@authon/react-native-wallet 0.0.0-stage → 0.1.0

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/JsValues.kt

@@ -0,0 +1,83 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/JsValues.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import kotlinx.serialization.json.JsonArray
+import kotlinx.serialization.json.JsonElement
+import kotlinx.serialization.json.JsonNull
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.booleanOrNull
+import java.math.BigDecimal
+import java.math.BigInteger
+
+/** Conversions that follow JavaScript semantics where the frame relies on them. */
+internal object JsValues {
+    /** `BigInt(value)`: integers, decimal strings, 0x/0o/0b strings; "" is 0. Null when JS would throw. */
+    fun toBigIntOrNull(value: Any?): BigInteger? = when (value) {
+        null -> null
+        is BigInteger -> value
+        is Int -> BigInteger.valueOf(value.toLong())
+        is Long -> BigInteger.valueOf(value)
+        is Short -> BigInteger.valueOf(value.toLong())
+        is Byte -> BigInteger.valueOf(value.toLong())
+        is Double, is Float -> numberToBigInt(BigDecimal(value.toString()))
+        is BigDecimal -> numberToBigInt(value)
+        is Boolean -> if (value) BigInteger.ONE else BigInteger.ZERO
+        is String -> stringToBigInt(value)
+        is JsonNull -> null
+        is JsonPrimitive ->
+            if (value.isString) stringToBigInt(value.content)
+            else value.booleanOrNull?.let { if (it) BigInteger.ONE else BigInteger.ZERO }
+                ?: runCatching { numberToBigInt(BigDecimal(value.content)) }.getOrNull()
+        else -> null
+    }
+
+    private fun numberToBigInt(d: BigDecimal): BigInteger? = try {
+        d.toBigIntegerExact()
+    } catch (_: ArithmeticException) {
+        null
+    }
+
+    private fun stringToBigInt(raw: String): BigInteger? {
+        val s = raw.trim()
+        if (s.isEmpty()) return BigInteger.ZERO
+        val radix = when {
+            s.startsWith("0x") || s.startsWith("0X") -> 16
+            s.startsWith("0o") || s.startsWith("0O") -> 8
+            s.startsWith("0b") || s.startsWith("0B") -> 2
+            else -> 10
+        }
+        return try {
+            if (radix == 10) {
+                if (!Regex("^[+-]?[0-9]+$").matches(s)) null else BigInteger(s)
+            } else {
+                val body = s.substring(2)
+                if (body.isEmpty() || body.any { Character.digit(it, radix) < 0 }) null else BigInteger(body, radix)
+            }
+        } catch (_: NumberFormatException) {
+            null
+        }
+    }
+
+    /** Converts Kotlin maps/lists/primitives (e.g. from a React Native bridge) to JSON. */
+    fun toJson(value: Any?): JsonElement = when (value) {
+        null -> JsonNull
+        is JsonElement -> value
+        is String -> JsonPrimitive(value)
+        is Boolean -> JsonPrimitive(value)
+        is BigInteger -> JsonPrimitive(value.toString())
+        is Number -> {
+            val d = value.toDouble()
+            if ((value is Double || value is Float) && d == Math.floor(d) && !d.isInfinite() && Math.abs(d) < 1e21) {
+                JsonPrimitive(BigDecimal(d).toBigInteger())
+            } else {
+                JsonPrimitive(value)
+            }
+        }
+        is Map<*, *> -> JsonObject(value.entries.associate { (k, v) -> k.toString() to toJson(v) })
+        is Iterable<*> -> JsonArray(value.map { toJson(it) })
+        is Array<*> -> JsonArray(value.map { toJson(it) })
+        is ByteArray -> JsonPrimitive("0x" + Bytes.toHex(value))
+        else -> throw walletError(WalletErrorCode.INVALID_REQUEST, "unsupported value type ${value::class.java.simpleName}")
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/KeystoreDeviceStore.kt

@@ -0,0 +1,232 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/KeystoreDeviceStore.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import android.content.Context
+import android.content.pm.PackageManager
+import android.os.Build
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyInfo
+import android.security.keystore.KeyProperties
+import android.security.keystore.StrongBoxUnavailableException
+import android.util.AtomicFile
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.buildJsonObject
+import kotlinx.serialization.json.contentOrNull
+import kotlinx.serialization.json.intOrNull
+import kotlinx.serialization.json.longOrNull
+import kotlinx.serialization.json.put
+import java.io.File
+import java.io.IOException
+import java.security.Key
+import java.security.KeyFactory
+import java.security.KeyPairGenerator
+import java.security.KeyStore
+import java.security.PrivateKey
+import java.security.Signature
+import java.security.interfaces.ECPublicKey
+import java.security.spec.ECGenParameterSpec
+import java.util.UUID
+import javax.crypto.KeyGenerator
+import javax.crypto.SecretKey
+import javax.crypto.SecretKeyFactory
+
+/** Where a Keystore key lives, as reported by KeyInfo. */
+enum class KeySecurityLevel { STRONGBOX, TRUSTED_ENVIRONMENT, UNKNOWN_SECURE, SOFTWARE, UNKNOWN }
+
+/**
+ * Device share storage in the Android Keystore (NATIVE.md section 3).
