@authon/react-native-wallet 0.0.0-stage → 0.4.0

package/ios/vendor/AuthonWallet/Wallet/DeviceStore.swift

@@ -0,0 +1,351 @@
+// GENERATED by scripts/sync-native-wallet.mjs from swift/Sources/AuthonWallet/Wallet/DeviceStore.swift. Do not edit: change the source and run the script.
+import CryptoKit
+import Foundation
+import Security
+
+/// What this device keeps for one project and user: the sealed device share D and a
+/// reference to the non-exportable device keys. Never the wallet key.
+public struct DeviceRecord: Codable, Equatable, Sendable {
+    /// `projectId \0 userId`
+    public var key: String
+    public var deviceId: String
+    public var walletId: String
+    public var address: String
+    public var shareVersion: Int
+    /// Unix milliseconds.
+    public var createdAt: Double
+    public var publicJwk: DevicePublicJwk
+    /// Store-specific reference to the device keys.
+    public var keyHandle: Data
+    /// D sealed by the store.
+    public var sealedShare: Data
+}
+
+/// A freshly generated device key pair (signing key and share-sealing key).
+public struct DeviceKeys: Equatable, Sendable {
+    public var handle: Data
+    public var publicJwk: DevicePublicJwk
+}
+
+/// Device storage, the native counterpart of the frame's IndexedDB store.
+/// `SecureEnclaveDeviceStore` is the production implementation; tests and the simulator
+/// can use `SoftwareDeviceStore`.
+public protocol DeviceStore: AnyObject, Sendable {
+    func generateKeys() throws -> DeviceKeys
+    /// Removes keys that never made it into a stored record.
+    func discardKeys(_ keys: DeviceKeys)
+    func seal(_ share: [UInt8], keys: DeviceKeys, storageKey: String) throws -> Data
+    /// Throws NEEDS_RESTORE when the share cannot be opened.
+    func open(_ record: DeviceRecord) throws -> [UInt8]
+    /// ECDSA P-256 / SHA-256 over the UTF-8 challenge, raw r || s (64 bytes) like WebCrypto.
+    func sign(challenge: String, record: DeviceRecord) throws -> [UInt8]
+    func get(_ key: String) throws -> DeviceRecord?
+    /// Replaces the record for `record.key`. Keys of a replaced record are removed.
+    func put(_ record: DeviceRecord) throws
+    func delete(_ key: String) throws
+}
+
+func storageKey(projectId: String, userId: String) -> String { "\(projectId)\u{0}\(userId)" }
+
+/// Generic-password items holding DeviceRecord JSON. This-device-only, never synchronized.
+struct KeychainRecords {
+    let service: String
+
+    private func base(_ key: String) -> [String: Any] {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            // The storage key contains a NUL; the account is its hash.
+            kSecAttrAccount as String: Bytes.hex(Bytes.sha256(Array(key.utf8))),
+            kSecAttrSynchronizable as String: kCFBooleanFalse!,
+        ]
+        #if os(macOS)
+        q[kSecUseDataProtectionKeychain as String] = true
+        #endif
+        return q
+    }
+
+    func get(_ key: String) throws -> DeviceRecord? {
+        var q = base(key)
+        q[kSecReturnData as String] = true
+        q[kSecMatchLimit as String] = kSecMatchLimitOne
+        var out: AnyObject?
+        let status = SecItemCopyMatching(q as CFDictionary, &out)
+        if status == errSecItemNotFound { return nil }
+        guard status == errSecSuccess, let data = out as? Data else { throw WalletError(.storageUnavailable, "keychain read failed (\(status))") }
+        guard let record = try? JSONDecoder().decode(DeviceRecord.self, from: data), record.key == key else { return nil }
+        return record
+    }
+
+    func put(_ record: DeviceRecord) throws {
+        let data = try JSONEncoder().encode(record)
+        let q = base(record.key)
+        let update: [String: Any] = [
+            kSecValueData as String: data,
+            kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+        ]
+        var status = SecItemUpdate(q as CFDictionary, update as CFDictionary)
+        if status == errSecItemNotFound {
+            var add = q
+            add.merge(update) { $1 }
+            status = SecItemAdd(add as CFDictionary, nil)
+        }
+        guard status == errSecSuccess else { throw WalletError(.storageUnavailable, "keychain write failed (\(status))") }
+    }
+
+    func delete(_ key: String) throws {
+        let status = SecItemDelete(base(key) as CFDictionary)
+        guard status == errSecSuccess || status == errSecItemNotFound else {
+            throw WalletError(.storageUnavailable, "keychain delete failed (\(status))")
+        }
+    }
+}
+
+/// P-256 keys in the Secure Enclave. The signing key's public half is the device key the API
+/// knows; a second enclave key seals D with ECIES (X9.63 SHA-256 KDF, AES-GCM). D's record is a
+/// this-device-only Keychain item, so it is not in backups or device transfers.
