@authon/react-native-wallet 0.0.0-stage → 0.4.0

package/ios/vendor/AuthonWallet/Support/JSONValue.swift

@@ -0,0 +1,341 @@
+// GENERATED by scripts/sync-native-wallet.mjs from swift/Sources/AuthonWallet/Support/JSONValue.swift. Do not edit: change the source and run the script.
+import Foundation
+
+/// JSON with object key order and number literals preserved. Typed data and transactions
+/// arrive as JSON text or Foundation values; JavaScript type checks (`typeof x === 'number'`)
+/// in the frame map to the cases here.
+public indirect enum JSONValue: Equatable, Sendable {
+    case null
+    case bool(Bool)
+    /// The number literal as written (no precision loss for large integers).
+    case number(String)
+    case string(String)
+    case array([JSONValue])
+    case object(JSONObject)
+
+    public subscript(key: String) -> JSONValue? {
+        if case .object(let o) = self { return o[key] }
+        return nil
+    }
+
+    var stringValue: String? {
+        if case .string(let s) = self { return s }
+        return nil
+    }
+
+    var objectValue: JSONObject? {
+        if case .object(let o) = self { return o }
+        return nil
+    }
+
+    var arrayValue: [JSONValue]? {
+        if case .array(let a) = self { return a }
+        return nil
+    }
+
+    /// JavaScript truthiness.
+    var isTruthy: Bool {
+        switch self {
+        case .null: return false
+        case .bool(let b): return b
+        case .number(let n): return (Double(n) ?? 0) != 0
+        case .string(let s): return !s.isEmpty
+        case .array, .object: return true
+        }
+    }
+
+    /// `BigInt(value)` for numbers (integral only), strings and booleans.
+    var jsBigInt: BigInteger? {
+        switch self {
+        case .number(let literal): return JSONValue.integer(literal)
+        case .string(let s): return BigInteger(jsString: s)
+        case .bool(let b): return BigInteger(BigUInt(b ? 1 : 0))
+        default: return nil
+        }
+    }
+
+    static func integer(_ literal: String) -> BigInteger? {
+        if let exact = BigInteger(jsString: literal), !literal.isEmpty, !literal.lowercased().hasPrefix("0x") { return exact }
+        guard let d = Double(literal), d.isFinite, d.rounded() == d else { return nil }
+        let text = String(format: "%.0f", d.magnitude)
+        guard let mag = BigUInt(decimal: text) else { return nil }
+        return BigInteger(mag, negative: d < 0)
+    }
+
+    // MARK: - Conversion
+
+    public static func parse(_ text: String) throws -> JSONValue {
+        var parser = JSONParser(Array(text.utf8))
+        let v = try parser.parseDocument()
+        return v
+    }
+
+    /// Converts Foundation values ([String: Any], [Any], NSNumber, String, NSNull). Dictionary keys are sorted.
+    public static func from(_ value: Any?) throws -> JSONValue {
+        guard let value else { return .null }
+        if let v = value as? JSONValue { return v }
+        if value is NSNull { return .null }
+        if let s = value as? String { return .string(s) }
+        // NSNumber first: a bridged 1 would also cast to Bool.
+        if let n = value as? NSNumber {
+            if CFGetTypeID(n) == CFBooleanGetTypeID() { return .bool(n.boolValue) }
+            let type = String(cString: n.objCType)
+            if type == "q" || type == "l" || type == "i" || type == "s" || type == "c" { return .number(String(n.int64Value)) }
+            if type == "Q" || type == "L" || type == "I" || type == "S" || type == "C" { return .number(String(n.uint64Value)) }
+            let d = n.doubleValue
+            guard d.isFinite else { throw WalletError(.invalidRequest, "non-finite number") }
+            if d.rounded() == d, d.magnitude < 1e18 { return .number(String(Int64(d))) }
+            return .number(String(d))
+        }
+        if let a = value as? [Any?] { return .array(try a.map { try from($0) }) }
+        if let a = value as? [Any] { return .array(try a.map { try from($0) }) }
+        if let d = value as? [String: Any?] {
+            return .object(JSONObject(try d.keys.sorted().map { ($0, try from(d[$0] ?? nil)) }))
+        }
+        if let d = value as? [String: Any] {
+            return .object(JSONObject(try d.keys.sorted().map { ($0, try from(d[$0])) }))
+        }
+        throw WalletError(.invalidRequest, "unsupported value \(type(of: value))")
+    }
+
+    /// `JSON.stringify(value, null, 2)`.
