@authon/react-native-wallet 0.0.0-stage → 0.4.0

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/AuthonWallet.kt

@@ -0,0 +1,218 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/AuthonWallet.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import android.app.Activity
+import android.content.Context
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import kotlinx.coroutines.withContext
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonObject
+import okhttp3.OkHttpClient
+import kotlin.coroutines.CoroutineContext
+
+data class WalletOptions(
+    /** Replaces the default approval dialog. The app is inside the trust boundary, so this is allowed. */
+    val approver: WalletApprover? = null,
+    /** Also require the device lock (BiometricPrompt) before every signature. */
+    val requireDeviceAuthentication: Boolean = false,
+    /** Replaces the Keystore device store (tests). */
+    val deviceStore: DeviceStore? = null,
+    /** Replaces the Credential Manager passkeys (tests). */
+    val passkeys: PasskeyProvider? = null,
+    /** TEST ONLY: accept software-backed Keystore keys (emulators). Never enable in production. */
+    val allowSoftwareKeysForTesting: Boolean = false,
+)
+
+/**
+ * Authon embedded wallet on Android. Same wallet row and `/v1/wallet/me/...` API (protocol 2) as the
+ * web frame, so web and app share one address per project user.
+ *
+ * The device stores only its share D. Every signature or accounts call fetches the company share A
+ * with a device-key proof, combines D+A in memory, derives the key, signs and wipes; the full key is
+ * never stored. All secrets stay inside this process (see README: trust model).
+ *
+ * Errors are [WalletException]s with the web frame's codes.
+ */
+class AuthonWallet internal constructor(
+    private val api: WalletApi,
+    private val packageName: String,
+    private val sessionProvider: suspend () -> String?,
+    private val store: DeviceStore,
+    private val passkeysFactory: (rpId: String) -> PasskeyProvider,
+    private val approver: WalletApprover?,
+    private val deviceAuthenticator: DeviceAuthenticator?,
+    private val probe: CapabilityProbe?,
+    private val dispatcher: CoroutineContext = Dispatchers.Default,
+) {
+    /**
+     * Core constructor (no dependency on the Authon auth client, so wrappers such as the React
+     * Native module can reuse this package alone). [sessionProvider] returns the Authon access
+     * token; [appId] is the package name registered in the console.
+     */
+    @JvmOverloads
+    constructor(
+        context: Context,
+        publishableKey: String,
+        apiUrl: String = DEFAULT_API_URL,
+        appId: String = context.packageName,
+        sessionProvider: suspend () -> String?,
+        activityProvider: () -> Activity?,
+        options: WalletOptions = WalletOptions(),
+        httpClient: OkHttpClient? = null,
+    ) : this(
+        api = if (httpClient != null) WalletApi(apiUrl, publishableKey, httpClient) else WalletApi(apiUrl, publishableKey),
+        packageName = appId,
+        sessionProvider = sessionProvider,
+        store = options.deviceStore ?: KeystoreDeviceStore(context, options.allowSoftwareKeysForTesting),
+        passkeysFactory = { rpId -> options.passkeys ?: CredentialManagerPasskeys(activityProvider, rpId) },
+        approver = options.approver ?: DialogWalletApprover(activityProvider),
+        deviceAuthenticator = if (options.requireDeviceAuthentication) BiometricDeviceAuthenticator(activityProvider) else null,
+        probe = AndroidCapabilityProbe(context),
+    )
+
+    private val mutex = Mutex()
+    private var config: WalletAppConfig? = null
+
+    /** This app's wallet configuration from the API (cached after the first success). */
+    suspend fun appConfig(): WalletAppConfig = run { config ?: api.appConfig(packageName).also { config = it } }
+
+    /**
+     * Whether this device and app can use the wallet (NATIVE.md section 9). Needs no session,
+     * opens no login or passkey UI, creates nothing, and never throws.
