@authon/react-native-wallet 0.0.0-stage → 0.4.0

package/ios/vendor/AuthonWallet/AuthonWallet.swift

@@ -0,0 +1,232 @@
+// GENERATED by scripts/sync-native-wallet.mjs from swift/Sources/AuthonWallet/AuthonWallet.swift. Do not edit: change the source and run the script.
+import Foundation
+import Security
+
+/// The Authon embedded wallet on iOS and macOS. Same wallet, shares and API as the web
+/// frame: the device keeps only its share D; every signature fetches the company share A
+/// with a device-key proof, combines them in memory, signs and wipes the key.
+///
+/// This module does not depend on the `Authon` auth module; `AuthonWalletAuthon` adds an
+/// initializer that takes an `Authon` instance.
+public final class AuthonWallet: @unchecked Sendable {
+    public typealias SessionProvider = @Sendable () async throws -> String
+
+    private let api: WalletAPIClient
+    private let sessionProvider: SessionProvider
+    private let appId: String?
+    private let customStore: DeviceStore?
+    private let customPasskeys: PasskeyProvider?
+    private let approver: WalletApprover?
+    private let deviceAuthenticator: DeviceAuthenticator?
+    private let allowSoftwareKeys: Bool
+    private let lock = NSLock()
+    private var cachedConfig: WalletAppConfig?
+    private var cachedStore: DeviceStore?
+
+    /// - Parameters:
+    ///   - sessionProvider: Returns the current Authon session token (refreshed if needed).
+    ///   - appId: `TEAMID.bundleId` as registered in the Authon console. Detected from the
+    ///     app's keychain access group when nil.
+    ///   - approver: Shown before every signature when the project requires confirmation
+    ///     (server setting). Pass your own to replace the default sheet.
+    ///   - requireDeviceAuthentication: Ask for Face ID / Touch ID / passcode before each signature.
+    ///   - deviceStore: Defaults to the Secure Enclave store.
+    ///   - allowSoftwareKeys: Use software device keys when there is no Secure Enclave (simulator,
+    ///     tests). Refused in release builds on devices. Never enable it for production.
+    public init(
+        publishableKey: String,
+        apiURL: String = "https://api.authon.dev",
+        sessionProvider: @escaping SessionProvider,
+        appId: String? = nil,
+        approver: WalletApprover? = SheetWalletApprover(),
+        requireDeviceAuthentication: Bool = false,
+        deviceAuthenticator: DeviceAuthenticator? = nil,
+        deviceStore: DeviceStore? = nil,
+        passkeys: PasskeyProvider? = nil,
+        allowSoftwareKeys: Bool = false,
+        urlSession: URLSession = .shared
+    ) {
+        api = WalletAPIClient(apiURL: apiURL, publishableKey: publishableKey, session: urlSession)
+        self.sessionProvider = sessionProvider
+        self.appId = appId
+        self.approver = approver
+        self.deviceAuthenticator = deviceAuthenticator ?? (requireDeviceAuthentication ? LocalDeviceAuthenticator() : nil)
+        customStore = deviceStore
+        customPasskeys = passkeys
+        self.allowSoftwareKeys = allowSoftwareKeys
+    }
+
+    // MARK: - Context
+
+    /// App registration and wallet settings from the API (cached).
+    public func appConfig() async throws -> WalletAppConfig {
+        if let c = lock.withLock({ cachedConfig }) { return c }
+        return try await refreshAppConfig()
+    }
+
+    /// Fetches app-config again (used by capabilities()); a successful answer replaces the cache.
+    func refreshAppConfig() async throws -> WalletAppConfig {
+        guard let appId = appId ?? Self.detectAppIdentifier() else {
+            throw WalletError(.originNotAllowed, "appId (TEAMID.bundleId) could not be determined")
+        }
+        let cfg = try await api.appConfig(platform: "ios", appId: appId)
+        if cfg.projectFound { lock.withLock { cachedConfig = cfg } }
+        return cfg
+    }
+
+    private func store() throws -> DeviceStore {
+        if let s = customStore { return s }
+        return try lock.withLock {
+            if let s = cachedStore { return s }
+            let s: DeviceStore
+            if let se = try? SecureEnclaveDeviceStore() {
+                s = se
+            } else if allowSoftwareKeys {
+                s = try SoftwareDeviceStore(persistent: true)
+            } else {
+                throw WalletError(.storageUnavailable, "this device has no Secure Enclave")
+            }
+            cachedStore = s
+            return s
+        }
+    }
+
+    private func context(passkeys needed: Bool = false) async throws -> (WalletOps, String) {
+        // Like the frame, a request without a session is refused before anything else.
