@authon/react-native-wallet 0.0.0-stage → 0.4.0

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/HdWallet.kt

@@ -0,0 +1,130 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/HdWallet.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import org.web3j.crypto.Bip32ECKeyPair
+import org.web3j.crypto.MnemonicUtils
+import org.web3j.utils.Numeric
+
+/**
+ * The shared secret is BIP39 entropy (16 bytes = 12 words); keys are m/44'/60'/0'/0/{index}.
+ * A 32-byte secret is a raw secp256k1 key from before HD wallets and has only account 0.
+ * Same rules as `apps/wallet/src/shares.ts`.
+ */
+internal object HdWallet {
+    const val HD_ENTROPY_BYTES = 16
+    const val MAX_ACCOUNT_INDEX: Long = 0x7fffffff
+
+    private const val H = Bip32ECKeyPair.HARDENED_BIT
+    private val ACCOUNT_PARENT = intArrayOf(44 or H, 60 or H, 0 or H, 0)
+
+    fun evmPath(index: Long): String = "m/44'/60'/0'/0/$index"
+
+    fun generateSecret(): ByteArray = Bytes.randomBytes(HD_ENTROPY_BYTES)
+
+    fun isHdSecret(secret: ByteArray): Boolean = secret.size == HD_ENTROPY_BYTES
+
+    fun isAccountIndex(index: Long): Boolean = index in 0..MAX_ACCOUNT_INDEX
+
+    fun mnemonicOf(entropy: ByteArray): String = MnemonicUtils.generateMnemonic(entropy)
+
+    /** BIP39 seed (PBKDF2-HMAC-SHA512, 2048 rounds, salt "mnemonic"). Callers wipe it. */
+    fun seedOf(entropy: ByteArray): ByteArray = MnemonicUtils.generateSeed(mnemonicOf(entropy), "")
+
+    private fun accountParent(secret: ByteArray): Bip32ECKeyPair {
+        val seed = seedOf(secret)
+        try {
+            return Bip32ECKeyPair.deriveKeyPair(Bip32ECKeyPair.generateKeyPair(seed), ACCOUNT_PARENT)
+        } finally {
+            seed.fill(0)
+        }
+    }
+
+    /** The EVM private key at account [index]. Callers wipe the result. */
+    fun privateKey(secret: ByteArray, index: Long = 0): ByteArray {
+        if (!isAccountIndex(index)) throw IllegalArgumentException("invalid account index")
+        if (secret.size == 32) {
+            if (index != 0L) throw walletError(WalletErrorCode.ACCOUNT_UNAVAILABLE, "this wallet has only account 0")
+            return secret.copyOf()
+        }
+        if (!isHdSecret(secret)) throw walletError(WalletErrorCode.INTERNAL, "unsupported wallet secret")
+        val node = Bip32ECKeyPair.deriveKeyPair(accountParent(secret), intArrayOf(index.toInt()))
+        return Numeric.toBytesPadded(node.privateKey, 32)
+    }
+
+    fun account(secret: ByteArray, index: Long = 0): EvmAccount {
+        val key = privateKey(secret, index)
+        try {
+            return EvmAccount(key)
+        } finally {
+            key.fill(0)
+        }
+    }
+
+    fun address(secret: ByteArray, index: Long = 0): String = account(secret, index).address
+
+    /** Addresses of accounts start..start+count-1; the seed is derived once for the range. */
+    fun addresses(secret: ByteArray, start: Long, count: Int): List<String> {
+        if (!isAccountIndex(start) || count < 1 || !isAccountIndex(start + count - 1)) {
+            throw IllegalArgumentException("invalid account range")
+        }
+        if (secret.size == 32) {
+            if (start != 0L || count != 1) throw walletError(WalletErrorCode.ACCOUNT_UNAVAILABLE, "this wallet has only account 0")
+            return listOf(address(secret, 0))
+        }
+        if (!isHdSecret(secret)) throw walletError(WalletErrorCode.INTERNAL, "unsupported wallet secret")
+        val parent = accountParent(secret)