+     */
+    suspend fun capabilities(): WalletCapabilities = withContext(dispatcher) {
+        val p = probe ?: throw IllegalStateException("no capability probe")
+        val (caps, cfg) = Capabilities.evaluate(api, packageName, p)
+        if (cfg != null) config = cfg
+        caps
+    }
+
+    private class Ready(val ops: WalletOps, val session: String, val config: WalletAppConfig)
+
+    private suspend fun ready(): Ready {
+        val cfg = appConfig()
+        val projectId = cfg.projectId
+        if (!cfg.allowed || projectId == null) throw walletError(WalletErrorCode.ORIGIN_NOT_ALLOWED, "this app is not registered for the Authon wallet")
+        if (!cfg.enabled) throw walletError(WalletErrorCode.ORIGIN_NOT_ALLOWED, "the wallet is disabled for this project")
+        if ((cfg.minFrameProtocol ?: 0) > WalletApi.FRAME_PROTOCOL) throw walletError(WalletErrorCode.FRAME_OUTDATED)
+        val session = sessionProvider()?.takeIf { it.isNotEmpty() } ?: throw walletError(WalletErrorCode.UNAUTHORIZED, "token required")
+        val ctx = WalletContext(
+            api = api,
+            store = store,
+            passkeys = passkeysFactory(cfg.rpId),
+            projectId = projectId,
+            confirmSigning = cfg.confirmSigning,
+            backupVersion = cfg.prfSaltVersion,
+            approver = approver,
+            deviceAuthenticator = deviceAuthenticator,
+        )
+        return Ready(WalletOps(ctx), session, cfg)
+    }
+
+    private fun requirePasskeyApproval(cfg: WalletAppConfig) {
+        if (!cfg.approved) {
+            throw walletError(WalletErrorCode.ORIGIN_NOT_ALLOWED, "this app is not yet approved for ${cfg.rpId} passkeys")
+        }
+    }
+
+    private suspend fun <T> op(block: suspend (Ready) -> T): T = withContext(dispatcher) {
+        mutex.withLock {
+            try {
+                block(ready())
+            } catch (e: CancellationException) {
+                throw e
+            } catch (e: Throwable) {
+                throw e.toWalletException()
+            }
+        }
+    }
+
+    /** The wallet; NOT_FOUND when this user has none yet. */
+    suspend fun status(): PublicWallet = op { it.ops.toPublicWallet(it.ops.status(it.session)) }
+
+    /** Creates the wallet (two-phase; resumes or discards an interrupted attempt), or returns the existing one. */
+    suspend fun create(): PublicWallet = op { it.ops.toPublicWallet(it.ops.createWallet(it.session)) }
+
+    /** Addresses of accounts start..start+count-1 on [chain] (NATIVE.md section 11). Signing is EVM only. */
+    suspend fun accounts(start: Long = 0, count: Int = 1, chain: WalletChain = WalletChain.EVM): List<WalletAccount> =
+        op { it.ops.accounts(it.session, start, count, chain) }
+
+    suspend fun signMessage(message: String, account: SignAccount = SignAccount.PRIMARY): String =
+        signMessage(WalletMessage.Text(message), account)
+
+    suspend fun signMessage(message: WalletMessage, account: SignAccount = SignAccount.PRIMARY): String =
+        op { it.ops.signMessage(it.session, message, account) }
+
+    /** personal_sign over raw bytes given as 0x hex. */
+    suspend fun signRawMessage(hex: String, account: SignAccount = SignAccount.PRIMARY): String =
+        signMessage(WalletMessage.Raw(hex), account)
+
+    /** EIP-712 v4 typed data as a JSON string. */
+    suspend fun signTypedData(typedDataJson: String, account: SignAccount = SignAccount.PRIMARY): String =
+        op { it.ops.signTypedData(it.session, parseObject(typedDataJson), account) }
+
+    /** EIP-712 v4 typed data as a map (`domain`, `types`, `primaryType`, `message`). */
+    suspend fun signTypedData(typedData: Map<String, Any?>, account: SignAccount = SignAccount.PRIMARY): String =
+        op { it.ops.signTypedData(it.session, JsValues.toJson(typedData) as JsonObject, account) }
+
+    /** Signs a legacy / EIP-2930 / EIP-1559 transaction given like the web frame's `tx` (numbers as numbers, decimal or hex strings). */
+    suspend fun signTransaction(transaction: Map<String, Any?>, account: SignAccount = SignAccount.PRIMARY): String =
+        op { it.ops.signTransaction(it.session, JsValues.toJson(transaction) as JsonObject, account) }
+
+    suspend fun signTransaction(transactionJson: String, account: SignAccount = SignAccount.PRIMARY): String =
+        op { it.ops.signTransaction(it.session, parseObject(transactionJson), account) }
+
+    /**
+     * Signs an app-built transaction on another chain (NATIVE.md section 12). Solana: payload
+     * `message` (serialized legacy/v0 Message, base64, at most 1232 bytes) and optional `cluster`
+     * (shown as "Solana <cluster>"); returns `signature` (base58). The signer must be the fee payer,
+     * and [address] must be the chain address of [account] (from accounts()). TRON: payload
+     * `rawDataHex` (raw_data protobuf, at most 4096 bytes); returns `txID` and `signature`
+     * (r||s||v hex); the owner must be the signer.