+        let session = try await sessionProvider()
+        guard !session.isEmpty else { throw WalletError(.unauthorized, "token required") }
+        let cfg = try await appConfig()
+        guard cfg.allowed else { throw WalletError(.originNotAllowed, "this app is not registered for the project") }
+        if let min = cfg.minFrameProtocol, min > WalletAPIClient.frameProtocol { throw WalletError(.frameOutdated) }
+        if needed && !cfg.approved {
+            throw WalletError(.originNotAllowed, "the app registration is not approved yet, so wallet passkeys are unavailable")
+        }
+        let ctx = WalletContext(
+            api: api,
+            store: try store(),
+            passkeys: customPasskeys ?? PlatformPasskeyProvider(relyingPartyIdentifier: cfg.rpId),
+            projectId: cfg.projectId ?? api.publishableKey,
+            confirmSigning: cfg.confirmSigning,
+            backupVersion: cfg.prfSaltVersion,
+            approver: approver,
+            deviceAuthenticator: deviceAuthenticator
+        )
+        return (WalletOps(ctx: ctx), session)
+    }
+
+    private func run<T>(passkeys: Bool = false, _ body: (WalletOps, String) async throws -> T) async throws -> T {
+        do {
+            let (ops, session) = try await context(passkeys: passkeys)
+            return try await body(ops, session)
+        } catch {
+            throw WalletError.wrap(error)
+        }
+    }
+
+    // MARK: - Operations
+
+    /// The wallet of the signed-in user. Throws NOT_FOUND when there is none yet.
+    public func status() async throws -> PublicWallet {
+        try await run { ops, s in try PublicWallet(try await ops.status(s)) }
+    }
+
+    /// Full status including a pending (unconfirmed) wallet; does not throw NOT_FOUND.
+    public func detailedStatus() async throws -> WalletStatus {
+        try await run { ops, s in try await ops.status(s) }
+    }
+
+    /// Creates the wallet (two-phase), or returns the existing one.
+    public func create() async throws -> PublicWallet {
+        try await run { ops, s in try PublicWallet(try await ops.create(s)) }
+    }
+
+    /// Addresses of accounts start..<start+count on `chain` (EVM: m/44'/60'/0'/0/n; other paths in
+    /// `WalletChain.path`). A wallet from before HD wallets has only EVM account 0 (ACCOUNT_UNAVAILABLE).
+    public func accounts(start: Int = 0, count: Int = 1, chain: WalletChain = .evm) async throws -> [WalletAccount] {
+        try await run { ops, s in try await ops.accounts(s, start: start, count: count, chain: chain) }
+    }
+
+    /// EIP-191 personal_sign. `account` > 0 must come with the address from `accounts()`.
+    public func signMessage(_ message: WalletMessage, account: Int = 0, address: String? = nil) async throws -> String {
+        try await run { ops, s in try await ops.signMessage(s, message, account: try SignAccount.parse(index: account, address: address)) }
+    }
+
+    public func signMessage(_ text: String, account: Int = 0, address: String? = nil) async throws -> String {
+        try await signMessage(.text(text), account: account, address: address)
+    }
+
+    /// EIP-712 v4. `typedData` is a JSON string, a `[String: Any]` dictionary or a JSONValue.
+    public func signTypedData(_ typedData: Any, account: Int = 0, address: String? = nil) async throws -> String {
+        try await run { ops, s in
+            let value: JSONValue = try (typedData as? String).map { try JSONValue.parse($0) } ?? JSONValue.from(typedData)
+            return try await ops.signTypedData(s, value, account: try SignAccount.parse(index: account, address: address))
+        }
+    }
+
+    /// Signs a legacy, EIP-2930 or EIP-1559 transaction and returns the serialized signed
+    /// transaction. Numeric fields may be numbers, decimal strings or 0x hex strings.
