@advenue/react-native 0.8.0 → 1.0.0

package/ios/AdvenueIosModule.swift

@@ -1,104 +1,144 @@
-import ExpoModulesCore
-import StoreKit
-import AdServices
-import AdSupport
 import AppTrackingTransparency
-import UIKit
-import DeviceCheck
-import CryptoKit
-#if canImport(AdAttributionKit)
-import AdAttributionKit
-#endif
-
-// Advenue iOS native module. Exposes SKAdNetwork conversion-value updates
-// (SKAN 4.0 fine + coarse) and the Apple Search Ads attribution token to JS.
-// The conversion-value POLICY lives in TS (@advenue/skadnetwork); this module
-// only performs the privileged StoreKit/AdServices calls.
+import ExpoModulesCore
+import Foundation
+
+// No `import Advenue` / `import AdvenueCore` here, and that is not an omission.
+// The podspec globs this file and the vendored SDK sources into ONE pod target,
+// so those module names resolve to nothing — importing them is the error that
+// stopped this package building at all. Every symbol below is already in scope
+// for the same reason. `check-vendored-swift.mjs` keeps it that way.
+
+/// The React Native bridge to the Advenue iOS SDK.
+///
+/// It used to be a toolbox: one function per native capability — storage,
+/// advertising ids, App Attest, SKAdNetwork, TCF, device info — because a
+/// TypeScript core drove them one at a time. That core is retired, and every
+/// one of those functions had stopped being called. They are gone rather than
+/// left in place, because dead code in an SDK is code someone later assumes is
+/// live, and one of them was warming a second Play Integrity provider on the
+/// Android side for nobody.
+///
+/// What is left is the bridge and one capability. `requestTrackingAuthorization`
+/// stays a capability because the app decides WHEN to prompt, and that decision
+/// belongs to the app's own UX rather than to the SDK's lifecycle.
 public class AdvenueIosModule: Module {
-  // UIKit (UIScreen/UIDevice/UIPasteboard) is main-thread-only, but synchronous
-  // `Function` handlers run on whatever thread invoked them (the JS thread on
-  // RN's bridge). Hop to main when needed; `sync` is safe because these are
-  // cheap local reads and the guard prevents a same-thread deadlock.
-  private static func onMainSync<T>(_ work: () -> T) -> T {
-    if Thread.isMainThread {
-      return work()
-    }
-    return DispatchQueue.main.sync(execute: work)
-  }
-
   public func definition() -> ModuleDefinition {
     Name("AdvenueIos")
 
-    // Call once at launch so SKAdNetwork starts the measurement window.
-    Function("registerAppForAttribution") {
-      if #available(iOS 16.1, *) {
-        // No-op: updatePostbackConversionValue implicitly registers.
-      } else {
-        SKAdNetwork.registerAppForAdNetworkAttribution()
-      }
-    }
-
-    // SKAN 4.0: fine value 0–63 + coarse "low" | "medium" | "high". On
-    // iOS 17.4+ the AdAttributionKit postback is updated as well, since an
-    // impression may be signed for either rail.
-    AsyncFunction("updateConversionValue") { (fineValue: Int, coarse: String, lockWindow: Bool, promise: Promise) in
-      #if canImport(AdAttributionKit)
-      if #available(iOS 17.4, *) {
-        let aakCoarse: CoarseConversionValue = {
-          switch coarse {
-          case "high": return .high
-          case "medium": return .medium
-          default: return .low
-          }
-        }()
-        Task {
-          do {
-            try await Postback.updateConversionValue(fineValue, coarseConversionValue: aakCoarse, lockPostback: lockWindow)
-          } catch {
-            // Expected when no AAK-signed impression exists; logged so SKAN/AAK
-            // postback divergence on iOS 17.4+ is diagnosable. The SKAN call
-            // below still resolves the promise.
-            NSLog("[Advenue] AdAttributionKit conversion update skipped: %@", error.localizedDescription)
-          }
-        }
-      }
-      #endif
-      if #available(iOS 16.1, *) {
-        let coarseValue: SKAdNetwork.CoarseConversionValue = {
-          switch coarse {
-          case "high": return .high
-          case "medium": return .medium
-          default: return .low
-          }
-        }()
-        SKAdNetwork.updatePostbackConversionValue(fineValue, coarseValue: coarseValue, lockWindow: lockWindow) { error in
-          if let error = error { promise.reject("ESKAN", error.localizedDescription) }
-          else { promise.resolve(nil) }
-        }
-      } else if #available(iOS 15.4, *) {
-        SKAdNetwork.updatePostbackConversionValue(fineValue) { error in
-          if let error = error { promise.reject("ESKAN", error.localizedDescription) }
-          else { promise.resolve(nil) }
+    // Diagnostics travel back to JavaScript. `onError` is a JS closure and
+    // cannot cross the channel, so what crosses is the event: a stable context
+    // identifier and a message, never PII. Without this the SDK's own swallowed
+    // failures — deferred identity, a rejected event, a transport error — reach
+    // nobody, which is what happened between the inversion and this commit.
