wative-core 2.4.1 → 2.4.3

package/dist/{svm-B5q8YaV9.d.ts → svm-B51NevS8.d.ts}

@@ -1,4 +1,4 @@
-import { c as Address, G as SvmTxBuildParams, F as SvmTransaction } from './workspace-kq3QyAgm.js';
+import { c as Address, G as SvmTxBuildParams, F as SvmTransaction } from './workspace-CBxKR80D.js';
 
 interface SvmInstruction {
     readonly programId: string;

package/dist/{svm-CXFwmeMo.d.cts → svm-DswX6XRv.d.cts}

@@ -1,4 +1,4 @@
-import { c as Address, G as SvmTxBuildParams, F as SvmTransaction } from './workspace-kq3QyAgm.cjs';
+import { c as Address, G as SvmTxBuildParams, F as SvmTransaction } from './workspace-CBxKR80D.cjs';
 
 interface SvmInstruction {
     readonly programId: string;

package/dist/{workspace-kq3QyAgm.d.cts → workspace-CBxKR80D.d.cts}

@@ -128,11 +128,7 @@ interface RecordInit<T> {
     readonly password?: string;
     readonly decrypt?: (ciphertext: Uint8Array, password: string) => Uint8Array;
     readonly persist?: (value: T, password: string) => Promise<void>;
-    /**
-     * Throws if the session that issued this record has ended. Supplied by
-     * providers that HAVE a session; a provider without one omits it and the
-     * record behaves as before.
-     */
+    /** Throws if the session that issued this record has ended. */
     readonly requireLiveSession?: () => void;
 }
 declare class Record$1<T> {
@@ -142,17 +138,7 @@ declare class Record$1<T> {
     constructor(slug: Slug, path: string, init?: RecordInit<T>);
     get locked(): boolean;
     get value(): T;
-    /**
-     * Pure CPU — decrypts the in-memory blob. Sync.
-     *
-     * BAD_PASSWORD means the password is wrong: an AES-GCM auth-tag mismatch on
-     * the locked path, or a mismatch against the password that opened the record
-     * on the unlocked one. DECRYPT_FAILED means the record cannot answer —
-     * structural damage or corruption on the locked path, and on the unlocked
-     * path a record carrying neither a password nor ciphertext, which has nothing
-     * to verify against. Callers can still read the two apart as "wrong password"
-     * versus "cannot be checked".
-     */
+    /** Pure CPU — decrypts the in-memory blob. */
     unlock(password: string): this;
     /** Persists changes via the owning Provider. */
     save(): Promise<void>;
@@ -170,38 +156,15 @@ declare abstract class Provider {
     abstract unlockContainer(password: string): Promise<boolean>;
     abstract lockContainer(): Promise<void>;
     abstract isContainerUnlocked(): boolean;
-    /**
-     * Structural inspection of the container BEFORE unlock. `Workspace.open()`
-     * uses it to auto-select create-vs-open without a `create` flag:
-     *   - `"empty"`     — no container yet; safe to initialize a new workspace.
-     *   - `"workspace"` — an existing wative workspace; open it.
-     *   - `"foreign"`   — non-empty storage that is NOT a wative workspace; `open()`
-     *                     refuses rather than scaffolding a workspace into it.
-     * The base default returns `"workspace"` (proceed as open-or-create, no guard),
-     * so existing custom providers are unaffected. Providers that can cheaply
-     * inspect their storage — e.g. `HybridProvider` on a filesystem — override this
-     * to detect `"foreign"` and stop a mistyped path from creating a workspace
-     * inside unrelated data.
-     */
+    /** Structural inspection of the container BEFORE unlock. */
     inspectContainer(): Promise<ContainerState>;
     abstract loadRecord<T>(type: RecordType, slug?: Slug): Promise<Record$1<T>>;
     abstract loadRecords<T>(type: RecordType): Promise<ReadonlyArray<Record$1<T>>>;
     abstract writeRecord<T>(type: RecordType, slug: Slug, value: T): Promise<void>;
     abstract dropRecord(type: RecordType, slug: Slug): Promise<void>;
-    /**
-     * Initialize an empty container by writing the four root records
-     * (CONFIG, NETWORK, ASSET, LOG) from the bundled template files at
-     * `src/workspace_template/`. Idempotent: existing records are left
-     * untouched. The ACCOUNTS namespace is left empty — per-account records
-     * are created lazily by `accounts.create(...)`.
-     *
-     * Subclasses inherit this default; override only if a backend needs
-     * non-record initialization (e.g. allocating a database schema).
-     */
+    /** Initialize an empty container by writing the four root records (CONFIG, NETWORK, ASSET, LOG) from the bundled templat... */
     initialize(): Promise<void>;
-    /** Any storage at all under the accounts area, however named. Defaults to
-     *  "nothing", so a provider that does not implement it can only fail to add a
-     *  refusal reason — never cause one. */
+    /** Any storage at all under the accounts area, however named. */
     protected _hasRawAccountData(): Promise<boolean>;
     abstract close(): Promise<void>;
 }
@@ -622,7 +585,8 @@ declare class Account {
         after: number;
         dropped: number;
     }>;
-    importPrivateKey(pk: string, vm: ChainVM): Promise<Wallet>;
+    
+    importPrivateKey(pk: string, vm?: ChainVM): Promise<Wallet>;
     drop(): Promise<void>;
     
