@algorandfoundation/react-native-passkey-autofill 1.0.0-canary.2 → 1.0.0-canary.21

package/build/ReactNativePasskeyAutofill.types.d.ts

@@ -1,2 +1,42 @@
-export type ReactNativePasskeyAutofillModuleEvents = {};
+export type ReactNativePasskeyAutofillModuleEvents = {
+    onPasskeyAdded: (event: {
+        success: boolean;
+    }) => void;
+    onPasskeyAuthenticated: (event: {
+        success: boolean;
+        credentialId?: string;
+    }) => void;
+};
+export type PasskeyAutofillCredentialIdentity = {
+    credentialId: string;
+    relyingPartyIdentifier?: string;
+    rpId?: string;
+    origin?: string;
+    userName?: string;
+    name?: string;
+    userHandle: string;
+    userId?: string;
+    privateKey?: string;
+    privateKeyBase64?: string;
+    publicKey?: string;
+    publicKeyBase64?: string;
+    createdAt?: number;
+    lastUsedAt?: number;
+    parentKeyId?: string;
+};
+/**
+ * Capabilities advertised by this credential provider. Exposed so the
+ * surrounding wallet UI / RP-side wallet can know which WebAuthn extensions
+ * are wired up natively before issuing a passkey request.
+ */
+export type PasskeyAutofillCapabilities = {
+    /**
+     * Whether the WebAuthn `prf` extension (a.k.a. `hmac-secret`) is supported
+     * by this credential provider. PRF outputs are derived deterministically
+     * from the wallet HD root secret so that restoring the wallet seed
+     * reproduces the same secrets on another device.
+     */
+    prf: boolean;
+};
+export declare const PASSKEY_AUTOFILL_CAPABILITIES: PasskeyAutofillCapabilities;
 //# sourceMappingURL=ReactNativePasskeyAutofill.types.d.ts.map

package/build/ReactNativePasskeyAutofill.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ReactNativePasskeyAutofill.types.d.ts","sourceRoot":"","sources":["../src/ReactNativePasskeyAutofill.types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,sCAAsC,GAAG,EAEpD,CAAC"}
+{"version":3,"file":"ReactNativePasskeyAutofill.types.d.ts","sourceRoot":"","sources":["../src/ReactNativePasskeyAutofill.types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,sCAAsC,GAAG;IACnD,cAAc,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IACtD,sBAAsB,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACtF,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC;;;;;OAKG;IACH,GAAG,EAAE,OAAO,CAAC;CACd,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,2BAE3C,CAAC"}

package/build/ReactNativePasskeyAutofill.types.js

@@ -1,2 +1,4 @@
-export {};
+export const PASSKEY_AUTOFILL_CAPABILITIES = {
+    prf: true,
+};
 //# sourceMappingURL=ReactNativePasskeyAutofill.types.js.map

package/build/ReactNativePasskeyAutofill.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"ReactNativePasskeyAutofill.types.js","sourceRoot":"","sources":["../src/ReactNativePasskeyAutofill.types.ts"],"names":[],"mappings":"","sourcesContent":["export type ReactNativePasskeyAutofillModuleEvents = {\n\n};\n"]}
+{"version":3,"file":"ReactNativePasskeyAutofill.types.js","sourceRoot":"","sources":["../src/ReactNativePasskeyAutofill.types.ts"],"names":[],"mappings":"AAsCA,MAAM,CAAC,MAAM,6BAA6B,GAAgC;IACxE,GAAG,EAAE,IAAI;CACV,CAAC","sourcesContent":["export type ReactNativePasskeyAutofillModuleEvents = {\n  onPasskeyAdded: (event: { success: boolean }) => void;\n  onPasskeyAuthenticated: (event: { success: boolean; credentialId?: string }) => void;\n};\n\nexport type PasskeyAutofillCredentialIdentity = {\n  credentialId: string;\n  relyingPartyIdentifier?: string;\n  rpId?: string;\n  origin?: string;\n  userName?: string;\n  name?: string;\n  userHandle: string;\n  userId?: string;\n  privateKey?: string;\n  privateKeyBase64?: string;\n  publicKey?: string;\n  publicKeyBase64?: string;\n  createdAt?: number;\n  lastUsedAt?: number;\n  parentKeyId?: string;\n};\n\n/**\n * Capabilities advertised by this credential provider. Exposed so the\n * surrounding wallet UI / RP-side wallet can know which WebAuthn extensions\n * are wired up natively before issuing a passkey request.\n */\nexport type PasskeyAutofillCapabilities = {\n  /**\n   * Whether the WebAuthn `prf` extension (a.k.a. `hmac-secret`) is supported\n   * by this credential provider. PRF outputs are derived deterministically\n   * from the wallet HD root secret so that restoring the wallet seed\n   * reproduces the same secrets on another device.\n   */\n  prf: boolean;\n};\n\nexport const PASSKEY_AUTOFILL_CAPABILITIES: PasskeyAutofillCapabilities = {\n  prf: true,\n};\n"]}

