@chipi-stack/chipi-expo 13.10.0 → 13.12.0

package/dist/index.d.mts

@@ -1,3 +1,116 @@
-export * from '@chipi-stack/chipi-react';
+export { ChipiProvider, ChipiWalletData, SessionState, SessionWallet, UseChipiSessionConfig, UseChipiSessionReturn, UseChipiWalletConfig, UseChipiWalletReturn, useAddSessionKeyToContract, useApprove, useCallAnyContract, useChipiContext, useChipiSession, useChipiWallet, useCreateSessionKey, useExecuteWithSession, useGetSessionData, useGetSku, useGetSkuList, useGetSkuPurchase, useGetTokenBalance, useGetTransactionList, useGetWallet, usePurchaseSku, useRecordSendTransaction, useRevokeSessionKey, useTransfer } from '@chipi-stack/chipi-react';
+import { CreateWalletParams, CreateWalletResponse, MigrateWalletToPasskeyParams, WalletData } from '@chipi-stack/types';
 export * from '@chipi-stack/types';
 export { Chain, ChainToken } from '@chipi-stack/types';
+
+type CreateWalletInput = {
+    params: CreateWalletParams;
+    bearerToken: string;
+};
+/**
+ * Expo-native override of useCreateWallet.
+ *
+ * When usePasskey: true is passed, this uses expo-local-authentication +
+ * expo-secure-store instead of the browser-only @simplewebauthn/browser,
+ * so it works on real iOS and Android devices.
+ */
+declare function useCreateWallet(): {
+    createWallet: (input: CreateWalletInput) => void;
+    createWalletAsync: (input: CreateWalletInput) => Promise<CreateWalletResponse>;
+    data: CreateWalletResponse | undefined;
+    isLoading: boolean;
+    isError: boolean;
+    error: Error | null;
+    isSuccess: boolean;
+    reset: () => void;
+};
+
+type MigrateWalletToPasskeyInput = MigrateWalletToPasskeyParams & {
+    bearerToken: string;
+};
+interface MigrateWalletToPasskeyResult {
+    success: boolean;
+    wallet: WalletData;
+    credentialId: string;
+}
+/**
+ * Expo-native override of useMigrateWalletToPasskey.
+ *
+ * Migrates a PIN-encrypted wallet to biometric (Face ID / Touch ID) protection.
+ * Uses expo-local-authentication + expo-secure-store instead of browser WebAuthn.
+ */
+declare function useMigrateWalletToPasskey(): {
+    migrateWalletToPasskey: (input: MigrateWalletToPasskeyInput) => void;
+    migrateWalletToPasskeyAsync: (input: MigrateWalletToPasskeyInput) => Promise<MigrateWalletToPasskeyResult>;
+    data: MigrateWalletToPasskeyResult | undefined;
+    isLoading: boolean;
+    isError: boolean;
+    error: Error | null;
+    isSuccess: boolean;
+    reset: () => void;
+};
+
+/**
+ * Native Passkey for Expo/React Native
+ *
+ * Replaces the browser-only @simplewebauthn/browser implementation with a
+ * native equivalent using:
+ *   - expo-local-authentication  → biometric gate (Face ID / Touch ID / fingerprint)
+ *   - expo-secure-store           → iOS Keychain / Android Keystore protected storage
+ *   - crypto-es                   → cryptographically secure random bytes (no Web Crypto in RN)
+ *
+ * Security model: a random 32-byte key is generated at wallet creation time,
+ * stored in the device's secure enclave behind biometric authentication,
+ * and retrieved later by prompting the user again. This is functionally
+ * equivalent to the WebAuthn PRF approach used on the web.
+ */
+interface NativeWalletCredential {
+    credentialId: string;
+    userId: string;
+    createdAt: string;
+}
+interface NativeCreateWalletPasskeyResult {
+    encryptKey: string;
+    credentialId: string;
+    prfSupported: false;
+}
+/**
+ * Returns true if the device has biometric hardware AND the user has enrolled.
+ * Must be true before calling createNativeWalletPasskey or getNativeWalletEncryptKey.
+ */
+declare function isNativeBiometricSupported(): Promise<boolean>;
+/**
+ * Create a new native wallet passkey.
+ *
+ * 1. Verifies biometric support.
+ * 2. Prompts the user with Face ID / Touch ID to confirm intent.
+ * 3. Generates a random encryption key.
+ * 4. Stores the key in the device's Keychain/Keystore, protected by biometrics.
+ * 5. Returns the encryption key so the wallet can be created immediately.
+ *
+ * The key is NEVER stored anywhere else — it lives only in the secure enclave.
+ */
+declare function createNativeWalletPasskey(userId: string, _userName: string): Promise<NativeCreateWalletPasskeyResult>;
+/**
+ * Retrieve the stored encryption key by authenticating with biometrics.
+ * expo-secure-store automatically triggers the Face ID / Touch ID prompt
+ * when requireAuthentication: true was used during storage.
+ *
+ * Returns null if no key is stored for the given userId.
+ */
+declare function getNativeWalletEncryptKey(userId: string): Promise<string | null>;
+/**
+ * Returns true if a native wallet passkey has been created on this device.
+ */
+declare function hasNativeWalletPasskey(): Promise<boolean>;
+/**
+ * Returns the stored credential metadata, or null if none exists.
+ */
+declare function getNativeWalletCredential(): Promise<NativeWalletCredential | null>;
+/**
+ * Removes the stored encryption key and credential metadata from this device.
+ * Use with caution — if the wallet has no other recovery mechanism, this is destructive.
+ */
+declare function removeNativeWalletPasskey(userId: string): Promise<void>;
+
+export { type NativeCreateWalletPasskeyResult, type NativeWalletCredential, createNativeWalletPasskey, getNativeWalletCredential, getNativeWalletEncryptKey, hasNativeWalletPasskey, isNativeBiometricSupported, removeNativeWalletPasskey, useCreateWallet, useMigrateWalletToPasskey };

package/dist/index.d.ts

@@ -1,3 +1,116 @@
-export * from '@chipi-stack/chipi-react';
+export { ChipiProvider, ChipiWalletData, SessionState, SessionWallet, UseChipiSessionConfig, UseChipiSessionReturn, UseChipiWalletConfig, UseChipiWalletReturn, useAddSessionKeyToContract, useApprove, useCallAnyContract, useChipiContext, useChipiSession, useChipiWallet, useCreateSessionKey, useExecuteWithSession, useGetSessionData, useGetSku, useGetSkuList, useGetSkuPurchase, useGetTokenBalance, useGetTransactionList, useGetWallet, usePurchaseSku, useRecordSendTransaction, useRevokeSessionKey, useTransfer } from '@chipi-stack/chipi-react';
+import { CreateWalletParams, CreateWalletResponse, MigrateWalletToPasskeyParams, WalletData } from '@chipi-stack/types';
 export * from '@chipi-stack/types';
 export { Chain, ChainToken } from '@chipi-stack/types';
+
+type CreateWalletInput = {
+    params: CreateWalletParams;
+    bearerToken: string;
+};
+/**
+ * Expo-native override of useCreateWallet.
+ *
+ * When usePasskey: true is passed, this uses expo-local-authentication +
+ * expo-secure-store instead of the browser-only @simplewebauthn/browser,
+ * so it works on real iOS and Android devices.
+ */
+declare function useCreateWallet(): {
+    createWallet: (input: CreateWalletInput) => void;
+    createWalletAsync: (input: CreateWalletInput) => Promise<CreateWalletResponse>;
+    data: CreateWalletResponse | undefined;
+    isLoading: boolean;
+    isError: boolean;
+    error: Error | null;
+    isSuccess: boolean;
+    reset: () => void;
+};
+
+type MigrateWalletToPasskeyInput = MigrateWalletToPasskeyParams & {
+    bearerToken: string;
+};
+interface MigrateWalletToPasskeyResult {
+    success: boolean;
+    wallet: WalletData;
+    credentialId: string;
+}
+/**
+ * Expo-native override of useMigrateWalletToPasskey.
+ *
+ * Migrates a PIN-encrypted wallet to biometric (Face ID / Touch ID) protection.
+ * Uses expo-local-authentication + expo-secure-store instead of browser WebAuthn.
+ */
+declare function useMigrateWalletToPasskey(): {
+    migrateWalletToPasskey: (input: MigrateWalletToPasskeyInput) => void;
+    migrateWalletToPasskeyAsync: (input: MigrateWalletToPasskeyInput) => Promise<MigrateWalletToPasskeyResult>;
+    data: MigrateWalletToPasskeyResult | undefined;
+    isLoading: boolean;
+    isError: boolean;
+    error: Error | null;
+    isSuccess: boolean;
+    reset: () => void;
+};
+
+/**
+ * Native Passkey for Expo/React Native
+ *
+ * Replaces the browser-only @simplewebauthn/browser implementation with a
+ * native equivalent using:
+ *   - expo-local-authentication  → biometric gate (Face ID / Touch ID / fingerprint)
+ *   - expo-secure-store           → iOS Keychain / Android Keystore protected storage
+ *   - crypto-es                   → cryptographically secure random bytes (no Web Crypto in RN)
+ *
+ * Security model: a random 32-byte key is generated at wallet creation time,
+ * stored in the device's secure enclave behind biometric authentication,
+ * and retrieved later by prompting the user again. This is functionally
+ * equivalent to the WebAuthn PRF approach used on the web.