+    Events("onAdvenueError")
+
+    Function("bridgeInitialize") { (options: [String: Any]) in
+      guard let app = options["apiKey"] as? String else { return }
+      var config = AdvenueConfig(
+        apiKey: app,
+        endpoint: (options["endpoint"] as? String) ?? DEFAULT_ENDPOINT,
+        appVersion: options["appVersion"] as? String,
+        requireConsent: (options["requireConsent"] as? Bool) ?? false,
+        signingSecret: options["signingSecret"] as? String,
+        onError: { [weak self] context, error in
+          self?.sendEvent("onAdvenueError", ["context": context, "message": "\(error)"])
+        },
+        // The wrapper's version, not this SDK's: a React Native release pins
+        // the native snapshot inside it, so its version identifies both.
+        sdkVersion: options["sdkVersion"] as? String)
+      if let flushInterval = options["flushIntervalMs"] as? Int {
+        config.flushIntervalMs = flushInterval
+      }
+      if let batchSize = options["batchSize"] as? Int { config.batchSize = batchSize }
+      Advenue.initialize(config)
+      // Firebase App Instance ID, when the host app already ships Firebase.
+      // `AdvenueFirebase` guards its import with `#if canImport`, which is
+      // false under SPM unless declared but true under CocoaPods, where the
+      // host app's pods are linked together — so this is safe here and would
+      // not be in a Swift Package. The Android side gets the same automatic
+      // detection from `plugin-firebase-reflect`.
+      AdvenueFirebase.register()
+    }
+
+    Function("bridgeTrack") { (name: String, properties: [String: Any]?) in
+      Advenue.track(name, properties: properties.map(Self.toAdvenueValues))
+    }
+
+    Function("bridgeFlush") { Advenue.flush() }
+    Function("bridgeSetUserId") { (id: String?) in Advenue.setUserId(id) }
+    Function("bridgeSetConsent") { (granted: Bool) in Advenue.setConsent(granted) }
+    Function("bridgeForgetMe") { Advenue.forgetMe() }
+    Function("bridgeShutdown") { Advenue.shutdown() }
+    Function("bridgeResolvedAppId") { () -> String? in Advenue.resolvedAppId() }
+
+    Function("bridgeSetConsentData") { (data: [String: Any]) in
+      guard let gdpr = data["isUserSubjectToGDPR"] as? Bool else { return }
+      Advenue.setConsentData(
+        Consent(
+          isUserSubjectToGDPR: gdpr,
+          hasConsentForDataUsage: data["hasConsentForDataUsage"] as? Bool,
+          hasConsentForAdsPersonalization: data["hasConsentForAdsPersonalization"] as? Bool,
+          hasConsentForAdStorage: data["hasConsentForAdStorage"] as? Bool))
+    }
+
+    // Read back, for the JavaScript consent cache. The cache is seeded from
+    // this at initialize: consent is persisted and survives restarts, so a
+    // facade defaulting to false on every cold start would silently discard a
+    // preference the user gave.
+    Function("bridgeGetConsent") { () -> Bool in Advenue.trackingConsent() }
+
+    Function("bridgeGetConsentData") { () -> [String: Any]? in
+      guard let consent = Advenue.consentData() else { return nil }
+      var out: [String: Any] = ["isUserSubjectToGDPR": consent.isUserSubjectToGDPR]
+      // Written only when stated: "not asked" is not "denied", and a false
+      // invented here is a recorded refusal that never happened.
+      if let v = consent.hasConsentForDataUsage { out["hasConsentForDataUsage"] = v }
+      if let v = consent.hasConsentForAdsPersonalization {
+        out["hasConsentForAdsPersonalization"] = v
+      }
+      if let v = consent.hasConsentForAdStorage { out["hasConsentForAdStorage"] = v }
+      return out
+    }
+
+    Function("bridgeSetAppInstanceId") { (id: String?) in Advenue.setAppInstanceId(id) }
+
+    Function("bridgeSetPushToken") { (token: String?, provider: String?) in
+      Advenue.setPushToken(token, provider: provider)
+    }
+
+    Function("bridgeProcessDeepLink") { (url: String) in
+      guard let parsed = URL(string: url) else { return }
+      Advenue.processDeepLink(parsed)
+    }
+
+    // The amount arrives as the app's price string, not micros: converting it
+    // in JavaScript would put a money computation back in the layer this
+    // release is emptying. A malformed amount records nothing.