     filterAddress(network: NetworkLike, addr?: string): Address | null;

package/dist/{workspace-kq3QyAgm.d.ts → workspace-CBxKR80D.d.ts}

@@ -128,11 +128,7 @@ interface RecordInit<T> {
     readonly password?: string;
     readonly decrypt?: (ciphertext: Uint8Array, password: string) => Uint8Array;
     readonly persist?: (value: T, password: string) => Promise<void>;
-    /**
-     * Throws if the session that issued this record has ended. Supplied by
-     * providers that HAVE a session; a provider without one omits it and the
-     * record behaves as before.
-     */
+    /** Throws if the session that issued this record has ended. */
     readonly requireLiveSession?: () => void;
 }
 declare class Record$1<T> {
@@ -142,17 +138,7 @@ declare class Record$1<T> {
     constructor(slug: Slug, path: string, init?: RecordInit<T>);
     get locked(): boolean;
     get value(): T;
-    /**
-     * Pure CPU — decrypts the in-memory blob. Sync.
-     *
-     * BAD_PASSWORD means the password is wrong: an AES-GCM auth-tag mismatch on
-     * the locked path, or a mismatch against the password that opened the record
-     * on the unlocked one. DECRYPT_FAILED means the record cannot answer —
-     * structural damage or corruption on the locked path, and on the unlocked
-     * path a record carrying neither a password nor ciphertext, which has nothing
-     * to verify against. Callers can still read the two apart as "wrong password"
-     * versus "cannot be checked".
-     */
+    /** Pure CPU — decrypts the in-memory blob. */
     unlock(password: string): this;
     /** Persists changes via the owning Provider. */
     save(): Promise<void>;
@@ -170,38 +156,15 @@ declare abstract class Provider {
     abstract unlockContainer(password: string): Promise<boolean>;
     abstract lockContainer(): Promise<void>;
     abstract isContainerUnlocked(): boolean;
-    /**
-     * Structural inspection of the container BEFORE unlock. `Workspace.open()`
-     * uses it to auto-select create-vs-open without a `create` flag:
-     *   - `"empty"`     — no container yet; safe to initialize a new workspace.
-     *   - `"workspace"` — an existing wative workspace; open it.
-     *   - `"foreign"`   — non-empty storage that is NOT a wative workspace; `open()`
-     *                     refuses rather than scaffolding a workspace into it.
-     * The base default returns `"workspace"` (proceed as open-or-create, no guard),
-     * so existing custom providers are unaffected. Providers that can cheaply
-     * inspect their storage — e.g. `HybridProvider` on a filesystem — override this
-     * to detect `"foreign"` and stop a mistyped path from creating a workspace
-     * inside unrelated data.
-     */
+    /** Structural inspection of the container BEFORE unlock. */
     inspectContainer(): Promise<ContainerState>;
     abstract loadRecord<T>(type: RecordType, slug?: Slug): Promise<Record$1<T>>;
     abstract loadRecords<T>(type: RecordType): Promise<ReadonlyArray<Record$1<T>>>;
     abstract writeRecord<T>(type: RecordType, slug: Slug, value: T): Promise<void>;
     abstract dropRecord(type: RecordType, slug: Slug): Promise<void>;
-    /**
-     * Initialize an empty container by writing the four root records
-     * (CONFIG, NETWORK, ASSET, LOG) from the bundled template files at
-     * `src/workspace_template/`. Idempotent: existing records are left
-     * untouched. The ACCOUNTS namespace is left empty — per-account records
-     * are created lazily by `accounts.create(...)`.
-     *
-     * Subclasses inherit this default; override only if a backend needs
-     * non-record initialization (e.g. allocating a database schema).
-     */
+    /** Initialize an empty container by writing the four root records (CONFIG, NETWORK, ASSET, LOG) from the bundled templat... */
     initialize(): Promise<void>;
-    /** Any storage at all under the accounts area, however named. Defaults to
-     *  "nothing", so a provider that does not implement it can only fail to add a
-     *  refusal reason — never cause one. */
+    /** Any storage at all under the accounts area, however named. */
     protected _hasRawAccountData(): Promise<boolean>;
     abstract close(): Promise<void>;
 }
@@ -622,7 +585,8 @@ declare class Account {
         after: number;
         dropped: number;
     }>;
-    importPrivateKey(pk: string, vm: ChainVM): Promise<Wallet>;
+    
+    importPrivateKey(pk: string, vm?: ChainVM): Promise<Wallet>;
     drop(): Promise<void>;
     
