@authon/react-native-wallet 0.0.0-stage → 0.4.0

package/build/types.d.ts

@@ -0,0 +1,167 @@
+/** Names and shapes follow `@authon/js` (WalletClient) so web and app code read the same. */
+export type Hex = `0x${string}`;
+export interface EmbeddedWalletDevice {
+    id: string;
+    label: string | null;
+    createdAt: string | null;
+    lastUsedAt: string | null;
+    /** This app install. */
+    current: boolean;
+}
+export interface EmbeddedWallet {
+    /** Account 0 (m/44'/60'/0'/0/0), the same address the web wallet shows for this user. */
+    address: string;
+    /**
+     * True once the wallet has a passkey backup (`protect()`). An unprotected wallet exists only
+     * as this install's device share plus the server share: deleting the app or losing the device
+     * makes it unrecoverable. Do not let users receive funds until `protected` is true.
+     */
+    protected: boolean;
+    /** True when the server has a wallet but this install holds no device share (call `restore()`). */
+    needsRestore: boolean;
+    /** A legacy backup without a passkey public key; call `upgradeBackup()` on a device that holds the wallet. */
+    backupUpgradeRecommended: boolean;
+    devices: EmbeddedWalletDevice[];
+}
+/** Chains whose account addresses the wallet derives from the same seed (NATIVE.md section 11). */
+export type WalletChain = 'evm' | 'tron' | 'xrp' | 'bitcoin' | 'bitcoin-testnet' | 'solana';
+/**
+ * One HD account. EVM: `m/44'/60'/0'/0/{index}` (account 0 is `EmbeddedWallet.address`); other chains
+ * use their standard paths (TRON `m/44'/195'/n'/0/0`, XRP `m/44'/144'/n'/0/0`, Bitcoin
+ * `m/84'/0'/n'/0/0`, Bitcoin testnet `m/84'/1'/n'/0/0`, Solana `m/44'/501'/n'/0'`).
+ */
+export interface WalletAccount {
+    index: number;
+    path: string;
+    address: string;
+    /** Set when `getAccounts` was asked for a chain. */
+    chain?: WalletChain;
+    /** Public key (hex) when the chain needs it to build a transaction (XRP SigningPubKey). */
+    publicKey?: string;
+}
+/** `signChainTransaction` input (NATIVE.md section 12). The app builds the unsigned transaction. */
+export interface WalletChainSignRequest {
+    chain: Exclude<WalletChain, 'evm'>;
+    /** Account index (default 0). */
+    account?: number;
+    /** The account's address on `chain`, from getAccounts. Signing fails (ADDRESS_MISMATCH) if it differs. */
+    address: string;
+    /**
+     * Chain-specific unsigned transaction: Solana `{ message }` (base64 Message, legacy or v0),
+     * TRON `{ rawDataHex }`, Bitcoin `{ psbt }` (base64), XRP `{ txBlobHex }` (encodeForSigning output).
+     */
+    payload: Record<string, unknown>;
+}
+/** Signs with another account of the same wallet. Omitted or 0 = the wallet address. */
+export interface WalletSignOptions {
+    account?: number;
+}
+/** A personal_sign payload: UTF-8 text, or raw bytes as 0x hex. */
+export type WalletMessage = string | {
+    raw: string;
+};
+export interface TypedDataPayload {
+    domain: Record<string, unknown>;
+    types: Record<string, Array<{
+        name: string;
+        type: string;
+    }>>;
+    primaryType: string;
+    message: Record<string, unknown>;
+}
+export interface WalletTransactionRequest {
+    to?: string;
+    from?: string;
+    value?: string | number | bigint;
+    data?: string;
+    nonce?: string | number;
+    gas?: string | number | bigint;
+    gasLimit?: string | number | bigint;
+    gasPrice?: string | number | bigint;
+    maxFeePerGas?: string | number | bigint;
+    maxPriorityFeePerGas?: string | number | bigint;
+    chainId?: string | number;
+    type?: string | number;
+    accessList?: Array<{
+        address: string;
+        storageKeys: string[];
+    }>;
+}
+export type WalletChangeListener = (wallet: EmbeddedWallet | null) => void;
+/** `GET /v1/wallet/app-config` for this app (public, no session needed). */
+export interface WalletAppConfig {
+    projectId: string | null;
+    /** The app is registered for the project (bundle ID / package name). */
+    allowed: boolean;
+    /** An Authon administrator approved the registration; passkey backup and restore need it. */
+    approved: boolean;
+    enabled: boolean;
+    chainIds: number[];
+    /** Project setting: show the native approval UI before every signature. */
+    confirmSigning: boolean;
+    /** Passkey relying party (`wallet.authon.dev`). */
+    rpId: string;
+    minFrameProtocol: number | null;
+}
+export type CapabilityStatus = 'available' | 'unavailable' | 'unknown';
+export interface CapabilityCheck {
+    status: CapabilityStatus;
+    /** Reason code (see the README table); null when available. */
+    reason: string | null;
+}
+/** `capabilities()`: can this device and app use the wallet? Asked before sign-in, no session. */
