@clerk/expo-biometrics 0.0.1

package/android/src/test/resources/biometric-credential-storage/v2/biometric_credentials.v2.json

@@ -0,0 +1,50 @@
+{
+  "version": 2,
+  "credentials": [
+    {
+      "id": "td_current_set",
+      "local_key_id": "tdlk_0123456789abcdef0123456789abcdef",
+      "user_id": "user_1",
+      "app_identifier": "com.example.app",
+      "identifier_hint_sha256": "b4c9a289323b21a01c3e940f150eb9b8c542587f1abfd8f0e1cc1ffc5e475514",
+      "policy": "biometry_current_set",
+      "created_at": 1735689600000,
+      "updated_at": 1735689600001,
+      "future_field": { "nested": [1, 2, 3] }
+    },
+    {
+      "id": "td_any",
+      "local_key_id": "tdlk_fedcba9876543210fedcba9876543210",
+      "user_id": "user_2",
+      "app_identifier": "com.example.app",
+      "policy": "biometry_any",
+      "created_at": 1735689700000,
+      "updated_at": 1735689700000
+    },
+    {
+      "id": "td_device_passcode",
+      "local_key_id": "tdlk_00000000000000000000000000000000",
+      "user_id": "user_3",
+      "app_identifier": "com.example.other",
+      "identifier_hint_sha256": null,
+      "policy": "biometry_or_device_passcode",
+      "created_at": 1735689800000,
+      "updated_at": 1735689800000
+    },
+    {
+      "id": "td_future_policy",
+      "local_key_id": "tdlk_11111111111111111111111111111111",
+      "user_id": "user_4",
+      "app_identifier": "com.example.app",
+      "policy": "some_future_policy",
+      "created_at": 1735689900000,
+      "updated_at": 1735689900000
+    },
+    {
+      "id": "td_incomplete",
+      "user_id": "user_5"
+    }
+  ],
+  "pending_cleanup_user_ids": ["user_6"],
+  "future_top_level_key": { "written_by": "a newer SDK" }
+}

package/android/src/test/resources/robolectric.properties

@@ -0,0 +1 @@
+sdk=30

package/dist/ClerkExpoBiometricsModule.d.ts

@@ -0,0 +1,18 @@
+import type { BiometricAvailability, BiometricCredentialKey, BiometricCredentialPolicy, BiometricCredentialRecord, InstallationMarkerResult, SaveRecordOptions } from './types';
+export interface ClerkExpoBiometricsNativeModule {
+    getAppIdentifier(): string;
+    hashIdentifierHint(hint: string): string | null;
+    getAvailability(): Promise<BiometricAvailability>;
+    createKey(policy: BiometricCredentialPolicy): Promise<BiometricCredentialKey>;
+    sign(localKeyId: string, clientData: string, reason: string | null): Promise<string>;
+    hasKey(localKeyId: string): Promise<boolean>;
+    deleteKey(localKeyId: string): Promise<void>;
+    /** JSON-encoded array of records, so fields the bridge cannot represent survive unchanged. */
+    listRecords(): Promise<string>;
+    saveRecord(record: BiometricCredentialRecord, options: SaveRecordOptions): Promise<void>;
+    deleteRecord(localKeyId: string): Promise<void>;
+    ensureInstallationMarker(): Promise<InstallationMarkerResult>;
+}
+declare const _default: ClerkExpoBiometricsNativeModule | null;
+export default _default;
+//# sourceMappingURL=ClerkExpoBiometricsModule.d.ts.map

package/dist/ClerkExpoBiometricsModule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClerkExpoBiometricsModule.d.ts","sourceRoot":"","sources":["../src/ClerkExpoBiometricsModule.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EAClB,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,+BAA+B;IAC9C,gBAAgB,IAAI,MAAM,CAAC;IAC3B,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAChD,eAAe,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClD,SAAS,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC9E,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrF,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,8FAA8F;IAC9F,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,UAAU,CAAC,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,wBAAwB,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAAC;CAC/D;;AAED,wBAAmG"}

package/dist/ClerkExpoBiometricsModule.js

@@ -0,0 +1,26 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ClerkExpoBiometricsModule_exports = {};
+__export(ClerkExpoBiometricsModule_exports, {
+  default: () => ClerkExpoBiometricsModule_default
+});
+module.exports = __toCommonJS(ClerkExpoBiometricsModule_exports);
+var import_expo = require("expo");
+var ClerkExpoBiometricsModule_default = (0, import_expo.requireOptionalNativeModule)("ClerkExpoBiometrics");
+//# sourceMappingURL=ClerkExpoBiometricsModule.js.map

package/dist/ClerkExpoBiometricsModule.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/ClerkExpoBiometricsModule.ts"],"sourcesContent":["import { requireOptionalNativeModule } from 'expo';\n\nimport type {\n  BiometricAvailability,\n  BiometricCredentialKey,\n  BiometricCredentialPolicy,\n  BiometricCredentialRecord,\n  InstallationMarkerResult,\n  SaveRecordOptions,\n} from './types';\n\nexport interface ClerkExpoBiometricsNativeModule {\n  getAppIdentifier(): string;\n  hashIdentifierHint(hint: string): string | null;\n  getAvailability(): Promise<BiometricAvailability>;\n  createKey(policy: BiometricCredentialPolicy): Promise<BiometricCredentialKey>;\n  sign(localKeyId: string, clientData: string, reason: string | null): Promise<string>;\n  hasKey(localKeyId: string): Promise<boolean>;\n  deleteKey(localKeyId: string): Promise<void>;\n  /** JSON-encoded array of records, so fields the bridge cannot represent survive unchanged. */\n  listRecords(): Promise<string>;\n  saveRecord(record: BiometricCredentialRecord, options: SaveRecordOptions): Promise<void>;\n  deleteRecord(localKeyId: string): Promise<void>;\n  ensureInstallationMarker(): Promise<InstallationMarkerResult>;\n}\n\nexport default requireOptionalNativeModule<ClerkExpoBiometricsNativeModule>('ClerkExpoBiometrics');\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAA4C;AA0B5C,IAAO,wCAAQ,yCAA6D,qBAAqB;","names":[]}

