zeldwallet 0.1.0

package/dist/src/keys/derivation.d.ts

@@ -0,0 +1,58 @@
+import { AddressType, AddressPurpose, NetworkType } from '../types';
+/** Derivation path templates for different address types */
+export declare const DERIVATION_PATHS: {
+    /** BIP44 - Legacy P2PKH (m/44'/0'/account'/change/index) */
+    readonly legacy: "m/44'/0'/0'";
+    /** BIP49 - Nested SegWit P2SH-P2WPKH (m/49'/0'/account'/change/index) */
+    readonly nestedSegwit: "m/49'/0'/0'";
+    /** BIP84 - Native SegWit P2WPKH (m/84'/0'/account'/change/index) */
+    readonly nativeSegwit: "m/84'/0'/0'";
+    /** BIP86 - Taproot P2TR (m/86'/0'/account'/change/index) */
+    readonly taproot: "m/86'/0'/0'";
+};
+/** Testnet derivation paths (coin type 1) */
+export declare const TESTNET_DERIVATION_PATHS: {
+    readonly legacy: "m/44'/1'/0'";
+    readonly nestedSegwit: "m/49'/1'/0'";
+    readonly nativeSegwit: "m/84'/1'/0'";
+    readonly taproot: "m/86'/1'/0'";
+};
+export type DerivationPathType = keyof typeof DERIVATION_PATHS;
+/** Type for derivation path maps */
+export type DerivationPathMap = {
+    readonly legacy: string;
+    readonly nestedSegwit: string;
+    readonly nativeSegwit: string;
+    readonly taproot: string;
+};
+/**
+ * Get derivation paths for the specified network
+ */
+export declare function getDerivationPaths(network: NetworkType): DerivationPathMap;
+/**
+ * Map address type to derivation path type
+ */
+export declare function addressTypeToPathType(addressType: AddressType): DerivationPathType;
+/**
+ * Map derivation path type to address type
+ */
+export declare function pathTypeToAddressType(pathType: DerivationPathType): AddressType;
+/**
+ * Get the address type to use for a given purpose
+ */
+export declare function purposeToAddressType(purpose: AddressPurpose): AddressType;
+/**
+ * Build a full derivation path
+ */
+export declare function buildDerivationPath(pathType: DerivationPathType, network: NetworkType, account?: number, change?: 0 | 1, index?: number): string;
+/**
+ * Parse a derivation path string
+ */
+export declare function parseDerivationPath(path: string): {
+    purpose: number;
+    coinType: number;
+    account: number;
+    change: number;
+    index: number;
+} | null;
+//# sourceMappingURL=derivation.d.ts.map

package/dist/src/keys/derivation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derivation.d.ts","sourceRoot":"","sources":["../../../src/keys/derivation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEzE,4DAA4D;AAC5D,eAAO,MAAM,gBAAgB;IAC3B,4DAA4D;;IAE5D,yEAAyE;;IAEzE,oEAAoE;;IAEpE,4DAA4D;;CAEpD,CAAC;AAEX,6CAA6C;AAC7C,eAAO,MAAM,wBAAwB;;;;;CAK3B,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,MAAM,OAAO,gBAAgB,CAAC;AAE/D,oCAAoC;AACpC,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,iBAAiB,CAE1E;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,WAAW,GAAG,kBAAkB,CAWlF;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,WAAW,CAW/E;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,WAAW,CAYzE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,MAAU,EACnB,MAAM,GAAE,CAAC,GAAG,CAAK,EACjB,KAAK,GAAE,MAAU,GAChB,MAAM,CAQR;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,IAAI,CAaP"}

