@authon/react-native-wallet 0.1.0 → 0.5.0

package/ios/vendor/AuthonAppleSignIn/AppleSignIn.swift

@@ -0,0 +1,285 @@
+// GENERATED by scripts/sync-native-wallet.mjs from swift/Sources/AuthonAppleSignIn/AppleSignIn.swift. Do not edit: change the source and run the script.
+import AuthenticationServices
+import CryptoKit
+import Foundation
+import Security
+#if canImport(UIKit)
+import UIKit
+#elseif canImport(AppKit)
+import AppKit
+#endif
+
+/// Error of the native Apple sign-in. `code` is a sign-in code shared by every Authon SDK
+/// (docs/wallet/NATIVE.md section 10): OAUTH_CANCELLED (show nothing), OAUTH_START_FAILED,
+/// OAUTH_REDIRECT_NOT_ALLOWED (app not registered or approved), OAUTH_PROVIDER_ERROR,
+/// OAUTH_STATE_MISMATCH, OAUTH_EXCHANGE_FAILED, ACCOUNT_LINK_REQUIRED, NETWORK_ERROR,
+/// RATE_LIMITED, API_ERROR.
+public struct AppleSignInError: Error, Equatable, LocalizedError, Sendable {
+    public let code: String
+    public let message: String
+    /// The server's request ID when the error came from an API response.
+    public let diagnosticId: String?
+    /// The server's own `code`, when it sent one (e.g. APP_NOT_APPROVED).
+    public let serverCode: String?
+    public let statusCode: Int
+    /// Whether the same call can succeed again. False for Apple ID sheet failures: showing the
+    /// same sheet again does not help (e.g. no Apple account on the device).
+    public let retryable: Bool
+
+    public var errorDescription: String? { message }
+
+    init(_ code: String, _ message: String, diagnosticId: String? = nil, serverCode: String? = nil, statusCode: Int = 0, retryable: Bool? = nil) {
+        self.code = code
+        self.message = message
+        self.diagnosticId = diagnosticId
+        self.serverCode = serverCode
+        self.statusCode = statusCode
+        self.retryable = retryable ?? ["OAUTH_START_FAILED", "OAUTH_PROVIDER_ERROR", "OAUTH_STATE_MISMATCH", "OAUTH_EXCHANGE_FAILED", "NETWORK_ERROR", "RATE_LIMITED", "API_ERROR"].contains(code)
+    }
+}
+
+/// What the Apple ID sheet returned. Credentials only travel to the Authon API.
+public struct AppleIDResult: Sendable {
+    public var identityToken: Data?
+    public var authorizationCode: Data?
+    public var fullName: PersonNameComponents?
+
+    public init(identityToken: Data?, authorizationCode: Data?, fullName: PersonNameComponents?) {
+        self.identityToken = identityToken
+        self.authorizationCode = authorizationCode
+        self.fullName = fullName
+    }
+}
+
+/// Shows the Apple ID sheet for a nonce (already hashed: lowercase hex SHA-256 of the server nonce).
+public protocol AppleIDAuthorizing: Sendable {
+    func authorize(hashedNonce: String) async throws -> AppleIDResult
+}
+
+/// Native Sign in with Apple against Authon's nonce-bound flow:
+/// `POST /v1/auth/oauth/native/apple/start` → Apple ID sheet → `POST /v1/auth/oauth/native/apple/complete`.
+/// There is no browser and no web fallback. An attempt is used once: after any failure, start again.
+/// The identity token, authorization code, nonce and verifier are never logged or returned.
+public final class AuthonAppleSignIn: @unchecked Sendable {
+    private let base: String
+    private let publishableKey: String
+    private let appId: String?
+    private let authorizer: AppleIDAuthorizing
+    private let session: URLSession
+
+    /// - Parameters:
+    ///   - appId: `TEAMID.bundleId` as registered in the Authon console; detected from the default
+    ///     keychain access group when nil.
+    ///   - anchor: The window for the Apple ID sheet (the key window when nil).
