@authon/react-native-wallet 0.1.0 → 0.4.0

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/Bitcoin.kt

@@ -0,0 +1,296 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/Bitcoin.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import org.web3j.crypto.ECKeyPair
+import org.web3j.crypto.Sign
+import java.io.ByteArrayOutputStream
+import java.math.BigInteger
+
+/**
+ * Bitcoin PSBT signing (NATIVE.md section 12, `apps/wallet/src/bitcoin.ts`). Inputs whose
+ * witness_utxo is the account's P2WPKH script are signed (BIP143, SIGHASH_ALL, RFC 6979 low-S
+ * DER + 0x01); other inputs are left alone. The returned PSBT is the input PSBT with every
+ * key-value kept and our partial signatures added (key 0x02 || compressed public key).
+ */
+internal object Bitcoin {
+    const val MAX_PSBT_BYTES = 100_000
+    private val MAGIC = byteArrayOf(0x70, 0x73, 0x62, 0x74, 0xff.toByte())
+
+    private fun invalid(why: String = "not a valid PSBT") = walletError(WalletErrorCode.INVALID_REQUEST, why)
+
+    class Input(val txid: ByteArray, val vout: ByteArray, val sequence: ByteArray)
+    class Output(val amount: Long, val script: ByteArray)
+    class KeyValue(val key: ByteArray, val value: ByteArray)
+
+    class Psbt(
+        val version: ByteArray,
+        val inputs: List<Input>,
+        val outputs: List<Output>,
+        val locktime: ByteArray,
+        val global: List<KeyValue>,
+        val inputMaps: List<MutableList<KeyValue>>,
+        val outputMaps: List<List<KeyValue>>,
+    ) {
+        fun witnessUtxo(i: Int): Output? = inputMaps[i].firstOrNull { it.key.size == 1 && it.key[0] == 0x01.toByte() }?.let {
+            val r = Reader(it.value)
+            val amount = r.u64()
+            val script = r.take(r.varint())
+            if (!r.done) throw invalid()
+            Output(amount, script)
+        }
+
+        fun sighashType(i: Int): Long? = inputMaps[i].firstOrNull { it.key.size == 1 && it.key[0] == 0x03.toByte() }?.let {
+            if (it.value.size != 4) throw invalid()
+            Reader(it.value).u32()
+        }
+    }
+
+    class Reader(private val b: ByteArray) {
+        var pos = 0
+        val done get() = pos == b.size
+
+        fun take(n: Long): ByteArray {
+            if (n < 0 || pos + n > b.size) throw invalid()
+            return b.copyOfRange(pos, pos + n.toInt()).also { pos += n.toInt() }
+        }
+
+        fun u8(): Int = take(1)[0].toInt() and 0xff
+
+        fun le(n: Int): Long {
+            val x = take(n.toLong())
+            var v = 0L
+            for (i in n - 1 downTo 0) v = (v shl 8) or (x[i].toLong() and 0xff)
+            return v
+        }
+
+        fun u32() = le(4)
+        fun u64() = le(8).also { if (it < 0) throw invalid() }
+
+        fun varint(): Long = when (val f = u8()) {
+            0xfd -> le(2)
+            0xfe -> le(4)
+            0xff -> le(8).also { if (it < 0) throw invalid() }
+            else -> f.toLong()
+        }
+    }
+
+    private fun ByteArrayOutputStream.varint(n: Long) {
+        when {
+            n < 0xfd -> write(n.toInt())
+            n <= 0xffff -> { write(0xfd); le(n, 2) }
+            n <= 0xffffffffL -> { write(0xfe); le(n, 4) }
+            else -> { write(0xff); le(n, 8) }
+        }
+    }
+
+    private fun ByteArrayOutputStream.le(v: Long, n: Int) {
+        for (i in 0 until n) write(((v ushr (8 * i)) and 0xff).toInt())
+    }
+
+    private fun ByteArrayOutputStream.varBytes(b: ByteArray) {
+        varint(b.size.toLong())