package/build/ReactNativePasskeyAutofillModule.d.ts

@@ -1,12 +1,49 @@
-import { NativeModule } from 'expo';
-import { ReactNativePasskeyAutofillModuleEvents } from './ReactNativePasskeyAutofill.types';
+import { NativeModule } from "expo";
+import { PasskeyAutofillCredentialIdentity, ReactNativePasskeyAutofillModuleEvents } from "./ReactNativePasskeyAutofill.types";
 declare class ReactNativePasskeyAutofillModule extends NativeModule<ReactNativePasskeyAutofillModuleEvents> {
     setMasterKey(secret: string): Promise<void>;
     setHdRootKeyId(id: string): Promise<void>;
     getHdRootKeyId(): Promise<string | null>;
     configureIntentActions(getPasskeyAction: string, createPasskeyAction: string): Promise<void>;
     clearCredentials(): Promise<void>;
+    deleteCredential(credentialId: string): Promise<void>;
+    /**
+     * iOS: returns the identities currently published to the AutoFill
+     * `ASCredentialIdentityStore`. Android: no-op returning `[]` because the
+     * native Credential Provider service reads credentials directly from MMKV
+     * and there is no separate identity store to query.
+     */
+    getStoredCredentials(): Promise<PasskeyAutofillCredentialIdentity[]>;
+    /**
+     * iOS: returns diagnostic strings from the AutoFill extension.
+     * Android: no-op returning `[]`.
+     */
+    getDiagnostics(): Promise<string[]>;
+    /**
+     * Replaces the iOS AutoFill passkey identity store with credentials
+     * available to the native Credential Provider extension. Each item must
+     * include a credential id, relying party (`relyingPartyIdentifier`,
+     * `rpId`, or `origin`), user handle, and P-256 private key material.
+     * Android ignores this method (no-op) because the provider reads MMKV
+     * directly.
+     */
+    replaceCredentialIdentities(credentials: PasskeyAutofillCredentialIdentity[]): Promise<void>;
+    refreshCredentialIdentities(): Promise<void>;
+    /**
+     * Resolves to `true` when this app is registered as the active
+     * credential/autofill provider on the current device (Android 14+
+     * credential provider or iOS AutoFill). Useful for gating passkey UI
+     * and for E2E tests that need to confirm the prompt that appears
+     * belongs to this provider and not a third party.
+     */
+    isProviderActive(): Promise<boolean>;
+    /**
+     * Opens the OS credential/autofill provider settings screen so the
+     * user can enable this app as the active provider. Resolves to `true`
+     * if a settings screen could be launched, `false` otherwise.
+     */
+    openProviderSettings(): Promise<boolean>;
 }
-declare const _default: ReactNativePasskeyAutofillModule;
-export default _default;
+declare const nativeModule: ReactNativePasskeyAutofillModule;
+export default nativeModule;
 //# sourceMappingURL=ReactNativePasskeyAutofillModule.d.ts.map

package/build/ReactNativePasskeyAutofillModule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ReactNativePasskeyAutofillModule.d.ts","sourceRoot":"","sources":["../src/ReactNativePasskeyAutofillModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,MAAM,MAAM,CAAC;AAEzD,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAE5F,OAAO,OAAO,gCAAiC,SAAQ,YAAY,CAAC,sCAAsC,CAAC;IACzG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACzC,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IACxC,sBAAsB,CAAC,gBAAgB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC5F,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;CAClC;;AAGD,wBAAmG"}
+{"version":3,"file":"ReactNativePasskeyAutofillModule.d.ts","sourceRoot":"","sources":["../src/ReactNativePasskeyAutofillModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,MAAM,MAAM,CAAC;AAGzD,OAAO,EACL,iCAAiC,EACjC,sCAAsC,EACvC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,OAAO,gCAAiC,SAAQ,YAAY,CAAC,sCAAsC,CAAC;IACzG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACzC,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IACxC,sBAAsB,CAAC,gBAAgB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC5F,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IACjC,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACrD;;;;;OAKG;IACH,oBAAoB,IAAI,OAAO,CAAC,iCAAiC,EAAE,CAAC;IACpE;;;OAGG;IACH,cAAc,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IACnC;;;;;;;OAOG;IACH,2BAA2B,CAAC,WAAW,EAAE,iCAAiC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAC5F,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IAC5C;;;;;;OAMG;IACH,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IACpC;;;;OAIG;IACH,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC;CACzC;AAGD,QAAA,MAAM,YAAY,kCAEjB,CAAC;AAoBF,eAAe,YAAY,CAAC"}

