@synqauth/solana-mobile 0.0.0-stage → 0.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Aerosol
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,40 @@
-# Temporary Holding Version
+# @synqauth/solana-mobile
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Sign in to Synq with a Solana wallet app on Android, through Mobile Wallet Adapter.
+
+Synq is customer identity for businesses: an OpenID Connect issuer for each of your brands, with Solana wallet, social, email and passkey sign-in. The documentation is at [docs.synq.build](https://docs.synq.build).
+
+This package is at 0.x and hasn't been published yet: its API can change in any release until Synq's first customer depends on it.
+
+## Usage
+
+In a React Native app on Android, with Mobile Wallet Adapter's own `transact`:
+
+```ts
+import { transact } from '@solana-mobile/mobile-wallet-adapter-protocol'
+import { mobileWalletSignInUrl } from '@synqauth/solana-mobile/react-native'
+
+const url = await mobileWalletSignInUrl(synq.client, {
+  issuer,
+  clientId,
+  appOrigin: 'https://app.example.com', // your registered redirect URI's origin
+  identity: { name: 'Acme', uri: 'https://app.example.com' },
+  transact,
+})
+// open `url` in the system browser; it comes straight back with a code
+```
+
+In a mobile browser, register Mobile Wallet Adapter as a wallet, and `@synqauth/solana` finds it:
+
+```ts
+import { registerMwa } from '@solana-mobile/wallet-standard-mobile'
+import { registerMobileWallet } from '@synqauth/solana-mobile/web'
+
+registerMobileWallet({ registerMwa, appIdentity: { name: 'Acme', uri: location.origin } })
+```
+
+The wallet app signs your brand's issuer's own request, and Synq checks it.
+
+## License
+
+MIT

package/dist/core.d.ts

@@ -0,0 +1,19 @@
+import { SignInRequest } from "@synqauth/solana";
+//#region src/core.d.ts
+/** What MWA's `authorize` answers for a sign-in: every field base64. */
+export interface MwaSignInResult {
+  readonly address: string;
+  readonly signed_message: string;
+  readonly signature: string;
+  readonly signature_type?: string;
+}
+/** A Solana address (32 bytes) in base58, as the issuer names wallets. */
+export declare function base58Address(bytes: Uint8Array): string;
+/**
+ * `synq_siws` for MWA's sign-in result for `request`: the address in
+ * base58, the signature as it came, and the request's nonce. Refuses a
+ * result whose signed message isn't the issuer's request for that address,
+ * or that isn't an Ed25519 signature.
+ */
+export declare function siwsFromMwa(request: SignInRequest, result: MwaSignInResult): string;
+//#endregion

package/dist/core.js

@@ -0,0 +1,52 @@
+import { SynqError } from "@synqauth/js";
+import { encodeSiws, signInMessage } from "@synqauth/solana";
+//#region src/core.ts
+const ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+function fromBase64(value) {
+	const binary = atob(value);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+/** A Solana address (32 bytes) in base58, as the issuer names wallets. */
+function base58Address(bytes) {
+	if (bytes.length !== 32) throw new SynqError("invalid_response", "The wallet answered an address that is not 32 bytes");
+	let n = 0n;
+	for (const byte of bytes) n = n * 256n + BigInt(byte);
+	let out = "";
+	while (n > 0n) {
+		out = ALPHABET[Number(n % 58n)] + out;
+		n /= 58n;
+	}
+	for (const byte of bytes) {
+		if (byte !== 0) break;
+		out = `1${out}`;
+	}
+	return out;
+}
+/**
+* `synq_siws` for MWA's sign-in result for `request`: the address in
+* base58, the signature as it came, and the request's nonce. Refuses a
+* result whose signed message isn't the issuer's request for that address,
+* or that isn't an Ed25519 signature.
+*/
+function siwsFromMwa(request, result) {
+	let address;
+	let message;
+	try {
+		address = base58Address(fromBase64(result.address));
+		message = new TextDecoder().decode(fromBase64(result.signed_message));
+	} catch (error) {
+		if (error instanceof SynqError) throw error;
+		throw new SynqError("invalid_response", "The wallet's sign-in result isn't base64", { cause: error });
+	}
+	if (result.signature_type && result.signature_type.toLowerCase() !== "ed25519") throw new SynqError("invalid_response", `The wallet signed with ${result.signature_type}, not Ed25519`);
+	if (message !== signInMessage(request, address)) throw new SynqError("invalid_response", "The wallet signed another message than the request makes");
+	return encodeSiws({
+		address,
+		signature: result.signature,
+		nonce: request.nonce
+	});
+}
+//#endregion
+export { base58Address, siwsFromMwa };