package/dist/src/keys/signing.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Signing Utilities
+ *
+ * Message and transaction signing functions.
+ */
+import * as bitcoin from 'bitcoinjs-lib';
+type SchnorrLike = {
+    sign: (msg: Uint8Array, priv: Uint8Array) => Promise<Uint8Array> | Uint8Array;
+};
+/**
+ * Create the message hash for Bitcoin message signing
+ */
+export declare function createMessageHash(message: string): Uint8Array;
+/**
+ * Sign a message with ECDSA and return a recoverable signature
+ * @param messageHash - The hash of the message to sign
+ * @param privateKey - The private key to sign with
+ * @returns Base64-encoded signature
+ */
+export declare function signMessageEcdsa(messageHash: Uint8Array, privateKey: Uint8Array): Promise<string>;
+/**
+ * Verify an ECDSA signature
+ */
+export declare function verifyMessageEcdsa(messageHash: Uint8Array, signature: Uint8Array, publicKey: Uint8Array): Promise<boolean>;
+/**
+ * Sign a message using a BIP-322-style hash (simple mode)
+ * Uses Schnorr for Taproot-friendly signatures (still a simplified flow).
+ */
+export declare function signMessageBip322Simple(message: string, address: string, network: bitcoin.Network, privateKey: Uint8Array, xOnlyPublicKey: Uint8Array, schnorrImpl?: SchnorrLike): Promise<string>;
+/**
+ * Tweak a private key for Taproot (BIP340)
+ * Used for Taproot key path spending
+ */
+export declare function tweakPrivateKey(privateKey: Uint8Array, merkleRoot?: Uint8Array): Uint8Array;
+/**
+ * Get the public key for a private key
+ */
+export declare function getPublicKey(privateKey: Uint8Array, compressed?: boolean): Uint8Array;
+/**
+ * Get the x-only public key (for Taproot)
+ */
+export declare function getXOnlyPublicKey(privateKey: Uint8Array): Uint8Array;
+export {};
+//# sourceMappingURL=signing.d.ts.map

package/dist/src/keys/signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../../src/keys/signing.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,OAAO,MAAM,eAAe,CAAC;AAGzC,KAAK,WAAW,GAAG;IACjB,IAAI,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC;CAC/E,CAAC;AAKF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAa7D;AA0BD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,UAAU,EACvB,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAajB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,UAAU,EACvB,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,OAAO,CAAC,CAIlB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,CAAC,OAAO,EACxB,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,UAAU,EAC1B,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC,CAyDjB;AAcD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,UAAU,GAAG,UAAU,CAiB3F;AAoCD;;GAEG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,GAAE,OAAc,GAAG,UAAU,CAE3F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CAIpE"}

package/dist/src/provider/WBIPProvider.d.ts

@@ -0,0 +1,74 @@
+import { AddressInfo, AddressPurpose, EventHandler, NetworkType, SignInputOptions, WBIPProviderOptions, WalletEvent, ConfirmationType } from '../types';
+export type ConfirmationHandler = (type: ConfirmationType, payload?: unknown) => Promise<boolean>;
+/**
+ * Minimal interface the provider needs from the wallet to avoid circular deps.
+ */
+interface WalletAdapter {
+    isUnlocked(): boolean;
+    getAddresses(purposes: AddressPurpose[]): AddressInfo[];
+    getNetwork(): NetworkType;
+    signMessage(message: string, address: string, protocol?: 'ecdsa' | 'bip322-simple'): Promise<string>;
+    signPsbt(psbtBase64: string, inputsToSign: SignInputOptions[]): Promise<string>;
+    on(event: WalletEvent, handler: EventHandler): void;
+    off(event: WalletEvent, handler: EventHandler): void;
+}
+/**
+ * WBIP Provider implementation (Phase 2)
+ */
+export declare class WBIPProvider {
+    private wallet;
+    private confirm?;
+    private lastProviderId;
+    private accessGrants;
+    private currentOptions?;
+    constructor(wallet: WalletAdapter, confirm?: ConfirmationHandler | undefined);
+    /**
+     * Update the confirmation handler used for sensitive requests.
+     */
+    setConfirmationHandler(confirm?: ConfirmationHandler): void;
+    /**
+     * Register the provider on the global window object so dApps can discover it.
+     */
+    register(options: WBIPProviderOptions): void;
+    /**
+     * Unregister the provider and clean up globals.
+     */
+    unregister(id?: string): void;
+    /**
+     * Handle WBIP request entry point.
+     */
+    request(method: string, params?: unknown): Promise<unknown>;
+    private handleGetAddresses;
+    private handleSignMessage;
+    private handleSignPsbt;
+    private handleGetInfo;
+    private buildNetworkPayload;
+    private ensureUnlocked;
+    private getOrigin;
+    private showConfirmation;
+    private buildConfirmationSummary;
+    /**
+     * Provide a concise PSBT summary for the confirm dialog.
+     * Avoids deep decoding to keep execution fast and safe.
+     */
+    private summarizeSignPsbt;
+    /**
+     * Normalize unexpected errors into WBIP-compatible internal errors.
+     */
+    private formatInternalError;
+    private isWBIPError;
+    /**
+     * Lightweight taproot detector: bech32m v1 with 32-byte data.
+     */
+    private isTaprootAddress;
+    /**
+     * Map common user-driven errors to INVALID_PARAMS for clearer feedback.
+     */
+    private mapUserError;
+    /**
+     * Reset transient access grants (used when wallet locks or unregisters).
+     */
+    resetAccess(): void;
+}
+export {};
+//# sourceMappingURL=WBIPProvider.d.ts.map