+    public convenience init(publishableKey: String, apiURL: String = "https://api.authon.dev", appId: String? = nil,
+                            anchor: (@MainActor () -> ASPresentationAnchor?)? = nil) {
+        self.init(publishableKey: publishableKey, apiURL: apiURL, appId: appId, authorizer: SystemAppleIDAuthorizer(anchor: anchor), session: .shared)
+    }
+
+    public init(publishableKey: String, apiURL: String, appId: String?, authorizer: AppleIDAuthorizing, session: URLSession = .shared) {
+        var b = apiURL
+        while b.hasSuffix("/") { b.removeLast() }
+        base = b
+        self.publishableKey = publishableKey
+        self.appId = appId
+        self.authorizer = authorizer
+        self.session = session
+    }
+
+    /// Runs the sign-in and returns the API's JSON result: a session
+    /// (`accessToken`, `refreshToken`, `expiresIn`, `user`) or an MFA challenge (`mfaRequired`, `mfaToken`).
+    public func signIn() async throws -> [String: Any] {
+        guard let appId = appId ?? Self.detectAppIdentifier() else {
+            throw AppleSignInError("OAUTH_REDIRECT_NOT_ALLOWED", "appId (TEAMID.bundleId) could not be determined")
+        }
+        var verifierBytes = [UInt8](repeating: 0, count: 32)
+        guard SecRandomCopyBytes(kSecRandomDefault, verifierBytes.count, &verifierBytes) == errSecSuccess else {
+            throw AppleSignInError("OAUTH_START_FAILED", "random source unavailable")
+        }
+        let verifier = Self.base64url(Data(verifierBytes))
+        let challenge = Self.base64url(Data(SHA256.hash(data: Data(verifier.utf8))))
+
+        let start: [String: Any]
+        do {
+            start = try await post("/v1/auth/oauth/native/apple/start", ["appId": appId, "codeChallenge": challenge])
+        } catch let e as AppleSignInError where e.code == "API_ERROR" {
+            throw AppleSignInError("OAUTH_START_FAILED", e.message, diagnosticId: e.diagnosticId, serverCode: e.serverCode, statusCode: e.statusCode)
+        }
+        guard let attemptId = start["attemptId"] as? String, let nonce = start["nonce"] as? String, !nonce.isEmpty else {
+            throw AppleSignInError("OAUTH_START_FAILED", "Unexpected response from the server")
+        }
+
+        let apple = try await authorizer.authorize(hashedNonce: Self.hashNonce(nonce))
+        guard let tokenData = apple.identityToken, let identityToken = String(data: tokenData, encoding: .utf8),
+              let codeData = apple.authorizationCode, let authorizationCode = String(data: codeData, encoding: .utf8) else {
+            throw AppleSignInError("OAUTH_PROVIDER_ERROR", "Apple returned no identity token or authorization code", retryable: false)
+        }
+        var body: [String: Any] = ["attemptId": attemptId, "codeVerifier": verifier, "identityToken": identityToken, "authorizationCode": authorizationCode]
+        if let name = apple.fullName.map({ PersonNameComponentsFormatter.localizedString(from: $0, style: .default) })?
+            .trimmingCharacters(in: .whitespacesAndNewlines), !name.isEmpty {
+            body["displayName"] = name
+        }
+        // Single use: no retry, whatever the outcome.
+        return try await post("/v1/auth/oauth/native/apple/complete", body)
+    }
+
+    /// Lowercase hex SHA-256 of the server nonce (what ASAuthorizationAppleIDRequest.nonce carries).