+public final class SecureEnclaveDeviceStore: DeviceStore, @unchecked Sendable {
+    private let records: KeychainRecords
+    private let tagPrefix: String
+    private static let algorithm = SecKeyAlgorithm.eciesEncryptionCofactorVariableIVX963SHA256AESGCM
+
+    /// Throws STORAGE_UNAVAILABLE on devices without a Secure Enclave (including the simulator).
+    public init(service: String = "dev.authon.wallet") throws {
+        guard SecureEnclave.isAvailable else {
+            throw WalletError(.storageUnavailable, "this device has no Secure Enclave")
+        }
+        records = KeychainRecords(service: service)
+        tagPrefix = service + ".key."
+    }
+
+    private struct Handle: Codable {
+        var sign: String
+        var seal: String
+    }
+
+    private func handle(_ data: Data) throws -> Handle {
+        guard let h = try? JSONDecoder().decode(Handle.self, from: data) else { throw WalletError(.needsRestore, "device key reference unreadable") }
+        return h
+    }
+
+    private func createKey(tag: String) throws -> SecKey {
+        var error: Unmanaged<CFError>?
+        guard let access = SecAccessControlCreateWithFlags(nil, kSecAttrAccessibleWhenUnlockedThisDeviceOnly, .privateKeyUsage, &error) else {
+            throw WalletError(.storageUnavailable, "access control unavailable")
+        }
+        var attrs: [String: Any] = [
+            kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+            kSecAttrKeySizeInBits as String: 256,
+            kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave,
+            kSecPrivateKeyAttrs as String: [
+                kSecAttrIsPermanent as String: true,
+                kSecAttrApplicationTag as String: Data(tag.utf8),
+                kSecAttrAccessControl as String: access,
+            ] as [String: Any],
+        ]
+        #if os(macOS)
+        attrs[kSecUseDataProtectionKeychain as String] = true
+        #endif
+        guard let key = SecKeyCreateRandomKey(attrs as CFDictionary, &error) else {
+            throw WalletError(.storageUnavailable, "secure enclave key creation failed")
+        }
+        return key
+    }
+
+    private func loadKey(tag: String) throws -> SecKey {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassKey,
+            kSecAttrApplicationTag as String: Data(tag.utf8),
+            kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+            kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave,
+            kSecReturnRef as String: true,
+        ]
+        #if os(macOS)
+        q[kSecUseDataProtectionKeychain as String] = true
+        #endif
+        var out: AnyObject?