package/dist/src/provider/WBIPProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WBIPProvider.d.ts","sourceRoot":"","sources":["../../../src/provider/WBIPProvider.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,YAAY,EAGZ,WAAW,EACX,gBAAgB,EAKhB,mBAAmB,EACnB,WAAW,EAEX,gBAAgB,EACjB,MAAM,UAAU,CAAC;AAElB,MAAM,MAAM,mBAAmB,GAAG,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAMlG;;GAEG;AACH,UAAU,aAAa;IACrB,UAAU,IAAI,OAAO,CAAC;IACtB,YAAY,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,WAAW,EAAE,CAAC;IACxD,UAAU,IAAI,WAAW,CAAC;IAC1B,WAAW,CACT,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,OAAO,GAAG,eAAe,GACnC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChF,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IACpD,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;CACtD;AAED;;GAEG;AACH,qBAAa,YAAY;IAKX,OAAO,CAAC,MAAM;IAAiB,OAAO,CAAC,OAAO,CAAC;IAJ3D,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,YAAY,CAAkC;IACtD,OAAO,CAAC,cAAc,CAAC,CAAsB;gBAEzB,MAAM,EAAE,aAAa,EAAU,OAAO,CAAC,EAAE,mBAAmB,YAAA;IAEhF;;OAEG;IACH,sBAAsB,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,IAAI;IAI3D;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI;IA2C5C;;OAEG;IACH,UAAU,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI;IAuB7B;;OAEG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YA0CnD,kBAAkB;YA6DlB,iBAAiB;YAuCjB,cAAc;IAkF5B,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,SAAS;YAOH,gBAAgB;IAoB9B,OAAO,CAAC,wBAAwB;IAuBhC;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAsCzB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,WAAW;IAWnB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IASxB;;OAEG;IACH,OAAO,CAAC,YAAY;IAsBpB;;OAEG;IACH,WAAW,IAAI,IAAI;CAGpB"}