+        write(b)
+    }
+
+    private fun readMap(r: Reader): MutableList<KeyValue> {
+        val out = ArrayList<KeyValue>()
+        while (true) {
+            val keyLen = r.varint()
+            if (keyLen == 0L) return out
+            val key = r.take(keyLen)
+            val value = r.take(r.varint())
+            if (out.any { it.key.contentEquals(key) }) throw invalid("duplicate PSBT key")
+            out += KeyValue(key, value)
+        }
+    }
+
+    fun parse(bytes: ByteArray): Psbt {
+        if (bytes.isEmpty() || bytes.size > MAX_PSBT_BYTES) throw invalid()
+        if (!bytes.copyOf(5).contentEquals(MAGIC)) throw invalid()
+        val r = Reader(bytes.copyOfRange(5, bytes.size))
+        val global = readMap(r)
+        val txField = global.filter { it.key.size == 1 && it.key[0] == 0x00.toByte() }
+        if (txField.size != 1) throw invalid("PSBT has no unsigned transaction")
+        val t = Reader(txField[0].value)
+        val version = t.take(4)
+        val inputs = List(t.varint().toInt().also { if (it < 1 || it > 10_000) throw invalid() }) {
+            val txid = t.take(32)
+            val vout = t.take(4)
+            if (t.varint() != 0L) throw invalid("unsigned transaction has a scriptSig")
+            Input(txid, vout, t.take(4))
+        }
+        val outputs = List(t.varint().toInt().also { if (it < 1 || it > 10_000) throw invalid() }) {
+            val amount = t.u64()
+            Output(amount, t.take(t.varint()))
+        }
+        val locktime = t.take(4)
+        if (!t.done) throw invalid()
+        val inputMaps = List(inputs.size) { readMap(r) }
+        val outputMaps = List(outputs.size) { readMap(r) }
+        if (!r.done) throw invalid()
+        return Psbt(version, inputs, outputs, locktime, global, inputMaps, outputMaps)
+    }
+
+    fun serialize(p: Psbt): ByteArray {
+        val out = ByteArrayOutputStream()
+        out.write(MAGIC)
+        for (map in listOf(p.global) + p.inputMaps + p.outputMaps) {
+            for (kv in map) {
+                out.varBytes(kv.key)
+                out.varBytes(kv.value)
+            }
+            out.write(0)
+        }
+        return out.toByteArray()
+    }
+
+    // ── Addresses ──
+
+    private class Net(val hrp: String, val p2pkh: Int, val p2sh: Int)
+
+    private fun net(chain: WalletChain) = if (chain == WalletChain.BITCOIN) Net("bc", 0x00, 0x05) else Net("tb", 0x6f, 0xc4)
+
+    fun scriptOf(address: String, chain: WalletChain): ByteArray {
+        val n = net(chain)
+        Bech32.decodeSegwit(n.hrp, address)?.let { (v, prog) ->
+            val op = if (v == 0) 0x00 else 0x50 + v
+            return byteArrayOf(op.toByte(), prog.size.toByte()) + prog
+        }
+        val raw = runCatching { Base58.decode(address) }.getOrNull()
+        if (raw != null && raw.size == 25 && Bytes.sha256(Bytes.sha256(raw.copyOf(21))).copyOf(4).contentEquals(raw.copyOfRange(21, 25))) {
+            val h = raw.copyOfRange(1, 21)
+            when (raw[0].toInt() and 0xff) {
+                n.p2pkh -> return byteArrayOf(0x76, 0xa9.toByte(), 0x14) + h + byteArrayOf(0x88.toByte(), 0xac.toByte())
+                n.p2sh -> return byteArrayOf(0xa9.toByte(), 0x14) + h + byteArrayOf(0x87.toByte())
+            }
+        }
+        throw walletError(WalletErrorCode.INVALID_REQUEST, "address is not a Bitcoin address of this network")
+    }
+
+    /** Address of a standard output script; null for scripts without one. */
