chore(release): develop -> main

.coverage-floor-lines

@@ -0,0 +1 @@
+99

.coverage-floors.json

@@ -0,0 +1,32 @@
+{
+  "_comment": [
+    "Per-file MINIMUM line coverage for Tier-A files: key derivation, wallet",
+    "seed/setup, signing, authentication, secure storage, biometric and the",
+    "hardware-wallet bridge and its BLE/USB transports. Enforced by",
+    "scripts/check-coverage-file-floors.mjs",
+    "(see ci.yml job `coverage-floor`).",
+    "",
+    "Why this exists on top of .coverage-floor-lines: the aggregate floor lets",
+    "a single security-critical file rot to 0% as long as the mean stays high.",
+    "These files are the ones where a regression loses funds or leaks keys, so",
+    "they are pinned individually at 100. Lowering any entry is a deliberate,",
+    "reviewable act — do not weaken a number to make a red build pass."
+  ],
+  "files": {
+    "src/features/passkey/services/key-derivation.ts": 100,
+    "src/features/passkey/services/setup-wallet.ts": 100,
+    "src/features/passkey/services/passkey-service.ts": 100,
+    "src/features/dfx-backend/services/auth-service.ts": 100,
+    "src/features/dfx-backend/services/jwt.ts": 100,
+    "src/features/dfx-backend/services/kyc-service.ts": 100,
+    "src/features/biometric/biometric.ts": 100,
+    "src/features/hardware-wallet/services/bitbox.ts": 100,
+    "src/features/hardware-wallet/services/transport-ble.ts": 100,
+    "src/features/hardware-wallet/services/transport-usb.ts": 100,
+    "src/services/wallet/seed.ts": 100,
+    "src/services/pin.ts": 100,
+    "src/services/storage.ts": 100,
+    "src/services/evm/signature.ts": 100,
+    "src/services/evm/address.ts": 100
+  }
+}

.detoxrc.js

@@ -4,12 +4,29 @@ module.exports = {
     args: {
       $0: 'jest',
       config: 'e2e/jest.config.js',
+      // The app (WDK worklet thread + balance/pricing timers) keeps the Node
+      // event loop alive, so jest can hang after the suite passes instead of
+      // exiting — intermittently on CI, which then burns the whole job to the
+      // timeout. Force-exit once the run (and teardown) is done.
+      forceExit: true,
     },
     jest: {
       setupTimeout: 120_000,
     },
   },
 
+  behavior: {
+    cleanup: {
+      // forceExit above only kills the jest child. The detox CLI parent then
+      // closes its ws server, but the app still running in the simulator holds
+      // its connection open, so the close callback never fires ("Detox server
+      // has been closed abruptly") and the leaked handle keeps the CLI alive
+      // until the CI job timeout. Shutting the device down drops the
+      // connection so the CLI can actually exit after a passing run.
+      shutdownDevice: true,
+    },
+  },
+
   apps: {
     'ios.debug': {
       type: 'ios.app',

