@authon/react-native-wallet 0.1.0 → 0.4.0

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/KeystoreDeviceStore.kt

@@ -125,29 +125,7 @@ class KeystoreDeviceStore @JvmOverloads constructor(
         return block(false)
     }
 
-    private fun securityLevel(key: Key?): KeySecurityLevel {
-        if (key == null) return KeySecurityLevel.UNKNOWN
-        val info: KeyInfo = try {
-            when (key) {
-                is PrivateKey -> KeyFactory.getInstance(key.algorithm, ANDROID_KEYSTORE).getKeySpec(key, KeyInfo::class.java)
-                is SecretKey -> SecretKeyFactory.getInstance(key.algorithm, ANDROID_KEYSTORE).getKeySpec(key, KeyInfo::class.java) as KeyInfo
-                else -> return KeySecurityLevel.UNKNOWN
-            }
-        } catch (_: Exception) {
-            return KeySecurityLevel.UNKNOWN
-        }
-        if (Build.VERSION.SDK_INT >= 31) {
-            return when (info.securityLevel) {
-                KeyProperties.SECURITY_LEVEL_STRONGBOX -> KeySecurityLevel.STRONGBOX
-                KeyProperties.SECURITY_LEVEL_TRUSTED_ENVIRONMENT -> KeySecurityLevel.TRUSTED_ENVIRONMENT
-                KeyProperties.SECURITY_LEVEL_UNKNOWN_SECURE -> KeySecurityLevel.UNKNOWN_SECURE
-                KeyProperties.SECURITY_LEVEL_SOFTWARE -> KeySecurityLevel.SOFTWARE
-                else -> KeySecurityLevel.UNKNOWN
-            }
-        }
-        @Suppress("DEPRECATION")
-        return if (info.isInsideSecureHardware) KeySecurityLevel.UNKNOWN_SECURE else KeySecurityLevel.SOFTWARE
-    }
+    private fun securityLevel(key: Key?): KeySecurityLevel = KeystoreSecurity.levelOf(key)
 
     private fun deleteAliases(handle: String) {
         for (alias in listOf("$handle.sign", "$handle.share")) runCatching { keyStore.deleteEntry(alias) }
@@ -230,3 +208,29 @@ class KeystoreDeviceStore @JvmOverloads constructor(
         const val ANDROID_KEYSTORE = "AndroidKeyStore"
     }
 }
+
+internal object KeystoreSecurity {
+    fun levelOf(key: Key?): KeySecurityLevel {
+        if (key == null) return KeySecurityLevel.UNKNOWN
+        val info: KeyInfo = try {
+            when (key) {
+                is PrivateKey -> KeyFactory.getInstance(key.algorithm, "AndroidKeyStore").getKeySpec(key, KeyInfo::class.java)
+                is SecretKey -> SecretKeyFactory.getInstance(key.algorithm, "AndroidKeyStore").getKeySpec(key, KeyInfo::class.java) as KeyInfo
+                else -> return KeySecurityLevel.UNKNOWN
+            }
+        } catch (_: Exception) {
+            return KeySecurityLevel.UNKNOWN
+        }
+        if (Build.VERSION.SDK_INT >= 31) {
+            return when (info.securityLevel) {
+                KeyProperties.SECURITY_LEVEL_STRONGBOX -> KeySecurityLevel.STRONGBOX
+                KeyProperties.SECURITY_LEVEL_TRUSTED_ENVIRONMENT -> KeySecurityLevel.TRUSTED_ENVIRONMENT
+                KeyProperties.SECURITY_LEVEL_UNKNOWN_SECURE -> KeySecurityLevel.UNKNOWN_SECURE
+                KeyProperties.SECURITY_LEVEL_SOFTWARE -> KeySecurityLevel.SOFTWARE
+                else -> KeySecurityLevel.UNKNOWN
+            }
+        }
+        @Suppress("DEPRECATION")
+        return if (info.isInsideSecureHardware) KeySecurityLevel.UNKNOWN_SECURE else KeySecurityLevel.SOFTWARE
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/Solana.kt

