@algorandfoundation/react-native-passkey-autofill 1.0.0-canary.26 → 1.0.0-canary.28

package/ARCHITECTURE.md

@@ -43,7 +43,7 @@ Introduced in Android 14 (API level 34) and backported to Android 9 via the Jetp
 The "Chain of Trust" ensures that passkeys are only used by the legitimate owners of a domain or application. This is handled through several layers of validation:
 
 1.  **Digital Asset Links**: For a passkey to be used across a website and an Android app, the website must host a `/.well-known/assetlinks.json` file that explicitly authorizes the Android app (via its package name and certificate fingerprint). This establishes a cryptographically verified link between the web origin and the mobile application.
-2.  **Relying Party ID (rpId) Validation**: When the service receives a `BeginGetCredentialRequest` or `BeginCreateCredentialRequest`, it includes information about the `rpId` (e.g., `example.com`). The system and the provider must ensure that the requesting app is authorized to use credentials for that `rpId`.
+2.  **Relying Party ID (rpId) Validation**: When the service receives a `BeginGetCredentialRequest` or `BeginCreateCredentialRequest`, it includes information about the `rpId` (e.g., `example.com`). The system verifies that the requesting app is authorized for that `rpId`; the provider then enforces credential scope itself (`credentials/RelyingParty.kt`): a get request is resolved to an effective RP ID (the request's `rpId`, else the calling app's `android:apk-key-hash:` origin), only credentials stored for that RP are offered as entries, and `GetPasskeyActivity` re-checks the selected credential against the request before any private material is loaded. A request that names no relying party gets no entries. Related Origin Requests are not supported.
 3.  **App Signature Verification**: The Android system verifies the signature of the app requesting the credential. It will only offer credentials to apps that can prove their identity through the Digital Asset Link chain.
 4.  **User Consent**: The `CredentialProviderService` does not directly return the credential. Instead, it returns a list of "Entries" (like `PublicKeyCredentialEntry`). When a user selects an entry, a `PendingIntent` is triggered, which typically launches an activity (like `GetPasskeyActivity`) to perform user verification (e.g., biometric check) before the actual passkey is released to the requesting app.
 
@@ -62,7 +62,7 @@ The following methods are exposed to the JavaScript layer:
 - `setMainKeyId(id: string)`: Sets the ID for the P-256 main key (the parent secret for passkey derivation). The legacy `setHdRootKeyId` remains as a deprecated alias.
 - `getMainKeyId()`: Retrieves the current P-256 main key ID.
 - `configureIntentActions(getPasskeyAction: string, createPasskeyAction: string)`: Configures the intent actions used for Passkey flows.
-- `clearCredentials()`: Clears all stored credentials.
+- `clearCredentials()`: Removes every passkey this module owns. On Android the passkeys MMKV instance is the wallet's own keystore namespace, so this is a record-by-record sweep of positively identified passkey records, never a `clearAll()`; `deleteCredential(id)` applies the same ownership check before removing anything.
 - `isProviderActive()`: Returns `true` if this app is the user-selected system credential/autofill provider. Uses Android's `Settings.Secure("credential_service"[_primary])` (API 34+) and iOS's `ASCredentialIdentityStore.getState`. Useful both for gating passkey UI at runtime and for E2E tests, which need to confirm that an OS passkey prompt is served by _this_ provider rather than any other installed one.
 - `openProviderSettings()`: Deep-links the user to the OS credential/autofill provider settings so they can enable this app as the active provider. Resolves to `true` if a settings screen could be launched.
 
@@ -70,6 +70,16 @@ The following methods are exposed to the JavaScript layer:
 
 As this module handles sensitive information (Passkeys), keys and secrets are handled securely in the native layers. The master key is stored in platform secure storage — never in plaintext: on Android it is AES/GCM-encrypted under the AndroidKeyStore, and on iOS it is held in the Keychain (`kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly`) within a shared keychain access group so the app and the AutoFill extension can both read it. It is deliberately not biometric-gated, because the extension must read it to enumerate credentials before the user authenticates; biometric verification is applied at the assertion step instead. The master key crosses the JS↔native bridge as raw bytes (`Uint8Array`), never as a hex string.
 