+        return (0 until count).map { i ->
+            val node = Bip32ECKeyPair.deriveKeyPair(parent, intArrayOf((start + i).toInt()))
+            val key = Numeric.toBytesPadded(node.privateKey, 32)
+            try {
+                EvmAccount(key).address
+            } finally {
+                key.fill(0)
+            }
+        }
+    }
+
+    class SplitShares(val device: ByteArray, val company: ByteArray, val backup: ByteArray?) {
+        fun wipe() = Bytes.wipe(device, company, backup)
+    }
+
+    fun splitUnprotected(secret: ByteArray): SplitShares {
+        val s = Shamir.split(secret, 2, 2)
+        return SplitShares(s[0], s[1], null)
+    }
+
+    fun splitProtected(secret: ByteArray): SplitShares {
+        val s = Shamir.split(secret, 3, 2)
+        return SplitShares(s[0], s[1], s[2])
+    }
+
+    fun assemble(a: ByteArray, b: ByteArray): ByteArray = Shamir.combine(listOf(a, b))
+
+    /**
+     * One more share on the same 2-of-n polynomial as [a] and [b] (see shares.ts deriveShare):
+     * shifting both x coordinates by x3 and interpolating at zero yields f(x3).
+     */
+    fun deriveShare(a: ByteArray, b: ByteArray, pickX: () -> Int = ::randomX): ByteArray {
+        if (a.size != b.size || a.size < 2) throw IllegalArgumentException("share length mismatch")
+        val xa = a[a.size - 1].toInt() and 0xff
+        val xb = b[b.size - 1].toInt() and 0xff
+        var x3 = 0
+        while (x3 == 0 || x3 == xa || x3 == xb) x3 = pickX() and 0xff
+        val shiftedA = a.copyOf()
+        val shiftedB = b.copyOf()
+        shiftedA[a.size - 1] = (xa xor x3).toByte()
+        shiftedB[b.size - 1] = (xb xor x3).toByte()
+        try {
+            val y = Shamir.combine(listOf(shiftedA, shiftedB))
+            val share = ByteArray(a.size)
+            y.copyInto(share)
+            share[a.size - 1] = x3.toByte()
+            y.fill(0)
+            return share
+        } finally {
+            Bytes.wipe(shiftedA, shiftedB)
+        }
+    }
+
+    private fun randomX(): Int = Bytes.randomBytes(1)[0].toInt() and 0xff
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/Http.kt

@@ -0,0 +1,86 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/Http.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import kotlinx.coroutines.suspendCancellableCoroutine
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonElement
+import kotlinx.serialization.json.JsonObject
+import okhttp3.Call
+import okhttp3.Callback
+import okhttp3.MediaType.Companion.toMediaType
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.RequestBody.Companion.toRequestBody
+import okhttp3.Response
+import java.io.IOException
+import java.util.concurrent.TimeUnit
+import kotlin.coroutines.resume
+import kotlin.coroutines.resumeWithException
+
+internal class HttpResult(val status: Int, val text: String, private val requestIdHeader: String? = null) {
+    val ok: Boolean get() = status in 200..299
+
+    /** The body as a JSON object; `{}` when it is empty or not an object (like the frame's `asRecord`). */
+    val json: JsonObject by lazy {
+        if (text.isBlank()) {
+            JsonObject(emptyMap())
+        } else {
+            runCatching { Json.parseToJsonElement(text) as? JsonObject }.getOrNull() ?: JsonObject(emptyMap())
+        }
+    }
+
+    /** Diagnostic id: the error body's `requestId`, else the `X-Request-Id` header (NATIVE.md section 10). */
+    val requestId: String?