     filterAddress(network: NetworkLike, addr?: string): Address | null;

package/examples/01-quick-start.test.cjs

@@ -1,5 +1,4 @@
-// 01 — Quick start. Open a workspace, create an HD account, derive wallets,
-// lock down. The shortest end-to-end demo.
+// 01 — Quick start: open a workspace, create an HD account, derive wallets, lock.
 
 const test = require("node:test");
 const assert = require("node:assert");

package/examples/02-hd-account.test.cjs

@@ -1,5 +1,4 @@
-// 02 — HD account flows. derive / slice wallets, dump mnemonic, reset password,
-// reopen a locked workspace.
+// 02 — HD accounts: derive/slice wallets, dump mnemonic, reset password, reopen.
 
 const test = require("node:test");
 const assert = require("node:assert");

package/examples/03-pk-account.test.cjs

@@ -1,4 +1,4 @@
-// 03 — PK account flows. Heterogeneous private keys, one wallet per import.
+// 03 — PK accounts: vm inferred from the key, and one import yielding both chains.
 
 const test = require("node:test");
 const assert = require("node:assert");
@@ -10,6 +10,13 @@ const { Workspace } = require("wative-core");
 
 const EVM_PK = "0x4f3edf983ac636a65a842ce7c78d9aa706d3b113bce9c46f30d7d21715b23b1d";
 const SVM_PK = "xtGWcHvQsr5ue8zG2F5fm31bW8vyn597Y92gUWaZZg3S1Z6FeJMATL8KU3xJMGbLfALnokcct9y5wYtCRrwNXZW";
+const SVM_PK_2 = "gaiC7Rnf9J6tV3SGwJyzvMDdz9RMmreSWZDyDK682MUKZHaWdZbbqgf35qD7FSwXka2Rf2o4MuhbWQTg82W9mbV";
+const SVM_KEYGEN_BYTES = [
+  51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51,
+  51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51, 51,
+  23, 203, 121, 251, 43, 65, 32, 242, 177, 236, 101, 228, 25, 141, 110, 8,
+  178, 142, 129, 63, 235, 1, 228, 164, 0, 131, 155, 133, 225, 128, 128, 206,
+];
 
