feat(web): WebAuthn PRF-based key encryption for web client

.github/workflows/lint.yml

@@ -67,8 +67,6 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: "20"
-      - name: Check React SDK version sync
-        run: node scripts/check-react-sdk-sync.js
       - name: Install dependencies
         run: ./scripts/retry-yarn-install.sh packages/react-sdk
       - name: Run lint

.gitignore

@@ -43,6 +43,9 @@ miden-client.toml
 !packages/react-sdk/
 !packages/react-sdk/**
 packages/react-sdk/dist/
+!packages/vite-plugin/
+!packages/vite-plugin/**
+packages/vite-plugin/dist/
 keystore/
 
 # Ignore files that spawn using `cargo run`

CHANGELOG.md

@@ -34,6 +34,7 @@
 * [FEATURE][web] New `MidenClient` class with resource-based API (`client.accounts`, `client.transactions`, `client.notes`, `client.tags`, `client.settings`). Provides high-level transaction helpers (`send`, `mint`, `consume`, `swap`, `consumeAll`), transaction dry-runs via `preview()`, confirmation polling via `waitFor()`, and flexible account/note references that accept hex strings, bech32 strings, or WASM objects interchangeably (`AccountRef`, `NoteInput` types). Factory methods: `MidenClient.create()`, `MidenClient.createTestnet()`, `MidenClient.createMock()`. ([#1762](https://github.com/0xMiden/miden-client/pull/1762))
 * [FEATURE][web] Added `TransactionId.fromHex()` static constructor for creating transaction IDs from hex strings. ([#1762](https://github.com/0xMiden/miden-client/pull/1762))
 * [FEATURE][web] Added standalone tree-shakeable note utilities (`createP2IDNote`, `createP2IDENote`, `buildSwapTag`) usable without a client instance. ([#1762](https://github.com/0xMiden/miden-client/pull/1762))
+* [FEATURE][web] Opt-in passkey-based encryption for secret keys at rest using WebAuthn PRF (Touch ID / Face ID / Windows Hello). Keys are encrypted with AES-256-GCM using a wrapping key derived from the authenticator's PRF output via HKDF-SHA256. Enable via `MidenClient.create({ passkeyEncryption: true })` or `MidenProvider config={{ passkeyEncryption: true }}`. Includes `isPasskeyPrfSupported()` for feature detection, transparent migration from plaintext keys, and a separate `MidenKeystore_*` IndexedDB for encrypted storage. Requires Chrome 116+, Safari 18+, or Edge 116+. ([#1836](https://github.com/0xMiden/miden-client/pull/1836))
 
 ## 0.13.1 (TBD)
 

crates/web-client/js/client.js

@@ -53,6 +53,31 @@ export class MidenClient {
 
     const seed = options?.seed ? await hashSeed(options.seed) : undefined;
 
+    // Resolve passkey encryption → keystore callbacks (before the keystore branch)
+    if (options?.passkeyEncryption && options?.keystore) {
+      console.warn(
+        "Both passkeyEncryption and keystore provided; keystore takes precedence."
+      );
+    }
+    if (options?.passkeyEncryption && !options?.keystore) {
+      const { createPasskeyKeystore, isPasskeyPrfSupported } =
+        await import("./passkey-keystore.js");
+      if (await isPasskeyPrfSupported()) {
+        const passkeyOpts =
+          typeof options.passkeyEncryption === "object"
+            ? options.passkeyEncryption
+            : {};
+        const storeName = options?.storeName || "default";
+        const result = await createPasskeyKeystore(storeName, passkeyOpts);
+        options = {
+          ...options,
+          storeName,
+          keystore: { getKey: result.getKey, insertKey: result.insertKey },
+        };
+      }
+      // Unsupported browser — silently fall through to standard keystore
+    }
+
     let inner;
     if (options?.keystore) {
       inner = await WebClientClass.createClientWithExternalKeystore(

crates/web-client/js/index.js

@@ -28,6 +28,10 @@ export const AuthScheme = Object.freeze({
 
 export { MidenClient };
 export { createP2IDNote, createP2IDENote, buildSwapTag };
+export {
+  isPasskeyPrfSupported,
+  createPasskeyKeystore,
+} from "./passkey-keystore.js";
 
 // Internal exports — used by integration tests that need direct access to the low-level WebClient proxy.
 export { WebClient as WasmWebClient, MockWebClient as MockWasmWebClient };