+    fun addressOf(script: ByteArray, chain: WalletChain): String? {
+        val n = net(chain)
+        val s = script
+        fun u(i: Int) = s[i].toInt() and 0xff
+        return when {
+            s.size == 25 && u(0) == 0x76 && u(1) == 0xa9 && u(2) == 0x14 && u(23) == 0x88 && u(24) == 0xac ->
+                Base58.encodeCheck(byteArrayOf(n.p2pkh.toByte()) + s.copyOfRange(3, 23))
+            s.size == 23 && u(0) == 0xa9 && u(1) == 0x14 && u(22) == 0x87 ->
+                Base58.encodeCheck(byteArrayOf(n.p2sh.toByte()) + s.copyOfRange(2, 22))
+            s.size == 22 && u(0) == 0x00 && u(1) == 0x14 -> Bech32.segwit(n.hrp, 0, s.copyOfRange(2, 22))
+            s.size == 34 && u(0) == 0x00 && u(1) == 0x20 -> Bech32.segwit(n.hrp, 0, s.copyOfRange(2, 34))
+            s.size == 34 && u(0) == 0x51 && u(1) == 0x20 -> Bech32.segwit(n.hrp, 1, s.copyOfRange(2, 34))
+            else -> null
+        }
+    }
+
+    private fun btc(sats: BigInteger): String {
+        val neg = sats.signum() < 0
+        val (whole, rem) = sats.abs().divideAndRemainder(BigInteger.valueOf(100_000_000))
+        val frac = rem.toString().padStart(8, '0').trimEnd('0')
+        return "${if (neg) "-" else ""}$whole${if (frac.isEmpty()) "" else ".$frac"} BTC"
+    }
+
+    private fun ownInputs(p: Psbt, script: ByteArray): List<Int> =
+        p.inputs.indices.filter { p.witnessUtxo(it)?.script?.contentEquals(script) == true }
+
+    fun summarize(p: Psbt, signer: String, chain: WalletChain): SignSummary {
+        val script = scriptOf(signer, chain)
+        val rows = mutableListOf(
+            SignRow("Network", if (chain == WalletChain.BITCOIN) "Bitcoin" else "Bitcoin testnet"),
+            SignRow("Account", signer, mono = true),
+        )
+        val warnings = mutableListOf<String>()
+        var inputs = BigInteger.ZERO
+        for (i in p.inputs.indices) {
+            val utxo = p.witnessUtxo(i) ?: throw invalid("every input needs witness_utxo")
+            inputs = inputs.add(BigInteger.valueOf(utxo.amount))
+        }
+        val mine = ownInputs(p, script)
+        if (mine.isEmpty()) throw walletError(WalletErrorCode.ADDRESS_MISMATCH, "no input belongs to the signing account")
+        for (i in mine) {
+            val type = p.sighashType(i)
+            if (type != null && type != 1L) throw invalid("only SIGHASH_ALL is signed")
+        }
+        if (mine.size != p.inputs.size) warnings += "${p.inputs.size - mine.size} of ${p.inputs.size} inputs are not yours and are not signed."
+        rows += SignRow("Spending", btc(inputs))
+        var outputs = BigInteger.ZERO
+        for (o in p.outputs) {
+            outputs = outputs.add(BigInteger.valueOf(o.amount))
+            val to = addressOf(o.script, chain) ?: "non-standard output".also {
+                warnings += "An output has a script this wallet cannot show as an address."
+            }
+            rows += if (o.script.contentEquals(script)) {
+                SignRow("Change back to you", btc(BigInteger.valueOf(o.amount)))
+            } else {
+                SignRow("Send ${btc(BigInteger.valueOf(o.amount))} to", to, mono = true)
+            }
+        }
+        val fee = inputs.subtract(outputs)
+        if (fee.signum() < 0) throw invalid("outputs exceed inputs")
+        rows += SignRow("Network fee", btc(fee))
+        if (fee.multiply(BigInteger.TEN) > inputs && fee > BigInteger.valueOf(100_000)) {
+            warnings += "The network fee is more than 10% of the amount spent."
