feat(web-client): opt-in passkey-based keystore

crates/web-client/js/client.js

@@ -64,6 +64,36 @@ export class MidenClient {
 
     const seed = options?.seed ? await hashSeed(options.seed) : undefined;
 
+    // Resolve passkey encryption → keystore callbacks (before the keystore branch)
+    if (options?.passkeyEncryption && options?.keystore) {
+      console.warn(
+        "Both passkeyEncryption and keystore provided; keystore takes precedence."
+      );
+    }
+    if (options?.passkeyEncryption && !options?.keystore) {
+      const { createPasskeyKeystore, isPasskeyPrfSupported } =
+        await import("./passkey-keystore.js");
+      if (await isPasskeyPrfSupported()) {
+        const passkeyOpts =
+          typeof options.passkeyEncryption === "object"
+            ? options.passkeyEncryption
+            : {};
+        const storeName = options?.storeName || "default";
+        const result = await createPasskeyKeystore(storeName, passkeyOpts);
+        options = {
+          ...options,
+          storeName,
+          keystore: { getKey: result.getKey, insertKey: result.insertKey },
+        };
+      }
+      // Unsupported browser — fall through to standard keystore
+      else {
+        console.warn(
+          "passkeyEncryption was requested but WebAuthn PRF is not supported in this browser. Falling back to standard keystore."
+        );
+      }
+    }
+
     const rpcUrl = resolveRpcUrl(options?.rpcUrl);
     const noteTransportUrl = resolveNoteTransportUrl(options?.noteTransportUrl);
 

crates/web-client/js/index.js

@@ -60,6 +60,10 @@ export { MidenClient };
 export { CompilerResource };
 export { createP2IDNote, createP2IDENote, buildSwapTag };
 export { StorageView, StorageResult, wordToBigInt };
+export {
+  isPasskeyPrfSupported,
+  createPasskeyKeystore,
+} from "./passkey-keystore.js";
 
 // Internal exports — used by integration tests that need direct access to the low-level WebClient proxy.
 export {