@authon/react-native-wallet 0.0.0-stage → 0.4.0

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/Chains.kt

@@ -0,0 +1,157 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/Chains.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import org.bouncycastle.crypto.digests.RIPEMD160Digest
+import org.bouncycastle.crypto.params.Ed25519PrivateKeyParameters
+import org.web3j.crypto.Bip32ECKeyPair
+import org.web3j.crypto.Hash
+import org.web3j.crypto.Keys
+import org.web3j.crypto.Sign
+import javax.crypto.Mac
+import javax.crypto.spec.SecretKeySpec
+
+/** Chains a wallet derives addresses for (NATIVE.md section 11). [wire] is the contract string. */
+enum class WalletChain(val wire: String) {
+    EVM("evm"),
+    TRON("tron"),
+    XRP("xrp"),
+    BITCOIN("bitcoin"),
+    BITCOIN_TESTNET("bitcoin-testnet"),
+    SOLANA("solana");
+
+    companion object {
+        fun fromWire(value: String): WalletChain = entries.firstOrNull { it.wire == value }
+            ?: throw walletError(WalletErrorCode.INVALID_REQUEST, "chain must be one of ${entries.joinToString(", ") { it.wire }}")
+    }
+}
+
+/**
+ * Per-chain account addresses from the BIP39 seed, with the paths of standard wallets
+ * (`apps/wallet/src/chains.ts`). Curve math comes from web3j / Bouncy Castle; only the address
+ * encodings and SLIP-0010 chaining are assembled here. Address derivation only, no signing.
+ */
+internal object Chains {
+    private const val H = Bip32ECKeyPair.HARDENED_BIT
+
+    fun path(chain: WalletChain, index: Long): String = when (chain) {
+        WalletChain.EVM -> "m/44'/60'/0'/0/$index"
+        WalletChain.TRON -> "m/44'/195'/$index'/0/0"
+        WalletChain.XRP -> "m/44'/144'/$index'/0/0"
+        WalletChain.BITCOIN -> "m/84'/0'/$index'/0/0"
+        WalletChain.BITCOIN_TESTNET -> "m/84'/1'/$index'/0/0"
+        WalletChain.SOLANA -> "m/44'/501'/$index'/0'"
+    }
+
+    private fun secpPath(chain: WalletChain, index: Int): IntArray = when (chain) {
+        WalletChain.EVM -> intArrayOf(44 or H, 60 or H, 0 or H, 0, index)
+        WalletChain.TRON -> intArrayOf(44 or H, 195 or H, index or H, 0, 0)
+        WalletChain.XRP -> intArrayOf(44 or H, 144 or H, index or H, 0, 0)
+        WalletChain.BITCOIN -> intArrayOf(84 or H, 0 or H, index or H, 0, 0)
+        WalletChain.BITCOIN_TESTNET -> intArrayOf(84 or H, 1 or H, index or H, 0, 0)
+        WalletChain.SOLANA -> throw IllegalArgumentException("solana is not secp256k1")
+    }
+
+    private fun hash160(data: ByteArray): ByteArray {
+        val sha = Bytes.sha256(data)
+        val d = RIPEMD160Digest()
+        d.update(sha, 0, sha.size)
+        return ByteArray(20).also { d.doFinal(it, 0) }
+    }
+
+    private fun secpAddress(chain: WalletChain, master: Bip32ECKeyPair, index: Int): String =
+        addressOfPrivateKey(chain, Bip32ECKeyPair.deriveKeyPair(master, secpPath(chain, index)).privateKey)
+
+    /** The secp256k1 private key of account [index] on [chain]. Callers wipe it. */
+    fun secpPrivateKey(secret: ByteArray, chain: WalletChain, index: Long): ByteArray {
+        if (!HdWallet.isAccountIndex(index)) throw walletError(WalletErrorCode.INVALID_REQUEST, "invalid account index")
+        if (chain == WalletChain.EVM) return HdWallet.privateKey(secret, index)
+        if (!HdWallet.isHdSecret(secret)) throw walletError(WalletErrorCode.ACCOUNT_UNAVAILABLE, "this wallet has only EVM account 0")
+        val seed = HdWallet.seedOf(secret)