+ * - Signing key: P-256, non-exportable, StrongBox when available, hardware TEE accepted.
+ *   Software-only keys are refused unless [allowSoftwareKeys] (tests and emulators only).
+ * - D is sealed with a Keystore AES-256-GCM key, AAD = storage key `projectId\0userId`, and written
+ *   with AtomicFile to `noBackupFilesDir`, so it is not part of cloud backups or device transfers.
+ *   Every write is read back and compared.
+ */
+class KeystoreDeviceStore @JvmOverloads constructor(
+    context: Context,
+    private val allowSoftwareKeys: Boolean = false,
+) : DeviceStore {
+    private val appContext = context.applicationContext
+    private val dir = File(appContext.noBackupFilesDir, "authon-wallet")
+    private val hasStrongBox = Build.VERSION.SDK_INT >= 28 &&
+        appContext.packageManager.hasSystemFeature(PackageManager.FEATURE_STRONGBOX_KEYSTORE)
+
+    private val keyStore: KeyStore by lazy { KeyStore.getInstance(ANDROID_KEYSTORE).apply { load(null) } }
+
+    private inner class KeystoreKeys(override val handle: String, override val publicJwk: DevicePublicJwk) : DeviceKeys {
+        private fun signKey(): PrivateKey = keyStore.getKey("$handle.sign", null) as? PrivateKey
+            ?: throw walletError(WalletErrorCode.NEEDS_RESTORE, "device key missing")
+
+        private fun aesKey(): SecretKey = keyStore.getKey("$handle.share", null) as? SecretKey
+            ?: throw walletError(WalletErrorCode.NEEDS_RESTORE, "device share key missing")
+
+        override fun sign(data: ByteArray): ByteArray {
+            val s = Signature.getInstance("SHA256withECDSA")
+            s.initSign(signKey())
+            s.update(data)
+            return DeviceStorage.derToRaw(s.sign())
+        }
+
+        override fun seal(plain: ByteArray, aad: ByteArray): SealedShare = DeviceStorage.gcmSeal(aesKey(), plain, aad)
+
+        override fun open(sealed: SealedShare, aad: ByteArray): ByteArray = DeviceStorage.gcmOpen(aesKey(), sealed, aad)
+    }
+
+    /** Security level of the signing key behind [keys] (diagnostics and tests). */
+    fun securityLevelOf(keys: DeviceKeys): KeySecurityLevel = securityLevel(keyStore.getKey("${keys.handle}.sign", null))
+
+    override suspend fun generateKeys(): DeviceKeys = withContext(Dispatchers.IO) {
+        val handle = "dev.authon.wallet.${UUID.randomUUID()}"
+        try {
+            val pair = withStrongBoxFallback { strongBox ->
+                val spec = KeyGenParameterSpec.Builder("$handle.sign", KeyProperties.PURPOSE_SIGN or KeyProperties.PURPOSE_VERIFY)
+                    .setAlgorithmParameterSpec(ECGenParameterSpec("secp256r1"))
+                    .setDigests(KeyProperties.DIGEST_SHA256)
+                    .apply { if (strongBox) setIsStrongBoxBacked(true) }
+                    .build()
+                KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, ANDROID_KEYSTORE).apply { initialize(spec) }.generateKeyPair()
+            }
+            val aes = withStrongBoxFallback { strongBox ->
+                val spec = KeyGenParameterSpec.Builder("$handle.share", KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT)
+                    .setKeySize(256)
+                    .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
+                    .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
+                    .apply { if (strongBox) setIsStrongBoxBacked(true) }
+                    .build()
+                KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, ANDROID_KEYSTORE).apply { init(spec) }.generateKey()
+            }
+            if (!allowSoftwareKeys) {