package/build/ReactNativePasskeyAutofillModule.js

@@ -1,4 +1,23 @@
-import { requireNativeModule } from 'expo';
+import { requireNativeModule } from "expo";
+import { Platform } from "react-native";
 // This call loads the native module object from the JSI.
-export default requireNativeModule('ReactNativePasskeyAutofill');
+const nativeModule = requireNativeModule("ReactNativePasskeyAutofill");
+// A handful of methods are only implemented in the iOS native module because
+// they interact with `ASCredentialIdentityStore`, which has no Android
+// equivalent (the Android Credential Provider service reads credentials
+// directly from MMKV on each request).
+if (Platform.OS === "android") {
+    const noops = {
+        replaceCredentialIdentities: () => Promise.resolve(),
+        refreshCredentialIdentities: () => Promise.resolve(),
+        getStoredCredentials: () => Promise.resolve([]),
+        getDiagnostics: () => Promise.resolve([]),
+    };
+    for (const name of Object.keys(noops)) {
+        if (typeof nativeModule[name] !== "function") {
+            nativeModule[name] = noops[name];
+        }
+    }
+}
+export default nativeModule;
 //# sourceMappingURL=ReactNativePasskeyAutofillModule.js.map

package/build/ReactNativePasskeyAutofillModule.js.map

@@ -1 +1 @@
-{"version":3,"file":"ReactNativePasskeyAutofillModule.js","sourceRoot":"","sources":["../src/ReactNativePasskeyAutofillModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAYzD,yDAAyD;AACzD,eAAe,mBAAmB,CAAmC,4BAA4B,CAAC,CAAC","sourcesContent":["import { NativeModule, requireNativeModule } from 'expo';\n\nimport { ReactNativePasskeyAutofillModuleEvents } from './ReactNativePasskeyAutofill.types';\n\ndeclare class ReactNativePasskeyAutofillModule extends NativeModule<ReactNativePasskeyAutofillModuleEvents> {\n  setMasterKey(secret: string): Promise<void>;\n  setHdRootKeyId(id: string): Promise<void>;\n  getHdRootKeyId(): Promise<string | null>;\n  configureIntentActions(getPasskeyAction: string, createPasskeyAction: string): Promise<void>;\n  clearCredentials(): Promise<void>;\n}\n\n// This call loads the native module object from the JSI.\nexport default requireNativeModule<ReactNativePasskeyAutofillModule>('ReactNativePasskeyAutofill');\n"]}
+{"version":3,"file":"ReactNativePasskeyAutofillModule.js","sourceRoot":"","sources":["../src/ReactNativePasskeyAutofillModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,MAAM,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAoDxC,yDAAyD;AACzD,MAAM,YAAY,GAAG,mBAAmB,CACtC,4BAA4B,CAC7B,CAAC;AAEF,6EAA6E;AAC7E,uEAAuE;AACvE,wEAAwE;AACxE,uCAAuC;AACvC,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;IAC9B,MAAM,KAAK,GAA6D;QACtE,2BAA2B,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;QACpD,2BAA2B,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;QACpD,oBAAoB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;KAC1C,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,OAAQ,YAAmD,CAAC,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YACpF,YAAmD,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;AACH,CAAC;AAED,eAAe,YAAY,CAAC","sourcesContent":["import { NativeModule, requireNativeModule } from \"expo\";\nimport { Platform } from \"react-native\";\n\nimport {\n  PasskeyAutofillCredentialIdentity,\n  ReactNativePasskeyAutofillModuleEvents,\n} from \"./ReactNativePasskeyAutofill.types\";\n\ndeclare class ReactNativePasskeyAutofillModule extends NativeModule<ReactNativePasskeyAutofillModuleEvents> {\n  setMasterKey(secret: string): Promise<void>;\n  setHdRootKeyId(id: string): Promise<void>;\n  getHdRootKeyId(): Promise<string | null>;\n  configureIntentActions(getPasskeyAction: string, createPasskeyAction: string): Promise<void>;\n  clearCredentials(): Promise<void>;\n  deleteCredential(credentialId: string): Promise<void>;\n  /**\n   * iOS: returns the identities currently published to the AutoFill\n   * `ASCredentialIdentityStore`. Android: no-op returning `[]` because the\n   * native Credential Provider service reads credentials directly from MMKV\n   * and there is no separate identity store to query.\n   */\n  getStoredCredentials(): Promise<PasskeyAutofillCredentialIdentity[]>;\n  /**\n   * iOS: returns diagnostic strings from the AutoFill extension.\n   * Android: no-op returning `[]`.\n   */\n  getDiagnostics(): Promise<string[]>;\n  /**\n   * Replaces the iOS AutoFill passkey identity store with credentials\n   * available to the native Credential Provider extension. Each item must\n   * include a credential id, relying party (`relyingPartyIdentifier`,\n   * `rpId`, or `origin`), user handle, and P-256 private key material.\n   * Android ignores this method (no-op) because the provider reads MMKV\n   * directly.\n   */\n  replaceCredentialIdentities(credentials: PasskeyAutofillCredentialIdentity[]): Promise<void>;\n  refreshCredentialIdentities(): Promise<void>;\n  /**\n   * Resolves to `true` when this app is registered as the active\n   * credential/autofill provider on the current device (Android 14+\n   * credential provider or iOS AutoFill). Useful for gating passkey UI\n   * and for E2E tests that need to confirm the prompt that appears\n   * belongs to this provider and not a third party.\n   */\n  isProviderActive(): Promise<boolean>;\n  /**\n   * Opens the OS credential/autofill provider settings screen so the\n   * user can enable this app as the active provider. Resolves to `true`\n   * if a settings screen could be launched, `false` otherwise.\n   */\n  openProviderSettings(): Promise<boolean>;\n}\n\n// This call loads the native module object from the JSI.\nconst nativeModule = requireNativeModule<ReactNativePasskeyAutofillModule>(\n  \"ReactNativePasskeyAutofill\",\n);\n\n// A handful of methods are only implemented in the iOS native module because\n// they interact with `ASCredentialIdentityStore`, which has no Android\n// equivalent (the Android Credential Provider service reads credentials\n// directly from MMKV on each request).\nif (Platform.OS === \"android\") {\n  const noops: Record<string, (...args: unknown[]) => Promise<unknown>> = {\n    replaceCredentialIdentities: () => Promise.resolve(),\n    refreshCredentialIdentities: () => Promise.resolve(),\n    getStoredCredentials: () => Promise.resolve([]),\n    getDiagnostics: () => Promise.resolve([]),\n  };\n  for (const name of Object.keys(noops)) {\n    if (typeof (nativeModule as unknown as Record<string, unknown>)[name] !== \"function\") {\n      (nativeModule as unknown as Record<string, unknown>)[name] = noops[name];\n    }\n  }\n}\n\nexport default nativeModule;\n"]}

