From 88fbc7fe96f8543b90908fdbe76d5108fc8e9c21 Mon Sep 17 00:00:00 2001
From: Quantum Explorer <quantum@dash.org>
Date: Sat, 19 Sep 2026 01:08:39 +0700
Subject: [PATCH 1/2] feat(swift-sdk): share a bounded login key with a browser
 over Bluetooth

The wallet FFI identity-key row gains `total_budget` / `expires_at` (with
presence flags) so callers can register the protocol 14 limited keys; a row
carrying either becomes an `IdentityPublicKey::V1`, everything else stays V0.
The parsed identity-update projection carries the same fields. The Swift
`IdentityPubkey` model exposes `totalBudget` / `expiresAt`.

SwiftExampleApp adds "Share Login Key with Browser" under an identity's keys:
the phone advertises a BLE GATT service, shows a six-digit pairing code when
a browser writes its request, registers an AUTHENTICATION / HIGH HASH160 key
with the chosen budget and expiry (signed by the master key), and serves the
login key encrypted with the Yappr key-exchange envelope. The phone never
keeps the login key.

The Kotlin JNI decoder passes no limits, so Android behaviour is unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 packages/swift-sdk/SwiftExampleApp/Info.plist |   6 +
 .../Services/BrowserLoginKeyProtocol.swift    | 384 ++++++++++++++++++
 .../Services/BrowserLoginPeripheral.swift     | 215 ++++++++++
 .../Views/IdentityDetailView.swift            |  17 +
 .../Views/ShareLoginKeyView.swift             | 356 ++++++++++++++++
 .../BrowserLoginKeyProtocolTests.swift        | 166 ++++++++
 6 files changed, 1144 insertions(+)
 create mode 100644 packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Services/BrowserLoginKeyProtocol.swift
 create mode 100644 packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Services/BrowserLoginPeripheral.swift
 create mode 100644 packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/ShareLoginKeyView.swift
 create mode 100644 packages/swift-sdk/SwiftExampleApp/SwiftExampleAppTests/BrowserLoginKeyProtocolTests.swift

diff --git a/packages/swift-sdk/SwiftExampleApp/Info.plist b/packages/swift-sdk/SwiftExampleApp/Info.plist
index 0f71e153e0a..9093385615b 100644
--- a/packages/swift-sdk/SwiftExampleApp/Info.plist
+++ b/packages/swift-sdk/SwiftExampleApp/Info.plist
@@ -30,6 +30,12 @@
 	<key>NSCameraUsageDescription</key>
 	<string>The camera is used to scan Dash address QR codes.</string>
 