+    func pretty(indent: Int = 0) -> String {
+        let pad = String(repeating: "  ", count: indent + 1)
+        let close = String(repeating: "  ", count: indent)
+        switch self {
+        case .null: return "null"
+        case .bool(let b): return b ? "true" : "false"
+        case .number(let n): return n
+        case .string(let s): return JSONValue.quote(s)
+        case .array(let a):
+            if a.isEmpty { return "[]" }
+            return "[\n" + a.map { pad + $0.pretty(indent: indent + 1) }.joined(separator: ",\n") + "\n" + close + "]"
+        case .object(let o):
+            if o.entries.isEmpty { return "{}" }
+            return "{\n" + o.entries.map { pad + JSONValue.quote($0.key) + ": " + $0.value.pretty(indent: indent + 1) }
+                .joined(separator: ",\n") + "\n" + close + "}"
+        }
+    }
+
+    /// `JSON.stringify(value)`.
+    func compact() -> String {
+        switch self {
+        case .null, .bool, .number, .string: return pretty()
+        case .array(let a): return "[" + a.map { $0.compact() }.joined(separator: ",") + "]"
+        case .object(let o): return "{" + o.entries.map { JSONValue.quote($0.key) + ":" + $0.value.compact() }.joined(separator: ",") + "}"
+        }
+    }
+
+    static func quote(_ s: String) -> String {
+        var out = "\""
+        for u in s.unicodeScalars {
+            switch u {
+            case "\"": out += "\\\""
+            case "\\": out += "\\\\"
+            case "\n": out += "\\n"
+            case "\r": out += "\\r"
+            case "\t": out += "\\t"
+            case "\u{08}": out += "\\b"
+            case "\u{0C}": out += "\\f"
+            default:
+                if u.value < 0x20 { out += String(format: "\\u%04x", u.value) } else { out.unicodeScalars.append(u) }
+            }
+        }
+        return out + "\""
+    }
+}
+
+public struct JSONObject: Equatable, Sendable {
+    public var entries: [(key: String, value: JSONValue)]
+
+    public init(_ entries: [(String, JSONValue)] = []) {
+        self.entries = entries.map { (key: $0.0, value: $0.1) }
+    }
+
+    public subscript(key: String) -> JSONValue? {
+        get { entries.last(where: { $0.key == key })?.value }
+        set {
+            if let i = entries.firstIndex(where: { $0.key == key }) {
+                if let newValue { entries[i].value = newValue } else { entries.remove(at: i) }
+            } else if let newValue {
+                entries.append((key: key, value: newValue))
+            }
+        }
+    }
+
+    public var keys: [String] { entries.map(\.key) }
+
+    public static func == (a: JSONObject, b: JSONObject) -> Bool {
+        a.entries.count == b.entries.count && zip(a.entries, b.entries).allSatisfy { $0.key == $1.key && $0.value == $1.value }
+    }
+}
+
+private struct JSONParser {
+    let s: [UInt8]
+    var i = 0
+    var depth = 0
+
+    init(_ s: [UInt8]) { self.s = s }
+
+    private func fail() -> WalletError { WalletError(.invalidRequest, "invalid JSON") }
+
+    mutating func parseDocument() throws -> JSONValue {
+        let v = try value()
+        skip()
+        guard i == s.count else { throw fail() }
+        return v
+    }
+
+    mutating func skip() {
+        while i < s.count, s[i] == 0x20 || s[i] == 0x0a || s[i] == 0x0d || s[i] == 0x09 { i += 1 }
+    }
+
+    mutating func value() throws -> JSONValue {
+        skip()
+        guard i < s.count else { throw fail() }
+        switch s[i] {
+        case UInt8(ascii: "{"): return try object()
+        case UInt8(ascii: "["): return try array()
+        case UInt8(ascii: "\""): return .string(try string())
+        case UInt8(ascii: "t"): try literal("true"); return .bool(true)
+        case UInt8(ascii: "f"): try literal("false"); return .bool(false)
+        case UInt8(ascii: "n"): try literal("null"); return .null
+        default: return try number()