package/build/index.d.ts

@@ -1,3 +1,3 @@
-export { default } from './ReactNativePasskeyAutofillModule';
-export * from './ReactNativePasskeyAutofill.types';
+export { default } from "./ReactNativePasskeyAutofillModule";
+export * from "./ReactNativePasskeyAutofill.types";
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,oCAAoC,CAAC;AAC7D,cAAe,oCAAoC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,oCAAoC,CAAC;AAC7D,cAAc,oCAAoC,CAAC"}

package/build/index.js

@@ -1,5 +1,5 @@
 // Reexport the native module. On web, it will be resolved to ReactNativePasskeyAutofillModule.web.ts
 // and on native platforms to ReactNativePasskeyAutofillModule.ts
-export { default } from './ReactNativePasskeyAutofillModule';
-export * from './ReactNativePasskeyAutofill.types';
+export { default } from "./ReactNativePasskeyAutofillModule";
+export * from "./ReactNativePasskeyAutofill.types";
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,iEAAiE;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,oCAAoC,CAAC;AAC7D,cAAe,oCAAoC,CAAC","sourcesContent":["// Reexport the native module. On web, it will be resolved to ReactNativePasskeyAutofillModule.web.ts\n// and on native platforms to ReactNativePasskeyAutofillModule.ts\nexport { default } from './ReactNativePasskeyAutofillModule';\nexport * from  './ReactNativePasskeyAutofill.types';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,iEAAiE;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,oCAAoC,CAAC;AAC7D,cAAc,oCAAoC,CAAC","sourcesContent":["// Reexport the native module. On web, it will be resolved to ReactNativePasskeyAutofillModule.web.ts\n// and on native platforms to ReactNativePasskeyAutofillModule.ts\nexport { default } from \"./ReactNativePasskeyAutofillModule\";\nexport * from \"./ReactNativePasskeyAutofill.types\";\n"]}