+        get() = (json["requestId"] as? kotlinx.serialization.json.JsonPrimitive)?.takeIf { it.isString }?.content ?: requestIdHeader
+}
+
+/** Keep in sync with `version` in authon/build.gradle.kts. */
+internal const val SDK_VERSION = "0.1.0"
+
+/** HTTP helper shared by the wallet and the auth core; lives here so the wallet package stands alone. */
+internal object Http {
+    private val JSON_MEDIA = "application/json".toMediaType()
+
+    val defaultClient: OkHttpClient by lazy {
+        OkHttpClient.Builder()
+            .connectTimeout(15, TimeUnit.SECONDS)
+            .readTimeout(30, TimeUnit.SECONDS)
+            .writeTimeout(30, TimeUnit.SECONDS)
+            .followRedirects(false)
+            .build()
+    }
+
+    fun userAgent(): String = "authon-android/$SDK_VERSION"
+
+    fun request(
+        url: String,
+        method: String,
+        headers: Map<String, String>,
+        body: JsonElement?,
+    ): Request {
+        val builder = Request.Builder().url(url)
+        for ((k, v) in headers) builder.header(k, v)
+        val payload = body?.toString()?.toRequestBody(JSON_MEDIA)
+        builder.method(method, payload ?: if (method == "POST" || method == "PUT" || method == "PATCH") ByteArray(0).toRequestBody(null) else null)
+        return builder.build()
+    }
+
+    /** Executes the call; throws IOException on network failure. Cancelling the coroutine cancels the call. */
+    suspend fun execute(client: OkHttpClient, request: Request): HttpResult =
+        suspendCancellableCoroutine { cont ->
+            val call = client.newCall(request)
+            cont.invokeOnCancellation { call.cancel() }
+            call.enqueue(
+                object : Callback {
+                    override fun onFailure(call: Call, e: IOException) {
+                        if (cont.isActive) cont.resumeWithException(e)
+                    }
+
+                    override fun onResponse(call: Call, response: Response) {
+                        val result = response.use { HttpResult(it.code, it.body?.string() ?: "", it.header("X-Request-Id")) }
+                        if (cont.isActive) cont.resume(result)
+                    }
+                },
+            )
+        }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/JsValues.kt

@@ -0,0 +1,83 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/JsValues.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import kotlinx.serialization.json.JsonArray
+import kotlinx.serialization.json.JsonElement
+import kotlinx.serialization.json.JsonNull
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.booleanOrNull
+import java.math.BigDecimal
+import java.math.BigInteger
+
+/** Conversions that follow JavaScript semantics where the frame relies on them. */
+internal object JsValues {
+    /** `BigInt(value)`: integers, decimal strings, 0x/0o/0b strings; "" is 0. Null when JS would throw. */
+    fun toBigIntOrNull(value: Any?): BigInteger? = when (value) {
+        null -> null
+        is BigInteger -> value
+        is Int -> BigInteger.valueOf(value.toLong())
+        is Long -> BigInteger.valueOf(value)
+        is Short -> BigInteger.valueOf(value.toLong())
+        is Byte -> BigInteger.valueOf(value.toLong())
+        is Double, is Float -> numberToBigInt(BigDecimal(value.toString()))
+        is BigDecimal -> numberToBigInt(value)
+        is Boolean -> if (value) BigInteger.ONE else BigInteger.ZERO
+        is String -> stringToBigInt(value)
+        is JsonNull -> null
+        is JsonPrimitive ->
+            if (value.isString) stringToBigInt(value.content)
+            else value.booleanOrNull?.let { if (it) BigInteger.ONE else BigInteger.ZERO }
+                ?: runCatching { numberToBigInt(BigDecimal(value.content)) }.getOrNull()
+        else -> null
+    }
+
+    private fun numberToBigInt(d: BigDecimal): BigInteger? = try {
