feat: adopt lnurlcash-kit 0.8 with BIP-32-derived note secrets

.gitignore

@@ -28,3 +28,4 @@ yarn-error.log*
 # Playwright (e2e/ itself is tracked - only its artifacts are ignored)
 /playwright-report/
 /test-results/
+/.playwright-mcp/

AGENTS.md

@@ -79,7 +79,7 @@ npm run cap:sync           # build + cap sync android
 
 - NixOS: use the flake dev shell (nodejs_22 + chromium for e2e).
   `sass-embedded` is aliased to pure-JS `sass` via npm overrides.
-- `lnurlcash-kit@0.1.1` and `lnurlcash-conformance@0.1.1` are exact npm
+- `lnurlcash-kit@0.8.0` and `lnurlcash-conformance@0.7.0` are exact npm
   registry packages. Keep their manifest pins, registry tarball URLs, and lock
   integrity values intact.
 - Credential and authorization records are bound to the canonical owner ID

e2e/global-setup.ts

@@ -0,0 +1,40 @@
+/// <reference types="node" />
+import { chromium } from '@playwright/test';
+import { execSync } from 'child_process';
+
+// Warms the freshly booted dev server before any test runs. `quasar dev`
+// answers HTTP the moment its port is up, but vite still transforms the
+// module graph on the first page load - a window in which the first test's
+// multi-step onboarding flow can race lazy compilation (observed as the
+// create flow never reaching /#/). One full load plus a reload completes
+// that work before the suite starts. Uses the same system-chromium
+// resolution as the main config (CI falls back to the bundled browser).
+const findSystemChromium = (): string | undefined => {
+  try {
+    return execSync('command -v chromium').toString().trim() || undefined;
+  } catch {
+    return undefined;
+  }
+};
+
+const globalSetup = async (): Promise<void> => {
+  const executablePath = process.env.CHROMIUM_PATH || findSystemChromium();
+  const browser = await chromium.launch({
+    ...(executablePath ? { executablePath } : {}),
+  });
+  try {
+    const page = await (await browser.newContext({ baseURL: 'http://localhost:9333' })).newPage();
+    await page.goto('/');
+    await page
+      .getByRole('button', { name: 'Get started' })
+      .waitFor({ state: 'visible', timeout: 60_000 });
+    await page.reload();
+    await page
+      .getByRole('button', { name: 'Get started' })
+      .waitFor({ state: 'visible', timeout: 60_000 });
+  } finally {
+    await browser.close();
+  }
+};
+
+export default globalSetup;

e2e/helpers/wallet.ts

@@ -1,4 +1,8 @@
 import type { Page } from '@playwright/test';
+import { expect } from '@playwright/test';
+import { buildNoteUrl, defaultRandomSecret } from 'lnurlcash-kit';
+import { MINT_ORIGIN, NOTE_PATH } from './MintMocker';
+import type { MintMocker } from './MintMocker';
 
 // Drives onboarding end to end on a fresh browser context: /#/welcome ->
 // "Create wallet" (empty password = stored unencrypted) -> confirm the
@@ -10,3 +14,34 @@ export const createFreshWallet = async (page: Page): Promise<void> => {
   await page.getByRole('button', { name: 'Continue' }).click();
   await page.waitForURL(/#\/$/);
 };
+
+// Give a fresh wallet one verified, spendable note at the mock mint: the
+// mock answers the note's informational GET and signs every mutation, and
+// the receive's first-contact trust prompt is confirmed, pinning the mint's
+// signing key so the wallet can verify what this mint mints.
+export const fundMockMintWallet = async (
+  page: Page,
+  mint: MintMocker,
+  amountMsat: number,
+): Promise<void> => {
+  await mint.mockNoteInfo({ amountMsat });
+  await mint.mockMutationEndpoint();
+  await createFreshWallet(page);
+
+  await page.getByRole('button', { name: 'Receive' }).click();
+  const chooser = page.locator('.q-dialog', { hasText: 'Paste or scan a note' });
+  await chooser.getByRole('button', { name: 'Bearer note' }).click();
+  const dialog = page.locator('.q-dialog', { hasText: 'Receive bearer note' });
+  await dialog
+    .locator('textarea')
+    .fill(buildNoteUrl(`${MINT_ORIGIN}${NOTE_PATH}`, defaultRandomSecret(), amountMsat));
+  await dialog.getByRole('button', { name: 'Receive', exact: true }).click();
+  await expect(dialog.getByText(`Received ${Math.floor(amountMsat / 1000)} sats`)).toBeVisible();
+  // the note advertises the mint's key, so the first-contact trust prompt
+  // opens as its own dialog - trust it (that also pins the signing key)
+  await page
+    .locator('.q-dialog', { hasText: 'New mint' })
+    .getByRole('button', { name: 'Trust this mint' })
+    .click();
+  await dialog.getByRole('button', { name: 'Done' }).click();
+};