+        try {
+            val node = Bip32ECKeyPair.deriveKeyPair(Bip32ECKeyPair.generateKeyPair(seed), secpPath(chain, index.toInt()))
+            return org.web3j.utils.Numeric.toBytesPadded(node.privateKey, 32)
+        } finally {
+            Bytes.wipe(seed)
+        }
+    }
+
+    /** Compressed secp256k1 public key of account [index] on [chain]. */
+    fun secpPublicKey(secret: ByteArray, chain: WalletChain, index: Long): ByteArray {
+        val key = secpPrivateKey(secret, chain, index)
+        try {
+            return compressedPublicKey(key)
+        } finally {
+            Bytes.wipe(key)
+        }
+    }
+
+    fun compressedPublicKey(privateKey: ByteArray): ByteArray =
+        Sign.publicPointFromPrivate(java.math.BigInteger(1, privateKey)).getEncoded(true)
+
+    fun hash160Of(data: ByteArray): ByteArray = hash160(data)
+
+    fun addressOfKey(chain: WalletChain, privateKey: ByteArray): String =
+        addressOfPrivateKey(chain, java.math.BigInteger(1, privateKey))
+
+    private fun addressOfPrivateKey(chain: WalletChain, privateKey: java.math.BigInteger): String {
+        val point = Sign.publicPointFromPrivate(privateKey)
+        val compressed = point.getEncoded(true)
+        val uncompressed = point.getEncoded(false)
+        return when (chain) {
+            WalletChain.EVM -> Keys.toChecksumAddress(Bytes.toHex(Hash.sha3(uncompressed.copyOfRange(1, 65)).copyOfRange(12, 32)))
+            WalletChain.TRON -> Base58.encodeCheck(byteArrayOf(0x41) + Hash.sha3(uncompressed.copyOfRange(1, 65)).copyOfRange(12, 32))
+            WalletChain.XRP -> Base58.encodeCheck(byteArrayOf(0x00) + hash160(compressed), Base58.XRP)
+            WalletChain.BITCOIN -> Bech32.segwitV0("bc", hash160(compressed))
+            WalletChain.BITCOIN_TESTNET -> Bech32.segwitV0("tb", hash160(compressed))
+            WalletChain.SOLANA -> throw IllegalArgumentException("solana is not secp256k1")
+        }
+    }
+
+    private fun hmacSha512(key: ByteArray, data: ByteArray): ByteArray =
+        Mac.getInstance("HmacSHA512").run { init(SecretKeySpec(key, "HmacSHA512")); doFinal(data) }
+
+    /** SLIP-0010 ed25519 derivation; every level is hardened. Callers wipe the 32-byte key. */
+    fun ed25519Key(seed: ByteArray, indices: IntArray): ByteArray {
+        var i = hmacSha512(Bytes.utf8("ed25519 seed"), seed)
+        var key = i.copyOfRange(0, 32)
+        var code = i.copyOfRange(32, 64)
+        for (index in indices) {
+            val hardened = index or H
+            val ser = byteArrayOf((hardened ushr 24).toByte(), (hardened ushr 16).toByte(), (hardened ushr 8).toByte(), hardened.toByte())
+            val data = byteArrayOf(0) + key + ser
+            Bytes.wipe(i)
+            i = hmacSha512(code, data)
+            Bytes.wipe(data, key, code)
+            key = i.copyOfRange(0, 32)
+            code = i.copyOfRange(32, 64)
+        }
+        Bytes.wipe(i, code)
+        return key
+    }
+
+    private fun solanaAddress(seed: ByteArray, index: Int): String {
+        val key = ed25519Key(seed, intArrayOf(44, 501, index, 0))
+        try {
+            return Base58.encode(Ed25519PrivateKeyParameters(key, 0).generatePublicKey().encoded)
+        } finally {
+            Bytes.wipe(key)
+        }
+    }
+
+    /** Addresses of accounts start..start+count-1 on [chain]. Only HD wallets have chains other than EVM account 0. */