+    public func signTransaction(_ transaction: Any, account: Int = 0, address: String? = nil) async throws -> String {
+        try await run { ops, s in
+            let value: JSONValue = try (transaction as? String).map { try JSONValue.parse($0) } ?? JSONValue.from(transaction)
+            return try await ops.signTransaction(s, value, account: try SignAccount.parse(index: account, address: address))
+        }
+    }
+
+    /// Signs a transaction the app built for another chain (EVM uses `signTransaction`: UNSUPPORTED_TYPE).
+    /// - Solana: `["message": <serialized Message, base64>, "cluster": "devnet"]` (cluster optional,
+    ///   only labels the approval) → `["signature": <base58>]`.
+    /// - TRON: `["rawDataHex": <raw_data protobuf, hex>]` → `["txID": <hex>, "signature": <r||s||v hex>]`.
+    /// - Bitcoin / testnet: `["psbt": <base64>]` → `["psbt": <signed PSBT base64>, "txHex": <raw tx>]`
+    ///   (`txHex` only when every input was the account's).
+    /// - XRP: `["txBlobHex": <encodeForSigning output>]` → `["signature": <DER, uppercase hex>]`.
+    /// `address` is the expected address of `account` on that chain (from `accounts(chain:)`).
+    public func signChainTransaction(chain: WalletChain, account: Int = 0, address: String, payload: [String: Any]) async throws -> [String: String] {
+        try await run { ops, s in
+            try await ops.signChainTransaction(s, chain: chain, account: account, address: address, payload: try JSONValue.from(payload))
+        }
+    }
+
+    /// Creates the passkey backup (iOS 18 / macOS 15 for PRF).
+    public func protect() async throws -> ProtectResult {
+        try await run(passkeys: true) { ops, s in try await ops.protect(s) }
+    }
+
+    /// Replaces a legacy backup with a verifiable one, from a device that holds the wallet.
+    public func upgradeBackup() async throws -> ProtectResult {
+        try await run(passkeys: true) { ops, s in try await ops.upgradeBackup(s) }
+    }
+
+    /// Restores the wallet on this device with the backup passkey.
+    public func restore(mode: RestoreMode = .add) async throws -> RestoreResult {
+        try await run(passkeys: true) { ops, s in try await ops.restore(s, mode: mode) }
+    }
+
+    public func revokeDevice(_ deviceId: String) async throws {
+        try await run { ops, s in try await ops.revokeDevice(s, deviceId: deviceId) }
+    }
+
+    // MARK: - App identifier
+
+    /// `TEAMID.bundleId` from the default keychain access group (the app identifier prefix).
+    static func detectAppIdentifier() -> String? {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: "dev.authon.wallet.app-id",
+            kSecAttrAccount as String: "probe",
+            kSecReturnAttributes as String: true,
+        ]
+        #if os(macOS)
+        q[kSecUseDataProtectionKeychain as String] = true
+        #endif
+        var out: AnyObject?
+        var status = SecItemCopyMatching(q as CFDictionary, &out)
+        if status == errSecItemNotFound {
+            var add = q
+            add[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+            status = SecItemAdd(add as CFDictionary, &out)
+        }
+        guard status == errSecSuccess, let attrs = out as? [String: Any], let group = attrs[kSecAttrAccessGroup as String] as? String,
+              group.contains(".") else { return nil }
+        return group
+    }
+}

package/ios/vendor/AuthonWallet/Capabilities.swift

@@ -0,0 +1,149 @@
+// GENERATED by scripts/sync-native-wallet.mjs from swift/Sources/AuthonWallet/Capabilities.swift. Do not edit: change the source and run the script.
+import CryptoKit
+import Foundation
+import LocalAuthentication
+import Security
+
+/// Pre-sign-in check (docs/wallet/NATIVE.md section 9): whether this app and device can use the
+/// wallet. Needs no session, opens no login or passkey UI and never creates a wallet.
+public struct WalletCapabilities: Equatable, Sendable {
+    public enum Status: String, Sendable {
+        case available, unavailable, unknown
+    }
+
+    public struct Check: Equatable, Sendable {
+        public var status: Status
+        /// Section 9 reason code; nil when available.
+        public var reason: String?