+	<!-- Bluetooth permission — "Share Login Key with Browser" advertises a
+	     Bluetooth LE service so a browser in range can receive a bounded
+	     identity key. -->
+	<key>NSBluetoothAlwaysUsageDescription</key>
+	<string>Bluetooth is used to hand a nearby browser a time- and spend-limited login key for your identity.</string>
+
 	<!-- Custom URL scheme for DashPay invitation deep links
 	     (dashpay://invite?du=…&assetlocktx=…&pk=…&islock=…). Opening such a link
 	     routes to the DashPay tab and pre-fills the claim sheet.
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Services/BrowserLoginKeyProtocol.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Services/BrowserLoginKeyProtocol.swift
new file mode 100644
index 00000000000..a19dec3b22f
--- /dev/null
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Services/BrowserLoginKeyProtocol.swift
@@ -0,0 +1,384 @@
+import CoreBluetooth
+import CryptoKit
+import Foundation
+import SwiftDashSDK
+
+/// The wire protocol a browser and this wallet speak over Bluetooth LE
+/// to hand the browser a bounded login key.
+///
+/// The browser is the GATT central, the phone the peripheral. The
+/// phone advertises `serviceUUID` with three characteristics:
+///
+///   - `requestCharacteristicUUID` (write): the browser writes one
+///     `BrowserLoginRequest`.
+///   - `statusCharacteristicUUID` (read + notify): one `Status` byte
+///     the phone updates as it moves through the flow.
+///   - `responseCharacteristicUUID` (read): the `BrowserLoginResponse`
+///     once `Status.ready` is signalled, empty before that.
+///
+/// The cryptography is byte-for-byte the Yappr key-exchange envelope
+/// that the `dash-key:` QR flow already uses, so the browser decrypts
+/// a Bluetooth response with the same code as an on-chain
+/// `loginKeyResponse` document:
+///
+///   sharedX  = ECDH(walletEphemeralPriv, appEphemeralPub).x
+///   key      = HKDF-SHA256(ikm: sharedX, salt: "dash:key-exchange:v1", info: "", 32)
+///   payload  = AES-256-GCM(key, nonce(12)) over loginKey(32) → nonce || ciphertext || tag (60 bytes)
+///   authPriv = HKDF-SHA256(ikm: loginKey, salt: identityId, info: "auth", 32)
+///
+/// The identity key the phone registers for the browser is
+/// `ECDSA_HASH160(authPub)`, AUTHENTICATION / HIGH, with the budget
+/// and expiry the user chose. The phone never keeps `loginKey`.
+enum BrowserLoginKeyProtocol {
+    /// Protocol version carried by both the request and the response.
+    static let version: UInt8 = 1
+
+    static let serviceUUIDString = "8f9a3e10-5c2b-4d6e-9f1a-2b3c4d5e6f01"
+    static let requestCharacteristicUUIDString = "8f9a3e10-5c2b-4d6e-9f1a-2b3c4d5e6f02"
+    static let statusCharacteristicUUIDString = "8f9a3e10-5c2b-4d6e-9f1a-2b3c4d5e6f03"
+    static let responseCharacteristicUUIDString = "8f9a3e10-5c2b-4d6e-9f1a-2b3c4d5e6f04"
+
+    // `CBUUID` is not Sendable, so the constants above are the strings
+    // and these build a fresh value per use.
+    static var serviceUUID: CBUUID { CBUUID(string: serviceUUIDString) }
+    static var requestCharacteristicUUID: CBUUID { CBUUID(string: requestCharacteristicUUIDString) }
+    static var statusCharacteristicUUID: CBUUID { CBUUID(string: statusCharacteristicUUIDString) }
+    static var responseCharacteristicUUID: CBUUID { CBUUID(string: responseCharacteristicUUIDString) }
+
+    /// Longest app label the request may carry, in UTF-8 bytes.
+    static let maxLabelLength = 64
+
+    /// Salt of the HKDF step that turns the ECDH x-coordinate into the
+    /// AES key. Shared with the QR flow, hence the unversioned name.
+    static let sharedSecretSalt = Data("dash:key-exchange:v1".utf8)
+
+    /// Value of the status characteristic.
+    enum Status: UInt8 {
+        /// Advertising, no request received yet.
+        case idle = 0
+        /// A request arrived and the user is being asked to confirm it.
+        case awaitingConfirmation = 1
+        /// The user confirmed; the key is being registered on Platform.
+        case registering = 2
+        /// The response characteristic holds the encrypted login key.
+        case ready = 3
+        /// The user declined the request.
+        case rejected = 4
+        /// The request was malformed, for another network, or the
+        /// registration failed.
+        case failed = 5
+    }
+
+    /// The network a request is for, as the single ASCII byte the
+    /// `dash-key:` URI uses in its `n=` parameter.
+    enum NetworkTag: UInt8 {
+        case mainnet = 0x6d  // "m"
+        case testnet = 0x74  // "t"
+        case devnet = 0x64  // "d"
+
+        init?(network: Network) {
+            switch network {
+            case .mainnet: self = .mainnet
+            case .testnet: self = .testnet
+            case .devnet: self = .devnet
+            case .regtest: return nil
+            }
+        }
+
+        var network: Network {
+            switch self {
+            case .mainnet: return .mainnet
+            case .testnet: return .testnet
+            case .devnet: return .devnet
+            }
+        }
+    }
+
+    enum ProtocolError: LocalizedError, Equatable {
+        case truncatedRequest
+        case unsupportedVersion(UInt8)
+        case unknownNetwork(UInt8)
+        case invalidEphemeralPublicKey
+        case labelNotUTF8
+        case labelTooLong(Int)
+        case invalidIdentityId
+        case randomnessUnavailable
+        case ephemeralKeyGenerationFailed
+
+        var errorDescription: String? {
+            switch self {
+            case .truncatedRequest:
+                return "The browser's request was shorter than the protocol requires."
+            case .unsupportedVersion(let version):
+                return "The browser spoke protocol version \(version); this wallet only speaks version \(BrowserLoginKeyProtocol.version)."
+            case .unknownNetwork(let tag):
+                return "The browser asked for an unknown network (tag \(tag))."
+            case .invalidEphemeralPublicKey:
+                return "The browser's ephemeral public key is not a valid secp256k1 point."
+            case .labelNotUTF8:
+                return "The app label is not valid UTF-8."
+            case .labelTooLong(let length):
+                return "The app label is \(length) bytes; at most \(BrowserLoginKeyProtocol.maxLabelLength) are allowed."
+            case .invalidIdentityId:
+                return "The identity id must be 32 bytes."
+            case .randomnessUnavailable:
+                return "The system random number generator was unavailable."
+            case .ephemeralKeyGenerationFailed:
+                return "Could not generate a valid ephemeral secp256k1 key."
+            }
+        }
+    }
+
+    // MARK: - Request
+
+    /// What the browser writes to the request characteristic:
+    ///
+    ///     version(1) || network(1) || appEphemeralPubKey(33) || contractId(32) || labelLen(1) || label(labelLen)
+    struct BrowserLoginRequest: Equatable {
+        static let minimumLength = 1 + 1 + 33 + 32 + 1
+
+        let network: NetworkTag
+        /// Compressed secp256k1 point the wallet does ECDH against.
+        let appEphemeralPublicKey: Data
+        /// The application contract the login is for.
+        let contractId: Data
+        /// Human-readable name the browser gave itself, e.g. "Login to Yappr".
+        let label: String
+
+        static func parse(_ bytes: Data) throws -> BrowserLoginRequest {
+            guard bytes.count >= minimumLength else {
+                throw ProtocolError.truncatedRequest
+            }
+            var cursor = bytes.startIndex
+            let version = bytes[cursor]
+            cursor += 1
+            guard version == BrowserLoginKeyProtocol.version else {
+                throw ProtocolError.unsupportedVersion(version)
+            }
+            guard let network = NetworkTag(rawValue: bytes[cursor]) else {
+                throw ProtocolError.unknownNetwork(bytes[cursor])
+            }
+            cursor += 1
+            let appEphemeralPublicKey = Data(bytes[cursor..<cursor + 33])
+            cursor += 33
+            guard Secp256k1Primitives.isValidCompressedPoint(appEphemeralPublicKey) else {
+                throw ProtocolError.invalidEphemeralPublicKey
+            }
+            let contractId = Data(bytes[cursor..<cursor + 32])
+            cursor += 32
+            let labelLength = Int(bytes[cursor])
+            cursor += 1
+            guard labelLength <= maxLabelLength else {
+                throw ProtocolError.labelTooLong(labelLength)
+            }
+            guard bytes.endIndex - cursor >= labelLength else {
+                throw ProtocolError.truncatedRequest
+            }
+            guard let label = String(data: bytes[cursor..<cursor + labelLength], encoding: .utf8) else {
+                throw ProtocolError.labelNotUTF8
+            }
+            return BrowserLoginRequest(
+                network: network,
+                appEphemeralPublicKey: appEphemeralPublicKey,
+                contractId: contractId,
+                label: label
+            )
+        }
+
+        func serialized() throws -> Data {
+            let labelBytes = Data(label.utf8)
+            guard labelBytes.count <= maxLabelLength else {
+                throw ProtocolError.labelTooLong(labelBytes.count)
+            }
+            var out = Data()
+            out.append(BrowserLoginKeyProtocol.version)
+            out.append(network.rawValue)
+            out.append(appEphemeralPublicKey)
+            out.append(contractId)
+            out.append(UInt8(labelBytes.count))
+            out.append(labelBytes)
+            return out
+        }
+
+        /// Six decimal digits both sides derive from the browser's
+        /// ephemeral public key. The browser shows them, the user checks
+        /// the phone shows the same ones before confirming, which rules
+        /// out a third radio in range answering the browser's request.
+        var pairingCode: String {
+            BrowserLoginKeyProtocol.pairingCode(for: appEphemeralPublicKey)
+        }
+    }
+
+    static func pairingCode(for appEphemeralPublicKey: Data) -> String {
+        let digest = hash160(appEphemeralPublicKey)
+        let value = digest.prefix(4).reduce(UInt32(0)) { ($0 << 8) | UInt32($1) }
+        return String(format: "%06d", value % 1_000_000)
+    }
+
+    /// RIPEMD160(SHA256(data)), the identity-key hash Platform uses.
+    static func hash160(_ data: Data) -> Data {
+        Data(hexString: SwiftDashSDK.KeychainManager.computePublicKeyHashHex(data)) ?? Data()
+    }
+
+    // MARK: - Response
+
+    /// What the phone exposes on the response characteristic:
+    ///
+    ///     version(1) || identityId(32) || walletEphemeralPubKey(33) || encryptedPayload(60)
+    ///     || keyId(4, big endian) || expiresAt(8, big endian, 0 = none) || totalBudget(8, big endian, 0 = none)
+    struct BrowserLoginResponse: Equatable {
+        static let length = 1 + 32 + 33 + 60 + 4 + 8 + 8
+
+        let identityId: Data
+        let walletEphemeralPublicKey: Data
+        /// nonce(12) || ciphertext(32) || tag(16)
+        let encryptedPayload: Data
+        /// Id of the key the phone registered on the identity.
+        let keyId: UInt32
+        /// Block time in milliseconds from which the key can no longer sign.
+        let expiresAt: UInt64?
+        /// Lifetime spend cap of the key in credits.
+        let totalBudget: UInt64?
+
+        func serialized() -> Data {
+            var out = Data(capacity: Self.length)
+            out.append(BrowserLoginKeyProtocol.version)
+            out.append(identityId)
+            out.append(walletEphemeralPublicKey)
+            out.append(encryptedPayload)
+            out.append(bigEndian: keyId)
+            out.append(bigEndian: expiresAt ?? 0)
+            out.append(bigEndian: totalBudget ?? 0)
+            return out
+        }
+
+        static func parse(_ bytes: Data) throws -> BrowserLoginResponse {
+            guard bytes.count == length else { throw ProtocolError.truncatedRequest }
+            var cursor = bytes.startIndex
+            guard bytes[cursor] == BrowserLoginKeyProtocol.version else {
+                throw ProtocolError.unsupportedVersion(bytes[cursor])
+            }
+            cursor += 1
+            let identityId = Data(bytes[cursor..<cursor + 32])
+            cursor += 32
+            let walletEphemeralPublicKey = Data(bytes[cursor..<cursor + 33])
+            cursor += 33
+            let encryptedPayload = Data(bytes[cursor..<cursor + 60])
+            cursor += 60
+            let keyId = Data(bytes[cursor..<cursor + 4]).reduce(UInt32(0)) { ($0 << 8) | UInt32($1) }
+            cursor += 4
+            let expiresAt = Data(bytes[cursor..<cursor + 8]).reduce(UInt64(0)) { ($0 << 8) | UInt64($1) }
+            cursor += 8
+            let totalBudget = Data(bytes[cursor..<cursor + 8]).reduce(UInt64(0)) { ($0 << 8) | UInt64($1) }
+            return BrowserLoginResponse(
+                identityId: identityId,
+                walletEphemeralPublicKey: walletEphemeralPublicKey,
+                encryptedPayload: encryptedPayload,
+                keyId: keyId,
+                expiresAt: expiresAt == 0 ? nil : expiresAt,
+                totalBudget: totalBudget == 0 ? nil : totalBudget
+            )
+        }
+    }
+
+    // MARK: - Key material
+
+    /// A fresh 32-byte login key, the secret the browser receives.
+    static func generateLoginKey() throws -> Data {
+        try randomBytes(32)
+    }
+
+    /// A fresh secp256k1 keypair for one ECDH exchange.