@@ -0,0 +1,195 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/Solana.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import org.bouncycastle.crypto.params.Ed25519PrivateKeyParameters
+import org.bouncycastle.crypto.signers.Ed25519Signer
+import java.math.BigInteger
+
+/**
+ * Solana transaction signing (NATIVE.md section 12, `apps/wallet/src/solana.ts`). The app builds
+ * the serialized Message (legacy or v0); the SDK parses it only to describe it and signs the exact
+ * bytes with Ed25519 (Bouncy Castle, deterministic).
+ */
+internal object Solana {
+    const val MAX_MESSAGE = 1232
+    private const val SYSTEM = "11111111111111111111111111111111"
+    private const val TOKEN = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA"
+    private const val TOKEN_2022 = "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb"
+    private const val ASSOCIATED_TOKEN = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL"
+    private const val COMPUTE_BUDGET = "ComputeBudget111111111111111111111111111111"
+    private const val MEMO = "MemoSq4gqABAXKb96qnH8TyNoJ6CDrADxwaj4uuQ"
+
+    class Instruction(val programId: String, val accounts: List<String?>, val data: ByteArray)
+
+    class Message(
+        val version: Int?,
+        val numRequiredSignatures: Int,
+        val accountKeys: List<String>,
+        val recentBlockhash: String,
+        val instructions: List<Instruction>,
+        val lookupAccounts: Int,
+    )
+
+    private fun invalid(message: String = "not a valid Solana message") = walletError(WalletErrorCode.INVALID_REQUEST, message)
+
+    private class Reader(private val bytes: ByteArray) {
+        private var pos = 0
+        val done get() = pos == bytes.size
+
+        fun u8(): Int {
+            if (pos >= bytes.size) throw invalid()
+            return bytes[pos++].toInt() and 0xff
+        }
+
+        fun take(n: Int): ByteArray {
+            if (n < 0 || pos + n > bytes.size) throw invalid()
+            return bytes.copyOfRange(pos, pos + n).also { pos += n }
+        }
+
+        /** compact-u16 (shortvec). */
+        fun len(): Int {
+            var value = 0
+            for (i in 0 until 3) {
+                val b = u8()
+                value = value or ((b and 0x7f) shl (7 * i))
+                if (b and 0x80 == 0) return value
+            }
+            throw invalid()
+        }
+    }
+
+    fun parse(bytes: ByteArray): Message {
+        if (bytes.isEmpty() || bytes.size > MAX_MESSAGE) throw invalid()
+        val r = Reader(bytes)
+        var version: Int? = null
+        var first = r.u8()
+        if (first and 0x80 != 0) {
+            if (first and 0x7f != 0) throw invalid("unsupported Solana message version")
+            version = 0
+            first = r.u8()
+        }
+        val numRequired = first
+        r.u8()
+        r.u8()
+        val keyCount = r.len()
+        val keys = List(keyCount) { Base58.encode(r.take(32)) }
+        val blockhash = Base58.encode(r.take(32))
+        class Raw(val program: Int, val accounts: List<Int>, val data: ByteArray)
+        val raw = List(r.len()) {
+            val program = r.u8()
+            val accounts = List(r.len()) { r.u8() }
+            Raw(program, accounts, r.take(r.len()))
+        }
+        var lookup = 0
+        if (version == 0) {
+            repeat(r.len()) {
+                r.take(32)
+                lookup += r.take(r.len()).size
+                lookup += r.take(r.len()).size
+            }
+        }
+        if (!r.done) throw invalid()
+        if (numRequired < 1 || numRequired > keyCount) throw invalid()
+        val total = keyCount + lookup
+        fun key(i: Int): String? {
+            if (i >= total) throw invalid()
+            return if (i < keyCount) keys[i] else null
+        }
+        val instructions = raw.map { ix ->
+            val program = key(ix.program) ?: throw invalid()
+            Instruction(program, ix.accounts.map { key(it) }, ix.data)
+        }
+        return Message(version, numRequired, keys, blockhash, instructions, lookup)
+    }
+
+    private fun u64(d: ByteArray, at: Int): BigInteger {
+        if (d.size < at + 8) throw invalid()
+        var v = BigInteger.ZERO
+        for (i in 7 downTo 0) v = v.shiftLeft(8).or(BigInteger.valueOf((d[at + i].toInt() and 0xff).toLong()))
+        return v
+    }
+
+    private fun u32(d: ByteArray, at: Int): Long {
+        if (d.size < at + 4) throw invalid()
+        var v = 0L
+        for (i in 3 downTo 0) v = (v shl 8) or (d[at + i].toLong() and 0xff)
+        return v
+    }
+
+    private fun decimal(amount: BigInteger, decimals: Int): String {
