@bota.dev/react-native-app-sdk 2.0.0-beta.10 → 2.0.0-beta.11

package/lib/typescript/specs/NativeBotaUploadV2Backend.d.ts

@@ -0,0 +1,18 @@
+import type { TurboModule } from 'react-native';
+import type { EventEmitter } from 'react-native/Libraries/Types/CodegenTypes';
+/** Preparation/result JSON contains only bounded identity metadata. Signed
+ * documents and recording bytes stay in the native backend adapter. */
+export interface Spec extends TurboModule {
+    readonly onCredentialsRequested: EventEmitter<{
+        requestId: string;
+        operationId: string;
+    }>;
+    prepare: (inputJSON: string) => Promise<string>;
+    cancel: (operationId: string) => Promise<void>;
+    complete: (operationId: string) => Promise<void>;
+    resolveCredentials: (requestId: string, token: string) => Promise<void>;
+    rejectCredentials: (requestId: string) => Promise<void>;
+}
+declare const _default: Spec | null;
+export default _default;
+//# sourceMappingURL=NativeBotaUploadV2Backend.d.ts.map

package/lib/typescript/specs/NativeBotaUploadV2Backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NativeBotaUploadV2Backend.d.ts","sourceRoot":"","sources":["../../../src/specs/NativeBotaUploadV2Backend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAE9E;uEACuE;AACvE,MAAM,WAAW,IAAK,SAAQ,WAAW;IACvC,QAAQ,CAAC,sBAAsB,EAAE,YAAY,CAAC;QAC5C,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;;AAED,wBAAoE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bota.dev/react-native-app-sdk",
-  "version": "2.0.0-beta.10",
+  "version": "2.0.0-beta.11",
   "description": "React Native facade for the Bota App SDK",
   "packageManager": "npm@12.0.2",
   "main": "lib/commonjs/index.js",