package/e2e/README.md

@@ -0,0 +1,155 @@
+# E2E — Appium + WebdriverIO
+
+End-to-end tests driving the `example/` app with [Appium 2](https://appium.io)
+through [WebdriverIO](https://webdriver.io). Tests are written in TypeScript
+and executed with Jest (to stay consistent with the rest of the repo).
+
+The happy-path test mirrors the example app: it mints a local XHD Ed25519
+key, creates a passkey against `https://debug.liquidauth.com`, and then
+re-uses it for an assertion round-trip.
+
+## Layout
+
+```
+e2e/
+├── driver/
+│   ├── capabilities.ts   # Android (UiAutomator2) + iOS (XCUITest) caps
+│   ├── selectors.ts      # testID + system-dialog helpers
+│   └── session.ts        # createDriver() — wraps webdriverio.remote()
+├── tests/
+│   └── passkey.test.ts   # smoke + passkey create/use against debug.liquidauth.com
+├── jest.config.ts
+├── package.json
+└── tsconfig.json
+```
+
+All app-level taps use React Native `testID`s (exposed as
+`accessibility id` on both platforms) via `byTestId("...")`. System
+WebAuthn/biometric dialogs are auto-confirmed by `confirmSystemPrompt()`.
+
+## Provider-active precondition
+
+The example app exposes a provider-status banner so the suite (and
+human testers) can confirm that _this_ package is the user-selected
+system credential/autofill provider before exercising passkey flows —
+otherwise another installed password manager could silently serve the
+system WebAuthn prompts. The example exposes:
+
+- A `testID="provider-status"` label whose text reads `active`,
+  `inactive`, or `unknown`.
+- A `testID="open-provider-settings"` CTA that deep-links to the OS
+  settings (Android: credential provider picker; iOS: AutoFill
+  settings).
+
+The first suite step (`surfaces the initial provider status`) is a
+smoke read only. The authoritative assertion runs after the passkey
+creation step: once Android has routed a
+`BeginCreate/BeginGetCredentialRequest` to our
+`PasskeyAutofillCredentialProviderService`, the service stamps an MMKV
+key that `ReactNativePasskeyAutofill.isProviderActive()` picks up and
+the banner flips to `active`. This two-signal design sidesteps the
+fact that `Settings.Secure("credential_service")` is `@hide`-restricted
+on Android 12+ and cannot be read by a regular app.
+
+If the passkey flow never reaches the stamp, enable the app manually
+on the device:
+
+- **Android 14+**: Settings → Passwords, passkeys & accounts →
+  Additional providers → _Passkey AutoFill Example_.
+- **iOS 17+**: Settings → Passwords → Password Options → enable
+  _Passkey AutoFill Example_.
+
+## Biometric prompts
+
+The passkey create/use flow ultimately routes through either the
+system's Single-Tap bottom sheet (when the provider attaches
+`BiometricPromptData` + `CryptoObject`) or the fallback
+`CreatePasskeyActivity` / `GetPasskeyActivity` screens. Both require a
+biometric confirmation from the user. On emulators the suite automates
+this by synthesising finger touches via `adb` (Android) or the
+`enrollBiometric` extension (iOS).
+
+## Prerequisites
+
+- Node.js 22+, pnpm 10+
+- **Android**: Android SDK, an AVD (API 34 recommended). Biometrics
+  are automatically enrolled by the suite on first run.
+- **iOS** (macOS only): Xcode 16.1+, an iOS 17+ Simulator. Face ID is
+  automatically enrolled by the suite.
+- Appium drivers. The driver packages are declared as regular `devDependencies`
+  and installed by `pnpm install`, so they are version-locked alongside the
+  rest of the workspace. The `appium:setup*` scripts then register them with
+  the Appium CLI from their local `node_modules` path (no `npm` shell-out,
+  no global `~/.appium` mutation required beyond Appium's own manifest):
+
+  ```bash
+  pnpm install                   # installs appium-uiautomator2-driver & appium-xcuitest-driver
+  pnpm run appium:setup          # register both drivers with Appium
+  pnpm run appium:setup:android  # Android only
+  pnpm run appium:setup:ios      # iOS only (macOS)
+  ```
+
+## Running locally
+
+1. Install repo deps:
+
+   ```bash
+   pnpm install
+   ```
+
+2. Build the example app for the target platform:
+
+   ```bash
+   pnpm run e2e:build:android   # produces example/android/app/build/outputs/apk/release/app-release.apk
+   pnpm run e2e:build:ios       # produces example/ios/build/Build/Products/Release-iphonesimulator/PasskeyAutofillExample.app
+   ```
+
+3. Boot an emulator/simulator, then run:
+
+   ```bash
+   pnpm run e2e:android
+   # or
+   pnpm run e2e:ios
+   ```
+
+   These scripts start Appium via `start-server-and-test`, wait for
+   `http://127.0.0.1:4723/status`, execute the Jest suite, and shut
+   Appium down afterwards.
+
+### Overrides
+
+| Env var                      | Purpose                                          |
+| ---------------------------- | ------------------------------------------------ |
+| `E2E_PLATFORM`               | `android` (default) or `ios`                     |
+| `E2E_APP_PATH`               | Absolute path to a prebuilt `.apk` / `.app`      |
+| `APPIUM_HOST`, `APPIUM_PORT` | Appium server (defaults `127.0.0.1:4723`)        |
+| `ANDROID_PLATFORM_VERSION`   | e.g. `"14"`                                      |
+| `ANDROID_DEVICE_NAME`        | e.g. `"Pixel_6_API_34"`                          |
+| `IOS_PLATFORM_VERSION`       | e.g. `"17.5"`                                    |
+| `IOS_DEVICE_NAME`            | e.g. `"iPhone 15"`                               |
+| `WDIO_LOG_LEVEL`             | `error` \| `warn` (default) \| `info` \| `debug` |
+
+## CI
+
+The [`E2E` workflow](../.github/workflows/e2e.yml) runs on
+`workflow_dispatch` or when a PR is labelled `e2e`:
+
+- **Android** job builds the release APK, installs the UiAutomator2 driver,
+  and runs the suite inside `reactivecircus/android-emulator-runner`.
+- **iOS** job (currently disabled) builds the `.app` for the iPhone Simulator,
+  installs the XCUITest driver, boots a simulator, and runs the suite.
+
+Screenshots of the test run are uploaded as workflow artifacts for debugging.
+
+## Authoring new tests
+
+1. Add a stable `testID` to the target React Native component.
+2. Import the helpers:
+
+   ```ts
+   import { createDriver } from "../driver/session";
+   import { byTestId, tap, confirmSystemPrompt } from "../driver/selectors";
+   ```
+
+3. Drive the app with `tap(driver, byTestId("..."))`. Use
+   `confirmSystemPrompt()` for OS-level WebAuthn/biometric dialogs.