+     */
+    suspend fun signChainTransaction(chain: WalletChain, account: Long, address: String, payload: Map<String, Any?>): Map<String, String> =
+        op { it.ops.signChainTransaction(it.session, chain, account, address, payload) }
+
+    /** Creates the passkey backup (B) of an unprotected wallet. */
+    suspend fun protect(): ProtectResult = op {
+        requirePasskeyApproval(it.config)
+        it.ops.protect(it.session)
+    }
+
+    /** Replaces a legacy backup (no passkey public key) with a verifiable one, from a device that holds the wallet. */
+    suspend fun upgradeBackup(): ProtectResult = op {
+        requirePasskeyApproval(it.config)
+        it.ops.upgradeBackup(it.session)
+    }
+
+    /** Restores the wallet on this device with the backup passkey. */
+    suspend fun restore(mode: RestoreMode = RestoreMode.ADD): RestoreResult = op {
+        requirePasskeyApproval(it.config)
+        it.ops.restore(it.session, mode)
+    }
+
+    /** Revokes a device; signed with this device's key. */
+    suspend fun revokeDevice(deviceId: String): Boolean = op { it.ops.revokeDevice(it.session, deviceId) }
+
+    private fun parseObject(json: String): JsonObject =
+        runCatching { Json.parseToJsonElement(json) as? JsonObject }.getOrNull()
+            ?: throw walletError(WalletErrorCode.INVALID_REQUEST, "expected a JSON object")
+
+    companion object {
+        const val DEFAULT_API_URL = "https://api.authon.dev"
+
+        internal fun forTesting(
+            api: WalletApi,
+            packageName: String,
+            sessionProvider: suspend () -> String?,
+            store: DeviceStore,
+            passkeys: PasskeyProvider,
+            approver: WalletApprover?,
+            deviceAuthenticator: DeviceAuthenticator? = null,
+            probe: CapabilityProbe? = null,
+        ) = AuthonWallet(api, packageName, sessionProvider, store, { passkeys }, approver, deviceAuthenticator, probe)
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/Bitcoin.kt

@@ -0,0 +1,296 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/Bitcoin.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import org.web3j.crypto.ECKeyPair
+import org.web3j.crypto.Sign
+import java.io.ByteArrayOutputStream
+import java.math.BigInteger
+
+/**
+ * Bitcoin PSBT signing (NATIVE.md section 12, `apps/wallet/src/bitcoin.ts`). Inputs whose
+ * witness_utxo is the account's P2WPKH script are signed (BIP143, SIGHASH_ALL, RFC 6979 low-S
+ * DER + 0x01); other inputs are left alone. The returned PSBT is the input PSBT with every
+ * key-value kept and our partial signatures added (key 0x02 || compressed public key).