+
+        public static let available = Check(status: .available, reason: nil)
+        static func unavailable(_ reason: String) -> Check { Check(status: .unavailable, reason: reason) }
+        static func unknown(_ reason: String) -> Check { Check(status: .unknown, reason: reason) }
+    }
+
+    /// unavailable if any check is unavailable, else unknown if any is unknown, else available.
+    public var ready: Status
+    /// App registration and approval (GET /v1/wallet/app-config).
+    public var app: Check
+    /// The embedded wallet is enabled for the project.
+    public var wallet: Check
+    /// Hardware-protected key storage (Secure Enclave on a real device).
+    public var secureStorage: Check
+    /// A device passcode or biometrics is set.
+    public var deviceLock: Check
+    /// Passkey PRF backup and restore (static OS support only).
+    public var passkeyBackup: Check
+    /// `X-Request-Id` of the app-config response.
+    public var diagnosticId: String?
+
+    init(app: Check, wallet: Check, secureStorage: Check, deviceLock: Check, passkeyBackup: Check, diagnosticId: String?) {
+        self.app = app
+        self.wallet = wallet
+        self.secureStorage = secureStorage
+        self.deviceLock = deviceLock
+        self.passkeyBackup = passkeyBackup
+        self.diagnosticId = diagnosticId
+        let all = [app, wallet, secureStorage, deviceLock, passkeyBackup].map(\.status)
+        ready = all.contains(.unavailable) ? .unavailable : all.contains(.unknown) ? .unknown : .available
+    }
+}
+
+/// Device checks behind capabilities(); replaceable in tests.
+struct CapabilityProbes: Sendable {
+    var secureStorage: @Sendable () -> WalletCapabilities.Check
+    var deviceLock: @Sendable () -> WalletCapabilities.Check
+    var passkeyBackup: @Sendable () -> WalletCapabilities.Check
+
+    static let device = CapabilityProbes(
+        secureStorage: { probeSecureEnclave() },
+        deviceLock: { probeDeviceLock() },
+        passkeyBackup: { probePasskeyBackup() }
+    )
+
+    /// The simulator never counts as hardware protection, even where it emulates an enclave.
+    /// On a device a throwaway enclave key is created and released (never stored).
+    static func probeSecureEnclave() -> WalletCapabilities.Check {
+        #if targetEnvironment(simulator)
+        return .unknown("SIMULATOR")
+        #else
+        guard SecureEnclave.isAvailable else { return .unavailable("HARDWARE_KEYSTORE_UNAVAILABLE") }
+        var error: Unmanaged<CFError>?
+        guard let access = SecAccessControlCreateWithFlags(nil, kSecAttrAccessibleWhenUnlockedThisDeviceOnly, .privateKeyUsage, &error) else {
+            return .unknown("CHECK_FAILED")
+        }
+        let attrs: [String: Any] = [
+            kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+            kSecAttrKeySizeInBits as String: 256,
+            kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave,
+            kSecPrivateKeyAttrs as String: [
+                kSecAttrIsPermanent as String: false,
+                kSecAttrAccessControl as String: access,
+            ] as [String: Any],
+        ]
+        guard SecKeyCreateRandomKey(attrs as CFDictionary, &error) != nil else { return .unknown("CHECK_FAILED") }
+        return .available
+        #endif
+    }
+
+    static func probeDeviceLock() -> WalletCapabilities.Check {
+        let context = LAContext()
+        var error: NSError?
+        if context.canEvaluatePolicy(.deviceOwnerAuthentication, error: &error) { return .available }
+        if let code = error.map({ LAError.Code(rawValue: $0.code) }), code == .passcodeNotSet {
+            return .unavailable("DEVICE_LOCK_NOT_SET")
+        }
+        return .unknown("CHECK_FAILED")
+    }
+
+    static func probePasskeyBackup() -> WalletCapabilities.Check {
+        if #available(iOS 18.0, macOS 15.0, *) {
+            // The API exists; whether the user's passkey provider evaluates PRF shows on the first protect().
+            return .unknown("PRF_PROVIDER_UNVERIFIED")
+        }
+        return .unavailable("OS_UNSUPPORTED")
+    }
+}
+
+extension AuthonWallet {
+    /// See `WalletCapabilities`. Never throws: failures become `unknown` checks.