package/e2e/driver/adb.ts

@@ -0,0 +1,73 @@
+import { execFile, execFileSync } from "node:child_process";
+
+/**
+ * Common ADB helpers to ensure consistent device targeting across the E2E suite.
+ */
+
+export function getAdbSerial(): string {
+  if (process.env.ANDROID_UDID) return process.env.ANDROID_UDID;
+
+  // Try to find the first connected emulator or device.
+  try {
+    const devices = execFileSync("adb", ["devices"], {
+      encoding: "utf8",
+      timeout: 5000,
+    })
+      .split("\n")
+      .slice(1)
+      .filter((l) => l.includes("\tdevice"))
+      .map((l) => l.split("\t")[0].trim());
+
+    if (devices.length === 1) return devices[0];
+    if (devices.length > 1) {
+      const emulators = devices.filter((d) => d.startsWith("emulator-"));
+      if (emulators.length > 0) return emulators[0];
+      return devices[0];
+    }
+  } catch (err) {
+    // eslint-disable-next-line no-console
+    console.warn("[e2e:adb] failed to list devices via adb:", (err as Error).message);
+  }
+
+  return "emulator-5554";
+}
+
+/**
+ * Wrap adb so we can swap serials / run headless without inheriting
+ * stdin from the caller (Jest runners hate dangling fds).
+ */
+export function adb(args: string[], opts: { timeout?: number } = {}): string {
+  const serial = getAdbSerial();
+  try {
+    return execFileSync("adb", ["-s", serial, ...args], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: opts.timeout ?? 15_000,
+    }).trim();
+  } catch (err) {
+    const error = err as Error & { stderr?: string };
+    const msg = error.stderr ? `${error.message}\n${error.stderr}` : error.message;
+    throw new Error(`adb command failed: adb -s ${serial} ${args.join(" ")}\n${msg}`);
+  }
+}
+
+export function adbSilent(args: string[]): string {
+  try {
+    const serial = getAdbSerial();
+    return execFileSync("adb", ["-s", serial, ...args], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 15_000,
+    }).trim();
+  } catch {
+    return "";
+  }
+}
+
+export function adbAsync(args: string[]): void {
+  // Fire-and-forget, used for the finger-touch spam where we don't
+  // want to block the test thread on adb's per-call latency (~50ms).
+  const serial = getAdbSerial();
+  const child = execFile("adb", ["-s", serial, ...args], () => undefined);
+  child.stdin?.end();
+}