+ */
+interface NativeWalletCredential {
+    credentialId: string;
+    userId: string;
+    createdAt: string;
+}
+interface NativeCreateWalletPasskeyResult {
+    encryptKey: string;
+    credentialId: string;
+    prfSupported: false;
+}
+/**
+ * Returns true if the device has biometric hardware AND the user has enrolled.
+ * Must be true before calling createNativeWalletPasskey or getNativeWalletEncryptKey.
+ */
+declare function isNativeBiometricSupported(): Promise<boolean>;
+/**
+ * Create a new native wallet passkey.
+ *
+ * 1. Verifies biometric support.
+ * 2. Prompts the user with Face ID / Touch ID to confirm intent.
+ * 3. Generates a random encryption key.
+ * 4. Stores the key in the device's Keychain/Keystore, protected by biometrics.
+ * 5. Returns the encryption key so the wallet can be created immediately.
+ *
+ * The key is NEVER stored anywhere else — it lives only in the secure enclave.
+ */
+declare function createNativeWalletPasskey(userId: string, _userName: string): Promise<NativeCreateWalletPasskeyResult>;
+/**
+ * Retrieve the stored encryption key by authenticating with biometrics.
+ * expo-secure-store automatically triggers the Face ID / Touch ID prompt
+ * when requireAuthentication: true was used during storage.
+ *
+ * Returns null if no key is stored for the given userId.
+ */
+declare function getNativeWalletEncryptKey(userId: string): Promise<string | null>;
+/**
+ * Returns true if a native wallet passkey has been created on this device.
+ */
+declare function hasNativeWalletPasskey(): Promise<boolean>;
+/**
+ * Returns the stored credential metadata, or null if none exists.
+ */
+declare function getNativeWalletCredential(): Promise<NativeWalletCredential | null>;
+/**
+ * Removes the stored encryption key and credential metadata from this device.
+ * Use with caution — if the wallet has no other recovery mechanism, this is destructive.
+ */
+declare function removeNativeWalletPasskey(userId: string): Promise<void>;
+
+export { type NativeCreateWalletPasskeyResult, type NativeWalletCredential, createNativeWalletPasskey, getNativeWalletCredential, getNativeWalletEncryptKey, hasNativeWalletPasskey, isNativeBiometricSupported, removeNativeWalletPasskey, useCreateWallet, useMigrateWalletToPasskey };

package/dist/index.js

@@ -1,10 +1,289 @@
 'use strict';
 
 var chipiReact = require('@chipi-stack/chipi-react');
+var reactQuery = require('@tanstack/react-query');
+var LocalAuthentication = require('expo-local-authentication');
+var SecureStore = require('expo-secure-store');
+var CryptoES = require('crypto-es');
+var backend = require('@chipi-stack/backend');
 var types = require('@chipi-stack/types');
 
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
 
+var LocalAuthentication__namespace = /*#__PURE__*/_interopNamespace(LocalAuthentication);
+var SecureStore__namespace = /*#__PURE__*/_interopNamespace(SecureStore);
+var CryptoES__default = /*#__PURE__*/_interopDefault(CryptoES);
+
+// src/index.ts
+var ENCRYPT_KEY_PREFIX = "chipi_wallet_key_";
+var CREDENTIAL_META_KEY = "chipi_wallet_credential";
+function generateRandomHex(byteCount) {
+  const wordArray = CryptoES__default.default.lib.WordArray.random(byteCount);
+  return wordArray.toString(CryptoES__default.default.enc.Hex);
+}
+async function isNativeBiometricSupported() {
+  const hasHardware = await LocalAuthentication__namespace.hasHardwareAsync();
+  if (!hasHardware) return false;
+  const isEnrolled = await LocalAuthentication__namespace.isEnrolledAsync();
+  return isEnrolled;
+}
+async function createNativeWalletPasskey(userId, _userName) {
+  const supported = await isNativeBiometricSupported();
+  if (!supported) {
+    throw new Error(
+      "Biometric authentication is not available or not enrolled on this device. Please enroll Face ID, Touch ID, or a fingerprint in your device settings."
+    );
+  }
+  const authResult = await LocalAuthentication__namespace.authenticateAsync({
+    promptMessage: "Authenticate to create your wallet",
+    cancelLabel: "Cancel",
+    disableDeviceFallback: false
+  });
+  if (!authResult.success) {
+    const reason = "error" in authResult ? authResult.error : "unknown";
+    if (reason === "user_cancel" || reason === "app_cancel") {
+      throw new Error("Biometric authentication was cancelled");
+    }
+    throw new Error(`Biometric authentication failed: ${reason}`);
+  }
+  const encryptKey = generateRandomHex(32);
+  const credentialId = `native_biometric_${userId}_${Date.now()}`;
+  await SecureStore__namespace.setItemAsync(
+    `${ENCRYPT_KEY_PREFIX}${userId}`,
+    encryptKey,
+    { requireAuthentication: true }
+  );
+  const meta = {
+    credentialId,
+    userId,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await SecureStore__namespace.setItemAsync(CREDENTIAL_META_KEY, JSON.stringify(meta));
+  return { encryptKey, credentialId, prfSupported: false };
+}
+async function getNativeWalletEncryptKey(userId) {
+  const supported = await isNativeBiometricSupported();
+  if (!supported) {
+    throw new Error(
+      "Biometric authentication is not available or not enrolled on this device."
+    );
+  }
+  return SecureStore__namespace.getItemAsync(`${ENCRYPT_KEY_PREFIX}${userId}`, {
+    requireAuthentication: true
+  });
+}
+async function hasNativeWalletPasskey() {
+  const stored = await SecureStore__namespace.getItemAsync(CREDENTIAL_META_KEY);
+  return stored !== null;
+}
+async function getNativeWalletCredential() {
+  const stored = await SecureStore__namespace.getItemAsync(CREDENTIAL_META_KEY);
+  if (!stored) return null;
+  try {
+    return JSON.parse(stored);
+  } catch {
+    return null;
+  }
+}
+async function removeNativeWalletPasskey(userId) {
+  await SecureStore__namespace.deleteItemAsync(`${ENCRYPT_KEY_PREFIX}${userId}`);
+  await SecureStore__namespace.deleteItemAsync(CREDENTIAL_META_KEY);
+}
+
+// src/hooks/useCreateWallet.ts
+function useCreateWallet() {
+  const { chipiSDK } = chipiReact.useChipiContext();
+  const mutation = reactQuery.useMutation({
+    mutationFn: async (input) => {
+      let encryptKey = input.params.encryptKey;
+      if (input.params.usePasskey) {
+        if (!input.params.externalUserId) {
+          throw new Error("externalUserId is required when using passkey");
+        }
+        try {
+          const passkeyResult = await createNativeWalletPasskey(
+            input.params.externalUserId,
+            input.params.externalUserId
+          );
+          encryptKey = passkeyResult.encryptKey;
+        } catch (error) {
+          if (error instanceof Error) {
+            throw new Error(`Passkey creation failed: ${error.message}`);
+          }
+          throw new Error("Failed to create passkey for wallet");
+        }
+      }
+      return chipiSDK.createWallet({
+        params: {
+          ...input.params,
+          encryptKey
+        },
+        bearerToken: input.bearerToken
+      });
+    }
+  });
+  return {
+    createWallet: mutation.mutate,
+    createWalletAsync: mutation.mutateAsync,
+    data: mutation.data,
+    isLoading: mutation.isPending,
+    isError: mutation.isError,
+    error: mutation.error,
+    isSuccess: mutation.isSuccess,
+    reset: mutation.reset
+  };
+}
+function useMigrateWalletToPasskey() {
+  const mutation = reactQuery.useMutation({
+    mutationFn: async (input) => {
+      const { wallet, oldEncryptKey, externalUserId } = input;
+      try {
+        const passkeyResult = await createNativeWalletPasskey(
+          externalUserId,
+          externalUserId
+        );
+        let decryptedPrivateKey;
+        try {
+          decryptedPrivateKey = backend.decryptPrivateKey(
+            wallet.encryptedPrivateKey,
+            oldEncryptKey
+          );
+        } catch {
+          throw new Error(
+            "Failed to decrypt wallet with provided encryptKey. Please verify your PIN/password is correct."
