mobile: pin Krusty KMS 0.14.0, and move the extension with it

.claude/workflows/mobile-feature.js

@@ -41,13 +41,13 @@ Ground rules for this task (in addition to AGENTS.md):
   small and additive. Put new logic in new files.
 - Read mobile/SCOPE.md and mobile/README.md first. The mobile architecture is fixed: all key custody and
   protocol logic lives in the Rust core mobile/core (crate bramble-core, UniFFI), built on the published
-  krusty-kms crates pinned at =0.11.0 (same release as the extension's @starknetfoundation/krusty-kms-wasm).
+  krusty-kms crates pinned at =0.14.0 (same release as the extension's @starknetfoundation/krusty-kms-wasm).
   The core is sans-IO: it builds JSON-RPC bodies and judges responses; Swift/Kotlin only move bytes.
 - Private keys, the recovery phrase, viewing keys, and vault keys never cross the FFI boundary except where
   SCOPE.md already allows (phrase at creation and on password-rechecked reveal). Never log secrets.
-- Never add fallback crypto. If krusty-kms 0.11.0 lacks something, say so explicitly and propose the smallest
+- Never add fallback crypto. If krusty-kms 0.14.0 lacks something, say so explicitly and propose the smallest
   honest path (e.g. an upstream krusty-kms change) rather than re-implementing it. Its sources are readable at
-  ~/.cargo/registry/src/*/krusty-kms*-0.11.0/ and in ~/Coding/krusty-kms (tag v0.11.0).
+  ~/.cargo/registry/src/*/krusty-kms*-0.14.0/ and in ~/Coding/krusty-kms (tag v0.14.0).
 - Nothing is restated by hand: design tokens, icons, networks, and presentation rules come from the
   extension's TypeScript via scripts/generate-mobile-assets.ts and parity fixtures (bun run mobile:assets,
   bun run mobile:parity). Reuse the existing SwiftUI components in mobile/ios/Bramble/DesignSystem and match
@@ -163,7 +163,7 @@ const research = await parallel([
     `behaviour. Cite file paths. The mobile app must reproduce this behaviour, so be precise about rules.`,
     { label: 'research:extension', phase: 'Research', schema: FINDINGS }),
   () => agent(
-    `${briefing}\nRESEARCH TASK (read-only, change nothing): inventory what the published krusty-kms 0.11.0 crates ` +
+    `${briefing}\nRESEARCH TASK (read-only, change nothing): inventory what the published krusty-kms 0.14.0 crates ` +
     `(krusty-kms, krusty-kms-common, krusty-kms-crypto, krusty-kms-client, krusty-kms-wallet-api, krusty-kms-sdk) ` +
     `provide for this feature: exact function signatures, types, and whether each pulls networking or async runtimes ` +
     `into a mobile binary. List precisely what is MISSING and would need an upstream krusty change.`,

mobile/SCOPE.md

@@ -18,7 +18,7 @@ instead of its WASM build. Native UI per platform (SwiftUI, Jetpack Compose); on
                  │  UniFFI (Swift)                    │  UniFFI (Kotlin/JNA)
                  └───────────────┬────────────────────┘
                         bramble-core  (mobile/core, Rust)
-     kms.rs      → krusty-kms =0.11.0 (same release as @starknetfoundation/krusty-kms-wasm)
+     kms.rs      → krusty-kms =0.14.0 (same release as @starknetfoundation/krusty-kms-wasm)
      vault.rs    → EncryptedEnvelope v3, byte-compatible with the extension
      wallet.rs   → WalletCore: lifecycle + key custody; phrase never crosses FFI except backup/reveal
      networks.rs → generated/networks.json  (rendered from wallet-model/networks)
@@ -29,7 +29,7 @@ What is reused from the extension, and how drift is prevented:
 
 | Shared piece | Source of truth | Mobile copy | Drift gate |
 | --- | --- | --- | --- |
-| Wallet crypto | Krusty KMS 0.11.0 | `krusty-kms` crate, pinned `=0.11.0` | `tests/conformance/mobile-generated.test.ts` compares the Cargo pin to the npm pin |
+| Wallet crypto | Krusty KMS 0.14.0 | `krusty-kms` crate, pinned `=0.14.0` | `tests/conformance/mobile-generated.test.ts` compares the Cargo pin to the npm pin |
 | Derivation / addresses / signatures | extension `deriveAccount` + WASM | `kms.rs` | `mobile/core/tests/fixtures/extension-parity.json`, written by the extension's real path, asserted in Rust and Swift tests, re-checked in `bun run check` |
 | Vault envelope | `vault/src/encrypted-store.ts` | `vault.rs` | Rust test opens an envelope the extension sealed |
 | Skins, scale, motion, springs, shadows | `ui-kit/src/theme/*` | `BrambleTokens.generated.{swift,kt}` | generated by `bun run mobile:assets`; byte-compared in `bun run check` |

mobile/core/Cargo.toml

@@ -27,13 +27,13 @@ testing = []
 