package/dist/errors.d.ts

@@ -0,0 +1,11 @@
+import type { BiometricsErrorCode } from './types';
+export declare class ClerkBiometricsError extends Error {
+    readonly code: BiometricsErrorCode;
+    constructor(code: BiometricsErrorCode, message: string, options?: {
+        cause?: unknown;
+    });
+}
+export declare function isClerkBiometricsError(error: unknown): error is ClerkBiometricsError;
+export declare function isBiometricsErrorCode(value: unknown): value is BiometricsErrorCode;
+export declare function toClerkBiometricsError(error: unknown): ClerkBiometricsError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAuBnD,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;gBAEvB,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAKtF;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAEpF;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAElF;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAO3E"}

package/dist/errors.js

@@ -0,0 +1,75 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var errors_exports = {};
+__export(errors_exports, {
+  ClerkBiometricsError: () => ClerkBiometricsError,
+  isBiometricsErrorCode: () => isBiometricsErrorCode,
+  isClerkBiometricsError: () => isClerkBiometricsError,
+  toClerkBiometricsError: () => toClerkBiometricsError
+});
+module.exports = __toCommonJS(errors_exports);
+const ERROR_CODES = /* @__PURE__ */ new Set([
+  "user_canceled",
+  "system_canceled",
+  "user_fallback",
+  "authentication_failed",
+  "biometry_not_available",
+  "biometry_not_enrolled",
+  "biometry_lockout",
+  "passcode_not_set",
+  "secure_key_storage_unavailable",
+  "key_not_found",
+  "key_invalidated",
+  "key_generation_failed",
+  "signing_failed",
+  "storage_failed",
+  "invalid_argument",
+  "not_implemented",
+  "native_module_unavailable",
+  "unknown"
+]);
+class ClerkBiometricsError extends Error {
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "ClerkBiometricsError";
+    this.code = code;
+  }
+}
+function isClerkBiometricsError(error) {
+  return error instanceof ClerkBiometricsError;
+}
+function isBiometricsErrorCode(value) {
+  return typeof value === "string" && ERROR_CODES.has(value);
+}
+function toClerkBiometricsError(error) {
+  if (error instanceof ClerkBiometricsError) {
+    return error;
+  }
+  const code = error == null ? void 0 : error.code;
+  const message = error instanceof Error ? error.message : String(error);
+  return new ClerkBiometricsError(isBiometricsErrorCode(code) ? code : "unknown", message, { cause: error });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ClerkBiometricsError,
+  isBiometricsErrorCode,
+  isClerkBiometricsError,
+  toClerkBiometricsError
+});
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts"],"sourcesContent":["import type { BiometricsErrorCode } from './types';\n\nconst ERROR_CODES: ReadonlySet<string> = new Set<BiometricsErrorCode>([\n  'user_canceled',\n  'system_canceled',\n  'user_fallback',\n  'authentication_failed',\n  'biometry_not_available',\n  'biometry_not_enrolled',\n  'biometry_lockout',\n  'passcode_not_set',\n  'secure_key_storage_unavailable',\n  'key_not_found',\n  'key_invalidated',\n  'key_generation_failed',\n  'signing_failed',\n  'storage_failed',\n  'invalid_argument',\n  'not_implemented',\n  'native_module_unavailable',\n  'unknown',\n]);\n\nexport class ClerkBiometricsError extends Error {\n  readonly code: BiometricsErrorCode;\n\n  constructor(code: BiometricsErrorCode, message: string, options?: { cause?: unknown }) {\n    super(message, options);\n    this.name = 'ClerkBiometricsError';\n    this.code = code;\n  }\n}\n\nexport function isClerkBiometricsError(error: unknown): error is ClerkBiometricsError {\n  return error instanceof ClerkBiometricsError;\n}\n\nexport function isBiometricsErrorCode(value: unknown): value is BiometricsErrorCode {\n  return typeof value === 'string' && ERROR_CODES.has(value);\n}\n\nexport function toClerkBiometricsError(error: unknown): ClerkBiometricsError {\n  if (error instanceof ClerkBiometricsError) {\n    return error;\n  }\n  const code = (error as { code?: unknown } | null)?.code;\n  const message = error instanceof Error ? error.message : String(error);\n  return new ClerkBiometricsError(isBiometricsErrorCode(code) ? code : 'unknown', message, { cause: error });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,MAAM,cAAmC,oBAAI,IAAyB;AAAA,EACpE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,MAAM,6BAA6B,MAAM;AAAA,EAG9C,YAAY,MAA2B,SAAiB,SAA+B;AACrF,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,uBAAuB,OAA+C;AACpF,SAAO,iBAAiB;AAC1B;AAEO,SAAS,sBAAsB,OAA8C;AAClF,SAAO,OAAO,UAAU,YAAY,YAAY,IAAI,KAAK;AAC3D;AAEO,SAAS,uBAAuB,OAAsC;AAC3E,MAAI,iBAAiB,sBAAsB;AACzC,WAAO;AAAA,EACT;AACA,QAAM,OAAQ,+BAAqC;AACnD,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,SAAO,IAAI,qBAAqB,sBAAsB,IAAI,IAAI,OAAO,WAAW,SAAS,EAAE,OAAO,MAAM,CAAC;AAC3G;","names":[]}