 test("PK account — create from EVM key + import a Solana key", async () => {
   const root = mkdtempSync(join(tmpdir(), "wative-pk-"));
@@ -25,10 +32,41 @@ test("PK account — create from EVM key + import a Solana key", async () => {
   assert.strictEqual(acc.organizationType, "PK");
   assert.strictEqual(acc.wallets.length, 1);
   assert.strictEqual(acc.wallets[0].addresses[0].vm, "evm");
+  assert.strictEqual(acc.wallets[0].addresses[1].vm, "svm");
 
   await acc.importPrivateKey(SVM_PK, "svm");
   assert.strictEqual(acc.wallets.length, 2);
   assert.strictEqual(acc.wallets[1].addresses[0].vm, "svm");
+  assert.strictEqual(acc.wallets[1].addresses[1].vm, "evm");
+
+  await ws.lock();
+});
+
+test("PK account — the key formats importPrivateKey accepts", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-pk-fmt-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+  const acc = await ws.accounts.create("Formats", "wsp-pwd", EVM_PK, undefined, { kind: "PK" });
+
+  const evm = await acc.importPrivateKey(
+    "0x6cbed15c793ce57650b9877cf6fa156fbef513c4e6134f022a85b1ffdd59b2a1",
+  );
+  assert.strictEqual(evm.addresses[0].vm, "evm");
+
+  const svm = await acc.importPrivateKey(SVM_PK_2);
+  assert.strictEqual(svm.addresses[0].vm, "svm");
+
+  const fromKeygen = await acc.importPrivateKey(JSON.stringify(SVM_KEYGEN_BYTES));
+  assert.strictEqual(fromKeygen.addresses[0].vm, "svm");
+
+  await assert.rejects(
+    acc.importPrivateKey("definitely-not-a-key"),
+    (err) => err.code === "INVALID_PRIVATE_KEY",
+  );
+
+  await assert.rejects(
+    acc.importPrivateKey("0x" + "0".repeat(64), "evm"),
+    (err) => err.code === "INVALID_PRIVATE_KEY",
+  );
 
   await ws.lock();
 });

package/examples/04-network-management.test.cjs

@@ -1,5 +1,4 @@
-// 04 — Network management. Pre-loaded networks, add custom networks,
-// override an existing network's RPC URL, drop user networks.
+// 04 — Networks: the pre-loaded set, adding, overriding an RPC URL, dropping.
 
 const test = require("node:test");
 const assert = require("node:assert");

package/examples/05-asset-management.test.cjs

@@ -1,5 +1,4 @@
-// 05 — Asset management. Pre-loaded tokens, add custom tokens,
-// drop user tokens, search via filter.
+// 05 — Assets: the pre-loaded tokens, adding, dropping, and searching via filter.
 
 const test = require("node:test");
 const assert = require("node:assert");

package/examples/06-address-signing.test.cjs

@@ -1,5 +1,4 @@
-// 06 — Address signing. Sign personal messages and build transactions
-// fully offline.
+// 06 — Address signing: personal messages and transaction building, fully offline.
 
 const test = require("node:test");
 const assert = require("node:assert");

package/examples/07-custom-provider.test.cjs

@@ -1,17 +1,11 @@
-// 07 — Custom storage backend. Extend the abstract `Provider` class to plug
-// `Workspace.open()` into any storage system. This example uses an in-memory
-// key-value store with a trivial XOR cipher; real custom Providers should use
-// an authenticated cipher (AES-GCM, ChaCha20-Poly1305).
+// 07 — Custom backend: extend Provider itself; the XOR cipher here is illustrative only.
 
 const test = require("node:test");
 const assert = require("node:assert");
 
 const { Workspace, Provider, Record, WativeError } = require("wative-core");
 
-/**
- * In-memory `Provider` implementation. Stores records in a Map under
- * filesystem-style paths, encrypted with a single-byte-header XOR scheme.
- */
+/** In-memory Provider: records in a Map under path-like keys, XOR-"encrypted". */
 class InMemoryProvider extends Provider {
   #store = new Map();
   #dirs = new Set();

package/examples/08-persistence.test.cjs

@@ -1,5 +1,4 @@
-// 08 — Persistence. Verify that accounts, networks, custom assets, and the
-// logger configuration all round-trip correctly across `lock()` + reopen.
+// 08 — Persistence: accounts, networks, assets and logger config across lock/reopen.
 
