From b46a06e4469a734ac003f44c64c37369cf89412d Mon Sep 17 00:00:00 2001
From: Chris Duncan <chris@zoso.dev>
Date: Fri, 27 Mar 2026 11:05:19 -0700
Subject: [PATCH] Build vault worker bundle from two-stage esbuild workflow
 instead of stringifying modules individually.

---
 esbuild/config.mjs            | 12 ++++++++++--
 esbuild/dev.mjs               |  2 +-
 esbuild/vault.mjs             | 28 ++++++++++++++++++++++++++++
 src/lib/vault/index.ts        | 34 ++++------------------------------
 src/lib/vault/vault-worker.ts |  2 ++
 5 files changed, 45 insertions(+), 33 deletions(-)
 create mode 100644 esbuild/vault.mjs

diff --git a/esbuild/config.mjs b/esbuild/config.mjs
index 6f36af6..5466379 100644
--- a/esbuild/config.mjs
+++ b/esbuild/config.mjs
@@ -1,6 +1,8 @@
 //! SPDX-FileCopyrightText: 2025 Chris Duncan <chris@zoso.dev>
 //! SPDX-License-Identifier: GPL-3.0-or-later
 
+import { browserVaultWorker, nodeVaultWorker } from './vault.mjs'
+
 /**
 * @type {import('esbuild').BuildOptions}
 */
@@ -27,7 +29,10 @@ export const browserOptions = {
 	format: 'esm',
 	entryPoints: [
 		{ in: './src/main.ts', out: 'browser.min' }
-	]
+	],
+	define: {
+		'VAULT_WORKER': browserVaultWorker
+	}
 }
 
 /**
@@ -53,5 +58,8 @@ export const nodeOptions = {
 	],
 	external: ['node:worker_threads'],
 	dropLabels: ['BROWSER'],
-	inject: ['./esbuild/inject/fake-indexeddb.mjs']
+	inject: ['./esbuild/inject/fake-indexeddb.mjs'],
+	define: {
+		'VAULT_WORKER': nodeVaultWorker
+	}
 }
diff --git a/esbuild/dev.mjs b/esbuild/dev.mjs
index 1091bc1..1011ced 100644
--- a/esbuild/dev.mjs
+++ b/esbuild/dev.mjs
@@ -5,5 +5,5 @@ import { build } from 'esbuild'
 import { browserOptions, iifeOptions, nodeOptions } from './config.mjs'
 
 await build(browserOptions)
-await build(iifeOptions)
+// await build(iifeOptions)
 await build(nodeOptions)
diff --git a/esbuild/vault.mjs b/esbuild/vault.mjs
new file mode 100644
index 0000000..51fc274
--- /dev/null
+++ b/esbuild/vault.mjs
@@ -0,0 +1,28 @@
+//! SPDX-FileCopyrightText: 2025 Chris Duncan <chris@zoso.dev>
+//! SPDX-License-Identifier: GPL-3.0-or-later
+
+import { build } from 'esbuild'
+
+/**
+ * @type {import('esbuild').BuildOptions}
+ */
+const vaultWorkerOptions = {
+	entryPoints: ['./src/lib/vault/vault-worker.ts'],
+	format: 'esm',
+	target: 'es2024',
+	legalComments: 'inline',
+	bundle: true,
+	write: false,
+}
+
+export const browserVaultWorker = JSON.stringify((await build({
+	...vaultWorkerOptions,
+	platform: 'browser',
+	dropLabels: ['NODE'],
+})).outputFiles?.[0].text)
+
+export const nodeVaultWorker = JSON.stringify((await build({
+	...vaultWorkerOptions,
+	platform: 'node',
+	dropLabels: ['BROWSER'],
+})).outputFiles?.[0].text)
diff --git a/src/lib/vault/index.ts b/src/lib/vault/index.ts
index 710deb0..0273de5 100644
--- a/src/lib/vault/index.ts
+++ b/src/lib/vault/index.ts
@@ -2,12 +2,7 @@
 //! SPDX-License-Identifier: GPL-3.0-or-later
 
 import { Worker as NodeWorker } from 'node:worker_threads'
-import { default as CONSTANTS } from '../constants'
-import { Bip39, Bip44, Blake2b, NanoNaCl, Secp256k1, WalletAesGcm } from '../crypto'
 import { Data } from '../database'
-import { Passkey } from './passkey'
-import { VaultTimer } from './vault-timer'
-import { VaultWorker } from './vault-worker'
 
 type Task = {
 	id: number
@@ -36,12 +31,14 @@ export class Vault {
 		this.#isLocked = true
 		this.#isTerminated = false
 		this.#queue = []
-		this.#url = URL.createObjectURL(new Blob([blob], { type: 'text/javascript' }))
+		//@ts-expect-error
+		this.#url = URL.createObjectURL(new Blob([VAULT_WORKER], { type: 'text/javascript' }))
 		BROWSER: this.#worker = new Worker(this.#url, { type: 'module' })
 		BROWSER: this.#worker.addEventListener('message', message => {
 			this.#report(message.data)
 		})
-		NODE: this.#worker = new NodeWorker(blob, {
+		//@ts-expect-error
+		NODE: this.#worker = new NodeWorker(VAULT_WORKER, {
 			eval: true,
 			stderr: false,
 			stdout: false
@@ -121,26 +118,3 @@ export class Vault {
 		}
 	}
 }
-
-const blob = `
-	${CONSTANTS}
-	const ${Secp256k1.name} = ${Secp256k1}
-	const ${Bip39.name} = ${Bip39}
-	const ${Bip44.name} = ${Bip44}
-	const ${Blake2b.name} = ${Blake2b}
-	const ${NanoNaCl.name} = ${NanoNaCl}
-	const ${WalletAesGcm.name} = ${WalletAesGcm}
-	const ${Passkey.name} = ${Passkey}
-	const ${VaultTimer.name} = ${VaultTimer}
-	const ${VaultWorker.name} = ${VaultWorker}
-	${Secp256k1.name === 'Secp256k1' ? '' : `const Secp256k1 = ${Secp256k1.name}`}
-	${Bip39.name === 'Bip39' ? '' : `const Bip39 = ${Bip39.name}`}
-	${Bip44.name === 'Bip44' ? '' : `const Bip44 = ${Bip44.name}`}
-	${Blake2b.name === 'Blake2b' ? '' : `const Blake2b = ${Blake2b.name}`}
-	${NanoNaCl.name === 'NanoNaCl' ? '' : `const NanoNaCl = ${NanoNaCl.name}`}
-	${WalletAesGcm.name === 'WalletAesGcm' ? '' : `const WalletAesGcm = ${WalletAesGcm.name}`}
-	${Passkey.name === 'Passkey' ? '' : `const Passkey = ${Passkey.name}`}
-	${VaultTimer.name === 'VaultTimer' ? '' : `const VaultTimer = ${VaultTimer.name}`}
-	${VaultWorker.name === 'VaultWorker' ? '' : `const VaultWorker = ${VaultWorker.name}`}
-	const v = new VaultWorker()
-`
diff --git a/src/lib/vault/vault-worker.ts b/src/lib/vault/vault-worker.ts
index 66436e0..88a9b25 100644
--- a/src/lib/vault/vault-worker.ts
+++ b/src/lib/vault/vault-worker.ts
@@ -634,3 +634,5 @@ export class VaultWorker {
 		return data.type
 	}
 }
+
+const v = new VaultWorker()
-- 
2.47.3