@doko/react-native-yubikit 0.0.2 → 0.0.4

package/README.md

@@ -1,7 +1,9 @@
-react-native-yubikit
+# react-native-yubikit
 
 A React Native TurboModule wrapper around Yubico's native [YubiKit Android](https://developers.yubico.com/yubikit-android/) and [YubiKit iOS](https://developers.yubico.com/yubikit-ios/) SDKs, for talking to YubiKey hardware over USB and NFC.
 
+![react-native-yubikit](https://raw.githubusercontent.com/Doko-Demo-Doa/react-native-yubikit/main/.github/assets/yubikit-new.webp)
+
 [![npm version](https://img.shields.io/npm/v/@doko/react-native-yubikit?style=for-the-badge&color=blue)](https://www.npmjs.com/package/@doko/react-native-yubikit)
 [![Monthly downloads](https://img.shields.io/npm/dm/@doko/react-native-yubikit?style=for-the-badge)](https://www.npmjs.com/package/@doko/react-native-yubikit)
 [![New Architecture](https://img.shields.io/badge/New%20Architecture-Only-5f3dc4?style=for-the-badge)](https://reactnative.dev/docs/the-new-architecture/landing-page)

package/android/src/main/java/com/yubikit/YubikitPivModule.kt

@@ -3,6 +3,7 @@ package com.yubikit
 import com.facebook.react.bridge.Arguments
 import com.facebook.react.bridge.Promise
 import com.facebook.react.bridge.ReactApplicationContext
+import com.yubico.yubikit.core.smartcard.SmartCardConnection
 import com.yubico.yubikit.piv.PivSession
 import com.yubikit.utils.YubikitUtils.base64Decode
 import com.yubikit.utils.YubikitUtils.base64Encode
@@ -23,16 +24,27 @@ class YubikitPivModule(reactContext: ReactApplicationContext) :
 
   override fun getName(): String = NAME
 
+  // PIV security status (PIN verified, management key authenticated) is scoped to
+  // the SmartCardConnection, not the device - opening a new connection per call
+  // (the `connectionHandle == null` path) throws that status away between calls.
+  // Passing a connectionHandle held open via Core.requestConnection lets a
+  // verifyPin() followed by a rawSignOrDecrypt() see the same verified PIN.
   private inline fun <R> withPivSession(
     deviceHandle: String,
     promise: Promise,
+    connectionHandle: String? = null,
     crossinline block: (PivSession) -> R
   ) {
     moduleScope.launch {
       try {
-        val result = YubiKitManagerHolder.withSmartCard(deviceHandle) { connection ->
-          PivSession(connection).use { session ->
-            block(session)
+        val result = if (connectionHandle != null) {
+          val connection = YubiKitManagerHolder.getConnection(connectionHandle) as SmartCardConnection
+          block(PivSession(connection))
+        } else {
+          YubiKitManagerHolder.withSmartCard(deviceHandle) { connection ->
+            PivSession(connection).use { session ->
+              block(session)
+            }
           }
         }
         @Suppress("UNCHECKED_CAST")
@@ -76,8 +88,13 @@ class YubikitPivModule(reactContext: ReactApplicationContext) :
     }
   }
 
-  override fun verifyPin(deviceHandle: String, pin: String, promise: Promise) {
-    withPivSession(deviceHandle, promise) { it.verifyPin(pin.toCharArray()) }
+  override fun verifyPin(
+    deviceHandle: String,
+    pin: String,
+    connectionHandle: String?,
+    promise: Promise
+  ) {
+    withPivSession(deviceHandle, promise, connectionHandle) { it.verifyPin(pin.toCharArray()) }
   }
 
   override fun getPinAttempts(deviceHandle: String, promise: Promise) {
@@ -187,29 +204,31 @@ class YubikitPivModule(reactContext: ReactApplicationContext) :
     }
   }
 