+        guard SecItemCopyMatching(q as CFDictionary, &out) == errSecSuccess, let key = out else {
+            throw WalletError(.needsRestore, "device key not found")
+        }
+        return key as! SecKey
+    }
+
+    private func deleteKey(tag: String) {
+        var q: [String: Any] = [kSecClass as String: kSecClassKey, kSecAttrApplicationTag as String: Data(tag.utf8)]
+        #if os(macOS)
+        q[kSecUseDataProtectionKeychain as String] = true
+        #endif
+        SecItemDelete(q as CFDictionary)
+    }
+
+    private func publicPoint(_ key: SecKey) throws -> [UInt8] {
+        guard let pub = SecKeyCopyPublicKey(key), let raw = SecKeyCopyExternalRepresentation(pub, nil) as Data? else {
+            throw WalletError(.storageUnavailable, "device public key unavailable")
+        }
+        return Array(raw)
+    }
+
+    public func generateKeys() throws -> DeviceKeys {
+        let id = UUID().uuidString
+        let h = Handle(sign: tagPrefix + id + ".sign", seal: tagPrefix + id + ".seal")
+        do {
+            let signKey = try createKey(tag: h.sign)
+            _ = try createKey(tag: h.seal)
+            return DeviceKeys(handle: try JSONEncoder().encode(h), publicJwk: try DevicePublicJwk(uncompressed: try publicPoint(signKey)))
+        } catch {
+            deleteKey(tag: h.sign)
+            deleteKey(tag: h.seal)
+            throw error
+        }
+    }
+
+    public func discardKeys(_ keys: DeviceKeys) {
+        guard let h = try? handle(keys.handle) else { return }
+        deleteKey(tag: h.sign)
+        deleteKey(tag: h.seal)
+    }
+
+    public func seal(_ share: [UInt8], keys: DeviceKeys, storageKey: String) throws -> Data {
+        let h = try handle(keys.handle)
+        guard let pub = SecKeyCopyPublicKey(try loadKey(tag: h.seal)) else { throw WalletError(.storageUnavailable) }
+        var plain = Bytes.sha256(Array(storageKey.utf8)) + share
+        defer { plain.wipe() }
+        var error: Unmanaged<CFError>?
+        guard let ct = SecKeyCreateEncryptedData(pub, Self.algorithm, Data(plain) as CFData, &error) as Data? else {
+            throw WalletError(.storageUnavailable, "device share cannot be sealed")
+        }
+        return ct
+    }
+
+    public func open(_ record: DeviceRecord) throws -> [UInt8] {
+        let h = try handle(record.keyHandle)
+        let key = try loadKey(tag: h.seal)
+        var error: Unmanaged<CFError>?
+        guard let pt = SecKeyCreateDecryptedData(key, Self.algorithm, record.sealedShare as CFData, &error) as Data? else {
+            throw WalletError(.needsRestore, "local share unreadable")
+        }
+        var plain = Array(pt)
+        defer { plain.wipe() }
+        guard plain.count > 32, Array(plain[0..<32]) == Bytes.sha256(Array(record.key.utf8)) else {
+            throw WalletError(.needsRestore, "local share unreadable")
+        }
+        return Array(plain[32...])
+    }
+
+    public func sign(challenge: String, record: DeviceRecord) throws -> [UInt8] {
+        let key = try loadKey(tag: try handle(record.keyHandle).sign)
+        var error: Unmanaged<CFError>?
+        guard let der = SecKeyCreateSignature(key, .ecdsaSignatureMessageX962SHA256, Data(challenge.utf8) as CFData, &error) as Data? else {
+            throw WalletError(.needsRestore, "device key unusable")
+        }
+        return Array(try P256.Signing.ECDSASignature(derRepresentation: der).rawRepresentation)
+    }
+
+    public func get(_ key: String) throws -> DeviceRecord? { try records.get(key) }
+
+    public func put(_ record: DeviceRecord) throws {
+        let previous = try? records.get(record.key)
+        try records.put(record)
+        if let previous, previous.keyHandle != record.keyHandle, let h = try? handle(previous.keyHandle) {
+            deleteKey(tag: h.sign)
+            deleteKey(tag: h.seal)
+        }
+    }
+
+    public func delete(_ key: String) throws {
+        let previous = try? records.get(key)
+        try records.delete(key)
+        if let previous, let h = try? handle(previous.keyHandle) {
+            deleteKey(tag: h.sign)
+            deleteKey(tag: h.seal)
+        }
+    }
+}
+
+/// Software P-256 keys and AES-GCM sealing (AAD = storage key, like the web frame). For tests
+/// and the simulator only: the keys are as exportable as any app data. Records are kept in
+/// memory, or in the Keychain with `persistent: true`.
+public final class SoftwareDeviceStore: DeviceStore, @unchecked Sendable {
+    private var memory: [String: DeviceRecord] = [:]
+    private let keychain: KeychainRecords?
+    private let lock = NSLock()
+    /// Test hook: when set, `put` stores this instead (simulates storage that drops or corrupts writes).