+export interface WalletCapabilities {
+    /** unavailable if any check is unavailable, else unknown if any is unknown, else available. */
+    ready: CapabilityStatus;
+    /** App registration and approval (APP_NOT_REGISTERED, APP_SIGNATURE_MISMATCH, APP_NOT_APPROVED, NETWORK_ERROR, API_ERROR). */
+    app: CapabilityCheck;
+    /** Embedded wallet enabled for the project (WALLET_DISABLED, NETWORK_ERROR). */
+    wallet: CapabilityCheck;
+    /** Hardware-protected key storage (HARDWARE_KEYSTORE_UNAVAILABLE, SIMULATOR, CHECK_FAILED). */
+    secureStorage: CapabilityCheck;
+    /** A device passcode / biometrics is set (DEVICE_LOCK_NOT_SET, CHECK_FAILED). */
+    deviceLock: CapabilityCheck;
+    /** Passkey PRF backup, static OS/API support only (OS_UNSUPPORTED, PASSKEY_API_UNAVAILABLE, PRF_PROVIDER_UNVERIFIED). */
+    passkeyBackup: CapabilityCheck;
+    /** X-Request-Id of the app-config response. */
+    diagnosticId: string | null;
+}
+export interface EIP1193RequestArguments {
+    method: string;
+    params?: unknown[] | Record<string, unknown>;
+}
+export interface EIP1193Provider {
+    request(args: EIP1193RequestArguments): Promise<unknown>;
+}
+export type TokenGetter = () => Promise<string | null | undefined> | string | null | undefined;
+export interface AuthonWalletOptions {
+    publishableKey: string;
+    /** Defaults to https://api.authon.dev. */
+    apiUrl?: string;
+    /**
+     * Returns the current Authon session (access) token, refreshed when needed. Called before
+     * every wallet call; the token is handed to the native wallet for that call only.
+     */
+    getToken: TokenGetter;
+    /**
+     * The app as registered in the Authon console: `TEAMID.bundleId` on iOS, the package name on
+     * Android. Detected when omitted (iOS: from the keychain access group; Android: package name).
+     */
+    appId?: string | {
+        ios?: string;
+        android?: string;
+    };
+    /** Also require Face ID / Touch ID / device credential (iOS) or BiometricPrompt (Android) before each signature. */
+    requireDeviceAuthentication?: boolean;
+    /**
+     * TEST ONLY. Refused by the native module outside debug builds.
+     * - `allowSoftwareKeys`: software device keys when there is no Secure Enclave / StrongBox / TEE
+     *   (simulator, emulator).
+     * - `autoApprove`: approve every signature without UI, for automated smoke tests.
+     */
+    testing?: {
+        allowSoftwareKeys?: boolean;
+        autoApprove?: boolean;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAE7F,MAAM,MAAM,GAAG,GAAG,KAAK,MAAM,EAAE,CAAC;AAEhC,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,wBAAwB;IACxB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,yFAAyF;IACzF,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,mGAAmG;IACnG,YAAY,EAAE,OAAO,CAAC;IACtB,8GAA8G;IAC9G,wBAAwB,EAAE,OAAO,CAAC;IAClC,OAAO,EAAE,oBAAoB,EAAE,CAAC;CACjC;AAED,mGAAmG;AACnG,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAE5F;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,2FAA2F;IAC3F,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,oGAAoG;AACpG,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACnC,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0GAA0G;IAC1G,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,wFAAwF;AACxF,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,mEAAmE;AACnE,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACpC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACpC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACxC,oBAAoB,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAChD,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAChE;AAED,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,KAAK,IAAI,CAAC;AAE3E,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAC;IACjB,6FAA6F;IAC7F,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2EAA2E;IAC3E,cAAc,EAAE,OAAO,CAAC;IACxB,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,aAAa,GAAG,SAAS,CAAC;AAEvE,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,gBAAgB,CAAC;IACzB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,+FAA+F;IAC/F,KAAK,EAAE,gBAAgB,CAAC;IACxB,8HAA8H;IAC9H,GAAG,EAAE,eAAe,CAAC;IACrB,gFAAgF;IAChF,MAAM,EAAE,eAAe,CAAC;IACxB,+FAA+F;IAC/F,aAAa,EAAE,eAAe,CAAC;IAC/B,iFAAiF;IACjF,UAAU,EAAE,eAAe,CAAC;IAC5B,yHAAyH;IACzH,aAAa,EAAE,eAAe,CAAC;IAC/B,+CAA+C;IAC/C,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1D;AAED,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAE/F,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,QAAQ,EAAE,WAAW,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,oHAAoH;IACpH,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;OAKG;IACH,OAAO,CAAC,EAAE;QAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAClE"}