+        d.toBigIntegerExact()
+    } catch (_: ArithmeticException) {
+        null
+    }
+
+    private fun stringToBigInt(raw: String): BigInteger? {
+        val s = raw.trim()
+        if (s.isEmpty()) return BigInteger.ZERO
+        val radix = when {
+            s.startsWith("0x") || s.startsWith("0X") -> 16
+            s.startsWith("0o") || s.startsWith("0O") -> 8
+            s.startsWith("0b") || s.startsWith("0B") -> 2
+            else -> 10
+        }
+        return try {
+            if (radix == 10) {
+                if (!Regex("^[+-]?[0-9]+$").matches(s)) null else BigInteger(s)
+            } else {
+                val body = s.substring(2)
+                if (body.isEmpty() || body.any { Character.digit(it, radix) < 0 }) null else BigInteger(body, radix)
+            }
+        } catch (_: NumberFormatException) {
+            null
+        }
+    }
+
+    /** Converts Kotlin maps/lists/primitives (e.g. from a React Native bridge) to JSON. */
+    fun toJson(value: Any?): JsonElement = when (value) {
+        null -> JsonNull
+        is JsonElement -> value
+        is String -> JsonPrimitive(value)
+        is Boolean -> JsonPrimitive(value)
+        is BigInteger -> JsonPrimitive(value.toString())
+        is Number -> {
+            val d = value.toDouble()
+            if ((value is Double || value is Float) && d == Math.floor(d) && !d.isInfinite() && Math.abs(d) < 1e21) {
+                JsonPrimitive(BigDecimal(d).toBigInteger())
+            } else {
+                JsonPrimitive(value)
+            }
+        }
+        is Map<*, *> -> JsonObject(value.entries.associate { (k, v) -> k.toString() to toJson(v) })
+        is Iterable<*> -> JsonArray(value.map { toJson(it) })
+        is Array<*> -> JsonArray(value.map { toJson(it) })
+        is ByteArray -> JsonPrimitive("0x" + Bytes.toHex(value))
+        else -> throw walletError(WalletErrorCode.INVALID_REQUEST, "unsupported value type ${value::class.java.simpleName}")
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/KeystoreDeviceStore.kt

@@ -0,0 +1,236 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/KeystoreDeviceStore.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import android.content.Context
+import android.content.pm.PackageManager
+import android.os.Build
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyInfo
+import android.security.keystore.KeyProperties
+import android.security.keystore.StrongBoxUnavailableException
+import android.util.AtomicFile
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.buildJsonObject
+import kotlinx.serialization.json.contentOrNull
+import kotlinx.serialization.json.intOrNull
+import kotlinx.serialization.json.longOrNull
+import kotlinx.serialization.json.put
+import java.io.File
+import java.io.IOException
+import java.security.Key
+import java.security.KeyFactory
+import java.security.KeyPairGenerator
+import java.security.KeyStore
+import java.security.PrivateKey
+import java.security.Signature
+import java.security.interfaces.ECPublicKey
+import java.security.spec.ECGenParameterSpec
+import java.util.UUID
+import javax.crypto.KeyGenerator
+import javax.crypto.SecretKey
+import javax.crypto.SecretKeyFactory
+
+/** Where a Keystore key lives, as reported by KeyInfo. */
+enum class KeySecurityLevel { STRONGBOX, TRUSTED_ENVIRONMENT, UNKNOWN_SECURE, SOFTWARE, UNKNOWN }
+
+/**
+ * Device share storage in the Android Keystore (NATIVE.md section 3).
+ * - Signing key: P-256, non-exportable, StrongBox when available, hardware TEE accepted.
+ *   Software-only keys are refused unless [allowSoftwareKeys] (tests and emulators only).
+ * - D is sealed with a Keystore AES-256-GCM key, AAD = storage key `projectId\0userId`, and written
+ *   with AtomicFile to `noBackupFilesDir`, so it is not part of cloud backups or device transfers.
+ *   Every write is read back and compared.