package/dist/index.d.ts

@@ -0,0 +1,57 @@
+import type { BiometricAvailability, BiometricCredentialKey, BiometricCredentialPolicy, BiometricCredentialRecord, InstallationMarkerResult, SaveRecordOptions, StoredBiometricCredentialRecord } from './types';
+export { ClerkBiometricsError, isBiometricsErrorCode, isClerkBiometricsError } from './errors';
+export type { BiometricAvailability, BiometricCredentialKey, BiometricCredentialPolicy, BiometricCredentialRecord, BiometricsErrorCode, BiometryType, InstallationMarkerResult, SaveRecordOptions, StoredBiometricCredentialRecord, } from './types';
+/**
+ * Returns the identifier Clerk uses as the credential's `app_identifier` (the iOS bundle identifier or the Android package name).
+ */
+export declare function getAppIdentifier(): string;
+/**
+ * Returns the SHA-256 of `hint` after trimming and lowercasing it, as 64 lowercase hex characters, or `null` when the
+ * normalized hint is empty. Compare it with a record's `identifierHintSha256` to match an identifier on every platform.
+ */
+export declare function hashIdentifierHint(hint: string): string | null;
+/**
+ * Reports which biometry the device supports and whether it can be used right now.
+ */
+export declare function getAvailability(): Promise<BiometricAvailability>;
+/**
+ * Creates a new hardware-backed P-256 private key protected by `policy`.
+ * Rejects with `secure_key_storage_unavailable` when the device has no hardware-backed key storage (see `getAvailability()`),
+ * and with `biometry_not_available`, `biometry_not_enrolled`, or `biometry_lockout` when biometrics cannot be used.
+ */
+export declare function createKey(policy: BiometricCredentialPolicy): Promise<BiometricCredentialKey>;
+/**
+ * Prompts for local authentication and signs the UTF-8 bytes of `clientData` with ES256.
+ * Resolves with the raw `r || s` signature, base64url-encoded without padding.
+ *
+ * @param reason - The message shown in the authentication prompt. On Android it is the prompt title, which defaults to the app name.
+ */
+export declare function sign(localKeyId: string, clientData: string, reason?: string | null): Promise<string>;
+/**
+ * Resolves whether the private key for `localKeyId` exists. Does not prompt for authentication.
+ */
+export declare function hasKey(localKeyId: string): Promise<boolean>;
+/**
+ * Deletes the private key for `localKeyId`. Resolves when the key does not exist.
+ */
+export declare function deleteKey(localKeyId: string): Promise<void>;
+/**
+ * Lists every well-formed credential record on the device, for every app identifier.
+ */
+export declare function listRecords(): Promise<StoredBiometricCredentialRecord[]>;
+/**
+ * Saves `record`, replacing any record with the same `id`. When the replaced record used a different key, that key is deleted.
+ */
+export declare function saveRecord(record: BiometricCredentialRecord, options: SaveRecordOptions): Promise<void>;
+/**
+ * Deletes the private key for `localKeyId`, then every record that references it.
+ * When the key cannot be deleted the records are kept and the promise rejects.
+ */
+export declare function deleteRecord(localKeyId: string): Promise<void>;
+/**
+ * Detects a new installation and deletes the records and keys a previous installation of this app left in the Keychain.
+ * Safe to call repeatedly. The store operations above call it before they read or write.
+ * On Android it always resolves `{ wiped: false }`: uninstalling the app deletes its records and keys.
+ */
+export declare function ensureInstallationMarker(): Promise<InstallationMarkerResult>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,+BAA+B,EAChC,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAC/F,YAAY,EACV,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,iBAAiB,EACjB,+BAA+B,GAChC,MAAM,SAAS,CAAC;AA0EjB;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK9D;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAEhE;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAGlG;AAED;;;;;GAKG;AACH,wBAAsB,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,GAAG,IAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAMhH;AAED;;GAEG;AACH,wBAAsB,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGjE;AAED;;GAEG;AACH,wBAAsB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGjE;AAED;;GAEG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,+BAA+B,EAAE,CAAC,CAc9E;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB7G;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGpE;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAE5E"}