 const test = require("node:test");
 const assert = require("node:assert");

package/examples/09-workspace-filter.test.cjs

@@ -1,5 +1,4 @@
-// 09 — Workspace search. `filter(query, objective)` returns the live object
-// matching `query` for the given objective: Wallet, Address, Account, or Asset.
+// 09 — Search: filter(query, objective) over Wallet, Address, Account and Asset.
 
 const test = require("node:test");
 const assert = require("node:assert");

package/examples/10-default-network.test.cjs

@@ -1,6 +1,4 @@
-// 10 — Account default network. `account.setDefaultNetwork(value)` accepts
-// a slug, a chain id, a hex chain id, or a Network instance — and the choice
-// persists across reopen.
+// 10 — setDefaultNetwork accepts a slug, chain id, hex chain id or Network, and persists.
 
 const test = require("node:test");
 const assert = require("node:assert");

package/examples/11-subpath-imports.test.cjs

@@ -1,13 +1,9 @@
-// 11 — Subpath imports. Heavier chain helpers ship under `wative-core/artifacts/evm`
-// and `wative-core/artifacts/svm` so they're only pulled in when used. In your
-// own project: require("wative-core/artifacts/evm") / require("wative-core/artifacts/svm").
+// 11 — Subpath imports: the heavier chain helpers under wative-core/artifacts/{evm,svm}.
 
 const test = require("node:test");
 const assert = require("node:assert");
 
-// Imported by SUBPATH, which is the whole point of this example — and what a
-// consumer writes. A relative path into dist/ would resolve here but nowhere
-// else, so it would pass in-repo while failing for every real installation.
+// By SUBPATH, as a consumer writes it — a relative dist/ path would pass only in-repo.
 const evmArtifacts = require("wative-core/artifacts/evm");
 const svmArtifacts = require("wative-core/artifacts/svm");
 

package/examples/12-logger.test.cjs

@@ -1,6 +1,4 @@
-// 12 — Logger. Workspace exposes `ws.logger` after unlock. Write structured
-// logs at any level, change the level via `ws.logger.setLevel(...)`, and the
-// configuration persists across reopen.
+// 12 — Logger: ws.logger after unlock, six levels, setLevel, and config persistence.
 
 const test = require("node:test");
 const assert = require("node:assert");

package/examples/13-workspace-config.test.cjs

@@ -1,5 +1,4 @@
-// 13 — Workspace config public API. Consumers should never need Provider
-// record access to update business-wide settings.
+// 13 — Workspace config: business-wide settings without reaching for the Provider.
 
 const test = require("node:test");
 const assert = require("node:assert");
@@ -25,9 +24,6 @@ test("workspace config — setBusinessTimezone/getConfig work from release dist"
     && !err.message.includes("Not/AZone")
   ));
 
-  // `config` hands back a frozen snapshot, not the live object. Assigning to it
-  // does not change the workspace — read config through `config` / `getConfig()`
-  // and change it through the setters.
   const snapshot = ws.config;
   assert.strictEqual(Object.isFrozen(snapshot), true);
   snapshot.settlementWindow = "ny-close";

package/examples/14-esm-runtime.test.mjs

@@ -8,12 +8,6 @@ import { fileURLToPath } from "node:url";
 const here = path.dirname(fileURLToPath(import.meta.url));
 
 async function importDist() {
-  // Import by PACKAGE SPECIFIER, not by file path. The root entry is
-  // condition-split: a raw path to dist/index.js bypasses the exports map and
-  // lands on the browser build, which deliberately has no filesystem backend.
-  // "wative-core" resolves through the node condition, which is what an ESM
-  // consumer actually gets — and still loads real ESM, so this keeps testing
-  // that the dist needs no CJS require shims.
   return import("wative-core");
 }
 