package/e2e/driver/capabilities.ts

@@ -0,0 +1,106 @@
+import path from "node:path";
+
+/**
+ * Platform target for the E2E run. Selected via the `E2E_PLATFORM`
+ * environment variable (defaults to `android`).
+ */
+export type Platform = "android" | "ios";
+
+export const PLATFORM: Platform = (process.env.E2E_PLATFORM as Platform | undefined) ?? "android";
+
+/** Example app identifiers (must match `example/app.json`). */
+export const ANDROID_PACKAGE = "co.algorand.auth.example";
+export const IOS_BUNDLE_ID = "co.algorand.auth.example";
+
+/**
+ * Absolute paths to the built example app binaries. Override with
+ * `E2E_APP_PATH` to point at a prebuilt artifact in CI. When omitted
+ * the helpers below fall back to the default expo-built location.
+ */
+const repoRoot = path.resolve(__dirname, "..", "..");
+const defaultAndroidApk = path.join(
+  repoRoot,
+  "example",
+  "android",
+  "app",
+  "build",
+  "outputs",
+  "apk",
+  "release",
+  "app-release.apk",
+);
+const defaultIosApp = path.join(
+  repoRoot,
+  "example",
+  "ios",
+  "build",
+  "Build",
+  "Products",
+  "Release-iphonesimulator",
+  "PasskeyAutofillExample.app",
+);
+
+export const ANDROID_APP_PATH = process.env.E2E_APP_PATH ?? defaultAndroidApk;
+export const IOS_APP_PATH = process.env.E2E_APP_PATH ?? defaultIosApp;
+
+export const APPIUM_HOST = process.env.APPIUM_HOST ?? "127.0.0.1";
+export const APPIUM_PORT = Number(process.env.APPIUM_PORT ?? 4723);
+
+export interface Capabilities {
+  [key: string]: unknown;
+}
+
+/**
+ * Android (UiAutomator2) capabilities. `noReset: false` ensures a clean
+ * keystore/passkey state between runs so tests are idempotent.
+ */
+export const androidCapabilities: Capabilities = {
+  platformName: "Android",
+  "appium:automationName": "UiAutomator2",
+  // `platformVersion` is intentionally only set when explicitly provided:
+  // when omitted, UiAutomator2 attaches to whichever device is currently
+  // connected via `adb`, which is the common case on a developer laptop.
+  ...(process.env.ANDROID_PLATFORM_VERSION
+    ? { "appium:platformVersion": process.env.ANDROID_PLATFORM_VERSION }
+    : {}),
+  // Pin the target device when set (matches `ANDROID_UDID` used by the adb
+  // helpers) so a run is deterministic when multiple devices are attached.
+  ...(process.env.ANDROID_UDID ? { "appium:udid": process.env.ANDROID_UDID } : {}),
+  "appium:deviceName": process.env.ANDROID_DEVICE_NAME ?? "Android Emulator",
+  "appium:app": ANDROID_APP_PATH,
+  "appium:appPackage": ANDROID_PACKAGE,
+  "appium:autoGrantPermissions": true,
+  "appium:noReset": false,
+  "appium:fullReset": false,
+  "appium:newCommandTimeout": 240,
+  // Bumped to absorb cold-AVD session-install flakes: on a fresh
+  // `google_apis_playstore` AVD, the UiAutomator2 server APK + the
+  // `io.appium.settings` helper app can occasionally take longer than
+  // the 30s default to install and start, producing
+  // `Appium Settings app is not running after 30000ms` at session
+  // creation. These knobs are the documented escape hatches.
+  "appium:uiautomator2ServerInstallTimeout": 120_000,
+  "appium:uiautomator2ServerLaunchTimeout": 120_000,
+  "appium:uiautomator2ServerReadTimeout": 240_000,
+  "appium:adbExecTimeout": 60_000,
+  "appium:appWaitActivity": "*",
+  "appium:appWaitDuration": 60_000,
+};
+
+/**
+ * iOS (XCUITest) capabilities. Targets the simulator.
+ */
+export const iosCapabilities: Capabilities = {
+  platformName: "iOS",
+  "appium:automationName": "XCUITest",
+  "appium:platformVersion": process.env.IOS_PLATFORM_VERSION ?? "17.5",
+  "appium:deviceName": process.env.IOS_DEVICE_NAME ?? "iPhone 15",
+  "appium:app": IOS_APP_PATH,
+  "appium:bundleId": IOS_BUNDLE_ID,
+  "appium:noReset": false,
+  "appium:newCommandTimeout": 240,
+};
+
+export function capabilitiesForPlatform(platform: Platform = PLATFORM): Capabilities {
+  return platform === "ios" ? iosCapabilities : androidCapabilities;
+}