+          );
+        }
+        const newEncryptedPrivateKey = backend.encryptPrivateKey(
+          decryptedPrivateKey,
+          passkeyResult.encryptKey
+        );
+        const updatedWallet = {
+          ...wallet,
+          encryptedPrivateKey: newEncryptedPrivateKey
+        };
+        return {
+          success: true,
+          wallet: updatedWallet,
+          credentialId: passkeyResult.credentialId
+        };
+      } catch (error) {
+        if (error instanceof Error) {
+          throw new Error(`Migration failed: ${error.message}`);
+        }
+        throw new Error("Failed to migrate wallet to passkey");
+      }
+    }
+  });
+  return {
+    migrateWalletToPasskey: mutation.mutate,
+    migrateWalletToPasskeyAsync: mutation.mutateAsync,
+    data: mutation.data,
+    isLoading: mutation.isPending,
+    isError: mutation.isError,
+    error: mutation.error,
+    isSuccess: mutation.isSuccess,
+    reset: mutation.reset
+  };
+}
+
+Object.defineProperty(exports, "ChipiProvider", {
+  enumerable: true,
+  get: function () { return chipiReact.ChipiProvider; }
+});
+Object.defineProperty(exports, "useAddSessionKeyToContract", {
+  enumerable: true,
+  get: function () { return chipiReact.useAddSessionKeyToContract; }
+});
+Object.defineProperty(exports, "useApprove", {
+  enumerable: true,
+  get: function () { return chipiReact.useApprove; }
+});
+Object.defineProperty(exports, "useCallAnyContract", {
+  enumerable: true,
+  get: function () { return chipiReact.useCallAnyContract; }
+});
+Object.defineProperty(exports, "useChipiContext", {
+  enumerable: true,
+  get: function () { return chipiReact.useChipiContext; }
+});
+Object.defineProperty(exports, "useChipiSession", {
+  enumerable: true,
+  get: function () { return chipiReact.useChipiSession; }
+});
+Object.defineProperty(exports, "useChipiWallet", {
+  enumerable: true,
+  get: function () { return chipiReact.useChipiWallet; }
+});
+Object.defineProperty(exports, "useCreateSessionKey", {
+  enumerable: true,
+  get: function () { return chipiReact.useCreateSessionKey; }
+});
+Object.defineProperty(exports, "useExecuteWithSession", {
+  enumerable: true,
+  get: function () { return chipiReact.useExecuteWithSession; }
+});
+Object.defineProperty(exports, "useGetSessionData", {
+  enumerable: true,
+  get: function () { return chipiReact.useGetSessionData; }
+});
+Object.defineProperty(exports, "useGetSku", {
+  enumerable: true,
+  get: function () { return chipiReact.useGetSku; }
+});
+Object.defineProperty(exports, "useGetSkuList", {
+  enumerable: true,
+  get: function () { return chipiReact.useGetSkuList; }
+});
+Object.defineProperty(exports, "useGetSkuPurchase", {
+  enumerable: true,
+  get: function () { return chipiReact.useGetSkuPurchase; }
+});
+Object.defineProperty(exports, "useGetTokenBalance", {
+  enumerable: true,
+  get: function () { return chipiReact.useGetTokenBalance; }
+});
+Object.defineProperty(exports, "useGetTransactionList", {
+  enumerable: true,
+  get: function () { return chipiReact.useGetTransactionList; }
+});
+Object.defineProperty(exports, "useGetWallet", {
+  enumerable: true,
+  get: function () { return chipiReact.useGetWallet; }
+});
+Object.defineProperty(exports, "usePurchaseSku", {
+  enumerable: true,
+  get: function () { return chipiReact.usePurchaseSku; }
+});
+Object.defineProperty(exports, "useRecordSendTransaction", {
+  enumerable: true,
+  get: function () { return chipiReact.useRecordSendTransaction; }
+});
+Object.defineProperty(exports, "useRevokeSessionKey", {
+  enumerable: true,
+  get: function () { return chipiReact.useRevokeSessionKey; }
+});
+Object.defineProperty(exports, "useTransfer", {
+  enumerable: true,
+  get: function () { return chipiReact.useTransfer; }
+});
 Object.defineProperty(exports, "Chain", {
   enumerable: true,
   get: function () { return types.Chain; }
@@ -13,17 +292,13 @@ Object.defineProperty(exports, "ChainToken", {
   enumerable: true,
   get: function () { return types.ChainToken; }
 });
-Object.keys(chipiReact).forEach(function (k) {
-  if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {
-    enumerable: true,
-    get: function () { return chipiReact[k]; }
-  });
-});
-Object.keys(types).forEach(function (k) {
-  if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {
-    enumerable: true,
-    get: function () { return types[k]; }
-  });
-});
+exports.createNativeWalletPasskey = createNativeWalletPasskey;
+exports.getNativeWalletCredential = getNativeWalletCredential;
+exports.getNativeWalletEncryptKey = getNativeWalletEncryptKey;
+exports.hasNativeWalletPasskey = hasNativeWalletPasskey;
+exports.isNativeBiometricSupported = isNativeBiometricSupported;
+exports.removeNativeWalletPasskey = removeNativeWalletPasskey;
+exports.useCreateWallet = useCreateWallet;
+exports.useMigrateWalletToPasskey = useMigrateWalletToPasskey;
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js","sourcesContent":[]}
+{"version":3,"sources":["../src/native-passkey.ts","../src/hooks/useCreateWallet.ts","../src/hooks/useMigrateWalletToPasskey.ts"],"names":["CryptoES","LocalAuthentication","SecureStore","useChipiContext","useMutation","decryptPrivateKey","encryptPrivateKey"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,IAAM,kBAAA,GAAqB,mBAAA;AAC3B,IAAM,mBAAA,GAAsB,yBAAA;AAmB5B,SAAS,kBAAkB,SAAA,EAA2B;AACpD,EAAA,MAAM,SAAA,GAAYA,yBAAA,CAAS,GAAA,CAAI,SAAA,CAAU,OAAO,SAAS,CAAA;AACzD,EAAA,OAAO,SAAA,CAAU,QAAA,CAASA,yBAAA,CAAS,GAAA,CAAI,GAAG,CAAA;AAC5C;AAMA,eAAsB,0BAAA,GAA+C;AACnE,EAAA,MAAM,WAAA,GAAc,MAA0BC,8BAAA,CAAA,gBAAA,EAAiB;AAC/D,EAAA,IAAI,CAAC,aAAa,OAAO,KAAA;AACzB,EAAA,MAAM,UAAA,GAAa,MAA0BA,8BAAA,CAAA,eAAA,EAAgB;AAC7D,EAAA,OAAO,UAAA;AACT;AAaA,eAAsB,yBAAA,CACpB,QACA,SAAA,EAC0C;AAC1C,EAAA,MAAM,SAAA,GAAY,MAAM,0BAAA,EAA2B;AACnD,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAEF;AAAA,EACF;AAGA,EAAA,MAAM,UAAA,GAAa,MAA0BA,8BAAA,CAAA,iBAAA,CAAkB;AAAA,IAC7D,aAAA,EAAe,oCAAA;AAAA,IACf,WAAA,EAAa,QAAA;AAAA,IACb,qBAAA,EAAuB;AAAA,GACxB,CAAA;AAED,EAAA,IAAI,CAAC,WAAW,OAAA,EAAS;AACvB,IAAA,MAAM,MAAA,GAAS,OAAA,IAAW,UAAA,GAAa,UAAA,CAAW,KAAA,GAAQ,SAAA;AAC1D,IAAA,IAAI,MAAA,KAAW,aAAA,IAAiB,MAAA,KAAW,YAAA,EAAc;AACvD,MAAA,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAAA,IAC1D;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,MAAM,CAAA,CAAE,CAAA;AAAA,EAC9D;AAEA,EAAA,MAAM,UAAA,GAAa,kBAAkB,EAAE,CAAA;AACvC,EAAA,MAAM,eAAe,CAAA,iBAAA,EAAoB,MAAM,CAAA,CAAA,EAAI,IAAA,CAAK,KAAK,CAAA,CAAA;AAG7D,EAAA,MAAkBC,sBAAA,CAAA,YAAA;AAAA,IAChB,CAAA,EAAG,kBAAkB,CAAA,EAAG,MAAM,CAAA,CAAA;AAAA,IAC9B,UAAA;AAAA,IACA,EAAE,uBAAuB,IAAA;AAAK,GAChC;AAGA,EAAA,MAAM,IAAA,GAA+B;AAAA,IACnC,YAAA;AAAA,IACA,MAAA;AAAA,IACA,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,GACpC;AACA,EAAA,MAAkBA,sBAAA,CAAA,YAAA,CAAa,mBAAA,EAAqB,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAExE,EAAA,OAAO,EAAE,UAAA,EAAY,YAAA,EAAc,YAAA,EAAc,KAAA,EAAM;AACzD;AASA,eAAsB,0BACpB,MAAA,EACwB;AACxB,EAAA,MAAM,SAAA,GAAY,MAAM,0BAAA,EAA2B;AACnD,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAmBA,sBAAA,CAAA,YAAA,CAAa,CAAA,EAAG,kBAAkB,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI;AAAA,IAChE,qBAAA,EAAuB;AAAA,GACxB,CAAA;AACH;AAKA,eAAsB,sBAAA,GAA2C;AAC/D,EAAA,MAAM,MAAA,GAAS,MAAkBA,sBAAA,CAAA,YAAA,CAAa,mBAAmB,CAAA;AACjE,EAAA,OAAO,MAAA,KAAW,IAAA;AACpB;AAKA,eAAsB,yBAAA,GAAoE;AACxF,EAAA,MAAM,MAAA,GAAS,MAAkBA,sBAAA,CAAA,YAAA,CAAa,mBAAmB,CAAA;AACjE,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,MAAM,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAMA,eAAsB,0BAA0B,MAAA,EAA+B;AAC7E,EAAA,MAAkBA,sBAAA,CAAA,eAAA,CAAgB,CAAA,EAAG,kBAAkB,CAAA,EAAG,MAAM,CAAA,CAAE,CAAA;AAClE,EAAA,MAAkBA,uCAAgB,mBAAmB,CAAA;AACvD;;;AChJO,SAAS,eAAA,GAWd;AACA,EAAA,MAAM,EAAE,QAAA,EAAS,GAAIC,0BAAA,EAAgB;AAErC,EAAA,MAAM,WAIFC,sBAAA,CAAY;AAAA,IACd,UAAA,EAAY,OAAO,KAAA,KAA6B;AAC9