+ */
+class KeystoreDeviceStore @JvmOverloads constructor(
+    context: Context,
+    private val allowSoftwareKeys: Boolean = false,
+) : DeviceStore {
+    private val appContext = context.applicationContext
+    private val dir = File(appContext.noBackupFilesDir, "authon-wallet")
+    private val hasStrongBox = Build.VERSION.SDK_INT >= 28 &&
+        appContext.packageManager.hasSystemFeature(PackageManager.FEATURE_STRONGBOX_KEYSTORE)
+
+    private val keyStore: KeyStore by lazy { KeyStore.getInstance(ANDROID_KEYSTORE).apply { load(null) } }
+
+    private inner class KeystoreKeys(override val handle: String, override val publicJwk: DevicePublicJwk) : DeviceKeys {
+        private fun signKey(): PrivateKey = keyStore.getKey("$handle.sign", null) as? PrivateKey
+            ?: throw walletError(WalletErrorCode.NEEDS_RESTORE, "device key missing")
+
+        private fun aesKey(): SecretKey = keyStore.getKey("$handle.share", null) as? SecretKey
+            ?: throw walletError(WalletErrorCode.NEEDS_RESTORE, "device share key missing")
+
+        override fun sign(data: ByteArray): ByteArray {
+            val s = Signature.getInstance("SHA256withECDSA")
+            s.initSign(signKey())
+            s.update(data)
+            return DeviceStorage.derToRaw(s.sign())
+        }
+
+        override fun seal(plain: ByteArray, aad: ByteArray): SealedShare = DeviceStorage.gcmSeal(aesKey(), plain, aad)
+
+        override fun open(sealed: SealedShare, aad: ByteArray): ByteArray = DeviceStorage.gcmOpen(aesKey(), sealed, aad)
+    }
+
+    /** Security level of the signing key behind [keys] (diagnostics and tests). */
+    fun securityLevelOf(keys: DeviceKeys): KeySecurityLevel = securityLevel(keyStore.getKey("${keys.handle}.sign", null))
+
+    override suspend fun generateKeys(): DeviceKeys = withContext(Dispatchers.IO) {
+        val handle = "dev.authon.wallet.${UUID.randomUUID()}"
+        try {
+            val pair = withStrongBoxFallback { strongBox ->
+                val spec = KeyGenParameterSpec.Builder("$handle.sign", KeyProperties.PURPOSE_SIGN or KeyProperties.PURPOSE_VERIFY)
+                    .setAlgorithmParameterSpec(ECGenParameterSpec("secp256r1"))
+                    .setDigests(KeyProperties.DIGEST_SHA256)
+                    .apply { if (strongBox) setIsStrongBoxBacked(true) }
+                    .build()
+                KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, ANDROID_KEYSTORE).apply { initialize(spec) }.generateKeyPair()
+            }
+            val aes = withStrongBoxFallback { strongBox ->
+                val spec = KeyGenParameterSpec.Builder("$handle.share", KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT)
+                    .setKeySize(256)
+                    .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
+                    .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
+                    .apply { if (strongBox) setIsStrongBoxBacked(true) }
+                    .build()
+                KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, ANDROID_KEYSTORE).apply { init(spec) }.generateKey()
+            }
+            if (!allowSoftwareKeys) {
+                val levels = listOf(securityLevel(pair.private), securityLevel(aes))
+                if (levels.any { it == KeySecurityLevel.SOFTWARE || it == KeySecurityLevel.UNKNOWN }) {
+                    deleteAliases(handle)
+                    throw walletError(WalletErrorCode.STORAGE_UNAVAILABLE, "this device has no hardware-backed keystore")
+                }
+            }
+            KeystoreKeys(handle, DeviceStorage.jwkOf(pair.public as ECPublicKey))
+        } catch (e: WalletException) {
+            throw e
+        } catch (e: Exception) {
+            deleteAliases(handle)