+        }
+    }
+
+    mutating func literal(_ word: String) throws {
+        let w = Array(word.utf8)
+        guard i + w.count <= s.count, Array(s[i..<i + w.count]) == w else { throw fail() }
+        i += w.count
+    }
+
+    mutating func object() throws -> JSONValue {
+        depth += 1
+        guard depth < 64 else { throw fail() }
+        defer { depth -= 1 }
+        i += 1
+        var obj = JSONObject()
+        skip()
+        if i < s.count, s[i] == UInt8(ascii: "}") { i += 1; return .object(obj) }
+        while true {
+            skip()
+            guard i < s.count, s[i] == UInt8(ascii: "\"") else { throw fail() }
+            let k = try string()
+            skip()
+            guard i < s.count, s[i] == UInt8(ascii: ":") else { throw fail() }
+            i += 1
+            let v = try value()
+            // JSON.parse keeps the first position and the last value of a duplicate key.
+            obj[k] = v
+            skip()
+            guard i < s.count else { throw fail() }
+            if s[i] == UInt8(ascii: ",") { i += 1; continue }
+            if s[i] == UInt8(ascii: "}") { i += 1; return .object(obj) }
+            throw fail()
+        }
+    }
+
+    mutating func array() throws -> JSONValue {
+        depth += 1
+        guard depth < 64 else { throw fail() }
+        defer { depth -= 1 }
+        i += 1
+        var out = [JSONValue]()
+        skip()
+        if i < s.count, s[i] == UInt8(ascii: "]") { i += 1; return .array(out) }
+        while true {
+            out.append(try value())
+            skip()
+            guard i < s.count else { throw fail() }
+            if s[i] == UInt8(ascii: ",") { i += 1; continue }
+            if s[i] == UInt8(ascii: "]") { i += 1; return .array(out) }
+            throw fail()
+        }
+    }
+
+    mutating func string() throws -> String {
+        i += 1
+        var scalars = String.UnicodeScalarView()
+        var raw = [UInt8]()
+        func flush() throws {
+            if raw.isEmpty { return }
+            guard let str = String(bytes: raw, encoding: .utf8) else { throw fail() }
+            scalars.append(contentsOf: str.unicodeScalars)
+            raw.removeAll()
+        }
+        while i < s.count {
+            let c = s[i]
+            if c == UInt8(ascii: "\"") {
+                i += 1
+                try flush()
+                return String(scalars)
+            }
+            if c < 0x20 { throw fail() }
+            if c == UInt8(ascii: "\\") {
+                try flush()
+                i += 1
+                guard i < s.count else { throw fail() }
+                let e = s[i]
+                i += 1
+                switch e {
+                case UInt8(ascii: "\""): scalars.append("\"")
+                case UInt8(ascii: "\\"): scalars.append("\\")
+                case UInt8(ascii: "/"): scalars.append("/")
+                case UInt8(ascii: "b"): scalars.append("\u{08}")
+                case UInt8(ascii: "f"): scalars.append("\u{0C}")
+                case UInt8(ascii: "n"): scalars.append("\n")
+                case UInt8(ascii: "r"): scalars.append("\r")
+                case UInt8(ascii: "t"): scalars.append("\t")
+                case UInt8(ascii: "u"):
+                    var unit = try hex4()
+                    if (0xD800..<0xDC00).contains(unit), i + 1 < s.count, s[i] == UInt8(ascii: "\\"), s[i + 1] == UInt8(ascii: "u") {
+                        let save = i
+                        i += 2
+                        let low = try hex4()
+                        if (0xDC00..<0xE000).contains(low) {
+                            unit = 0x10000 + ((unit - 0xD800) << 10) + (low - 0xDC00)
+                        } else {
+                            i = save
+                        }
+                    }
+                    // Lone surrogates become U+FFFD (JavaScript keeps them; Swift strings cannot).