C,MAAA,IAAI,UAAA,GAAa,MAAM,MAAA,CAAO,UAAA;AAE9B,MAAA,IAAI,KAAA,CAAM,OAAO,UAAA,EAAY;AAC3B,QAAA,IAAI,CAAC,KAAA,CAAM,MAAA,CAAO,cAAA,EAAgB;AAChC,UAAA,MAAM,IAAI,MAAM,+CAA+C,CAAA;AAAA,QACjE;AAEA,QAAA,IAAI;AACF,UAAA,MAAM,gBAAgB,MAAM,yBAAA;AAAA,YAC1B,MAAM,MAAA,CAAO,cAAA;AAAA,YACb,MAAM,MAAA,CAAO;AAAA,WACf;AACA,UAAA,UAAA,GAAa,aAAA,CAAc,UAAA;AAAA,QAC7B,SAAS,KAAA,EAAO;AACd,UAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,YAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAAA,UAC7D;AACA,UAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,QACvD;AAAA,MACF;AAEA,MAAA,OAAO,SAAS,YAAA,CAAa;AAAA,QAC3B,MAAA,EAAQ;AAAA,UACN,GAAG,KAAA,CAAM,MAAA;AAAA,UACT;AAAA,SACF;AAAA,QACA,aAAa,KAAA,CAAM;AAAA,OACpB,CAAA;AAAA,IACH;AAAA,GACD,CAAA;AAED,EAAA,OAAO;AAAA,IACL,cAAc,QAAA,CAAS,MAAA;AAAA,IACvB,mBAAmB,QAAA,CAAS,WAAA;AAAA,IAC5B,MAAM,QAAA,CAAS,IAAA;AAAA,IACf,WAAW,QAAA,CAAS,SAAA;AAAA,IACpB,SAAS,QAAA,CAAS,OAAA;AAAA,IAClB,OAAO,QAAA,CAAS,KAAA;AAAA,IAChB,WAAW,QAAA,CAAS,SAAA;AAAA,IACpB,OAAO,QAAA,CAAS;AAAA,GAClB;AACF;AC5DO,SAAS,yBAAA,GAWd;AACA,EAAA,MAAM,WAIFA,sBAAAA,CAAY;AAAA,IACd,UAAA,EAAY,OAAO,KAAA,KAAuC;AACxD,MAAA,MAAM,EAAE,MAAA,EAAQ,aAAA,EAAe,cAAA,EAAe,GAAI,KAAA;AAElD,MAAA,IAAI;AAEF,QAAA,MAAM,gBAAgB,MAAM,yBAAA;AAAA,UAC1B,cAAA;AAAA,UACA;AAAA,SACF;AAGA,QAAA,IAAI,mBAAA;AACJ,QAAA,IAAI;AACF,UAAA,mBAAA,GAAsBC,yBAAA;AAAA,YACpB,MAAA,CAAO,mBAAA;AAAA,YACP;AAAA,WACF;AAAA,QACF,CAAA,CAAA,MAAQ;AACN,UAAA,MAAM,IAAI,KAAA;AAAA,YACR;AAAA,WACF;AAAA,QACF;AAGA,QAAA,MAAM,sBAAA,GAAyBC,yBAAA;AAAA,UAC7B,mBAAA;AAAA,UACA,aAAA,CAAc;AAAA,SAChB;AAEA,QAAA,MAAM,aAAA,GAA4B;AAAA,UAChC,GAAG,MAAA;AAAA,UACH,mBAAA,EAAqB;AAAA,SACvB;AAEA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS,IAAA;AAAA,UACT,MAAA,EAAQ,aAAA;AAAA,UACR,cAAc,aAAA,CAAc;AAAA,SAC9B;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,UAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAAA,QACtD;AACA,QAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,MACvD;AAAA,IACF;AAAA,GACD,CAAA;AAED,EAAA,OAAO;AAAA,IACL,wBAAwB,QAAA,CAAS,MAAA;AAAA,IACjC,6BAA6B,QAAA,CAAS,WAAA;AAAA,IACtC,MAAM,QAAA,CAAS,IAAA;AAAA,IACf,WAAW,QAAA,CAAS,SAAA;AAAA,IACpB,SAAS,QAAA,CAAS,OAAA;AAAA,IAClB,OAAO,QAAA,CAAS,KAAA;AAAA,IAChB,WAAW,QAAA,CAAS,SAAA;AAAA,IACpB,OAAO,QAAA,CAAS;AAAA,GAClB;AACF","file":"index.js","sourcesContent":["/**\n * Native Passkey for Expo/React Native\n *\n * Replaces the browser-only @simplewebauthn/browser implementation with a\n * native equivalent using:\n *   - expo-local-authentication  → biometric gate (Face ID / Touch ID / fingerprint)\n *   - expo-secure-store           → iOS Keychain / Android Keystore protected storage\n *   - crypto-es                   → cryptographically secure random bytes (no Web Crypto in RN)\n *\n * Security model: a random 32-byte key is generated at wallet creation time,\n * stored in the device's secure enclave behind biometric authentication,\n * and retrieved later by prompting the user again. This is functionally\n * equivalent to the WebAuthn PRF approach used on the web.\n */\n\nimport * as LocalAuthentication from \"expo-local-authentication\";\nimport * as SecureStore from \"expo-secure-store\";\nimport CryptoES from \"crypto-es\";\n\nconst ENCRYPT_KEY_PREFIX = \"chipi_wallet_key_\";\nconst CREDENTIAL_META_KEY = \"chipi_wallet_credential\";\n\nexport interface NativeWalletCredential {\n  credentialId: string;\n  userId: string;\n  createdAt: string;\n}\n\nexport interface NativeCreateWalletPasskeyResult {\n  encryptKey: string;\n  credentialId: string;\n  prfSupported: false;\n}\n\n/**\n * Generate a cryptographically random hex string (32 bytes = 64 hex chars).\n * Uses crypto-es because React Native has no Web Crypto API (crypto is undefined).\n * Same approach as @chipi-stack/backend for consistency.\n */\nfunction generateRandomHex(byteCount: number): string {\n  const wordArray = CryptoES.lib.WordArray.random(byteCount);\n  return wordArray.toString(CryptoES.enc.Hex);\n}\n\n/**\n * Returns true if the device has biometric hardware AND the user has enrolled.\n * Must be true before calling createNativeWalletPasskey or getNativeWalletEncryptKey.\n */\nexport async function isNativeBiometricSupported(): Promise<boolean> {\n  const hasHardware = await LocalAuthentication.hasHardwareAsync();\n  if (!hasHardware) return false;\n  const isEnrolled = await LocalAuthentication.isEnrolledAsync();\n  return isEnrolled;\n}\n\n/**\n * Create a new native wallet passkey.\n *\n * 1. Verifies biometric support.\n * 2. Prompts the user with Face ID / Touch ID to confirm intent.\n * 3. Generates a random encryption key.\n * 4. Stores the key in the device's Keychain/Keystore, protected by biometrics.\n * 5. Returns the encryption key so the wallet can be created immediately.\n *\n * The key is NEVER stored anywhere else — it lives only in the secure enclave.\n */\nexport async function createNativeWalletPasskey(\n  userId: string,\n  _userName: string\n): Promise<NativeCreateWalletPasskeyResult> {\n  const supported = await isNativeBiometricSupported();\n  if (!supported) {\n    throw new Error(\n      \"Biometric authentication is not available or not enrolled on this device. \" +\n        \"Please enroll Face ID, Touch ID, or a fingerprint in your device settings.\"\n    );\n  }\n\n  // Prompt biometrics to confirm user intent before generating/storing the key\n  const authResult = await LocalAuthentication.authenticateAsync({\n    promptMessage: \"Authenticate to create your wallet\",\n    cancelLabel: \"Cancel\",\n    disableDeviceFallback: false,\n  });\n\n  if (!authResult.success) {\n    const reason = \"error\" in authResult ? authResult.error : \"unknown\";\n    if (reason === \"user_cancel\" || reason === \"app_cancel\") {\n      throw new Error(\"Biometric authentication was cancelled\");\n    }\n    throw new Error(`Biometric authentication failed: ${reason}`);\n  }\n\n  const encryptKey = generateRandomHex(32);\n  const credentialId = `native_biometric_${userId}_${Date.now()}`;\n\n  // Store the encryption key — requireAuthentication means future reads need biometrics\n  await SecureStore.setItemAsync(\n    `${ENCRYPT_KEY_PREFIX}${userId}`,\n    encryptKey,\n    { requireAuthentication: true }\n  );\n\n  // Store lightweight credential metadata (not sensitive — no requireAuthentication needed)\n  const meta: NativeWalletCredential = {\n    credentialId,\n    userId,\n    createdAt: new Date().toISOString(),\n  };\n  await SecureStore.setItemAsync(CREDENTIAL_META_KEY, JSON.stringify(meta));\n\n  return { encryptKey, credentialId, prfSupported: false };\n}\n\n/**\n * Retrieve the stored encryption key by authenticating with biometrics.\n * expo-secure-store automatically triggers the Face ID / Touch ID prompt\n * when requireAuthentication: true was used during storage.\n *\n * Returns null if no key is stored for the given userId.\n */\nexport async function getNativeWalletEncryptKey(\n  userId: string\n): Promise<string | null> {\n  const supported = await isNativeBiometricSupported();\n  if (!supported) {\n    throw new Error(\n      \"Biometric authentication is not available or not enrolled on this device.\"\n    );\n  }\n\n  return SecureStore.getItemAsync(`${ENCRYPT_KEY_PREFIX}${userId}`, {\n    requireAuthentication: true,\n  });\n}\n\n/**\n * Returns true if a native wallet passkey has been created on this device.\n */\nexport async function hasNativeWalletPasskey(): Promise<boolean> {\n  const stored = await SecureStore.getItemAsync(CREDENTIAL_META_KEY);\n  return stored !== null;\n}\n\n/**\n * Returns the stored credential metadata, or null if none exists.\n */\nexport async function getNativeWalletCredential(): Promise<NativeWalletCredential | null> {\n  const stored = await SecureStore.getItemAsync(CREDENTIAL_META_KEY);\n  if (!stored) return null;\n  try {\n    return JSON.parse(stored) as NativeWalletCredential;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Removes the stored encryption key and credential metadata from this device.