+            throw WalletException(WalletErrorCode.STORAGE_UNAVAILABLE, "device keys could not be created", e)
+        }
+    }
+
+    private fun <T> withStrongBoxFallback(block: (Boolean) -> T): T {
+        if (hasStrongBox) {
+            try {
+                return block(true)
+            } catch (_: StrongBoxUnavailableException) {
+                // fall through to the TEE
+            }
+        }
+        return block(false)
+    }
+
+    private fun securityLevel(key: Key?): KeySecurityLevel = KeystoreSecurity.levelOf(key)
+
+    private fun deleteAliases(handle: String) {
+        for (alias in listOf("$handle.sign", "$handle.share")) runCatching { keyStore.deleteEntry(alias) }
+    }
+
+    private fun fileFor(key: String) = AtomicFile(File(dir, Bytes.toHex(Bytes.sha256(Bytes.utf8(key))) + ".json"))
+
+    override suspend fun discardKeys(keys: DeviceKeys) = withContext(Dispatchers.IO) { deleteAliases(keys.handle) }
+
+    override suspend fun get(key: String): DeviceRecord? = withContext(Dispatchers.IO) { read(key) }
+
+    private fun read(key: String): DeviceRecord? {
+        val file = fileFor(key)
+        if (!file.baseFile.exists()) return null
+        val o = try {
+            Json.parseToJsonElement(String(file.readFully(), Charsets.UTF_8)) as? JsonObject
+        } catch (e: Exception) {
+            throw WalletException(WalletErrorCode.STORAGE_UNAVAILABLE, "device record unreadable", e)
+        } ?: return null
+        fun s(k: String) = (o[k] as? JsonPrimitive)?.contentOrNull
+        if (s("key") != key) return null
+        val handle = s("handle") ?: return null
+        val jwk = o["publicJwk"] as? JsonObject ?: return null
+        return DeviceRecord(
+            key = key,
+            keys = KeystoreKeys(
+                handle,
+                DevicePublicJwk((jwk["x"] as JsonPrimitive).content, (jwk["y"] as JsonPrimitive).content),
+            ),
+            iv = Bytes.fromBase64(s("iv") ?: return null),
+            ciphertext = Bytes.fromBase64(s("ciphertext") ?: return null),
+            deviceId = s("deviceId") ?: return null,
+            walletId = s("walletId") ?: return null,
+            address = s("address") ?: return null,
+            shareVersion = (o["shareVersion"] as? JsonPrimitive)?.intOrNull ?: return null,
+            createdAt = (o["createdAt"] as? JsonPrimitive)?.longOrNull ?: 0L,
+        )
+    }
+
+    override suspend fun put(record: DeviceRecord) = withContext(Dispatchers.IO) {
+        val previous = runCatching { read(record.key) }.getOrNull()
+        val bytes = buildJsonObject {
+            put("v", 1)
+            put("key", record.key)
+            put("handle", record.keys.handle)
+            put("publicJwk", record.keys.publicJwk.toJson())
+            put("iv", Bytes.toBase64(record.iv))
+            put("ciphertext", Bytes.toBase64(record.ciphertext))
+            put("deviceId", record.deviceId)
+            put("walletId", record.walletId)
+            put("address", record.address)
+            put("shareVersion", record.shareVersion)
+            put("createdAt", record.createdAt)
+        }.toString().toByteArray(Charsets.UTF_8)
+        val file = fileFor(record.key)
+        try {
+            if (!dir.exists() && !dir.mkdirs()) throw IOException("cannot create ${dir.name}")
+            val out = file.startWrite()
+            try {
+                out.write(bytes)
+                file.finishWrite(out)
+            } catch (e: IOException) {
+                file.failWrite(out)
+                throw e
+            }
+            if (!file.readFully().contentEquals(bytes)) throw IOException("read-back differs")
+        } catch (e: IOException) {
+            throw WalletException(WalletErrorCode.STORAGE_UNAVAILABLE, "device share could not be stored", e)