+    public var interceptPut: ((DeviceRecord) -> DeviceRecord?)?
+
+    /// Refused in release builds on real devices.
+    public init(persistent: Bool = false, service: String = "dev.authon.wallet.software") throws {
+        #if !DEBUG && !targetEnvironment(simulator)
+        throw WalletError(.storageUnavailable, "software device keys are only for tests and the simulator")
+        #else
+        keychain = persistent ? KeychainRecords(service: service) : nil
+        #endif
+    }
+
+    private struct Handle: Codable {
+        var sign: Data
+        var seal: Data
+    }
+
+    private func handle(_ data: Data) throws -> Handle {
+        guard let h = try? JSONDecoder().decode(Handle.self, from: data) else { throw WalletError(.needsRestore, "device key reference unreadable") }
+        return h
+    }
+
+    public func generateKeys() throws -> DeviceKeys {
+        let sign = P256.Signing.PrivateKey()
+        let seal = SymmetricKey(size: .bits256).withUnsafeBytes { Data($0) }
+        let h = Handle(sign: sign.rawRepresentation, seal: seal)
+        return DeviceKeys(handle: try JSONEncoder().encode(h), publicJwk: try DevicePublicJwk(uncompressed: Array(sign.publicKey.x963Representation)))
+    }
+
+    public func discardKeys(_ keys: DeviceKeys) {}
+
+    public func seal(_ share: [UInt8], keys: DeviceKeys, storageKey: String) throws -> Data {
+        let h = try handle(keys.handle)
+        let box = try AES.GCM.seal(share, using: SymmetricKey(data: h.seal), authenticating: Data(storageKey.utf8))
+        return box.combined!
+    }
+
+    public func open(_ record: DeviceRecord) throws -> [UInt8] {
+        do {
+            let h = try handle(record.keyHandle)
+            let box = try AES.GCM.SealedBox(combined: record.sealedShare)
+            return Array(try AES.GCM.open(box, using: SymmetricKey(data: h.seal), authenticating: Data(record.key.utf8)))
+        } catch {
+            throw WalletError(.needsRestore, "local share unreadable")
+        }
+    }
+
+    public func sign(challenge: String, record: DeviceRecord) throws -> [UInt8] {
+        let key = try P256.Signing.PrivateKey(rawRepresentation: try handle(record.keyHandle).sign)
+        return Array(try key.signature(for: Data(challenge.utf8)).rawRepresentation)
+    }
+
+    public func get(_ key: String) throws -> DeviceRecord? {
+        if let keychain { return try keychain.get(key) }
+        lock.lock()
+        defer { lock.unlock() }
+        return memory[key]
+    }
+
+    public func put(_ record: DeviceRecord) throws {
+        let stored: DeviceRecord
+        if let interceptPut {
+            guard let r = interceptPut(record) else { return }
+            stored = r
+        } else {
+            stored = record
+        }
+        if let keychain { return try keychain.put(stored) }
+        lock.lock()
+        defer { lock.unlock() }
+        memory[stored.key] = stored
+    }
+
+    public func delete(_ key: String) throws {
+        if let keychain { return try keychain.delete(key) }
+        lock.lock()
+        defer { lock.unlock() }
+        memory[key] = nil
+    }
+}

package/ios/vendor/AuthonWallet/Wallet/Passkeys.swift

@@ -0,0 +1,190 @@
+// GENERATED by scripts/sync-native-wallet.mjs from swift/Sources/AuthonWallet/Wallet/Passkeys.swift. Do not edit: change the source and run the script.
+import AuthenticationServices
+import CryptoKit
+import Foundation
+#if canImport(UIKit)
+import UIKit
+#elseif canImport(AppKit)
+import AppKit
+#endif
+
+/// A WebAuthn assertion with base64url fields, as the API verifies it.
+public struct PasskeyAssertion: Equatable, Sendable {
+    public var credentialId: String
+    public var clientDataJSON: String
+    public var authenticatorData: String
+    public var signature: String
+
+    public init(credentialId: String, clientDataJSON: String, authenticatorData: String, signature: String) {
+        self.credentialId = credentialId
+        self.clientDataJSON = clientDataJSON
+        self.authenticatorData = authenticatorData
+        self.signature = signature
+    }
+}
+
+public struct PasskeyCreateResult: Sendable {
+    /// base64url
+    public var credentialId: String
+    /// 32-byte PRF output for the salt.