+        }
+        return SignSummary(SignSummary.Kind.TRANSACTION, "Bitcoin transaction", rows, null, warnings, SignRisk.HIGH)
+    }
+
+    private fun dsha(b: ByteArray) = Bytes.sha256(Bytes.sha256(b))
+
+    private fun outputBytes(o: Output) = ByteArrayOutputStream().apply { le(o.amount, 8); varBytes(o.script) }.toByteArray()
+
+    /** BIP143 sighash of input [i] for a P2WPKH output with [pubkeyHash], SIGHASH_ALL. */
+    fun sighash(p: Psbt, i: Int, pubkeyHash: ByteArray, amount: Long): ByteArray {
+        val prevouts = ByteArrayOutputStream().apply { for (x in p.inputs) { write(x.txid); write(x.vout) } }.toByteArray()
+        val sequences = ByteArrayOutputStream().apply { for (x in p.inputs) write(x.sequence) }.toByteArray()
+        val outs = ByteArrayOutputStream().apply { for (o in p.outputs) write(outputBytes(o)) }.toByteArray()
+        val pre = ByteArrayOutputStream()
+        pre.write(p.version)
+        pre.write(dsha(prevouts))
+        pre.write(dsha(sequences))
+        pre.write(p.inputs[i].txid)
+        pre.write(p.inputs[i].vout)
+        pre.write(byteArrayOf(0x19, 0x76, 0xa9.toByte(), 0x14) + pubkeyHash + byteArrayOf(0x88.toByte(), 0xac.toByte()))
+        pre.le(amount, 8)
+        pre.write(p.inputs[i].sequence)
+        pre.write(dsha(outs))
+        pre.write(p.locktime)
+        pre.le(1, 4)
+        return dsha(pre.toByteArray())
+    }
+
+    /** Signs our inputs; `txHex` is the finalized transaction when every input is ours. */
+    fun sign(p: Psbt, privateKey: ByteArray, chain: WalletChain): Map<String, String> {
+        val pub = Chains.compressedPublicKey(privateKey)
+        val hash = Chains.hash160Of(pub)
+        val script = byteArrayOf(0x00, 0x14) + hash
+        val mine = ownInputs(p, script)
+        if (mine.isEmpty()) throw walletError(WalletErrorCode.ADDRESS_MISMATCH)
+        val keyPair = ECKeyPair.create(privateKey)
+        val sigs = HashMap<Int, ByteArray>()
+        for (i in mine) {
+            val sig = Sign.signMessage(sighash(p, i, hash, p.witnessUtxo(i)!!.amount), keyPair, false)
+            val der = Der.encode(sig.r, sig.s) + byteArrayOf(0x01)
+            sigs[i] = der
+            val key = byteArrayOf(0x02) + pub
+            p.inputMaps[i].removeAll { it.key.contentEquals(key) }
+            p.inputMaps[i] += KeyValue(key, der)
+        }
+        val psbt = Bytes.toBase64(serialize(p))
+        if (mine.size != p.inputs.size) return mapOf("psbt" to psbt)
+        val tx = ByteArrayOutputStream()
+        tx.write(p.version)
+        tx.write(byteArrayOf(0x00, 0x01))
+        tx.varint(p.inputs.size.toLong())
+        for (x in p.inputs) { tx.write(x.txid); tx.write(x.vout); tx.write(0); tx.write(x.sequence) }
+        tx.varint(p.outputs.size.toLong())
+        for (o in p.outputs) tx.write(outputBytes(o))
+        for (i in p.inputs.indices) {
+            tx.write(2)
+            tx.varBytes(sigs.getValue(i))
+            tx.varBytes(pub)
+        }
+        tx.write(p.locktime)
+        return mapOf("psbt" to psbt, "txHex" to Bytes.toHex(tx.toByteArray()))
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/Chains.kt

@@ -0,0 +1,157 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/Chains.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import org.bouncycastle.crypto.digests.RIPEMD160Digest
+import org.bouncycastle.crypto.params.Ed25519PrivateKeyParameters
+import org.web3j.crypto.Bip32ECKeyPair
+import org.web3j.crypto.Hash
+import org.web3j.crypto.Keys
+import org.web3j.crypto.Sign
+import javax.crypto.Mac
+import javax.crypto.spec.SecretKeySpec
+
+/** Chains a wallet derives addresses for (NATIVE.md section 11). [wire] is the contract string. */
+enum class WalletChain(val wire: String) {
+    EVM("evm"),
+    TRON("tron"),
+    XRP("xrp"),
+    BITCOIN("bitcoin"),
+    BITCOIN_TESTNET("bitcoin-testnet"),
+    SOLANA("solana");
+
+    companion object {
+        fun fromWire(value: String): WalletChain = entries.firstOrNull { it.wire == value }
+            ?: throw walletError(WalletErrorCode.INVALID_REQUEST, "chain must be one of ${entries.joinToString(", ") { it.wire }}")
+    }
+}
+
+/**
+ * Per-chain account addresses from the BIP39 seed, with the paths of standard wallets
+ * (`apps/wallet/src/chains.ts`). Curve math comes from web3j / Bouncy Castle; only the address
+ * encodings and SLIP-0010 chaining are assembled here. Address derivation only, no signing.