+        }
+        if (previous != null && previous.keys.handle != record.keys.handle) deleteAliases(previous.keys.handle)
+    }
+
+    override suspend fun delete(key: String) = withContext(Dispatchers.IO) {
+        val previous = runCatching { read(key) }.getOrNull()
+        fileFor(key).delete()
+        if (previous != null) deleteAliases(previous.keys.handle)
+    }
+
+    private companion object {
+        const val ANDROID_KEYSTORE = "AndroidKeyStore"
+    }
+}
+
+internal object KeystoreSecurity {
+    fun levelOf(key: Key?): KeySecurityLevel {
+        if (key == null) return KeySecurityLevel.UNKNOWN
+        val info: KeyInfo = try {
+            when (key) {
+                is PrivateKey -> KeyFactory.getInstance(key.algorithm, "AndroidKeyStore").getKeySpec(key, KeyInfo::class.java)
+                is SecretKey -> SecretKeyFactory.getInstance(key.algorithm, "AndroidKeyStore").getKeySpec(key, KeyInfo::class.java) as KeyInfo
+                else -> return KeySecurityLevel.UNKNOWN
+            }
+        } catch (_: Exception) {
+            return KeySecurityLevel.UNKNOWN
+        }
+        if (Build.VERSION.SDK_INT >= 31) {
+            return when (info.securityLevel) {
+                KeyProperties.SECURITY_LEVEL_STRONGBOX -> KeySecurityLevel.STRONGBOX
+                KeyProperties.SECURITY_LEVEL_TRUSTED_ENVIRONMENT -> KeySecurityLevel.TRUSTED_ENVIRONMENT
+                KeyProperties.SECURITY_LEVEL_UNKNOWN_SECURE -> KeySecurityLevel.UNKNOWN_SECURE
+                KeyProperties.SECURITY_LEVEL_SOFTWARE -> KeySecurityLevel.SOFTWARE
+                else -> KeySecurityLevel.UNKNOWN
+            }
+        }
+        @Suppress("DEPRECATION")
+        return if (info.isInsideSecureHardware) KeySecurityLevel.UNKNOWN_SECURE else KeySecurityLevel.SOFTWARE
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/Prf.kt

@@ -0,0 +1,111 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/Prf.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import javax.crypto.Cipher
+import javax.crypto.Mac
+import javax.crypto.spec.GCMParameterSpec
+import javax.crypto.spec.SecretKeySpec
+
+/** A WebAuthn assertion, base64url fields, as the API verifies it. */
+data class PasskeyAssertion(
+    val credentialId: String,
+    val clientDataJSON: String,
+    val authenticatorData: String,
+    val signature: String,
+)
+
+class PasskeyCreateResult(
+    val credentialId: String,
+    /** 32-byte PRF output. The SDK wipes it after use. */
+    val prfOutput: ByteArray,
+    /** SPKI public key (base64url) when the provider reports it. */
+    val publicKey: String?,
+    /** COSE algorithm of [publicKey] (-7 ES256, -257 RS256, -8 EdDSA). */
+    val publicKeyAlg: Int?,
+    /** The raw attestationObject (base64url); the API reads the COSE key from it when [publicKey] is null. */
+    val attestationObject: String?,
+)
+
+class PasskeyGetResult(val prfOutput: ByteArray, val assertion: PasskeyAssertion)
+
+/** Passkey operations with the PRF extension for RP `wallet.authon.dev`. */
+interface PasskeyProvider {
+    suspend fun create(userId: ByteArray, userName: String, salt: ByteArray): PasskeyCreateResult
+
+    /** [challenge] is the server's restore challenge when the API verifies the assertion. */
+    suspend fun get(credentialId: String, salt: ByteArray, challenge: ByteArray?): PasskeyGetResult
+}
+
+/** Backup encryption of `apps/wallet/src/prf.ts`: PRF salt v1/v2, HKDF-SHA256, AES-256-GCM, AAD, `v2.` prefix. */
+internal object Prf {
+    const val PRF_SALT_LABEL = "authon-wallet-backup-v1"
+    const val PRF_SALT_LABEL_V2 = "authon-wallet-backup-v2"
+    const val DEFAULT_WRITE_BACKUP_VERSION = 1
+    private const val HKDF_INFO = "authon-wallet-backup-v1/aes-gcm-256"
+    private const val V2_PREFIX = "v2."