+                val levels = listOf(securityLevel(pair.private), securityLevel(aes))
+                if (levels.any { it == KeySecurityLevel.SOFTWARE || it == KeySecurityLevel.UNKNOWN }) {
+                    deleteAliases(handle)
+                    throw walletError(WalletErrorCode.STORAGE_UNAVAILABLE, "this device has no hardware-backed keystore")
+                }
+            }
+            KeystoreKeys(handle, DeviceStorage.jwkOf(pair.public as ECPublicKey))
+        } catch (e: WalletException) {
+            throw e
+        } catch (e: Exception) {
+            deleteAliases(handle)
+            throw WalletException(WalletErrorCode.STORAGE_UNAVAILABLE, "device keys could not be created", e)
+        }
+    }
+
+    private fun <T> withStrongBoxFallback(block: (Boolean) -> T): T {
+        if (hasStrongBox) {
+            try {
+                return block(true)
+            } catch (_: StrongBoxUnavailableException) {
+                // fall through to the TEE
+            }
+        }
+        return block(false)
+    }
+
+    private fun securityLevel(key: Key?): KeySecurityLevel {
+        if (key == null) return KeySecurityLevel.UNKNOWN
+        val info: KeyInfo = try {
+            when (key) {
+                is PrivateKey -> KeyFactory.getInstance(key.algorithm, ANDROID_KEYSTORE).getKeySpec(key, KeyInfo::class.java)
+                is SecretKey -> SecretKeyFactory.getInstance(key.algorithm, ANDROID_KEYSTORE).getKeySpec(key, KeyInfo::class.java) as KeyInfo
+                else -> return KeySecurityLevel.UNKNOWN
+            }
+        } catch (_: Exception) {
+            return KeySecurityLevel.UNKNOWN
+        }
+        if (Build.VERSION.SDK_INT >= 31) {
+            return when (info.securityLevel) {
+                KeyProperties.SECURITY_LEVEL_STRONGBOX -> KeySecurityLevel.STRONGBOX
+                KeyProperties.SECURITY_LEVEL_TRUSTED_ENVIRONMENT -> KeySecurityLevel.TRUSTED_ENVIRONMENT
+                KeyProperties.SECURITY_LEVEL_UNKNOWN_SECURE -> KeySecurityLevel.UNKNOWN_SECURE
+                KeyProperties.SECURITY_LEVEL_SOFTWARE -> KeySecurityLevel.SOFTWARE
+                else -> KeySecurityLevel.UNKNOWN
+            }
+        }
+        @Suppress("DEPRECATION")
+        return if (info.isInsideSecureHardware) KeySecurityLevel.UNKNOWN_SECURE else KeySecurityLevel.SOFTWARE
+    }
+
+    private fun deleteAliases(handle: String) {
+        for (alias in listOf("$handle.sign", "$handle.share")) runCatching { keyStore.deleteEntry(alias) }
+    }
+
+    private fun fileFor(key: String) = AtomicFile(File(dir, Bytes.toHex(Bytes.sha256(Bytes.utf8(key))) + ".json"))
+
+    override suspend fun discardKeys(keys: DeviceKeys) = withContext(Dispatchers.IO) { deleteAliases(keys.handle) }
+
+    override suspend fun get(key: String): DeviceRecord? = withContext(Dispatchers.IO) { read(key) }
+
+    private fun read(key: String): DeviceRecord? {
+        val file = fileFor(key)
+        if (!file.baseFile.exists()) return null
+        val o = try {
+            Json.parseToJsonElement(String(file.readFully(), Charsets.UTF_8)) as? JsonObject
+        } catch (e: Exception) {
+            throw WalletException(WalletErrorCode.STORAGE_UNAVAILABLE, "device record unreadable", e)
+        } ?: return null
+        fun s(k: String) = (o[k] as? JsonPrimitive)?.contentOrNull
+        if (s("key") != key) return null
+        val handle = s("handle") ?: return null
+        val jwk = o["publicJwk"] as? JsonObject ?: return null
+        return DeviceRecord(
+            key = key,
+            keys = KeystoreKeys(