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+import { MwaSignInResult, base58Address, siwsFromMwa } from "./core.js";
+export { type MwaSignInResult, base58Address, siwsFromMwa };

package/dist/index.js

@@ -0,0 +1,2 @@
+import { base58Address, siwsFromMwa } from "./core.js";
+export { base58Address, siwsFromMwa };

package/dist/react-native.d.ts

@@ -0,0 +1,55 @@
+import { MwaSignInResult, siwsFromMwa } from "./core.js";
+import { AuthorizationUrlOptions, SynqClient } from "@synqauth/js";
+import { SignInRequest } from "@synqauth/solana";
+//#region src/react-native.d.ts
+/** The part of an MWA wallet session this uses. */
+export interface MwaWallet {
+  authorize(params: {
+    identity: {
+      name?: string;
+      uri?: string;
+      icon?: string;
+    };
+    chain?: string;
+    sign_in_payload?: SignInRequest;
+  }): Promise<{
+    sign_in_result?: MwaSignInResult;
+  }>;
+}
+/** MWA's `transact`: runs `callback` in a session with the wallet app the person picks. */
+export type MwaTransact = <T>(callback: (wallet: MwaWallet) => Promise<T>) => Promise<T>;
+/** What `mobileWalletSignInUrl` takes besides the client. */
+export interface MobileWalletSignInOptions extends Omit<AuthorizationUrlOptions, 'pushed' | 'prompt' | 'method'> {
+  issuer: string | URL;
+  clientId: string;
+  /**
+   * The app's https identity: the origin of a redirect URI it registered
+   * and claims (an App Link through `assetlinks.json`, a universal link
+   * through `apple-app-site-association`). The issuer answers a wallet
+   * sign-in request only to one of the app's own origins, which a native
+   * app's requests carry as `Origin`. An app whose only redirect URI is a
+   * scheme of its own (`com.example.app:/callback`) can sign people in
+   * through the browser but not with a wallet: this is `invalid_options`.
+   */
+  appOrigin: string;
+  /** How the wallet app names the app asking: `uri`, when given, is https on `appOrigin`. */
+  identity: {
+    name?: string;
+    uri?: string;
+    icon?: string;
+  };
+  transact: MwaTransact;
+  fetch?: typeof fetch;
+}
+/**
+ * The issuer's request, signed by the wallet app through MWA, pushed to
+ * Synq: the URL to open in the system browser, which comes straight back to
+ * the app's redirect URI with a code. A person who declines in the wallet
+ * app is `wallet_rejected`. The app needs an https identity it claims as
+ * `appOrigin` (an App Link, a universal link): one whose only redirect URI is
+ * a scheme of its own signs in through the browser only, and is
+ * `invalid_options` here, before anyone is asked.
+ */
+export declare function mobileWalletSignInUrl(client: SynqClient, options: MobileWalletSignInOptions): Promise<URL>;
+//#endregion
+export { type MwaSignInResult, siwsFromMwa };