+
+    fun passkeyUserId(userHandle: String): ByteArray = Bytes.sha256(Bytes.utf8(userHandle))
+
+    fun salt(version: Int, projectId: String?, walletId: String?): ByteArray =
+        if (version == 1) {
+            Bytes.sha256(Bytes.utf8(PRF_SALT_LABEL))
+        } else {
+            if (projectId == null || walletId == null) throw walletError(WalletErrorCode.INTERNAL, "backup context required")
+            Bytes.sha256(Bytes.utf8("$PRF_SALT_LABEL_V2\u0000$projectId\u0000$walletId"))
+        }
+
+    fun backupVersionOf(payload: String): Int = if (payload.startsWith(V2_PREFIX)) 2 else 1
+
+    /** RFC 5869 HKDF-SHA256 with an empty salt, one output block (the AES-256 key). */
+    fun deriveBackupKey(prfOutput: ByteArray): ByteArray = hkdfSha256(prfOutput, ByteArray(0), Bytes.utf8(HKDF_INFO), 32)
+
+    fun hkdfSha256(ikm: ByteArray, salt: ByteArray, info: ByteArray, length: Int): ByteArray {
+        require(length in 1..255 * 32)
+        val extract = Mac.getInstance("HmacSHA256")
+        // An empty salt means HashLen zero bytes (RFC 5869 2.2); JCA rejects empty HMAC keys.
+        extract.init(SecretKeySpec(if (salt.isEmpty()) ByteArray(32) else salt, "HmacSHA256"))
+        val prk = extract.doFinal(ikm)
+        val expand = Mac.getInstance("HmacSHA256")
+        expand.init(SecretKeySpec(prk, "HmacSHA256"))
+        val out = ByteArray(length)
+        var t = ByteArray(0)
+        var offset = 0
+        var counter = 1
+        while (offset < length) {
+            expand.update(t)
+            expand.update(info)
+            expand.update(counter.toByte())
+            t = expand.doFinal()
+            val n = minOf(t.size, length - offset)
+            t.copyInto(out, offset, 0, n)
+            offset += n
+            counter++
+        }
+        Bytes.wipe(prk, t)
+        return out
+    }
+
+    private fun aad(walletId: String, version: Int) = Bytes.utf8(if (version == 1) "backup:$walletId" else "backup:v2:$walletId")
+
+    fun encryptBackup(key: ByteArray, share: ByteArray, walletId: String, version: Int, iv: ByteArray = Bytes.randomBytes(12)): String {
+        val cipher = Cipher.getInstance("AES/GCM/NoPadding")
+        cipher.init(Cipher.ENCRYPT_MODE, SecretKeySpec(key, "AES"), GCMParameterSpec(128, iv))
+        cipher.updateAAD(aad(walletId, version))
+        val body = Bytes.toBase64(Bytes.concat(iv, cipher.doFinal(share)))
+        return if (version == 1) body else V2_PREFIX + body
+    }
+
+    fun decryptBackup(key: ByteArray, payload: String, walletId: String): ByteArray {
+        val version = backupVersionOf(payload)
+        val raw = Bytes.fromBase64(if (version == 1) payload else payload.substring(V2_PREFIX.length))
+        if (raw.size < 12 + 16) throw walletError(WalletErrorCode.INVALID_REQUEST, "backup ciphertext malformed")
+        return try {
+            val cipher = Cipher.getInstance("AES/GCM/NoPadding")
+            cipher.init(Cipher.DECRYPT_MODE, SecretKeySpec(key, "AES"), GCMParameterSpec(128, raw, 0, 12))
+            cipher.updateAAD(aad(walletId, version))
+            cipher.doFinal(raw, 12, raw.size - 12)
+        } catch (e: Exception) {
+            throw WalletException(WalletErrorCode.INVALID_REQUEST, "backup cannot be decrypted with this passkey", e)
+        }
+    }
+}