+                handle,
+                DevicePublicJwk((jwk["x"] as JsonPrimitive).content, (jwk["y"] as JsonPrimitive).content),
+            ),
+            iv = Bytes.fromBase64(s("iv") ?: return null),
+            ciphertext = Bytes.fromBase64(s("ciphertext") ?: return null),
+            deviceId = s("deviceId") ?: return null,
+            walletId = s("walletId") ?: return null,
+            address = s("address") ?: return null,
+            shareVersion = (o["shareVersion"] as? JsonPrimitive)?.intOrNull ?: return null,
+            createdAt = (o["createdAt"] as? JsonPrimitive)?.longOrNull ?: 0L,
+        )
+    }
+
+    override suspend fun put(record: DeviceRecord) = withContext(Dispatchers.IO) {
+        val previous = runCatching { read(record.key) }.getOrNull()
+        val bytes = buildJsonObject {
+            put("v", 1)
+            put("key", record.key)
+            put("handle", record.keys.handle)
+            put("publicJwk", record.keys.publicJwk.toJson())
+            put("iv", Bytes.toBase64(record.iv))
+            put("ciphertext", Bytes.toBase64(record.ciphertext))
+            put("deviceId", record.deviceId)
+            put("walletId", record.walletId)
+            put("address", record.address)
+            put("shareVersion", record.shareVersion)
+            put("createdAt", record.createdAt)
+        }.toString().toByteArray(Charsets.UTF_8)
+        val file = fileFor(record.key)
+        try {
+            if (!dir.exists() && !dir.mkdirs()) throw IOException("cannot create ${dir.name}")
+            val out = file.startWrite()
+            try {
+                out.write(bytes)
+                file.finishWrite(out)
+            } catch (e: IOException) {
+                file.failWrite(out)
+                throw e
+            }
+            if (!file.readFully().contentEquals(bytes)) throw IOException("read-back differs")
+        } catch (e: IOException) {
+            throw WalletException(WalletErrorCode.STORAGE_UNAVAILABLE, "device share could not be stored", e)
+        }
+        if (previous != null && previous.keys.handle != record.keys.handle) deleteAliases(previous.keys.handle)
+    }
+
+    override suspend fun delete(key: String) = withContext(Dispatchers.IO) {
+        val previous = runCatching { read(key) }.getOrNull()
+        fileFor(key).delete()
+        if (previous != null) deleteAliases(previous.keys.handle)
+    }
+
+    private companion object {
+        const val ANDROID_KEYSTORE = "AndroidKeyStore"
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/Prf.kt

@@ -0,0 +1,111 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/Prf.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import javax.crypto.Cipher
+import javax.crypto.Mac
+import javax.crypto.spec.GCMParameterSpec
+import javax.crypto.spec.SecretKeySpec
+
+/** A WebAuthn assertion, base64url fields, as the API verifies it. */
+data class PasskeyAssertion(
+    val credentialId: String,
+    val clientDataJSON: String,
+    val authenticatorData: String,
+    val signature: String,
+)
+
+class PasskeyCreateResult(
+    val credentialId: String,
+    /** 32-byte PRF output. The SDK wipes it after use. */
+    val prfOutput: ByteArray,
+    /** SPKI public key (base64url) when the provider reports it. */
+    val publicKey: String?,
+    /** COSE algorithm of [publicKey] (-7 ES256, -257 RS256, -8 EdDSA). */
+    val publicKeyAlg: Int?,
+    /** The raw attestationObject (base64url); the API reads the COSE key from it when [publicKey] is null. */
+    val attestationObject: String?,
+)
+