+ */
+internal object Chains {
+    private const val H = Bip32ECKeyPair.HARDENED_BIT
+
+    fun path(chain: WalletChain, index: Long): String = when (chain) {
+        WalletChain.EVM -> "m/44'/60'/0'/0/$index"
+        WalletChain.TRON -> "m/44'/195'/$index'/0/0"
+        WalletChain.XRP -> "m/44'/144'/$index'/0/0"
+        WalletChain.BITCOIN -> "m/84'/0'/$index'/0/0"
+        WalletChain.BITCOIN_TESTNET -> "m/84'/1'/$index'/0/0"
+        WalletChain.SOLANA -> "m/44'/501'/$index'/0'"
+    }
+
+    private fun secpPath(chain: WalletChain, index: Int): IntArray = when (chain) {
+        WalletChain.EVM -> intArrayOf(44 or H, 60 or H, 0 or H, 0, index)
+        WalletChain.TRON -> intArrayOf(44 or H, 195 or H, index or H, 0, 0)
+        WalletChain.XRP -> intArrayOf(44 or H, 144 or H, index or H, 0, 0)
+        WalletChain.BITCOIN -> intArrayOf(84 or H, 0 or H, index or H, 0, 0)
+        WalletChain.BITCOIN_TESTNET -> intArrayOf(84 or H, 1 or H, index or H, 0, 0)
+        WalletChain.SOLANA -> throw IllegalArgumentException("solana is not secp256k1")
+    }
+
+    private fun hash160(data: ByteArray): ByteArray {
+        val sha = Bytes.sha256(data)
+        val d = RIPEMD160Digest()
+        d.update(sha, 0, sha.size)
+        return ByteArray(20).also { d.doFinal(it, 0) }
+    }
+
+    private fun secpAddress(chain: WalletChain, master: Bip32ECKeyPair, index: Int): String =
+        addressOfPrivateKey(chain, Bip32ECKeyPair.deriveKeyPair(master, secpPath(chain, index)).privateKey)
+
+    /** The secp256k1 private key of account [index] on [chain]. Callers wipe it. */
+    fun secpPrivateKey(secret: ByteArray, chain: WalletChain, index: Long): ByteArray {
+        if (!HdWallet.isAccountIndex(index)) throw walletError(WalletErrorCode.INVALID_REQUEST, "invalid account index")
+        if (chain == WalletChain.EVM) return HdWallet.privateKey(secret, index)
+        if (!HdWallet.isHdSecret(secret)) throw walletError(WalletErrorCode.ACCOUNT_UNAVAILABLE, "this wallet has only EVM account 0")
+        val seed = HdWallet.seedOf(secret)
+        try {
+            val node = Bip32ECKeyPair.deriveKeyPair(Bip32ECKeyPair.generateKeyPair(seed), secpPath(chain, index.toInt()))
+            return org.web3j.utils.Numeric.toBytesPadded(node.privateKey, 32)
+        } finally {
+            Bytes.wipe(seed)
+        }
+    }
+
+    /** Compressed secp256k1 public key of account [index] on [chain]. */
+    fun secpPublicKey(secret: ByteArray, chain: WalletChain, index: Long): ByteArray {
+        val key = secpPrivateKey(secret, chain, index)
+        try {
+            return compressedPublicKey(key)
+        } finally {
+            Bytes.wipe(key)
+        }
+    }
+
+    fun compressedPublicKey(privateKey: ByteArray): ByteArray =
+        Sign.publicPointFromPrivate(java.math.BigInteger(1, privateKey)).getEncoded(true)
+
+    fun hash160Of(data: ByteArray): ByteArray = hash160(data)
+
+    fun addressOfKey(chain: WalletChain, privateKey: ByteArray): String =
+        addressOfPrivateKey(chain, java.math.BigInteger(1, privateKey))
+
+    private fun addressOfPrivateKey(chain: WalletChain, privateKey: java.math.BigInteger): String {
+        val point = Sign.publicPointFromPrivate(privateKey)
+        val compressed = point.getEncoded(true)
+        val uncompressed = point.getEncoded(false)
+        return when (chain) {
+            WalletChain.EVM -> Keys.toChecksumAddress(Bytes.toHex(Hash.sha3(uncompressed.copyOfRange(1, 65)).copyOfRange(12, 32)))
+            WalletChain.TRON -> Base58.encodeCheck(byteArrayOf(0x41) + Hash.sha3(uncompressed.copyOfRange(1, 65)).copyOfRange(12, 32))