+        if (decimals == 0) return amount.toString()
+        val base = BigInteger.TEN.pow(decimals)
+        val (whole, rem) = amount.divideAndRemainder(base)
+        val frac = rem.toString().padStart(decimals, '0').trimEnd('0')
+        return if (frac.isEmpty()) whole.toString() else "$whole.$frac"
+    }
+
+    private fun addr(a: String?) = a ?: "(address from a lookup table)"
+
+    /** The approval summary. The signer must be the fee payer (account 0). */
+    fun summarize(msg: Message, signer: String, network: String): SignSummary {
+        if (msg.accountKeys[0] != signer) throw walletError(WalletErrorCode.ADDRESS_MISMATCH, "the fee payer is not the signing account")
+        val rows = mutableListOf(SignRow("Network", network), SignRow("Account", signer, mono = true))
+        val warnings = mutableListOf<String>()
+        if (msg.numRequiredSignatures > 1) {
+            warnings += "This transaction needs ${msg.numRequiredSignatures} signatures; you sign as the fee payer."
+        }
+        if (msg.lookupAccounts > 0) warnings += "Some accounts come from address lookup tables and cannot be shown."
+        for (ix in msg.instructions) {
+            val d = ix.data
+            val d0 = d.getOrNull(0)?.toInt()?.and(0xff)
+            val isToken = ix.programId == TOKEN || ix.programId == TOKEN_2022
+            when {
+                ix.programId == SYSTEM && d.size >= 12 && u32(d, 0) == 2L -> {
+                    rows += SignRow("Send", decimal(u64(d, 4), 9) + " SOL")
+                    rows += SignRow("To", addr(ix.accounts.getOrNull(1)), mono = true)
+                    if (ix.accounts.getOrNull(0) != signer) warnings += "SOL is sent from an account other than yours."
+                }
+                isToken && d0 == 12 && d.size >= 10 -> {
+                    rows += SignRow("Send token", decimal(u64(d, 1), d[9].toInt() and 0xff))
+                    rows += SignRow("Token", addr(ix.accounts.getOrNull(1)), mono = true)
+                    rows += SignRow("To token account", addr(ix.accounts.getOrNull(2)), mono = true)
+                }
+                isToken && d0 == 3 && d.size >= 9 -> {
+                    rows += SignRow("Send token (raw units)", u64(d, 1).toString())
+                    rows += SignRow("To token account", addr(ix.accounts.getOrNull(1)), mono = true)
+                    warnings += "Token amount is shown in raw units (no decimals in this instruction)."
+                }
+                ix.programId == ASSOCIATED_TOKEN && (d.isEmpty() || d0 == 0 || d0 == 1) ->
+                    rows += SignRow("Create token account", addr(ix.accounts.getOrNull(1)), mono = true)
+                ix.programId == COMPUTE_BUDGET && d0 == 2 && d.size >= 5 -> rows += SignRow("Compute limit", u32(d, 1).toString())
+                ix.programId == COMPUTE_BUDGET && d0 == 3 && d.size >= 9 ->
+                    rows += SignRow("Priority fee", "${u64(d, 1)} micro-lamports per unit")
+                ix.programId == MEMO -> rows += SignRow("Memo", String(d, Charsets.UTF_8))
+                else -> {
+                    rows += SignRow("Program call", ix.programId, mono = true)
+                    warnings += "Calls a program this wallet cannot describe (${ix.programId}). Approve only if you trust the app."
+                }
+            }
+        }
+        rows += SignRow("Recent blockhash", msg.recentBlockhash, mono = true)
+        return SignSummary(SignSummary.Kind.TRANSACTION, "Solana transaction", rows, null, warnings, SignRisk.HIGH)
+    }
+
+    /** SLIP-0010 key of account [index]. Callers wipe it. */
+    fun privateKey(secret: ByteArray, index: Long): ByteArray {
+        if (!HdWallet.isAccountIndex(index)) throw walletError(WalletErrorCode.INVALID_REQUEST, "invalid account index")
+        if (!HdWallet.isHdSecret(secret)) throw walletError(WalletErrorCode.ACCOUNT_UNAVAILABLE, "this wallet has only EVM account 0")
+        val seed = HdWallet.seedOf(secret)
+        try {
+            return Chains.ed25519Key(seed, intArrayOf(44, 501, index.toInt(), 0))
+        } finally {
+            Bytes.wipe(seed)
+        }
+    }
+
+    fun addressOf(privateKey: ByteArray): String = Base58.encode(Ed25519PrivateKeyParameters(privateKey, 0).generatePublicKey().encoded)
+
+    /** Ed25519 over the exact message bytes, base58. */
+    fun sign(message: ByteArray, privateKey: ByteArray): String {
+        val signer = Ed25519Signer()
+        signer.init(true, Ed25519PrivateKeyParameters(privateKey, 0))
+        signer.update(message, 0, message.size)
+        return Base58.encode(signer.generateSignature())
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/Tron.kt