package/dist/src/react/ZeldWalletCard.d.ts

@@ -0,0 +1,29 @@
+import { DetailedHTMLProps, HTMLAttributes } from 'react';
+import { UseZeldWalletControllerArgs } from './useZeldWalletController';
+declare global {
+    namespace JSX {
+        interface IntrinsicElements {
+            'zeld-wallet-ui': DetailedHTMLProps<HTMLAttributes<HTMLElement>, HTMLElement>;
+        }
+    }
+}
+export type ZeldWalletCardProps = UseZeldWalletControllerArgs & {
+    className?: string;
+    variant?: 'light' | 'dark';
+    /**
+     * Optionally override the tag name when defining the custom element.
+     */
+    tagName?: string;
+};
+export type ZeldWalletCardRef = {
+    connect: (password?: string) => Promise<void>;
+};
+export declare const ZeldWalletCard: import('react').ForwardRefExoticComponent<UseZeldWalletControllerArgs & {
+    className?: string;
+    variant?: "light" | "dark";
+    /**
+     * Optionally override the tag name when defining the custom element.
+     */
+    tagName?: string;
+} & import('react').RefAttributes<ZeldWalletCardRef>>;
+//# sourceMappingURL=ZeldWalletCard.d.ts.map

package/dist/src/react/ZeldWalletCard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZeldWalletCard.d.ts","sourceRoot":"","sources":["../../../src/react/ZeldWalletCard.tsx"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,iBAAiB,EACtB,KAAK,cAAc,EAEpB,MAAM,OAAO,CAAC;AAEf,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAE7E,OAAO,CAAC,MAAM,CAAC;IAGb,UAAU,GAAG,CAAC;QACZ,UAAU,iBAAiB;YACzB,gBAAgB,EAAE,iBAAiB,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;SAC/E;KACF;CACF;AAED,MAAM,MAAM,mBAAmB,GAAG,2BAA2B,GAAG;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C,CAAC;AAEF,eAAO,MAAM,cAAc;gBAZb,MAAM;cACR,OAAO,GAAG,MAAM;IAC1B;;OAEG;cACO,MAAM;qDAwDhB,CAAC"}

package/dist/src/react/index.d.ts

@@ -0,0 +1,3 @@
+export { ZeldWalletCard, type ZeldWalletCardRef, type ZeldWalletCardProps } from './ZeldWalletCard';
+export { useZeldWalletController, type UseZeldWalletControllerArgs, type UseZeldWalletControllerResult, } from './useZeldWalletController';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/react/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/react/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,KAAK,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACpG,OAAO,EACL,uBAAuB,EACvB,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,GACnC,MAAM,2BAA2B,CAAC"}

package/dist/src/react/useZeldWalletController.d.ts

@@ -0,0 +1,28 @@
+import { NetworkType } from '../types';
+import { LocaleKey, LocaleStrings } from '../component/i18n';
+import { ComponentState } from '../component/state';
+export type UseZeldWalletControllerArgs = {
+    lang?: string;
+    network?: NetworkType;
+    autoconnect?: boolean;
+};
+export type UseZeldWalletControllerResult = {
+    state: ComponentState;
+    locale: LocaleKey;
+    strings: LocaleStrings;
+    network: NetworkType;
+    showPasswordWarning: boolean;
+    showBackupWarning: boolean;
+    readyWithSecurity: boolean;
+    connect: (password?: string) => Promise<void>;
+    setLocale: (lang?: string) => void;
+    showSetPasswordForm: () => void;
+    hideSetPasswordForm: () => void;
+    showBackupForm: () => void;
+    hideBackupForm: () => void;
+    clearBackupResult: () => void;
+    handleSetPassword: (password: string, confirmPassword: string) => Promise<void>;
+    handleExportBackup: (walletPassword: string) => Promise<void>;
+};
+export declare function useZeldWalletController({ lang, network, autoconnect, }: UseZeldWalletControllerArgs): UseZeldWalletControllerResult;
+//# sourceMappingURL=useZeldWalletController.d.ts.map

package/dist/src/react/useZeldWalletController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useZeldWalletController.d.ts","sourceRoot":"","sources":["../../../src/react/useZeldWalletController.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,EAAE,WAAW,CAAC;IACrB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,mBAAmB,EAAE,MAAM,IAAI,CAAC;IAChC,mBAAmB,EAAE,MAAM,IAAI,CAAC;IAChC,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,iBAAiB,EAAE,MAAM,IAAI,CAAC;IAC9B,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF,kBAAkB,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,EACtC,IAAW,EACX,OAAmB,EACnB,WAAkB,GACnB,EAAE,2BAA2B,GAAG,6BAA6B,CAsD7D"}