+Encryption is a precondition, not a best effort. On Android, `setMasterKey` rejects its promise (code `ERR_MASTER_KEY`) if the key is not 32 bytes, cannot be stored in the AndroidKeyStore-backed Keychain, does not read back, or fails a seal/open round trip; nothing is silently logged and swallowed. `saveCredential` refuses to write a record when no master key is available (it throws `MasterKeyUnavailableException` and the create flow returns a `CreateCredentialUnknownException` to the relying party), so a P-256 private key is never persisted without AES-256-GCM. The Credential Provider service only offers `CreateEntry` / credential entries once the master key both reads back and passes the round trip.
+
+### Logging
+
+All Android logging goes through `utils/PasskeyLog.kt`. Debug and info lines are emitted only when the host app is debuggable and are stripped from release builds; warnings and errors are always emitted but carry fixed messages and non-sensitive fields only. Request and response JSON, credential ids, user ids and handles, challenges, ciphers, signatures, PRF outputs and key material are never logged at any level. `LoggingPolicyTest` fails the unit test run if any other file in the module imports `android.util.Log`.
+
+### User verification and the UV flag
+
+The `UV` bit in `authenticatorData` is only set when a user-verification ceremony ran for that operation (`auth/UserVerification.kt`). Both activities track whether the system's Credential Manager prompt reported success and whether a `BiometricPrompt` they showed succeeded, and derive the flag from those two facts when the response is built. A request with `userVerification: "required"` runs a manual prompt whenever the system did not verify, and fails if no ceremony completes; `preferred` and `discouraged` may proceed without one, with `UV` clear. `UP` stays set, since choosing the entry in the system chooser is the presence gesture.
+
 ## End-to-End Tests
 
 The `e2e/` workspace drives the `example/` app with Appium 2 + WebdriverIO, executed through Jest. The Android job uses the UiAutomator2 driver; the iOS job uses XCUITest. The happy-path spec mirrors the example and exercises passkey registration and assertion against `https://debug.liquidauth.com`. See [`e2e/README.md`](./e2e/README.md) for local usage and the [`E2E` workflow](./.github/workflows/e2e.yml) for CI.

package/CHANGELOG.md

@@ -1,3 +1,22 @@
+# [1.0.0-canary.28](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.27...v1.0.0-canary.28) (2026-09-29)
+
+### Bug Fixes
+
+- restrict client hash to privileged list ([d17cea0](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/d17cea058745b5de0103d4ccd767885a2d185981))
+
+# [1.0.0-canary.27](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.26...v1.0.0-canary.27) (2026-09-22)
+
+### Bug Fixes
+
+- **android:** drop the legacy re-seal migration; the unsealed write path was unreachable ([12e16f4](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/12e16f4c9a1ac3e6c583e3a1026d9799a10801e3)), closes [#24](https://github.com/algorandfoundation/react-native-passkey-autofill/issues/24)
+- **android:** fail closed when the passkey master key is unavailable ([56dbb8b](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/56dbb8ba78b9b517b1f2fa8db8e75cdf527a0909))
+- **android:** offer and sign only credentials scoped to the requesting relying party ([ce715f5](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/ce715f5c680279478baea3b3ac87e4d663794244))
+- **android:** only delete records this module owns from the shared keystore ([2fe3d08](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/2fe3d088dafaaf6c34d755233dc77ba2fd6b9188))
+- **android:** route logging through PasskeyLog and stop logging ceremony data ([15ee108](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/15ee108e4c9171548f27ab1b8a4a9fc98a85812c))
+- **android:** set the WebAuthn UV flag only when a verification ceremony ran ([a2321b5](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/a2321b501bb3211e3e4c617eb806244fcc0eb51a))
+- enumerate passkeys as metadata only; open one private key after selection ([7b03f81](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/7b03f81c171ed686e8410f8e3fe3dbdab5b987cf))
+- **ios:** pin the deterministic-P256 Swift package to a commit revision ([a9e8c85](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/a9e8c85653239d44acc053933f55da803175480f))
+
 # [1.0.0-canary.26](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.25...v1.0.0-canary.26) (2026-08-17)
 