+    Function("bridgeRecordSkanRevenue") { (amount: String, currency: String) in
+      Advenue.recordSkanRevenue(amount: amount, currency: currency)
+    }
+
+    AsyncFunction("bridgeDeviceId") { (promise: Promise) in
+      Task { promise.resolve(await Advenue.deviceId()) }
+    }
+
+    AsyncFunction("bridgeResolveDeferredDeepLink") { (promise: Promise) in
+      Task {
+        guard let link = await Advenue.resolveDeferredDeepLink() else {
+          promise.resolve(nil)
+          return
         }
-      } else {
-        SKAdNetwork.updateConversionValue(fineValue)
-        promise.resolve(nil)
+        promise.resolve([
+          "deepLinkValue": link.deepLinkValue as Any,
+          "campaign": link.campaign as Any,
+          "network": link.network as Any,
+          "influencerId": link.influencerId as Any,
+          "isDeferred": link.isDeferred,
+          "isFirstLaunch": link.isFirstLaunch,
+        ])
       }
     }
 
-    // Apple Search Ads attribution token; resolved server-side via @advenue/skadnetwork.
-    AsyncFunction("getAttributionToken") { (promise: Promise) in
-      if #available(iOS 14.3, *) {
-        do {
-          let token = try AAAttribution.attributionToken()
-          promise.resolve(token)
-        } catch {
-          promise.reject("EASA", error.localizedDescription)
-        }
-      } else {
-        promise.resolve(nil)
-      }
-    }
 
     // ATT consent prompt. The consumer app must declare
     // NSUserTrackingUsageDescription in Info.plist, or iOS rejects the call.
@@ -111,262 +151,23 @@ public class AdvenueIosModule: Module {
         promise.resolve("authorized")
       }
     }
-
-    AsyncFunction("getAdvertisingId") { (promise: Promise) in
-      if #available(iOS 14, *) {
-        guard ATTrackingManager.trackingAuthorizationStatus == .authorized else {
-          promise.resolve(nil)
-          return
-        }
-      }
-      let idfa = ASIdentifierManager.shared().advertisingIdentifier.uuidString
-      promise.resolve(idfa == "00000000-0000-0000-0000-000000000000" ? nil : idfa)
-    }
-
-    Function("getTrackingAuthorizationStatus") { () -> String in
-      if #available(iOS 14, *) {
-        return Self.attStatusString(ATTrackingManager.trackingAuthorizationStatus)
-      }
-      return "authorized"
-    }
-
-    // Vendor-scoped device id (identifierForVendor). Available WITHOUT ATT because
-    // it is NOT an advertising identifier. First-party fraud/dedup use only — it
-    // must not be used for cross-network attribution, which would be "tracking".
-    Function("getIdentifierForVendor") { () -> String? in
-      return Self.onMainSync { UIDevice.current.identifierForVendor?.uuidString }
-    }
-
-    // G3.3 — DeviceCheck token. Calls DCDevice.current.generateToken to obtain
-    // the opaque base64 token that identifies this physical device to the Apple
-    // DeviceCheck API. The server uses it (with the per-app DeviceCheck key) to
-    // query/update the persistent 2-bit per-device flag. Unlike App Attest, this
-    // requires no challenge/server round-trip — just generate and attach.
-    //
-    // Rejects with EUNSUPPORTED when DCDevice.current.isSupported is false (iOS
-    // simulator, Catalyst, etc.) so the JS layer can fail-safe and omit the token.
-    // IMPORTANT: NOT compile/on-device verified here; reviewed against the
-    // DCDevice API. The JS fail-safe in sdk-react-native ensures missing token
-    // never blocks attribution.