package/dist/index.js

@@ -0,0 +1,204 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var index_exports = {};
+__export(index_exports, {
+  ClerkBiometricsError: () => import_errors2.ClerkBiometricsError,
+  createKey: () => createKey,
+  deleteKey: () => deleteKey,
+  deleteRecord: () => deleteRecord,
+  ensureInstallationMarker: () => ensureInstallationMarker,
+  getAppIdentifier: () => getAppIdentifier,
+  getAvailability: () => getAvailability,
+  hasKey: () => hasKey,
+  hashIdentifierHint: () => hashIdentifierHint,
+  isBiometricsErrorCode: () => import_errors2.isBiometricsErrorCode,
+  isClerkBiometricsError: () => import_errors2.isClerkBiometricsError,
+  listRecords: () => listRecords,
+  saveRecord: () => saveRecord,
+  sign: () => sign
+});
+module.exports = __toCommonJS(index_exports);
+var import_ClerkExpoBiometricsModule = __toESM(require("./ClerkExpoBiometricsModule"));
+var import_errors = require("./errors");
+var import_errors2 = require("./errors");
+const POLICIES = /* @__PURE__ */ new Set([
+  "biometry_current_set",
+  "biometry_any",
+  "biometry_or_device_passcode"
+]);
+function nativeModule() {
+  if (!import_ClerkExpoBiometricsModule.default) {
+    throw new import_errors.ClerkBiometricsError(
+      "native_module_unavailable",
+      "The ClerkExpoBiometrics native module is not available. Rebuild your app with @clerk/expo-biometrics installed; it cannot run in Expo Go or on the web."
+    );
+  }
+  return import_ClerkExpoBiometricsModule.default;
+}
+async function callNative(fn) {
+  const module2 = nativeModule();
+  try {
+    return await fn(module2);
+  } catch (error) {
+    throw (0, import_errors.toClerkBiometricsError)(error);
+  }
+}
+function invalidArgument(message) {
+  return new import_errors.ClerkBiometricsError("invalid_argument", message);
+}
+function assertNonEmptyString(value, name) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw invalidArgument(`${name} must be a non-empty string.`);
+  }
+}
+function assertPolicy(value) {
+  if (typeof value !== "string" || !POLICIES.has(value)) {
+    throw invalidArgument(`policy must be one of ${[...POLICIES].join(", ")}.`);
+  }
+}
+function assertTimestamp(value, name) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+    throw invalidArgument(`${name} must be a non-negative number of milliseconds since the Unix epoch.`);
+  }
+}
+function assertRecord(record) {
+  if (typeof record !== "object" || record === null) {
+    throw invalidArgument("record must be an object.");
+  }
+  assertNonEmptyString(record.id, "record.id");
+  assertNonEmptyString(record.localKeyId, "record.localKeyId");
+  assertNonEmptyString(record.userId, "record.userId");
+  assertNonEmptyString(record.appIdentifier, "record.appIdentifier");
+  if (record.identifierHint !== void 0 && typeof record.identifierHint !== "string") {
+    throw invalidArgument("record.identifierHint must be a string when provided.");
+  }
+  assertPolicy(record.policy);
+  assertTimestamp(record.createdAt, "record.createdAt");
+  assertTimestamp(record.updatedAt, "record.updatedAt");
+}
+function callNativeSync(fn) {
+  const module2 = nativeModule();
+  try {
+    return fn(module2);
+  } catch (error) {
+    throw (0, import_errors.toClerkBiometricsError)(error);
+  }
+}
+function getAppIdentifier() {
+  return callNativeSync((module2) => module2.getAppIdentifier());
+}
+function hashIdentifierHint(hint) {
+  if (typeof hint !== "string") {
+    throw invalidArgument("hint must be a string.");
+  }
+  return callNativeSync((module2) => module2.hashIdentifierHint(hint));
+}
+function getAvailability() {
+  return callNative((module2) => module2.getAvailability());
+}
+async function createKey(policy) {
+  assertPolicy(policy);
+  return callNative((module2) => module2.createKey(policy));
+}
+async function sign(localKeyId, clientData, reason = null) {
+  assertNonEmptyString(localKeyId, "localKeyId");
+  if (typeof clientData !== "string") {
+    throw invalidArgument("clientData must be a string.");
+  }
+  return callNative((module2) => module2.sign(localKeyId, clientData, reason));
+}
+async function hasKey(localKeyId) {
+  assertNonEmptyString(localKeyId, "localKeyId");
+  return callNative((module2) => module2.hasKey(localKeyId));
+}
+async function deleteKey(localKeyId) {
+  assertNonEmptyString(localKeyId, "localKeyId");
+  return callNative((module2) => module2.deleteKey(localKeyId));
+}
+async function listRecords() {
+  const json = await callNative((module2) => module2.listRecords());
+  let records;
+  try {
+    records = JSON.parse(json);
+  } catch (error) {
+    throw new import_errors.ClerkBiometricsError("storage_failed", "The native module returned invalid record data.", {
+      cause: error
+    });
+  }
+  if (!Array.isArray(records)) {
+    throw new import_errors.ClerkBiometricsError("storage_failed", "The native module returned invalid record data.");
+  }
+  return records;
+}
+async function saveRecord(record, options) {
+  assertRecord(record);
+  if (typeof (options == null ? void 0 : options.removeOtherRecordsForApp) !== "boolean") {
+    throw invalidArgument("options.removeOtherRecordsForApp must be a boolean.");
+  }
+  const nativeRecord = {
+    id: record.id,
+    localKeyId: record.localKeyId,
+    userId: record.userId,
+    appIdentifier: record.appIdentifier,
+    policy: record.policy,
+    createdAt: record.createdAt,
+    updatedAt: record.updatedAt
+  };
+  if (record.identifierHint !== void 0) {
+    nativeRecord.identifierHint = record.identifierHint;
+  }
+  return callNative(
+    (module2) => module2.saveRecord(nativeRecord, { removeOtherRecordsForApp: options.removeOtherRecordsForApp })
+  );
+}
+async function deleteRecord(localKeyId) {
+  assertNonEmptyString(localKeyId, "localKeyId");
+  return callNative((module2) => module2.deleteRecord(localKeyId));
+}
+function ensureInstallationMarker() {
+  return callNative((module2) => module2.ensureInstallationMarker());
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ClerkBiometricsError,
+  createKey,
+  deleteKey,