+class PasskeyGetResult(val prfOutput: ByteArray, val assertion: PasskeyAssertion)
+
+/** Passkey operations with the PRF extension for RP `wallet.authon.dev`. */
+interface PasskeyProvider {
+    suspend fun create(userId: ByteArray, userName: String, salt: ByteArray): PasskeyCreateResult
+
+    /** [challenge] is the server's restore challenge when the API verifies the assertion. */
+    suspend fun get(credentialId: String, salt: ByteArray, challenge: ByteArray?): PasskeyGetResult
+}
+
+/** Backup encryption of `apps/wallet/src/prf.ts`: PRF salt v1/v2, HKDF-SHA256, AES-256-GCM, AAD, `v2.` prefix. */
+internal object Prf {
+    const val PRF_SALT_LABEL = "authon-wallet-backup-v1"
+    const val PRF_SALT_LABEL_V2 = "authon-wallet-backup-v2"
+    const val DEFAULT_WRITE_BACKUP_VERSION = 1
+    private const val HKDF_INFO = "authon-wallet-backup-v1/aes-gcm-256"
+    private const val V2_PREFIX = "v2."
+
+    fun passkeyUserId(userHandle: String): ByteArray = Bytes.sha256(Bytes.utf8(userHandle))
+
+    fun salt(version: Int, projectId: String?, walletId: String?): ByteArray =
+        if (version == 1) {
+            Bytes.sha256(Bytes.utf8(PRF_SALT_LABEL))
+        } else {
+            if (projectId == null || walletId == null) throw walletError(WalletErrorCode.INTERNAL, "backup context required")
+            Bytes.sha256(Bytes.utf8("$PRF_SALT_LABEL_V2\u0000$projectId\u0000$walletId"))
+        }
+
+    fun backupVersionOf(payload: String): Int = if (payload.startsWith(V2_PREFIX)) 2 else 1
+
+    /** RFC 5869 HKDF-SHA256 with an empty salt, one output block (the AES-256 key). */
+    fun deriveBackupKey(prfOutput: ByteArray): ByteArray = hkdfSha256(prfOutput, ByteArray(0), Bytes.utf8(HKDF_INFO), 32)
+
+    fun hkdfSha256(ikm: ByteArray, salt: ByteArray, info: ByteArray, length: Int): ByteArray {
+        require(length in 1..255 * 32)
+        val extract = Mac.getInstance("HmacSHA256")
+        // An empty salt means HashLen zero bytes (RFC 5869 2.2); JCA rejects empty HMAC keys.
+        extract.init(SecretKeySpec(if (salt.isEmpty()) ByteArray(32) else salt, "HmacSHA256"))
+        val prk = extract.doFinal(ikm)
+        val expand = Mac.getInstance("HmacSHA256")
+        expand.init(SecretKeySpec(prk, "HmacSHA256"))
+        val out = ByteArray(length)
+        var t = ByteArray(0)
+        var offset = 0
+        var counter = 1
+        while (offset < length) {
+            expand.update(t)
+            expand.update(info)
+            expand.update(counter.toByte())
+            t = expand.doFinal()
+            val n = minOf(t.size, length - offset)
+            t.copyInto(out, offset, 0, n)
+            offset += n
+            counter++
+        }
+        Bytes.wipe(prk, t)
+        return out
+    }
+
+    private fun aad(walletId: String, version: Int) = Bytes.utf8(if (version == 1) "backup:$walletId" else "backup:v2:$walletId")
+
+    fun encryptBackup(key: ByteArray, share: ByteArray, walletId: String, version: Int, iv: ByteArray = Bytes.randomBytes(12)): String {
+        val cipher = Cipher.getInstance("AES/GCM/NoPadding")
+        cipher.init(Cipher.ENCRYPT_MODE, SecretKeySpec(key, "AES"), GCMParameterSpec(128, iv))
+        cipher.updateAAD(aad(walletId, version))
+        val body = Bytes.toBase64(Bytes.concat(iv, cipher.doFinal(share)))
+        return if (version == 1) body else V2_PREFIX + body
+    }
+
+    fun decryptBackup(key: ByteArray, payload: String, walletId: String): ByteArray {
+        val version = backupVersionOf(payload)
+        val raw = Bytes.fromBase64(if (version == 1) payload else payload.substring(V2_PREFIX.length))