@@ -0,0 +1,184 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/Tron.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+import org.web3j.crypto.ECKeyPair
+import org.web3j.crypto.Sign
+import java.math.BigInteger
+import java.time.Instant
+import java.time.ZoneOffset
+import java.time.format.DateTimeFormatter
+
+/**
+ * TRON transaction signing (NATIVE.md section 12, `apps/wallet/src/tron.ts`). The app builds
+ * raw_data; the SDK decodes it only to describe it and signs SHA-256(raw_data) like TronWeb
+ * (RFC 6979 via web3j, r || s || recovery + 27).
+ */
+internal object Tron {
+    const val MAX_RAW_DATA = 4096
+
+    class Contract(
+        val type: Long,
+        var owner: String? = null,
+        var to: String? = null,
+        var amount: BigInteger? = null,
+        var contractAddress: String? = null,
+        var callValue: BigInteger? = null,
+        var data: ByteArray? = null,
+    )
+
+    class RawData(
+        val expiration: BigInteger?,
+        val timestamp: BigInteger?,
+        val feeLimit: BigInteger?,
+        val memo: ByteArray?,
+        val contracts: List<Contract>,
+    )
+
+    private fun invalid() = walletError(WalletErrorCode.INVALID_REQUEST, "not a valid TRON raw_data")
+
+    private class Field(val no: Int, val wire: Int, val varint: BigInteger? = null, val bytes: ByteArray? = null)
+
+    /** Minimal protobuf reader: varint (0), 64-bit (1), length-delimited (2), 32-bit (5). */
+    private fun fields(buf: ByteArray): List<Field> {
+        val out = ArrayList<Field>()
+        var pos = 0
+        fun varint(): BigInteger {
+            var v = BigInteger.ZERO
+            var shift = 0
+            while (shift < 70) {
+                if (pos >= buf.size) throw invalid()
+                val b = buf[pos++].toInt() and 0xff
+                v = v.or(BigInteger.valueOf((b and 0x7f).toLong()).shiftLeft(shift))
+                if (b and 0x80 == 0) return v
+                shift += 7
+            }
+            throw invalid()
+        }
+        while (pos < buf.size) {
+            val key = varint()
+            val no = key.shiftRight(3)
+            val wire = key.and(BigInteger.valueOf(7)).toInt()
+            if (no.signum() == 0 || no.bitLength() > 31) throw invalid()
+            when (wire) {
+                0 -> out += Field(no.toInt(), wire, varint = varint())
+                2 -> {
+                    val len = varint()
+                    if (len.bitLength() > 31 || pos + len.toInt() > buf.size) throw invalid()
+                    out += Field(no.toInt(), wire, bytes = buf.copyOfRange(pos, pos + len.toInt()))
+                    pos += len.toInt()
+                }
+                1, 5 -> {
+                    val len = if (wire == 1) 8 else 4
+                    if (pos + len > buf.size) throw invalid()
+                    pos += len
+                    out += Field(no.toInt(), wire)
+                }
+                else -> throw invalid()
+            }
+        }
+        return out
+    }
+
+    fun address(raw: ByteArray): String {
+        if (raw.size != 21 || raw[0] != 0x41.toByte()) throw invalid()
+        return Base58.encodeCheck(raw)
+    }
+
+    private fun List<Field>.one(no: Int) = firstOrNull { it.no == no }
+
+    fun parse(raw: ByteArray): RawData {
+        if (raw.isEmpty() || raw.size > MAX_RAW_DATA) throw invalid()
+        val top = fields(raw)
+        val contracts = top.filter { it.no == 11 && it.bytes != null }.map { f ->
+            val c = fields(f.bytes!!)
+            val type = c.one(1)?.varint?.toLong() ?: 0L
+            val any = c.one(2)?.bytes
+            val value = any?.let { fields(it).one(2)?.bytes }
+            val contract = Contract(type)
+            if (value != null && (type == 1L || type == 31L)) {
+                val v = fields(value)
+                fun addr(no: Int) = v.one(no)?.bytes?.let { address(it) }
+                contract.owner = addr(1)
+                if (type == 1L) {
+                    contract.to = addr(2)
+                    contract.amount = v.one(3)?.varint ?: BigInteger.ZERO
+                } else {
+                    contract.contractAddress = addr(2)
+                    contract.callValue = v.one(3)?.varint ?: BigInteger.ZERO
+                    contract.data = v.one(4)?.bytes ?: ByteArray(0)
+                }
+            }