+    /// `allowSoftwareKeys` does not affect the answer.
+    public func capabilities() async -> WalletCapabilities {
+        await capabilities(probes: .device)
+    }
+
+    func capabilities(probes: CapabilityProbes) async -> WalletCapabilities {
+        let app: WalletCapabilities.Check
+        let wallet: WalletCapabilities.Check
+        var diagnosticId: String?
+        do {
+            let cfg = try await refreshAppConfig()
+            diagnosticId = cfg.diagnosticId
+            if !cfg.projectFound {
+                app = .unavailable("APP_NOT_REGISTERED")
+                wallet = .unknown("API_ERROR")
+            } else {
+                app = !cfg.allowed ? .unavailable("APP_NOT_REGISTERED") : cfg.approved ? .available : .unknown("APP_NOT_APPROVED")
+                wallet = cfg.enabled ? .available : .unavailable("WALLET_DISABLED")
+            }
+        } catch let e as WalletError where e.isNetworkFailure {
+            app = .unknown("NETWORK_ERROR")
+            wallet = .unknown("NETWORK_ERROR")
+        } catch let e as WalletError where e.code == .originNotAllowed {
+            // The app ID could not be determined, so no registration can match it.
+            app = .unavailable("APP_NOT_REGISTERED")
+            wallet = .unknown("API_ERROR")
+        } catch {
+            diagnosticId = (error as? WalletError)?.diagnosticId
+            app = .unknown("API_ERROR")
+            wallet = .unknown("API_ERROR")
+        }
+        return WalletCapabilities(
+            app: app,
+            wallet: wallet,
+            secureStorage: probes.secureStorage(),
+            deviceLock: probes.deviceLock(),
+            passkeyBackup: probes.passkeyBackup(),
+            diagnosticId: diagnosticId
+        )
+    }
+}

package/ios/vendor/AuthonWallet/Chains/Bitcoin.swift

@@ -0,0 +1,296 @@
+// GENERATED by scripts/sync-native-wallet.mjs from swift/Sources/AuthonWallet/Chains/Bitcoin.swift. Do not edit: change the source and run the script.
+import Foundation
+
+/// Bitcoin PSBT signing (docs/wallet/NATIVE.md section 12, `apps/wallet/src/bitcoin.ts`). Inputs
+/// whose previous output is the signing account's P2WPKH script are signed (BIP143,
+/// SIGHASH_ALL); other inputs are left alone. Every input must carry witness_utxo.
+enum Bitcoin {
+    static let maxPsbt = 100_000
+
+    private static func invalid(_ why: String = "not a valid PSBT") -> WalletError { WalletError(.invalidRequest, why) }
+
+    struct KeyValue {
+        var key: [UInt8]
+        var value: [UInt8]
+    }
+
+    struct Input {
+        var prevout: [UInt8] // txid (32, internal order) + vout (4)
+        var sequence: [UInt8]
+        var map: [KeyValue]
+
+        var witnessUtxo: (amount: UInt64, script: [UInt8])? {
+            guard let v = map.first(where: { $0.key == [0x01] })?.value else { return nil }
+            return try? Bitcoin.decodeTxOut(v)
+        }
+    }
+
+    struct Output {
+        var amount: UInt64
+        var script: [UInt8]
+    }
+
+    /// A version 0 PSBT. Key-value pairs are kept as read and written back in the same order.
+    struct Psbt {
+        var global: [KeyValue]
+        var version: [UInt8]
+        var locktime: [UInt8]
+        var inputs: [Input]
+        var outputs: [Output]
+        var outputMaps: [[KeyValue]]
+    }
+
+    // MARK: - Reading
+
+    private struct Reader {
+        let b: [UInt8]
+        var pos = 0
+        var done: Bool { pos == b.count }
+
+        mutating func take(_ n: Int) throws -> [UInt8] {
+            guard n >= 0, n <= b.count - pos else { throw invalid() }
+            pos += n
+            return Array(b[(pos - n)..<pos])
+        }
+
+        mutating func compact() throws -> Int {
+            let first = try take(1)[0]
+            switch first {
+            case 0xfd: return Int(le(try take(2)))
+            case 0xfe: return Int(le(try take(4)))
+            case 0xff:
+                let v = le(try take(8))
+                guard v <= UInt64(Int32.max) else { throw invalid() }
+                return Int(v)
+            default: return Int(first)
+            }
+        }
+
+        mutating func varBytes() throws -> [UInt8] { try take(try compact()) }
+
+        /// One map; ends at the 0x00 separator. Duplicate keys are invalid.