+  deleteRecord,
+  ensureInstallationMarker,
+  getAppIdentifier,
+  getAvailability,
+  hasKey,
+  hashIdentifierHint,
+  isBiometricsErrorCode,
+  isClerkBiometricsError,
+  listRecords,
+  saveRecord,
+  sign
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type { ClerkExpoBiometricsNativeModule } from './ClerkExpoBiometricsModule';\nimport ClerkExpoBiometrics from './ClerkExpoBiometricsModule';\nimport { ClerkBiometricsError, toClerkBiometricsError } from './errors';\nimport type {\n  BiometricAvailability,\n  BiometricCredentialKey,\n  BiometricCredentialPolicy,\n  BiometricCredentialRecord,\n  InstallationMarkerResult,\n  SaveRecordOptions,\n  StoredBiometricCredentialRecord,\n} from './types';\n\nexport { ClerkBiometricsError, isBiometricsErrorCode, isClerkBiometricsError } from './errors';\nexport type {\n  BiometricAvailability,\n  BiometricCredentialKey,\n  BiometricCredentialPolicy,\n  BiometricCredentialRecord,\n  BiometricsErrorCode,\n  BiometryType,\n  InstallationMarkerResult,\n  SaveRecordOptions,\n  StoredBiometricCredentialRecord,\n} from './types';\n\nconst POLICIES: ReadonlySet<string> = new Set<BiometricCredentialPolicy>([\n  'biometry_current_set',\n  'biometry_any',\n  'biometry_or_device_passcode',\n]);\n\nfunction nativeModule(): ClerkExpoBiometricsNativeModule {\n  if (!ClerkExpoBiometrics) {\n    throw new ClerkBiometricsError(\n      'native_module_unavailable',\n      'The ClerkExpoBiometrics native module is not available. Rebuild your app with @clerk/expo-biometrics installed; it cannot run in Expo Go or on the web.',\n    );\n  }\n  return ClerkExpoBiometrics;\n}\n\nasync function callNative<T>(fn: (module: ClerkExpoBiometricsNativeModule) => Promise<T>): Promise<T> {\n  const module = nativeModule();\n  try {\n    return await fn(module);\n  } catch (error) {\n    throw toClerkBiometricsError(error);\n  }\n}\n\nfunction invalidArgument(message: string): ClerkBiometricsError {\n  return new ClerkBiometricsError('invalid_argument', message);\n}\n\nfunction assertNonEmptyString(value: unknown, name: string): asserts value is string {\n  if (typeof value !== 'string' || value.length === 0) {\n    throw invalidArgument(`${name} must be a non-empty string.`);\n  }\n}\n\nfunction assertPolicy(value: unknown): asserts value is BiometricCredentialPolicy {\n  if (typeof value !== 'string' || !POLICIES.has(value)) {\n    throw invalidArgument(`policy must be one of ${[...POLICIES].join(', ')}.`);\n  }\n}\n\nfunction assertTimestamp(value: unknown, name: string): asserts value is number {\n  if (typeof value !== 'number' || !Number.isFinite(value) || value < 0) {\n    throw invalidArgument(`${name} must be a non-negative number of milliseconds since the Unix epoch.`);\n  }\n}\n\nfunction assertRecord(record: BiometricCredentialRecord): void {\n  if (typeof record !== 'object' || record === null) {\n    throw invalidArgument('record must be an object.');\n  }\n  assertNonEmptyString(record.id, 'record.id');\n  assertNonEmptyString(record.localKeyId, 'record.localKeyId');\n  assertNonEmptyString(record.userId, 'record.userId');\n  assertNonEmptyString(record.appIdentifier, 'record.appIdentifier');\n  if (record.identifierHint !== undefined && typeof record.identifierHint !== 'string') {\n    throw invalidArgument('record.identifierHint must be a string when provided.');\n  }\n  assertPolicy(record.policy);\n  assertTimestamp(record.createdAt, 'record.createdAt');\n  assertTimestamp(record.updatedAt, 'record.updatedAt');\n}\n\nfunction callNativeSync<T>(fn: (module: ClerkExpoBiometricsNativeModule) => T): T {\n  const module = nativeModule();\n  try {\n    return fn(module);\n  } catch (error) {\n    throw toClerkBiometricsError(error);\n  }\n}\n\n/**\n * Returns the identifier Clerk uses as the credential's `app_identifier` (the iOS bundle identifier or the Android package name).\n */\nexport function getAppIdentifier(): string {\n  return callNativeSync(module => module.getAppIdentifier());\n}\n\n/**\n * Returns the SHA-256 of `hint` after trimming and lowercasing it, as 64 lowercase hex characters, or `null` when the\n * normalized hint is empty. Compare it with a record's `identifierHintSha256` to match an identifier on every platform.\n */\nexport function hashIdentifierHint(hint: string): string | null {\n  if (typeof hint !== 'string') {\n    throw invalidArgument('hint must be a string.');\n  }\n  return callNativeSync(module => module.hashIdentifierHint(hint));\n}\n\n/**\n * Reports which biometry the device supports and whether it can be used right now.\n */\nexport function getAvailability(): Promise<BiometricAvailability> {\n  return callNative(module => module.getAvailability());\n}\n\n/**\n * Creates a new hardware-backed P-256 private key protected by `policy`.\n * Rejects with `secure_key_storage_unavailable` when the device has no hardware-backed key storage (see `getAvailability()`),\n * and with `biometry_not_available`, `biometry_not_enrolled`, or `biometry_lockout` when biometrics cannot be used.\n */\nexport async function createKey(policy: BiometricCredentialPolicy): Promise<BiometricCredentialKey> {\n  assertPolicy(policy);\n  return callNative(module => module.createKey(policy));\n}\n\n/**\n * Prompts for local authentication and signs the UTF-8 bytes of `clientData` with ES256.\n * Resolves with the raw `r || s` signature, base64url-encoded without padding.\n *\n * @param reason - The message shown in the authentication prompt. On Android it is the prompt title, which defaults to the app name.\n */\nexport async function sign(localKeyId: string, clientData: string, reason: string | null = null): Promise<string> {\n  assertNonEmptyString(localKeyId, 'localKeyId');\n  if (typeof clientData !== 'string') {\n    throw invalidArgument('clientData must be a string.');\n  }\n  return callNative(module => module.sign(localKeyId, clientData, reason));\n}\n\n/**\n * Resolves whether the private key for `localKeyId` exists. Does not prompt for authentication.