package/build/types.js

@@ -0,0 +1,3 @@
+/** Names and shapes follow `@authon/js` (WalletClient) so web and app code read the same. */
+export {};
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,6FAA6F"}

package/build/useAuthonWallet.d.ts

@@ -0,0 +1,25 @@
+import { AuthonWalletClient } from './client';
+import { AuthonWalletError } from './errors';
+import type { AuthonWalletOptions, EmbeddedWallet, TokenGetter } from './types';
+export interface UseAuthonWalletOptions extends Omit<AuthonWalletOptions, 'getToken'> {
+    /** Defaults to the session of the surrounding `<AuthonProvider>` from @authon/react-native. */
+    getToken?: TokenGetter;
+}
+export interface UseAuthonWalletResult {
+    /** The client; call ensure(), signMessage(), protect() etc. on it. */
+    wallet: AuthonWalletClient;
+    /** The signed-in user's wallet, null when signed out or before it is created. */
+    current: EmbeddedWallet | null;
+    /** False until the first status check finished (or while signed out and the auth SDK is loading). */
+    isLoaded: boolean;
+    error: AuthonWalletError | null;
+    /** Reloads `current`. */
+    refresh: () => Promise<void>;
+}
+/**
+ * Wallet of the signed-in user. Inside `<AuthonProvider>` (@authon/react-native) the session token
+ * comes from the provider and the wallet follows sign-in and sign-out; elsewhere pass `getToken`.
+ * The client is recreated only when publishableKey, apiUrl or appId change.
+ */
+export declare function useAuthonWallet(options: UseAuthonWalletOptions): UseAuthonWalletResult;
+//# sourceMappingURL=useAuthonWallet.d.ts.map

package/build/useAuthonWallet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthonWallet.d.ts","sourceRoot":"","sources":["../src/useAuthonWallet.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEhF,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC;IACnF,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,WAAW,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,sEAAsE;IACtE,MAAM,EAAE,kBAAkB,CAAC;IAC3B,iFAAiF;IACjF,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/B,qGAAqG;IACrG,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAChC,yBAAyB;IACzB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,qBAAqB,CA0EtF"}

