feat: Add WASM support and browser extension infrastructure

- Add WASM build target and dependencies for all crates.
- Implement IndexedDB-based persistent storage for WASM.
- Create browser extension infrastructure (UI, scripting, etc.).
- Integrate Rhai scripting engine for secure automation.
- Implement user stories and documentation for the extension.

vault/src/lib.rs

@@ -8,9 +8,16 @@ pub use crate::session::SessionManager;
 pub use crate::data::{KeyType, KeyMetadata, KeyEntry};
 mod error;
 mod crypto;
-mod session;
-
+pub mod session;
 mod utils;
+mod rhai_sync_helpers;
+pub mod rhai_bindings;
+
+#[cfg(target_arch = "wasm32")]
+pub mod session_singleton;
+#[cfg(target_arch = "wasm32")]
+pub mod wasm_helpers;
+
 
 pub use kvstore::traits::KVStore;
 use data::*;

vault/src/rhai_bindings.rs

@@ -0,0 +1,77 @@
+//! Rhai bindings for Vault and EVM Client modules
+//! Provides a single source of truth for scripting integration.
+
+use rhai::Engine;
+use crate::session::SessionManager;
+
+
+/// Register core Vault and EVM Client APIs with the Rhai scripting engine.
+#[cfg(not(target_arch = "wasm32"))]
+pub fn register_rhai_api<S: kvstore::traits::KVStore + Send + Sync + Clone + 'static>(
+    engine: &mut Engine,
+    session_manager: std::sync::Arc<std::sync::Mutex<SessionManager<S>>>,
+) {
+    engine.register_type::<RhaiSessionManager<S>>();
+    engine.register_fn("select_keypair", RhaiSessionManager::<S>::select_keypair);
+    engine.register_fn("sign", RhaiSessionManager::<S>::sign);
+    // No global constant registration: Rhai does not support this directly.
+    // Scripts should receive the session manager as a parameter or via module scope.
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[derive(Clone)]
+struct RhaiSessionManager<S: kvstore::traits::KVStore + Send + Sync + Clone + 'static> {
+    inner: std::sync::Arc<std::sync::Mutex<SessionManager<S>>>,
+}
+
+#[cfg(target_arch = "wasm32")]
+#[derive(Clone)]
+struct RhaiSessionManager<S: kvstore::traits::KVStore + Clone + 'static> {
+    inner: S,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl<S: kvstore::traits::KVStore + Send + Sync + Clone + 'static> RhaiSessionManager<S> {
+        pub fn select_keypair(&self, key_id: String) -> Result<(), String> {
+            // Use Mutex for interior mutability, &self is sufficient
+            self.inner.lock().unwrap().select_keypair(&key_id).map_err(|e| format!("select_keypair error: {e}"))
+        }
+        pub fn sign(&self, message: rhai::Blob) -> Result<rhai::Blob, String> {
+            let sm = self.inner.lock().unwrap();
+            // Try to get the current keyspace name from session state if possible
+            let keypair = sm.current_keypair().ok_or("No keypair selected")?;
+            // Sign using the session manager; password and keyspace are not needed (already unlocked)
+            crate::rhai_sync_helpers::sign_sync::<S>(
+                &sm,
+                &message,
+            ).map_err(|e| format!("sign error: {e}"))
+        }
+    }
+
+#[cfg(target_arch = "wasm32")]
+impl<S: kvstore::traits::KVStore + Clone + 'static> RhaiSessionManager<S> {
+    // WASM-specific implementation (stub for now)
+}
+
+// WASM-specific API: no Arc/Mutex, just a reference
+#[cfg(target_arch = "wasm32")]
+pub fn register_rhai_api<S: kvstore::traits::KVStore + Clone + 'static>(
+    engine: &mut Engine,
+    session_manager: &SessionManager<S>,
+) {
+    // WASM registration logic (adapt as needed)
+    // Example: engine.register_type::<RhaiSessionManager<S>>();
+    // engine.register_fn(...);
+    // In WASM, register global functions that operate on the singleton
+    engine.register_fn("select_keypair", |key_id: String| {
+        crate::wasm_helpers::select_keypair_global(&key_id)
+    }); // Calls the shared WASM session singleton
+    engine.register_fn("sign", |message: rhai::Blob| -> Result<rhai::Blob, String> {
+        Err("sign is async in WASM; use the WASM sign() API from JS instead".to_string())
+    });
+    // No global session object in WASM; use JS/WASM API for session ops
+}
+
+// --- Sync wrappers for async Rust APIs (to be implemented with block_on or similar) ---
+// These should be implemented in a separate module (rhai_sync_helpers.rs)
+// and use block_on or spawn_local for WASM compatibility.

vault/src/rhai_sync_helpers.rs

@@ -0,0 +1,20 @@
+//! Synchronous wrappers for async Vault and EVM client APIs for use in Rhai bindings.
+//! These use block_on for native, and spawn_local for WASM if needed.
+
+use crate::session::SessionManager;
+
+#[cfg(not(target_arch = "wasm32"))]
+use tokio::runtime::Handle;
+
+// Synchronous sign wrapper for Rhai: only supports signing the currently selected keypair in the unlocked keyspace
+#[cfg(not(target_arch = "wasm32"))]
+pub fn sign_sync<S: kvstore::traits::KVStore + Send + Sync + 'static>(
+    session_manager: &SessionManager<S>,
+    message: &[u8],
+) -> Result<Vec<u8>, String> {
+    Handle::current().block_on(async {
+        session_manager.sign(message).await.map_err(|e| format!("sign error: {e}"))
+    })
+}
+
+

vault/src/session_singleton.rs

@@ -0,0 +1,12 @@
+//! WASM session singleton for the vault crate
+//! This file defines the global SessionManager singleton for WASM builds.
+
+use once_cell::unsync::Lazy;
+use std::cell::RefCell;
+use crate::session::SessionManager;
+use kvstore::wasm::WasmStore;
+
+// Thread-local singleton for WASM session management
+thread_local! {
+    pub static SESSION_MANAGER: Lazy<RefCell<Option<SessionManager<WasmStore>>>> = Lazy::new(|| RefCell::new(None));
+}

vault/src/wasm_helpers.rs

@@ -0,0 +1,15 @@
+//! WASM-specific helpers for Rhai bindings and session management
+//! Provides global functions for Rhai integration in WASM builds.
+
+#[cfg(target_arch = "wasm32")]
+pub fn select_keypair_global(key_id: &str) -> Result<(), String> {
+    use crate::session_singleton::SESSION_MANAGER;
+    SESSION_MANAGER.with(|cell| {
+        let mut opt = cell.borrow_mut();
+        if let Some(session) = opt.as_mut() {
+            session.select_keypair(key_id).map_err(|e| format!("select_keypair error: {e}"))
+        } else {
+            Err("Session not initialized".to_string())
+        }
+    })
+}