 ### Bug Fixes

package/README.md

@@ -98,6 +98,9 @@ For iOS integration, make sure that:
 - The app has a `webcredentials:<domain>` associated domain, and that domain serves a valid `apple-app-site-association` file for the app identifier.
 - The deployment target is iOS 17 or newer for passkey credential provider support.
 - The generated extension target can link `AuthenticationServices.framework`, `CryptoKit.framework`, `MMKVCore`, and the deterministic P-256 Swift package.
+
+The deterministic P-256 Swift package is pinned to an exact upstream commit, not a branch, because it derives passkey keys from the wallet's root material and produces the signatures; a branch head can change between two prebuilds of the same wallet commit. To move the pin, set `deterministicP256PackageRevision` in the plugin props to a full 40-character commit SHA you have reviewed. The former `deterministicP256PackageBranch` prop is rejected. CI checks the generated Xcode project for any Swift package requirement that is not a commit revision.
+
 - `NSFaceIDUsageDescription` is present when biometric authentication is used.
 
 At runtime, the app must provide the native side with the master key, identify the P-256 main key (the parent secret for passkey derivation) stored in MMKV, and keep the iOS identity store in sync:
@@ -118,7 +121,9 @@ Call `refreshCredentialIdentities()` after creating, importing, deleting, or res
 import ReactNativePasskeyAutofill from "@algorandfoundation/react-native-passkey-autofill";
 
 // 1. Set the master key for encryption (raw bytes — never a hex string, so
-//    the secret isn't materialized as a non-zeroable JS string)
+//    the secret isn't materialized as a non-zeroable JS string). The promise
+//    REJECTS if the key cannot be stored and verified; until it resolves no
+//    passkey can be created, so surface the failure rather than continuing.
 await ReactNativePasskeyAutofill.setMasterKey(masterKeyBytes);
 
 // 2. Set the P-256 main key ID (parent secret for passkey derivation).

package/android/src/main/AndroidManifest.xml

@@ -1,6 +1,8 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
           xmlns:tools="http://schemas.android.com/tools">
     <uses-permission android:name="android.permission.USE_BIOMETRIC"/>
+    <!-- Refreshes Google's privileged-browser allowlist (PrivilegedBrowserAllowlist). -->
+    <uses-permission android:name="android.permission.INTERNET"/>
     <application>
         <service
             android:name=".service.PasskeyAutofillCredentialProviderService"

package/android/src/main/java/co/algorand/passkeyautofill/CreatePasskeyActivity.kt

@@ -5,7 +5,7 @@ import android.app.Activity
 import android.content.Intent
 import android.os.Build
 import android.os.Bundle
-import android.util.Log
+import co.algorand.passkeyautofill.utils.PasskeyLog
 import android.graphics.Color
 import android.graphics.Typeface
 import android.view.Gravity
@@ -17,15 +17,19 @@ import androidx.annotation.RequiresApi
 import androidx.appcompat.app.AppCompatActivity
 import androidx.credentials.CreatePublicKeyCredentialRequest
 import androidx.credentials.CreatePublicKeyCredentialResponse
+import androidx.credentials.exceptions.CreateCredentialUnknownException
 import androidx.credentials.provider.PendingIntentHandler
 import androidx.credentials.provider.ProviderCreateCredentialRequest
 import androidx.credentials.webauthn.AuthenticatorAttestationResponse
 import androidx.credentials.webauthn.FidoPublicKeyCredential
 import androidx.credentials.webauthn.PublicKeyCredentialCreationOptions
 import co.algorand.passkeyautofill.auth.BiometricRequirement
+import co.algorand.passkeyautofill.auth.UserVerification
 import co.algorand.passkeyautofill.credentials.CredentialRepository
 import co.algorand.passkeyautofill.credentials.Credential
+import co.algorand.passkeyautofill.credentials.MasterKeyUnavailableException
 import co.algorand.passkeyautofill.utils.PasskeyUtils
+import co.algorand.passkeyautofill.utils.PrivilegedBrowserAllowlist
 import java.security.KeyPair
 import android.util.Base64 as AndroidBase64
 import androidx.biometric.BiometricPrompt
@@ -46,6 +50,8 @@ class CreatePasskeyActivity : AppCompatActivity() {
 