+                    scalars.append(Unicode.Scalar(unit) ?? "\u{FFFD}")
+                default: throw fail()
+                }
+                continue
+            }
+            raw.append(c)
+            i += 1
+        }
+        throw fail()
+    }
+
+    mutating func hex4() throws -> UInt32 {
+        guard i + 4 <= s.count, let v = UInt32(String(decoding: s[i..<i + 4], as: UTF8.self), radix: 16) else { throw fail() }
+        i += 4
+        return v
+    }
+
+    mutating func number() throws -> JSONValue {
+        let start = i
+        if i < s.count, s[i] == UInt8(ascii: "-") { i += 1 }
+        let intStart = i
+        while i < s.count, (0x30...0x39).contains(s[i]) { i += 1 }
+        guard i > intStart, !(s[intStart] == 0x30 && i - intStart > 1) else { throw fail() }
+        if i < s.count, s[i] == UInt8(ascii: ".") {
+            i += 1
+            let f = i
+            while i < s.count, (0x30...0x39).contains(s[i]) { i += 1 }
+            guard i > f else { throw fail() }
+        }
+        if i < s.count, s[i] == UInt8(ascii: "e") || s[i] == UInt8(ascii: "E") {
+            i += 1
+            if i < s.count, s[i] == UInt8(ascii: "+") || s[i] == UInt8(ascii: "-") { i += 1 }
+            let e = i
+            while i < s.count, (0x30...0x39).contains(s[i]) { i += 1 }
+            guard i > e else { throw fail() }
+        }
+        return .number(String(decoding: s[start..<i], as: UTF8.self))
+    }
+}

package/ios/vendor/AuthonWallet/UI/WalletApprover.swift

@@ -0,0 +1,250 @@
+// GENERATED by scripts/sync-native-wallet.mjs from swift/Sources/AuthonWallet/UI/WalletApprover.swift. Do not edit: change the source and run the script.
+import Foundation
+import LocalAuthentication
+import SwiftUI
+#if canImport(UIKit)
+import UIKit
+#elseif canImport(AppKit)
+import AppKit
+#endif
+
+/// Passkey operations an approver may confirm before the system passkey sheet appears.
+public enum PasskeyAction: String, Sendable {
+    case protect
+    case upgradeBackup
+    case restore
+    /// Restore that revokes every other device.
+    case restoreReset
+}
+
+/// Approves signatures. It runs before the company share is requested, so a refused request
+/// never assembles the key. Apps can replace the default sheet; the app is inside the trust
+/// boundary anyway (docs/wallet/NATIVE.md section 2).
+public protocol WalletApprover: Sendable {
+    /// Return to approve; throw (USER_CANCELLED) to refuse.
+    func approveSignature(_ summary: SignSummary) async throws
+    /// Return to continue; throw (USER_CANCELLED) to stop.
+    func confirmPasskeyAction(_ action: PasskeyAction) async throws
+}
+
+extension WalletApprover {
+    public func confirmPasskeyAction(_ action: PasskeyAction) async throws {}
+}
+
+/// Extra device-owner check (Face ID, Touch ID or passcode) before each signature.
+public protocol DeviceAuthenticator: Sendable {
+    func authenticate(reason: String) async throws
+}
+
+public struct LocalDeviceAuthenticator: DeviceAuthenticator {
+    public init() {}
+
+    public func authenticate(reason: String) async throws {
+        let context = LAContext()
+        var error: NSError?