+        if (raw.size < 12 + 16) throw walletError(WalletErrorCode.INVALID_REQUEST, "backup ciphertext malformed")
+        return try {
+            val cipher = Cipher.getInstance("AES/GCM/NoPadding")
+            cipher.init(Cipher.DECRYPT_MODE, SecretKeySpec(key, "AES"), GCMParameterSpec(128, raw, 0, 12))
+            cipher.updateAAD(aad(walletId, version))
+            cipher.doFinal(raw, 12, raw.size - 12)
+        } catch (e: Exception) {
+            throw WalletException(WalletErrorCode.INVALID_REQUEST, "backup cannot be decrypted with this passkey", e)
+        }
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/Proof.kt

@@ -0,0 +1,134 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/Proof.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import kotlinx.serialization.json.JsonArray
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.buildJsonArray
+import kotlinx.serialization.json.buildJsonObject
+import kotlinx.serialization.json.put
+import java.nio.ByteBuffer
+import java.nio.CharBuffer
+import java.nio.charset.CharacterCodingException
+import java.nio.charset.CodingErrorAction
+
+/** P-256 device public key as the API stores it (JWK, base64url x/y without padding). */
+data class DevicePublicJwk(val x: String, val y: String) {
+    val kty: String get() = "EC"
+    val crv: String get() = "P-256"
+
+    fun toJson(): JsonObject = buildJsonObject {
+        put("kty", kty)
+        put("crv", crv)
+        put("x", x)
+        put("y", y)
+    }
+}
+
+/** Server-issued proof nonce (`expiresAt` in Unix seconds). */
+data class ProofNonce(val nonce: String, val expiresAt: Long)
+
+/** Wallet key proofs and reserved-message rules of `apps/wallet/src/proof.ts`. */
+internal object Proof {
+    const val DOMAIN_NAME = "Authon Wallet Proof"
+    const val DOMAIN_VERSION = "1"
+    private val RESERVED_PREFIXES = listOf("create:", "device:", "restore:")
+
+    fun canonicalJwk(jwk: DevicePublicJwk): String =
+        "{\"crv\":${json(jwk.crv)},\"kty\":${json(jwk.kty)},\"x\":${json(jwk.x)},\"y\":${json(jwk.y)}}"
+
+    fun devicePublicKeyHash(jwk: DevicePublicJwk): String = Bytes.toHex(Bytes.sha256(Bytes.utf8(canonicalJwk(jwk))))
+
+    private fun json(s: String): String = JsonPrimitive(s).toString()
+
+    private fun fields(vararg pairs: Pair<String, String>): JsonArray = buildJsonArray {
+        for ((name, type) in pairs) add(buildJsonObject { put("name", name); put("type", type) })
+    }
+
+    private val BOUND = arrayOf("nonce" to "string", "expiresAt" to "uint256")
+
+    private val TYPES: Map<String, JsonArray> = mapOf(
+        "CreateWallet" to fields("projectId" to "string", "userId" to "string", "deviceKeyHash" to "string", *BOUND),
+        "AddDevice" to fields("walletId" to "string", "shareVersion" to "uint256", "deviceKeyHash" to "string", *BOUND),
+        "RestoreWallet" to fields("walletId" to "string", "shareVersion" to "uint256", "deviceKeyHash" to "string", *BOUND),
+    )
+
+    fun typedData(primaryType: String, message: List<Pair<String, String>>, bound: ProofNonce): JsonObject = buildJsonObject {
+        put("domain", buildJsonObject { put("name", DOMAIN_NAME); put("version", DOMAIN_VERSION) })
+        put("types", buildJsonObject { put(primaryType, TYPES.getValue(primaryType)) })
+        put("primaryType", primaryType)
+        put(
+            "message",
+            buildJsonObject {
+                for ((k, v) in message) put(k, v)
+                put("nonce", bound.nonce)
+                put("expiresAt", bound.expiresAt.toString())
+            },
+        )
+    }
+