+    public var prfOutput: [UInt8]
+    /// SPKI public key (base64url) and COSE algorithm, when the provider can supply them.
+    public var publicKey: String?
+    public var publicKeyAlg: Int?
+    /// The raw attestationObject (base64url); the API reads the COSE key from it.
+    public var attestationObject: String?
+
+    public init(credentialId: String, prfOutput: [UInt8], publicKey: String? = nil, publicKeyAlg: Int? = nil, attestationObject: String? = nil) {
+        self.credentialId = credentialId
+        self.prfOutput = prfOutput
+        self.publicKey = publicKey
+        self.publicKeyAlg = publicKeyAlg
+        self.attestationObject = attestationObject
+    }
+}
+
+public struct PasskeyGetResult: Sendable {
+    public var prfOutput: [UInt8]
+    public var assertion: PasskeyAssertion
+
+    public init(prfOutput: [UInt8], assertion: PasskeyAssertion) {
+        self.prfOutput = prfOutput
+        self.assertion = assertion
+    }
+}
+
+/// Backup passkeys with the PRF extension (`PasskeyProvider` in prf.ts).
+public protocol PasskeyProvider: Sendable {
+    func create(userId: [UInt8], userName: String, salt: [UInt8]) async throws -> PasskeyCreateResult
+    /// `challenge` is the server's restore challenge when the API verifies the assertion.
+    func get(credentialId: String, salt: [UInt8], challenge: [UInt8]?) async throws -> PasskeyGetResult
+}
+
+/// Platform passkeys for the `wallet.authon.dev` relying party. The app needs the Associated
+/// Domain `webcredentials:wallet.authon.dev` and an approved app registration. PRF needs
+/// iOS 18 / macOS 15; older systems report PRF_UNSUPPORTED (the wallet cannot be protected).
+public final class PlatformPasskeyProvider: PasskeyProvider, @unchecked Sendable {
+    public let relyingPartyIdentifier: String
+    private let anchor: (@MainActor () -> ASPresentationAnchor?)?
+
+    public init(relyingPartyIdentifier: String = "wallet.authon.dev", anchor: (@MainActor () -> ASPresentationAnchor?)? = nil) {
+        self.relyingPartyIdentifier = relyingPartyIdentifier
+        self.anchor = anchor
+    }
+
+    public func create(userId: [UInt8], userName: String, salt: [UInt8]) async throws -> PasskeyCreateResult {
+        guard #available(iOS 18.0, macOS 15.0, *) else { throw WalletError(.prfUnsupported) }
+        let provider = ASAuthorizationPlatformPublicKeyCredentialProvider(relyingPartyIdentifier: relyingPartyIdentifier)
+        let request = provider.createCredentialRegistrationRequest(challenge: Data(try Bytes.random(32)), name: userName, userID: Data(userId))
+        request.displayName = userName
+        request.userVerificationPreference = .required
+        request.attestationPreference = .none
+        request.prf = .inputValues(.saltInput1(Data(salt)))
+        let auth = try await perform(request)
+        guard let reg = auth.credential as? ASAuthorizationPlatformPublicKeyCredentialRegistration else {
+            throw WalletError(.internal, "passkey failure")
+        }
+        guard let prf = reg.prf, prf.isSupported else { throw WalletError(.prfUnsupported) }
+        let credentialId = Bytes.base64url(Array(reg.credentialID))
+        let attestation = reg.rawAttestationObject.map { Bytes.base64url(Array($0)) }
+        if let first = prf.first {
+            return PasskeyCreateResult(credentialId: credentialId, prfOutput: try prfBytes(first), attestationObject: attestation)
+        }
+        // Some authenticators only evaluate PRF on assertion.