+        guard context.canEvaluatePolicy(.deviceOwnerAuthentication, error: &error) else {
+            throw WalletError(.forbidden, "device authentication is not available")
+        }
+        let ok: Bool
+        do {
+            ok = try await context.evaluatePolicy(.deviceOwnerAuthentication, localizedReason: reason)
+        } catch {
+            throw WalletError(.userCancelled)
+        }
+        if !ok { throw WalletError(.userCancelled) }
+    }
+}
+
+/// The default approver: a SwiftUI sheet over the key window. It never waits for a sheet
+/// that is not on screen: without a window to present from, or when the sheet has not
+/// appeared within `appearTimeout`, the request fails with CONFIRM_WINDOW_BLOCKED (nothing
+/// is signed). Rejecting in the sheet is USER_CANCELLED.
+public struct SheetWalletApprover: WalletApprover {
+    #if canImport(UIKit)
+    typealias Presenter = @MainActor @Sendable () -> UIViewController?
+    #else
+    typealias Presenter = @MainActor @Sendable () -> NSWindow?
+    #endif
+
+    let appearTimeout: TimeInterval
+    let presenter: Presenter
+
+    public init(appearTimeout: TimeInterval = 2) {
+        self.init(appearTimeout: appearTimeout, presenter: { Self.defaultPresenter() })
+    }
+
+    init(appearTimeout: TimeInterval, presenter: @escaping Presenter) {
+        self.appearTimeout = appearTimeout
+        self.presenter = presenter
+    }
+
+    enum Outcome { case approved, rejected, blocked }
+
+    private static func check(_ outcome: Outcome) throws {
+        switch outcome {
+        case .approved: return
+        case .rejected: throw WalletError(.userCancelled)
+        case .blocked: throw WalletError(.confirmWindowBlocked, "the approval sheet could not be shown")
+        }
+    }
+
+    public func approveSignature(_ summary: SignSummary) async throws {
+        try Self.check(await present { finish in ApprovalView(summary: summary, onFinish: finish) })
+    }
+
+    public func confirmPasskeyAction(_ action: PasskeyAction) async throws {
+        // The system passkey sheet is the confirmation for the other actions.
+        guard action == .restoreReset else { return }
+        try Self.check(await present { finish in ResetConfirmView(onFinish: finish) })
+    }
+
+    @MainActor
+    func present<V: View>(_ build: @escaping (@escaping (Bool) -> Void) -> V) async -> Outcome {
+        await withCheckedContinuation { (cont: CheckedContinuation<Outcome, Never>) in
+            var finished = false
+            var appeared = false
+            #if canImport(UIKit)
+            var host: UIViewController?
+            let complete: (Outcome) -> Void = { outcome in
+                guard !finished else { return }
+                finished = true
+                // Resume once the sheet is gone, so a following request can present its own
+                // sheet (presenting on a controller that is being dismissed silently fails).
+                guard let h = host, h.presentingViewController != nil else {
+                    cont.resume(returning: outcome)
+                    return
+                }
+                h.dismiss(animated: true) { cont.resume(returning: outcome) }
+            }
+            let controller = UIHostingController(rootView: build { complete($0 ? .approved : .rejected) })
+            controller.isModalInPresentation = true
+            host = controller
+            guard let top = presenter() else {
+                complete(.blocked)
+                return
+            }
+            top.present(controller, animated: true) { appeared = true }
+            let isOnScreen = { appeared || controller.viewIfLoaded?.window != nil }
+            #else
+            var sheet: NSWindow?
+            var parent: NSWindow?