+ */
+internal object Bitcoin {
+    const val MAX_PSBT_BYTES = 100_000
+    private val MAGIC = byteArrayOf(0x70, 0x73, 0x62, 0x74, 0xff.toByte())
+
+    private fun invalid(why: String = "not a valid PSBT") = walletError(WalletErrorCode.INVALID_REQUEST, why)
+
+    class Input(val txid: ByteArray, val vout: ByteArray, val sequence: ByteArray)
+    class Output(val amount: Long, val script: ByteArray)
+    class KeyValue(val key: ByteArray, val value: ByteArray)
+
+    class Psbt(
+        val version: ByteArray,
+        val inputs: List<Input>,
+        val outputs: List<Output>,
+        val locktime: ByteArray,
+        val global: List<KeyValue>,
+        val inputMaps: List<MutableList<KeyValue>>,
+        val outputMaps: List<List<KeyValue>>,
+    ) {
+        fun witnessUtxo(i: Int): Output? = inputMaps[i].firstOrNull { it.key.size == 1 && it.key[0] == 0x01.toByte() }?.let {
+            val r = Reader(it.value)
+            val amount = r.u64()
+            val script = r.take(r.varint())
+            if (!r.done) throw invalid()
+            Output(amount, script)
+        }
+
+        fun sighashType(i: Int): Long? = inputMaps[i].firstOrNull { it.key.size == 1 && it.key[0] == 0x03.toByte() }?.let {
+            if (it.value.size != 4) throw invalid()
+            Reader(it.value).u32()
+        }
+    }
+
+    class Reader(private val b: ByteArray) {
+        var pos = 0
+        val done get() = pos == b.size
+
+        fun take(n: Long): ByteArray {
+            if (n < 0 || pos + n > b.size) throw invalid()
+            return b.copyOfRange(pos, pos + n.toInt()).also { pos += n.toInt() }
+        }
+
+        fun u8(): Int = take(1)[0].toInt() and 0xff
+
+        fun le(n: Int): Long {
+            val x = take(n.toLong())
+            var v = 0L
+            for (i in n - 1 downTo 0) v = (v shl 8) or (x[i].toLong() and 0xff)
+            return v
+        }
+
+        fun u32() = le(4)
+        fun u64() = le(8).also { if (it < 0) throw invalid() }
+
+        fun varint(): Long = when (val f = u8()) {
+            0xfd -> le(2)
+            0xfe -> le(4)
+            0xff -> le(8).also { if (it < 0) throw invalid() }
+            else -> f.toLong()
+        }
+    }
+
+    private fun ByteArrayOutputStream.varint(n: Long) {
+        when {
+            n < 0xfd -> write(n.toInt())
+            n <= 0xffff -> { write(0xfd); le(n, 2) }
+            n <= 0xffffffffL -> { write(0xfe); le(n, 4) }
+            else -> { write(0xff); le(n, 8) }
+        }
+    }
+
+    private fun ByteArrayOutputStream.le(v: Long, n: Int) {
+        for (i in 0 until n) write(((v ushr (8 * i)) and 0xff).toInt())
+    }
+
+    private fun ByteArrayOutputStream.varBytes(b: ByteArray) {
+        varint(b.size.toLong())
+        write(b)
+    }
+
+    private fun readMap(r: Reader): MutableList<KeyValue> {
+        val out = ArrayList<KeyValue>()
+        while (true) {
+            val keyLen = r.varint()
+            if (keyLen == 0L) return out
+            val key = r.take(keyLen)
+            val value = r.take(r.varint())
+            if (out.any { it.key.contentEquals(key) }) throw invalid("duplicate PSBT key")
+            out += KeyValue(key, value)
+        }
+    }
+
+    fun parse(bytes: ByteArray): Psbt {
+        if (bytes.isEmpty() || bytes.size > MAX_PSBT_BYTES) throw invalid()
+        if (!bytes.copyOf(5).contentEquals(MAGIC)) throw invalid()
+        val r = Reader(bytes.copyOfRange(5, bytes.size))
+        val global = readMap(r)
+        val txField = global.filter { it.key.size == 1 && it.key[0] == 0x00.toByte() }
+        if (txField.size != 1) throw invalid("PSBT has no unsigned transaction")
+        val t = Reader(txField[0].value)
+        val version = t.take(4)
+        val inputs = List(t.varint().toInt().also { if (it < 1 || it > 10_000) throw invalid() }) {
+            val txid = t.take(32)
+            val vout = t.take(4)
+            if (t.varint() != 0L) throw invalid("unsigned transaction has a scriptSig")
+            Input(txid, vout, t.take(4))
+        }
+        val outputs = List(t.varint().toInt().also { if (it < 1 || it > 10_000) throw invalid() }) {
+            val amount = t.u64()
+            Output(amount, t.take(t.varint()))
+        }
+        val locktime = t.take(4)
+        if (!t.done) throw invalid()
+        val inputMaps = List(inputs.size) { readMap(r) }