+    public static func hashNonce(_ nonce: String) -> String {
+        SHA256.hash(data: Data(nonce.utf8)).map { String(format: "%02x", $0) }.joined()
+    }
+
+    static func base64url(_ data: Data) -> String {
+        data.base64EncodedString().replacingOccurrences(of: "+", with: "-").replacingOccurrences(of: "/", with: "_").replacingOccurrences(of: "=", with: "")
+    }
+
+    // MARK: - HTTP
+
+    private func post(_ path: String, _ body: [String: Any]) async throws -> [String: Any] {
+        guard let url = URL(string: base + path) else { throw AppleSignInError("API_ERROR", "Invalid URL") }
+        var req = URLRequest(url: url)
+        req.httpMethod = "POST"
+        req.setValue("application/json", forHTTPHeaderField: "content-type")
+        req.setValue("application/json", forHTTPHeaderField: "accept")
+        req.setValue(publishableKey, forHTTPHeaderField: "x-api-key")
+        req.httpShouldHandleCookies = false
+        req.httpBody = try JSONSerialization.data(withJSONObject: body)
+        let data: Data
+        let response: URLResponse
+        do {
+            (data, response) = try await session.data(for: req)
+        } catch {
+            throw AppleSignInError("NETWORK_ERROR", "The server could not be reached")
+        }
+        let http = response as? HTTPURLResponse
+        let status = http?.statusCode ?? 0
+        let json = (try? JSONSerialization.jsonObject(with: data)) as? [String: Any]
+        guard (200..<300).contains(status) else {
+            let serverCode = json?["code"] as? String
+            let id = (json?["requestId"] as? String) ?? http?.value(forHTTPHeaderField: "X-Request-Id")
+            let message = (json?["message"] as? String) ?? HTTPURLResponse.localizedString(forStatusCode: status)
+            throw AppleSignInError(Self.code(status: status, serverCode: serverCode), message, diagnosticId: id, serverCode: serverCode, statusCode: status)
+        }
+        guard let json else { throw AppleSignInError("API_ERROR", "Unexpected response from the server", statusCode: status) }
+        return json
+    }
+
+    static func code(status: Int, serverCode: String?) -> String {
+        switch serverCode {
+        case "OAUTH_STATE_INVALID": return "OAUTH_STATE_MISMATCH"
+        case "OAUTH_EXCHANGE_FAILED": return "OAUTH_EXCHANGE_FAILED"
+        case "OAUTH_REDIRECT_NOT_ALLOWED", "APP_NOT_REGISTERED", "APP_NOT_APPROVED": return "OAUTH_REDIRECT_NOT_ALLOWED"
+        case "EXPLICIT_IDENTITY_LINK_REQUIRED": return "ACCOUNT_LINK_REQUIRED"
+        case "RATE_LIMITED": return "RATE_LIMITED"
+        default: return status == 429 ? "RATE_LIMITED" : "API_ERROR"
+        }
+    }
+
+    /// `TEAMID.bundleId` from the app's default keychain access group.
+    static func detectAppIdentifier() -> String? {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: "dev.authon.apple-sign-in.app-id",
+            kSecAttrAccount as String: "probe",
+            kSecReturnAttributes as String: true,
+        ]
+        #if os(macOS)
+        q[kSecUseDataProtectionKeychain as String] = true
+        #endif
+        var out: AnyObject?
+        var status = SecItemCopyMatching(q as CFDictionary, &out)
+        if status == errSecItemNotFound {
+            var add = q
+            add[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+            status = SecItemAdd(add as CFDictionary, &out)
+        }
+        guard status == errSecSuccess, let attrs = out as? [String: Any], let group = attrs[kSecAttrAccessGroup as String] as? String,
+              group.contains(".") else { return nil }
+        return group
+    }
+}
+
+/// The system Apple ID sheet (ASAuthorizationController), shown immediately.
+public final class SystemAppleIDAuthorizer: AppleIDAuthorizing, @unchecked Sendable {
+    private let anchor: (@MainActor () -> ASPresentationAnchor?)?
+
+    public init(anchor: (@MainActor () -> ASPresentationAnchor?)? = nil) {
+        self.anchor = anchor
+    }
+
+    @MainActor
+    public func authorize(hashedNonce: String) async throws -> AppleIDResult {
+        let request = ASAuthorizationAppleIDProvider().createRequest()
+        request.requestedScopes = [.fullName, .email]
+        request.nonce = hashedNonce
+        let delegate = AppleIDDelegate(anchor: anchor?() ?? Self.keyWindow())
+        let credential = try await delegate.run(request)
+        return AppleIDResult(identityToken: credential.identityToken, authorizationCode: credential.authorizationCode, fullName: credential.fullName)
+    }
+
+    @MainActor
+    static func keyWindow() -> ASPresentationAnchor {
+        #if canImport(UIKit)
+        let scenes = UIApplication.shared.connectedScenes.compactMap { $0 as? UIWindowScene }
+        return scenes.flatMap(\.windows).first(where: \.isKeyWindow) ?? scenes.first?.windows.first ?? ASPresentationAnchor()
+        #else
+        return NSApplication.shared.keyWindow ?? NSApplication.shared.windows.first ?? ASPresentationAnchor()
+        #endif
+    }
+
+    /// ASAuthorizationError → sign-in code. Only `.canceled` is a cancel; everything else (including
+    /// 1000 `.unknown` after dismissing "sign in to your Apple account") is a provider error that
+    /// retrying the same sheet will not fix.