package/build/useAuthonWallet.js

@@ -0,0 +1,77 @@
+import { useCallback, useContext, useEffect, useMemo, useRef, useState } from 'react';
+import { getAuthonContext } from './authonContext';
+import { AuthonWalletClient } from './client';
+import { AuthonWalletError } from './errors';
+/**
+ * Wallet of the signed-in user. Inside `<AuthonProvider>` (@authon/react-native) the session token
+ * comes from the provider and the wallet follows sign-in and sign-out; elsewhere pass `getToken`.
+ * The client is recreated only when publishableKey, apiUrl or appId change.
+ */
+export function useAuthonWallet(options) {
+    const session = useContext(getAuthonContext());
+    const latest = useRef({ options, session });
+    latest.current = { options, session };
+    if (!options.getToken && !session) {
+        throw new AuthonWalletError('NOT_CONFIGURED', 'useAuthonWallet needs getToken, or must be used inside <AuthonProvider> from @authon/react-native');
+    }
+    const appIdKey = typeof options.appId === 'string' ? options.appId : JSON.stringify(options.appId ?? null);
+    const testingKey = JSON.stringify(options.testing ?? null);
+    const wallet = useMemo(() => new AuthonWalletClient({
+        ...latest.current.options,
+        getToken: async () => {
+            const { options: o, session: s } = latest.current;
+            if (o.getToken)
+                return o.getToken();
+            if (!s?.isSignedIn)
+                return null;
+            const token = s.getToken?.();
+            if (token)
+                return token;
+            return (await s.client?.refreshToken?.())?.accessToken ?? null;
+        },
+    }), 
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [options.publishableKey, options.apiUrl, appIdKey, options.requireDeviceAuthentication, testingKey]);
+    // dispose() only resets the client, so this is safe under StrictMode's double effects.
+    useEffect(() => () => wallet.dispose(), [wallet]);
+    const [current, setCurrent] = useState(null);
+    const [isLoaded, setLoaded] = useState(false);
+    const [error, setError] = useState(null);
+    useEffect(() => wallet.onChange(setCurrent), [wallet]);
+    const signedIn = options.getToken ? true : session?.isSignedIn === true;
+    const sessionUser = options.getToken ? null : session?.userId ?? null;
+    const authLoaded = options.getToken ? true : session?.isLoaded !== false;
+    const lastUser = useRef(undefined);
+    const refresh = useCallback(async () => {
+        try {
+            setCurrent(await wallet.get());
+            setError(null);
+        }
+        catch (e) {
+            setError(e instanceof AuthonWalletError ? e : new AuthonWalletError('UNKNOWN', String(e)));
+        }
+        finally {
+            setLoaded(true);
+        }
+    }, [wallet]);
+    useEffect(() => {
+        if (!authLoaded)
+            return;
+        if (!signedIn) {
+            wallet.dispose();
+            lastUser.current = undefined;
+            setCurrent(null);
+            setError(null);
+            setLoaded(true);
+            return;
+        }
+        // Another user signed in: drop the previous user's cached accounts and in-flight calls.
+        if (lastUser.current !== undefined && lastUser.current !== sessionUser)
+            wallet.dispose();
+        lastUser.current = sessionUser;
+        setLoaded(false);
+        void refresh();
+    }, [authLoaded, signedIn, sessionUser, refresh, wallet]);
+    return { wallet, current, isLoaded, error, refresh };
+}
+//# sourceMappingURL=useAuthonWallet.js.map

package/build/useAuthonWallet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthonWallet.js","sourceRoot":"","sources":["../src/useAuthonWallet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAoB7C;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,MAAM,OAAO,GAAG,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5C,MAAM,CAAC,OAAO,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAEtC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,iBAAiB,CACzB,gBAAgB,EAChB,mGAAmG,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IAC3G,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,CACpB,GAAG,EAAE,CACH,IAAI,kBAAkB,CAAC;QACrB,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO;QACzB,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC;YAClD,IAAI,CAAC,CAAC,QAAQ;gBAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,EAAE,UAAU;gBAAE,OAAO,IAAI,CAAC;YAChC,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC7B,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,WAAW,IAAI,IAAI,CAAC;QACjE,CAAC;KACF,CAAC;IACJ,uDAAuD;IACvD,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,2BAA2B,EAAE,UAAU,CAAC,CACpG,CAAC;IACF,uFAAuF;IACvF,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAElD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAwB,IAAI,CAAC,CAAC;IACpE,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAA2B,IAAI,CAAC,CAAC;IAEnE,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI,CAAC;IACtE,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,KAAK,KAAK,CAAC;IAEzE,MAAM,QAAQ,GAAG,MAAM,CAA4B,SAAS,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,IAAI,CAAC;YACH,UAAU,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,YAAY,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAEb,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,QAAQ,CAAC,OAAO,GAAG,SAAS,CAAC;YAC7B,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,SAAS,CAAC,IAAI,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,wFAAwF;QACxF,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,WAAW;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACzF,QAAQ,CAAC,OAAO,GAAG,WAAW,CAAC;QAC/B,SAAS,CAAC,KAAK,CAAC,CAAC;QACjB,KAAK,OAAO,EAAE,CAAC;IACjB,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAEzD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACvD,CAAC"}