\n * Use with caution — if the wallet has no other recovery mechanism, this is destructive.\n */\nexport async function removeNativeWalletPasskey(userId: string): Promise<void> {\n  await SecureStore.deleteItemAsync(`${ENCRYPT_KEY_PREFIX}${userId}`);\n  await SecureStore.deleteItemAsync(CREDENTIAL_META_KEY);\n}\n","import { useMutation, type UseMutationResult } from \"@tanstack/react-query\";\nimport { useChipiContext } from \"@chipi-stack/chipi-react\";\nimport type {\n  CreateWalletParams,\n  CreateWalletResponse,\n} from \"@chipi-stack/types\";\nimport { createNativeWalletPasskey } from \"../native-passkey\";\n\ntype CreateWalletInput = {\n  params: CreateWalletParams;\n  bearerToken: string;\n};\n\n/**\n * Expo-native override of useCreateWallet.\n *\n * When usePasskey: true is passed, this uses expo-local-authentication +\n * expo-secure-store instead of the browser-only @simplewebauthn/browser,\n * so it works on real iOS and Android devices.\n */\nexport function useCreateWallet(): {\n  createWallet: (input: CreateWalletInput) => void;\n  createWalletAsync: (\n    input: CreateWalletInput\n  ) => Promise<CreateWalletResponse>;\n  data: CreateWalletResponse | undefined;\n  isLoading: boolean;\n  isError: boolean;\n  error: Error | null;\n  isSuccess: boolean;\n  reset: () => void;\n} {\n  const { chipiSDK } = useChipiContext();\n\n  const mutation: UseMutationResult<\n    CreateWalletResponse,\n    Error,\n    CreateWalletInput\n  > = useMutation({\n    mutationFn: async (input: CreateWalletInput) => {\n      let encryptKey = input.params.encryptKey;\n\n      if (input.params.usePasskey) {\n        if (!input.params.externalUserId) {\n          throw new Error(\"externalUserId is required when using passkey\");\n        }\n\n        try {\n          const passkeyResult = await createNativeWalletPasskey(\n            input.params.externalUserId,\n            input.params.externalUserId\n          );\n          encryptKey = passkeyResult.encryptKey;\n        } catch (error) {\n          if (error instanceof Error) {\n            throw new Error(`Passkey creation failed: ${error.message}`);\n          }\n          throw new Error(\"Failed to create passkey for wallet\");\n        }\n      }\n\n      return chipiSDK.createWallet({\n        params: {\n          ...input.params,\n          encryptKey: encryptKey!,\n        },\n        bearerToken: input.bearerToken,\n      });\n    },\n  });\n\n  return {\n    createWallet: mutation.mutate,\n    createWalletAsync: mutation.mutateAsync,\n    data: mutation.data,\n    isLoading: mutation.isPending,\n    isError: mutation.isError,\n    error: mutation.error,\n    isSuccess: mutation.isSuccess,\n    reset: mutation.reset,\n  };\n}\n","import { useMutation, type UseMutationResult } from \"@tanstack/react-query\";\nimport type { MigrateWalletToPasskeyParams, WalletData } from \"@chipi-stack/types\";\nimport { decryptPrivateKey, encryptPrivateKey } from \"@chipi-stack/backend\";\nimport { createNativeWalletPasskey } from \"../native-passkey\";\n\ntype MigrateWalletToPasskeyInput = MigrateWalletToPasskeyParams & {\n  bearerToken: string;\n};\n\ninterface MigrateWalletToPasskeyResult {\n  success: boolean;\n  wallet: WalletData;\n  credentialId: string;\n}\n\n/**\n * Expo-native override of useMigrateWalletToPasskey.\n *\n * Migrates a PIN-encrypted wallet to biometric (Face ID / Touch ID) protection.\n * Uses expo-local-authentication + expo-secure-store instead of browser WebAuthn.\n */\nexport function useMigrateWalletToPasskey(): {\n  migrateWalletToPasskey: (input: MigrateWalletToPasskeyInput) => void;\n  migrateWalletToPasskeyAsync: (\n    input: MigrateWalletToPasskeyInput\n  ) => Promise<MigrateWalletToPasskeyResult>;\n  data: MigrateWalletToPasskeyResult | undefined;\n  isLoading: boolean;\n  isError: boolean;\n  error: Error | null;\n  isSuccess: boolean;\n  reset: () => void;\n} {\n  const mutation: UseMutationResult<\n    MigrateWalletToPasskeyResult,\n    Error,\n    MigrateWalletToPasskeyInput\n  > = useMutation({\n    mutationFn: async (input: MigrateWalletToPasskeyInput) => {\n      const { wallet, oldEncryptKey, externalUserId } = input;\n\n      try {\n        // Step 1: Create new native passkey and derive encryptKey via biometrics\n        const passkeyResult = await createNativeWalletPasskey(\n          externalUserId,\n          externalUserId\n        );\n\n        // Step 2: Decrypt the private key with the old PIN/encryptKey\n        let decryptedPrivateKey: string;\n        try {\n          decryptedPrivateKey = decryptPrivateKey(\n            wallet.encryptedPrivateKey,\n            oldEncryptKey\n          );\n        } catch {\n          throw new Error(\n            \"Failed to decrypt wallet with provided encryptKey. Please verify your PIN/password is correct.\"\n          );\n        }\n\n        // Step 3: Re-encrypt with the new biometric-derived encryptKey\n        const newEncryptedPrivateKey = encryptPrivateKey(\n          decryptedPrivateKey,\n          passkeyResult.encryptKey\n        );\n\n        const updatedWallet: WalletData = {\n          ...wallet,\n          encryptedPrivateKey: newEncryptedPrivateKey,\n        };\n\n        return {\n          success: true,\n          wallet: updatedWallet,\n          credentialId: passkeyResult.credentialId,\n        };\n      } catch (error) {\n        if (error instanceof Error) {\n          throw new Error(`Migration failed: ${error.message}`);\n        }\n        throw new Error(\"Failed to migrate wallet to passkey\");\n      }\n    },\n  });\n\n  return {\n    migrateWalletToPasskey: mutation.mutate,\n    migrateWalletToPasskeyAsync: mutation.mutateAsync,\n    data: mutation.data,\n    isLoading: mutation.isPending,\n    isError: mutation.isError,\n    error: mutation.error,\n    isSuccess: mutation.isSuccess,\n    reset: mutation.reset,\n  };\n}\n"]}

package/dist/index.mjs

@@ -1,5 +1,184 @@
-export * from '@chipi-stack/chipi-react';
-export * from '@chipi-stack/types';
+import { useChipiContext } from '@chipi-stack/chipi-react';
+export { ChipiProvider, useAddSessionKeyToContract, useApprove, useCallAnyContract, useChipiContext, useChipiSession, useChipiWallet, useCreateSessionKey, useExecuteWithSession, useGetSessionData, useGetSku, useGetSkuList, useGetSkuPurchase, useGetTokenBalance, useGetTransactionList, useGetWallet, usePurchaseSku, useRecordSendTransaction, useRevokeSessionKey, useTransfer } from '@chipi-stack/chipi-react';
+import { useMutation } from '@tanstack/react-query';
+import * as LocalAuthentication from 'expo-local-authentication';
+import * as SecureStore from 'expo-secure-store';
+import CryptoES from 'crypto-es';
+import { decryptPrivateKey, encryptPrivateKey } from '@chipi-stack/backend';
 export { Chain, ChainToken } from '@chipi-stack/types';
+
+// src/index.ts
+var ENCRYPT_KEY_PREFIX = "chipi_wallet_key_";
+var CREDENTIAL_META_KEY = "chipi_wallet_credential";
+function generateRandomHex(byteCount) {
+  const wordArray = CryptoES.lib.WordArray.random(byteCount);
+  return wordArray.toString(CryptoES.enc.Hex);
+}
+async function isNativeBiometricSupported() {
+  const hasHardware = await LocalAuthentication.hasHardwareAsync();
+  if (!hasHardware) return false;
+  const isEnrolled = await LocalAuthentication.isEnrolledAsync();
+  return isEnrolled;
+}
+async function createNativeWalletPasskey(userId, _userName) {
+  const supported = await isNativeBiometricSupported();
+  if (!supported) {
+    throw new Error(
+      "Biometric authentication is not available or not enrolled on this device. Please enroll Face ID, Touch ID, or a fingerprint in your device settings."