package/dist/src/storage/SecureStorage.d.ts

@@ -0,0 +1,183 @@
+/**
+ * SecureStorage
+ *
+ * Handles encrypted storage of sensitive data using IndexedDB and Web Crypto API.
+ * Supports both password-protected mode and passwordless mode.
+ */
+/**
+ * SecureStorage class for encrypted data persistence
+ */
+export declare class SecureStorage {
+    private db;
+    private encryptionKey;
+    private isPasswordProtected;
+    private pbkdf2Iterations?;
+    constructor(options?: {
+        pbkdf2Iterations?: number;
+    });
+    /**
+     * Resolve a PBKDF2 iteration override from environment variables.
+     * Useful to speed up CI/tests without weakening the default shipped cost.
+     */
+    private getEnvIterationOverride;
+    /**
+     * Resolve the PBKDF2 iteration count in priority order:
+     * 1) explicit override passed to constructor (per-session opt-in)
+     * 2) persisted metadata from prior setup
+     * 3) environment override (e.g., test)
+     * 4) default from PBKDF2_CONFIG
+     */
+    private resolveIterations;
+    /**
+     * When issuing a new password-derived key, enforce a sensible floor if metadata already exists.
+     * This avoids permanently low KDF costs that were set in test/dev environments.
+     */
+    private normalizeIterationsForNewKey;
+    /**
+     * Initialize the secure storage
+     * @param password - Optional password for encryption. If not provided, uses stored key.
+     */
+    init(password?: string, options?: {
+        readOnly?: boolean;
+    }): Promise<void>;
+    /**
+     * Open the IndexedDB database
+     */
+    private openDatabase;
+    /**
+     * Check if storage exists (has been initialized before)
+     */
+    exists(): Promise<boolean>;
+    /**
+     * Determine if a wallet payload exists (mnemonic present in data store).
+     * Metadata alone should not mark the wallet as existing.
+     */
+    private hasWalletPayload;
+    /**
+     * Get storage metadata
+     */
+    private getMetadata;
+    /**
+     * Update storage metadata
+     */
+    private updateMetadata;
+    /**
+     * Get or create salt for PBKDF2 key derivation
+     */
+    private getOrCreateSalt;
+    /**
+     * Require an existing salt when storage is already password-protected.
+     */
+    private requireSalt;
+    /**
+     * Derive encryption key from password using PBKDF2
+     */
+    private deriveKeyFromPassword;
+    /**
+     * Get or create a stored encryption key (passwordless mode)
+     */
+    private getOrCreateStoredKey;
+    /**
+     * Convert stored key material (CryptoKey or legacy envelope/raw) into a CryptoKey.
+     * Migrates legacy formats to a stored CryptoKey when possible.
+     */
+    private materializeStoredKey;
+    /**
+     * Import a stored envelope into a non-extractable CryptoKey
+     */
+    private importStoredKeyEnvelope;
+    /**
+     * Normalize legacy raw key bytes into a versioned envelope.
+     */
+    private normalizeStoredKeyEnvelope;
+    /**
+     * Encrypt data using AES-GCM
+     */
+    private encrypt;
+    /**
+     * Decrypt data using AES-GCM
+     */
+    private decrypt;
+    /**
+     * Normalize legacy encrypted payloads and validate structure.
+     */
+    private normalizeEncryptedData;
+    /**
+     * Detect production builds without relying solely on process.env.
+     * Browser bundles may tree-shake process, so we also look for Vite/import.meta flags.
+     */
+    private isProductionLike;
+    /**
+     * Store encrypted data
+     */
+    set(key: string, value: Uint8Array): Promise<void>;
+    /**
+     * Retrieve and decrypt data
+     */
+    get(key: string): Promise<Uint8Array | null>;
+    /**
+     * Delete a key from storage
+     */
+    delete(key: string): Promise<void>;
+    /**
+     * Check if storage has password protection
+     */
+    hasPassword(): Promise<boolean>;
+    /**
+     * Check if a backup was created at least once.
+     */
+    hasBackup(): Promise<boolean>;
+    /**
+     * Mark backup metadata as completed with the provided timestamp.
+     */
+    markBackupCompleted(timestamp?: number): Promise<void>;
+    /**
+     * Expose the PBKDF2 iteration count used for the current storage.
+     * Useful for backup metadata so restores reuse the same KDF cost.
+     */
+    getPbkdf2Iterations(): Promise<number | undefined>;
+    /**
+     * Add password protection to passwordless storage
+     * Re-encrypts all data with the new password-derived key
+     */
+    setPassword(password: string): Promise<void>;
+    /**
+     * Change the password
+     */
+    changePassword(oldPassword: string, newPassword: string, options?: {
+        iterations?: number;
+    }): Promise<void>;
+    /**
+     * Remove password protection (revert to passwordless mode)
+     */
+    removePassword(currentPassword: string): Promise<void>;
+    /**
+     * Export all data in decrypted form
+     */
+    private exportAllDecrypted;
+    /**
+     * Import and encrypt all data
+     */
+    private importAllEncrypted;
+    /**
+     * Best-effort zeroization of decrypted data held during migrations.
+     */
+    private wipeDecryptedData;
+    /**
+     * Clear all data and reset storage
+     */
+    clear(): Promise<void>;
+    /**
+     * Request persistent storage from the browser
+     */
+    requestPersistence(): Promise<boolean>;
+    /**
+     * Check if storage is persistent
+     */
+    isPersistent(): Promise<boolean>;
+    /**
+     * Close the database connection
+     */
+    close(): void;
+}
+//# sourceMappingURL=SecureStorage.d.ts.map