package/expo-module.config.json

@@ -0,0 +1,9 @@
+{
+  "platforms": ["apple", "android"],
+  "apple": {
+    "modules": ["AuthonWalletModule"]
+  },
+  "android": {
+    "modules": ["dev.authon.reactnative.wallet.AuthonWalletModule"]
+  }
+}

package/ios/AuthonReactNativeWallet.podspec

@@ -0,0 +1,41 @@
+require 'json'
+
+package = JSON.parse(File.read(File.join(__dir__, '..', 'package.json')))
+
+Pod::Spec.new do |s|
+  s.name = 'AuthonReactNativeWallet'
+  s.version = package['version']
+  s.summary = package['description']
+  s.license = { :type => 'MIT' }
+  s.author = 'Authon'
+  s.homepage = 'https://authon.dev'
+  # AuthonWallet needs iOS 16 (the Swift package's minimum); PRF passkeys need iOS 18 at run time.
+  s.platforms = { :ios => '16.0' }
+  s.source = { :git => 'https://github.com/mikusnuz/authon-sdk.git', :tag => "react-native-wallet@#{s.version}" }
+  s.static_framework = true
+  s.swift_version = '5.9'
+  s.dependency 'ExpoModulesCore'
+  s.frameworks = 'Security', 'CryptoKit', 'LocalAuthentication', 'AuthenticationServices', 'SwiftUI'
+
+  # vendor/ is generated from swift/Sources by scripts/sync-native-wallet.mjs.
+  # CSecp256k1: compile only build/*.c (they include src/*.c); CKeccak: sha3.c, ripemd160.c and memzero.c;
+  # CMonocypher (Ed25519, deterministic like the web wallet): both .c files, no flags.
+  s.source_files = [
+    '*.swift',
+    'vendor/AuthonWallet/**/*.swift',
+    'vendor/CSecp256k1/build/*.c',
+    'vendor/CSecp256k1/include/*.h',
+    'vendor/CKeccak/sha3.c',
+    'vendor/CKeccak/ripemd160.c',
+    'vendor/CKeccak/memzero.c',
+    'vendor/CKeccak/include/ckeccak.h',
+    'vendor/CMonocypher/*.c',
+    'vendor/CMonocypher/include/*.h',
+  ]
+  s.public_header_files = ['vendor/CSecp256k1/include/*.h', 'vendor/CKeccak/include/ckeccak.h', 'vendor/CMonocypher/include/*.h']
+  s.preserve_paths = ['vendor/CSecp256k1/src/**/*', 'vendor/CKeccak/*.h']
+  s.pod_target_xcconfig = {
+    'DEFINES_MODULE' => 'YES',
+    'GCC_PREPROCESSOR_DEFINITIONS' => '$(inherited) ENABLE_MODULE_RECOVERY=1',
+  }
+end