+    fun createTypedData(projectId: String, userId: String, deviceKey: DevicePublicJwk, bound: ProofNonce) =
+        typedData("CreateWallet", listOf("projectId" to projectId, "userId" to userId, "deviceKeyHash" to devicePublicKeyHash(deviceKey)), bound)
+
+    fun deviceTypedData(walletId: String, shareVersion: Int, deviceKey: DevicePublicJwk, bound: ProofNonce) =
+        typedData(
+            "AddDevice",
+            listOf("walletId" to walletId, "shareVersion" to shareVersion.toString(), "deviceKeyHash" to devicePublicKeyHash(deviceKey)),
+            bound,
+        )
+
+    /** shareVersion in the signed message is the current version + 1. */
+    fun restoreTypedData(walletId: String, currentShareVersion: Int, newDeviceKey: DevicePublicJwk, bound: ProofNonce) =
+        typedData(
+            "RestoreWallet",
+            listOf(
+                "walletId" to walletId,
+                "shareVersion" to (currentShareVersion + 1).toString(),
+                "deviceKeyHash" to devicePublicKeyHash(newDeviceKey),
+            ),
+            bound,
+        )
+
+    /** Proofs are always signed with account 0 of the wallet secret. */
+    fun sign(secret: ByteArray, typedData: JsonObject): String = HdWallet.account(secret, 0).signTypedData(typedData)
+
+    /** True for app text that looks like a (legacy) wallet proof. */
+    fun isReservedMessageText(text: String): Boolean {
+        var i = 0
+        while (i < text.length && (text[i].code <= 0x1f || text[i] == '' || isJsWhitespace(text[i]))) i++
+        val t = text.substring(i).lowercase()
+        return RESERVED_PREFIXES.any { t.startsWith(it) }
+    }
+
+    /** JavaScript `\s`: WhiteSpace and LineTerminator code points. */
+    private fun isJsWhitespace(c: Char): Boolean =
+        c == ' ' || c == '\t' || c == '\n' || c == '\u000b' || c == '\u000c' || c == '\r' || c == ' ' || c == ' ' ||
+            c in ' '..' ' || c == '
' || c == '
' || c == ' ' || c == ' ' || c == '　' ||
+            c == ''
+
+    /** Decodes a raw hex message as strict UTF-8; null when it is not valid UTF-8 or not hex. */
+    fun rawMessageText(hex: String): String? {
+        val bytes = Bytes.fromHexOrNull(hex) ?: return null
+        return try {
+            Charsets.UTF_8.newDecoder()
+                .onMalformedInput(CodingErrorAction.REPORT)
+                .onUnmappableCharacter(CodingErrorAction.REPORT)
+                .decode(ByteBuffer.wrap(bytes))
+                .let { stripBom(it) }
+        } catch (_: CharacterCodingException) {
+            null
+        }
+    }
+
+    // TextDecoder('utf-8') drops a leading BOM by default.
+    private fun stripBom(chars: CharBuffer): String {
+        val s = chars.toString()
+        return if (s.startsWith("")) s.substring(1) else s
+    }
+
+    fun isReservedTypedData(typedData: JsonObject): Boolean {
+        val name = ((typedData["domain"] as? JsonObject)?.get("name") as? JsonPrimitive)?.takeIf { it.isString }?.content
+            ?: return false
+        return name.trim().lowercase() == DOMAIN_NAME.lowercase()
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/Shamir.kt

@@ -0,0 +1,106 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/Shamir.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import java.security.SecureRandom
+
+/**
+ * Port of the `shamir-secret-sharing` JS library used by the web frame: GF(2^8) with the
+ * same tables, a share is `y bytes || x` (x in the last byte). [combine] is deterministic and
+ * byte-identical to the library; [split] draws its coefficients and coordinates from SecureRandom.