+        mutating func map() throws -> [KeyValue] {
+            var out = [KeyValue]()
+            while true {
+                let key = try varBytes()
+                if key.isEmpty { return out }
+                let value = try varBytes()
+                guard !out.contains(where: { $0.key == key }) else { throw invalid() }
+                out.append(KeyValue(key: key, value: value))
+            }
+        }
+    }
+
+    static func le(_ b: [UInt8]) -> UInt64 { b.enumerated().reduce(UInt64(0)) { $0 | UInt64($1.element) << (8 * UInt64($1.offset)) } }
+    static func le64(_ v: UInt64) -> [UInt8] { (0..<8).map { UInt8(truncatingIfNeeded: v >> (8 * UInt64($0))) } }
+
+    static func compact(_ n: Int) -> [UInt8] {
+        if n < 0xfd { return [UInt8(n)] }
+        if n <= 0xffff { return [0xfd, UInt8(n & 0xff), UInt8(n >> 8)] }
+        return [0xfe] + (0..<4).map { UInt8(truncatingIfNeeded: n >> (8 * $0)) }
+    }
+
+    static func decodeTxOut(_ b: [UInt8]) throws -> (amount: UInt64, script: [UInt8]) {
+        var r = Reader(b: b)
+        let amount = le(try r.take(8))
+        let script = try r.varBytes()
+        guard r.done else { throw invalid() }
+        return (amount, script)
+    }
+
+    static func parse(_ bytes: [UInt8]) throws -> Psbt {
+        guard !bytes.isEmpty, bytes.count <= maxPsbt else { throw invalid() }
+        var r = Reader(b: bytes)
+        guard try r.take(5) == [0x70, 0x73, 0x62, 0x74, 0xff] else { throw invalid() }
+        let global = try r.map()
+        if let v = global.first(where: { $0.key == [0xfb] })?.value, le(v) != 0 { throw invalid("only PSBT version 0 is supported") }
+        guard let unsigned = global.first(where: { $0.key == [0x00] })?.value else { throw invalid() }
+        var t = Reader(b: unsigned)
+        let version = try t.take(4)
+        let inCount = try t.compact()
+        guard inCount > 0 else { throw invalid() } // also rejects a segwit marker
+        var inputs = [Input]()
+        for _ in 0..<inCount {
+            let prevout = try t.take(36)
+            guard try t.varBytes().isEmpty else { throw invalid() } // unsigned: empty scriptSig
+            inputs.append(Input(prevout: prevout, sequence: try t.take(4), map: []))
+        }
+        var outputs = [Output]()
+        for _ in 0..<(try t.compact()) {
+            let amount = le(try t.take(8))
+            outputs.append(Output(amount: amount, script: try t.varBytes()))
+        }
+        let locktime = try t.take(4)
+        guard t.done else { throw invalid() }
+        for i in inputs.indices {
+            inputs[i].map = try r.map()
+            if let utxo = inputs[i].map.first(where: { $0.key == [0x01] }) { _ = try decodeTxOut(utxo.value) }
+            if let sighash = inputs[i].map.first(where: { $0.key == [0x03] })?.value, sighash != [1, 0, 0, 0] {
+                throw invalid("only SIGHASH_ALL inputs can be signed")
+            }
+        }
+        var outputMaps = [[KeyValue]]()
+        for _ in outputs { outputMaps.append(try r.map()) }
+        guard r.done else { throw invalid() }
+        return Psbt(global: global, version: version, locktime: locktime, inputs: inputs, outputs: outputs, outputMaps: outputMaps)
+    }
+
+    static func serialize(_ p: Psbt) -> [UInt8] {
+        func map(_ m: [KeyValue]) -> [UInt8] {
+            var out = [UInt8]()
+            for kv in m {
+                out += compact(kv.key.count)
+                out += kv.key
+                out += compact(kv.value.count)
+                out += kv.value
+            }
+            out.append(0)
+            return out
+        }
+        var out: [UInt8] = [0x70, 0x73, 0x62, 0x74, 0xff]
+        out += map(p.global)
+        for i in p.inputs { out += map(i.map) }
+        for m in p.outputMaps { out += map(m) }
+        return out
+    }
+
+    // MARK: - Scripts and addresses
+
+    static func p2wpkh(_ compressed: [UInt8]) -> [UInt8] { [0x00, 0x14] + ChainAddresses.hash160(compressed) }
+
+    private static func hrp(_ chain: WalletChain) -> String { chain == .bitcoin ? "bc" : "tb" }
+
+    /// Address of a standard output script, or nil.