package/ios/AuthonWalletModule.swift

@@ -0,0 +1,233 @@
+import ExpoModulesCore
+import Foundation
+
+/// Bridges the AuthonWallet core (vendor/AuthonWallet, generated from swift/Sources) to JS.
+///
+/// Only public data crosses the bridge: addresses, signatures, status and devices. The device
+/// share, the company share, the key and passkey PRF output stay inside the core. Every
+/// function resolves an envelope `{ ok: true, value }` or `{ ok: false, code, message }` with
+/// the web wallet's error codes, so JS never parses native exception text.
+public final class AuthonWalletModule: Module {
+  private let lock = NSLock()
+  private var wallets: [String: AuthonWallet] = [:]
+
+  public func definition() -> ModuleDefinition {
+    Name("AuthonWallet")
+
+    AsyncFunction("configure") { (id: String, config: [String: Any]) -> [String: Any] in
+      self.envelope { try self.configure(id, config); return NSNull() }
+    }
+
+    AsyncFunction("release") { (id: String) -> [String: Any] in
+      self.lock.withLock { self.wallets[id] = nil }
+      return ["ok": true, "value": NSNull()]
+    }
+
+    AsyncFunction("appConfig") { (id: String) async -> [String: Any] in
+      await self.call(id, token: nil) { try Self.appConfig(await $0.appConfig()) }
+    }
+
+    AsyncFunction("capabilities") { (id: String) async -> [String: Any] in
+      await self.call(id, token: nil) { Self.capabilities(await $0.capabilities()) }
+    }
+
+    AsyncFunction("status") { (id: String, token: String) async -> [String: Any] in
+      await self.call(id, token: token) { try Self.wallet(await $0.status()) }
+    }
+
+    AsyncFunction("create") { (id: String, token: String) async -> [String: Any] in
+      await self.call(id, token: token) { try Self.wallet(await $0.create()) }
+    }
+
+    AsyncFunction("accounts") { (id: String, token: String, start: Int, count: Int, chain: String) async -> [String: Any] in
+      await self.call(id, token: token) { w in
+        guard let walletChain = WalletChain(rawValue: chain) else {
+          throw WalletError(.invalidRequest, "chain must be one of \(WalletChain.allCases.map(\.rawValue).joined(separator: ", "))")
+        }
+        return try await w.accounts(start: start, count: count, chain: walletChain).map {
+          ["index": $0.index, "path": $0.path, "address": $0.address, "chain": $0.chain.rawValue, "publicKey": Self.orNull($0.publicKey)] as [String: Any]
+        }
+      }
+    }
+
+    AsyncFunction("signMessage") { (id: String, token: String, kind: String, message: String, account: Int, address: String?) async -> [String: Any] in
+      await self.call(id, token: token) { w in
+        let payload: WalletMessage = kind == "raw" ? .raw(message) : .text(message)
+        return try await w.signMessage(payload, account: account, address: address)
+      }
+    }
+
+    AsyncFunction("signTypedData") { (id: String, token: String, typedDataJson: String, account: Int, address: String?) async -> [String: Any] in
+      await self.call(id, token: token) { try await $0.signTypedData(typedDataJson, account: account, address: address) }
+    }
+
+    AsyncFunction("signTransaction") { (id: String, token: String, transactionJson: String, account: Int, address: String?) async -> [String: Any] in
+      await self.call(id, token: token) { try await $0.signTransaction(transactionJson, account: account, address: address) }
+    }
+
+    AsyncFunction("signChainTransaction") { (id: String, token: String, chain: String, account: Int, address: String, payloadJson: String) async -> [String: Any] in
+      await self.call(id, token: token) { w in
+        guard let walletChain = WalletChain(rawValue: chain) else {
+          throw WalletError(.invalidRequest, "unknown chain")
+        }
+        guard let data = payloadJson.data(using: .utf8),
+              let payload = try? JSONSerialization.jsonObject(with: data) as? [String: Any] else {
+          throw WalletError(.invalidRequest, "payload must be a JSON object")
+        }
+        return try await w.signChainTransaction(chain: walletChain, account: account, address: address, payload: payload)
+      }
+    }
+
+    AsyncFunction("protect") { (id: String, token: String) async -> [String: Any] in
+      await self.call(id, token: token) { ["shareVersion": try await $0.protect().shareVersion] }
+    }
+
+    AsyncFunction("upgradeBackup") { (id: String, token: String) async -> [String: Any] in
+      await self.call(id, token: token) { ["shareVersion": try await $0.upgradeBackup().shareVersion] }
+    }
+
+    AsyncFunction("restore") { (id: String, token: String, reset: Bool) async -> [String: Any] in
+      await self.call(id, token: token) { w in
+        let r = try await w.restore(mode: reset ? .reset : .add)
+        return ["shareVersion": r.shareVersion, "backupUpgradeRecommended": r.backupUpgradeRecommended]