+    fun addresses(secret: ByteArray, chain: WalletChain, start: Long, count: Int): List<String> {
+        if (!HdWallet.isAccountIndex(start) || count < 1 || !HdWallet.isAccountIndex(start + count - 1)) {
+            throw walletError(WalletErrorCode.INVALID_REQUEST, "invalid account range")
+        }
+        if (chain == WalletChain.EVM) return HdWallet.addresses(secret, start, count)
+        if (!HdWallet.isHdSecret(secret)) throw walletError(WalletErrorCode.ACCOUNT_UNAVAILABLE, "this wallet has only EVM account 0")
+        val seed = HdWallet.seedOf(secret)
+        try {
+            if (chain == WalletChain.SOLANA) return (0 until count).map { solanaAddress(seed, (start + it).toInt()) }
+            val master = Bip32ECKeyPair.generateKeyPair(seed)
+            return (0 until count).map { secpAddress(chain, master, (start + it).toInt()) }
+        } finally {
+            Bytes.wipe(seed)
+        }
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/CredentialManagerPasskeys.kt

@@ -0,0 +1,192 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/CredentialManagerPasskeys.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import android.app.Activity
+import androidx.credentials.CreatePublicKeyCredentialRequest
+import androidx.credentials.CreatePublicKeyCredentialResponse
+import androidx.credentials.CredentialManager
+import androidx.credentials.GetCredentialRequest
+import androidx.credentials.GetPublicKeyCredentialOption
+import androidx.credentials.PublicKeyCredential
+import androidx.credentials.exceptions.CreateCredentialCancellationException
+import androidx.credentials.exceptions.CreateCredentialException
+import androidx.credentials.exceptions.CreateCredentialProviderConfigurationException
+import androidx.credentials.exceptions.CreateCredentialUnsupportedException
+import androidx.credentials.exceptions.GetCredentialCancellationException
+import androidx.credentials.exceptions.GetCredentialException
+import androidx.credentials.exceptions.GetCredentialProviderConfigurationException
+import androidx.credentials.exceptions.GetCredentialUnsupportedException
+import androidx.credentials.exceptions.NoCredentialException
+import androidx.credentials.exceptions.domerrors.DomError
+import androidx.credentials.exceptions.domerrors.NotAllowedError
+import androidx.credentials.exceptions.domerrors.NotSupportedError
+import androidx.credentials.exceptions.domerrors.SecurityError
+import androidx.credentials.exceptions.publickeycredential.CreatePublicKeyCredentialDomException
+import androidx.credentials.exceptions.publickeycredential.GetPublicKeyCredentialDomException
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.addJsonObject
+import kotlinx.serialization.json.booleanOrNull
+import kotlinx.serialization.json.buildJsonObject
+import kotlinx.serialization.json.contentOrNull
+import kotlinx.serialization.json.intOrNull
+import kotlinx.serialization.json.put
+import kotlinx.serialization.json.putJsonArray
+import kotlinx.serialization.json.putJsonObject
+
+/**
+ * Backup passkeys through Credential Manager with WebAuthn JSON for RP `wallet.authon.dev`
+ * (the same RP as the web frame, so synced passkeys restore on either side). PRF is requested with
+ * `extensions.prf.eval.first` and read from `clientExtensionResults.prf.results.first`.
+ *
+ * The app must be listed in the RP's Digital Asset Links (`get_login_creds`), which the API
+ * publishes only for approved app registrations.