+    static func generateEphemeralKeyPair() throws -> (privateKey: Data, publicKey: Data) {
+        // A random 32-byte string is outside the curve order with
+        // probability ~2^-128, so one retry loop is plenty.
+        for _ in 0..<8 {
+            let privateKey = try randomBytes(32)
+            if let publicKey = try? Secp256k1Primitives.compressedPublicKey(privateKey: privateKey) {
+                return (privateKey, publicKey)
+            }
+        }
+        throw ProtocolError.ephemeralKeyGenerationFailed
+    }
+
+    /// The private key of the AUTHENTICATION identity key the browser
+    /// will derive from `loginKey`: `HKDF-SHA256(ikm: loginKey, salt: identityId, info: "auth")`.
+    static func deriveAuthPrivateKey(loginKey: Data, identityId: Data) throws -> Data {
+        guard identityId.count == 32 else { throw ProtocolError.invalidIdentityId }
+        let key = HKDF<SHA256>.deriveKey(
+            inputKeyMaterial: SymmetricKey(data: loginKey),
+            salt: identityId,
+            info: Data("auth".utf8),
+            outputByteCount: 32
+        )
+        return key.withUnsafeBytes { Data($0) }
+    }
+
+    /// The AES-256-GCM key both sides derive from the ECDH x-coordinate.
+    static func deriveSharedKey(sharedX: Data) -> SymmetricKey {
+        HKDF<SHA256>.deriveKey(
+            inputKeyMaterial: SymmetricKey(data: sharedX),
+            salt: sharedSecretSalt,
+            info: Data(),
+            outputByteCount: 32
+        )
+    }
+
+    /// Encrypt `loginKey` for the browser: nonce(12) || ciphertext(32) || tag(16).
+    static func seal(
+        loginKey: Data,
+        walletEphemeralPrivateKey: Data,
+        appEphemeralPublicKey: Data
+    ) throws -> Data {
+        let sharedX = try Secp256k1Primitives.ecdhSharedX(
+            privateKey: walletEphemeralPrivateKey,
+            publicKey: appEphemeralPublicKey
+        )
+        let key = deriveSharedKey(sharedX: sharedX)
+        let box = try AES.GCM.seal(loginKey, using: key)
+        guard let combined = box.combined else {
+            // Only a non-standard nonce size yields nil, and AES.GCM.seal
+            // picks the standard 12 bytes when no nonce is passed.
+            throw ProtocolError.ephemeralKeyGenerationFailed
+        }
+        return combined
+    }
+
+    /// The browser's side of `seal`, here so tests can round-trip and so
+    /// a wallet-to-wallet transfer could reuse it.
+    static func open(
+        encryptedPayload: Data,
+        appEphemeralPrivateKey: Data,
+        walletEphemeralPublicKey: Data
+    ) throws -> Data {
+        let sharedX = try Secp256k1Primitives.ecdhSharedX(
+            privateKey: appEphemeralPrivateKey,
+            publicKey: walletEphemeralPublicKey
+        )
+        let key = deriveSharedKey(sharedX: sharedX)
+        let box = try AES.GCM.SealedBox(combined: encryptedPayload)
+        return try AES.GCM.open(box, using: key)
+    }
+
+    static func randomBytes(_ count: Int) throws -> Data {
+        var bytes = [UInt8](repeating: 0, count: count)
+        let status = bytes.withUnsafeMutableBufferPointer { buffer -> Int32 in
+            guard let base = buffer.baseAddress else { return errSecParam }
+            return SecRandomCopyBytes(kSecRandomDefault, buffer.count, base)
+        }
+        guard status == errSecSuccess else { throw ProtocolError.randomnessUnavailable }
+        return Data(bytes)
+    }
+}
+
+private extension Data {
+    mutating func append(bigEndian value: UInt32) {
+        var be = value.bigEndian
+        Swift.withUnsafeBytes(of: &be) { append(contentsOf: $0) }
+    }
+
+    mutating func append(bigEndian value: UInt64) {
+        var be = value.bigEndian
+        Swift.withUnsafeBytes(of: &be) { append(contentsOf: $0) }
+    }
+}
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Services/BrowserLoginPeripheral.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Services/BrowserLoginPeripheral.swift
new file mode 100644
index 00000000000..f5d7ad12d91
--- /dev/null
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Services/BrowserLoginPeripheral.swift
@@ -0,0 +1,215 @@
+import CoreBluetooth
+import Foundation
+
+/// The Bluetooth LE peripheral a browser connects to for a login key.
+///
+/// Owns the `CBPeripheralManager`, publishes the
+/// `BrowserLoginKeyProtocol` service, reassembles the browser's
+/// request write, and serves the status and response characteristics.
+/// Everything the UI needs is pushed through `@Published` state on the
+/// main actor; the flow decisions (confirm, register, deliver) stay in
+/// the view model so this class knows nothing about identities.
+@MainActor
+final class BrowserLoginPeripheral: NSObject, ObservableObject {
+    enum RadioState: Equatable {
+        case unknown
+        case unauthorized
+        case poweredOff
+        case unsupported
+        case poweredOn
+        case advertising
+    }
+
+    @Published private(set) var radioState: RadioState = .unknown
+    @Published private(set) var status: BrowserLoginKeyProtocol.Status = .idle
+    @Published private(set) var lastError: String?
+
+    /// Called on the main actor with each complete request write.
+    var onRequest: ((Data) -> Void)?
+
+    private var manager: CBPeripheralManager?
+    private var service: CBMutableService?
+    private var statusCharacteristic: CBMutableCharacteristic?
+    private var responseCharacteristic: CBMutableCharacteristic?
+    private var responseBytes = Data()
+    /// Whether `start()` was called and the service should go up as
+    /// soon as the radio reports powered on.
+    private var wantsAdvertising = false
+
+    private let localName: String
+
+    init(localName: String) {
+        self.localName = localName
+        super.init()
+    }
+
+    /// Bring the radio up and advertise the service once it is ready.
+    func start() {
+        wantsAdvertising = true
+        lastError = nil
+        if manager == nil {
+            // A nil queue delivers delegate callbacks on the main queue,
+            // which is what the @MainActor isolation of this class expects.
+            manager = CBPeripheralManager(delegate: self, queue: nil)
+        } else {
+            publishIfReady()
+        }
+    }
+
+    /// Stop advertising and tear the service down. The response bytes
+    /// are wiped so a later connection cannot read a stale key.
+    func stop() {
+        wantsAdvertising = false
+        responseBytes.resetBytes(in: 0..<responseBytes.count)
+        responseBytes = Data()
+        manager?.stopAdvertising()
+        manager?.removeAllServices()
+        service = nil
+        statusCharacteristic = nil
+        responseCharacteristic = nil
+        if radioState == .advertising {
+            radioState = .poweredOn
+        }
+    }
+
+    /// Update the status byte and notify a subscribed browser.
+    func setStatus(_ status: BrowserLoginKeyProtocol.Status) {
+        self.status = status
+        guard let manager, let statusCharacteristic else { return }
+        _ = manager.updateValue(
+            Data([status.rawValue]),
+            for: statusCharacteristic,
+            onSubscribedCentrals: nil
+        )
+    }
+
+    /// Expose the encrypted response and flip the status to `ready`.
+    func deliver(response: Data) {
+        responseBytes = response
+        setStatus(.ready)
+    }
+
+    private func publishIfReady() {
+        guard wantsAdvertising, let manager, manager.state == .poweredOn, service == nil else { return }
+
+        let request = CBMutableCharacteristic(
+            type: BrowserLoginKeyProtocol.requestCharacteristicUUID,
+            properties: [.write],
+            value: nil,
+            permissions: [.writeable]
+        )
+        let statusChar = CBMutableCharacteristic(
+            type: BrowserLoginKeyProtocol.statusCharacteristicUUID,
+            properties: [.read, .notify],
+            value: nil,
+            permissions: [.readable]
+        )
+        let response = CBMutableCharacteristic(
+            type: BrowserLoginKeyProtocol.responseCharacteristicUUID,
+            properties: [.read],
+            value: nil,
+            permissions: [.readable]
+        )
+        let service = CBMutableService(type: BrowserLoginKeyProtocol.serviceUUID, primary: true)
+        service.characteristics = [request, statusChar, response]
+
+        self.service = service
+        self.statusCharacteristic = statusChar
+        self.responseCharacteristic = response
+        manager.add(service)
+    }
+
+    private func handle(writes requests: [CBATTRequest]) {
+        guard let manager, let first = requests.first else { return }
+        // A write longer than the ATT MTU arrives as several prepared
+        // writes with increasing offsets, delivered together. Stitch
+        // them back into one buffer before parsing.
+        var assembled = Data()
+        for request in requests.sorted(by: { $0.offset < $1.offset }) {
+            guard request.characteristic.uuid == BrowserLoginKeyProtocol.requestCharacteristicUUID else {
+                manager.respond(to: first, withResult: .writeNotPermitted)
+                return
+            }
+            guard request.offset == assembled.count, let chunk = request.value else {
+                manager.respond(to: first, withResult: .invalidOffset)
+                return
+            }
+            assembled.append(chunk)
+        }
+        manager.respond(to: first, withResult: .success)
+        onRequest?(assembled)
+    }
+
+    private func handle(read request: CBATTRequest) {
+        guard let manager else { return }
+        let bytes: Data
+        switch request.characteristic.uuid {
+        case BrowserLoginKeyProtocol.statusCharacteristicUUID:
+            bytes = Data([status.rawValue])
+        case BrowserLoginKeyProtocol.responseCharacteristicUUID:
+            bytes = responseBytes
+        default:
+            manager.respond(to: request, withResult: .readNotPermitted)
+            return
+        }
+        guard request.offset <= bytes.count else {
+            manager.respond(to: request, withResult: .invalidOffset)
+            return
+        }
+        request.value = bytes.subdata(in: request.offset..<bytes.count)
+        manager.respond(to: request, withResult: .success)
+    }
+}
+
+// The manager was created with a nil queue, so CoreBluetooth calls these
+// on the main queue. The `@preconcurrency` conformance keeps the methods
+// main-actor isolated (checked at runtime) so the non-Sendable manager
+// and ATT requests can be used in place.
+extension BrowserLoginPeripheral: @preconcurrency CBPeripheralManagerDelegate {
+    func peripheralManagerDidUpdateState(_ peripheral: CBPeripheralManager) {
+        switch peripheral.state {
+        case .poweredOn:
+            radioState = .poweredOn
+            publishIfReady()
+        case .poweredOff:
+            radioState = .poweredOff
+        case .unauthorized:
+            radioState = .unauthorized
+        case .unsupported:
+            radioState = .unsupported
+        default:
+            radioState = .unknown
+        }
+    }
+
+    func peripheralManager(
+        _ peripheral: CBPeripheralManager,
+        didAdd service: CBService,
+        error: Error?
+    ) {
+        if let error {
+            lastError = "Could not publish the Bluetooth service: \(error.localizedDescription)"
+            return
+        }
+        peripheral.startAdvertising([
+            CBAdvertisementDataServiceUUIDsKey: [BrowserLoginKeyProtocol.serviceUUID],
+            CBAdvertisementDataLocalNameKey: localName,
+        ])
+    }
+
+    func peripheralManagerDidStartAdvertising(_ peripheral: CBPeripheralManager, error: Error?) {
+        if let error {
+            lastError = "Could not start advertising: \(error.localizedDescription)"
+        } else {
+            radioState = .advertising
+        }
+    }
+
+    func peripheralManager(_ peripheral: CBPeripheralManager, didReceiveRead request: CBATTRequest) {
+        handle(read: request)
+    }
+
+    func peripheralManager(_ peripheral: CBPeripheralManager, didReceiveWrite requests: [CBATTRequest]) {
+        handle(writes: requests)
+    }
+}
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/IdentityDetailView.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/IdentityDetailView.swift
index edc3ed10dbf..95f8479e58c 100644
--- a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/IdentityDetailView.swift
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/IdentityDetailView.swift
@@ -387,6 +387,23 @@ struct IdentityDetailView: View {
                     }
                     .padding(.vertical, 4)
                 }
+
+                // Bluetooth login-key sharing needs the wallet's
+                // MASTER key to sign the key registration, so it is
+                // only offered when the owning wallet is loaded.
+                if hasLoadedWallet(for: identity) {
+                    NavigationLink(destination: ShareLoginKeyView(identity: identity)
+                        .environmentObject(appState)
+                        .environmentObject(walletManager)
+                    ) {
+                        HStack {
+                            Image(systemName: "antenna.radiowaves.left.and.right")
+                            Text("Share Login Key with Browser")
+                                .fontWeight(.medium)
+                        }
+                        .padding(.vertical, 4)
+                    }
+                }
             }
 