e2e/specs/backup-security.spec.ts

@@ -1,5 +1,9 @@
 import { test, expect } from '../fixtures';
 import { createFreshWallet } from '../helpers/wallet';
+import { bytesToHex } from '@noble/hashes/utils.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { utf8ToBytes } from '@noble/hashes/utils.js';
+import { secp256k1 } from '@noble/curves/secp256k1.js';
 
 // M4 backup & security surfaces. No real WebAuthn: headless Chromium has no
 // platform authenticator, so the security page is asserted in its honest
@@ -12,6 +16,72 @@ const VALID_PHRASE =
 const readSettings = async (page: import('@playwright/test').Page) =>
   JSON.parse((await page.evaluate(() => localStorage.getItem('sattle_settings'))) ?? '{}');
 
+// A v2 encrypted wallet-material record built with the app's own wrap
+// (keys.ts/passwordWrap.ts: PBKDF2-SHA256 210k -> AES-GCM), for specs that
+// need a saved, locked wallet without driving the onboarding UI.
+const PASSWORD = 'correct horse battery staple';
+const PBKDF2_ITERATIONS = 210_000;
+
+const encryptedWalletMaterialRecord = async (
+  password: string,
+): Promise<{
+  enc: true;
+  salt: string;
+  iv: string;
+  ciphertext: string;
+  materialHash: string;
+  ownerId: string;
+  version: 2;
+}> => {
+  const linkingKeyHex = '07'.repeat(32);
+  const material = {
+    version: 2,
+    linkingKeyHex,
+    cashRootHex: '08'.repeat(64),
+  };
+  const serialized = JSON.stringify(material);
+  const salt = crypto.getRandomValues(new Uint8Array(16));
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const baseKey = await crypto.subtle.importKey(
+    'raw',
+    new TextEncoder().encode(password),
+    'PBKDF2',
+    false,
+    ['deriveKey'],
+  );
+  const aesKey = await crypto.subtle.deriveKey(
+    { name: 'PBKDF2', salt, iterations: PBKDF2_ITERATIONS, hash: 'SHA-256' },
+    baseKey,
+    { name: 'AES-GCM', length: 256 },
+    false,
+    ['encrypt'],
+  );
+  const ciphertext = new Uint8Array(
+    await crypto.subtle.encrypt(
+      { name: 'AES-GCM', iv },
+      aesKey,
+      new TextEncoder().encode(serialized),
+    ),
+  );
+  return {
+    enc: true,
+    salt: bytesToHex(salt),
+    iv: bytesToHex(iv),
+    ciphertext: bytesToHex(ciphertext),
+    materialHash: bytesToHex(sha256(utf8ToBytes(serialized))),
+    ownerId: bytesToHex(secp256k1.getPublicKey(hexToBytesLocal(linkingKeyHex), true)),
+    version: 2,
+  };
+};
+
+const hexToBytesLocal = (hex: string): Uint8Array => {
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < bytes.length; i += 1) {
+    bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+};
+
 test.describe('Backup page', () => {
   test('renders all sections and exports a JSON backup file', async ({ page }) => {
     await createFreshWallet(page);
@@ -93,19 +163,22 @@ test.describe('Security page', () => {
     });
     await createFreshWallet(page);
     await page.evaluate(() => {
-      const saved: unknown = JSON.parse(localStorage.getItem('sattle_linking_key') ?? '{}');
+      const saved: unknown = JSON.parse(localStorage.getItem('sattle_wallet_material_v2') ?? '{}');
       if (
         typeof saved !== 'object' ||
         saved === null ||
         !('ownerId' in saved) ||
-        typeof saved.ownerId !== 'string'
+        typeof saved.ownerId !== 'string' ||
+        !('materialHash' in saved) ||
+        typeof saved.materialHash !== 'string'
       ) {
         throw new Error('expected saved wallet owner');
       }
       const wrap = {
         hkdfSalt: '11'.repeat(16),
         iv: '22'.repeat(12),
-        wrappedKey: '33'.repeat(48),
+        materialHash: saved.materialHash,
+        wrappedMaterial: '33'.repeat(48),
         createdAt: 1,
       };
       localStorage.setItem(
@@ -116,14 +189,14 @@ test.describe('Security page', () => {
             credentialId: '44'.repeat(16),
             name: 'Current wallet passkey',
             ownerId: saved.ownerId,
-            version: 1,
+            version: 2,
           },
           {
             ...wrap,
             credentialId: '55'.repeat(16),
             name: 'Foreign wallet passkey',
             ownerId: '0256b328b30c8bf5839e24058747879408bdb36241dc9c2e7c619faa12b2920967',
-            version: 1,
+            version: 2,
           },
         ]),
       );
@@ -137,36 +210,39 @@ test.describe('Security page', () => {
     await expect(page.getByText('Foreign wallet passkey')).toHaveCount(0);
   });
 