+ */
+class CredentialManagerPasskeys(
+    private val activityProvider: () -> Activity?,
+    private val rpId: String = WalletApi.DEFAULT_RP_ID,
+) : PasskeyProvider {
+
+    private fun activity(): Activity = activityProvider()?.takeUnless { it.isFinishing || it.isDestroyed }
+        ?: throw walletError(WalletErrorCode.INTERNAL, "no foreground activity for the passkey prompt")
+
+    override suspend fun create(userId: ByteArray, userName: String, salt: ByteArray): PasskeyCreateResult {
+        val request = buildJsonObject {
+            put("challenge", Bytes.toBase64Url(Bytes.randomBytes(32)))
+            putJsonObject("rp") {
+                put("id", rpId)
+                put("name", "Authon Wallet")
+            }
+            putJsonObject("user") {
+                put("id", Bytes.toBase64Url(userId))
+                put("name", userName)
+                put("displayName", userName)
+            }
+            putJsonArray("pubKeyCredParams") {
+                for (alg in listOf(-7, -257, -8)) addJsonObject {
+                    put("type", "public-key")
+                    put("alg", alg)
+                }
+            }
+            put("attestation", "none")
+            putJsonObject("authenticatorSelection") {
+                put("residentKey", "preferred")
+                put("userVerification", "required")
+            }
+            prfExtension(salt)
+        }
+        val activity = activity()
+        val response = try {
+            withContext(Dispatchers.Main) {
+                CredentialManager.create(activity).createCredential(activity, CreatePublicKeyCredentialRequest(request.toString()))
+            }
+        } catch (e: CreateCredentialException) {
+            throw mapCreate(e)
+        }
+        val json = (response as? CreatePublicKeyCredentialResponse)?.registrationResponseJson
+            ?: throw walletError(WalletErrorCode.INTERNAL, "unexpected credential response")
+        val cred = Json.parseToJsonElement(json) as JsonObject
+        val ext = cred["clientExtensionResults"] as? JsonObject
+        val prf = ext?.get("prf") as? JsonObject
+        if (prf == null || (prf["enabled"] as? JsonPrimitive)?.booleanOrNull == false) throw walletError(WalletErrorCode.PRF_UNSUPPORTED)
+        val credentialId = normalize(cred.str("rawId") ?: cred.str("id") ?: throw walletError(WalletErrorCode.INTERNAL, "credential id missing"))
+        val resp = cred["response"] as? JsonObject ?: JsonObject(emptyMap())
+        val alg = (resp["publicKeyAlgorithm"] as? JsonPrimitive)?.intOrNull
+        val spki = resp.str("publicKey")?.takeIf { alg == -7 || alg == -257 || alg == -8 }?.let { normalize(it) }
+        val attestation = resp.str("attestationObject")?.let { normalize(it) }
+        val direct = prfFirst(prf)
+        val prfOutput = direct ?: get(credentialId, salt, null).prfOutput
+        return PasskeyCreateResult(credentialId, prfOutput, spki, if (spki != null) alg else null, attestation)
+    }
+
+    override suspend fun get(credentialId: String, salt: ByteArray, challenge: ByteArray?): PasskeyGetResult {
+        val request = buildJsonObject {
+            put("challenge", Bytes.toBase64Url(challenge ?: Bytes.randomBytes(32)))
+            put("rpId", rpId)
+            putJsonArray("allowCredentials") {
+                addJsonObject {
+                    put("type", "public-key")
+                    put("id", normalize(credentialId))
+                }
+            }
+            put("userVerification", "required")
+            prfExtension(salt)
+        }
+        val activity = activity()
+        val result = try {
+            withContext(Dispatchers.Main) {
+                CredentialManager.create(activity).getCredential(
+                    activity,
+                    GetCredentialRequest(listOf(GetPublicKeyCredentialOption(request.toString()))),
+                )
+            }
+        } catch (e: GetCredentialException) {
+            throw mapGet(e)
+        }
+        val json = (result.credential as? PublicKeyCredential)?.authenticationResponseJson
+            ?: throw walletError(WalletErrorCode.INTERNAL, "unexpected credential response")
+        val cred = Json.parseToJsonElement(json) as JsonObject
+        val prf = (cred["clientExtensionResults"] as? JsonObject)?.get("prf") as? JsonObject
+        val out = prf?.let { prfFirst(it) } ?: throw walletError(WalletErrorCode.PRF_UNSUPPORTED)
+        val resp = cred["response"] as? JsonObject ?: JsonObject(emptyMap())
