- The label must be a string of 1 to 128 printable ASCII characters, no ":". Anything else passed the old check as its text, so a missing value derived a secret under "undefined"; and outside ASCII, labels that look alike can encode differently (composed and decomposed accents) or differ and encode the same (lone surrogates). The label is the PRF input and frozen once used, so the rule is set before the first release.

- A second PRF output equal to the first is zeroed and treated as missing: a provider that ignores the PRF input would otherwise hand the app the Falcon key's entropy. withAppSecret throws app-secret-unavailable and the account still signs.

- The credential's own copy of the first output is zeroed like the second's. Both are copied before either is zeroed, in case they share a buffer.

The README and the guide state the label rule, and that context is not part of the secret's input.

WorkerKeyStore.unlock transfers the entropy buffer to the worker. When the unlock then failed (the worker answered with an error, or the store locked while the worker derived the key), the catch block made a view of that detached buffer to zero it, which throws. The caller got a TypeError instead of the PasskeyError, and lock() was skipped, leaving the worker running.

Zero the buffer only while the page still holds it (a worker that never started). The test worker now detaches what it's sent, as a real one does, and tests cover a failure before and after the transfer.

Feat/smart contract patterns conpet page (INT-185)

Use the platform's WebCrypto (crypto.subtle) for SHA-512, SHA-256, HMAC,
X25519 and Ed25519 verification. Keep @noble only for what WebCrypto lacks:
unclamped Ed25519 point arithmetic for BIP32-Ed25519, Ed25519 -> X25519 key
conversion (@noble/curves), and BLAKE2b (@noble/hashes). Replace Buffer and
bn.js with plain Uint8Array/bigint helpers so the published build has no
Node globals. Runtime dependencies drop from six to two.

Key derivation, signatures and ECDH outputs are byte-identical to the
previous implementation. verifyWithPublicKey keeps libsodium's strict rules
(canonical S, R and public key; small-order points rejected) regardless of
the platform's WebCrypto edge-case behaviour.

API changes since 2.0.0-canary.1:
- fromSeed is async and accepts any Uint8Array.
- signData no longer takes a metadata argument. Encoding/JSON-schema
  validation and the Algorand tag-prefix check were removed; it signs
  exactly the bytes given. SignMetadata, Encoding, ERROR_BAD_DATA and
  ERROR_TAGS_FOUND are no longer exported. Callers signing untrusted data
  must domain-separate it (e.g. as ARC-60 does).
- signAlgoTransaction rejects input not prefixed with "TX" by throwing
  TxTagMissingError, catching an encoded transaction passed in place of its
  bytes to sign.
- deriveChildNodePublic rejects harden(0) (previously returned a wrong key).
- Only the package root is importable (package.json "exports").
- Requires Node.js >= 22, a browser with WebCrypto Ed25519/X25519, or a
  WebCrypto polyfill on React Native.

Also:
- README test vectors regenerated; the previous ones did not match the
  library's output. A test now checks the README vectors.
- Switch from yarn to pnpm; update CI to Node 22/24 and current actions.
- build/test clean dist first so stale spec files are never packed.

An app can ask the passkey for a secret of its own, derived from the
same credential but separate from the signing key: pass
`appSecret: { label }` and read it with `withAppSecret(callback)`.

- Every PRF ceremony (connect, unlock) also evaluates `eval.second`
  with `@txnlab/use-wallet-passkey:app-secret:v1:<label>` while the
  option is set. The label is 1-128 characters, no `:`.
- The secret is held only while the session is unlocked and zeroed on
  lock, release, a failed connect and a key mismatch. `withAppSecret`
  hands the callback a copy it zeroes afterwards; while locked it runs
  a PRF ceremony (confirmed per `confirm`).
- A provider that returns no second output gives `PasskeyError` code
  `app-secret-unavailable`.
- `PasskeySigningRequest` gains `{ type: 'app-secret' }`.
- `APP_SECRET_PREFIX`, `appSecretInput` and `PasskeyAppSecretOptions`
  are exported; the prefix is frozen.

hay.app uses it to derive a separate ZeroSignal payer account from a
passkey Haystack Login, as it already does from a legacy login's key.

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>