package/src/encryptedUploadV2Backend.ts

@@ -0,0 +1,171 @@
+import type { BotaDeviceSDKRecordingClient, BotaEncryptedUploadV2Recording,
+  BotaEncryptedUploadV2ProfileDecision, BotaEncryptedUploadV2Progress } from './client';
+import type { ConnectedDevice } from './models/Device';
+import type { Spec } from './specs/NativeBotaUploadV2Backend';
+
+export interface EncryptedUploadV2BackendOptions {
+  /** Customer-authenticated HTTPS proxy exposing the v2 routes, e.g. https://api.example.com/v1. */
+  baseUrl: string;
+  /** Stable, non-secret account/project/environment identity. */
+  scopeKey: string;
+  accountId: string;
+  projectId: string;
+  endUserId: string;
+  environment: string;
+  /** Only needed by an organization-scoped backend bridge. */
+  organizationId?: string;
+  /** Abort permanently on logout or any account/project/binding change. */
+  signal: AbortSignal;
+  /** Return an application access token, never a Bota secret API key. */
+  getAccessToken(signal: AbortSignal): Promise<string>;
+}
+
+export interface EncryptedUploadV2SyncTarget {
+  deviceId: string;
+  bindingGeneration: number;
+  signal?: AbortSignal;
+  onProgress?: (progress: BotaEncryptedUploadV2Progress) => void;
+  /** Optional import of an existing integration's exact cloud identity. */
+  priorUpload?: { recordingId: string; sessionId?: string; ownerRevision?: number };
+}
+
+export interface EncryptedUploadV2Backend {
+  /** Reinvoking after restart/reconnect resumes the native journal for this exact recording. */
+  sync(device: ConnectedDevice, recording: BotaEncryptedUploadV2Recording,
+    target: EncryptedUploadV2SyncTarget): Promise<{ recordingId: string }>;
+  dispose(): Promise<void>;
+}
+
+/** @internal Dependency injection keeps the public facade and host tests on the same implementation. */
+export function createManagedEncryptedUploadV2Backend(
+  native: Spec | null, recordings: BotaDeviceSDKRecordingClient,
+  options: EncryptedUploadV2BackendOptions,
+): EncryptedUploadV2Backend {
+  // Capture identity once; mutating the caller's object cannot repoint an active request.
+  const config = { ...options };
+  const url = new URL(config.baseUrl);
+  const path = url.pathname.replace(/\/$/, '');
+  if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash ||
+    !/^(\/[A-Za-z0-9_-]+)+$/.test(path) || !config.scopeKey || !config.signal) {
+    throw new Error('Invalid encrypted upload backend configuration');
+  }
+  const apiOrigin = url.origin;
+  const attempts = new Set<{ cancel(): Promise<void>; settled: Promise<void> }>();
+  let disposed = false;
+  const backend: EncryptedUploadV2Backend = {
+    async sync(device, recording, target) {
+      device = { ...device };
+      recording = { ...recording };
+      target = { ...target, priorUpload: target.priorUpload && { ...target.priorUpload } };
+      if (!native) throw new Error('Encrypted upload backend requires the matching native SDK binary');
+      if (disposed || config.signal.aborted || target.signal?.aborted) throw new Error('Encrypted upload cancelled');
+      const signal = new AbortController();
+      let operationId: string | undefined;
+      let selected: (BotaEncryptedUploadV2ProfileDecision & { recordingId: string }) | undefined;
+      let cancelTask: Promise<void> | undefined;
+      let completed = false;
+      const check = () => {
+        if (disposed || signal.signal.aborted || config.signal.aborted || target.signal?.aborted) {
+          throw new Error('Encrypted upload cancelled');
+        }
+      };
+      const cancel = () => {
+        signal.abort();
+        if (operationId) cancelTask ??= Promise.resolve().then(() => native.cancel(operationId!));
+        return cancelTask ?? Promise.resolve();
+      };
+      // Event callbacks must not create unhandled rejections; disposal awaits the same task.
+      const abort = () => { void cancel().catch(() => {}); };
+      let settle!: () => void;
+      const settled = new Promise<void>(resolve => { settle = resolve; });
+      const attempt = { cancel, settled };
+      attempts.add(attempt);
+      let subscription: { remove(): void } | undefined;
+      try {
+        config.signal.addEventListener('abort', abort, { once: true });
+        target.signal?.addEventListener('abort', abort, { once: true });
+        subscription = native.onCredentialsRequested(event => {
+          if (!operationId || event.operationId !== operationId) return;
+          void (async () => {
+            try {
+              check();
+              const token = await config.getAccessToken(signal.signal);
+              check();
+              await native.resolveCredentials(event.requestId, token);
+            } catch { await native.rejectCredentials(event.requestId).catch(() => {}); }
+          })();
+        });
+        check();
+        await recordings.syncEncryptedRecordingV2(device, recording, async context => {
+          check();
+          if (!context.operationId || (operationId && operationId !== context.operationId)) {
+            throw new Error('Encrypted upload operation changed');
+          }
+          operationId = context.operationId;
+          const value: unknown = JSON.parse(await native.prepare(JSON.stringify({
+            operationId,
+            scope: { apiOrigin, apiBasePath: path, scopeKey: config.scopeKey,
+              accountId: config.accountId, projectId: config.projectId, endUserId: config.endUserId,
+              organizationId: config.organizationId ?? '', environment: config.environment,
+              deviceId: target.deviceId, bindingGeneration: target.bindingGeneration,
+              serialNumber: device.serialNumber, nativeDeviceId: device.id },
+            recording: { uuid: context.recording.uuid, generation: context.recording.generation,
+              ciphertextLength: context.recording.ciphertextLength, ciphertextSha256: context.recording.ciphertextSha256,
+              startedAtMs: context.recording.startedAtMs, durationMs: context.recording.durationMs,
+              plaintextLength: context.recording.plaintextLength, storageFormat: context.recording.storageFormat },
+            capability: { rawValueHex: context.capability.rawValueHex, flags: context.capability.flags },
+            ...(context.checkpoint === undefined ? {} : { checkpoint: {
+              version: context.checkpoint.version, uploadSessionId: context.checkpoint.uploadSessionId,
+              ownerRevision: context.checkpoint.ownerRevision, revision: context.checkpoint.revision,
+              nextCiphertextOffset: context.checkpoint.nextCiphertextOffset, prefixSha256: context.checkpoint.prefixSha256,
+              highestContiguousSequence: context.checkpoint.highestContiguousSequence,
+              transportSessionId: context.checkpoint.transportSessionId, sinkRegistrationId: context.checkpoint.sinkRegistrationId,
+              windowPackets: context.checkpoint.windowPackets, dataPayloadBytes: context.checkpoint.dataPayloadBytes,
+            } }),
+            ...(target.priorUpload === undefined ? {} : { priorJournalEntry: {
+              recordingId: target.priorUpload.recordingId, sessionId: target.priorUpload.sessionId,
+              ownerRevision: target.priorUpload.ownerRevision } }),
+          })));
+          check();
+          const result = value as NonNullable<typeof selected>;
+          if (!result || result.profile !== 'encrypted_upload_v2' ||
+            !/^rec_[A-Za-z0-9_-]+$/.test(result.recordingId) ||
+            !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/.test(result.uploadSessionId) ||
+            !Number.isSafeInteger(result.ownerRevision) || result.ownerRevision < 1 ||
+            !result.materialRegistrationId || !['legacy_allowed', 'v2_preferred', 'v2_required'].includes(result.securityPolicy)) {
+            throw new Error('Invalid encrypted upload backend response');
+          }
+          selected = result;
+          return { profile: result.profile, uploadSessionId: result.uploadSessionId,
+            ownerRevision: result.ownerRevision, securityPolicy: result.securityPolicy,
+            materialRegistrationId: result.materialRegistrationId };
+        }, progress => { if (!signal.signal.aborted) target.onProgress?.(progress); }, { signal: signal.signal });
+        check();
+        if (!operationId || !selected) throw new Error('Encrypted upload confirmation is missing');
+        // The native sync only resolves after signed receipt/CONFIRM. Never infer this from HTTP 2xx.
+        await native.complete(operationId);
+        completed = true;
+        return { recordingId: selected.recordingId };
+      } finally {
+        // Native complete already releases the operation. A later bridge cancellation
+        // failure must not turn confirmed device cleanup into a retryable sync failure.
+        try { if (completed) signal.abort(); else await cancel(); }
+        finally {
+          attempts.delete(attempt);
+          config.signal.removeEventListener('abort', abort);
+          target.signal?.removeEventListener('abort', abort);
+          subscription?.remove();
+          settle();
+        }
+      }
+    },
+    async dispose() {
+      disposed = true;
+      const results = await Promise.allSettled([...attempts].map(async attempt => {
+        try { await attempt.cancel(); } finally { await attempt.settled; }
+      }));
+      if (results.some(result => result.status === 'rejected')) throw new Error('Encrypted upload cancellation failed');
+    },
+  };
+  return backend;
+}