+            WalletChain.XRP -> Base58.encodeCheck(byteArrayOf(0x00) + hash160(compressed), Base58.XRP)
+            WalletChain.BITCOIN -> Bech32.segwitV0("bc", hash160(compressed))
+            WalletChain.BITCOIN_TESTNET -> Bech32.segwitV0("tb", hash160(compressed))
+            WalletChain.SOLANA -> throw IllegalArgumentException("solana is not secp256k1")
+        }
+    }
+
+    private fun hmacSha512(key: ByteArray, data: ByteArray): ByteArray =
+        Mac.getInstance("HmacSHA512").run { init(SecretKeySpec(key, "HmacSHA512")); doFinal(data) }
+
+    /** SLIP-0010 ed25519 derivation; every level is hardened. Callers wipe the 32-byte key. */
+    fun ed25519Key(seed: ByteArray, indices: IntArray): ByteArray {
+        var i = hmacSha512(Bytes.utf8("ed25519 seed"), seed)
+        var key = i.copyOfRange(0, 32)
+        var code = i.copyOfRange(32, 64)
+        for (index in indices) {
+            val hardened = index or H
+            val ser = byteArrayOf((hardened ushr 24).toByte(), (hardened ushr 16).toByte(), (hardened ushr 8).toByte(), hardened.toByte())
+            val data = byteArrayOf(0) + key + ser
+            Bytes.wipe(i)
+            i = hmacSha512(code, data)
+            Bytes.wipe(data, key, code)
+            key = i.copyOfRange(0, 32)
+            code = i.copyOfRange(32, 64)
+        }
+        Bytes.wipe(i, code)
+        return key
+    }
+
+    private fun solanaAddress(seed: ByteArray, index: Int): String {
+        val key = ed25519Key(seed, intArrayOf(44, 501, index, 0))
+        try {
+            return Base58.encode(Ed25519PrivateKeyParameters(key, 0).generatePublicKey().encoded)
+        } finally {
+            Bytes.wipe(key)
+        }
+    }
+
+    /** Addresses of accounts start..start+count-1 on [chain]. Only HD wallets have chains other than EVM account 0. */
+    fun addresses(secret: ByteArray, chain: WalletChain, start: Long, count: Int): List<String> {
+        if (!HdWallet.isAccountIndex(start) || count < 1 || !HdWallet.isAccountIndex(start + count - 1)) {
+            throw walletError(WalletErrorCode.INVALID_REQUEST, "invalid account range")
+        }
+        if (chain == WalletChain.EVM) return HdWallet.addresses(secret, start, count)
+        if (!HdWallet.isHdSecret(secret)) throw walletError(WalletErrorCode.ACCOUNT_UNAVAILABLE, "this wallet has only EVM account 0")
+        val seed = HdWallet.seedOf(secret)
+        try {
+            if (chain == WalletChain.SOLANA) return (0 until count).map { solanaAddress(seed, (start + it).toInt()) }
+            val master = Bip32ECKeyPair.generateKeyPair(seed)
+            return (0 until count).map { secpAddress(chain, master, (start + it).toInt()) }
+        } finally {
+            Bytes.wipe(seed)
+        }
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/Der.kt

@@ -0,0 +1,17 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/Der.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import java.math.BigInteger
+
+/** DER encoding of an ECDSA (r, s) signature. */
+internal object Der {
+    private fun int(v: ByteArray): ByteArray {
+        val n = BigInteger(1, v).toByteArray() // minimal, with a leading 0 when the high bit is set
+        return byteArrayOf(0x02, n.size.toByte()) + n
+    }
+
+    fun encode(r: ByteArray, s: ByteArray): ByteArray {
+        val body = int(r) + int(s)
+        return byteArrayOf(0x30, body.size.toByte()) + body
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/Encodings.kt

@@ -0,0 +1,133 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/Encodings.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import java.math.BigInteger
+