+    static func map(_ error: Error) -> AppleSignInError {
+        if let e = error as? ASAuthorizationError, e.code == .canceled {
+            return AppleSignInError("OAUTH_CANCELLED", "Sign in with Apple was cancelled")
+        }
+        return AppleSignInError("OAUTH_PROVIDER_ERROR", "Sign in with Apple failed (\((error as NSError).code))", retryable: false)
+    }
+}
+
+@MainActor
+private final class AppleIDDelegate: NSObject, ASAuthorizationControllerDelegate, ASAuthorizationControllerPresentationContextProviding {
+    private let anchor: ASPresentationAnchor
+    private var continuation: CheckedContinuation<ASAuthorizationAppleIDCredential, Error>?
+    private var retain: AppleIDDelegate?
+
+    init(anchor: ASPresentationAnchor) {
+        self.anchor = anchor
+    }
+
+    func run(_ request: ASAuthorizationRequest) async throws -> ASAuthorizationAppleIDCredential {
+        try await withCheckedThrowingContinuation { cont in
+            continuation = cont
+            retain = self
+            let controller = ASAuthorizationController(authorizationRequests: [request])
+            controller.delegate = self
+            controller.presentationContextProvider = self
+            controller.performRequests()
+        }
+    }
+
+    nonisolated func presentationAnchor(for controller: ASAuthorizationController) -> ASPresentationAnchor {
+        MainActor.assumeIsolated { anchor }
+    }
+
+    nonisolated func authorizationController(controller: ASAuthorizationController, didCompleteWithAuthorization authorization: ASAuthorization) {
+        MainActor.assumeIsolated {
+            if let credential = authorization.credential as? ASAuthorizationAppleIDCredential {
+                finish(.success(credential))
+            } else {
+                finish(.failure(AppleSignInError("OAUTH_PROVIDER_ERROR", "Unexpected Apple credential type", retryable: false)))
+            }
+        }
+    }
+
+    nonisolated func authorizationController(controller: ASAuthorizationController, didCompleteWithError error: Error) {
+        let mapped = SystemAppleIDAuthorizer.map(error)
+        MainActor.assumeIsolated { finish(.failure(mapped)) }
+    }
+
+    private func finish(_ result: Result<ASAuthorizationAppleIDCredential, Error>) {
+        continuation?.resume(with: result)
+        continuation = nil
+        retain = nil
+    }
+}

package/ios/vendor/AuthonWallet/AuthonWallet.swift

@@ -61,11 +61,16 @@ public final class AuthonWallet: @unchecked Sendable {
     /// App registration and wallet settings from the API (cached).
     public func appConfig() async throws -> WalletAppConfig {
         if let c = lock.withLock({ cachedConfig }) { return c }
+        return try await refreshAppConfig()
+    }
+
+    /// Fetches app-config again (used by capabilities()); a successful answer replaces the cache.
+    func refreshAppConfig() async throws -> WalletAppConfig {
         guard let appId = appId ?? Self.detectAppIdentifier() else {
             throw WalletError(.originNotAllowed, "appId (TEAMID.bundleId) could not be determined")
         }
         let cfg = try await api.appConfig(platform: "ios", appId: appId)
-        lock.withLock { cachedConfig = cfg }
+        if cfg.projectFound { lock.withLock { cachedConfig = cfg } }
         return cfg
     }
 
@@ -135,9 +140,10 @@ public final class AuthonWallet: @unchecked Sendable {
         try await run { ops, s in try PublicWallet(try await ops.create(s)) }
     }
 
-    /// Addresses of accounts start..<start+count (m/44'/60'/0'/0/n).
-    public func accounts(start: Int = 0, count: Int = 1) async throws -> [WalletAccount] {
-        try await run { ops, s in try await ops.accounts(s, start: start, count: count) }
+    /// Addresses of accounts start..<start+count on `chain` (EVM: m/44'/60'/0'/0/n; other paths in
+    /// `WalletChain.path`). A wallet from before HD wallets has only EVM account 0 (ACCOUNT_UNAVAILABLE).