package/dist/src/storage/SecureStorage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecureStorage.d.ts","sourceRoot":"","sources":["../../../src/storage/SecureStorage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAuCH;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,EAAE,CAA2C;IACrD,OAAO,CAAC,aAAa,CAA0B;IAC/C,OAAO,CAAC,mBAAmB,CAAkB;IAC7C,OAAO,CAAC,gBAAgB,CAAC,CAAS;gBAEtB,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE;IAInD;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IA8B/B;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAsBzB;;;OAGG;IACH,OAAO,CAAC,4BAA4B;IAYpC;;;OAGG;IACG,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA6D9E;;OAEG;YACW,YAAY;IAe1B;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAMhC;;;OAGG;YACW,gBAAgB;IAM9B;;OAEG;YACW,WAAW;IAMzB;;OAEG;YACW,cAAc;IAoB5B;;OAEG;YACW,eAAe;IAW7B;;OAEG;YACW,WAAW;IASzB;;OAEG;YACW,qBAAqB;IAQnC;;OAEG;YACW,oBAAoB;IAiElC;;;OAGG;YACW,oBAAoB;IAkBlC;;OAEG;YACW,uBAAuB;IAUrC;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAoBlC;;OAEG;YACW,OAAO;IAiBrB;;OAEG;YACW,OAAO;IAkBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAoB9B;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;OAEG;IACG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxD;;OAEG;IACG,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAYlD;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQxC;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAKrC;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAKnC;;OAEG;IACG,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO5D;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAKxD;;;OAGG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgElD;;OAEG;IACG,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAChC,OAAO,CAAC,IAAI,CAAC;IA+EhB;;OAEG;IACG,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuF5D;;OAEG;YACW,kBAAkB;IAiBhC;;OAEG;YACW,kBAAkB;IAsBhC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAOzB;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA4C5B;;OAEG;IACG,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC;IAO5C;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC;IAOtC;;OAEG;IACH,KAAK,IAAI,IAAI;CAQd"}