package/src/index.ts

@@ -1,5 +1,8 @@
 import NativeBotaDeviceSDK from './specs/NativeBotaDeviceSDK';
 import { createBotaDeviceSDK } from './client';
+import NativeBotaUploadV2Backend from './specs/NativeBotaUploadV2Backend';
+import { createManagedEncryptedUploadV2Backend } from './encryptedUploadV2Backend';
+import type { EncryptedUploadV2BackendOptions } from './encryptedUploadV2Backend';
 import { setDefaultCompatibilityClient } from './compatibility/runtime';
 
 export {
@@ -52,6 +55,9 @@ export type {
 } from './client';
 
 export const BotaDeviceSDK = createBotaDeviceSDK(NativeBotaDeviceSDK);
+export const createEncryptedUploadV2Backend = (options: EncryptedUploadV2BackendOptions) =>
+  createManagedEncryptedUploadV2Backend(NativeBotaUploadV2Backend, BotaDeviceSDK.recordings, options);
+export type { EncryptedUploadV2BackendOptions, EncryptedUploadV2Backend, EncryptedUploadV2SyncTarget } from './encryptedUploadV2Backend';
 setDefaultCompatibilityClient(BotaDeviceSDK);
 
 export { BotaClient } from './BotaClient';

package/src/sdkIdentity.ts

@@ -1,3 +1,3 @@
 // Generated by cargo xtask client-identity generate. Do not edit.
 export const SDK_PACKAGE = '@bota.dev/react-native-app-sdk'
-export const SDK_VERSION = '2.0.0-beta.10'
+export const SDK_VERSION = '2.0.0-beta.11'

package/src/specs/NativeBotaUploadV2Backend.ts

@@ -0,0 +1,19 @@
+import type { TurboModule } from 'react-native';
+import { TurboModuleRegistry } from 'react-native';
+import type { EventEmitter } from 'react-native/Libraries/Types/CodegenTypes';
+
+/** Preparation/result JSON contains only bounded identity metadata. Signed
+ * documents and recording bytes stay in the native backend adapter. */
+export interface Spec extends TurboModule {
+  readonly onCredentialsRequested: EventEmitter<{
+    requestId: string;
+    operationId: string;
+  }>;
+  prepare: (inputJSON: string) => Promise<string>;
+  cancel: (operationId: string) => Promise<void>;
+  complete: (operationId: string) => Promise<void>;
+  resolveCredentials: (requestId: string, token: string) => Promise<void>;
+  rejectCredentials: (requestId: string) => Promise<void>;
+}
+
+export default TurboModuleRegistry.get<Spec>('BotaUploadV2Backend');