             // Actions Section
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/ShareLoginKeyView.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/ShareLoginKeyView.swift
new file mode 100644
index 00000000000..2205dd5da4f
--- /dev/null
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/ShareLoginKeyView.swift
@@ -0,0 +1,356 @@
+import SwiftData
+import SwiftDashSDK
+import SwiftUI
+
+/// Hand a browser a bounded login key over Bluetooth LE.
+///
+/// The user picks how long the key lives and how many credits it may
+/// spend, the phone advertises the `BrowserLoginKeyProtocol` service,
+/// and once a browser writes its request the user compares the pairing
+/// code on both screens and confirms. The phone then:
+///
+///   1. draws a random login key and derives the AUTHENTICATION key
+///      the browser will use from it (`HKDF(loginKey, identityId, "auth")`),
+///   2. registers `ECDSA_HASH160(authPub)` as a HIGH key carrying the
+///      chosen `totalBudget` and `expiresAt` through
+///      `wallet.updateIdentity(addPublicKeys:)`, signed by the
+///      identity's MASTER key from the Keychain,
+///   3. encrypts the login key to the browser's ephemeral public key
+///      and exposes it on the response characteristic.
+///
+/// The login key is never stored on the phone: it exists only in this
+/// view's memory until the response is served, and the identity key it
+/// controls can only sign Batch transitions within its budget until it
+/// expires. A HASH160 key needs no ownership proof, which is why the
+/// phone can register a key whose private half it never keeps.
+struct ShareLoginKeyView: View {
+    let identity: PersistentIdentity
+
+    @EnvironmentObject var appState: AppState
+    @EnvironmentObject var walletManager: PlatformWalletManager
+    @Environment(\.modelContext) private var modelContext
+    @Environment(\.dismiss) private var dismiss
+
+    @StateObject private var peripheral = BrowserLoginPeripheral(localName: "Dash Wallet")
+
+    enum Phase: Equatable {
+        case configuring
+        case advertising
+        case awaitingConfirmation
+        case registering
+        case delivered
+        case failed(String)
+    }
+
+    /// How long the browser's key stays valid.
+    enum Lifetime: String, CaseIterable, Identifiable {
+        case oneHour = "1 hour"
+        case oneDay = "24 hours"
+        case oneWeek = "7 days"
+        case oneMonth = "30 days"
+
+        var id: String { rawValue }
+
+        var seconds: TimeInterval {
+            switch self {
+            case .oneHour: return 3_600
+            case .oneDay: return 86_400
+            case .oneWeek: return 7 * 86_400
+            case .oneMonth: return 30 * 86_400
+            }
+        }
+    }
+
+    /// How many credits the browser's key may spend in total.
+    enum Budget: String, CaseIterable, Identifiable {
+        case milliDash = "0.001 DASH"
+        case centiDash = "0.01 DASH"
+        case deciDash = "0.1 DASH"
+        case oneDash = "1 DASH"
+
+        var id: String { rawValue }
+
+        /// 1 DASH = 100 000 000 duffs = 100 000 000 000 credits.
+        var credits: UInt64 {
+            switch self {
+            case .milliDash: return 100_000_000
+            case .centiDash: return 1_000_000_000
+            case .deciDash: return 10_000_000_000
+            case .oneDash: return 100_000_000_000
+            }
+        }
+    }
+
+    @State private var phase: Phase = .configuring
+    @State private var lifetime: Lifetime = .oneDay
+    @State private var budget: Budget = .centiDash
+    @State private var request: BrowserLoginKeyProtocol.BrowserLoginRequest?
+    @State private var registeredKeyId: UInt32?
+
+    var body: some View {
+        Form {
+            Section("Identity") {
+                LabeledContent("Identity", value: identity.alias ?? identity.dpnsName ?? shortId(identity.identityId))
+                LabeledContent("Balance", value: identity.formattedBalance)
+            }
+
+            Section {
+                Picker("Valid for", selection: $lifetime) {
+                    ForEach(Lifetime.allCases) { Text($0.rawValue).tag($0) }
+                }
+                Picker("Spend limit", selection: $budget) {
+                    ForEach(Budget.allCases) { Text($0.rawValue).tag($0) }
+                }
+            } header: {
+                Text("Limits")
+            } footer: {
+                Text("The browser gets its own authentication key. Platform refuses anything it signs after the key expires or once it has spent its limit, and the key can never change your identity's keys.")
+            }
+            .disabled(phase != .configuring)
+
+            Section("Bluetooth") {
+                switch phase {
+                case .configuring:
+                    Button {
+                        startAdvertising()
+                    } label: {
+                        Label("Start sharing", systemImage: "antenna.radiowaves.left.and.right")
+                    }
+                    .disabled(!hasLoadedWallet || !hasMasterKey)
+                    if !hasLoadedWallet {
+                        Text("This identity's wallet is not loaded, so the phone cannot sign the key registration.")
+                            .font(.caption)
+                            .foregroundColor(.secondary)
+                    } else if !hasMasterKey {
+                        Text("This identity has no MASTER key on the phone, so it cannot add keys.")
+                            .font(.caption)
+                            .foregroundColor(.secondary)
+                    }
+                case .advertising:
+                    HStack {
+                        ProgressView()
+                        Text(radioText)
+                    }
+                    Text("In the browser, choose “Sign in with phone” and pick “Dash Wallet” from the Bluetooth list.")
+                        .font(.caption)
+                        .foregroundColor(.secondary)
+                case .awaitingConfirmation:
+                    if let request {
+                        LabeledContent("App", value: request.label)
+                        LabeledContent("Contract", value: shortId(request.contractId))
+                        LabeledContent("Network", value: String(describing: request.network.network))
+                        VStack(alignment: .leading, spacing: 8) {
+                            Text("Pairing code")
+                                .font(.caption)
+                                .foregroundColor(.secondary)
+                            Text(request.pairingCode)
+                                .font(.system(.largeTitle, design: .monospaced))
+                                .fontWeight(.bold)
+                            Text("Only confirm if the browser shows the same six digits.")
+                                .font(.caption)
+                                .foregroundColor(.secondary)
+                        }
+                        Button {
+                            Task { await confirmAndRegister() }
+                        } label: {
+                            Label("Share a \(lifetime.rawValue) key limited to \(budget.rawValue)", systemImage: "checkmark.shield")
+                        }
+                        Button(role: .destructive) {
+                            reject()
+                        } label: {
+                            Label("Decline", systemImage: "xmark")
+                        }
+                    }
+                case .registering:
+                    HStack {
+                        ProgressView()
+                        Text("Registering the key on Platform…")
+                    }
+                case .delivered:
+                    Label("Login key delivered", systemImage: "checkmark.circle.fill")
+                        .foregroundColor(.green)
+                    if let registeredKeyId {
+                        LabeledContent("Key id", value: "\(registeredKeyId)")
+                    }
+                    Text("The browser can now sign in. You can disable the key early from the key list.")
+                        .font(.caption)
+                        .foregroundColor(.secondary)
+                    Button("Done") { dismiss() }
+                case .failed(let message):
+                    Label(message, systemImage: "exclamationmark.triangle")
+                        .foregroundColor(.red)
+                    Button("Try again") {
+                        request = nil
+                        phase = .configuring
+                        peripheral.stop()
+                    }
+                }
+            }
+
+            if let error = peripheral.lastError {
+                Section {
+                    Text(error).foregroundColor(.red)
+                }
+            }
+        }
+        .navigationTitle("Share Login Key")
+        .navigationBarTitleDisplayMode(.inline)
+        .onAppear {
+            peripheral.onRequest = { bytes in handle(requestBytes: bytes) }
+        }
+        .onDisappear {
+            peripheral.stop()
+        }
+    }
+
+    // MARK: - Derived state
+
+    private var hasLoadedWallet: Bool {
+        guard let walletId = identity.wallet?.walletId else { return false }
+        return walletManager.wallet(for: walletId) != nil
+    }
+
+    private var hasMasterKey: Bool {
+        identity.identityPublicKeys.contains {
+            $0.purpose == .authentication && $0.securityLevel == .master && $0.disabledAt == nil
+        }
+    }
+
+    private var radioText: String {
+        switch peripheral.radioState {
+        case .advertising: return "Waiting for a browser…"
+        case .poweredOn: return "Publishing the service…"
+        case .poweredOff: return "Bluetooth is off."
+        case .unauthorized: return "Bluetooth permission was denied."
+        case .unsupported: return "This device has no Bluetooth LE."
+        case .unknown: return "Starting Bluetooth…"
+        }
+    }
+
+    private func shortId(_ id: Data) -> String {
+        let base58 = id.toBase58String()
+        guard base58.count > 12 else { return base58 }
+        return "\(base58.prefix(6))…\(base58.suffix(6))"
+    }
+
+    // MARK: - Flow
+
+    private func startAdvertising() {
+        phase = .advertising
+        peripheral.start()
+    }
+
+    private func handle(requestBytes: Data) {
+        guard phase == .advertising else { return }
+        do {
+            let parsed = try BrowserLoginKeyProtocol.BrowserLoginRequest.parse(requestBytes)
+            guard parsed.network.network == identity.network else {
+                peripheral.setStatus(.failed)
+                phase = .failed("The browser asked for \(parsed.network.network) but this identity lives on \(identity.network).")
+                return
+            }
+            request = parsed
+            phase = .awaitingConfirmation
+            peripheral.setStatus(.awaitingConfirmation)
+        } catch {
+            peripheral.setStatus(.failed)
+            phase = .failed(error.localizedDescription)
+        }
+    }
+
+    private func reject() {
+        peripheral.setStatus(.rejected)
+        request = nil
+        phase = .configuring
+        peripheral.stop()
+    }
+
+    @MainActor
+    private func confirmAndRegister() async {
+        guard let request else { return }
+        guard let walletId = identity.wallet?.walletId,
+              let wallet = walletManager.wallet(for: walletId) else {
+            fail("Wallet not loaded in the wallet manager.")
+            return
+        }
+
+        phase = .registering
+        peripheral.setStatus(.registering)
+
+        var loginKey = Data()
+        var walletEphemeralPrivateKey = Data()
+        defer {
+            loginKey.resetBytes(in: 0..<loginKey.count)
+            walletEphemeralPrivateKey.resetBytes(in: 0..<walletEphemeralPrivateKey.count)
+        }
+
+        do {
+            loginKey = try BrowserLoginKeyProtocol.generateLoginKey()
+            var authPrivateKey = try BrowserLoginKeyProtocol.deriveAuthPrivateKey(
+                loginKey: loginKey,
+                identityId: identity.identityId
+            )
+            defer { authPrivateKey.resetBytes(in: 0..<authPrivateKey.count) }
+            let authPublicKey = try Secp256k1Primitives.compressedPublicKey(privateKey: authPrivateKey)
+            let authKeyHash = BrowserLoginKeyProtocol.hash160(authPublicKey)
+            guard authKeyHash.count == 20 else {
+                fail("Could not hash the browser's public key.")
+                return
+            }
+
+            let expiresAt = UInt64((Date().timeIntervalSince1970 + lifetime.seconds) * 1000)
+            let keyId = (identity.identityPublicKeys.map { $0.id }.max() ?? 0) + 1
+            let newKey = ManagedPlatformWallet.IdentityPubkey(
+                keyId: keyId,
+                keyType: .ecdsaHash160,
+                purpose: .authentication,
+                securityLevel: .high,
+                pubkeyBytes: authKeyHash,
+                totalBudget: budget.credits,
+                expiresAt: expiresAt
+            )
+
+            let signer = KeychainSigner(modelContainer: modelContext.container)
+            try await wallet.updateIdentity(
+                identityId: identity.identityId,
+                addPublicKeys: [newKey],
+                signer: signer
+            )
+            _ = signer  // keepalive: see KeychainSigner lifetime contract.
+
+            let ephemeral = try BrowserLoginKeyProtocol.generateEphemeralKeyPair()
+            walletEphemeralPrivateKey = ephemeral.privateKey
+            let encryptedPayload = try BrowserLoginKeyProtocol.seal(
+                loginKey: loginKey,
+                walletEphemeralPrivateKey: walletEphemeralPrivateKey,
+                appEphemeralPublicKey: request.appEphemeralPublicKey
+            )
+            let response = BrowserLoginKeyProtocol.BrowserLoginResponse(
+                identityId: identity.identityId,
+                walletEphemeralPublicKey: ephemeral.publicKey,
+                encryptedPayload: encryptedPayload,
+                keyId: keyId,
+                expiresAt: expiresAt,
+                totalBudget: budget.credits
+            )
+            peripheral.deliver(response: response.serialized())
+            registeredKeyId = keyId
+            phase = .delivered
+
+            if let sdk = appState.sdk {
+                try? await IdentityKeyRefresher.refreshBalanceAndKeys(
+                    identity: identity,
+                    sdk: sdk,
+                    modelContext: modelContext
+                )
+            }
+        } catch {
+            fail(error.localizedDescription)
+        }
+    }
+
+    private func fail(_ message: String) {
+        peripheral.setStatus(.failed)
+        phase = .failed(message)
+    }
+}
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleAppTests/BrowserLoginKeyProtocolTests.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleAppTests/BrowserLoginKeyProtocolTests.swift
new file mode 100644
index 00000000000..eaba714bd54
--- /dev/null
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleAppTests/BrowserLoginKeyProtocolTests.swift
@@ -0,0 +1,166 @@
+//
+//  BrowserLoginKeyProtocolTests.swift
+//  SwiftExampleAppTests
+//
+//  Wire format and cryptography of the Bluetooth login-key handoff.
+//  The fixed vectors were computed independently in Python so the
+//  browser (which implements the same derivations in JavaScript) and
+//  the phone cannot drift apart unnoticed.
+//
+
+import CryptoKit
+import SwiftDashSDK
+import XCTest
+@testable import SwiftExampleApp
+
+final class BrowserLoginKeyProtocolTests: XCTestCase {
+    private let appPrivateKey = Data(repeating: 0x11, count: 32)
+    private let walletPrivateKey = Data(repeating: 0x22, count: 32)
+    private let identityId = Data(repeating: 0x33, count: 32)
+    private let contractId = Data(repeating: 0x44, count: 32)
+
+    private var appPublicKey: Data {
+        try! Secp256k1Primitives.compressedPublicKey(privateKey: appPrivateKey)
+    }
+
+    // MARK: - Request
+
+    func testRequestRoundTrips() throws {
+        let request = BrowserLoginKeyProtocol.BrowserLoginRequest(
+            network: .devnet,
+            appEphemeralPublicKey: appPublicKey,
+            contractId: contractId,
+            label: "Login to Yappr"
+        )
+        let bytes = try request.serialized()
+        XCTAssertEqual(bytes.count, 1 + 1 + 33 + 32 + 1 + 14)
+        XCTAssertEqual(bytes[0], 1)
+        XCTAssertEqual(bytes[1], UInt8(ascii: "d"))
+        XCTAssertEqual(try BrowserLoginKeyProtocol.BrowserLoginRequest.parse(bytes), request)
+    }
+
+    func testRequestRejectsWrongVersionUnknownNetworkAndBadPoint() throws {
+        let request = BrowserLoginKeyProtocol.BrowserLoginRequest(
+            network: .testnet,
+            appEphemeralPublicKey: appPublicKey,
+            contractId: contractId,
+            label: "x"
+        )
+        var bytes = try request.serialized()
+
+        bytes[0] = 2
+        XCTAssertThrowsError(try BrowserLoginKeyProtocol.BrowserLoginRequest.parse(bytes)) {
+            XCTAssertEqual($0 as? BrowserLoginKeyProtocol.ProtocolError, .unsupportedVersion(2))
+        }
+        bytes[0] = 1
+
+        bytes[1] = UInt8(ascii: "z")
+        XCTAssertThrowsError(try BrowserLoginKeyProtocol.BrowserLoginRequest.parse(bytes)) {
+            XCTAssertEqual($0 as? BrowserLoginKeyProtocol.ProtocolError, .unknownNetwork(UInt8(ascii: "z")))
+        }
+        bytes[1] = UInt8(ascii: "t")
+
+        bytes[2] = 0x05  // not a compressed-point prefix
+        XCTAssertThrowsError(try BrowserLoginKeyProtocol.BrowserLoginRequest.parse(bytes)) {
+            XCTAssertEqual($0 as? BrowserLoginKeyProtocol.ProtocolError, .invalidEphemeralPublicKey)
+        }
+
+        XCTAssertThrowsError(try BrowserLoginKeyProtocol.BrowserLoginRequest.parse(Data(repeating: 1, count: 10))) {
+            XCTAssertEqual($0 as? BrowserLoginKeyProtocol.ProtocolError, .truncatedRequest)
+        }
+    }
+
+    func testRequestLabelLengthIsBounded() throws {
+        let long = String(repeating: "a", count: 65)
+        let request = BrowserLoginKeyProtocol.BrowserLoginRequest(
+            network: .mainnet,
+            appEphemeralPublicKey: appPublicKey,
+            contractId: contractId,
+            label: long
+        )
+        XCTAssertThrowsError(try request.serialized())
+    }
+
+    // MARK: - Response
+
+    func testResponseRoundTripsAndEncodesAbsentLimitsAsZero() throws {
+        let payload = Data((0..<60).map { UInt8($0) })
+        let response = BrowserLoginKeyProtocol.BrowserLoginResponse(
+            identityId: identityId,
+            walletEphemeralPublicKey: appPublicKey,
+            encryptedPayload: payload,
+            keyId: 0x0102_0304,
+            expiresAt: 1_800_000_000_000,
+            totalBudget: nil
+        )
+        let bytes = response.serialized()
+        XCTAssertEqual(bytes.count, BrowserLoginKeyProtocol.BrowserLoginResponse.length)
+        XCTAssertEqual(Array(bytes[126..<130]), [1, 2, 3, 4])
+        XCTAssertEqual(Array(bytes[138..<146]), [UInt8](repeating: 0, count: 8))
+        XCTAssertEqual(try BrowserLoginKeyProtocol.BrowserLoginResponse.parse(bytes), response)
+    }
+
+    // MARK: - Cryptography
+
+    /// HKDF-SHA256(ikm = 0x55 * 32, salt = 0x33 * 32, info = "auth", 32),
+    /// computed with Python's hmac/hashlib.
+    func testAuthKeyDerivationMatchesReferenceVector() throws {
+        let loginKey = Data(repeating: 0x55, count: 32)
+        let derived = try BrowserLoginKeyProtocol.deriveAuthPrivateKey(loginKey: loginKey, identityId: identityId)
+        XCTAssertEqual(
+            derived.toHexString(),
+            "6f0aa5dd9454cb33b8a96b93a4d3b8936ce81bd8d2b9e054dee938f59c022e35"
+        )
+    }
+
+    /// HKDF-SHA256(ikm = 0x66 * 32, salt = "dash:key-exchange:v1", info = "", 32).
+    func testSharedKeyDerivationMatchesReferenceVector() {
+        let key = BrowserLoginKeyProtocol.deriveSharedKey(sharedX: Data(repeating: 0x66, count: 32))
+        XCTAssertEqual(
+            key.withUnsafeBytes { Data($0) }.toHexString(),
+            "47e69df69b24bbc45453bf907d78c6c6264c1eb15be5ae7563e2b8ea25a45539"
+        )
+    }
+
+    func testSealedLoginKeyOpensWithTheOtherSidesKeys() throws {
+        let loginKey = try BrowserLoginKeyProtocol.generateLoginKey()
+        let walletPublicKey = try Secp256k1Primitives.compressedPublicKey(privateKey: walletPrivateKey)
+
+        let sealed = try BrowserLoginKeyProtocol.seal(
+            loginKey: loginKey,
+            walletEphemeralPrivateKey: walletPrivateKey,
+            appEphemeralPublicKey: appPublicKey
+        )
+        XCTAssertEqual(sealed.count, 60)
+
+        let opened = try BrowserLoginKeyProtocol.open(
+            encryptedPayload: sealed,
+            appEphemeralPrivateKey: appPrivateKey,
+            walletEphemeralPublicKey: walletPublicKey
+        )
+        XCTAssertEqual(opened, loginKey)
+
+        var tampered = sealed
+        tampered[20] ^= 0x01
+        XCTAssertThrowsError(try BrowserLoginKeyProtocol.open(
+            encryptedPayload: tampered,
+            appEphemeralPrivateKey: appPrivateKey,
+            walletEphemeralPublicKey: walletPublicKey
+        ))
+    }
+
+    func testPairingCodeIsSixDigitsAndDeterministic() {
+        let code = BrowserLoginKeyProtocol.pairingCode(for: appPublicKey)
+        XCTAssertEqual(code.count, 6)
+        XCTAssertTrue(code.allSatisfy(\.isNumber))
+        XCTAssertEqual(code, BrowserLoginKeyProtocol.pairingCode(for: appPublicKey))
+        XCTAssertEqual(code, "350178")
+    }
+
+    func testEphemeralKeyPairIsValid() throws {
+        let pair = try BrowserLoginKeyProtocol.generateEphemeralKeyPair()
+        XCTAssertEqual(pair.privateKey.count, 32)
+        XCTAssertTrue(Secp256k1Primitives.isValidCompressedPoint(pair.publicKey))
+        XCTAssertEqual(try Secp256k1Primitives.compressedPublicKey(privateKey: pair.privateKey), pair.publicKey)
+    }
+}