+        fun field(name: String) = resp.str(name)?.let { normalize(it) } ?: ""
+        return PasskeyGetResult(
+            out,
+            PasskeyAssertion(
+                credentialId = normalize(cred.str("rawId") ?: cred.str("id") ?: credentialId),
+                clientDataJSON = field("clientDataJSON"),
+                authenticatorData = field("authenticatorData"),
+                signature = field("signature"),
+            ),
+        )
+    }
+
+    private fun kotlinx.serialization.json.JsonObjectBuilder.prfExtension(salt: ByteArray) {
+        putJsonObject("extensions") {
+            putJsonObject("prf") {
+                putJsonObject("eval") { put("first", Bytes.toBase64Url(salt)) }
+            }
+        }
+    }
+
+    private fun prfFirst(prf: JsonObject): ByteArray? {
+        val first = ((prf["results"] as? JsonObject)?.get("first") as? JsonPrimitive)?.contentOrNull ?: return null
+        val bytes = runCatching { Bytes.fromBase64(first) }.getOrNull() ?: return null
+        return bytes.takeIf { it.size == 32 }
+    }
+
+    private fun normalize(b64: String): String = Bytes.toBase64Url(Bytes.fromBase64(b64))
+
+    private fun JsonObject.str(k: String) = (this[k] as? JsonPrimitive)?.takeIf { it.isString }?.content
+
+    private fun mapDom(error: DomError, cause: Exception): WalletException = when (error) {
+        is NotAllowedError -> WalletException(WalletErrorCode.USER_CANCELLED, cause.message, cause)
+        is SecurityError -> WalletException(
+            WalletErrorCode.ORIGIN_NOT_ALLOWED,
+            "this app is not linked to $rpId (Digital Asset Links): ${cause.message}",
+            cause,
+        )
+        is NotSupportedError -> WalletException(WalletErrorCode.PRF_UNSUPPORTED, cause.message, cause)
+        else -> WalletException(WalletErrorCode.INTERNAL, "passkey failure", cause)
+    }
+
+    private fun mapCreate(e: CreateCredentialException): WalletException = when (e) {
+        is CreateCredentialCancellationException -> WalletException(WalletErrorCode.USER_CANCELLED, e.message, e)
+        is CreateCredentialUnsupportedException, is CreateCredentialProviderConfigurationException ->
+            WalletException(WalletErrorCode.PRF_UNSUPPORTED, e.message, e)
+        is CreatePublicKeyCredentialDomException -> mapDom(e.domError, e)
+        else -> WalletException(WalletErrorCode.INTERNAL, "passkey failure", e)
+    }
+
+    private fun mapGet(e: GetCredentialException): WalletException = when (e) {
+        is GetCredentialCancellationException -> WalletException(WalletErrorCode.USER_CANCELLED, e.message, e)
+        is NoCredentialException -> WalletException(WalletErrorCode.USER_CANCELLED, "no matching backup passkey", e)
+        is GetCredentialUnsupportedException, is GetCredentialProviderConfigurationException ->
+            WalletException(WalletErrorCode.PRF_UNSUPPORTED, e.message, e)
+        is GetPublicKeyCredentialDomException -> mapDom(e.domError, e)
+        else -> WalletException(WalletErrorCode.INTERNAL, "passkey failure", e)
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/Der.kt

@@ -0,0 +1,17 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/Der.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import java.math.BigInteger
+
+/** DER encoding of an ECDSA (r, s) signature. */
+internal object Der {
+    private fun int(v: ByteArray): ByteArray {
+        val n = BigInteger(1, v).toByteArray() // minimal, with a leading 0 when the high bit is set
+        return byteArrayOf(0x02, n.size.toByte()) + n
+    }
+
+    fun encode(r: ByteArray, s: ByteArray): ByteArray {
+        val body = int(r) + int(s)
+        return byteArrayOf(0x30, body.size.toByte()) + body
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/DeviceStore.kt

@@ -0,0 +1,170 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/DeviceStore.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import java.math.BigInteger
+import java.security.KeyPairGenerator
+import java.security.PrivateKey
+import java.security.Signature
+import java.security.interfaces.ECPublicKey
+import java.security.spec.ECGenParameterSpec
+import java.util.concurrent.ConcurrentHashMap
+import javax.crypto.Cipher
+import javax.crypto.KeyGenerator
+import javax.crypto.SecretKey
+import javax.crypto.spec.GCMParameterSpec
+
+class SealedShare(val iv: ByteArray, val ciphertext: ByteArray)
+
+/**
+ * The non-exportable keys of one device record: a P-256 signing key (its public JWK is registered
+ * with the API) and an AES-256-GCM key that seals the device share D.