     private var origin: String = "unknown-origin" // Derivation origin (rpId or hash)
     private var displayOrigin: String = "unknown-origin"
+    /** The verified web origin when the caller is an allow-listed privileged browser; null for every ordinary app. */
+    private var privilegedOrigin: String? = null
     private var userHandle: String = "unknown-user"
     private var userName: String = "User"
     private var userId: String = "unknown-id"
@@ -53,29 +59,36 @@ class CreatePasskeyActivity : AppCompatActivity() {
     private var bundleRequestJson: String? = null
     private var request: ProviderCreateCredentialRequest? = null
     private var biometricPromptResult: Any? = null
+
+    /** The system's Credential Manager prompt ran for this operation and succeeded. */
+    private var systemVerified: Boolean = false
     private var systemUnlockedCipher: javax.crypto.Cipher? = null
     private var isHandling: Boolean = false
 
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
-        Log.i(TAG, "onCreate started")
+        PasskeyLog.init(this)
+        PasskeyLog.i(TAG, "onCreate started")
         
         request = try {
             PendingIntentHandler.retrieveProviderCreateCredentialRequest(intent)
         } catch (e: Exception) {
-            Log.e(TAG, "Error retrieving request from intent", e)
+            PasskeyLog.e(TAG, "Error retrieving request from intent", e)
             null
         }
-        Log.i(TAG, "Retrieved request: $request")
+        PasskeyLog.i(TAG, "Retrieved request: present=${request != null}")
         
         // Check for system-provided biometric result (Single Tap flow)
         try {
             val biometricResult = request?.biometricPromptResult
-            Log.i(TAG, "biometricResult from system: $biometricResult")
+            PasskeyLog.i(TAG, "biometricResult from system: present=${biometricResult != null}")
             if (biometricResult != null) {
                 this.biometricPromptResult = biometricResult
+                // A result object alone is not verification: the prompt may
+                // have failed or been dismissed.
+                systemVerified = biometricResult.isSuccessful
                 val authResult = biometricResult.authenticationResult
-                Log.i(TAG, "authResult from system: $authResult (${authResult?.javaClass?.name})")
+                PasskeyLog.i(TAG, "authResult from system: present=${authResult != null}, successful=$systemVerified")
                 
                 // Also try to find it in the biometricResult object itself
                 systemUnlockedCipher = if (authResult != null) {
@@ -83,10 +96,10 @@ class CreatePasskeyActivity : AppCompatActivity() {
                 } else {
                     PasskeyUtils.extractCipher(biometricResult)
                 }
-                Log.i(TAG, "systemUnlockedCipher from system: $systemUnlockedCipher")
+                PasskeyLog.i(TAG, "systemUnlockedCipher from system: present=${systemUnlockedCipher != null}")
             }
         } catch (e: Exception) {
-            Log.e(TAG, "Error processing biometricPromptResult", e)
+            PasskeyLog.e(TAG, "Error processing biometricPromptResult", e)
         }
 
         val credentialData = intent.getBundleExtra("CREDENTIAL_DATA")
@@ -98,6 +111,12 @@ class CreatePasskeyActivity : AppCompatActivity() {
 
         if (request != null) {
             try {
+                // A caller-asserted web origin is trusted only for an allow-listed
+                // privileged browser; everyone else is bound to their app identity.
+                val allowlist = PrivilegedBrowserAllowlist.json(this)
+                privilegedOrigin = allowlist?.let {
+                    credentialRepository.getPrivilegedOrigin(request!!.callingAppInfo, it)
+                }
                 val systemOrigin = credentialRepository.getOrigin(request!!.callingAppInfo)
                 origin = systemOrigin
                 displayOrigin = systemOrigin
@@ -118,13 +137,13 @@ class CreatePasskeyActivity : AppCompatActivity() {
                 userName = pkJson.optJSONObject("user")?.optString("displayName") ?: userHandle
                 userId = pkJson.optJSONObject("user")?.optString("id") ?: "unknown-id"
             } catch (e: Exception) {
-                Log.e(TAG, "Error parsing request", e)
+                PasskeyLog.e(TAG, "Error parsing request", e)
             }
         }
 