+            contract
+        }
+        if (contracts.isEmpty()) throw invalid()
+        return RawData(top.one(8)?.varint, top.one(14)?.varint, top.one(18)?.varint, top.one(10)?.bytes, contracts)
+    }
+
+    private val MILLION = BigInteger.valueOf(1_000_000)
+    private val MAX_UINT256: BigInteger = BigInteger.ONE.shiftLeft(256).subtract(BigInteger.ONE)
+    private val ISO = DateTimeFormatter.ofPattern("uuuu-MM-dd'T'HH:mm:ss.SSS'Z'").withZone(ZoneOffset.UTC)
+
+    private fun trx(sun: BigInteger): String {
+        val (whole, rem) = sun.divideAndRemainder(MILLION)
+        val frac = rem.toString().padStart(6, '0').trimEnd('0')
+        return "$whole${if (frac.isEmpty()) "" else ".$frac"} TRX"
+    }
+
+    private fun word(data: ByteArray, i: Int) = data.copyOfRange(4 + 32 * i, 4 + 32 * (i + 1))
+
+    private fun wordAddress(data: ByteArray, i: Int) = address(byteArrayOf(0x41) + word(data, i).copyOfRange(12, 32))
+
+    fun summarize(tx: RawData, signer: String): SignSummary {
+        val rows = mutableListOf(SignRow("Network", "TRON"), SignRow("Account", signer, mono = true))
+        val warnings = mutableListOf<String>()
+        if (tx.contracts.size != 1) warnings += "This transaction has ${tx.contracts.size} contracts."
+        for (c in tx.contracts) {
+            if (c.owner != null && c.owner != signer) {
+                throw walletError(WalletErrorCode.ADDRESS_MISMATCH, "the transaction owner is not the signing account")
+            }
+            val data = c.data
+            if (c.type == 1L && !c.to.isNullOrEmpty()) {
+                rows += SignRow("Send", trx(c.amount ?: BigInteger.ZERO))
+                rows += SignRow("To", c.to!!, mono = true)
+            } else if (c.type == 31L && data != null) {
+                val selector = Bytes.toHex(data.copyOf(minOf(4, data.size)))
+                rows += SignRow("Contract", c.contractAddress ?: "?", mono = true)
+                val callValue = c.callValue
+                if (callValue != null && callValue.signum() > 0) rows += SignRow("Send", trx(callValue))
+                if (selector == "a9059cbb" && data.size == 68) {
+                    rows += SignRow("Token transfer to", wordAddress(data, 0), mono = true)
+                    rows += SignRow("Token amount (raw units)", BigInteger(1, word(data, 1)).toString())
+                } else if (selector == "095ea7b3" && data.size == 68) {
+                    val amount = BigInteger(1, word(data, 1))
+                    rows += SignRow("Allow spender", wordAddress(data, 0), mono = true)
+                    rows += SignRow("Allowance (raw units)", if (amount == MAX_UINT256) "Unlimited" else amount.toString())
+                    warnings += "This lets another address spend your tokens."
+                } else {
+                    rows += SignRow("Call data", "0x" + Bytes.toHex(data), mono = true)
+                    warnings += "Calls a contract function this wallet cannot describe. Approve only if you trust the app."
+                }
+            } else {
+                rows += SignRow("Contract type", c.type.toString())
+                warnings += "TRON contract type ${c.type} cannot be described. Approve only if you trust the app."
+            }
+        }
+        tx.feeLimit?.let { rows += SignRow("Fee limit", trx(it)) }
+        tx.memo?.takeIf { it.isNotEmpty() }?.let { rows += SignRow("Memo", String(it, Charsets.UTF_8)) }
+        tx.expiration?.let {
+            val text = try {
+                ISO.format(Instant.ofEpochMilli(it.longValueExact()))
+            } catch (_: Exception) {
+                throw walletError(WalletErrorCode.INVALID_REQUEST, "invalid expiration")
+            }
+            rows += SignRow("Expires", text)
+        }
+        return SignSummary(SignSummary.Kind.TRANSACTION, "TRON transaction", rows, null, warnings, SignRisk.HIGH)
+    }
+
+    /** txID = SHA-256(raw_data); signature r || s || (recovery + 27), lowercase hex like TronWeb. */
+    fun sign(raw: ByteArray, privateKey: ByteArray): Map<String, String> {
+        val txId = Bytes.sha256(raw)
+        val sig = Sign.signMessage(txId, ECKeyPair.create(privateKey), false)
+        return mapOf("txID" to Bytes.toHex(txId), "signature" to Bytes.toHex(sig.r + sig.s + sig.v))
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/WalletApi.kt