@@ -58,9 +52,6 @@ test("ESM dist consumer signs EVM transactions without global require shims", as
 });
 
 test("ESM dist consumer signs SVM transactions without global require shims", async () => {
-  // Regression: the SVM signing path used require() for @solana/web3.js, bs58
-  // and tweetnacl, which throws "Dynamic require ... is not supported" under
-  // native ESM. These are now static imports like web3 on the EVM side.
   const { Workspace } = await importDist();
   assert.equal(globalThis.require, undefined);
   const root = await mkdtemp(path.join(tmpdir(), "wative-core-esm-svm-sign-"));

package/examples/15-package-resolution.test.cjs

@@ -1,20 +1,9 @@
-// 15 — Package resolution. Every example now resolves the package by its bare
-// name, so they all exercise the `exports` map; this file is the one that tests
-// the map ITSELF rather than using it incidentally — every declared subpath,
-// under both conditions. It therefore covers the export conditions (`import` vs
-// `require`), the declared subpaths, and the parity between the two builds.
-//
-// It works without installing anything because Node resolves a package's own
-// name from inside that package ("self-reference"), which requires `name` and
-// `exports` to be present — so a broken exports map fails this file outright.
+// 15 — The exports map itself: every subpath, both conditions, and build parity.
 
 const test = require("node:test");
 const assert = require("node:assert");
 
-// "wative-core/node" is where HybridProviderV3 lives after the breaking
-// refactor that folded NodeHybridProvider into it. It was missing here, so the
-// subpath carrying the release's headline feature was the one subpath nothing
-// resolved.
+// "wative-core/node" carries HybridProviderV3 and was once missing from this list.
 const SUBPATHS = [
   "wative-core",
   "wative-core/node",
@@ -34,37 +23,7 @@ test("every declared subpath resolves by bare name under require(), to the CJS b
   }
 });
 
-// A type used in a public signature but not exported is invisible to a
-// TypeScript consumer, who then cannot name what the method returns. That is not
-// visible from JavaScript, so it is asserted against the emitted declarations.
-//
-// Two things this used to get wrong, both of which let a real regression ship:
-//
-//   1. It opened ONLY `dist/index.node.d.cts` — the node+require artifact. The
-//      root subpath emits THREE declaration files (browser/default, node+import,
-//      node+require), and `ContainerState` is the return type of the universal
-//      `Provider.inspectContainer()`. Deleting its export from the browser
-//      artifact alone left this green while every bundler consumer got TS2305.
-//      The artifact list is now derived from the `exports` map itself, so a new
-//      subpath or condition is covered the day it is added rather than the day
-//      someone remembers.
-//
-//   2. It asserted `\bName\b` — bare presence anywhere in the file. A name also
-//      appears in an import specifier, in another type's signature, or in a
-//      comment, so the assertion held whether or not the name was EXPORTED. It
-//      now parses the export clauses and checks membership in the exported set.
-// Keyed by ARTIFACT, not by subpath: the browser and node root builds export
-// legitimately different sets (the node one adds the filesystem provider), so a
-// per-subpath map cannot express "required here, absent there" and would either
-// under-check the node build or falsely fail the browser one.
-//
-// ⚠️ This list is HAND-MAINTAINED, and that is the remaining weakness. The
-// checks below make the ORACLE strong — every declared artifact, and exported
-// rather than merely mentioned — but the INPUT is still a list someone has to
-// remember to extend. `OpenOptions` and `PasswordCheckContext` were both TS2305
-// in a shipped release precisely because nothing derived this list from the
-// public signatures. Deriving it (a referenced-but-not-exported set difference
-// over the emitted declarations) is the real fix and is not done here.
+// Keyed by ARTIFACT, since the browser and node root builds export different sets.
 const EXPECTED_EXPORTS = {
   "./dist/index.d.ts": ["ContainerState", "Argon2BackendInfo", "OpenOptions", "PasswordCheckContext"],
   "./dist/index.node.d.ts": [
@@ -72,9 +31,6 @@ const EXPECTED_EXPORTS = {
     "Argon2BackendInfo",
     "OpenOptions",
     "PasswordCheckContext",
-    // The node root re-exports the filesystem provider surface. `exports.test.ts`
-    // pins this as a deliberate contract, and `18-envelope-v3.test.cjs` reaches
-    // `HybridProviderV3` through the ROOT specifier, not the ./node subpath.
     "HybridProviderV3",
     "HybridProvider",
     "FileSink",
@@ -94,27 +50,11 @@ const EXPECTED_EXPORTS = {
   "./dist/node/index.d.cts": ["HybridProviderV3", "HybridProvider", "FileSink", "FileSinkOptions"],
 };
 