\n */\nexport async function hasKey(localKeyId: string): Promise<boolean> {\n  assertNonEmptyString(localKeyId, 'localKeyId');\n  return callNative(module => module.hasKey(localKeyId));\n}\n\n/**\n * Deletes the private key for `localKeyId`. Resolves when the key does not exist.\n */\nexport async function deleteKey(localKeyId: string): Promise<void> {\n  assertNonEmptyString(localKeyId, 'localKeyId');\n  return callNative(module => module.deleteKey(localKeyId));\n}\n\n/**\n * Lists every well-formed credential record on the device, for every app identifier.\n */\nexport async function listRecords(): Promise<StoredBiometricCredentialRecord[]> {\n  const json = await callNative(module => module.listRecords());\n  let records: unknown;\n  try {\n    records = JSON.parse(json);\n  } catch (error) {\n    throw new ClerkBiometricsError('storage_failed', 'The native module returned invalid record data.', {\n      cause: error,\n    });\n  }\n  if (!Array.isArray(records)) {\n    throw new ClerkBiometricsError('storage_failed', 'The native module returned invalid record data.');\n  }\n  return records as StoredBiometricCredentialRecord[];\n}\n\n/**\n * Saves `record`, replacing any record with the same `id`. When the replaced record used a different key, that key is deleted.\n */\nexport async function saveRecord(record: BiometricCredentialRecord, options: SaveRecordOptions): Promise<void> {\n  assertRecord(record);\n  if (typeof options?.removeOtherRecordsForApp !== 'boolean') {\n    throw invalidArgument('options.removeOtherRecordsForApp must be a boolean.');\n  }\n  const nativeRecord: BiometricCredentialRecord = {\n    id: record.id,\n    localKeyId: record.localKeyId,\n    userId: record.userId,\n    appIdentifier: record.appIdentifier,\n    policy: record.policy,\n    createdAt: record.createdAt,\n    updatedAt: record.updatedAt,\n  };\n  if (record.identifierHint !== undefined) {\n    nativeRecord.identifierHint = record.identifierHint;\n  }\n  return callNative(module =>\n    module.saveRecord(nativeRecord, { removeOtherRecordsForApp: options.removeOtherRecordsForApp }),\n  );\n}\n\n/**\n * Deletes the private key for `localKeyId`, then every record that references it.\n * When the key cannot be deleted the records are kept and the promise rejects.\n */\nexport async function deleteRecord(localKeyId: string): Promise<void> {\n  assertNonEmptyString(localKeyId, 'localKeyId');\n  return callNative(module => module.deleteRecord(localKeyId));\n}\n\n/**\n * Detects a new installation and deletes the records and keys a previous installation of this app left in the Keychain.\n * Safe to call repeatedly. The store operations above call it before they read or write.\n * On Android it always resolves `{ wiped: false }`: uninstalling the app deletes its records and keys.\n */\nexport function ensureInstallationMarker(): Promise<InstallationMarkerResult> {\n  return callNative(module => module.ensureInstallationMarker());\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,uCAAgC;AAChC,oBAA6D;AAW7D,IAAAA,iBAAoF;AAapF,MAAM,WAAgC,oBAAI,IAA+B;AAAA,EACvE;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,eAAgD;AACvD,MAAI,CAAC,iCAAAC,SAAqB;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,iCAAAA;AACT;AAEA,eAAe,WAAc,IAAyE;AACpG,QAAMC,UAAS,aAAa;AAC5B,MAAI;AACF,WAAO,MAAM,GAAGA,OAAM;AAAA,EACxB,SAAS,OAAO;AACd,cAAM,sCAAuB,KAAK;AAAA,EACpC;AACF;AAEA,SAAS,gBAAgB,SAAuC;AAC9D,SAAO,IAAI,mCAAqB,oBAAoB,OAAO;AAC7D;AAEA,SAAS,qBAAqB,OAAgB,MAAuC;AACnF,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,gBAAgB,GAAG,IAAI,8BAA8B;AAAA,EAC7D;AACF;AAEA,SAAS,aAAa,OAA4D;AAChF,MAAI,OAAO,UAAU,YAAY,CAAC,SAAS,IAAI,KAAK,GAAG;AACrD,UAAM,gBAAgB,yBAAyB,CAAC,GAAG,QAAQ,EAAE,KAAK,IAAI,CAAC,GAAG;AAAA,EAC5E;AACF;AAEA,SAAS,gBAAgB,OAAgB,MAAuC;AAC9E,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,GAAG;AACrE,UAAM,gBAAgB,GAAG,IAAI,sEAAsE;AAAA,EACrG;AACF;AAEA,SAAS,aAAa,QAAyC;AAC7D,MAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AACjD,UAAM,gBAAgB,2BAA2B;AAAA,EACnD;AACA,uBAAqB,OAAO,IAAI,WAAW;AAC3C,uBAAqB,OAAO,YAAY,mBAAmB;AAC3D,uBAAqB,OAAO,QAAQ,eAAe;AACnD,uBAAqB,OAAO,eAAe,sBAAsB;AACjE,MAAI,OAAO,mBAAmB,UAAa,OAAO,OAAO,mBAAmB,UAAU;AACpF,UAAM,gBAAgB,uDAAuD;AAAA,EAC/E;AACA,eAAa,OAAO,MAAM;AAC1B,kBAAgB,OAAO,WAAW,kBAAkB;AACpD,kBAAgB,OAAO,WAAW,kBAAkB;AACtD;AAEA,SAAS,eAAkB,IAAuD;AAChF,QAAMA,UAAS,aAAa;AAC5B,MAAI;AACF,WAAO,GAAGA,OAAM;AAAA,EAClB,SAAS,OAAO;AACd,cAAM,sCAAuB,KAAK;AAAA,EACpC;AACF;AAKO,SAAS,mBAA2B;AACzC,SAAO,eAAe,CAAAA,YAAUA,QAAO,iBAAiB,CAAC;AAC3D;AAMO,SAAS,mBAAmB,MAA6B;AAC9D,MAAI,OAAO,SAAS,UAAU;AAC5B,UAAM,gBAAgB,wBAAwB;AAAA,EAChD;AACA,SAAO,eAAe,CAAAA,YAAUA,QAAO,mBAAmB,IAAI,CAAC;AACjE;AAKO,SAAS,kBAAkD;AAChE,SAAO,WAAW,CAAAA,YAAUA,QAAO,gBAAgB,CAAC;AACtD;AAOA,eAAsB,UAAU,QAAoE;AAClG,eAAa,MAAM;AACnB,SAAO,WAAW,CAAAA,YAAUA,QAAO,UAAU,MAAM,CAAC;AACtD;AAQA,eAAsB,KAAK,YAAoB,YAAoB,SAAwB,MAAuB;AAChH,uBAAqB,YAAY,YAAY;AAC7C,MAAI,OAAO,eAAe,UAAU;AAClC,UAAM,gBAAgB,8BAA8B;AAAA,EACtD;AACA,SAAO,WAAW,CAAAA,YAAUA,QAAO,KAAK,YAAY,YAAY,MAAM,CAAC;AACzE;AAKA,eAAsB,OAAO,YAAsC;AACjE,uBAAqB,YAAY,YAAY;AAC7C,SAAO,WAAW,CAAAA,YAAUA,QAAO,OAAO,UAAU,CAAC;AACvD;AAKA,eAAsB,UAAU,YAAmC;AACjE,uBAAqB,YAAY,YAAY;AAC7C,SAAO,WAAW,CAAAA,YAAUA,QAAO,UAAU,UAAU,CAAC;AAC1D;AAKA,eAAsB,cAA0D;AAC9E,QAAM,OAAO,MAAM,WAAW,CAAAA,YAAUA,QAAO,YAAY,CAAC;AAC5D,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,IAAI;AAAA,EAC3B,SAAS,OAAO;AACd,UAAM,IAAI,mCAAqB,kBAAkB,mDAAmD;AAAA,MAClG,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,CAAC,MAAM,QAAQ,OAAO,GAAG;AAC3B,UAAM,IAAI,mCAAqB,kBAAkB,iDAAiD;AAAA,EACpG;AACA,SAAO;AACT;AAKA,eAAsB,WAAW,QAAmC,SAA2C;AAC7G,eAAa,MAAM;AACnB,MAAI,QAAO,mCAAS,8BAA6B,WAAW;AAC1D,UAAM,gBAAgB,qDAAqD;AAAA,EAC7E;AACA,QAAM,eAA0C;AAAA,IAC9C,IAAI,OAAO;AAAA,IACX,YAAY,OAAO;AAAA,IACnB,QAAQ,OAAO;AAAA,IACf,eAAe,OAAO;AAAA,IACtB,QAAQ,OAAO;AAAA,IACf,WAAW,OAAO;AAAA,IAClB,WAAW,OAAO;AAAA,EACpB;AACA,MAAI,OAAO,mBAAmB,QAAW;AACvC,iBAAa,iBAAiB,OAAO;AAAA,EACvC;AACA,SAAO;AAAA,IAAW,CAAAA,YAChBA,QAAO,WAAW,cAAc,EAAE,0BAA0B,QAAQ,yBAAyB,CAAC;AAAA,EAChG;AACF;AAMA,eAAsB,aAAa,YAAmC;AACpE,uBAAqB,YAAY,YAAY;AAC7C,SAAO,WAAW,CAAAA,YAAUA,QAAO,aAAa,UAAU,CAAC;AAC7D;AAOO,SAAS,2BAA8D;AAC5E,SAAO,WAAW,CAAAA,YAAUA,QAAO,yBAAyB,CAAC;AAC/D;","names":["import_errors","ClerkExpoBiometrics","module"]}