@@ -50,6 +50,10 @@ data class WalletAppConfig(
     val prfSaltVersion: Int,
     val rpId: String,
     val minFrameProtocol: Int?,
+    /** Android: whether the running app's signing certificate is registered; null when not asked or not registered. */
+    val signatureMatches: Boolean? = null,
+    /** `X-Request-Id` of the app-config response. */
+    val diagnosticId: String? = null,
 )
 
 internal data class DeviceProof(val deviceId: String, val challenge: String, val signature: String) {
@@ -89,23 +93,25 @@ internal class WalletApi(
         headers["user-agent"] = Http.userAgent()
         return try {
             Http.execute(client, Http.request("$base/v1/wallet$path", method, headers, body))
-        } catch (_: IOException) {
-            throw walletError(WalletErrorCode.API_ERROR, "network error")
+        } catch (e: IOException) {
+            throw WalletException(WalletErrorCode.API_ERROR, "network error", e)
         }
     }
 
     private fun ensureOk(res: HttpResult): JsonObject {
         if (res.ok) return res.json
         val serverCode = res.json.str("code")
-        if (serverCode != null && serverCode in RESTORE_CODES) throw walletError(WalletErrorCode.NEEDS_RESTORE)
-        if (serverCode != null && serverCode in KNOWN_CODES) throw walletError(WalletErrorCode.valueOf(serverCode))
-        throw walletError(STATUS_CODES[res.status] ?: WalletErrorCode.API_ERROR)
+        val id = res.requestId
+        if (serverCode != null && serverCode in RESTORE_CODES) throw walletError(WalletErrorCode.NEEDS_RESTORE, diagnosticId = id)
+        if (serverCode != null && serverCode in KNOWN_CODES) throw walletError(WalletErrorCode.valueOf(serverCode), diagnosticId = id)
+        throw walletError(STATUS_CODES[res.status] ?: WalletErrorCode.API_ERROR, diagnosticId = id)
     }
 