+ */
+internal object Shamir {
+    private val random = SecureRandom()
+
+    private fun add(a: Int, b: Int): Int = a xor b
+
+    private fun div(a: Int, b: Int): Int {
+        require(b != 0) { "cannot divide by zero" }
+        val diff = (GfTables.LOG[a] - GfTables.LOG[b] + 255) % 255
+        return if (a == 0) 0 else GfTables.EXP[diff]
+    }
+
+    private fun mult(a: Int, b: Int): Int {
+        val sum = (GfTables.LOG[a] + GfTables.LOG[b]) % 255
+        return if (a == 0 || b == 0) 0 else GfTables.EXP[sum]
+    }
+
+    private fun interpolate(xs: IntArray, ys: IntArray, x: Int): Int {
+        var result = 0
+        for (i in xs.indices) {
+            var basis = 1
+            for (j in xs.indices) {
+                if (i == j) continue
+                basis = mult(basis, div(add(x, xs[j]), add(xs[i], xs[j])))
+            }
+            result = add(result, mult(ys[i], basis))
+        }
+        return result
+    }
+
+    private fun evaluate(coefficients: IntArray, x: Int, degree: Int): Int {
+        require(x != 0) { "cannot evaluate secret polynomial at zero" }
+        var result = coefficients[degree]
+        for (i in degree - 1 downTo 0) result = add(mult(result, x), coefficients[i])
+        return result
+    }
+
+    private fun newCoordinates(): IntArray {
+        val coordinates = IntArray(255) { it + 1 }
+        val randomIndices = ByteArray(255).also { random.nextBytes(it) }
+        for (i in 0 until 255) {
+            val j = (randomIndices[i].toInt() and 0xff) % 255
+            val tmp = coordinates[i]
+            coordinates[i] = coordinates[j]
+            coordinates[j] = tmp
+        }
+        return coordinates
+    }
+
+    fun split(secret: ByteArray, shares: Int, threshold: Int): List<ByteArray> {
+        require(secret.isNotEmpty()) { "secret cannot be empty" }
+        require(shares in 2..255) { "shares must be at least 2 and at most 255" }
+        require(threshold in 2..255) { "threshold must be at least 2 and at most 255" }
+        require(shares >= threshold) { "shares cannot be less than threshold" }
+        val xs = newCoordinates()
+        val result = List(shares) { i -> ByteArray(secret.size + 1).also { it[secret.size] = xs[i].toByte() } }
+        val degree = threshold - 1
+        val coefficients = IntArray(degree + 1)
+        val randomCoefficients = ByteArray(degree)
+        try {
+            for (i in secret.indices) {
+                coefficients[0] = secret[i].toInt() and 0xff
+                random.nextBytes(randomCoefficients)
+                for (k in 0 until degree) coefficients[k + 1] = randomCoefficients[k].toInt() and 0xff
+                for (j in 0 until shares) result[j][i] = evaluate(coefficients, xs[j], degree).toByte()
+            }
+        } finally {
+            coefficients.fill(0)
+            randomCoefficients.fill(0)
+        }
+        return result
+    }
+
+    fun combine(shares: List<ByteArray>): ByteArray {
+        require(shares.size in 2..255) { "shares must have at least 2 and at most 255 elements" }
+        val shareLength = shares[0].size
+        for (s in shares) {
+            require(s.size >= 2) { "each share must be at least 2 bytes" }
+            require(s.size == shareLength) { "all shares must have the same byte length" }
+        }
+        val xs = IntArray(shares.size)
+        val seen = HashSet<Int>()
+        for (i in shares.indices) {
+            val x = shares[i][shareLength - 1].toInt() and 0xff
+            require(seen.add(x)) { "shares must contain unique values but a duplicate was found" }
+            xs[i] = x
+        }
+        val secret = ByteArray(shareLength - 1)
+        val ys = IntArray(shares.size)
+        for (i in secret.indices) {
+            for (j in shares.indices) ys[j] = shares[j][i].toInt() and 0xff
+            secret[i] = interpolate(xs, ys, 0).toByte()
+        }
+        ys.fill(0)
+        return secret
+    }
+}