From 9b8849921c5b894064b41b7782ffb2f78047ddae Mon Sep 17 00:00:00 2001
From: Quantum Explorer <quantum@dash.org>
Date: Sat, 19 Sep 2026 02:37:27 +0700
Subject: [PATCH 2/2] feat(swift-example-app): show a key's budget, remaining
 budget, expiry and bounds

The key list rows and the key detail screen now surface the protocol 14
limits a key carries: its total budget with what Platform says is left
(one `fetchKeysRemainingBudgets` call per list, one per detail view), how
much was spent, the expiry as a date and relative time with an expired
state, and the contract bounds. `KeyLimitsFormatting` renders credits as
DASH at full precision and is unit-tested.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .../Utils/KeyLimitsFormatting.swift           |  73 ++++++++++++
 .../SwiftExampleApp/Views/KeyDetailView.swift | 108 ++++++++++++++++++
 .../SwiftExampleApp/Views/KeysListView.swift  |  60 +++++++++-
 .../KeyLimitsFormattingTests.swift            |  55 +++++++++
 4 files changed, 294 insertions(+), 2 deletions(-)
 create mode 100644 packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Utils/KeyLimitsFormatting.swift
 create mode 100644 packages/swift-sdk/SwiftExampleApp/SwiftExampleAppTests/KeyLimitsFormattingTests.swift

diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Utils/KeyLimitsFormatting.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Utils/KeyLimitsFormatting.swift
new file mode 100644
index 00000000000..08700a6821e
--- /dev/null
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Utils/KeyLimitsFormatting.swift
@@ -0,0 +1,73 @@
+import Foundation
+import SwiftDashSDK
+
+/// Renders a key's protocol 14 limits and contract bounds for the key
+/// screens: credits as DASH, expiry as a date plus how far away it is,
+/// and bounds as the contract they point at.
+enum KeyLimitsFormatting {
+    /// 1 DASH = 100 000 000 duffs = 100 000 000 000 credits.
+    static let creditsPerDash: UInt64 = 100_000_000_000
+
+    /// Credits rendered as DASH, trimming trailing zeros: 1_000_000_000 → "0.01 DASH".
+    static func dash(_ credits: UInt64) -> String {
+        "\(dashNumber(credits)) DASH"
+    }
+
+    /// The DASH amount alone, at full credit precision: 1_000_000_000 → "0.01".
+    static func dashNumber(_ credits: UInt64) -> String {
+        let whole = credits / creditsPerDash
+        let fraction = credits % creditsPerDash
+        var digits = String(fraction)
+        digits = String(repeating: "0", count: 11 - digits.count) + digits
+        while digits.hasSuffix("0") { digits.removeLast() }
+        return digits.isEmpty ? "\(whole)" : "\(whole).\(digits)"
+    }
+
+    /// "0.004 of 0.01 DASH left" or, without a remaining figure, "0.01 DASH".
+    static func budget(total: UInt64, remaining: UInt64?) -> String {
+        guard let remaining else { return dash(total) }
+        return "\(dashNumber(remaining)) of \(dash(total)) left"
+    }
+
+    /// Whether the key has expired at `now`. The expiry instant itself is
+    /// already expired, as consensus counts it.
+    static func isExpired(expiresAt: TimestampMillis, now: Date) -> Bool {
+        UInt64(now.timeIntervalSince1970 * 1000) >= expiresAt
+    }
+
+    /// The expiry as an absolute local date and time.
+    static func expiryDate(_ expiresAt: TimestampMillis, locale: Locale = .current) -> String {
+        let date = Date(timeIntervalSince1970: TimeInterval(expiresAt) / 1000)
+        let formatter = DateFormatter()
+        formatter.locale = locale
+        formatter.dateStyle = .medium
+        formatter.timeStyle = .short
+        return formatter.string(from: date)
+    }
+
+    /// "Expires in 3 hours" or "Expired 2 days ago".
+    static func expiryRelative(_ expiresAt: TimestampMillis, now: Date, locale: Locale = .current) -> String {
+        let date = Date(timeIntervalSince1970: TimeInterval(expiresAt) / 1000)
+        let formatter = RelativeDateTimeFormatter()
+        formatter.locale = locale
+        formatter.unitsStyle = .full
+        let relative = formatter.localizedString(for: date, relativeTo: now)
+        return isExpired(expiresAt: expiresAt, now: now) ? "Expired \(relative)" : "Expires \(relative)"
+    }
+
+    /// Short, readable rendering of contract bounds.
+    static func bounds(_ bounds: ContractBounds) -> String {
+        switch bounds {
+        case .singleContract(let id):
+            return "Contract \(shortId(id))"
+        case .singleContractDocumentType(let id, let documentTypeName):
+            return "Contract \(shortId(id)), type \(documentTypeName)"
+        }
+    }
+
+    static func shortId(_ id: Data) -> String {
+        let base58 = id.toBase58String()
+        guard base58.count > 13 else { return base58 }
+        return "\(base58.prefix(6))…\(base58.suffix(6))"
+    }
+}
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/KeyDetailView.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/KeyDetailView.swift
index 48ee5b54179..e370a849424 100644
--- a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/KeyDetailView.swift
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/KeyDetailView.swift
@@ -13,6 +13,11 @@ struct KeyDetailView: View {
     @State private var showDisableConfirm = false
     @State private var isDisabling = false
     @State private var disableError: String?
+    /// What Platform says is left of this key's budget. `.some(nil)` means
+    /// the node answered that the key carries no budget.
+    @State private var remainingBudget: UInt64?? = nil
+    @State private var remainingBudgetError: String?
+    @State private var isLoadingRemainingBudget = false
     @Environment(\.dismiss) var dismiss
     @Environment(\.modelContext) private var modelContext
     @EnvironmentObject var appState: AppState
@@ -73,6 +78,10 @@ struct KeyDetailView: View {
                     .textSelection(.enabled)
             }
 