-  test('hides passkey-first unlock for a markerless saved wallet', async ({ page }) => {
-    // Given an encrypted saved key and passkey slot without owner markers
-    await page.addInitScript(() => {
-      localStorage.setItem(
-        'sattle_linking_key',
-        JSON.stringify({
-          enc: true,
-          salt: '11'.repeat(16),
-          iv: '22'.repeat(12),
-          ciphertext: '33'.repeat(48),
-        }),
-      );
-      localStorage.setItem(
-        'sattle_passkey_slots',
-        JSON.stringify([
-          {
-            credentialId: '44'.repeat(16),
-            hkdfSalt: '55'.repeat(16),
-            iv: '66'.repeat(12),
-            wrappedKey: '77'.repeat(48),
-            createdAt: 1,
-          },
-        ]),
-      );
-    });
+  test('hides passkey-first unlock when no passkey belongs to the saved wallet', async ({
+    page,
+  }) => {
+    // Given an encrypted v2 saved wallet whose only passkey slot belongs to
+    // a DIFFERENT owner (a foreign wallet's residue on the same device)
+    const record = await encryptedWalletMaterialRecord(PASSWORD);
+    await page.addInitScript(
+      ({ storedRecord }) => {
+        localStorage.setItem('sattle_wallet_material_v2', JSON.stringify(storedRecord));
+        localStorage.setItem(
+          'sattle_passkey_slots',
+          JSON.stringify([
+            {
+              credentialId: '44'.repeat(16),
+              hkdfSalt: '55'.repeat(16),
+              iv: '66'.repeat(12),
+              materialHash: '77'.repeat(32),
+              wrappedMaterial: '88'.repeat(48),
+              createdAt: 1,
+              ownerId: '0256b328b30c8bf5839e24058747879408bdb36241dc9c2e7c619faa12b2920967',
+              version: 2,
+            },
+          ]),
+        );
+      },
+      { storedRecord: record },
+    );
 
     // When the locked wallet renders
     await page.goto('/');
 
-    // Then passkey-first unlock is unavailable until another owner proof
+    // Then passkey-first unlock is unavailable - the one slot on this
+    // device is not this wallet's
     await expect(page.getByText('Wallet locked')).toBeVisible();
     await expect(page.getByRole('button', { name: 'Unlock with passkey' })).toHaveCount(0);
   });

e2e/specs/manage-mints.spec.ts

@@ -38,6 +38,7 @@ const mockSuggestionMint = async (page: Page): Promise<void> => {
       callback: 'https://mint.600.wtf/pay',
       minSendable: 1000,
       maxSendable: 100_000_000_000,
+      commentAllowed: 64,
       withdrawLink: 'https://mint.600.wtf/note',
       metadata: '[]',
     }),
@@ -87,8 +88,8 @@ test.describe('Manage mints', () => {
   test('a mint with held notes cannot be removed', async ({ page, mint }) => {
     // hold a 21-sat note from the mock mint - holding funds locks the mint
     // against removal
-    await mint.mockNoteInfo({ amountMsat: 21_000, mintPubkey: MINT_PUBKEY });
-    await mint.mockRotateOk();
+    await mint.mockNoteInfo({ amountMsat: 21_000 });
+    await mint.mockMutationEndpoint();
     await createFreshWallet(page);
 