+/** Base58 (Bitcoin and XRP alphabets) and Base58Check with a double-SHA-256 checksum. */
+internal object Base58 {
+    const val BITCOIN = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
+    const val XRP = "rpshnaf39wBUDNEGHJKLM4PQRST7VWXYZ2bcdeCg65jkm8oFqi1tuvAxyz"
+    private val FIFTY_EIGHT = BigInteger.valueOf(58)
+
+    fun encode(data: ByteArray, alphabet: String = BITCOIN): String {
+        var n = BigInteger(1, data)
+        val out = StringBuilder()
+        while (n.signum() > 0) {
+            val (q, r) = n.divideAndRemainder(FIFTY_EIGHT)
+            out.append(alphabet[r.toInt()])
+            n = q
+        }
+        for (b in data) {
+            if (b.toInt() != 0) break
+            out.append(alphabet[0])
+        }
+        return out.reverse().toString()
+    }
+
+    fun decode(text: String, alphabet: String = BITCOIN): ByteArray {
+        var n = BigInteger.ZERO
+        for (c in text) {
+            val digit = alphabet.indexOf(c)
+            if (digit < 0) throw walletError(WalletErrorCode.INVALID_REQUEST, "invalid base58")
+            n = n.multiply(FIFTY_EIGHT).add(BigInteger.valueOf(digit.toLong()))
+        }
+        val body = n.toByteArray().let { if (it.size > 1 && it[0].toInt() == 0) it.copyOfRange(1, it.size) else it }
+        val zeros = text.takeWhile { it == alphabet[0] }.length
+        return ByteArray(zeros) + if (n.signum() == 0) ByteArray(0) else body
+    }
+
+    fun encodeCheck(payload: ByteArray, alphabet: String = BITCOIN): String {
+        val checksum = Bytes.sha256(Bytes.sha256(payload)).copyOf(4)
+        return encode(payload + checksum, alphabet)
+    }
+}
+
+/** Bech32 (BIP173) and Bech32m (BIP350) for segwit addresses. */
+internal object Bech32 {
+    private const val BECH32M_CONST = 0x2bc830a3
+    private const val CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l"
+    private val GEN = intArrayOf(0x3b6a57b2, 0x26508e6d, 0x1ea119fa, 0x3d4233dd, 0x2a1462b3)
+
+    private fun polymod(values: IntArray): Int {
+        var chk = 1
+        for (v in values) {
+            val top = chk ushr 25
+            chk = ((chk and 0x1ffffff) shl 5) xor v
+            for (i in 0 until 5) if ((top ushr i) and 1 == 1) chk = chk xor GEN[i]
+        }
+        return chk
+    }
+
+    private fun hrpExpand(hrp: String): IntArray =
+        IntArray(hrp.length) { hrp[it].code ushr 5 } + intArrayOf(0) + IntArray(hrp.length) { hrp[it].code and 31 }
+
+    fun encode(hrp: String, data: IntArray, bech32m: Boolean = false): String {
+        val values = hrpExpand(hrp) + data + IntArray(6)
+        val mod = polymod(values) xor (if (bech32m) BECH32M_CONST else 1)
+        val checksum = IntArray(6) { (mod ushr (5 * (5 - it))) and 31 }
+        return hrp + "1" + (data + checksum).joinToString("") { CHARSET[it].toString() }
+    }
+
+    /** True when [address] is a valid Bech32 string (checksum and charset); case must not be mixed. */
+    fun verify(address: String): Boolean {
+        if (address.lowercase() != address && address.uppercase() != address) return false
+        val s = address.lowercase()
+        val pos = s.lastIndexOf('1')
+        if (pos < 1 || pos + 7 > s.length || s.length > 90) return false
+        val data = s.substring(pos + 1).map { CHARSET.indexOf(it) }.toIntArray()
+        if (data.any { it < 0 }) return false
+        return polymod(hrpExpand(s.substring(0, pos)) + data) == 1
+    }
+
+    /** 8-bit bytes to 5-bit groups with padding (BIP173 convertbits). */
+    fun toWords(bytes: ByteArray): IntArray {
+        val out = ArrayList<Int>()
+        var acc = 0
+        var bits = 0
+        for (b in bytes) {