+            let complete: (Outcome) -> Void = { outcome in
+                guard !finished else { return }
+                finished = true
+                if let sheet, sheet.sheetParent != nil { parent?.endSheet(sheet) }
+                cont.resume(returning: outcome)
+            }
+            guard let window = presenter() else {
+                complete(.blocked)
+                return
+            }
+            let w = NSWindow(contentViewController: NSHostingController(rootView: build { complete($0 ? .approved : .rejected) }.frame(minWidth: 420, minHeight: 360)))
+            sheet = w
+            parent = window
+            window.beginSheet(w)
+            let isOnScreen = { appeared || w.sheetParent != nil || w.isVisible }
+            #endif
+            DispatchQueue.main.asyncAfter(deadline: .now() + appearTimeout) {
+                if !finished && !isOnScreen() { complete(.blocked) }
+            }
+        }
+    }
+
+    #if canImport(UIKit)
+    @MainActor
+    static func defaultPresenter() -> UIViewController? {
+        let scenes = UIApplication.shared.connectedScenes.compactMap { $0 as? UIWindowScene }
+        let window = scenes.flatMap(\.windows).first(where: \.isKeyWindow) ?? scenes.first?.windows.first
+        var top = window?.rootViewController
+        while let presented = top?.presentedViewController, !presented.isBeingDismissed { top = presented }
+        return top
+    }
+    #else
+    @MainActor
+    static func defaultPresenter() -> NSWindow? {
+        NSApplication.shared.keyWindow ?? NSApplication.shared.windows.first(where: \.isVisible)
+    }
+    #endif
+}
+
+struct ApprovalView: View {
+    let summary: SignSummary
+    let onFinish: (Bool) -> Void
+    @State private var readToEnd = false
+
+    var body: some View {
+        VStack(alignment: .leading, spacing: 16) {
+            Text(summary.title).font(.title2.bold())
+            ForEach(Array(summary.warnings.enumerated()), id: \.offset) { _, w in
+                Label(w, systemImage: "exclamationmark.triangle.fill")
+                    .foregroundColor(.red)
+                    .font(.callout)
+            }
+            VStack(alignment: .leading, spacing: 8) {
+                ForEach(Array(summary.rows.enumerated()), id: \.offset) { _, row in
+                    VStack(alignment: .leading, spacing: 2) {
+                        Text(row.label).font(.caption).foregroundColor(.secondary)
+                        Text(row.value)
+                            .font(row.mono ? .system(.footnote, design: .monospaced) : .body)
+                            .textSelection(.enabled)
+                    }
+                }
+            }
+            if let text = summary.body {
+                ScrollView {
+                    LazyVStack(alignment: .leading, spacing: 0) {
+                        Text(text)
+                            .font(.system(.footnote, design: .monospaced))
+                            .frame(maxWidth: .infinity, alignment: .leading)
+                            .textSelection(.enabled)
+                        Color.clear.frame(height: 1).onAppear { readToEnd = true }
+                    }
+                    .padding(8)
+                }
+                .frame(maxHeight: 280)
+                .background(Color.secondary.opacity(0.1))
+                .cornerRadius(8)
+                if !readToEnd {
+                    Text("Scroll to the end to sign.").font(.caption).foregroundColor(.secondary)
+                }
+            }
+            Spacer(minLength: 0)
+            HStack(spacing: 12) {
+                Button(role: .cancel) { onFinish(false) } label: {
+                    Text("Reject").frame(maxWidth: .infinity)
+                }
+                .buttonStyle(.bordered)
+                Button { onFinish(true) } label: {
+                    Text("Sign").frame(maxWidth: .infinity)
+                }
+                .buttonStyle(.borderedProminent)
+                .tint(summary.warnings.isEmpty ? .accentColor : .red)
+                .disabled(summary.body != nil && !readToEnd)
+            }
+            .controlSize(.large)
+        }
+        .padding(20)
+    }
+}
+
+struct ResetConfirmView: View {
+    let onFinish: (Bool) -> Void
+
+    var body: some View {
+        VStack(alignment: .leading, spacing: 16) {
+            Text("Restore and sign out other devices").font(.title2.bold())
+            Text("Your wallet will be restored on this device with your passkey. Every other device and browser that holds this wallet will stop working and must restore again.")