+        val outputMaps = List(outputs.size) { readMap(r) }
+        if (!r.done) throw invalid()
+        return Psbt(version, inputs, outputs, locktime, global, inputMaps, outputMaps)
+    }
+
+    fun serialize(p: Psbt): ByteArray {
+        val out = ByteArrayOutputStream()
+        out.write(MAGIC)
+        for (map in listOf(p.global) + p.inputMaps + p.outputMaps) {
+            for (kv in map) {
+                out.varBytes(kv.key)
+                out.varBytes(kv.value)
+            }
+            out.write(0)
+        }
+        return out.toByteArray()
+    }
+
+    // ── Addresses ──
+
+    private class Net(val hrp: String, val p2pkh: Int, val p2sh: Int)
+
+    private fun net(chain: WalletChain) = if (chain == WalletChain.BITCOIN) Net("bc", 0x00, 0x05) else Net("tb", 0x6f, 0xc4)
+
+    fun scriptOf(address: String, chain: WalletChain): ByteArray {
+        val n = net(chain)
+        Bech32.decodeSegwit(n.hrp, address)?.let { (v, prog) ->
+            val op = if (v == 0) 0x00 else 0x50 + v
+            return byteArrayOf(op.toByte(), prog.size.toByte()) + prog
+        }
+        val raw = runCatching { Base58.decode(address) }.getOrNull()
+        if (raw != null && raw.size == 25 && Bytes.sha256(Bytes.sha256(raw.copyOf(21))).copyOf(4).contentEquals(raw.copyOfRange(21, 25))) {
+            val h = raw.copyOfRange(1, 21)
+            when (raw[0].toInt() and 0xff) {
+                n.p2pkh -> return byteArrayOf(0x76, 0xa9.toByte(), 0x14) + h + byteArrayOf(0x88.toByte(), 0xac.toByte())
+                n.p2sh -> return byteArrayOf(0xa9.toByte(), 0x14) + h + byteArrayOf(0x87.toByte())
+            }
+        }
+        throw walletError(WalletErrorCode.INVALID_REQUEST, "address is not a Bitcoin address of this network")
+    }
+
+    /** Address of a standard output script; null for scripts without one. */
+    fun addressOf(script: ByteArray, chain: WalletChain): String? {
+        val n = net(chain)
+        val s = script
+        fun u(i: Int) = s[i].toInt() and 0xff
+        return when {
+            s.size == 25 && u(0) == 0x76 && u(1) == 0xa9 && u(2) == 0x14 && u(23) == 0x88 && u(24) == 0xac ->
+                Base58.encodeCheck(byteArrayOf(n.p2pkh.toByte()) + s.copyOfRange(3, 23))
+            s.size == 23 && u(0) == 0xa9 && u(1) == 0x14 && u(22) == 0x87 ->
+                Base58.encodeCheck(byteArrayOf(n.p2sh.toByte()) + s.copyOfRange(2, 22))
+            s.size == 22 && u(0) == 0x00 && u(1) == 0x14 -> Bech32.segwit(n.hrp, 0, s.copyOfRange(2, 22))
+            s.size == 34 && u(0) == 0x00 && u(1) == 0x20 -> Bech32.segwit(n.hrp, 0, s.copyOfRange(2, 34))
+            s.size == 34 && u(0) == 0x51 && u(1) == 0x20 -> Bech32.segwit(n.hrp, 1, s.copyOfRange(2, 34))
+            else -> null
+        }
+    }
+
+    private fun btc(sats: BigInteger): String {
+        val neg = sats.signum() < 0
+        val (whole, rem) = sats.abs().divideAndRemainder(BigInteger.valueOf(100_000_000))
+        val frac = rem.toString().padStart(8, '0').trimEnd('0')
+        return "${if (neg) "-" else ""}$whole${if (frac.isEmpty()) "" else ".$frac"} BTC"
+    }
+
+    private fun ownInputs(p: Psbt, script: ByteArray): List<Int> =
+        p.inputs.indices.filter { p.witnessUtxo(it)?.script?.contentEquals(script) == true }
+
+    fun summarize(p: Psbt, signer: String, chain: WalletChain): SignSummary {
+        val script = scriptOf(signer, chain)
+        val rows = mutableListOf(
+            SignRow("Network", if (chain == WalletChain.BITCOIN) "Bitcoin" else "Bitcoin testnet"),
+            SignRow("Account", signer, mono = true),
+        )
+        val warnings = mutableListOf<String>()
+        var inputs = BigInteger.ZERO
+        for (i in p.inputs.indices) {
+            val utxo = p.witnessUtxo(i) ?: throw invalid("every input needs witness_utxo")
+            inputs = inputs.add(BigInteger.valueOf(utxo.amount))
+        }
+        val mine = ownInputs(p, script)
+        if (mine.isEmpty()) throw walletError(WalletErrorCode.ADDRESS_MISMATCH, "no input belongs to the signing account")
+        for (i in mine) {
+            val type = p.sighashType(i)
+            if (type != null && type != 1L) throw invalid("only SIGHASH_ALL is signed")
+        }
+        if (mine.size != p.inputs.size) warnings += "${p.inputs.size - mine.size} of ${p.inputs.size} inputs are not yours and are not signed."