package/e2e/driver/credentialProvider.ts

@@ -0,0 +1,104 @@
+import { PLATFORM, ANDROID_PACKAGE } from "./capabilities";
+import { adbSilent } from "./adb";
+
+/**
+ * Credential Manager provider registration helper (Android only).
+ *
+ * Why this file exists
+ * --------------------
+ * On Android 14 the Credential Manager only routes `BeginCreate*` /
+ * `BeginGet*` requests to credential-provider services that the user has
+ * explicitly enabled in Settings → Passwords, passkeys & accounts →
+ * Additional providers. A freshly booted AVD has **no** providers
+ * enabled, so:
+ *
+ *   - `handleCreatePasskey` opens a Credential Manager sheet that lists
+ *     zero providers, the consent screen is dismissed by the system, and
+ *     our service never receives a `BeginCreateCredentialRequest` — so
+ *     `provider-status` stays `inactive` forever.
+ *   - Every test after "creates an XHD Ed25519 key" then fails because
+ *     the passkey flow deadlocks on an empty system UI.
+ *
+ * Settings → Additional providers writes the enabled component names to
+ * the secure setting `credential_service` (comma-separated) and the
+ * primary provider to `credential_service_primary`. We can do the same
+ * thing via `adb shell settings put secure ...` — the `adb shell` user
+ * already holds `WRITE_SECURE_SETTINGS`, so no root / magisk required.
+ *
+ * This helper is idempotent and a no-op on iOS / when the
+ * target APK isn't installed.
+ */
+
+function isAndroidTarget(): boolean {
+  return PLATFORM === "android";
+}
+
+let registered = false;
+
+/**
+ * Enable our passkey provider service as the system's credential
+ * provider so Credential Manager actually routes requests to it.
+ *
+ * Returns `true` if the `credential_service` secure setting ends up
+ * containing our component. Safe to call repeatedly; no-ops on iOS.
+ */
+// Must stay in sync with `android/src/main/AndroidManifest.xml` and
+// `android/build.gradle` (`namespace`). The component name is:
+//   <applicationId>/<library-namespace>.service.PasskeyAutofillCredentialProviderService
+// i.e. the host app id + the FQCN of the service declared by the
+// library whose manifest is merged into the example app.
+const SERVICE_FQCN = "co.algorand.passkeyautofill.service.PasskeyAutofillCredentialProviderService";
+
+export async function ensureAndroidCredentialProviderEnabled(): Promise<boolean> {
+  if (!isAndroidTarget()) return false;
+  if (registered) return true;
+
+  const component = `${ANDROID_PACKAGE}/${SERVICE_FQCN}`;
+
+  // Guard: the service must actually be installed — otherwise the
+  // Credential Manager silently drops the component on first use and
+  // our `settings put` is effectively a no-op.
+  const pmCheck = adbSilent(["shell", "pm", "list", "packages", ANDROID_PACKAGE]);
+  if (!pmCheck.includes(ANDROID_PACKAGE)) {
+    // eslint-disable-next-line no-console
+    console.warn(
+      `[e2e] credential-provider: ${ANDROID_PACKAGE} not installed yet; ` +
+        "skipping provider registration.",
+    );
+    return false;
+  }
+
+  // Write both the primary slot and the list slot. Different AOSP
+  // builds read one or the other (Android 14 stock uses
+  // `credential_service_primary` for the default, `credential_service`
+  // for additional providers); setting both makes us the only
+  // configured provider either way.
+  adbSilent(["shell", "settings", "put", "secure", "credential_service", component]);
+  adbSilent(["shell", "settings", "put", "secure", "credential_service_primary", component]);
+
+  // Some OEM Settings UIs also persist the enabled providers into
+  // `autofill_service` when Autofill & Credential Manager share the
+  // provider. Best-effort mirror; failure is fine.
+  adbSilent(["shell", "settings", "put", "secure", "autofill_service", component]);
+
+  // Verify what the system actually stored. `settings get` returns the
+  // literal value or "null" if unset.
+  const got = adbSilent(["shell", "settings", "get", "secure", "credential_service"]);
+  const gotPrimary = adbSilent([
+    "shell",
+    "settings",
+    "get",
+    "secure",
+    "credential_service_primary",
+  ]);
+
+  const ok = got.includes(component) || gotPrimary.includes(component);
+  // eslint-disable-next-line no-console
+  console.log(
+    `[e2e] credential-provider: component=${component} registered=${ok} ` +
+      `(credential_service=${got || "null"}, primary=${gotPrimary || "null"})`,
+  );
+
+  registered = ok;
+  return ok;
+}