package/dist/types.d.ts

@@ -0,0 +1,85 @@
+/**
+ * The local authentication policy that protects a biometric credential's private key.
+ *
+ * - `biometry_current_set`: requires a biometric from the currently enrolled set. Adding or removing a Face ID / Touch ID enrollment invalidates the key.
+ * - `biometry_any`: requires a biometric, and survives biometric enrollment changes.
+ * - `biometry_or_device_passcode`: requires biometrics to be available at creation, then accepts a biometric or the device passcode.
+ */
+export type BiometricCredentialPolicy = 'biometry_current_set' | 'biometry_any' | 'biometry_or_device_passcode';
+/**
+ * The biometry the device supports. iOS reports `faceID`, `touchID`, or `opticID`. Android cannot tell which sensor is a
+ * strong (Class 3) biometric, so it reports `biometric` whenever one is present.
+ */
+export type BiometryType = 'faceID' | 'touchID' | 'opticID' | 'biometric' | 'none';
+export interface BiometricAvailability {
+    /** The biometry the device supports, or `none`. */
+    biometryType: BiometryType;
+    /** Whether biometric authentication can be evaluated now. Key creation requires this for every policy. */
+    canEvaluateBiometrics: boolean;
+    /** Whether device owner authentication (biometrics or passcode) can be evaluated now. */
+    canEvaluateDeviceOwner: boolean;
+    /** Why biometric authentication cannot be evaluated, or `null` when it can. */
+    errorCode: BiometricsErrorCode | null;
+    /**
+     * Whether the device has hardware-backed key storage: the Secure Enclave on iOS, which the iOS Simulator lacks, or the
+     * Android Keystore on Android 9 (API level 28) and later.
+     * `createKey()` rejects with `secure_key_storage_unavailable` when this is `false`.
+     */
+    secureKeyStorageAvailable: boolean;
+}
+export interface BiometricCredentialKey {
+    /** Opaque identifier of the private key. Stored in the credential record as `localKeyId`. */
+    localKeyId: string;
+    /** P-256 public key as a compact JWK string: `{"kty":"EC","crv":"P-256","x":"…","y":"…","alg":"ES256"}`. */
+    publicKeyJwk: string;
+}
+/**
+ * On-device metadata linking a Clerk biometric credential to its private key.
+ */
+export interface BiometricCredentialRecord {
+    /** Server credential ID. */
+    id: string;
+    /** Identifier of the private key returned by `createKey()`. */
+    localKeyId: string;
+    /** Clerk user ID that enrolled the credential. */
+    userId: string;
+    /** App identifier the credential was enrolled for (see `getAppIdentifier()`). */
+    appIdentifier: string;
+    /**
+     * Local-only identifier hint. Normalized (trimmed, lowercased) when stored; empty values are omitted.
+     * iOS stores the normalized hint; Android stores only its hash (see `hashIdentifierHint()`).
+     */
+    identifierHint?: string;
+    policy: BiometricCredentialPolicy;
+    /** Server credential creation time, in milliseconds since the Unix epoch. */
+    createdAt: number;
+    /** Server credential update time, in milliseconds since the Unix epoch. */
+    updatedAt: number;
+}
+/**
+ * A record read from the store. Fields written by other SDK versions are passed through unchanged.
+ */
+export type StoredBiometricCredentialRecord = Omit<BiometricCredentialRecord, 'identifierHint'> & {
+    /** The normalized identifier hint on iOS, when one was stored. Always `null` on Android, which stores only the hash. */
+    identifierHint?: string | null;
+    /** `hashIdentifierHint()` of the stored identifier hint, or `null` when there is none. Compare hints with this field. */
+    identifierHintSha256: string | null;
+    readonly [field: string]: unknown;
+};
+export interface SaveRecordOptions {
+    /**
+     * Delete every other record for the same `appIdentifier`, along with its private key, after the record is saved.
+     * Set this after a successful enrollment, since the server has already replaced those credentials.
+     * On Android only the same `userId`'s other records are deleted, as the shared storage contract requires.
+     */
+    removeOtherRecordsForApp: boolean;
+}
+export interface InstallationMarkerResult {
+    /**
+     * `true` when this is a new installation and the records left behind by a previous one were deleted.
+     * Always `false` on Android, where uninstalling the app already deletes its records and keys.
+     */
+    wiped: boolean;
+}
+export type BiometricsErrorCode = 'user_canceled' | 'system_canceled' | 'user_fallback' | 'authentication_failed' | 'biometry_not_available' | 'biometry_not_enrolled' | 'biometry_lockout' | 'passcode_not_set' | 'secure_key_storage_unavailable' | 'key_not_found' | 'key_invalidated' | 'key_generation_failed' | 'signing_failed' | 'storage_failed' | 'invalid_argument' | 'not_implemented' | 'native_module_unavailable' | 'unknown';
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,yBAAyB,GAAG,sBAAsB,GAAG,cAAc,GAAG,6BAA6B,CAAC;AAEhH;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;AAEnF,MAAM,WAAW,qBAAqB;IACpC,mDAAmD;IACnD,YAAY,EAAE,YAAY,CAAC;IAC3B,0GAA0G;IAC1G,qBAAqB,EAAE,OAAO,CAAC;IAC/B,yFAAyF;IACzF,sBAAsB,EAAE,OAAO,CAAC;IAChC,+EAA+E;IAC/E,SAAS,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC;;;;OAIG;IACH,yBAAyB,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,sBAAsB;IACrC,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;IACnB,4GAA4G;IAC5G,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,4BAA4B;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,yBAAyB,CAAC;IAClC,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,GAAG;IAChG,wHAAwH;IACxH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,yHAAyH;IACzH,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACnC,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,wBAAwB,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GACf,iBAAiB,GACjB,eAAe,GACf,uBAAuB,GACvB,wBAAwB,GACxB,uBAAuB,GACvB,kBAAkB,GAClB,kBAAkB,GAClB,gCAAgC,GAChC,eAAe,GACf,iBAAiB,GACjB,uBAAuB,GACvB,gBAAgB,GAChB,gBAAgB,GAChB,kBAAkB,GAClB,iBAAiB,GACjB,2BAA2B,GAC3B,SAAS,CAAC"}