+        rows += SignRow("Spending", btc(inputs))
+        var outputs = BigInteger.ZERO
+        for (o in p.outputs) {
+            outputs = outputs.add(BigInteger.valueOf(o.amount))
+            val to = addressOf(o.script, chain) ?: "non-standard output".also {
+                warnings += "An output has a script this wallet cannot show as an address."
+            }
+            rows += if (o.script.contentEquals(script)) {
+                SignRow("Change back to you", btc(BigInteger.valueOf(o.amount)))
+            } else {
+                SignRow("Send ${btc(BigInteger.valueOf(o.amount))} to", to, mono = true)
+            }
+        }
+        val fee = inputs.subtract(outputs)
+        if (fee.signum() < 0) throw invalid("outputs exceed inputs")
+        rows += SignRow("Network fee", btc(fee))
+        if (fee.multiply(BigInteger.TEN) > inputs && fee > BigInteger.valueOf(100_000)) {
+            warnings += "The network fee is more than 10% of the amount spent."
+        }
+        return SignSummary(SignSummary.Kind.TRANSACTION, "Bitcoin transaction", rows, null, warnings, SignRisk.HIGH)
+    }
+
+    private fun dsha(b: ByteArray) = Bytes.sha256(Bytes.sha256(b))
+
+    private fun outputBytes(o: Output) = ByteArrayOutputStream().apply { le(o.amount, 8); varBytes(o.script) }.toByteArray()
+
+    /** BIP143 sighash of input [i] for a P2WPKH output with [pubkeyHash], SIGHASH_ALL. */
+    fun sighash(p: Psbt, i: Int, pubkeyHash: ByteArray, amount: Long): ByteArray {
+        val prevouts = ByteArrayOutputStream().apply { for (x in p.inputs) { write(x.txid); write(x.vout) } }.toByteArray()
+        val sequences = ByteArrayOutputStream().apply { for (x in p.inputs) write(x.sequence) }.toByteArray()
+        val outs = ByteArrayOutputStream().apply { for (o in p.outputs) write(outputBytes(o)) }.toByteArray()
+        val pre = ByteArrayOutputStream()
+        pre.write(p.version)
+        pre.write(dsha(prevouts))
+        pre.write(dsha(sequences))
+        pre.write(p.inputs[i].txid)
+        pre.write(p.inputs[i].vout)
+        pre.write(byteArrayOf(0x19, 0x76, 0xa9.toByte(), 0x14) + pubkeyHash + byteArrayOf(0x88.toByte(), 0xac.toByte()))
+        pre.le(amount, 8)
+        pre.write(p.inputs[i].sequence)
+        pre.write(dsha(outs))
+        pre.write(p.locktime)
+        pre.le(1, 4)
+        return dsha(pre.toByteArray())
+    }
+
+    /** Signs our inputs; `txHex` is the finalized transaction when every input is ours. */
+    fun sign(p: Psbt, privateKey: ByteArray, chain: WalletChain): Map<String, String> {
+        val pub = Chains.compressedPublicKey(privateKey)
+        val hash = Chains.hash160Of(pub)
+        val script = byteArrayOf(0x00, 0x14) + hash
+        val mine = ownInputs(p, script)
+        if (mine.isEmpty()) throw walletError(WalletErrorCode.ADDRESS_MISMATCH)
+        val keyPair = ECKeyPair.create(privateKey)
+        val sigs = HashMap<Int, ByteArray>()
+        for (i in mine) {
+            val sig = Sign.signMessage(sighash(p, i, hash, p.witnessUtxo(i)!!.amount), keyPair, false)
+            val der = Der.encode(sig.r, sig.s) + byteArrayOf(0x01)
+            sigs[i] = der
+            val key = byteArrayOf(0x02) + pub
+            p.inputMaps[i].removeAll { it.key.contentEquals(key) }
+            p.inputMaps[i] += KeyValue(key, der)
+        }
+        val psbt = Bytes.toBase64(serialize(p))
+        if (mine.size != p.inputs.size) return mapOf("psbt" to psbt)