package/dist/react-native.js

@@ -0,0 +1,74 @@
+import { siwsFromMwa } from "./core.js";
+import { SynqError } from "@synqauth/js";
+import { requestSignIn } from "@synqauth/solana";
+//#region src/react-native.ts
+/**
+* The app's https origin, from `appOrigin`, or `invalid_options`. Wallet
+* sign-in needs an https identity the app claims (an App Link through
+* `assetlinks.json`, a universal link through `apple-app-site-association`):
+* MWA wallets show the dapp's identity URI and check it against the app,
+* the Sign In With Solana message names its domain, and the issuer answers
+* only an origin of one of the app's redirect URIs. A scheme of the app's
+* own (`com.example.app:/callback`) proves nothing about who owns the app:
+* it is enough for signing in through the browser, not with a wallet.
+*/
+function httpsIdentity(appOrigin, identityUri) {
+	const url = URL.canParse(appOrigin) ? new URL(appOrigin) : void 0;
+	if (url?.protocol !== "https:") throw new SynqError("invalid_options", `Signing in with a wallet app needs the app's https identity as appOrigin, the origin of an https redirect URI it claims (an App Link or universal link), not ${appOrigin}: a scheme of the app's own is for signing in through the browser only`);
+	if (identityUri !== void 0) {
+		const identity = URL.canParse(identityUri) ? new URL(identityUri) : void 0;
+		if (identity?.protocol !== "https:" || identity.origin !== url.origin) throw new SynqError("invalid_options", `identity.uri must be an https URL on the app's identity, ${url.origin}, not ${identityUri}`);
+	}
+	return url.origin;
+}
+/**
+* The issuer's request, signed by the wallet app through MWA, pushed to
+* Synq: the URL to open in the system browser, which comes straight back to
+* the app's redirect URI with a code. A person who declines in the wallet
+* app is `wallet_rejected`. The app needs an https identity it claims as
+* `appOrigin` (an App Link, a universal link): one whose only redirect URI is
+* a scheme of its own signs in through the browser only, and is
+* `invalid_options` here, before anyone is asked.
+*/
+async function mobileWalletSignInUrl(client, options) {
+	const { issuer, clientId, appOrigin, identity, transact, fetch: fetcher, params, ...rest } = options;
+	const origin = httpsIdentity(appOrigin, identity.uri);
+	const base = fetcher ?? fetch;
+	const withOrigin = (input, init) => {
+		const headers = new Headers(init?.headers);
+		headers.set("origin", origin);
+		return base(input, {
+			...init,
+			headers
+		});
+	};
+	const request = await requestSignIn({
+		issuer,
+		clientId,
+		fetch: withOrigin
+	});
+	let result;
+	try {
+		result = await transact(async (wallet) => {
+			return (await wallet.authorize({
+				identity,
+				chain: request.chainId,
+				sign_in_payload: request
+			})).sign_in_result;
+		});
+	} catch (error) {
+		throw new SynqError("wallet_rejected", `The wallet app didn't sign: ${String(error)}`, { cause: error });
+	}
+	if (!result) throw new SynqError("wallet_rejected", "The wallet app answered no sign-in");
+	return client.authorizationUrl({
+		...rest,
+		prompt: "login",
+		pushed: true,
+		params: {
+			...params,
+			synq_siws: siwsFromMwa(request, result)
+		}
+	});
+}
+//#endregion
+export { mobileWalletSignInUrl, siwsFromMwa };

package/dist/web.d.ts

@@ -0,0 +1,24 @@
+//#region src/web.d.ts
+/** The options `registerMwa` takes that this sets; the rest pass through. */
+export interface RegisterMwaOptions {
+  appIdentity: {
+    name?: string;
+    uri?: string;
+    icon?: string;
+  };
+  chains: readonly string[];
+  [option: string]: unknown;
+}
+/** What `registerMobileWallet` takes. */
+export interface RegisterMobileWalletOptions {
+  /** `registerMwa` from @solana-mobile/wallet-standard-mobile. */
+  registerMwa: (options: RegisterMwaOptions) => void;
+  appIdentity: RegisterMwaOptions['appIdentity'];
+  /** The chains it signs for: Synq's issuers name their stage's (`solana:devnet` on preview, `solana:mainnet` in production). */
+  chains?: readonly string[];
+  /** Anything else `registerMwa` takes, such as `authorizationCache` or `onWalletNotFound`. */
+  options?: Record<string, unknown>;
+}
+/** Registers Mobile Wallet Adapter as a wallet the page's discovery finds; does nothing off a browser. */
+export declare function registerMobileWallet(options: RegisterMobileWalletOptions): boolean;
+//#endregion

package/dist/web.js

@@ -0,0 +1,13 @@
+//#region src/web.ts
+/** Registers Mobile Wallet Adapter as a wallet the page's discovery finds; does nothing off a browser. */
+function registerMobileWallet(options) {
+	if (typeof globalThis.window !== "object") return false;
+	options.registerMwa({
+		...options.options,
+		appIdentity: options.appIdentity,
+		chains: options.chains ?? ["solana:mainnet", "solana:devnet"]
+	});
+	return true;
+}
+//#endregion
+export { registerMobileWallet };

package/package.json

@@ -1,6 +1,55 @@
 {
   "name": "@synqauth/solana-mobile",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.0.0",
+  "description": "Sign in to Synq with a Solana wallet app on Android, through Mobile Wallet Adapter.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/aerosol-build/synq.git",
+    "directory": "packages/solana-mobile"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=22"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./core": {
+      "types": "./dist/core.d.ts",
+      "default": "./dist/core.js"
+    },
+    "./react-native": {
+      "types": "./dist/react-native.d.ts",
+      "default": "./dist/react-native.js"
+    },
+    "./web": {
+      "types": "./dist/web.d.ts",
+      "default": "./dist/web.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@synqauth/js": "0.0.0",
+    "@synqauth/solana": "0.0.0"
+  },
+  "devDependencies": {
+    "@vitest/coverage-v8": "5.0.2",
+    "vitest": "5.0.2"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "lint": "eslint .",
+    "typecheck": "tsc",
+    "test": "vitest run --coverage"
+  }
 }