+    );
+  }
+  const authResult = await LocalAuthentication.authenticateAsync({
+    promptMessage: "Authenticate to create your wallet",
+    cancelLabel: "Cancel",
+    disableDeviceFallback: false
+  });
+  if (!authResult.success) {
+    const reason = "error" in authResult ? authResult.error : "unknown";
+    if (reason === "user_cancel" || reason === "app_cancel") {
+      throw new Error("Biometric authentication was cancelled");
+    }
+    throw new Error(`Biometric authentication failed: ${reason}`);
+  }
+  const encryptKey = generateRandomHex(32);
+  const credentialId = `native_biometric_${userId}_${Date.now()}`;
+  await SecureStore.setItemAsync(
+    `${ENCRYPT_KEY_PREFIX}${userId}`,
+    encryptKey,
+    { requireAuthentication: true }
+  );
+  const meta = {
+    credentialId,
+    userId,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await SecureStore.setItemAsync(CREDENTIAL_META_KEY, JSON.stringify(meta));
+  return { encryptKey, credentialId, prfSupported: false };
+}
+async function getNativeWalletEncryptKey(userId) {
+  const supported = await isNativeBiometricSupported();
+  if (!supported) {
+    throw new Error(
+      "Biometric authentication is not available or not enrolled on this device."
+    );
+  }
+  return SecureStore.getItemAsync(`${ENCRYPT_KEY_PREFIX}${userId}`, {
+    requireAuthentication: true
+  });
+}
+async function hasNativeWalletPasskey() {
+  const stored = await SecureStore.getItemAsync(CREDENTIAL_META_KEY);
+  return stored !== null;
+}
+async function getNativeWalletCredential() {
+  const stored = await SecureStore.getItemAsync(CREDENTIAL_META_KEY);
+  if (!stored) return null;
+  try {
+    return JSON.parse(stored);
+  } catch {
+    return null;
+  }
+}
+async function removeNativeWalletPasskey(userId) {
+  await SecureStore.deleteItemAsync(`${ENCRYPT_KEY_PREFIX}${userId}`);
+  await SecureStore.deleteItemAsync(CREDENTIAL_META_KEY);
+}
+
+// src/hooks/useCreateWallet.ts
+function useCreateWallet() {
+  const { chipiSDK } = useChipiContext();
+  const mutation = useMutation({
+    mutationFn: async (input) => {
+      let encryptKey = input.params.encryptKey;
+      if (input.params.usePasskey) {
+        if (!input.params.externalUserId) {
+          throw new Error("externalUserId is required when using passkey");
+        }
+        try {
+          const passkeyResult = await createNativeWalletPasskey(
+            input.params.externalUserId,
+            input.params.externalUserId
+          );
+          encryptKey = passkeyResult.encryptKey;
+        } catch (error) {
+          if (error instanceof Error) {
+            throw new Error(`Passkey creation failed: ${error.message}`);
+          }
+          throw new Error("Failed to create passkey for wallet");
+        }
+      }
+      return chipiSDK.createWallet({
+        params: {
+          ...input.params,
+          encryptKey
+        },
+        bearerToken: input.bearerToken
+      });
+    }
+  });
+  return {
+    createWallet: mutation.mutate,
+    createWalletAsync: mutation.mutateAsync,
+    data: mutation.data,
+    isLoading: mutation.isPending,
+    isError: mutation.isError,
+    error: mutation.error,
+    isSuccess: mutation.isSuccess,
+    reset: mutation.reset
+  };
+}
+function useMigrateWalletToPasskey() {
+  const mutation = useMutation({
+    mutationFn: async (input) => {
+      const { wallet, oldEncryptKey, externalUserId } = input;
+      try {
+        const passkeyResult = await createNativeWalletPasskey(
+          externalUserId,
+          externalUserId
+        );
+        let decryptedPrivateKey;
+        try {
+          decryptedPrivateKey = decryptPrivateKey(
+            wallet.encryptedPrivateKey,
+            oldEncryptKey
+          );
+        } catch {
+          throw new Error(
+            "Failed to decrypt wallet with provided encryptKey. Please verify your PIN/password is correct."
+          );
+        }
+        const newEncryptedPrivateKey = encryptPrivateKey(
+          decryptedPrivateKey,
+          passkeyResult.encryptKey
+        );
+        const updatedWallet = {
+          ...wallet,
+          encryptedPrivateKey: newEncryptedPrivateKey
+        };
+        return {
+          success: true,
+          wallet: updatedWallet,
+          credentialId: passkeyResult.credentialId
+        };
+      } catch (error) {
+        if (error instanceof Error) {
+          throw new Error(`Migration failed: ${error.message}`);
+        }
+        throw new Error("Failed to migrate wallet to passkey");
+      }
+    }
+  });
+  return {
+    migrateWalletToPasskey: mutation.mutate,
+    migrateWalletToPasskeyAsync: mutation.mutateAsync,
+    data: mutation.data,
+    isLoading: mutation.isPending,
+    isError: mutation.isError,
+    error: mutation.error,
+    isSuccess: mutation.isSuccess,
+    reset: mutation.reset
+  };
+}
+
+export { createNativeWalletPasskey, getNativeWalletCredential, getNativeWalletEncryptKey, hasNativeWalletPasskey, isNativeBiometricSupported, removeNativeWalletPasskey, useCreateWallet, useMigrateWalletToPasskey };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"index.mjs","sourcesContent":[]}
+{"version":3,"sources":["../src/native-passkey.ts","../src/hooks/useCreateWallet.ts","../src/hooks/useMigrateWalletToPasskey.ts"],"names":["useMutation"],"mappings":";;;;;;;;;;AAmBA,IAAM,kBAAA,GAAqB,mBAAA;AAC3B,IAAM,mBAAA,GAAsB,yBAAA;AAmB5B,SAAS,kBAAkB,SAAA,EAA2B;AACpD,EAAA,MAAM,SAAA,GAAY,QAAA,CAAS,GAAA,CAAI,SAAA,CAAU,OAAO,SAAS,CAAA;AACzD,EAAA,OAAO,SAAA,CAAU,QAAA,CAAS,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA;AAC5C;AAMA,eAAsB,0BAAA,GAA+C;AACnE,EAAA,MAAM,WAAA,GAAc,MAA0B,mBAAA,CAAA,gBAAA,EAAiB;AAC/D,EAAA,IAAI,CAAC,aAAa,OAAO,KAAA;AACzB,EAAA,MAAM,UAAA,GAAa,MAA0B,mBAAA,CAAA,eAAA,EAAgB;AAC7D,EAAA,OAAO,UAAA;AACT;AAaA,eAAsB,yBAAA,CACpB,QACA,SAAA,EAC0C;AAC1C,EAAA,MAAM,SAAA,GAAY,MAAM,0BAAA,EAA2B;AACnD,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAEF;AAAA,EACF;AAGA,EAAA,MAAM,UAAA,GAAa,MAA0B,mBAAA,CAAA,iBAAA,CAAkB;AAAA,IAC7D,aAAA,EAAe,oCAAA;AAAA,IACf,WAAA,EAAa,QAAA;AAAA,IACb,qBAAA,EAAuB;AAAA,GACxB,CAAA;AAED,EAAA,IAAI,CAAC,WAAW,OAAA,EAAS;AACvB,IAAA,MAAM,MAAA,GAAS,OAAA,IAAW,UAAA,GAAa,UAAA,CAAW,KAAA,GAAQ,SAAA;AAC1D,IAAA,IAAI,MAAA,KAAW,aAAA,IAAiB,MAAA,KAAW,YAAA,EAAc;AACvD,MAAA,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAAA,IAC1D;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,MAAM,CAAA,CAAE,CAAA;AAAA,EAC9D;AAEA,EAAA,MAAM,UAAA,GAAa,kBAAkB,EAAE,CAAA;AACvC,EAAA,MAAM,eAAe,CAAA,iBAAA,EAAoB,MAAM,CAAA,CAAA,EAAI,IAAA,CAAK,KAAK,CAAA,CAAA;AAG7D,EAAA,MAAkB,WAAA,CAAA,YAAA;AAAA,IAChB,CAAA,EAAG,kBAAkB,CAAA,EAAG,MAAM,CAAA,CAAA;AAAA,IAC9B,UAAA;AAAA,IACA,EAAE,uBAAuB,IAAA;AAAK,GAChC;AAGA,EAAA,MAAM,IAAA,GAA+B;AAAA,IACnC,YAAA;AAAA,IACA,MAAA;AAAA,IACA,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,GACpC;AACA,EAAA,MAAkB,WAAA,CAAA,YAAA,CAAa,mBAAA,EAAqB,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAExE,EAAA,OAAO,EAAE,UAAA,EAAY,YAAA,EAAc,YAAA,EAAc,KAAA,EAAM;AACzD;AASA,eAAsB,0BACpB,MAAA,EACwB;AACxB,EAAA,MAAM,SAAA,GAAY,MAAM,0BAAA,EAA2B;AACnD,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAmB,WAAA,CAAA,YAAA,CAAa,CAAA,EAAG,kBAAkB,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI;AAAA,IAChE,qBAAA,EAAuB;AAAA,GACxB,CAAA;AACH;AAKA,eAAsB,sBAAA,GAA2C;AAC/D,EAAA,MAAM,MAAA,GAAS,MAAkB,WAAA,CAAA,YAAA,CAAa,mBAAmB,CAAA;AACjE,EAAA,OAAO,MAAA,KAAW,IAAA;AACpB;AAKA,eAAsB,yBAAA,GAAoE;AACxF,EAAA,MAAM,MAAA,GAAS,MAAkB,WAAA,CAAA,YAAA,CAAa,mBAAmB,CAAA;AACjE,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,MAAM,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAMA,eAAsB,