+ */
+interface DeviceKeys {
+    /** Identifies the keys inside their store (e.g. the Keystore alias prefix). */
+    val handle: String
+    val publicJwk: DevicePublicJwk
+
+    /** ECDSA P-256 / SHA-256 over [data]; raw r||s (64 bytes) like WebCrypto. */
+    fun sign(data: ByteArray): ByteArray
+
+    fun seal(plain: ByteArray, aad: ByteArray): SealedShare
+
+    fun open(sealed: SealedShare, aad: ByteArray): ByteArray
+}
+
+data class DeviceRecord(
+    /** `projectId \0 userId`. */
+    val key: String,
+    val keys: DeviceKeys,
+    val iv: ByteArray,
+    val ciphertext: ByteArray,
+    val deviceId: String,
+    val walletId: String,
+    val address: String,
+    val shareVersion: Int,
+    val createdAt: Long,
+)
+
+/** Where the device share lives. Only D (sealed) and key references are stored; never k, A or B. */
+interface DeviceStore {
+    suspend fun generateKeys(): DeviceKeys
+
+    /** Removes keys that never made it into a stored record. */
+    suspend fun discardKeys(keys: DeviceKeys)
+
+    suspend fun get(key: String): DeviceRecord?
+
+    /** Replaces the record for [DeviceRecord.key]; keys of a replaced record are removed. */
+    suspend fun put(record: DeviceRecord)
+
+    suspend fun delete(key: String)
+}
+
+internal object DeviceStorage {
+    fun storageKey(projectId: String, userId: String): String = "$projectId\u0000$userId"
+
+    /** DER ECDSA signature -> raw r||s, each left-padded to [size] bytes. */
+    fun derToRaw(der: ByteArray, size: Int = 32): ByteArray {
+        var i = 0
+        fun readLen(): Int {
+            var len = der[i++].toInt() and 0xff
+            if (len and 0x80 != 0) {
+                val n = len and 0x7f
+                len = 0
+                repeat(n) { len = (len shl 8) or (der[i++].toInt() and 0xff) }
+            }
+            return len
+        }
+        require(der[i++].toInt() == 0x30) { "not a DER sequence" }
+        readLen()
+        fun readInt(): ByteArray {
+            require(der[i++].toInt() == 0x02) { "not a DER integer" }
+            val len = readLen()
+            val v = der.copyOfRange(i, i + len)
+            i += len
+            return v
+        }
+        val r = readInt()
+        val s = readInt()
+        val out = ByteArray(size * 2)
+        fun place(v: ByteArray, offset: Int) {
+            val trimmed = v.dropWhile { it.toInt() == 0 }.toByteArray()
+            require(trimmed.size <= size) { "integer too long" }
+            trimmed.copyInto(out, offset + size - trimmed.size)
+        }
+        place(r, 0)
+        place(s, size)
+        return out
+    }
+
+    fun unsigned32(v: BigInteger): ByteArray {
+        val raw = v.toByteArray()
+        val trimmed = if (raw.size > 32) raw.copyOfRange(raw.size - 32, raw.size) else raw
+        return ByteArray(32 - trimmed.size) + trimmed
+    }
+
+    fun jwkOf(key: ECPublicKey): DevicePublicJwk =
+        DevicePublicJwk(Bytes.toBase64Url(unsigned32(key.w.affineX)), Bytes.toBase64Url(unsigned32(key.w.affineY)))
+
+    fun gcmSeal(key: SecretKey, plain: ByteArray, aad: ByteArray, iv: ByteArray? = null): SealedShare {
+        val cipher = Cipher.getInstance("AES/GCM/NoPadding")
+        if (iv == null) cipher.init(Cipher.ENCRYPT_MODE, key) else cipher.init(Cipher.ENCRYPT_MODE, key, GCMParameterSpec(128, iv))
+        cipher.updateAAD(aad)
+        val ct = cipher.doFinal(plain)
+        return SealedShare(cipher.iv, ct)
+    }
+
+    fun gcmOpen(key: SecretKey, sealed: SealedShare, aad: ByteArray): ByteArray {
+        val cipher = Cipher.getInstance("AES/GCM/NoPadding")
+        cipher.init(Cipher.DECRYPT_MODE, key, GCMParameterSpec(128, sealed.iv))
+        cipher.updateAAD(aad)
+        return cipher.doFinal(sealed.ciphertext)
+    }
+}
+
+/**
+ * In-memory store with software JCA keys. For JVM tests and emulators only: nothing survives the
+ * process and the keys are not hardware-backed.