+    public func accounts(start: Int = 0, count: Int = 1, chain: WalletChain = .evm) async throws -> [WalletAccount] {
+        try await run { ops, s in try await ops.accounts(s, start: start, count: count, chain: chain) }
     }
 
     /// EIP-191 personal_sign. `account` > 0 must come with the address from `accounts()`.
@@ -166,6 +172,20 @@ public final class AuthonWallet: @unchecked Sendable {
         }
     }
 
+    /// Signs a transaction the app built for another chain (EVM uses `signTransaction`: UNSUPPORTED_TYPE).
+    /// - Solana: `["message": <serialized Message, base64>, "cluster": "devnet"]` (cluster optional,
+    ///   only labels the approval) → `["signature": <base58>]`.
+    /// - TRON: `["rawDataHex": <raw_data protobuf, hex>]` → `["txID": <hex>, "signature": <r||s||v hex>]`.
+    /// - Bitcoin / testnet: `["psbt": <base64>]` → `["psbt": <signed PSBT base64>, "txHex": <raw tx>]`
+    ///   (`txHex` only when every input was the account's).
+    /// - XRP: `["txBlobHex": <encodeForSigning output>]` → `["signature": <DER, uppercase hex>]`.
+    /// `address` is the expected address of `account` on that chain (from `accounts(chain:)`).
+    public func signChainTransaction(chain: WalletChain, account: Int = 0, address: String, payload: [String: Any]) async throws -> [String: String] {
+        try await run { ops, s in
+            try await ops.signChainTransaction(s, chain: chain, account: account, address: address, payload: try JSONValue.from(payload))
+        }
+    }
+
     /// Creates the passkey backup (iOS 18 / macOS 15 for PRF).
     public func protect() async throws -> ProtectResult {
         try await run(passkeys: true) { ops, s in try await ops.protect(s) }

package/ios/vendor/AuthonWallet/Capabilities.swift

@@ -0,0 +1,149 @@
+// GENERATED by scripts/sync-native-wallet.mjs from swift/Sources/AuthonWallet/Capabilities.swift. Do not edit: change the source and run the script.
+import CryptoKit
+import Foundation
+import LocalAuthentication
+import Security
+
+/// Pre-sign-in check (docs/wallet/NATIVE.md section 9): whether this app and device can use the
+/// wallet. Needs no session, opens no login or passkey UI and never creates a wallet.
+public struct WalletCapabilities: Equatable, Sendable {
+    public enum Status: String, Sendable {
+        case available, unavailable, unknown
+    }
+
+    public struct Check: Equatable, Sendable {
+        public var status: Status
+        /// Section 9 reason code; nil when available.
+        public var reason: String?
+
+        public static let available = Check(status: .available, reason: nil)
+        static func unavailable(_ reason: String) -> Check { Check(status: .unavailable, reason: reason) }
+        static func unknown(_ reason: String) -> Check { Check(status: .unknown, reason: reason) }
+    }
+
+    /// unavailable if any check is unavailable, else unknown if any is unknown, else available.
+    public var ready: Status
+    /// App registration and approval (GET /v1/wallet/app-config).
+    public var app: Check
+    /// The embedded wallet is enabled for the project.
+    public var wallet: Check
+    /// Hardware-protected key storage (Secure Enclave on a real device).
+    public var secureStorage: Check
+    /// A device passcode or biometrics is set.
+    public var deviceLock: Check
+    /// Passkey PRF backup and restore (static OS support only).
+    public var passkeyBackup: Check
+    /// `X-Request-Id` of the app-config response.
+    public var diagnosticId: String?
+
+    init(app: Check, wallet: Check, secureStorage: Check, deviceLock: Check, passkeyBackup: Check, diagnosticId: String?) {
+        self.app = app
+        self.wallet = wallet
+        self.secureStorage = secureStorage
+        self.deviceLock = deviceLock
+        self.passkeyBackup = passkeyBackup
+        self.diagnosticId = diagnosticId
+        let all = [app, wallet, secureStorage, deviceLock, passkeyBackup].map(\.status)
+        ready = all.contains(.unavailable) ? .unavailable : all.contains(.unknown) ? .unknown : .available
+    }
+}
+
+/// Device checks behind capabilities(); replaceable in tests.