+            acc = (acc shl 8) or (b.toInt() and 0xff)
+            bits += 8
+            while (bits >= 5) {
+                bits -= 5
+                out += (acc ushr bits) and 31
+            }
+        }
+        if (bits > 0) out += (acc shl (5 - bits)) and 31
+        return out.toIntArray()
+    }
+
+    fun segwitV0(hrp: String, program: ByteArray): String = encode(hrp, intArrayOf(0) + toWords(program))
+
+    /** Segwit address for witness [version] (v0 bech32, v1+ bech32m). */
+    fun segwit(hrp: String, version: Int, program: ByteArray): String = encode(hrp, intArrayOf(version) + toWords(program), version > 0)
+
+    /** Decodes a segwit address of [hrp] to (version, program); null when it is not one. */
+    fun decodeSegwit(hrp: String, address: String): Pair<Int, ByteArray>? {
+        if (address.lowercase() != address && address.uppercase() != address) return null
+        val s = address.lowercase()
+        val pos = s.lastIndexOf('1')
+        if (pos < 1 || pos + 7 > s.length || s.length > 90 || s.substring(0, pos) != hrp) return null
+        val data = s.substring(pos + 1).map { CHARSET.indexOf(it) }.toIntArray()
+        if (data.any { it < 0 }) return null
+        val check = polymod(hrpExpand(hrp) + data)
+        val words = data.copyOfRange(0, data.size - 6)
+        if (words.isEmpty()) return null
+        val version = words[0]
+        if (version > 16 || check != (if (version == 0) 1 else BECH32M_CONST)) return null
+        var acc = 0
+        var bits = 0
+        val out = ArrayList<Byte>()
+        for (w in words.drop(1)) {
+            acc = (acc shl 5) or w
+            bits += 5
+            if (bits >= 8) {
+                bits -= 8
+                out += ((acc ushr bits) and 0xff).toByte()
+            }
+        }
+        if (bits >= 5 || (acc and ((1 shl bits) - 1)) != 0) return null
+        val program = out.toByteArray()
+        if (program.size < 2 || program.size > 40 || (version == 0 && program.size != 20 && program.size != 32)) return null
+        return version to program
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/Http.kt

@@ -17,7 +17,7 @@ import java.util.concurrent.TimeUnit
 import kotlin.coroutines.resume
 import kotlin.coroutines.resumeWithException
 
-internal class HttpResult(val status: Int, val text: String) {
+internal class HttpResult(val status: Int, val text: String, private val requestIdHeader: String? = null) {
     val ok: Boolean get() = status in 200..299
 
     /** The body as a JSON object; `{}` when it is empty or not an object (like the frame's `asRecord`). */
@@ -28,6 +28,10 @@ internal class HttpResult(val status: Int, val text: String) {
             runCatching { Json.parseToJsonElement(text) as? JsonObject }.getOrNull() ?: JsonObject(emptyMap())
         }
     }
+
+    /** Diagnostic id: the error body's `requestId`, else the `X-Request-Id` header (NATIVE.md section 10). */
+    val requestId: String?
+        get() = (json["requestId"] as? kotlinx.serialization.json.JsonPrimitive)?.takeIf { it.isString }?.content ?: requestIdHeader
 }
 
 /** Keep in sync with `version` in authon/build.gradle.kts. */
@@ -73,7 +77,7 @@ internal object Http {
                     }
 
                     override fun onResponse(call: Call, response: Response) {
-                        val result = response.use { HttpResult(it.code, it.body?.string() ?: "") }
+                        val result = response.use { HttpResult(it.code, it.body?.string() ?: "", it.header("X-Request-Id")) }
                         if (cont.isActive) cont.resume(result)
                     }
                 },