         // If the system already showed a biometric prompt (Single Tap), proceed automatically
         if (biometricPromptResult != null) {
-            Log.d(TAG, "System already showed biometric prompt (Single Tap), proceeding automatically")
+            PasskeyLog.d(TAG, "System already showed biometric prompt (Single Tap), proceeding automatically")
             handleCreation()
             return
         }
@@ -278,48 +297,49 @@ class CreatePasskeyActivity : AppCompatActivity() {
     private fun handleCreation() {
         if (isHandling) return
         isHandling = true
-        Log.d(TAG, "handleCreation started, userVerification=$userVerification")
+        PasskeyLog.d(TAG, "handleCreation started, userVerification=$userVerification")
         lifecycleScope.launch {
-            val cipherToUse = systemUnlockedCipher ?: run {
+            // A manual BiometricPrompt this activity showed succeeded.
+            var manualVerified = false
+            var cipherToUse = systemUnlockedCipher ?: run {
                 if (biometricPromptResult != null) {
                     try {
                         val fallback = credentialRepository.getBiometricCipherForEncryption(this@CreatePasskeyActivity, BiometricRequirement.resolve(this@CreatePasskeyActivity))
-                        Log.i(TAG, "Successfully obtained fallback cipher from repository (Single Tap timeout)")
+                        PasskeyLog.i(TAG, "Successfully obtained fallback cipher from repository (Single Tap timeout)")
                         fallback
                     } catch (e: Exception) {
-                        Log.d(TAG, "Fallback cipher failed: ${e.message}")
+                        PasskeyLog.d(TAG, "Fallback cipher failed: ${e.message}")
                         null
                     }
                 } else {
                     null
                 }
-            } ?: run {
-                // Only prompt for biometrics if userVerification is "required"
-                // For "preferred" and "discouraged", we can proceed without a manual biometric prompt
-                if (userVerification == "required") {
-                    Log.i(TAG, "userVerification is required, running manual biometrics")
-                    val result = biometrics(true)
-                    Log.d(TAG, "Manual biometrics result: $result")
-                    if (result == null) {
-                        Log.w(TAG, "Biometrics failed or was canceled")
-                        setupUI() // Show UI as fallback
-                        isHandling = false
-                        return@launch
-                    }
-                    result.cryptoObject?.cipher
-                } else {
-                    Log.d(TAG, "userVerification is $userVerification, skipping manual biometrics")
-                    null
+            }
+
+            // "required" means a verification ceremony MUST run for this
+            // operation. If the system's prompt did not succeed (it was not
+            // shown, failed, or was dismissed), run our own; "preferred" and
+            // "discouraged" proceed without one, and the response says so.
+            if (UserVerification.normalize(userVerification) == UserVerification.REQUIRED && !systemVerified) {
+                PasskeyLog.i(TAG, "userVerification is required and the system did not verify; running manual biometrics")
+                val result = biometrics(true)
+                if (result == null) {
+                    PasskeyLog.w(TAG, "Biometrics failed or was canceled")
+                    setupUI() // Show UI as fallback
+                    isHandling = false
+                    return@launch
                 }
+                manualVerified = true
+                cipherToUse = result.cryptoObject?.cipher ?: cipherToUse
+            } else if (!systemVerified) {
+                PasskeyLog.d(TAG, "userVerification is $userVerification, skipping manual biometrics")
             }
-            
-            Log.d(TAG, "cipherToUse: $cipherToUse")
-            
+
             var finalCipher = cipherToUse
 
             try {
                 val req = request ?: throw IllegalStateException("No request found")
-                Log.d(TAG, "Request found, origin: $origin")
+                PasskeyLog.d(TAG, "Request found")
             
             // Prefer using the request JSON from the bundle if available
             val rawRequestJson = bundleRequestJson ?: run {
@@ -333,22 +353,21 @@ class CreatePasskeyActivity : AppCompatActivity() {
             } else {
                 rawRequestJson
             }
-            Log.d(TAG, "Passkey request JSON: $passkeyReqJson")
             val requestOptions = try {
                 PublicKeyCredentialCreationOptions(passkeyReqJson)
             } catch (e: org.json.JSONException) {
-                Log.e(TAG, "Invalid passkey creation request JSON: $passkeyReqJson")
+                PasskeyLog.e(TAG, "Invalid passkey creation request JSON")
                 throw e
             }
 