+    static func address(script s: [UInt8], chain: WalletChain) -> String? {
+        let main = chain == .bitcoin
+        func base58(_ version: UInt8, _ hash: ArraySlice<UInt8>) -> String {
+            let payload = [version] + hash
+            return Base58.encode(payload + ChainAddresses.checksum4(payload), alphabet: Base58.bitcoin)
+        }
+        if s.count == 25, s[0] == 0x76, s[1] == 0xa9, s[2] == 0x14, s[23] == 0x88, s[24] == 0xac { return base58(main ? 0x00 : 0x6f, s[3..<23]) }
+        if s.count == 23, s[0] == 0xa9, s[1] == 0x14, s[22] == 0x87 { return base58(main ? 0x05 : 0xc4, s[2..<22]) }
+        if s.count == 22, s[0] == 0x00, s[1] == 0x14 { return Bech32.segwitAddress(hrp: hrp(chain), version: 0, program: Array(s[2...])) }
+        if s.count == 34, s[0] == 0x00, s[1] == 0x20 { return Bech32.segwitAddress(hrp: hrp(chain), version: 0, program: Array(s[2...])) }
+        if s.count == 34, s[0] == 0x51, s[1] == 0x20 { return Bech32.segwitAddress(hrp: hrp(chain), version: 1, program: Array(s[2...])) }
+        return nil
+    }
+
+    static func btc(_ sats: UInt64) -> String { Solana.units(sats, 8) + " BTC" }
+
+    private static func ownInputs(_ p: Psbt, script: [UInt8]) -> [Int] {
+        p.inputs.indices.filter { p.inputs[$0].witnessUtxo?.script == script }
+    }
+
+    static func summarize(_ p: Psbt, signer: String, chain: WalletChain) throws -> SignSummary {
+        guard let decoded = Bech32.decodeSegwit(hrp: hrp(chain), address: signer), decoded.version == 0, decoded.program.count == 20 else {
+            throw WalletError(.invalidRequest, "address is not a Bitcoin address of this network")
+        }
+        let script = [0x00, 0x14] + decoded.program
+        var rows: [SignSummary.Row] = [
+            .init(label: "Network", value: chain == .bitcoin ? "Bitcoin" : "Bitcoin testnet"),
+            .init(label: "Account", value: signer, mono: true),
+        ]
+        var warnings = [String]()
+        var inputs: UInt64 = 0
+        for i in p.inputs {
+            guard let utxo = i.witnessUtxo else { throw invalid("every input needs witness_utxo") }
+            let (sum, overflow) = inputs.addingReportingOverflow(utxo.amount)
+            guard !overflow else { throw invalid() }
+            inputs = sum
+        }
+        let mine = ownInputs(p, script: script)
+        guard !mine.isEmpty else { throw WalletError(.addressMismatch, "no input belongs to the signing account") }
+        if mine.count != p.inputs.count {
+            warnings.append("\(p.inputs.count - mine.count) of \(p.inputs.count) inputs are not yours and are not signed.")
+        }
+        rows.append(.init(label: "Spending", value: btc(inputs)))
+        var outputs: UInt64 = 0
+        for o in p.outputs {
+            let (sum, overflow) = outputs.addingReportingOverflow(o.amount)
+            guard !overflow else { throw invalid() }
+            outputs = sum
+            let to: String
+            if let a = address(script: o.script, chain: chain) {
+                to = a
+            } else {
+                to = "non-standard output"
+                warnings.append("An output has a script this wallet cannot show as an address.")