+ */
+class InMemoryDeviceStore : DeviceStore {
+    private val records = ConcurrentHashMap<String, DeviceRecord>()
+    private var counter = 0
+
+    private class SoftwareKeys(override val handle: String) : DeviceKeys {
+        private val signKey: PrivateKey
+        private val aesKey: SecretKey = KeyGenerator.getInstance("AES").apply { init(256) }.generateKey()
+        override val publicJwk: DevicePublicJwk
+
+        init {
+            val pair = KeyPairGenerator.getInstance("EC").apply { initialize(ECGenParameterSpec("secp256r1")) }.generateKeyPair()
+            signKey = pair.private
+            publicJwk = DeviceStorage.jwkOf(pair.public as ECPublicKey)
+        }
+
+        override fun sign(data: ByteArray): ByteArray {
+            val s = Signature.getInstance("SHA256withECDSA")
+            s.initSign(signKey)
+            s.update(data)
+            return DeviceStorage.derToRaw(s.sign())
+        }
+
+        override fun seal(plain: ByteArray, aad: ByteArray): SealedShare =
+            DeviceStorage.gcmSeal(aesKey, plain, aad, Bytes.randomBytes(12))
+
+        override fun open(sealed: SealedShare, aad: ByteArray): ByteArray = DeviceStorage.gcmOpen(aesKey, sealed, aad)
+    }
+
+    override suspend fun generateKeys(): DeviceKeys = synchronized(this) { SoftwareKeys("mem-${++counter}") }
+
+    override suspend fun discardKeys(keys: DeviceKeys) = Unit
+
+    override suspend fun get(key: String): DeviceRecord? = records[key]
+
+    override suspend fun put(record: DeviceRecord) {
+        records[record.key] = record
+    }
+
+    override suspend fun delete(key: String) {
+        records.remove(key)
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/DialogWalletApprover.kt

@@ -0,0 +1,141 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/DialogWalletApprover.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import android.app.Activity
+import android.app.AlertDialog
+import android.content.Context
+import android.graphics.Color
+import android.graphics.Typeface
+import android.hardware.biometrics.BiometricManager
+import android.hardware.biometrics.BiometricPrompt
+import android.os.Build
+import android.os.CancellationSignal
+import android.util.TypedValue
+import android.view.ViewGroup
+import android.widget.LinearLayout
+import android.widget.ScrollView
+import android.widget.TextView
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.suspendCancellableCoroutine
+import kotlinx.coroutines.withContext
+import kotlin.coroutines.resume
+
+/**
+ * Default approval UI: a platform AlertDialog with the summary (rows, warnings, the full text).
+ * "Sign" is enabled only after the text was scrolled to the end, like the web approval card.