package/dist/src/storage/constants.d.ts

@@ -0,0 +1,59 @@
+/**
+ * SecureStorage Constants
+ */
+/** Database name for IndexedDB */
+export declare const DB_NAME = "zeldwallet";
+/** Database version */
+export declare const DB_VERSION = 1;
+/** Object store names */
+export declare const STORES: {
+    /** Store for encrypted wallet data */
+    readonly DATA: "data";
+    /** Store for metadata (salt, encryption key, etc.) */
+    readonly META: "meta";
+};
+/** Metadata keys */
+export declare const META_KEYS: {
+    /** Salt for PBKDF2 key derivation */
+    readonly SALT: "salt";
+    /** Stored encryption key (passwordless mode) */
+    readonly ENCRYPTION_KEY: "encryption-key";
+    /** Storage metadata */
+    readonly METADATA: "metadata";
+};
+/** Data keys */
+export declare const DATA_KEYS: {
+    /** Encrypted mnemonic */
+    readonly MNEMONIC: "mnemonic";
+    /** Optional BIP39 passphrase (encrypted alongside mnemonic) */
+    readonly PASSPHRASE: "passphrase";
+    /** Wallet configuration */
+    readonly CONFIG: "config";
+};
+/** PBKDF2 parameters */
+export declare const PBKDF2_CONFIG: {
+    /** Number of iterations (600k for strong security) */
+    readonly ITERATIONS: 600000;
+    /** Hash algorithm */
+    readonly HASH: "SHA-256";
+    /** Salt length in bytes */
+    readonly SALT_LENGTH: 16;
+    /** Key derivation algorithm name */
+    readonly NAME: "PBKDF2";
+};
+/** AES-GCM parameters */
+export declare const AES_CONFIG: {
+    /** Algorithm name */
+    readonly NAME: "AES-GCM";
+    /** Key length in bits */
+    readonly LENGTH: 256;
+    /** IV length in bytes */
+    readonly IV_LENGTH: 12;
+};
+/** Storage format version */
+export declare const STORAGE_VERSION = 1;
+/** Stored key envelope version (for passwordless master key persistence) */
+export declare const KEY_ENVELOPE_VERSION = 1;
+/** Encrypted record version (per-record versioning for migration readiness) */
+export declare const ENCRYPTED_RECORD_VERSION = 1;
+//# sourceMappingURL=constants.d.ts.map

package/dist/src/storage/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/storage/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,kCAAkC;AAClC,eAAO,MAAM,OAAO,eAAe,CAAC;AAEpC,uBAAuB;AACvB,eAAO,MAAM,UAAU,IAAI,CAAC;AAE5B,yBAAyB;AACzB,eAAO,MAAM,MAAM;IACjB,sCAAsC;;IAEtC,sDAAsD;;CAE9C,CAAC;AAEX,oBAAoB;AACpB,eAAO,MAAM,SAAS;IACpB,qCAAqC;;IAErC,gDAAgD;;IAEhD,uBAAuB;;CAEf,CAAC;AAEX,gBAAgB;AAChB,eAAO,MAAM,SAAS;IACpB,yBAAyB;;IAEzB,+DAA+D;;IAE/D,2BAA2B;;CAEnB,CAAC;AAEX,wBAAwB;AACxB,eAAO,MAAM,aAAa;IACxB,sDAAsD;;IAEtD,qBAAqB;;IAErB,2BAA2B;;IAE3B,oCAAoC;;CAE5B,CAAC;AAEX,yBAAyB;AACzB,eAAO,MAAM,UAAU;IACrB,qBAAqB;;IAErB,yBAAyB;;IAEzB,yBAAyB;;CAEjB,CAAC;AAEX,6BAA6B;AAC7B,eAAO,MAAM,eAAe,IAAI,CAAC;AAEjC,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,IAAI,CAAC"}