-// The `exports` map declares 10 `types` entries across 9 distinct files
-// (`./dist/index.d.ts` is reached by both the `browser` and `default`
-// conditions). Both totals are asserted EXACTLY rather than as floors: a floor
-// tolerates a gap, so deleting `exports["./node"].require.types` would drop the
-// CJS declarations for the subpath carrying the headline feature and still pass.
-// 32 = 4 (index.d.ts, counted twice — browser and default both resolve to it)
-//    + 8 + 8 (the two node root artifacts) + 4 + 4 (the ./node subpath pair).
-// The artifacts/{evm,svm} pairs contribute none; they are checked for existence
-// and non-emptiness only.
+// Both totals are EXACT, not floors: a floor tolerates the gap this exists to catch.
 const EXPECTED_ARTIFACTS = 10;
 const EXPECTED_ASSERTIONS = 32;
 
-// tsup re-exports rather than re-declares: `export { k as ContainerState } from
-// './chunk.cjs'`. The public name is what follows `as`, or the whole entry when
-// there is no alias. Direct `export declare class X` forms are collected too.
-//
-// Two shapes the two builds do NOT agree on, both of which must be handled or
-// the check reports a false regression: the browser artifact writes inline type
-// modifiers (`type Argon2BackendInfo`) where the node artifact writes the bare
-// name, and a name colliding with a lib type is emitted aliased (`Record$1 as
-// Record`). Strip the modifier first, then resolve the alias.
+// tsup re-exports rather than re-declares, so strip any inline modifier then the alias.
 function exportedNames(dts) {
   const names = new Set();
   for (const m of dts.matchAll(/export\s*(?:type\s*)?\{([^}]*)\}/g)) {
@@ -153,20 +93,10 @@ function declaredTypeArtifacts(exportsMap) {
 test("every type named by a public signature is exported from every artifact that declares it", () => {
   const fs = require("node:fs");
   const path = require("node:path");
-  // Resolve the package under test by NAME, not by `__dirname/..`. This file
-  // runs in two layouts: in the release checkout (examples/ beside dist/, where
-  // `..` is the package root) and copied FLAT into a scratch consumer dir that
-  // installed the tarball (where `..` is the scratch dir's parent and holds no
-  // package.json at all). The second layout is what CI's "published" job uses,
-  // and `__dirname/..` made this test throw ENOENT there — so that job has
-  // never been able to pass. The exports map declares "./package.json", so this
-  // resolves in both.
   const root = path.dirname(require.resolve("wative-core/package.json"));
   const pkg = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
   const artifacts = declaredTypeArtifacts(pkg.exports);
 
-  // If the exports map stops declaring types, this test would otherwise pass by
-  // checking nothing at all — the same vacuity it exists to prevent.
   assert.strictEqual(
     artifacts.length,
     EXPECTED_ARTIFACTS,
@@ -175,11 +105,6 @@ test("every type named by a public signature is exported from every artifact tha
       `or a subpath was added and needs an entry in EXPECTED_EXPORTS.`,
   );
 
-  // Counting `types` entries alone cannot see a subpath that declares NONE: the
-  // total is unchanged, so the exact-count assertion above passes while the new
-  // subpath ships with no declarations at all and its consumers get "could not
-  // find a declaration file". Every subpath with conditions must produce at
-  // least one.
   for (const [subpath, node] of Object.entries(pkg.exports)) {
     if (typeof node === "string") continue; // "./package.json" — a file, not a type surface
     assert.ok(
@@ -202,8 +127,6 @@ test("every type named by a public signature is exported from every artifact tha
       checked++;
     }
   }
-  // Exact, for the same reason as the artifact count: a floor here would let a
-  // whole artifact's expectations be deleted without the suite noticing.
   assert.strictEqual(
     checked,
     EXPECTED_ASSERTIONS,
@@ -234,7 +157,6 @@ test("the CJS and ESM builds expose an identical export surface", async () => {
   const esm = await import("wative-core");
 