+        let second = try await get(credentialId: credentialId, salt: salt, challenge: nil)
+        return PasskeyCreateResult(credentialId: credentialId, prfOutput: second.prfOutput, attestationObject: attestation)
+    }
+
+    public func get(credentialId: String, salt: [UInt8], challenge: [UInt8]?) async throws -> PasskeyGetResult {
+        guard #available(iOS 18.0, macOS 15.0, *) else { throw WalletError(.prfUnsupported) }
+        guard let id = Bytes.fromBase64(credentialId) else { throw WalletError(.invalidRequest, "invalid credential id") }
+        let provider = ASAuthorizationPlatformPublicKeyCredentialProvider(relyingPartyIdentifier: relyingPartyIdentifier)
+        let request = provider.createCredentialAssertionRequest(challenge: Data(try challenge ?? Bytes.random(32)))
+        request.allowedCredentials = [ASAuthorizationPlatformPublicKeyCredentialDescriptor(credentialID: Data(id))]
+        request.userVerificationPreference = .required
+        request.prf = .inputValues(.saltInput1(Data(salt)))
+        let auth = try await perform(request)
+        guard let cred = auth.credential as? ASAuthorizationPlatformPublicKeyCredentialAssertion else {
+            throw WalletError(.internal, "passkey failure")
+        }
+        guard let prf = cred.prf else { throw WalletError(.prfUnsupported) }
+        return PasskeyGetResult(
+            prfOutput: try prfBytes(prf.first),
+            assertion: PasskeyAssertion(
+                credentialId: Bytes.base64url(Array(cred.credentialID)),
+                clientDataJSON: Bytes.base64url(Array(cred.rawClientDataJSON)),
+                authenticatorData: Bytes.base64url(Array(cred.rawAuthenticatorData)),
+                signature: Bytes.base64url(Array(cred.signature))
+            )
+        )
+    }
+
+    private func prfBytes(_ key: SymmetricKey) throws -> [UInt8] {
+        let out = key.withUnsafeBytes { Array($0) }
+        guard out.count == 32 else { throw WalletError(.prfUnsupported) }
+        return out
+    }
+
+    @MainActor
+    private func perform(_ request: ASAuthorizationRequest) async throws -> ASAuthorization {
+        let delegate = AuthorizationDelegate(anchor: anchor?() ?? Self.defaultAnchor())
+        return try await delegate.run(request)
+    }
+
+    @MainActor
+    static func defaultAnchor() -> ASPresentationAnchor {
+        #if canImport(UIKit)
+        let scenes = UIApplication.shared.connectedScenes.compactMap { $0 as? UIWindowScene }
+        return scenes.flatMap(\.windows).first(where: \.isKeyWindow) ?? scenes.first?.windows.first ?? ASPresentationAnchor()
+        #else
+        return NSApplication.shared.keyWindow ?? NSApplication.shared.windows.first ?? ASPresentationAnchor()
+        #endif
+    }
+}
+
+@MainActor
+private final class AuthorizationDelegate: NSObject, ASAuthorizationControllerDelegate, ASAuthorizationControllerPresentationContextProviding {
+    private let anchor: ASPresentationAnchor
+    private var continuation: CheckedContinuation<ASAuthorization, Error>?
+    private var retain: AuthorizationDelegate?
+
+    init(anchor: ASPresentationAnchor) {
+        self.anchor = anchor
+    }
+
+    func run(_ request: ASAuthorizationRequest) async throws -> ASAuthorization {
+        try await withCheckedThrowingContinuation { cont in
+            continuation = cont
+            retain = self
+            let controller = ASAuthorizationController(authorizationRequests: [request])
+            controller.delegate = self
+            controller.presentationContextProvider = self
+            controller.performRequests()
+        }
+    }
+
+    nonisolated func presentationAnchor(for controller: ASAuthorizationController) -> ASPresentationAnchor {
+        MainActor.assumeIsolated { anchor }
+    }
+
+    nonisolated func authorizationController(controller: ASAuthorizationController, didCompleteWithAuthorization authorization: ASAuthorization) {
+        MainActor.assumeIsolated { finish(.success(authorization)) }
+    }
+
+    nonisolated func authorizationController(controller: ASAuthorizationController, didCompleteWithError error: Error) {
+        let mapped: WalletError
+        if let e = error as? ASAuthorizationError, e.code == .canceled {
+            mapped = WalletError(.userCancelled)
+        } else {
+            // Missing Associated Domains or an unapproved app registration also end here (.failed).