+            }
+            rows.append(o.script == script
+                ? .init(label: "Change back to you", value: btc(o.amount))
+                : .init(label: "Send \(btc(o.amount)) to", value: to, mono: true))
+        }
+        guard outputs <= inputs else { throw invalid("outputs exceed inputs") }
+        let fee = inputs - outputs
+        rows.append(.init(label: "Network fee", value: btc(fee)))
+        if fee.multipliedReportingOverflow(by: 10).partialValue > inputs && fee > 100_000 {
+            warnings.append("The network fee is more than 10% of the amount spent.")
+        }
+        return SignSummary(kind: .transaction, title: "Bitcoin transaction", rows: rows, body: nil, warnings: warnings, risk: .high)
+    }
+
+    // MARK: - Signing
+
+    private static func dsha(_ b: [UInt8]) -> [UInt8] { Bytes.sha256(Bytes.sha256(b)) }
+
+    private static func serializeOutputs(_ p: Psbt) -> [UInt8] {
+        p.outputs.flatMap { le64($0.amount) + compact($0.script.count) + $0.script }
+    }
+
+    /// BIP143 SIGHASH_ALL digest of input `index` spending a P2WPKH output of `pubkeyHash`.
+    static func sighash(_ p: Psbt, index: Int, pubkeyHash: [UInt8], amount: UInt64) -> [UInt8] {
+        let hashPrevouts = dsha(p.inputs.flatMap(\.prevout))
+        let hashSequence = dsha(p.inputs.flatMap(\.sequence))
+        let hashOutputs = dsha(serializeOutputs(p))
+        let scriptCode: [UInt8] = [0x19, 0x76, 0xa9, 0x14] + pubkeyHash + [0x88, 0xac]
+        let input = p.inputs[index]
+        var preimage: [UInt8] = p.version
+        preimage += hashPrevouts
+        preimage += hashSequence
+        preimage += input.prevout
+        preimage += scriptCode
+        preimage += le64(amount)
+        preimage += input.sequence
+        preimage += hashOutputs
+        preimage += p.locktime
+        preimage += [1, 0, 0, 0]
+        return dsha(preimage)
+    }
+
+    /// Signs the signer's inputs. Returns the signed PSBT (partial signatures added) and, when
+    /// every input was ours, the finalized raw transaction.
+    static func sign(_ psbt: Psbt, privateKey: [UInt8]) throws -> [String: String] {
+        var p = psbt
+        let pub = try Secp256k1.publicKey(of: privateKey, compressed: true)
+        let script = p2wpkh(pub)
+        let pubkeyHash = Array(script[2...])
+        let mine = ownInputs(p, script: script)
+        guard !mine.isEmpty else { throw WalletError(.addressMismatch) }
+        var witnesses = [Int: [UInt8]]()
+        for i in mine {
+            let amount = p.inputs[i].witnessUtxo!.amount
+            let sig = try Secp256k1.signDER(hash: sighash(p, index: i, pubkeyHash: pubkeyHash, amount: amount), key: privateKey) + [0x01]
+            let key = [0x02] + pub
+            if let at = p.inputs[i].map.firstIndex(where: { $0.key == key }) {
+                p.inputs[i].map[at].value = sig
+            } else {
+                p.inputs[i].map.append(KeyValue(key: key, value: sig))
+            }
+            witnesses[i] = compact(2) + compact(sig.count) + sig + compact(pub.count) + pub
+        }
+        var result = ["psbt": Bytes.base64(serialize(p))]
+        guard mine.count == p.inputs.count else { return result }
+        var tx = p.version + [0x00, 0x01] + compact(p.inputs.count)
+        for i in p.inputs { tx += i.prevout + [0x00] + i.sequence }
+        tx += compact(p.outputs.count) + serializeOutputs(p)
+        for i in p.inputs.indices { tx += witnesses[i]! }
+        tx += p.locktime
+        result["txHex"] = Bytes.hex(tx)
+        return result
+    }
+
+    /// Partial signatures (by input) for checks: the value of the PSBT_IN_PARTIAL_SIG entry for `pubkey`.
+    static func partialSignatures(_ p: Psbt, pubkey: [UInt8]) -> [[UInt8]?] {
+        p.inputs.map { i in i.map.first(where: { $0.key == [0x02] + pubkey })?.value }
+    }
+}