-    suspend fun appConfig(packageName: String): WalletAppConfig {
-        val res = call("GET", "/app-config?platform=android&appId=${enc(packageName)}", null)
+    suspend fun appConfig(packageName: String, certSha256: String? = null): WalletAppConfig {
+        val cert = certSha256?.let { "&certSha256=${enc(it)}" } ?: ""
+        val res = call("GET", "/app-config?platform=android&appId=${enc(packageName)}$cert", null)
         if (res.status == 403 || res.status == 404) {
-            return WalletAppConfig(false, false, null, false, emptyList(), true, 1, DEFAULT_RP_ID, null)
+            return WalletAppConfig(false, false, null, false, emptyList(), true, 1, DEFAULT_RP_ID, null, null, res.requestId)
         }
         val data = ensureOk(res)
         val wc = data["walletConfig"] as? JsonObject ?: JsonObject(emptyMap())
@@ -119,6 +125,8 @@ internal class WalletApi(
             prfSaltVersion = if ((wc["prfSaltVersion"] as? JsonPrimitive)?.intOrNull == 2) 2 else 1,
             rpId = data.str("rpId") ?: DEFAULT_RP_ID,
             minFrameProtocol = (data["minFrameProtocol"] as? JsonPrimitive)?.intOrNull,
+            signatureMatches = data.bool("signatureMatches"),
+            diagnosticId = res.requestId,
         )
     }
 

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/WalletCapabilities.kt

@@ -0,0 +1,91 @@
+// GENERATED by scripts/sync-native-wallet.mjs from kotlin/authon/src/main/kotlin/dev/authon/sdk/wallet/WalletCapabilities.kt. Do not edit: change the source and run the script.
+package dev.authon.sdk.wallet
+
+/** NATIVE.md section 9. [wire] is the contract string. */
+enum class CapabilityStatus(val wire: String) { AVAILABLE("available"), UNAVAILABLE("unavailable"), UNKNOWN("unknown") }
+
+data class CapabilityCheck(val status: CapabilityStatus, val reason: String? = null) {
+    companion object {
+        val AVAILABLE = CapabilityCheck(CapabilityStatus.AVAILABLE)
+        fun unavailable(reason: String) = CapabilityCheck(CapabilityStatus.UNAVAILABLE, reason)
+        fun unknown(reason: String) = CapabilityCheck(CapabilityStatus.UNKNOWN, reason)
+    }
+}
+
+/**
+ * Whether this device and app can use the wallet, answered before sign-in: no session, no
+ * login or passkey UI, no wallet is created.
+ */
+data class WalletCapabilities(
+    /** Any unavailable -> unavailable; else any unknown -> unknown; else available. */
+    val ready: CapabilityStatus,
+    val app: CapabilityCheck,
+    val wallet: CapabilityCheck,
+    val secureStorage: CapabilityCheck,
+    val deviceLock: CapabilityCheck,
+    val passkeyBackup: CapabilityCheck,
+    /** `X-Request-Id` of the app-config response, when the API answered. */
+    val diagnosticId: String?,
+) {
+    companion object {
+        fun readyOf(checks: List<CapabilityCheck>): CapabilityStatus = when {
+            checks.any { it.status == CapabilityStatus.UNAVAILABLE } -> CapabilityStatus.UNAVAILABLE
+            checks.any { it.status == CapabilityStatus.UNKNOWN } -> CapabilityStatus.UNKNOWN
+            else -> CapabilityStatus.AVAILABLE
+        }
+    }
+}
+
+/** Static device checks behind capabilities(); the Android implementation is [AndroidCapabilityProbe]. */
+interface CapabilityProbe {
+    /** SHA-256 of the running app's signing certificate, uppercase hex with colons; null when unreadable. */
+    fun signingCertSha256(): String?
+    suspend fun secureStorage(): CapabilityCheck
+    fun deviceLock(): CapabilityCheck
+    fun passkeyBackup(): CapabilityCheck
+}
+
+internal object Capabilities {
+    const val APP_NOT_REGISTERED = "APP_NOT_REGISTERED"
+    const val APP_SIGNATURE_MISMATCH = "APP_SIGNATURE_MISMATCH"
+    const val APP_NOT_APPROVED = "APP_NOT_APPROVED"
+    const val WALLET_DISABLED = "WALLET_DISABLED"
+    const val NETWORK_ERROR = "NETWORK_ERROR"
+    const val API_ERROR = "API_ERROR"
+    const val HARDWARE_KEYSTORE_UNAVAILABLE = "HARDWARE_KEYSTORE_UNAVAILABLE"
+    const val SIMULATOR = "SIMULATOR"
+    const val CHECK_FAILED = "CHECK_FAILED"
+    const val DEVICE_LOCK_NOT_SET = "DEVICE_LOCK_NOT_SET"
+    const val OS_UNSUPPORTED = "OS_UNSUPPORTED"
+    const val PASSKEY_API_UNAVAILABLE = "PASSKEY_API_UNAVAILABLE"
+    const val PRF_PROVIDER_UNVERIFIED = "PRF_PROVIDER_UNVERIFIED"
+
+    fun appCheck(cfg: WalletAppConfig): CapabilityCheck = when {
+        !cfg.allowed || cfg.projectId == null -> CapabilityCheck.unavailable(APP_NOT_REGISTERED)
+        cfg.signatureMatches == false -> CapabilityCheck.unavailable(APP_SIGNATURE_MISMATCH)
+        !cfg.approved -> CapabilityCheck.unknown(APP_NOT_APPROVED)
+        else -> CapabilityCheck.AVAILABLE
+    }
+
+    fun walletCheck(cfg: WalletAppConfig): CapabilityCheck =
+        if (cfg.enabled) CapabilityCheck.AVAILABLE else CapabilityCheck.unavailable(WALLET_DISABLED)
+
+    suspend fun evaluate(api: WalletApi, appId: String, probe: CapabilityProbe): Pair<WalletCapabilities, WalletAppConfig?> {
+        val cert = runCatching { probe.signingCertSha256() }.getOrNull()
+        var config: WalletAppConfig? = null
+        val (app, wallet, diagnosticId) = try {
+            val cfg = api.appConfig(appId, cert)
+            config = cfg
+            Triple(appCheck(cfg), walletCheck(cfg), cfg.diagnosticId)
+        } catch (e: WalletException) {
+            // No response at all (WalletApi wraps the IOException) vs. an API error.
+            val reason = if (e.cause is java.io.IOException) NETWORK_ERROR else API_ERROR
+            Triple(CapabilityCheck.unknown(reason), CapabilityCheck.unknown(reason), e.diagnosticId)
+        }
+        val secure = runCatching { probe.secureStorage() }.getOrElse { CapabilityCheck.unknown(CHECK_FAILED) }
+        val lock = runCatching { probe.deviceLock() }.getOrElse { CapabilityCheck.unknown(CHECK_FAILED) }
+        val passkey = runCatching { probe.passkeyBackup() }.getOrElse { CapabilityCheck.unknown(PASSKEY_API_UNAVAILABLE) }
+        val checks = listOf(app, wallet, secure, lock, passkey)
+        return WalletCapabilities(WalletCapabilities.readyOf(checks), app, wallet, secure, lock, passkey, diagnosticId) to config
+    }
+}