   const cjsKeys = Object.keys(cjs).sort();
-  // The ESM namespace carries a `default` interop key that the CJS object does not.
   const esmKeys = Object.keys(esm).filter((k) => k !== "default").sort();
 
   assert.deepStrictEqual(

package/examples/16-known-answer-vectors.test.cjs

@@ -1,13 +1,4 @@
-// 16 — Known-answer vectors. The other examples check that operations succeed
-// and that results look plausible ("is a string", "starts with 0x"). That kind
-// of assertion still passes if a key is derived from the wrong path, or if a
-// signature is produced by the wrong key — the two failures most likely to lose
-// someone's funds.
-//
-// This file pins exact expected values instead. Every EVM value below was taken
-// from the published BIP-39 / BIP-44 test vectors for the canonical "abandon …
-// about" mnemonic, not from this library's own output, so the assertions are
-// independent ground truth rather than a recording of current behaviour.
+// 16 — Known-answer vectors: exact published BIP-44 values, not "looks plausible".
 
 const test = require("node:test");
 const assert = require("node:assert");
@@ -21,27 +12,21 @@ const { Workspace } = require("wative-core");
 const MNEMONIC =
   "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";
 
-// m/44'/60'/0'/0/{0,1,2} for the mnemonic above. These are the standard vectors
-// reproduced by every BIP-44 implementation; a mismatch means the derivation
-// path or the seed derivation changed.
+// m/44'/60'/0'/0/{0,1,2}: standard vectors; a mismatch means the derivation moved.
 const EVM_ADDRESSES = [
   "0x9858EfFD232B4033E47d90003D41EC34EcaEda94",
   "0x6Fac4D18c912343BF86fa7049364Dd4E424Ab9C0",
   "0xb6716976A3ebe8D39aCEB04372f22Ff8e6802D7A",
 ];
 
-// Solana derivation for the same mnemonic. Pinned as a regression vector: these
-// are this library's values, so they guard against silent drift in the SVM
-// derivation path rather than asserting an external standard.
+// Solana, same mnemonic — this library's own values, pinned against silent drift.
 const SVM_ADDRESSES = [
   "HAgk14JpMQLgt6rVgv7cBQFJWFto5Dqxi472uT3DKpqk",
   "Hh8QwFUA6MtVu1qAoq12ucvFHNwCcVTV7hpWjeY1Hztb",
   "7WktogJEd2wQ9eH2oWusmcoFTgeYi6rS632UviTBJ2jm",
 ];
 
-// EIP-191 personal_sign of "hello" by the first EVM address. ECDSA here is
-// deterministic (RFC 6979), so the signature is a fixed value, and it verifies
-// externally as recovering to EVM_ADDRESSES[0].
+// EIP-191 "hello" by the first address; RFC 6979 makes it a fixed value.
 const EVM_SIGNATURE_HELLO =
   "0x22f6b9cd7ff4f321e11181c4fe64adeea9469908fb514fbb6001fe022002dfda" +
   "1f4ec9ea436bad14a7823806487d3aeb39b22e2556590922d6a8308971a17e991c";
@@ -130,11 +115,8 @@ test("signatures are bound to the message and to the signing key", async () => {
   const first = addressFor(acc.wallets[0], "evm");
   const second = addressFor(acc.wallets[1], "evm");
 
-  // A different message under the same key must not reuse the signature.
   assert.notStrictEqual(first.signMessage("hello!"), EVM_SIGNATURE_HELLO);
-  // The same message under a different key must not either.
   assert.notStrictEqual(second.signMessage("hello"), EVM_SIGNATURE_HELLO);
-  // And signing is repeatable for a given key and message.
   assert.strictEqual(first.signMessage("hello"), EVM_SIGNATURE_HELLO);
 
   await ws.lock();