.env.example

@@ -1,4 +1,92 @@
+# =============================================================================
+# Feature flags
+# =============================================================================
+# Build-time gates for every deferred (non-MVP) function. Each variable
+# is read in `src/config/features.ts` and compared against the literal
+# 'true' — Metro's dead-code elimination drops the unused branch from
+# the bundle when a flag is left off. Copy the lines you need into
+# `.env.local` (which is gitignored) and set them to `true` to enable
+# the feature in your local build.
+#
+# Default for every flag is OFF. The MVP build runs with none of these
+# set: Welcome → Create wallet → Dashboard → Receive / Send only.
+#
+# See the "Feature flags" table in README.md for what each flag gates.
+
+# Restore wallet from 12 / 24-word seed (incl. verify-seed quiz).
+EXPO_PUBLIC_ENABLE_RESTORE=
+
+# Create / restore wallet via WebAuthn Passkey (iOS 18+ / Android 14+).
+EXPO_PUBLIC_ENABLE_PASSKEY=
+
+# Legal disclaimer step in onboarding + Settings → Legal-documents launcher.
+EXPO_PUBLIC_ENABLE_LEGAL=
+
+# PIN setup + PIN unlock + auth gate around `(auth)/*` routes.
+EXPO_PUBLIC_ENABLE_PIN=
+
+# Biometric unlock (Face ID / Touch ID / fingerprint) + Settings toggle.
+EXPO_PUBLIC_ENABLE_BIOMETRIC=
+
+# Portfolio screen (local + linked wallets), asset detail, chain manage,
+# Hide-balance toggle, Dashboard portfolio pill.
+EXPO_PUBLIC_ENABLE_PORTFOLIO=
+
+# Buy (fiat on-ramp) + Sell (fiat off-ramp) flows.
+EXPO_PUBLIC_ENABLE_BUY_SELL=
+
+# Linked-wallet detail screen (per-address holdings + tx feed).
+EXPO_PUBLIC_ENABLE_LINKED_WALLETS=
+
+# Transaction history (list + detail).
+EXPO_PUBLIC_ENABLE_TX_HISTORY=
+
+# Pay (QR scan). Currently a placeholder that returns a coming-soon alert.
+EXPO_PUBLIC_ENABLE_PAY=
+
+# DFX backend integration: silent sign-in, e-mail login, auto-link,
+# linked-wallets management, KYC, user data, support, contact channels.
+# Many of the deferred features above are non-functional without this on
+# (e.g. Buy/Sell, Linked wallets), so flip this first when enabling them.
+EXPO_PUBLIC_ENABLE_DFX_BACKEND=
+
+# Tax report CSV export (CoinTracking et al.).
+EXPO_PUBLIC_ENABLE_TAX_REPORT=
+
+# Settings hub + screens it owns (language, currency, seed export,
+# delete wallet, screen-capture protection on the seed screen).
+EXPO_PUBLIC_ENABLE_SETTINGS=
+
+# BitBox02 hardware wallet pairing (USB + BLE + WASM bridge).
+EXPO_PUBLIC_ENABLE_HARDWARE_WALLET=
+
+# Multi-sig vault setup (local cosigner list, no on-chain signing yet).
+EXPO_PUBLIC_ENABLE_MULTISIG=
+
+# `dfxwallet://` deep-link handler.
+EXPO_PUBLIC_ENABLE_DEEPLINKS=
+
+# In-app WebView (KYC iframe + payment hand-off, gated by safe-url allow-list).
+EXPO_PUBLIC_ENABLE_WEBVIEW=
+
+# =============================================================================
+# Build-time configuration
+# =============================================================================
+# URLs / API keys / RPC overrides. Defaults are baked into
+# `src/config/chains.ts` / `src/config/env.ts`, so the app runs with
+# none of these set. Override only when pointing the build at a
+# private RPC / custom backend.
+
 EXPO_PUBLIC_DFX_API_URL=https://api.dfx.swiss/v1
+EXPO_PUBLIC_LDS_URL=
+EXPO_PUBLIC_ETHERSCAN_API_KEY=
 EXPO_PUBLIC_ETH_RPC_URL=
 EXPO_PUBLIC_ARBITRUM_RPC_URL=
 EXPO_PUBLIC_POLYGON_RPC_URL=
+EXPO_PUBLIC_BASE_RPC_URL=
+EXPO_PUBLIC_PLASMA_RPC_URL=
+EXPO_PUBLIC_SEPOLIA_RPC_URL=
+EXPO_PUBLIC_BTC_ELECTRUM_HOST=
+EXPO_PUBLIC_BTC_ELECTRUM_PORT=
+EXPO_PUBLIC_WDK_INDEXER_URL=
+EXPO_PUBLIC_WDK_INDEXER_API_KEY=

.env.testnet

@@ -13,6 +13,12 @@ EXPO_PUBLIC_DFX_API_URL=https://api.dfx.swiss/v1
 # TODO(testnet): replace with the real WDK testnet indexer once provisioned.
 EXPO_PUBLIC_WDK_INDEXER_URL=https://wdk-api.tether.io
 
+# Minimal WDK chain set for E2E. WDK inits every configured chain on first
+# wallet setup; the full set blows past the visual-regression onboard timeout
+# on a fresh CI simulator. The authenticated screens only need a wallet to
+# exist, so init just one EVM testnet + bitcoin. Unset = all chains (prod).
+EXPO_PUBLIC_WDK_CHAINS=sepolia,bitcoin
+
 # Chain RPCs — leave blank to fall through to the public defaults baked into
 # `src/config/chains.ts`. Override here if you want to point E2E at private
 # testnet RPCs.