+            mapped = WalletError(.internal, "passkey failure (\((error as NSError).code))")
+        }
+        MainActor.assumeIsolated { finish(.failure(mapped)) }
+    }
+
+    private func finish(_ result: Result<ASAuthorization, Error>) {
+        continuation?.resume(with: result)
+        continuation = nil
+        retain = nil
+    }
+}

package/ios/vendor/AuthonWallet/Wallet/Proof.swift

@@ -0,0 +1,143 @@
+// GENERATED by scripts/sync-native-wallet.mjs from swift/Sources/AuthonWallet/Wallet/Proof.swift. Do not edit: change the source and run the script.
+import Foundation
+
+/// Device public key as the API stores it.
+public struct DevicePublicJwk: Codable, Equatable, Sendable {
+    public var kty: String
+    public var crv: String
+    public var x: String
+    public var y: String
+
+    public init(x: String, y: String) {
+        kty = "EC"
+        crv = "P-256"
+        self.x = x
+        self.y = y
+    }
+
+    /// From a 65-byte uncompressed P-256 point.
+    init(uncompressed point: [UInt8]) throws {
+        guard point.count == 65, point[0] == 4 else { throw WalletError(.internal, "invalid device public key") }
+        self.init(x: Bytes.base64url(Array(point[1..<33])), y: Bytes.base64url(Array(point[33..<65])))
+    }
+
+    var json: JSONValue {
+        .object(JSONObject([("kty", .string(kty)), ("crv", .string(crv)), ("x", .string(x)), ("y", .string(y))]))
+    }
+}
+
+/// Server-issued nonce bound into a wallet key proof (`expiresAt` in Unix seconds).
+public struct ProofNonce: Equatable, Sendable {
+    public var nonce: String
+    public var expiresAt: Int64
+}
+
+/// Wallet key proofs (`apps/wallet/src/proof.ts`): EIP-712 under the wallet's own domain.
+enum WalletProof {
+    static let domainName = "Authon Wallet Proof"
+    static let reservedPrefixes = ["create:", "device:", "restore:"]
+
+    static func canonicalJwk(_ jwk: DevicePublicJwk) -> String {
+        "{\"crv\":\(JSONValue.quote(jwk.crv)),\"kty\":\(JSONValue.quote(jwk.kty)),\"x\":\(JSONValue.quote(jwk.x)),\"y\":\(JSONValue.quote(jwk.y))}"
+    }
+
+    static func devicePublicKeyHash(_ jwk: DevicePublicJwk) -> String {
+        Bytes.hex(Bytes.sha256(Array(canonicalJwk(jwk).utf8)))
+    }
+
+    enum Kind: String {
+        case create = "CreateWallet"
+        case device = "AddDevice"
+        case restore = "RestoreWallet"
+    }
+
+    static func typedData(_ kind: Kind, _ fields: [(String, JSONValue)], bound: ProofNonce) -> JSONValue {
+        func field(_ n: String, _ t: String) -> JSONValue { .object(JSONObject([("name", .string(n)), ("type", .string(t))])) }
+        let head: [JSONValue]
+        switch kind {
+        case .create: head = [field("projectId", "string"), field("userId", "string"), field("deviceKeyHash", "string")]
+        case .device, .restore: head = [field("walletId", "string"), field("shareVersion", "uint256"), field("deviceKeyHash", "string")]
+        }
+        let typeList = head + [field("nonce", "string"), field("expiresAt", "uint256")]
+        return .object(JSONObject([
+            ("domain", .object(JSONObject([("name", .string(domainName)), ("version", .string("1"))]))),
+            ("types", .object(JSONObject([(kind.rawValue, .array(typeList))]))),
+            ("primaryType", .string(kind.rawValue)),
+            ("message", .object(JSONObject(fields + [("nonce", .string(bound.nonce)), ("expiresAt", .number(String(bound.expiresAt)))]))),
+        ]))
+    }
+
+    private static func sign(_ secret: [UInt8], _ td: JSONValue) throws -> String {
+        let account = try WalletShares.account(secret)
+        defer { account.wipe() }
+        return try account.signTypedData(try TypedData(td))
+    }
+
+    static func createTypedData(projectId: String, userId: String, deviceKey: DevicePublicJwk, bound: ProofNonce) -> JSONValue {
+        typedData(.create, [("projectId", .string(projectId)), ("userId", .string(userId)), ("deviceKeyHash", .string(devicePublicKeyHash(deviceKey)))], bound: bound)
+    }
+
+    static func deviceTypedData(walletId: String, shareVersion: Int, deviceKey: DevicePublicJwk, bound: ProofNonce) -> JSONValue {
+        typedData(.device, [("walletId", .string(walletId)), ("shareVersion", .number(String(shareVersion))), ("deviceKeyHash", .string(devicePublicKeyHash(deviceKey)))], bound: bound)
+    }
+
+    /// The restore proof names the next share version (current + 1).