package/android/src/vendor/kotlin/dev/authon/sdk/wallet/WalletError.kt

@@ -46,13 +46,29 @@ enum class WalletErrorCode {
     ACCOUNT_UNAVAILABLE,
 }
 
+/**
+ * A wallet error with the fields of NATIVE.md section 10. [diagnosticId] is the server's request id
+ * when the API answered (log only this id, never tokens or key material).
+ */
 class WalletException(
     val code: WalletErrorCode,
     message: String? = null,
     cause: Throwable? = null,
-) : Exception(message ?: code.name, cause)
+    val diagnosticId: String? = null,
+    val retryable: Boolean = code in RETRYABLE,
+) : Exception(message ?: code.name, cause) {
+    companion object {
+        /** Codes worth retrying unchanged (later); everything else needs a different action. */
+        val RETRYABLE: Set<WalletErrorCode> = setOf(
+            WalletErrorCode.API_ERROR,
+            WalletErrorCode.RATE_LIMITED,
+            WalletErrorCode.WALLET_PENDING,
+        )
+    }
+}
 
-internal fun walletError(code: WalletErrorCode, message: String? = null): WalletException = WalletException(code, message)
+internal fun walletError(code: WalletErrorCode, message: String? = null, diagnosticId: String? = null): WalletException =
+    WalletException(code, message, diagnosticId = diagnosticId)
 
 internal fun Throwable.toWalletException(): WalletException =
     this as? WalletException ?: WalletException(WalletErrorCode.INTERNAL, "unexpected error", this)