-    AsyncFunction("getDeviceCheckToken") { (promise: Promise) in
-      guard DCDevice.current.isSupported else {
-        promise.reject("EUNSUPPORTED", "DCDevice is not supported on this device")
-        return
-      }
-      DCDevice.current.generateToken { tokenData, error in
-        if let error = error {
-          promise.reject("EDEVICECHECK", error.localizedDescription)
-          return
-        }
-        guard let tokenData = tokenData else {
-          promise.reject("EDEVICECHECK", "generateToken returned nil data")
-          return
-        }
-        promise.resolve(tokenData.base64EncodedString())
-      }
-    }
-
-    // G3.2n — App Attest. Takes the server-supplied challenge string, computes
-    // clientDataHash = SHA-256(challenge UTF-8), generates (or reuses a
-    // keychain-cached) DCAppAttest key, and calls attestKey to obtain the
-    // CBOR attestation object. Resolves { keyId, attestationObject } where
-    // attestationObject is base64-encoded — pass directly to the server's
-    // verifyAppAttest endpoint. Rejects with a code on any failure so the JS
-    // layer can fail-safe (omit attestation rather than blocking the install).
-    // IMPORTANT: DCAppAttestService.isSupported is false on simulators; this
-    // causes the JS layer to skip attestation entirely (server sees 'unavailable').
-    AsyncFunction("attestKey") { (challenge: String, promise: Promise) in
-      guard #available(iOS 14.0, *) else {
-        promise.reject("EUNSUPPORTED", "App Attest requires iOS 14.0+")
-        return
-      }
-      let service = DCAppAttestService.shared
-      guard service.isSupported else {
-        promise.reject("EUNSUPPORTED", "DCAppAttestService is not supported on this device")
-        return
-      }
-
-      // Compute clientDataHash = SHA-256 of the UTF-8 challenge bytes.
-      guard let challengeData = challenge.data(using: .utf8) else {
-        promise.reject("EBADCHALLENGE", "Failed to encode challenge as UTF-8")
-        return
-      }
-      let clientDataHash = Data(SHA256.hash(data: challengeData))
-
-      // Load a previously generated key from Keychain, or generate a new one.
-      // Key is cached per-install/device so we only call generateKey once.
-      Self.resolveKeyId(service: service) { result in
-        switch result {
-        case .failure(let error):
-          promise.reject("EKEYID", error.localizedDescription)
-        case .success(let keyId):
-          service.attestKey(keyId, clientDataHash: clientDataHash) { attestationObject, error in
-            if let error = error {
-              // A key can be attested only once. If Apple rejects this keyId as
-              // invalid (e.g. it was already attested but the server never recorded
-              // it, or the key became invalid), the cached id is permanently
-              // unusable — drop it so the NEXT call generates a fresh key instead
-              // of looping on the dead id forever.
-              if (error as? DCError)?.code == .invalidKey {
-                Self.deleteKeyId()
-              }
-              promise.reject("EATTEST", error.localizedDescription)
-              return
-            }
-            guard let attestationObject = attestationObject else {
-              promise.reject("EATTEST", "attestKey returned nil attestation object")
-              return
-            }
-            let base64Attest = attestationObject.base64EncodedString()
-            promise.resolve(["keyId": keyId, "attestationObject": base64Attest])
-          }
-        }
-      }
-    }
-
-    // Device metadata for Meta CAPI `extinfo` (Task 3n). Synchronous — every
-    // API used here is a cheap local read (no network I/O). Best-effort per
-    // field: a field is simply omitted when its source is unavailable, so the
-    // JS-side fail-safe (collectDeviceInfo) degrades gracefully rather than
-    // sending misleading placeholder values.
-    // IMPORTANT: NOT compile/on-device verified here; reviewed against the
-    // UIKit/Foundation APIs. The JS fail-safe in sdk-react-native ensures a
-    // missing/partial result never blocks attribution.
-    Function("getDeviceInfo") { () -> [String: Any] in
-      var info: [String: Any] = [:]
-
-      // Hardware model identifier (e.g. "iPhone16,1") via utsname, not the
-      // marketing name — matches the Android side's Build.MODEL granularity.