     await page.getByRole('button', { name: 'Receive' }).click();

e2e/specs/move-funds.spec.ts

@@ -1,40 +1,18 @@
 import { test, expect } from '../fixtures';
 import type { Page } from '@playwright/test';
-import { buildNoteUrl, defaultRandomSecret } from 'lnurlcash-kit';
-import { MINT_ORIGIN, MINT2_ORIGIN, NOTE_PATH } from '../helpers/MintMocker';
-import { createFreshWallet } from '../helpers/wallet';
+import { MINT2_ORIGIN } from '../helpers/MintMocker';
+import { fundMockMintWallet } from '../helpers/wallet';
 
 const AMOUNT_MSAT = 50_000; // 50 sats
-const MINT_PUBKEY = `02${'ab'.repeat(32)}`;
-const TARGET_PUBKEY = `03${'cd'.repeat(32)}`;
-// 64 hex chars - a valid preimage (it becomes the claimed note's secret)
+// 64 hex chars - a valid payment receipt, distinct from the claimed note secret
 const PREIMAGE = 'ef'.repeat(32);
 // amount-less by decodeBolt11AmountMsat, so the kit skips its invoice
 // amount cross-check against the requested value
 const INVOICE = 'lnmock1transfer';
 
 // give the wallet a verified, spendable 50-sat note at the source mint
 const fundSourceMint = async (page: Page, mint: import('../helpers/MintMocker').MintMocker) => {
-  await mint.mockNoteInfo({ amountMsat: AMOUNT_MSAT, mintPubkey: MINT_PUBKEY });
-  await mint.mockRotateOk();
-  await createFreshWallet(page);
-
-  await page.getByRole('button', { name: 'Receive' }).click();
-  const chooser = page.locator('.q-dialog', { hasText: 'Paste or scan a note' });
-  await chooser.getByRole('button', { name: 'Bearer note' }).click();
-  const dialog = page.locator('.q-dialog', { hasText: 'Receive bearer note' });
-  await dialog
-    .locator('textarea')
-    .fill(buildNoteUrl(`${MINT_ORIGIN}${NOTE_PATH}`, defaultRandomSecret(), AMOUNT_MSAT));
-  await dialog.getByRole('button', { name: 'Receive', exact: true }).click();
-  await expect(dialog.getByText('Received 50 sats')).toBeVisible();
-  // the note advertises a mint key, so the first-contact trust prompt opens
-  // as its own dialog - trust it (that also locks the mint)
-  await page
-    .locator('.q-dialog', { hasText: 'New mint' })
-    .getByRole('button', { name: 'Trust this mint' })
-    .click();
-  await dialog.getByRole('button', { name: 'Done' }).click();
+  await fundMockMintWallet(page, mint, AMOUNT_MSAT);
 };
 
 // pick an option from a Quasar select identified by its label
@@ -78,7 +56,6 @@ test.describe('Move funds', () => {
     // the target mint advertises a flat 2-sat receive fee (2000 msat, 0 ppm)
     await mint.mockTargetMint(
       {
-        mintPubkey: TARGET_PUBKEY,
         invoice: INVOICE,
         preimage: PREIMAGE,
         noteAmountMsat: AMOUNT_MSAT,
@@ -100,11 +77,10 @@ test.describe('Move funds', () => {
 
   test('a two-mint transfer moves the balance', async ({ page, mint }) => {
     await fundSourceMint(page, mint);
-    // the target mint: hands out the invoice, reports it settled with the
-    // preimage, and answers the claim's note info + rotation
+    // the target mint commits the wallet-chosen secret, hands out the invoice,
+    // and exposes that note only after the source-mint melt pays it
     await mint.mockTargetMint(
       {
-        mintPubkey: TARGET_PUBKEY,
         invoice: INVOICE,
         preimage: PREIMAGE,
         noteAmountMsat: AMOUNT_MSAT,