.github/CODEOWNERS

@@ -0,0 +1,43 @@
+# Code owners for security-critical paths.
+#
+# Effective only once the develop/main rulesets enable
+# "require review from Code Owners" — see docs/security/roadmap.md (P0.6).
+# Until then this file still routes review requests automatically.
+#
+# Rationale (docs/security/roadmap.md, "Reviews"): any PR touching key
+# handling, signing, secure storage, the DFX backend client, dependency
+# manifests or CI itself needs a security-conscious review — enforced
+# here instead of by convention.
+
+# Key handling & signing
+/src/services/wallet/        @Danswar @davidleomay @TaprootFreak
+/src/services/security/      @Danswar @davidleomay @TaprootFreak
+/src/services/evm/           @Danswar @davidleomay @TaprootFreak
+/src/services/storage.ts     @Danswar @davidleomay @TaprootFreak
+/src/services/pin.ts         @Danswar @davidleomay @TaprootFreak
+/src/features/hardware-wallet/ @Danswar @davidleomay @TaprootFreak
+/src/features/passkey/       @Danswar @davidleomay @TaprootFreak
+/src/features/biometric/     @Danswar @davidleomay @TaprootFreak
+/src/features/pin/           @Danswar @davidleomay @TaprootFreak
+
+# Feature flags decide which security features are live
+/src/config/features.ts      @Danswar @davidleomay @TaprootFreak
+
+# Security-critical screens (seed export, PIN entry, onboarding/key creation)
+/app/(auth)/seed-export.tsx  @Danswar @davidleomay @TaprootFreak
+/app/(pin)/                  @Danswar @davidleomay @TaprootFreak
+/app/(onboarding)/           @Danswar @davidleomay @TaprootFreak
+
+# Backend trust boundary
+/src/features/dfx-backend/   @Danswar @davidleomay @TaprootFreak
+
+# Supply chain & build integrity
+/package.json                @Danswar @davidleomay @TaprootFreak
+/package-lock.json           @Danswar @davidleomay @TaprootFreak
+/plugins/                    @Danswar @davidleomay @TaprootFreak
+
+# CI and the gates themselves (a gate nobody guards is not a gate)
+/.github/                    @Danswar @davidleomay @TaprootFreak
+/scripts/                    @Danswar @davidleomay @TaprootFreak
+/.coverage-floor-lines       @Danswar @davidleomay @TaprootFreak
+/.coverage-floors.json       @Danswar @davidleomay @TaprootFreak

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,26 @@
+## What
+
+<!-- One or two sentences: what does this PR change, and why? -->
+
+## Feature matrix
+
+<!-- The README feature matrix is the source of truth (CI enforces it). -->
+
+- [ ] No user-facing function added/changed/removed — matrix untouched
+- [ ] Matrix row(s) updated in this PR: <!-- which row(s)? -->
+- [ ] New screen added → classified in `e2e/visual-coverage.json` (CI enforces it)
+
+## Tests
+
+- [ ] New/changed logic is covered (coverage floor must not drop — CI enforces it)
+- [ ] Touched a deferred feature: its test status in the matrix is still accurate
+
+## Security checklist (tick what applies)
+
+- [ ] Touches key handling, signing, secure storage, or the DFX client → code-owner review requested
+- [ ] No secret, seed, token, or PII is logged, persisted outside `expo-secure-store`, or sent to a third party
+- [ ] New dependency added → justified here: <!-- why is it needed, why this package? -->
+
+## How to verify
+
+<!-- Commands or steps a reviewer can run. -->

.github/dependabot.yml

@@ -11,10 +11,12 @@ updates:
     open-pull-requests-limit: 5
     labels:
       - dependencies
+    # `prefix` already carries the conventional-commit scope, so `include: scope`
+    # must stay off — together they produce a double scope ("chore(deps)(deps): …")
+    # that fails the pr-policy conventional-commit gate.
     commit-message:
       prefix: chore(deps)
       prefix-development: chore(deps-dev)
-      include: scope
 
   - package-ecosystem: github-actions
     directory: /
@@ -28,6 +30,6 @@ updates:
     labels:
       - dependencies
       - github-actions
+    # See note above: `prefix` carries the scope; `include: scope` would double it.
     commit-message:
       prefix: chore(ci)
-      include: scope

.github/workflows/auto-release-pr.yaml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 

.github/workflows/auto-tag.yaml

@@ -17,13 +17,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           fetch-tags: true
 
       - name: Setup SSH for Deploy Key
-        uses: webfactory/ssh-agent@v0.9.0
+        uses: webfactory/ssh-agent@v0.10.0
         with:
           ssh-private-key: ${{ secrets.TAG_DEPLOY_KEY }}
 

.github/workflows/beta-release-android.yaml

@@ -18,10 +18,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -30,7 +30,7 @@ jobs:
         run: npm ci
 
       - name: Setup EAS
-        uses: expo/expo-github-action@v8
+        uses: expo/expo-github-action@v9
         with:
           eas-version: latest
           token: ${{ secrets.EXPO_TOKEN }}

.github/workflows/beta-release-ios.yaml

@@ -18,10 +18,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -30,7 +30,7 @@ jobs:
         run: npm ci
 
       - name: Setup EAS
-        uses: expo/expo-github-action@v8
+        uses: expo/expo-github-action@v9
         with:
           eas-version: latest
           token: ${{ secrets.EXPO_TOKEN }}