+ */
+class DialogWalletApprover(private val activityProvider: () -> Activity?) : WalletApprover {
+
+    override suspend fun approve(summary: SignSummary): Boolean = withContext(Dispatchers.Main) {
+        val activity = activityProvider()?.takeUnless { it.isFinishing || it.isDestroyed }
+            ?: throw walletError(WalletErrorCode.CONFIRM_WINDOW_BLOCKED, "no foreground activity for the approval")
+        suspendCancellableCoroutine { cont ->
+            val scroll = ScrollView(activity)
+            scroll.addView(content(activity, summary))
+            var answered = false
+            val dialog = AlertDialog.Builder(activity)
+                .setTitle(summary.title)
+                .setView(scroll)
+                .setPositiveButton("Sign") { _, _ ->
+                    answered = true
+                    if (cont.isActive) cont.resume(true)
+                }
+                .setNegativeButton("Cancel") { _, _ ->
+                    answered = true
+                    if (cont.isActive) cont.resume(false)
+                }
+                .setOnDismissListener {
+                    if (!answered && cont.isActive) cont.resume(false)
+                }
+                .create()
+            dialog.setCanceledOnTouchOutside(false)
+            dialog.setOnShowListener {
+                val sign = dialog.getButton(AlertDialog.BUTTON_POSITIVE)
+                fun update() {
+                    sign.isEnabled = !scroll.canScrollVertically(1)
+                }
+                update()
+                scroll.setOnScrollChangeListener { _, _, _, _, _ -> if (!sign.isEnabled) update() }
+                scroll.post { update() }
+            }
+            cont.invokeOnCancellation { dialog.dismiss() }
+            dialog.show()
+        }
+    }
+
+    private fun content(context: Context, summary: SignSummary): LinearLayout {
+        val pad = dp(context, 20)
+        val layout = LinearLayout(context).apply {
+            orientation = LinearLayout.VERTICAL
+            setPadding(pad, dp(context, 8), pad, dp(context, 8))
+        }
+        for (w in summary.warnings) {
+            layout.addView(text(context, w).apply { setTextColor(Color.rgb(0xb4, 0x23, 0x18)); setPadding(0, 0, 0, dp(context, 8)) })
+        }
+        for (row in summary.rows) {
+            layout.addView(text(context, row.label).apply { alpha = 0.7f; setTextSize(TypedValue.COMPLEX_UNIT_SP, 12f) })
+            layout.addView(
+                text(context, row.value).apply {
+                    if (row.mono) typeface = Typeface.MONOSPACE
+                    setTextIsSelectable(true)
+                    setPadding(0, 0, 0, dp(context, 8))
+                },
+            )
+        }
+        summary.body?.let { body ->
+            layout.addView(
+                text(context, body).apply {
+                    typeface = Typeface.MONOSPACE
+                    setTextSize(TypedValue.COMPLEX_UNIT_SP, 12f)
+                    setTextIsSelectable(true)
+                },
+            )
+        }
+        return layout
+    }
+
+    private fun text(context: Context, value: String) = TextView(context).apply {
+        text = value
+        layoutParams = LinearLayout.LayoutParams(ViewGroup.LayoutParams.MATCH_PARENT, ViewGroup.LayoutParams.WRAP_CONTENT)
+    }
+
+    private fun dp(context: Context, v: Int) = (v * context.resources.displayMetrics.density).toInt()
+}
+
+/**
+ * Device lock check with the platform BiometricPrompt: biometrics or the device credential on
+ * Android 10+, biometrics only on Android 9.
+ */
+class BiometricDeviceAuthenticator(private val activityProvider: () -> Activity?) : DeviceAuthenticator {
+
+    override suspend fun authenticate(reason: String): Boolean = withContext(Dispatchers.Main) {
+        val activity = activityProvider()?.takeUnless { it.isFinishing || it.isDestroyed }
+            ?: throw walletError(WalletErrorCode.CONFIRM_WINDOW_BLOCKED, "no foreground activity for device authentication")
+        suspendCancellableCoroutine { cont ->
+            val executor = activity.mainExecutor
+            val builder = BiometricPrompt.Builder(activity).setTitle(reason).setSubtitle("Confirm it is you")
+            when {
+                Build.VERSION.SDK_INT >= 30 -> builder.setAllowedAuthenticators(
+                    BiometricManager.Authenticators.BIOMETRIC_STRONG or BiometricManager.Authenticators.DEVICE_CREDENTIAL,
+                )
+                Build.VERSION.SDK_INT == 29 -> @Suppress("DEPRECATION") builder.setDeviceCredentialAllowed(true)
+                else -> builder.setNegativeButton("Cancel", executor) { _, _ -> if (cont.isActive) cont.resume(false) }
+            }
+            val signal = CancellationSignal()
+            cont.invokeOnCancellation { signal.cancel() }
+            builder.build().authenticate(
+                signal,
+                executor,
+                object : BiometricPrompt.AuthenticationCallback() {
+                    override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
+                        if (cont.isActive) cont.resume(true)
+                    }
+
+                    override fun onAuthenticationError(errorCode: Int, errString: CharSequence) {
+                        if (cont.isActive) cont.resume(false)
+                    }
+                },
+            )
+        }
+    }
+}