0BAA0B,MAAA,EAA+B;AAC7E,EAAA,MAAkB,WAAA,CAAA,eAAA,CAAgB,CAAA,EAAG,kBAAkB,CAAA,EAAG,MAAM,CAAA,CAAE,CAAA;AAClE,EAAA,MAAkB,4BAAgB,mBAAmB,CAAA;AACvD;;;AChJO,SAAS,eAAA,GAWd;AACA,EAAA,MAAM,EAAE,QAAA,EAAS,GAAI,eAAA,EAAgB;AAErC,EAAA,MAAM,WAIF,WAAA,CAAY;AAAA,IACd,UAAA,EAAY,OAAO,KAAA,KAA6B;AAC9C,MAAA,IAAI,UAAA,GAAa,MAAM,MAAA,CAAO,UAAA;AAE9B,MAAA,IAAI,KAAA,CAAM,OAAO,UAAA,EAAY;AAC3B,QAAA,IAAI,CAAC,KAAA,CAAM,MAAA,CAAO,cAAA,EAAgB;AAChC,UAAA,MAAM,IAAI,MAAM,+CAA+C,CAAA;AAAA,QACjE;AAEA,QAAA,IAAI;AACF,UAAA,MAAM,gBAAgB,MAAM,yBAAA;AAAA,YAC1B,MAAM,MAAA,CAAO,cAAA;AAAA,YACb,MAAM,MAAA,CAAO;AAAA,WACf;AACA,UAAA,UAAA,GAAa,aAAA,CAAc,UAAA;AAAA,QAC7B,SAAS,KAAA,EAAO;AACd,UAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,YAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAAA,UAC7D;AACA,UAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,QACvD;AAAA,MACF;AAEA,MAAA,OAAO,SAAS,YAAA,CAAa;AAAA,QAC3B,MAAA,EAAQ;AAAA,UACN,GAAG,KAAA,CAAM,MAAA;AAAA,UACT;AAAA,SACF;AAAA,QACA,aAAa,KAAA,CAAM;AAAA,OACpB,CAAA;AAAA,IACH;AAAA,GACD,CAAA;AAED,EAAA,OAAO;AAAA,IACL,cAAc,QAAA,CAAS,MAAA;AAAA,IACvB,mBAAmB,QAAA,CAAS,WAAA;AAAA,IAC5B,MAAM,QAAA,CAAS,IAAA;AAAA,IACf,WAAW,QAAA,CAAS,SAAA;AAAA,IACpB,SAAS,QAAA,CAAS,OAAA;AAAA,IAClB,OAAO,QAAA,CAAS,KAAA;AAAA,IAChB,WAAW,QAAA,CAAS,SAAA;AAAA,IACpB,OAAO,QAAA,CAAS;AAAA,GAClB;AACF;AC5DO,SAAS,yBAAA,GAWd;AACA,EAAA,MAAM,WAIFA,WAAAA,CAAY;AAAA,IACd,UAAA,EAAY,OAAO,KAAA,KAAuC;AACxD,MAAA,MAAM,EAAE,MAAA,EAAQ,aAAA,EAAe,cAAA,EAAe,GAAI,KAAA;AAElD,MAAA,IAAI;AAEF,QAAA,MAAM,gBAAgB,MAAM,yBAAA;AAAA,UAC1B,cAAA;AAAA,UACA;AAAA,SACF;AAGA,QAAA,IAAI,mBAAA;AACJ,QAAA,IAAI;AACF,UAAA,mBAAA,GAAsB,iBAAA;AAAA,YACpB,MAAA,CAAO,mBAAA;AAAA,YACP;AAAA,WACF;AAAA,QACF,CAAA,CAAA,MAAQ;AACN,UAAA,MAAM,IAAI,KAAA;AAAA,YACR;AAAA,WACF;AAAA,QACF;AAGA,QAAA,MAAM,sBAAA,GAAyB,iBAAA;AAAA,UAC7B,mBAAA;AAAA,UACA,aAAA,CAAc;AAAA,SAChB;AAEA,QAAA,MAAM,aAAA,GAA4B;AAAA,UAChC,GAAG,MAAA;AAAA,UACH,mBAAA,EAAqB;AAAA,SACvB;AAEA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS,IAAA;AAAA,UACT,MAAA,EAAQ,aAAA;AAAA,UACR,cAAc,aAAA,CAAc;AAAA,SAC9B;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,UAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAAA,QACtD;AACA,QAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,MACvD;AAAA,IACF;AAAA,GACD,CAAA;AAED,EAAA,OAAO;AAAA,IACL,wBAAwB,QAAA,CAAS,MAAA;AAAA,IACjC,6BAA6B,QAAA,CAAS,WAAA;AAAA,IACtC,MAAM,QAAA,CAAS,IAAA;AAAA,IACf,WAAW,QAAA,CAAS,SAAA;AAAA,IACpB,SAAS,QAAA,CAAS,OAAA;AAAA,IAClB,OAAO,QAAA,CAAS,KAAA;AAAA,IAChB,WAAW,QAAA,CAAS,SAAA;AAAA,IACpB,OAAO,QAAA,CAAS;AAAA,GAClB;AACF","file":"index.mjs","sourcesContent":["/**\n * Native Passkey for Expo/React Native\n *\n * Replaces the browser-only @simplewebauthn/browser implementation with a\n * native equivalent using:\n *   - expo-local-authentication  → biometric gate (Face ID / Touch ID / fingerprint)\n *   - expo-secure-store           → iOS Keychain / Android Keystore protected storage\n *   - crypto-es                   → cryptographically secure random bytes (no Web Crypto in RN)\n *\n * Security model: a random 32-byte key is generated at wallet creation time,\n * stored in the device's secure enclave behind biometric authentication,\n * and retrieved later by prompting the user again. This is functionally\n * equivalent to the WebAuthn PRF approach used on the web.\n */\n\nimport * as LocalAuthentication from \"expo-local-authentication\";\nimport * as SecureStore from \"expo-secure-store\";\nimport CryptoES from \"crypto-es\";\n\nconst ENCRYPT_KEY_PREFIX = \"chipi_wallet_key_\";\nconst CREDENTIAL_META_KEY = \"chipi_wallet_credential\";\n\nexport interface NativeWalletCredential {\n  credentialId: string;\n  userId: string;\n  createdAt: string;\n}\n\nexport interface NativeCreateWalletPasskeyResult {\n  encryptKey: string;\n  credentialId: string;\n  prfSupported: false;\n}\n\n/**\n * Generate a cryptographically random hex string (32 bytes = 64 hex chars).\n * Uses crypto-es because React Native has no Web Crypto API (crypto is undefined).\n * Same approach as @chipi-stack/backend for consistency.\n */\nfunction generateRandomHex(byteCount: number): string {\n  const wordArray = CryptoES.lib.WordArray.random(byteCount);\n  return wordArray.toString(CryptoES.enc.Hex);\n}\n\n/**\n * Returns true if the device has biometric hardware AND the user has enrolled.\n * Must be true before calling createNativeWalletPasskey or getNativeWalletEncryptKey.\n */\nexport async function isNativeBiometricSupported(): Promise<boolean> {\n  const hasHardware = await LocalAuthentication.hasHardwareAsync();\n  if (!hasHardware) return false;\n  const isEnrolled = await LocalAuthentication.isEnrolledAsync();\n  return isEnrolled;\n}\n\n/**\n * Create a new native wallet passkey.\n *\n * 1. Verifies biometric support.\n * 2. Prompts the user with Face ID / Touch ID to confirm intent.\n * 3. Generates a random encryption key.\n * 4. Stores the key in the device's Keychain/Keystore, protected by biometrics.\n * 5. Returns the encryption key so the wallet can be created immediately.\n *\n * The key is NEVER stored anywhere else — it lives only in the secure enclave.\n */\nexport async function createNativeWalletPasskey(\n  userId: string,\n  _userName: string\n): Promise<NativeCreateWalletPasskeyResult> {\n  const supported = await isNativeBiometricSupported();\n  if (!supported) {\n    throw new Error(\n      \"Biometric authentication is not available or not enrolled on this device. \" +\n        \"Please enroll Face ID, Touch ID, or a fingerprint in your device settings.\"\n    );\n  }\n\n  // Prompt biometrics to confirm user intent before generating/storing the key\n  const authResult = await LocalAuthentication.authenticateAsync({\n    promptMessage: \"Authenticate to create your wallet\",\n    cancelLabel: \"Cancel\",\n    disableDeviceFallback: false,\n  });\n\n  if (!authResult.success) {\n    const reason = \"error\" in authResult ? authResult.error : \"unknown\";\n    if (reason === \"user_cancel\" || reason === \"app_cancel\") {\n      throw new Error(\"Biometric authentication was cancelled\");\n    }\n    throw new Error(`Biometric authentication failed: ${reason}`);\n  }\n\n  const encryptKey = generateRandomHex(32);\n  const credentialId = `native_biometric_${userId}_${Date.now()}`;\n\n  // Store the encryption key — requireAuthentication means future reads need biometrics\n  await SecureStore.setItemAsync(\n    `${ENCRYPT_KEY_PREFIX}${userId}`,\n    encryptKey,\n    { requireAuthentication: true }\n  );\n\n  // Store lightweight credential metadata (not sensitive — no requireAuthentication needed)\n  const meta: NativeWalletCredential = {\n    credentialId,\n    userId,\n    createdAt: new Date().toISOString(),\n  };\n  await SecureStore.setItemAsync(CREDENTIAL_META_KEY, JSON.stringify(meta));\n\n  return { encryptKey, credentialId, prfSupported: false };\n}\n\n/**\n * Retrieve the stored encryption key by authenticating with biometrics.\n * expo-secure-store automatically triggers the Face ID / Touch ID prompt\n * when requireAuthentication: true was used during storage.\n *\n * Returns null if no key is stored for the given userId.\n */\nexport async function getNativeWalletEncryptKey(\n  userId: string\n): Promise<string | null> {\n  const supported = await isNativeBiometricSupported();\n  if (!supported) {\n    throw new Error(\n      \"Biometric authentication is not available or not enrolled on this device.\"\n    );\n  }\n\n  return SecureStore.getItemAsync(`${ENCRYPT_KEY_PREFIX}${userId}`, {\n    requireAuthentication: true,\n  });\n}\n\n/**\n * Returns true if a native wallet passkey has been created on this device.