+            if publicKey.hasLimits || publicKey.contractBounds != nil {
+                limitsSection
+            }
+
             // Key Status / danger section
             keyStatusSection
 
@@ -167,6 +176,105 @@ struct KeyDetailView: View {
         }
     }
 
+    // MARK: - Limits section
+
+    /// Protocol 14 limits and contract bounds. The total budget and the
+    /// expiry are part of the key; what remains of the budget lives in
+    /// Drive and is fetched when the section appears.
+    private var limitsSection: some View {
+        Section {
+            if let bounds = publicKey.contractBounds {
+                HStack {
+                    Text("Bound to")
+                    Spacer()
+                    Text(KeyLimitsFormatting.bounds(bounds))
+                        .fontWeight(.medium)
+                        .multilineTextAlignment(.trailing)
+                }
+            }
+
+            if let totalBudget = publicKey.totalBudget {
+                HStack {
+                    Text("Total budget")
+                    Spacer()
+                    Text(KeyLimitsFormatting.dash(totalBudget))
+                        .fontWeight(.medium)
+                }
+                HStack {
+                    Text("Remaining")
+                    Spacer()
+                    if isLoadingRemainingBudget {
+                        ProgressView().controlSize(.small)
+                    } else if let remaining = remainingBudget, let remaining {
+                        Text(KeyLimitsFormatting.dash(remaining))
+                            .fontWeight(.medium)
+                            .foregroundColor(remaining == 0 ? .red : .primary)
+                    } else if remainingBudgetError != nil {
+                        Text("Unavailable")
+                            .foregroundColor(.secondary)
+                    } else {
+                        Text("Unknown")
+                            .foregroundColor(.secondary)
+                    }
+                }
+                if let remaining = remainingBudget, let remaining, remaining <= totalBudget {
+                    HStack {
+                        Text("Spent")
+                        Spacer()
+                        Text(KeyLimitsFormatting.dash(totalBudget - remaining))
+                            .fontWeight(.medium)
+                    }
+                }
+                if let error = remainingBudgetError {
+                    Text(error)
+                        .font(.caption)
+                        .foregroundColor(.red)
+                }
+            }
+
+            if let expiresAt = publicKey.expiresAt {
+                let expired = KeyLimitsFormatting.isExpired(expiresAt: expiresAt, now: Date())
+                HStack {
+                    Text("Expires")
+                    Spacer()
+                    VStack(alignment: .trailing, spacing: 2) {
+                        Text(KeyLimitsFormatting.expiryDate(expiresAt))
+                            .fontWeight(.medium)
+                        Text(KeyLimitsFormatting.expiryRelative(expiresAt, now: Date()))
+                            .font(.caption)
+                            .foregroundColor(expired ? .red : .secondary)
+                    }
+                }
+            }
+        } header: {
+            Text("Limits")
+        } footer: {
+            if publicKey.hasLimits {
+                Text("Platform refuses anything this key signs once its budget is spent or its expiry has passed. The limits cannot be lowered; the budget can be raised and the expiry extended by the identity's master key.")
+            }
+        }
+        .task(id: publicKey.id) {
+            await loadRemainingBudget()
+        }
+    }
+
+    @MainActor
+    private func loadRemainingBudget() async {
+        guard publicKey.totalBudget != nil, let sdk = appState.sdk else { return }
+        isLoadingRemainingBudget = true
+        defer { isLoadingRemainingBudget = false }
+        do {
+            let budgets = try await sdk.fetchKeysRemainingBudgets(
+                identityId: identity.identityIdBase58,
+                keyIds: [publicKey.id]
+            )
+            remainingBudget = budgets[publicKey.id]
+            remainingBudgetError = nil
+        } catch {
+            remainingBudgetError = error.localizedDescription
+        }
+    }
+
     // MARK: - Key Status section
 