+struct CapabilityProbes: Sendable {
+    var secureStorage: @Sendable () -> WalletCapabilities.Check
+    var deviceLock: @Sendable () -> WalletCapabilities.Check
+    var passkeyBackup: @Sendable () -> WalletCapabilities.Check
+
+    static let device = CapabilityProbes(
+        secureStorage: { probeSecureEnclave() },
+        deviceLock: { probeDeviceLock() },
+        passkeyBackup: { probePasskeyBackup() }
+    )
+
+    /// The simulator never counts as hardware protection, even where it emulates an enclave.
+    /// On a device a throwaway enclave key is created and released (never stored).
+    static func probeSecureEnclave() -> WalletCapabilities.Check {
+        #if targetEnvironment(simulator)
+        return .unknown("SIMULATOR")
+        #else
+        guard SecureEnclave.isAvailable else { return .unavailable("HARDWARE_KEYSTORE_UNAVAILABLE") }
+        var error: Unmanaged<CFError>?
+        guard let access = SecAccessControlCreateWithFlags(nil, kSecAttrAccessibleWhenUnlockedThisDeviceOnly, .privateKeyUsage, &error) else {
+            return .unknown("CHECK_FAILED")
+        }
+        let attrs: [String: Any] = [
+            kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+            kSecAttrKeySizeInBits as String: 256,
+            kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave,
+            kSecPrivateKeyAttrs as String: [
+                kSecAttrIsPermanent as String: false,
+                kSecAttrAccessControl as String: access,
+            ] as [String: Any],
+        ]
+        guard SecKeyCreateRandomKey(attrs as CFDictionary, &error) != nil else { return .unknown("CHECK_FAILED") }
+        return .available
+        #endif
+    }
+
+    static func probeDeviceLock() -> WalletCapabilities.Check {
+        let context = LAContext()
+        var error: NSError?
+        if context.canEvaluatePolicy(.deviceOwnerAuthentication, error: &error) { return .available }
+        if let code = error.map({ LAError.Code(rawValue: $0.code) }), code == .passcodeNotSet {
+            return .unavailable("DEVICE_LOCK_NOT_SET")
+        }
+        return .unknown("CHECK_FAILED")
+    }
+
+    static func probePasskeyBackup() -> WalletCapabilities.Check {
+        if #available(iOS 18.0, macOS 15.0, *) {
+            // The API exists; whether the user's passkey provider evaluates PRF shows on the first protect().
+            return .unknown("PRF_PROVIDER_UNVERIFIED")
+        }
+        return .unavailable("OS_UNSUPPORTED")
+    }
+}
+
+extension AuthonWallet {
+    /// See `WalletCapabilities`. Never throws: failures become `unknown` checks.
+    /// `allowSoftwareKeys` does not affect the answer.
+    public func capabilities() async -> WalletCapabilities {
+        await capabilities(probes: .device)
+    }
+
+    func capabilities(probes: CapabilityProbes) async -> WalletCapabilities {
+        let app: WalletCapabilities.Check
+        let wallet: WalletCapabilities.Check
+        var diagnosticId: String?
+        do {
+            let cfg = try await refreshAppConfig()
+            diagnosticId = cfg.diagnosticId
+            if !cfg.projectFound {
+                app = .unavailable("APP_NOT_REGISTERED")
+                wallet = .unknown("API_ERROR")
+            } else {
+                app = !cfg.allowed ? .unavailable("APP_NOT_REGISTERED") : cfg.approved ? .available : .unknown("APP_NOT_APPROVED")
+                wallet = cfg.enabled ? .available : .unavailable("WALLET_DISABLED")
+            }
+        } catch let e as WalletError where e.isNetworkFailure {
+            app = .unknown("NETWORK_ERROR")
+            wallet = .unknown("NETWORK_ERROR")
+        } catch let e as WalletError where e.code == .originNotAllowed {
+            // The app ID could not be determined, so no registration can match it.
+            app = .unavailable("APP_NOT_REGISTERED")
+            wallet = .unknown("API_ERROR")
+        } catch {
+            diagnosticId = (error as? WalletError)?.diagnosticId
+            app = .unknown("API_ERROR")
+            wallet = .unknown("API_ERROR")
+        }
+        return WalletCapabilities(
+            app: app,
+            wallet: wallet,
+            secureStorage: probes.secureStorage(),
+            deviceLock: probes.deviceLock(),
+            passkeyBackup: probes.passkeyBackup(),
+            diagnosticId: diagnosticId
+        )
+    }
+}