-      var systemInfo = utsname()
-      uname(&systemInfo)
-      let model = withUnsafePointer(to: &systemInfo.machine) {
-        $0.withMemoryRebound(to: CChar.self, capacity: 1) { ptr in
-          String(cString: ptr)
-        }
-      }
-      info["model"] = model
-      info["locale"] = Locale.current.identifier
-      info["timezone"] = TimeZone.current.identifier
-      info["cpuCores"] = ProcessInfo.processInfo.activeProcessorCount
-
-      let (screenWidth, screenHeight, screenDensity) = Self.onMainSync { () -> (Int, Int, Double) in
-        let screen = UIScreen.main
-        return (
-          Int(screen.bounds.width * screen.scale),
-          Int(screen.bounds.height * screen.scale),
-          Double(screen.scale)
-        )
-      }
-      info["screenWidth"] = screenWidth
-      info["screenHeight"] = screenHeight
-      info["screenDensity"] = screenDensity
-
-      if let attrs = try? FileManager.default.attributesOfFileSystem(forPath: NSHomeDirectory()) {
-        let gb = 1024.0 * 1024.0 * 1024.0
-        if let total = attrs[.systemSize] as? NSNumber {
-          info["totalStorageGb"] = total.doubleValue / gb
-        }
-        if let free = attrs[.systemFreeSize] as? NSNumber {
-          info["freeStorageGb"] = free.doubleValue / gb
-        }
-      }
-
-      return info
-    }
-
-    // MARK: - Built-in SDK storage (Adjust-style: the app supplies nothing)
-
-    // Sync key/value storage backing the SDK's offline buffer + state. A
-    // dedicated UserDefaults suite keeps SDK keys out of the app's defaults.
-    Function("storageGetItem") { (key: String) -> String? in
-      Self.sdkDefaults.string(forKey: key)
-    }
-    Function("storageSetItem") { (key: String, value: String) in
-      Self.sdkDefaults.set(value, forKey: key)
-    }
-    Function("storageRemoveItem") { (key: String) in
-      Self.sdkDefaults.removeObject(forKey: key)
-    }
-
-    // MARK: - DMA / TCF consent (read-only)
-
-    // IAB TCF v2 data a TCF-compliant CMP (e.g. Google UMP) writes to the
-    // app's *standard* UserDefaults — deliberately not our io.advenue.sdk
-    // suite. Raw values pass through; the TS side (tcfToConsent) owns the
-    // policy mapping. UserDefaults is thread-safe — no main-thread hop.
-    Function("getTcfData") { () -> [String: Any?]? in
-      let std = UserDefaults.standard
-      // object(forKey:), not integer(forKey:): a missing key must read as
-      // unknown, not 0 ("GDPR does not apply") — a defaulted 0 would strip
-      // consent handling from EEA traffic.
-      let gdprApplies = std.object(forKey: "IABTCF_gdprApplies") as? Int
-      let purposeConsents = std.string(forKey: "IABTCF_PurposeConsents")
-      if gdprApplies == nil && purposeConsents == nil { return nil }
-      return ["gdprApplies": gdprApplies, "purposeConsents": purposeConsents]
-    }
-
-    // Keychain-backed secure storage for the reinstall-durable identifiers
-    // (device id, install guard). kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly:
-    // survives app reinstall, readable after first unlock (background events),
-    // and never migrates via device-to-device backup restore — a restored
-    // backup must NOT clone another device's attribution identity.
-    Function("secureGetItem") { (key: String) -> String? in
-      Self.keychainGet(key)
-    }
-    Function("secureSetItem") { (key: String, value: String) in
-      Self.keychainSet(key, value)
-    }
-    Function("secureRemoveItem") { (key: String) in
-      Self.keychainRemove(key)
-    }
-  }
-
-  // MARK: - Built-in storage helpers
-
-  private static let sdkDefaults: UserDefaults =
-    UserDefaults(suiteName: "io.advenue.sdk") ?? .standard
-
-  // Shares `keychainService` with the App Attest helpers below — same service,
-  // distinct accounts (storage keys vs "app-attest-key-id"), so neither can
-  // read or delete the other's entries.
-  private static func keychainBaseQuery(_ key: String) -> [String: Any] {
-    [
-      kSecClass as String: kSecClassGenericPassword,
-      kSecAttrService as String: keychainService,
-      kSecAttrAccount as String: key,
-    ]
   }
 
-  private static func keychainGet(_ key: String) -> String? {
-    var query = keychainBaseQuery(key)
-    query[kSecReturnData as String] = true
-    query[kSecMatchLimit as String] = kSecMatchLimitOne
-    var result: AnyObject?
-    let status = SecItemCopyMatching(query as CFDictionary, &result)
-    guard status == errSecSuccess, let data = result as? Data else {
-      return nil
-    }
-    return String(data: data, encoding: .utf8)
-  }
-
-  private static func keychainSet(_ key: String, _ value: String) {
-    guard let data = value.data(using: .utf8) else { return }
-    let base = keychainBaseQuery(key)
-    let update: [String: Any] = [kSecValueData as String: data]
-    let status = SecItemUpdate(base as CFDictionary, update as CFDictionary)
-    if status == errSecItemNotFound {
-      var add = base
-      add[kSecValueData as String] = data
-      add[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
-      SecItemAdd(add as CFDictionary, nil)
+  /// reaches the warehouse looking like a measurement.
