const evm = acc.wallets[0].addresses.find((a) => a.vm === "evm");
+  const svm = acc.wallets[0].addresses.find((a) => a.vm === "svm");
+
+  const evmSig = evm.signMessage("hello");
+  const svmSig = svm.signMessage("hello");
+
+  assert.ok(typeof evmSig === "string" && evmSig.startsWith("0x"));
+  assert.ok(typeof svmSig === "string" && svmSig.length > 0);
+  assert.notStrictEqual(evmSig, svmSig);
+
+  await ws.lock();
+});
+
+test("address — buildTransaction convenience helper (offline)", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-build-tx-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const acc = await ws.accounts.create("Desk", "wsp-pwd", MNEMONIC);
+  const evm = acc.wallets[0].addresses.find((a) => a.vm === "evm");
+
+  const tx = await evm.buildTransaction({
+    to: "0x1234567890123456789012345678901234567890",
+    value: 1_000_000_000_000_000n,
+    chainId: 1,
+    nonce: 0,
+    gasLimit: 21000n,
+    maxFeePerGas: 50_000_000_000n,
+    maxPriorityFeePerGas: 1_000_000_000n,
+    type: 2,
+    network: Network.Ethereum,
+  });
+
+  assert.strictEqual(tx.from.toLowerCase(), evm.publicKey.toLowerCase());
+
+  await ws.lock();
+});

package/examples/07-custom-provider.test.cjs

@@ -0,0 +1,164 @@
+// 07 — Custom storage backend. Extend the abstract `Provider` class to plug
+// `Workspace.open()` into any storage system. This example uses an in-memory
+// key-value store with a trivial XOR cipher; real custom Providers should use
+// an authenticated cipher (AES-GCM, ChaCha20-Poly1305).
+
+const test = require("node:test");
+const assert = require("node:assert");
+
+const { Workspace, Provider, Record, WativeError } = require("wative-core");
+
+/**
+ * In-memory `Provider` implementation. Stores records in a Map under
+ * filesystem-style paths, encrypted with a single-byte-header XOR scheme.
+ */
+class InMemoryProvider extends Provider {
+  #store = new Map();
+  #dirs = new Set();
+  #password = null;
+
+  constructor(label) {
+    super(label);
+    this.#dirs.add("/");
+    this.#dirs.add("/accounts");
+  }
+
+  _exist(path) { return this.#store.has(path) || this.#dirs.has(path); }
+  _read(path) {
+    const v = this.#store.get(path);
+    if (!v) throw new WativeError("RECORD_NOT_FOUND", `no entry at ${path}`);
+    return v;
+  }
+  _write(path, data) { this.#store.set(path, data); }
+  _remove(path) { this.#store.delete(path); }
+  _ensureDir(path) { this.#dirs.add(path); }
+  _listItems(path) {
+    const prefix = path.endsWith("/") ? path : path + "/";
+    const out = new Set();
+    for (const k of this.#store.keys()) {
+      if (k.startsWith(prefix)) {
+        const head = k.slice(prefix.length).split("/")[0];
+        if (head) out.add(head);
+      }
+    }
+    return Array.from(out);
+  }
+
+  async unlockContainer(password) {
+    if (typeof password !== "string" || password.length === 0) return false;
+    const path = this.#pathFor("CONFIG", "config");
+    if (this.#store.has(path)) {
+      try { this.#decrypt(this.#store.get(path), password); }
+      catch { return false; }
+    }
+    this.#password = password;
+    return true;
+  }
+  async lockContainer() { this.#password = null; }
+  isContainerUnlocked() { return this.#password !== null; }
+
+  async loadRecord(type, slug) {
+    if (this.#password === null) throw new WativeError("PROVIDER_IO", "container locked");
+    const eff = slug ?? this.#defaultSlug(type);
+    const path = this.#pathFor(type, eff);
+    if (!this.#store.has(path)) throw new WativeError("RECORD_NOT_FOUND", path);
+    const encrypted = this.#store.get(path);
+    const value = JSON.parse(new TextDecoder().decode(this.#decrypt(encrypted, this.#password)));
+    return new Record(eff, path, {