     /// "Key Status" section: a read-only "Disabled" row when the key is
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/KeysListView.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/KeysListView.swift
index 6e10bb31753..a2e2eed5ff4 100644
--- a/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/KeysListView.swift
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleApp/Views/KeysListView.swift
@@ -20,6 +20,9 @@ struct KeysListView: View {
   @State private var pendingDisableKey: IdentityPublicKey?
   @State private var isDisabling = false
   @State private var disableError: String?
+  /// What Platform says is left of each budgeted key, fetched once for the
+  /// whole list. Absent while loading or when the query failed.
+  @State private var remainingBudgets: [UInt32: UInt64?] = [:]
 
   private var publicKeys: [IdentityPublicKey] {
     identity.identityPublicKeys
@@ -44,7 +47,8 @@ struct KeysListView: View {
             }) {
               KeyRowView(
                 publicKey: publicKey,
-                privateKeyAvailable: true
+                privateKeyAvailable: true,
+                remainingBudget: remainingBudgets[publicKey.id] ?? nil
               )
             }
             .foregroundColor(.primary)
@@ -56,7 +60,8 @@ struct KeysListView: View {
             NavigationLink(destination: KeyDetailView(identity: identity, publicKey: publicKey)) {
               KeyRowView(
                 publicKey: publicKey,
-                privateKeyAvailable: false
+                privateKeyAvailable: false,
+                remainingBudget: remainingBudgets[publicKey.id] ?? nil
               )
             }
             .swipeActions(edge: .trailing, allowsFullSwipe: false) {
@@ -102,6 +107,9 @@ struct KeysListView: View {
       }
     }
     .navigationTitle("Identity Keys")
+    .task(id: publicKeys.compactMap { $0.totalBudget != nil ? $0.id : nil }) {
+      await loadRemainingBudgets()
+    }
     .navigationBarTitleDisplayMode(.inline)
     .toolbar {
       ToolbarItem(placement: .navigationBarTrailing) {
@@ -235,6 +243,24 @@ struct KeysListView: View {
     }
   }
 
+  /// One remaining-budgets query for every key that carries a budget.
+  @MainActor
+  private func loadRemainingBudgets() async {
+    let budgetedKeyIds = publicKeys.compactMap { $0.totalBudget != nil ? $0.id : nil }
+    guard !budgetedKeyIds.isEmpty, let sdk = appState.sdk else {
+      remainingBudgets = [:]
+      return
+    }
+    do {
+      remainingBudgets = try await sdk.fetchKeysRemainingBudgets(
+        identityId: identity.identityIdBase58,
+        keyIds: budgetedKeyIds
+      )
+    } catch {
+      print("🔑 KeysListView: remaining budgets unavailable: \(error.localizedDescription)")
+    }
+  }
+
   private func hasPrivateKey(for publicKey: IdentityPublicKey) -> Bool {
     // Two private-key storage schemes coexist on the device. The
     // legacy scheme is keyed by `(identityId, keyIndex)`; the new
@@ -256,6 +282,8 @@ struct KeysListView: View {
 struct KeyRowView: View {
   let publicKey: IdentityPublicKey
   let privateKeyAvailable: Bool
+  /// What Platform says is left of the key's budget, when known.
+  var remainingBudget: UInt64? = nil
 
   var body: some View {
     VStack(alignment: .leading, spacing: 8) {
@@ -299,6 +327,34 @@ struct KeyRowView: View {
         }
       }
 
+      // Limits and bounds (protocol 14)
+      if publicKey.hasLimits || publicKey.contractBounds != nil {
+        VStack(alignment: .leading, spacing: 2) {
+          if let totalBudget = publicKey.totalBudget {
+            Label(
+              KeyLimitsFormatting.budget(total: totalBudget, remaining: remainingBudget),
+              systemImage: "creditcard"
+            )
+            .font(.caption2)
+            .foregroundColor(remainingBudget == 0 ? .red : .secondary)
+          }
+          if let expiresAt = publicKey.expiresAt {
+            let expired = KeyLimitsFormatting.isExpired(expiresAt: expiresAt, now: Date())
+            Label(
+              KeyLimitsFormatting.expiryRelative(expiresAt, now: Date()),
+              systemImage: expired ? "clock.badge.xmark" : "clock"
+            )
+            .font(.caption2)
+            .foregroundColor(expired ? .red : .secondary)
+          }
+          if let bounds = publicKey.contractBounds {
+            Label(KeyLimitsFormatting.bounds(bounds), systemImage: "doc.text")
+              .font(.caption2)
+              .foregroundColor(.secondary)
+          }
+        }
+      }
+
       // Public Key Data
       VStack(alignment: .leading, spacing: 4) {
         Text("Public Key:")
diff --git a/packages/swift-sdk/SwiftExampleApp/SwiftExampleAppTests/KeyLimitsFormattingTests.swift b/packages/swift-sdk/SwiftExampleApp/SwiftExampleAppTests/KeyLimitsFormattingTests.swift
new file mode 100644
index 00000000000..330bc986e79
--- /dev/null
+++ b/packages/swift-sdk/SwiftExampleApp/SwiftExampleAppTests/KeyLimitsFormattingTests.swift
@@ -0,0 +1,55 @@
+//
+//  KeyLimitsFormattingTests.swift
+//  SwiftExampleAppTests
+//
+//  How a key's budget, expiry and bounds read on the key screens.
+//
+
+import SwiftDashSDK
+import XCTest
+@testable import SwiftExampleApp
+
+final class KeyLimitsFormattingTests: XCTestCase {
+    func testCreditsRenderAsDashWithoutTrailingZeros() {
+        XCTAssertEqual(KeyLimitsFormatting.dash(100_000_000_000), "1 DASH")
+        XCTAssertEqual(KeyLimitsFormatting.dash(1_000_000_000), "0.01 DASH")
+        XCTAssertEqual(KeyLimitsFormatting.dash(123_456_789_012), "1.23456789012 DASH")
+        XCTAssertEqual(KeyLimitsFormatting.dash(1), "0.00000000001 DASH")
+        XCTAssertEqual(KeyLimitsFormatting.dash(0), "0 DASH")
+    }
+
+    func testBudgetShowsRemainingOfTotalWhenKnown() {
+        XCTAssertEqual(KeyLimitsFormatting.budget(total: 1_000_000_000, remaining: 400_000_000), "0.004 of 0.01 DASH left")
+        XCTAssertEqual(KeyLimitsFormatting.budget(total: 1_000_000_000, remaining: nil), "0.01 DASH")
+    }
+
+    func testExpiryInstantCountsAsExpired() {
+        let expiresAt: TimestampMillis = 1_700_000_000_000
+        XCTAssertFalse(KeyLimitsFormatting.isExpired(expiresAt: expiresAt, now: Date(timeIntervalSince1970: 1_699_999_999.999)))
+        XCTAssertTrue(KeyLimitsFormatting.isExpired(expiresAt: expiresAt, now: Date(timeIntervalSince1970: 1_700_000_000)))
+    }
+
+    func testRelativeExpiryNamesBothDirections() {
+        let expiresAt: TimestampMillis = 1_700_000_000_000
+        let locale = Locale(identifier: "en_US")
+        XCTAssertEqual(
+            KeyLimitsFormatting.expiryRelative(expiresAt, now: Date(timeIntervalSince1970: 1_699_996_400), locale: locale),
+            "Expires in 1 hour"
+        )
+        XCTAssertEqual(
+            KeyLimitsFormatting.expiryRelative(expiresAt, now: Date(timeIntervalSince1970: 1_700_172_800), locale: locale),
+            "Expired 2 days ago"
+        )
+    }
+
+    func testBoundsNameTheContractAndDocumentType() {
+        let id = Data(repeating: 0x44, count: 32)
+        let short = KeyLimitsFormatting.shortId(id)
+        XCTAssertEqual(short.count, 13)
+        XCTAssertEqual(KeyLimitsFormatting.bounds(.singleContract(id: id)), "Contract \(short)")
+        XCTAssertEqual(
+            KeyLimitsFormatting.bounds(.singleContractDocumentType(id: id, documentTypeName: "profile")),
+            "Contract \(short), type profile"
+        )
+    }
+}