\n */\nexport async function hasNativeWalletPasskey(): Promise<boolean> {\n  const stored = await SecureStore.getItemAsync(CREDENTIAL_META_KEY);\n  return stored !== null;\n}\n\n/**\n * Returns the stored credential metadata, or null if none exists.\n */\nexport async function getNativeWalletCredential(): Promise<NativeWalletCredential | null> {\n  const stored = await SecureStore.getItemAsync(CREDENTIAL_META_KEY);\n  if (!stored) return null;\n  try {\n    return JSON.parse(stored) as NativeWalletCredential;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Removes the stored encryption key and credential metadata from this device.\n * Use with caution — if the wallet has no other recovery mechanism, this is destructive.\n */\nexport async function removeNativeWalletPasskey(userId: string): Promise<void> {\n  await SecureStore.deleteItemAsync(`${ENCRYPT_KEY_PREFIX}${userId}`);\n  await SecureStore.deleteItemAsync(CREDENTIAL_META_KEY);\n}\n","import { useMutation, type UseMutationResult } from \"@tanstack/react-query\";\nimport { useChipiContext } from \"@chipi-stack/chipi-react\";\nimport type {\n  CreateWalletParams,\n  CreateWalletResponse,\n} from \"@chipi-stack/types\";\nimport { createNativeWalletPasskey } from \"../native-passkey\";\n\ntype CreateWalletInput = {\n  params: CreateWalletParams;\n  bearerToken: string;\n};\n\n/**\n * Expo-native override of useCreateWallet.\n *\n * When usePasskey: true is passed, this uses expo-local-authentication +\n * expo-secure-store instead of the browser-only @simplewebauthn/browser,\n * so it works on real iOS and Android devices.\n */\nexport function useCreateWallet(): {\n  createWallet: (input: CreateWalletInput) => void;\n  createWalletAsync: (\n    input: CreateWalletInput\n  ) => Promise<CreateWalletResponse>;\n  data: CreateWalletResponse | undefined;\n  isLoading: boolean;\n  isError: boolean;\n  error: Error | null;\n  isSuccess: boolean;\n  reset: () => void;\n} {\n  const { chipiSDK } = useChipiContext();\n\n  const mutation: UseMutationResult<\n    CreateWalletResponse,\n    Error,\n    CreateWalletInput\n  > = useMutation({\n    mutationFn: async (input: CreateWalletInput) => {\n      let encryptKey = input.params.encryptKey;\n\n      if (input.params.usePasskey) {\n        if (!input.params.externalUserId) {\n          throw new Error(\"externalUserId is required when using passkey\");\n        }\n\n        try {\n          const passkeyResult = await createNativeWalletPasskey(\n            input.params.externalUserId,\n            input.params.externalUserId\n          );\n          encryptKey = passkeyResult.encryptKey;\n        } catch (error) {\n          if (error instanceof Error) {\n            throw new Error(`Passkey creation failed: ${error.message}`);\n          }\n          throw new Error(\"Failed to create passkey for wallet\");\n        }\n      }\n\n      return chipiSDK.createWallet({\n        params: {\n          ...input.params,\n          encryptKey: encryptKey!,\n        },\n        bearerToken: input.bearerToken,\n      });\n    },\n  });\n\n  return {\n    createWallet: mutation.mutate,\n    createWalletAsync: mutation.mutateAsync,\n    data: mutation.data,\n    isLoading: mutation.isPending,\n    isError: mutation.isError,\n    error: mutation.error,\n    isSuccess: mutation.isSuccess,\n    reset: mutation.reset,\n  };\n}\n","import { useMutation, type UseMutationResult } from \"@tanstack/react-query\";\nimport type { MigrateWalletToPasskeyParams, WalletData } from \"@chipi-stack/types\";\nimport { decryptPrivateKey, encryptPrivateKey } from \"@chipi-stack/backend\";\nimport { createNativeWalletPasskey } from \"../native-passkey\";\n\ntype MigrateWalletToPasskeyInput = MigrateWalletToPasskeyParams & {\n  bearerToken: string;\n};\n\ninterface MigrateWalletToPasskeyResult {\n  success: boolean;\n  wallet: WalletData;\n  credentialId: string;\n}\n\n/**\n * Expo-native override of useMigrateWalletToPasskey.\n *\n * Migrates a PIN-encrypted wallet to biometric (Face ID / Touch ID) protection.\n * Uses expo-local-authentication + expo-secure-store instead of browser WebAuthn.\n */\nexport function useMigrateWalletToPasskey(): {\n  migrateWalletToPasskey: (input: MigrateWalletToPasskeyInput) => void;\n  migrateWalletToPasskeyAsync: (\n    input: MigrateWalletToPasskeyInput\n  ) => Promise<MigrateWalletToPasskeyResult>;\n  data: MigrateWalletToPasskeyResult | undefined;\n  isLoading: boolean;\n  isError: boolean;\n  error: Error | null;\n  isSuccess: boolean;\n  reset: () => void;\n} {\n  const mutation: UseMutationResult<\n    MigrateWalletToPasskeyResult,\n    Error,\n    MigrateWalletToPasskeyInput\n  > = useMutation({\n    mutationFn: async (input: MigrateWalletToPasskeyInput) => {\n      const { wallet, oldEncryptKey, externalUserId } = input;\n\n      try {\n        // Step 1: Create new native passkey and derive encryptKey via biometrics\n        const passkeyResult = await createNativeWalletPasskey(\n          externalUserId,\n          externalUserId\n        );\n\n        // Step 2: Decrypt the private key with the old PIN/encryptKey\n        let decryptedPrivateKey: string;\n        try {\n          decryptedPrivateKey = decryptPrivateKey(\n            wallet.encryptedPrivateKey,\n            oldEncryptKey\n          );\n        } catch {\n          throw new Error(\n            \"Failed to decrypt wallet with provided encryptKey. Please verify your PIN/password is correct.\"\n          );\n        }\n\n        // Step 3: Re-encrypt with the new biometric-derived encryptKey\n        const newEncryptedPrivateKey = encryptPrivateKey(\n          decryptedPrivateKey,\n          passkeyResult.encryptKey\n        );\n\n        const updatedWallet: WalletData = {\n          ...wallet,\n          encryptedPrivateKey: newEncryptedPrivateKey,\n        };\n\n        return {\n          success: true,\n          wallet: updatedWallet,\n          credentialId: passkeyResult.credentialId,\n        };\n      } catch (error) {\n        if (error instanceof Error) {\n          throw new Error(`Migration failed: ${error.message}`);\n        }\n        throw new Error(\"Failed to migrate wallet to passkey\");\n      }\n    },\n  });\n\n  return {\n    migrateWalletToPasskey: mutation.mutate,\n    migrateWalletToPasskeyAsync: mutation.mutateAsync,\n    data: mutation.data,\n    isLoading: mutation.isPending,\n    isError: mutation.isError,\n    error: mutation.error,\n    isSuccess: mutation.isSuccess,\n    reset: mutation.reset,\n  };\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chipi-stack/chipi-expo",
-  "version": "13.10.0",
+  "version": "13.12.0",
   "description": "Chipi SDK for React Native and Expo applications",
   "keywords": [
     "chipi",
@@ -55,15 +55,29 @@
   },
   "dependencies": {
     "@tanstack/react-query": "^5.85.0",
-    "@chipi-stack/backend": "^13.9.0",
-    "@chipi-stack/shared": "^13.9.0",
-    "@chipi-stack/chipi-react": "^13.9.0",
-    "@chipi-stack/types": "^13.10.0"
+    "crypto-es": "^2.1.0",
+    "@chipi-stack/backend": "^13.11.0",
+    "@chipi-stack/chipi-react": "^13.11.0",
+    "@chipi-stack/types": "^13.12.0",
+    "@chipi-stack/shared": "^13.11.0"
   },
   "peerDependencies": {
+    "expo-local-authentication": ">=14.0.0",
+    "expo-secure-store": ">=13.0.0",
     "react": ">=16.8.0",
     "react-dom": ">=16.8.0"
   },
+  "peerDependenciesMeta": {
+    "expo-local-authentication": {
+      "optional": false
+    },
+    "expo-secure-store": {
+      "optional": false
+    },
+    "react-dom": {
+      "optional": true
+    }
+  },
   "engines": {
     "node": ">=18.17.0"
   },