Webpackified the export iframe! by ethankonk · Pull Request #114 · tkhq/frames

ethankonk · 2026-02-06T15:24:25Z

No description provided.

socket-security · 2026-02-06T15:24:53Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@noble/ed25519@3.0.0
	@noble/hashes@2.0.1

View full report

Copilot

Pull request overview

This pull request migrates the export iframe from a standalone HTML/JS approach to a webpack-based build system, modernizing the codebase and improving modularity. The changes align the export iframe with the existing webpack-based architecture used by other iframes in the project (import and export-and-sign).

Changes:

Introduced webpack build configuration with Babel transpilation, CSS extraction, and code splitting
Added support for Bitcoin WIF and Sui Bech32 key encoding formats to shared turnkey-core module
Restructured export iframe code into modular ES6 imports with separate CSS and HTML templates
Updated build pipeline in Dockerfile to compile export iframe alongside other webpack-based modules

Reviewed changes

Copilot reviewed 13 out of 30 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
shared/turnkey-core.js	Added `base58CheckEncode` function and new key encoding formats (BITCOIN_MAINNET_WIF, BITCOIN_TESTNET_WIF, SUI_BECH32) to support additional blockchain ecosystems
nginx.conf	Updated export iframe routing configuration to serve webpack-built assets
export/webpack.config.js	New webpack configuration with Babel, CSS extraction, CSP settings, and code splitting
export/src/turnkey-core.js	New module that wraps and re-exports shared functions with export-specific utilities
export/src/styles.css	Extracted CSS styles from inline HTML to separate stylesheet
export/src/index.template.html	Clean HTML template without embedded JavaScript
export/src/index.js	New entry point with modularized event handlers and HPKE decryption logic
export/package.json	Added webpack toolchain dependencies and updated build scripts
export/noble-ed25519.js	Removed vendored library in favor of npm package
export/index.test.js	Updated test setup to work with new modular structure
export/index.template.html	Removed monolithic HTML file with embedded scripts
Dockerfile	Added export module build step to multi-stage build process
dist/*	Generated webpack build artifacts

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

export/webpack.config.js

export/src/turnkey-core.js

shared/turnkey-core.js

Copilot · 2026-02-06T15:32:23Z

nginx.conf

    server {
        listen 8081;
-        root /usr/share/nginx;
+        root /usr/share/nginx/templated/export;


The nginx configuration sets the root to /usr/share/nginx/templated/export, but the Dockerfile copies the built export files to /usr/share/nginx/export (line 41). This path mismatch will cause nginx to fail serving the export iframe. Either change the Dockerfile to copy to /usr/share/nginx/templated/export or update this nginx root directive to /usr/share/nginx/export.

Suggested change

root /usr/share/nginx/templated/export;

root /usr/share/nginx/export;

export/src/index.js

export/src/turnkey-core.js

leeland-turnkey · 2026-02-23T18:42:12Z

I believe we will need to update the resources.yaml file. The export folder runs envsubst against export/index.template.html. We will need to import changes from the templated/export tolder to the webpack dist of export/dist. Also the init container block needs to mirror the export-and-sign and import pattern:
https://github.com/tkhq/frames/blob/main/kustomize/base/resources.yaml#L29-L56

leeland-turnkey · 2026-02-23T19:00:36Z

I would make sure the github actions for export-and-sign match export and re-run the CI build after the change. I believe there will be more errors and things we missed that will be uncovered: .github/workflows/ci.yml

leeland-turnkey · 2026-02-23T18:38:25Z

export/src/index.template.html

+<!DOCTYPE html>
+<html class="no-js" lang="">
+  <head>
+    <link rel="icon" type="image/svg+xml" href="./favicon.svg" />


We are going to need something like this or else we will get an error in preprod and production:
https://github.com/tkhq/frames/blob/main/export-and-sign/src/index.template.html#L8

verifyEnclaveSignature will always throw in production

leeland-turnkey · 2026-02-23T18:45:27Z

export/webpack.config.js

+    resolveLoader: {
+      modules: [path.resolve(__dirname, "node_modules"), "node_modules"],
+    },
+    optimization: {


We will need to add deterministic in the optimization as well.

04bc323

Suggested change

optimization: {

optimization: {

// Reproducible builds so CI "dist matches committed" check passes

moduleIds: "deterministic",

chunkIds: "deterministic",

leeland-turnkey · 2026-02-23T18:53:54Z

export/package.json

+  },
+  "dependencies": {
+    "@hpke/core": "^1.7.5",
+    "@noble/ed25519": "^3.0.0",


Not sure if this matters, but export is running version 3.0.0 for this package while export-and-sign is running 2.0.0: https://github.com/tkhq/frames/blob/main/export-and-sign/package.json#L22

Another NIT:
We have carats as part of these dependencies while export-and-sign have the packages locked.

leeland-turnkey · 2026-02-23T19:05:00Z

export/src/index.js

@@ -0,0 +1,320 @@
+// Vendor @hpke/core from https://esm.sh/@hpke/core@1.2.7


We can remove this comment since it's managed by webpack

leeland-turnkey · 2026-02-23T19:06:26Z

export/src/index.js

+    keyDiv.style[styleKey] = style[styleKey];
+  }
+  document.body.appendChild(keyDiv);
+  TKHQ.applySettings(TKHQ.getSettings());


we call applySettings here, but we don't in standalone.js. Do you know the reason why? I'm not sure if it is testing something or not: https://github.com/tkhq/frames/pull/114/changes#diff-1c20a0aebf2920f0209e01ecd1b5ef3cdf3739d0209015550ef3f0a18b83ba9cR156

ethankonk added 2 commits February 5, 2026 18:04

webpackified our export iframe

9373726

fixed sha256 library and bech32 encoding

6c12209

ethankonk requested review from andrewkmin, Copilot and leeland-turnkey February 6, 2026 15:24

Copilot started reviewing on behalf of ethankonk February 6, 2026 15:24 View session

linting and prettier

ed363a1

Copilot AI reviewed Feb 6, 2026

View reviewed changes

ethankonk added 3 commits February 6, 2026 10:55

added back standalone export stuff

f6ab3a0

fixed copilot comments

6e6a6c5

rebuilt import & export-and-sign

9600642

ethankonk force-pushed the ethan/webpackify-export branch from ed8c91c to 0ada54c Compare February 6, 2026 18:49

fixed tests

b6402c6

ethankonk force-pushed the ethan/webpackify-export branch from 0ada54c to b6402c6 Compare February 6, 2026 18:52

leeland-turnkey requested changes Feb 23, 2026

View reviewed changes

ethankonk mentioned this pull request Feb 26, 2026

iframe stamper update for new passphrase encrypted export flow tkhq/sdk#1224

Open

	root /usr/share/nginx/templated/export;
	root /usr/share/nginx/export;

-    optimization: {
+    optimization: {
+     // Reproducible builds so CI "dist matches committed" check passes
+      moduleIds: "deterministic",
+      chunkIds: "deterministic",

		@@ -0,0 +1,320 @@
		// Vendor @hpke/core from https://esm.sh/@hpke/core@1.2.7

Conversation

ethankonk commented Feb 6, 2026

Uh oh!

socket-security bot commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

leeland-turnkey commented Feb 23, 2026

Uh oh!

leeland-turnkey commented Feb 23, 2026

Uh oh!

leeland-turnkey Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

leeland-turnkey Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

leeland-turnkey Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

leeland-turnkey Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

leeland-turnkey Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

socket-security bot commented Feb 6, 2026 •

edited

Loading