-            Log.d(TAG, "Creating deterministic key pair")
+            PasskeyLog.d(TAG, "Creating deterministic key pair")
             // No requested scheme: a new credential takes the preferred parent
             // (the wallet's deterministic-P256 main key), and records which one
             // it got so every later assertion re-derives the same key.
             val derived = credentialRepository.createDomainKeyPair(this@CreatePasskeyActivity, origin, userHandle)
             val keyPair: KeyPair = derived.keyPair
-            Log.d(TAG, "Derived from parent ${derived.parentKeyId} (${derived.derivationScheme})")
-            Log.d(TAG, "Generating credential ID")
+            PasskeyLog.d(TAG, "Derived from parent ${derived.parentKeyId} (${derived.derivationScheme})")
+            PasskeyLog.d(TAG, "Generating credential ID")
             val credentialId = credentialRepository.generateCredentialId(keyPair)
             val credentialIdBase64 = AndroidBase64.encodeToString(credentialId, AndroidBase64.NO_WRAP)
 
@@ -364,17 +383,18 @@ class CreatePasskeyActivity : AppCompatActivity() {
                 derivationScheme = derived.derivationScheme
             )
             
-            Log.d(TAG, "Saving credential to repository")
+            PasskeyLog.d(TAG, "Saving credential to repository")
             try {
                 credentialRepository.saveCredential(this@CreatePasskeyActivity, credential, finalCipher)
             } catch (e: Exception) {
                 if (e.message?.contains("user not authenticated", ignoreCase = true) == true || 
                     e.cause?.message?.contains("user not authenticated", ignoreCase = true) == true) {
-                    Log.i(TAG, "Key is locked, triggering manual biometric prompt")
+                    PasskeyLog.i(TAG, "Key is locked, triggering manual biometric prompt")
                     val result = biometrics(true)
                     if (result != null) {
+                        manualVerified = true
                         finalCipher = result.cryptoObject?.cipher
-                        Log.i(TAG, "Retrying save with manual biometric cipher")
+                        PasskeyLog.i(TAG, "Retrying save with manual biometric cipher")
                         credentialRepository.saveCredential(this@CreatePasskeyActivity, credential, finalCipher)
                     } else {
                         throw e
@@ -384,14 +404,26 @@ class CreatePasskeyActivity : AppCompatActivity() {
                 }
             }
 
-            Log.d(TAG, "Building AuthenticatorAttestationResponse")
+            // UV reflects what actually happened in this operation. UP stays set:
+            // the user chose this provider's entry in the system chooser (or
+            // tapped Create in our sheet), which is the presence gesture.
+            val verification = UserVerification.outcome(userVerification, systemVerified, manualVerified)
+            check(verification.satisfiesRequest) {
+                "Relying party requires user verification but no verification ceremony completed"
+            }
+            PasskeyLog.d(TAG, "Building AuthenticatorAttestationResponse (uv=${verification.verified})")
+            // The origin the registration is bound to: the verified web origin
+            // for an allow-listed privileged browser, otherwise the caller's
+            // android:apk-key-hash: identity. This is independent of `origin`,
+            // which stays the derivation origin (rpId) so keys re-derive stably.
+            val responseOrigin = privilegedOrigin ?: credentialRepository.getOrigin(req.callingAppInfo)
             val response = AuthenticatorAttestationResponse(
                 requestOptions = requestOptions,
                 credentialId = credentialId,
                 credentialPublicKey = credentialRepository.getPublicKeyFromKeyPair(keyPair),
-                origin = credentialRepository.getOrigin(req.callingAppInfo),
+                origin = responseOrigin,
                 up = true,
-                uv = true,
+                uv = verification.verified,
                 be = true,
                 bs = true,
                 packageName = req.callingAppInfo.packageName
@@ -408,14 +440,14 @@ class CreatePasskeyActivity : AppCompatActivity() {
             val respJson = fullJson.getJSONObject("response")
 