+      provider: this,
+      recordType: type,
+      encrypted,
+      value,
+      password: this.#password,
+      decrypt: (ct, pwd) => this.#decrypt(ct, pwd),
+      persist: async (val, pwd) => {
+        this.#store.set(path, this.#encrypt(JSON.stringify(val), pwd));
+      },
+    });
+  }
+  async loadRecords(type) {
+    if (type !== "ACCOUNTS") {
+      const r = await this.loadRecord(type).catch((e) => {
+        if (e instanceof WativeError && e.code === "RECORD_NOT_FOUND") return null;
+        throw e;
+      });
+      return r ? [r] : [];
+    }
+    const items = this._listItems("/accounts").filter((n) => n.endsWith(".kv"));
+    return Promise.all(items.map((n) => this.loadRecord("ACCOUNTS", n.slice(0, -3))));
+  }
+  async writeRecord(type, slug, value) {
+    if (this.#password === null) throw new WativeError("PROVIDER_IO", "container locked");
+    this.#store.set(this.#pathFor(type, slug), this.#encrypt(JSON.stringify(value), this.#password));
+  }
+  async dropRecord(type, slug) { this.#store.delete(this.#pathFor(type, slug)); }
+  async close() { this.#password = null; }
+
+  #defaultSlug(type) {
+    return ({ CONFIG: "config", NETWORK: "network", ASSET: "asset", LOG: "log", ACCOUNTS: "" })[type] || "";
+  }
+  #pathFor(type, slug) {
+    if (type === "ACCOUNTS") return `/accounts/${slug}.kv`;
+    return `/${this.#defaultSlug(type)}`;
+  }
+  #encrypt(plaintext, password) {
+    const data = new TextEncoder().encode(plaintext);
+    const stream = this.#streamFor(password, data.length);
+    const out = new Uint8Array(data.length + 1);
+    out[0] = 0x42;
+    for (let i = 0; i < data.length; i++) out[i + 1] = data[i] ^ stream[i];
+    return out;
+  }
+  #decrypt(blob, password) {
+    if (blob.length < 1 || blob[0] !== 0x42) throw new WativeError("DECRYPT_FAILED", "bad header");
+    const ct = blob.subarray(1);
+    const stream = this.#streamFor(password, ct.length);
+    const out = new Uint8Array(ct.length);
+    for (let i = 0; i < ct.length; i++) out[i] = ct[i] ^ stream[i];
+    try { JSON.parse(new TextDecoder().decode(out)); }
+    catch (e) { throw new WativeError("BAD_PASSWORD", "non-JSON after decrypt", { cause: e }); }
+    return out;
+  }
+  #streamFor(password, length) {
+    const seed = new TextEncoder().encode("salt|" + password);
+    const out = new Uint8Array(length);
+    for (let i = 0; i < length; i++) out[i] = seed[i % seed.length] ^ ((i * 7) & 0xff);
+    return out;
+  }
+}
+
+test("custom provider — full lifecycle against an in-memory backend", async () => {
+  const provider = new InMemoryProvider("memory://desk-1");
+
+  let ws = await Workspace.open({ provider, password: "wsp-pwd" });
+  assert.strictEqual(ws.locked, false);
+
+  const slugs = ws.networks.map((n) => n.slug).sort();
+  assert.strictEqual(slugs.length, 10);
+  assert.ok(slugs.includes("ethereum"));
+  assert.ok(slugs.includes("arbitrum-sepolia"));
+
+  const acc = await ws.accounts.create(
+    "Trader",
+    "wsp-pwd",
+    "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about",
+  );
+  await acc.deriveWallets(2);
+  assert.strictEqual(acc.wallets.length, 3);
+
+  await ws.lock();
+  ws = await Workspace.open({ provider, password: "wsp-pwd" });
+  const reopened = ws.accounts.bySlug(acc.slug);
+  assert.ok(reopened);
+  assert.strictEqual(reopened.wallets.length, 3);
+
+  await ws.lock();
+});
+
+test("custom provider — bad password is rejected", async () => {
+  const provider = new InMemoryProvider("memory://desk-2");
+  const ws = await Workspace.open({ provider, password: "right-pwd" });
+  await ws.lock();
+
+  await assert.rejects(Workspace.open({ provider, password: "wrong-pwd" }), (err) => err.code === "BAD_PASSWORD");
+});