+        val tx = ByteArrayOutputStream()
+        tx.write(p.version)
+        tx.write(byteArrayOf(0x00, 0x01))
+        tx.varint(p.inputs.size.toLong())
+        for (x in p.inputs) { tx.write(x.txid); tx.write(x.vout); tx.write(0); tx.write(x.sequence) }
+        tx.varint(p.outputs.size.toLong())
+        for (o in p.outputs) tx.write(outputBytes(o))
+        for (i in p.inputs.indices) {
+            tx.write(2)
+            tx.varBytes(sigs.getValue(i))
+            tx.varBytes(pub)
+        }
+        tx.write(p.locktime)
+        return mapOf("psbt" to psbt, "txHex" to Bytes.toHex(tx.toByteArray()))
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/Bytes.kt

@@ -0,0 +1,74 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/Bytes.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import java.security.MessageDigest
+import java.security.SecureRandom
+import java.util.Base64
+
+internal object Bytes {
+    private val random = SecureRandom()
+
+    fun utf8(value: String): ByteArray = value.toByteArray(Charsets.UTF_8)
+
+    fun toBase64(bytes: ByteArray): String = Base64.getEncoder().encodeToString(bytes)
+
+    /** Accepts standard and URL-safe alphabets, with or without padding (like the frame's atob path). */
+    fun fromBase64(value: String): ByteArray {
+        val normalized = value.replace('-', '+').replace('_', '/').trimEnd('=')
+        return try {
+            Base64.getDecoder().decode(normalized.padEnd((normalized.length + 3) / 4 * 4, '='))
+        } catch (e: IllegalArgumentException) {
+            throw WalletException(WalletErrorCode.INVALID_REQUEST, "invalid base64", e)
+        }
+    }
+
+    fun toBase64Url(bytes: ByteArray): String = Base64.getUrlEncoder().withoutPadding().encodeToString(bytes)
+
+    fun toHex(bytes: ByteArray): String {
+        val out = StringBuilder(bytes.size * 2)
+        for (b in bytes) {
+            val v = b.toInt() and 0xff
+            out.append(HEX[v ushr 4]).append(HEX[v and 0x0f])
+        }
+        return out.toString()
+    }
+
+    /** Hex with or without 0x; null when malformed. */
+    fun fromHexOrNull(value: String): ByteArray? {
+        val body = if (value.startsWith("0x") || value.startsWith("0X")) value.substring(2) else value
+        if (body.length % 2 != 0) return null
+        val out = ByteArray(body.length / 2)
+        for (i in out.indices) {
+            val hi = Character.digit(body[i * 2], 16)
+            val lo = Character.digit(body[i * 2 + 1], 16)
+            if (hi < 0 || lo < 0) return null
+            out[i] = ((hi shl 4) or lo).toByte()
+        }
+        return out
+    }
+
+    fun fromHex(value: String): ByteArray =
+        fromHexOrNull(value) ?: throw WalletException(WalletErrorCode.INVALID_REQUEST, "invalid hex")
+
+    fun concat(vararg parts: ByteArray): ByteArray {
+        val out = ByteArray(parts.sumOf { it.size })
+        var offset = 0
+        for (p in parts) {
+            p.copyInto(out, offset)
+            offset += p.size
+        }
+        return out
+    }
+
+    fun randomBytes(length: Int): ByteArray = ByteArray(length).also { random.nextBytes(it) }
+
+    fun wipe(vararg buffers: ByteArray?) {
+        for (b in buffers) b?.fill(0)
+    }
+
+    fun sha256(data: ByteArray): ByteArray = MessageDigest.getInstance("SHA-256").digest(data)
+
+    fun sameBytes(a: ByteArray, b: ByteArray): Boolean = MessageDigest.isEqual(a, b)
+
+    private const val HEX = "0123456789abcdef"
+}