+                .font(.body)
+            Spacer(minLength: 0)
+            HStack(spacing: 12) {
+                Button(role: .cancel) { onFinish(false) } label: { Text("Cancel").frame(maxWidth: .infinity) }
+                    .buttonStyle(.bordered)
+                Button { onFinish(true) } label: { Text("Restore").frame(maxWidth: .infinity) }
+                    .buttonStyle(.borderedProminent)
+                    .tint(.red)
+            }
+            .controlSize(.large)
+        }
+        .padding(20)
+    }
+}

package/ios/vendor/AuthonWallet/Wallet/Backup.swift

@@ -0,0 +1,69 @@
+// GENERATED by scripts/sync-native-wallet.mjs from swift/Sources/AuthonWallet/Wallet/Backup.swift. Do not edit: change the source and run the script.
+import CryptoKit
+import Foundation
+
+/// Passkey backup encryption, byte-identical to `apps/wallet/src/prf.ts`.
+public enum BackupVersion: Int, Sendable {
+    /// Salt SHA-256("authon-wallet-backup-v1"); ciphertext without prefix.
+    case v1 = 1
+    /// Salt bound to project and wallet; ciphertext stored as `v2.<base64>`.
+    case v2 = 2
+}
+
+enum WalletBackup {
+    static let saltLabelV1 = "authon-wallet-backup-v1"
+    static let saltLabelV2 = "authon-wallet-backup-v2"
+    static let hkdfInfo = "authon-wallet-backup-v1/aes-gcm-256"
+    static let v2Prefix = "v2."
+
+    static func passkeyUserId(projectId: String, userId: String) -> [UInt8] {
+        Bytes.sha256(Array("\(projectId):\(userId)".utf8))
+    }
+
+    static func prfSalt(_ version: BackupVersion, projectId: String, walletId: String) -> [UInt8] {
+        switch version {
+        case .v1: return Bytes.sha256(Array(saltLabelV1.utf8))
+        case .v2: return Bytes.sha256(Array("\(saltLabelV2)\u{0}\(projectId)\u{0}\(walletId)".utf8))
+        }
+    }
+
+    static func version(of payload: String) -> BackupVersion { payload.hasPrefix(v2Prefix) ? .v2 : .v1 }
+
+    /// HKDF-SHA256(ikm = PRF output, salt = empty, info) -> AES-256 key.
+    static func deriveKey(prfOutput: [UInt8]) -> SymmetricKey {
+        HKDF<SHA256>.deriveKey(
+            inputKeyMaterial: SymmetricKey(data: prfOutput),
+            salt: Data(),
+            info: Data(hkdfInfo.utf8),
+            outputByteCount: 32
+        )
+    }
+
+    private static func aad(_ walletId: String, _ version: BackupVersion) -> Data {
+        Data((version == .v1 ? "backup:\(walletId)" : "backup:v2:\(walletId)").utf8)
+    }
+
+    static func encrypt(key: SymmetricKey, share: [UInt8], walletId: String, version: BackupVersion, iv: [UInt8]? = nil) throws -> String {
+        let nonce = try AES.GCM.Nonce(data: iv ?? (try Bytes.random(12)))
+        let box = try AES.GCM.seal(share, using: key, nonce: nonce, authenticating: aad(walletId, version))
+        let body = Bytes.base64(Array(nonce) + Array(box.ciphertext) + Array(box.tag))
+        return version == .v1 ? body : v2Prefix + body
+    }
+
+    static func decrypt(key: SymmetricKey, payload: String, walletId: String) throws -> [UInt8] {
+        let version = version(of: payload)
+        guard let raw = Bytes.fromBase64(version == .v1 ? payload : String(payload.dropFirst(v2Prefix.count))), raw.count >= 28 else {
+            throw WalletError(.invalidRequest, "backup ciphertext malformed")
+        }
+        do {
+            let box = try AES.GCM.SealedBox(
+                nonce: AES.GCM.Nonce(data: raw[0..<12]),
+                ciphertext: raw[12..<(raw.count - 16)],
+                tag: raw[(raw.count - 16)...]
+            )
+            return Array(try AES.GCM.open(box, using: key, authenticating: aad(walletId, version)))
+        } catch {
+            throw WalletError(.invalidRequest, "backup cannot be decrypted with this passkey")
+        }
+    }
+}