+      }
+    }
+
+    AsyncFunction("revokeDevice") { (id: String, token: String, deviceId: String) async -> [String: Any] in
+      await self.call(id, token: token) { try await $0.revokeDevice(deviceId); return NSNull() }
+    }
+  }
+
+  // MARK: - Instances
+
+  private static var isDebugBuild: Bool {
+    #if DEBUG
+    return true
+    #else
+    return false
+    #endif
+  }
+
+  private func configure(_ id: String, _ config: [String: Any]) throws {
+    guard let publishableKey = config["publishableKey"] as? String, !publishableKey.isEmpty else {
+      throw WalletError(.invalidRequest, "publishableKey required")
+    }
+    let apiUrl = (config["apiUrl"] as? String).flatMap { $0.isEmpty ? nil : $0 } ?? "https://api.authon.dev"
+    let appId = (config["appId"] as? String).flatMap { $0.isEmpty ? nil : $0 }
+    let testing = config["testing"] as? [String: Any] ?? [:]
+    let softwareKeys = testing["allowSoftwareKeys"] as? Bool ?? false
+    let autoApprove = testing["autoApprove"] as? Bool ?? false
+    if (softwareKeys || autoApprove) && !Self.isDebugBuild {
+      throw WalletError(.invalidRequest, "testing options are only available in debug builds")
+    }
+    let wallet = AuthonWallet(
+      publishableKey: publishableKey,
+      apiURL: apiUrl,
+      sessionProvider: { CallToken.value ?? "" },
+      appId: appId,
+      approver: autoApprove ? TestAutoApprover() : SheetWalletApprover(),
+      requireDeviceAuthentication: config["requireDeviceAuthentication"] as? Bool ?? false,
+      allowSoftwareKeys: softwareKeys
+    )
+    lock.withLock { wallets[id] = wallet }
+  }
+
+  private func call(_ id: String, token: String?, _ body: @escaping (AuthonWallet) async throws -> Any) async -> [String: Any] {
+    guard let wallet = lock.withLock({ wallets[id] }) else {
+      return Self.failure(WalletError(.invalidRequest, "wallet not configured"))
+    }
+    do {
+      // The token is the Authon session token for this call, not a wallet secret.
+      let value = try await CallToken.$value.withValue(token) { try await body(wallet) }
+      return ["ok": true, "value": value]
+    } catch {
+      return Self.failure(error)
+    }
+  }
+
+  private func envelope(_ body: () throws -> Any) -> [String: Any] {
+    do {
+      return ["ok": true, "value": try body()]
+    } catch {
+      return Self.failure(error)
+    }
+  }
+
+  private static func failure(_ error: Error) -> [String: Any] {
+    let e: WalletError
+    if let w = error as? WalletError {
+      e = w
+    } else if error is CancellationError {
+      e = WalletError(.userCancelled)
+    } else {
+      e = WalletError(.internal, "unexpected error")
+    }
+    return [
+      "ok": false,
+      "code": e.code.rawValue,
+      "message": e.message,
+      "diagnosticId": orNull(e.diagnosticId),
+      "retryable": e.retryable,
+    ]
+  }
+
+  // MARK: - Public data only
+
+  private static func orNull(_ value: Any?) -> Any { value ?? NSNull() }
+
+  private static func wallet(_ w: PublicWallet) -> [String: Any] {
+    [
+      "address": w.address,
+      "protected": w.isProtected,
+      "needsRestore": w.needsRestore,
+      "backupUpgradeRecommended": w.backupUpgradeRecommended,
+      "devices": w.devices.map {
+        [
+          "id": $0.id,
+          "label": orNull($0.label),
+          "createdAt": orNull($0.createdAt),
+          "lastUsedAt": orNull($0.lastUsedAt),
+          "current": $0.current,
+        ] as [String: Any]
+      },
+    ]
+  }
+
+  private static func capabilities(_ c: WalletCapabilities) -> [String: Any] {
+    func check(_ k: WalletCapabilities.Check) -> [String: Any] {
+      ["status": k.status.rawValue, "reason": orNull(k.reason)]
+    }
+    return [
+      "ready": c.ready.rawValue,
+      "app": check(c.app),
+      "wallet": check(c.wallet),
+      "secureStorage": check(c.secureStorage),
+      "deviceLock": check(c.deviceLock),
+      "passkeyBackup": check(c.passkeyBackup),
+      "diagnosticId": orNull(c.diagnosticId),
+    ]
+  }
+
+  private static func appConfig(_ c: WalletAppConfig) -> [String: Any] {
+    [
+      "projectId": orNull(c.projectId),
+      "allowed": c.allowed,
+      "approved": c.approved,
+      "enabled": c.enabled,
+      "chainIds": c.chainIds,
+      "confirmSigning": c.confirmSigning,
+      "rpId": c.rpId,
+      "minFrameProtocol": orNull(c.minFrameProtocol),
+    ]
+  }
+}
+
+private enum CallToken {
+  @TaskLocal static var value: String?
+}
+
+/// Debug builds only (checked in configure): approves every request without UI, so automated
+/// smoke tests on the simulator can sign. Never used unless the app passes `testing.autoApprove`.
+private struct TestAutoApprover: WalletApprover {
+  func approveSignature(_ summary: SignSummary) async throws {}
+}