 [dependencies]
 # Wallet cryptography. Pinned exactly, and to the same release as the extension's
-# `@starknetfoundation/krusty-kms-wasm` (tests/conformance/mobile-core-pins.test.ts).
+# `@starknetfoundation/krusty-kms-wasm` (tests/conformance/mobile-generated.test.ts).
 # `parallel` (rayon) is only used by proof generation, which this core never runs.
-krusty-kms = { version = "=0.11.0", default-features = false }
-krusty-kms-common = { version = "=0.11.0" }
+krusty-kms = { version = "=0.14.0", default-features = false }
+krusty-kms-common = { version = "=0.14.0" }
 starknet-types-core = { version = "=0.2.4", features = ["hash"] }
 # BIP-39 English word list for the recovery-phrase word assist (already a Krusty dependency).
-bip39 = { version = "=2.2.2", default-features = false, features = ["std"] }
+bip39 = { version = "=3.0.0", default-features = false, features = ["std"] }
 # Bindings generator for the Swift and Kotlin surfaces.
 uniffi = { version = "=0.29.5" }
 # Vault envelope: the extension's EncryptedEnvelope v3 (PBKDF2-SHA-256 -> AES-256-GCM).

mobile/core/src/lib.rs

@@ -194,7 +194,7 @@ pub struct CoreInfo {
 pub fn core_info() -> CoreInfo {
     CoreInfo {
         core_version: env!("CARGO_PKG_VERSION").into(),
-        krusty_version: "0.11.0".into(),
+        krusty_version: "0.14.0".into(),
     }
 }
 

package.json

@@ -78,7 +78,7 @@
     "@bramble/wallet-ui": "workspace:*",
     "@bramble/wallet-model": "workspace:*",
     "@bramble/wallet-protocol": "workspace:*",
-    "@starknetfoundation/krusty-kms-wasm": "0.11.0",
+    "@starknetfoundation/krusty-kms-wasm": "0.14.0",
     "starknet": "10.8.0"
   },
   "overrides": {

scripts/check-krusty-adapter.ts

@@ -14,14 +14,14 @@ import { deriveAccount } from "@bramble/vault/accounts";
 import { DEFAULT_NETWORK, isStarkFieldElement } from "@bramble/wallet-model/networks";
 
 const packageName = "@starknetfoundation/krusty-kms-wasm";
-const packageVersion = "0.11.0";
+const packageVersion = "0.14.0";
 const packageRoot = `node_modules/${packageName}`;
 const packageManifest = `${packageRoot}/package.json`;
 const wasmPackage = `${packageRoot}/krusty_kms_wasm.js`;
 const wasmBinary = `${packageRoot}/krusty_kms_wasm_bg.wasm`;
 const expectedRuntimeDigests: Readonly<Record<string, string>> = {
-  [wasmPackage]: "b76e555eaf4edae057dff57f72c52533716f6bcb4c73418e4513934ce402e63e",
-  [wasmBinary]: "d92e54274127096998f32d556779fe0352f88c1d70ce19da8ba34b71db7b7d0c",
+  [wasmPackage]: "41583537fa163ab2afdfcf240cd7430a138ed3b0b68d0d278400a915b1216c8d",
+  [wasmBinary]: "fc634ff372f32f9873cf83db44ffe4f633ca6ec3ee73707ec3515301870fa15e",
 };
 
 // A published BIP-39 test phrase, never a wallet phrase: it exists so the

scripts/config-standards-policy.ts

@@ -54,7 +54,7 @@ export const EXPECTED_DEPENDENCIES: Readonly<Record<string, string>> = {
   "@bramble/wallet-ui": "workspace:*",
   "@bramble/wallet-model": "workspace:*",
   "@bramble/wallet-protocol": "workspace:*",
-  "@starknetfoundation/krusty-kms-wasm": "0.11.0",
+  "@starknetfoundation/krusty-kms-wasm": "0.14.0",
   starknet: "10.8.0",
 };
 

tests/scripts/krusty-package-provenance.test.ts

@@ -4,7 +4,7 @@ import { readFile } from "node:fs/promises";
 import { readWorkflowSources } from "../../scripts/workflow-inventory";
 
 const packageName = "@starknetfoundation/krusty-kms-wasm";
-const packageVersion = "0.11.0";
+const packageVersion = "0.14.0";
 
 describe("published Krusty package", () => {
   test("is an exact runtime dependency with no source-vendoring script", async () => {