             // Ensure compact clientDataJSON for registration too
-            val sanitizedOrigin = credentialRepository.getOrigin(req.callingAppInfo).replace(Regex("/$"), "")
+            val sanitizedOrigin = responseOrigin.replace(Regex("/$"), "")
             val challenge = if (requestJson.has("publicKey")) {
                 requestJson.getJSONObject("publicKey").getString("challenge")
             } else {
                 requestJson.getString("challenge")
             }
 
-            Log.d(TAG, "Building clientDataJSON, challenge: $challenge, origin: $sanitizedOrigin")
+            PasskeyLog.d(TAG, "Building clientDataJSON")
             val clientDataJSONString = if (sanitizedOrigin.startsWith("https://") || sanitizedOrigin.startsWith("http://")) {
                 "{\"type\":\"webauthn.create\",\"challenge\":\"$challenge\",\"origin\":\"$sanitizedOrigin\",\"crossOrigin\":false}"
             } else {
@@ -437,7 +469,7 @@ class CreatePasskeyActivity : AppCompatActivity() {
                     val patched = WebAuthn.injectAaguid(respJson.getString("attestationObject"), aaguid)
                     respJson.put("attestationObject", patched)
                 } catch (e: Exception) {
-                    Log.w(TAG, "Failed to inject AAGUID into attestationObject", e)
+                    PasskeyLog.w(TAG, "Failed to inject AAGUID into attestationObject", e)
                 }
             }
 
@@ -454,11 +486,10 @@ class CreatePasskeyActivity : AppCompatActivity() {
                 val prfResult = JSONObject().put("enabled", true)
                 clientExtensionResults.put("prf", prfResult)
                 fullJson.put("clientExtensionResults", clientExtensionResults)
-                Log.d(TAG, "Advertised PRF support on registration")
+                PasskeyLog.d(TAG, "Advertised PRF support on registration")
             }
 
             val createResponse = CreatePublicKeyCredentialResponse(fullJson.toString())
-            Log.d(TAG, "CreatePublicKeyCredentialResponse: ${fullJson.toString()}")
             
             PendingIntentHandler.setCreateCredentialResponse(
                 resultIntent,
@@ -466,13 +497,25 @@ class CreatePasskeyActivity : AppCompatActivity() {
             )
             
             setResult(Activity.RESULT_OK, resultIntent)
-            Log.d(TAG, "Result set to OK")
+            PasskeyLog.d(TAG, "Result set to OK")
             ReactNativePasskeyAutofillModule.instance?.sendEvent("onPasskeyAdded", Bundle().apply {
                 putBoolean("success", true)
             })
             finish()
+        } catch (e: MasterKeyUnavailableException) {
+            // Nothing was written. Retrying from the UI cannot help — only the
+            // wallet calling setMasterKey can — so report a definite failure to
+            // the relying party instead of leaving the sheet open.
+            PasskeyLog.e(TAG, "Passkey creation aborted: master key unavailable", e)
+            val errorIntent = Intent()
+            PendingIntentHandler.setCreateCredentialException(
+                errorIntent,
+                CreateCredentialUnknownException("Passkey provider is not ready: master key unavailable"),
+            )
+            setResult(Activity.RESULT_OK, errorIntent)
+            finish()
         } catch (e: Exception) {
-            Log.e(TAG, "Error during passkey creation", e)
+            PasskeyLog.e(TAG, "Error during passkey creation", e)
             setupUI() // Show UI on error
             isHandling = false
         }
@@ -514,7 +557,7 @@ class CreatePasskeyActivity : AppCompatActivity() {
                     val cipher = credentialRepository.getBiometricCipherForEncryption(this, requirement)
                     biometricPrompt.authenticate(promptInfo, BiometricPrompt.CryptoObject(cipher))
                 } catch (e: Exception) {
-                    Log.e(TAG, "Failed to initialize biometric prompt with cipher", e)
+                    PasskeyLog.e(TAG, "Failed to initialize biometric prompt with cipher", e)
                     biometricPrompt.authenticate(promptInfo)
                 }
             } else {