package/dist/types.js

@@ -0,0 +1,17 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var types_exports = {};
+module.exports = __toCommonJS(types_exports);
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["/**\n * The local authentication policy that protects a biometric credential's private key.\n *\n * - `biometry_current_set`: requires a biometric from the currently enrolled set. Adding or removing a Face ID / Touch ID enrollment invalidates the key.\n * - `biometry_any`: requires a biometric, and survives biometric enrollment changes.\n * - `biometry_or_device_passcode`: requires biometrics to be available at creation, then accepts a biometric or the device passcode.\n */\nexport type BiometricCredentialPolicy = 'biometry_current_set' | 'biometry_any' | 'biometry_or_device_passcode';\n\n/**\n * The biometry the device supports. iOS reports `faceID`, `touchID`, or `opticID`. Android cannot tell which sensor is a\n * strong (Class 3) biometric, so it reports `biometric` whenever one is present.\n */\nexport type BiometryType = 'faceID' | 'touchID' | 'opticID' | 'biometric' | 'none';\n\nexport interface BiometricAvailability {\n  /** The biometry the device supports, or `none`. */\n  biometryType: BiometryType;\n  /** Whether biometric authentication can be evaluated now. Key creation requires this for every policy. */\n  canEvaluateBiometrics: boolean;\n  /** Whether device owner authentication (biometrics or passcode) can be evaluated now. */\n  canEvaluateDeviceOwner: boolean;\n  /** Why biometric authentication cannot be evaluated, or `null` when it can. */\n  errorCode: BiometricsErrorCode | null;\n  /**\n   * Whether the device has hardware-backed key storage: the Secure Enclave on iOS, which the iOS Simulator lacks, or the\n   * Android Keystore on Android 9 (API level 28) and later.\n   * `createKey()` rejects with `secure_key_storage_unavailable` when this is `false`.\n   */\n  secureKeyStorageAvailable: boolean;\n}\n\nexport interface BiometricCredentialKey {\n  /** Opaque identifier of the private key. Stored in the credential record as `localKeyId`. */\n  localKeyId: string;\n  /** P-256 public key as a compact JWK string: `{\"kty\":\"EC\",\"crv\":\"P-256\",\"x\":\"…\",\"y\":\"…\",\"alg\":\"ES256\"}`. */\n  publicKeyJwk: string;\n}\n\n/**\n * On-device metadata linking a Clerk biometric credential to its private key.\n */\nexport interface BiometricCredentialRecord {\n  /** Server credential ID. */\n  id: string;\n  /** Identifier of the private key returned by `createKey()`. */\n  localKeyId: string;\n  /** Clerk user ID that enrolled the credential. */\n  userId: string;\n  /** App identifier the credential was enrolled for (see `getAppIdentifier()`). */\n  appIdentifier: string;\n  /**\n   * Local-only identifier hint. Normalized (trimmed, lowercased) when stored; empty values are omitted.\n   * iOS stores the normalized hint; Android stores only its hash (see `hashIdentifierHint()`).\n   */\n  identifierHint?: string;\n  policy: BiometricCredentialPolicy;\n  /** Server credential creation time, in milliseconds since the Unix epoch. */\n  createdAt: number;\n  /** Server credential update time, in milliseconds since the Unix epoch. */\n  updatedAt: number;\n}\n\n/**\n * A record read from the store. Fields written by other SDK versions are passed through unchanged.\n */\nexport type StoredBiometricCredentialRecord = Omit<BiometricCredentialRecord, 'identifierHint'> & {\n  /** The normalized identifier hint on iOS, when one was stored. Always `null` on Android, which stores only the hash. */\n  identifierHint?: string | null;\n  /** `hashIdentifierHint()` of the stored identifier hint, or `null` when there is none. Compare hints with this field. */\n  identifierHintSha256: string | null;\n  readonly [field: string]: unknown;\n};\n\nexport interface SaveRecordOptions {\n  /**\n   * Delete every other record for the same `appIdentifier`, along with its private key, after the record is saved.\n   * Set this after a successful enrollment, since the server has already replaced those credentials.\n   * On Android only the same `userId`'s other records are deleted, as the shared storage contract requires.\n   */\n  removeOtherRecordsForApp: boolean;\n}\n\nexport interface InstallationMarkerResult {\n  /**\n   * `true` when this is a new installation and the records left behind by a previous one were deleted.\n   * Always `false` on Android, where uninstalling the app already deletes its records and keys.\n   */\n  wiped: boolean;\n}\n\nexport type BiometricsErrorCode =\n  | 'user_canceled'\n  | 'system_canceled'\n  | 'user_fallback'\n  | 'authentication_failed'\n  | 'biometry_not_available'\n  | 'biometry_not_enrolled'\n  | 'biometry_lockout'\n  | 'passcode_not_set'\n  | 'secure_key_storage_unavailable'\n  | 'key_not_found'\n  | 'key_invalidated'\n  | 'key_generation_failed'\n  | 'signing_failed'\n  | 'storage_failed'\n  | 'invalid_argument'\n  | 'not_implemented'\n  | 'native_module_unavailable'\n  | 'unknown';\n"],"mappings":";;;;;;;;;;;;;;AAAA;AAAA;","names":[]}

package/expo-module.config.json

@@ -0,0 +1,9 @@
+{
+  "platforms": ["apple", "android"],
+  "apple": {
+    "modules": ["ClerkExpoBiometricsModule"]
+  },
+  "android": {
+    "modules": ["expo.modules.clerk.biometrics.ClerkExpoBiometricsModule"]
+  }
+}