+    static func restoreTypedData(walletId: String, currentShareVersion: Int, deviceKey: DevicePublicJwk, bound: ProofNonce) -> JSONValue {
+        typedData(.restore, [("walletId", .string(walletId)), ("shareVersion", .number(String(currentShareVersion + 1))), ("deviceKeyHash", .string(devicePublicKeyHash(deviceKey)))], bound: bound)
+    }
+
+    static func signCreate(_ secret: [UInt8], projectId: String, userId: String, deviceKey: DevicePublicJwk, bound: ProofNonce) throws -> String {
+        try sign(secret, createTypedData(projectId: projectId, userId: userId, deviceKey: deviceKey, bound: bound))
+    }
+
+    static func signDevice(_ secret: [UInt8], walletId: String, shareVersion: Int, deviceKey: DevicePublicJwk, bound: ProofNonce) throws -> String {
+        try sign(secret, deviceTypedData(walletId: walletId, shareVersion: shareVersion, deviceKey: deviceKey, bound: bound))
+    }
+
+    static func signRestore(_ secret: [UInt8], walletId: String, currentShareVersion: Int, deviceKey: DevicePublicJwk, bound: ProofNonce) throws -> String {
+        try sign(secret, restoreTypedData(walletId: walletId, currentShareVersion: currentShareVersion, deviceKey: deviceKey, bound: bound))
+    }
+
+    /// App text that looks like a (legacy) wallet proof is never signed for an app.
+    static func isReservedMessageText(_ text: String) -> Bool {
+        let scalars = text.unicodeScalars.drop { $0.properties.isWhitespace || $0.value < 0x20 || $0.value == 0xfeff }
+        let t = String(String.UnicodeScalarView(scalars)).lowercased()
+        return reservedPrefixes.contains { t.hasPrefix($0) }
+    }
+
+    /// `{raw}` hex decoded as strict UTF-8; nil when it is not valid UTF-8.
+    static func rawMessageText(_ hex: String) -> String? {
+        let body = hex.hasPrefix("0x") ? String(hex.dropFirst(2)) : hex
+        guard body.count % 2 == 0, let bytes = Bytes.fromHex(body) else { return nil }
+        return String(strictUTF8: bytes)
+    }
+
+    static func isReservedTypedData(_ td: JSONValue) -> Bool {
+        guard case .string(let name) = td["domain"]?["name"] ?? .null else { return false }
+        return name.trimmingCharacters(in: jsWhitespace).lowercased() == domainName.lowercased()
+    }
+
+    /// JavaScript String.prototype.trim whitespace.
+    static let jsWhitespace: CharacterSet = {
+        var set = CharacterSet.whitespacesAndNewlines
+        set.insert(charactersIn: "\u{feff}")
+        return set
+    }()
+}
+
+extension String {
+    /// Strict UTF-8 decoding (TextDecoder with fatal: true).
+    init?(strictUTF8 bytes: [UInt8]) {
+        var it = bytes.makeIterator()
+        var decoder = UTF8()
+        var scalars = String.UnicodeScalarView()
+        loop: while true {
+            switch decoder.decode(&it) {
+            case .scalarValue(let s): scalars.append(s)
+            case .emptyInput: break loop
+            case .error: return nil
+            }
+        }
+        self = String(scalars)
+    }
+}