+  private static func toAdvenueValues(_ raw: [String: Any]) -> [String: AdvenueValue] {
+    var out: [String: AdvenueValue] = [:]
+    for (key, value) in raw {
+      switch value {
+      case let v as String: out[key] = .string(v)
+      case let v as Bool: out[key] = .bool(v)
+      case let v as Int: out[key] = .int(v)
+      case let v as Double: out[key] = .double(v)
+      default: continue
+      }
     }
+    return out
   }
 
-  private static func keychainRemove(_ key: String) {
-    SecItemDelete(keychainBaseQuery(key) as CFDictionary)
-  }
-
-  @available(iOS 14, *)
   private static func attStatusString(_ status: ATTrackingManager.AuthorizationStatus) -> String {
     switch status {
     case .authorized: return "authorized"
@@ -375,93 +176,4 @@ public class AdvenueIosModule: Module {
     default: return "notDetermined"
     }
   }
-
-  // MARK: - App Attest Keychain helpers
-
-  private static let keychainService = "io.advenue.sdk"
-  private static let keychainAccount = "app-attest-key-id"
-
-  /// Loads the persisted App Attest keyId from the Keychain. Returns nil when
-  /// no key has been generated yet; the caller must then call generateKey and
-  /// persist the result via saveKeyId(_:).
-  @available(iOS 14.0, *)
-  private static func loadKeyId() -> String? {
-    let query: [CFString: Any] = [
-      kSecClass: kSecClassGenericPassword,
-      kSecAttrService: keychainService,
-      kSecAttrAccount: keychainAccount,
-      kSecReturnData: true,
-      kSecMatchLimit: kSecMatchLimitOne,
-    ]
-    var item: CFTypeRef?
-    let status = SecItemCopyMatching(query as CFDictionary, &item)
-    guard status == errSecSuccess, let data = item as? Data else { return nil }
-    return String(data: data, encoding: .utf8)
-  }
-
-  /// Persists the App Attest keyId to the Keychain, replacing any prior value.
-  @available(iOS 14.0, *)
-  private static func saveKeyId(_ keyId: String) {
-    guard let data = keyId.data(using: .utf8) else { return }
-    // Try to update an existing item first; fall back to adding a new one.
-    let query: [CFString: Any] = [
-      kSecClass: kSecClassGenericPassword,
-      kSecAttrService: keychainService,
-      kSecAttrAccount: keychainAccount,
-    ]
-    let attributes: [CFString: Any] = [kSecValueData: data]
-    var status = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-    if status == errSecItemNotFound {
-      var addQuery = query
-      addQuery[kSecValueData] = data
-      status = SecItemAdd(addQuery as CFDictionary, nil)
-    }
-    if status != errSecSuccess {
-      NSLog("[Advenue] Keychain write for App Attest keyId failed: %d", status)
-    }
-  }
-
-  /// Removes the persisted App Attest keyId so the next resolveKeyId generates a
-  /// fresh key. Called when Apple reports the cached key as invalid.
-  @available(iOS 14.0, *)
-  private static func deleteKeyId() {
-    let query: [CFString: Any] = [
-      kSecClass: kSecClassGenericPassword,
-      kSecAttrService: keychainService,
-      kSecAttrAccount: keychainAccount,
-    ]
-    let status = SecItemDelete(query as CFDictionary)
-    if status != errSecSuccess && status != errSecItemNotFound {
-      NSLog("[Advenue] Keychain delete for App Attest keyId failed: %d", status)
-    }
-  }
-
-  /// Resolves a DCAppAttest keyId: loads from Keychain if present, otherwise
-  /// generates a new one via DCAppAttestService.generateKey and persists it.
-  @available(iOS 14.0, *)
-  private static func resolveKeyId(
-    service: DCAppAttestService,
-    completion: @escaping (Result<String, Error>) -> Void
-  ) {
-    if let cached = loadKeyId() {
-      completion(.success(cached))
-      return
-    }
-    service.generateKey { keyId, error in
-      if let error = error {
-        completion(.failure(error))
-        return
-      }
-      guard let keyId = keyId else {
-        completion(.failure(NSError(
-          domain: "io.advenue.appattest",
-          code: -1,
-          userInfo: [NSLocalizedDescriptionKey: "generateKey returned nil keyId"]
-        )))
-        return
-      }
-      saveKeyId(keyId)
-      completion(.success(keyId))
-    }
-  }
 }