-  override fun getSlotMetadata(deviceHandle: String, slot: String, promise: Promise) {
-    moduleScope.launch {
-      try {
-        val meta = YubiKitManagerHolder.withSmartCard(deviceHandle) { connection ->
-          PivSession(connection).use { session ->
-            session.getSlotMetadata(slotFromString(slot))
-          }
-        }
-        promise.resolve(Arguments.createMap().apply {
-          putString("keyType", com.yubikit.utils.YubikitUtils.keyTypeToString(meta.keyType))
-          putString("pinPolicy", com.yubikit.utils.YubikitUtils.pinPolicyToString(meta.pinPolicy))
-          putString("touchPolicy", com.yubikit.utils.YubikitUtils.touchPolicyToString(meta.touchPolicy))
-          putBoolean("generated", meta.isGenerated)
-          meta.publicKeyValues?.let { putString("publicKey", base64Encode(it.encoded)) }
-        })
-      } catch (e: Exception) {
-        promise.reject("PIV_ERROR", e.message, e)
+  override fun getSlotMetadata(
+    deviceHandle: String,
+    slot: String,
+    connectionHandle: String?,
+    promise: Promise
+  ) {
+    withPivSession(deviceHandle, promise, connectionHandle) { session ->
+      val meta = session.getSlotMetadata(slotFromString(slot))
+      Arguments.createMap().apply {
+        putString("keyType", com.yubikit.utils.YubikitUtils.keyTypeToString(meta.keyType))
+        putString("pinPolicy", com.yubikit.utils.YubikitUtils.pinPolicyToString(meta.pinPolicy))
+        putString("touchPolicy", com.yubikit.utils.YubikitUtils.touchPolicyToString(meta.touchPolicy))
+        putBoolean("generated", meta.isGenerated)
+        meta.publicKeyValues?.let { putString("publicKey", base64Encode(it.encoded)) }
       }
     }
   }
 
-  override fun getCertificate(deviceHandle: String, slot: String, promise: Promise) {
-    withPivSession(deviceHandle, promise) {
+  override fun getCertificate(
+    deviceHandle: String,
+    slot: String,
+    connectionHandle: String?,
+    promise: Promise
+  ) {
+    withPivSession(deviceHandle, promise, connectionHandle) {
       base64Encode(it.getCertificate(slotFromString(slot)).encoded)
     }
   }
@@ -272,9 +291,10 @@ class YubikitPivModule(reactContext: ReactApplicationContext) :
     slot: String,
     keyType: String,
     payload: String,
+    connectionHandle: String?,
     promise: Promise
   ) {
-    withPivSession(deviceHandle, promise) {
+    withPivSession(deviceHandle, promise, connectionHandle) {
       base64Encode(
         it.rawSignOrDecrypt(
           slotFromString(slot),

package/ios/YubikitPiv.mm

@@ -315,8 +315,14 @@ RCT_EXPORT_MODULE(YubikitPiv)
   }];
 }
 
+// `connectionHandle` is accepted for API parity with Android, where PIN-verified
+// status is scoped to the connection and a fresh one is opened per call unless a
+// held connectionHandle is passed. iOS doesn't need it: connectionForHandle:
+// already caches one persistent connection per deviceHandle, reused across calls,
+// so verified PIN status here already survives to a later rawSignOrDecrypt call.
 - (void)verifyPin:(NSString *)deviceHandle
               pin:(NSString *)pin
+ connectionHandle:(nullable NSString *)connectionHandle
           resolve:(RCTPromiseResolveBlock)resolve
            reject:(RCTPromiseRejectBlock)reject {
   id<YKFConnectionProtocol> connection = [self connectionForHandle:deviceHandle reject:reject];
@@ -525,6 +531,7 @@ RCT_EXPORT_MODULE(YubikitPiv)
 
 - (void)getSlotMetadata:(NSString *)deviceHandle
                    slot:(NSString *)slot
+       connectionHandle:(nullable NSString *)connectionHandle
                 resolve:(RCTPromiseResolveBlock)resolve
                  reject:(RCTPromiseRejectBlock)reject {
   id<YKFConnectionProtocol> connection = [self connectionForHandle:deviceHandle reject:reject];
@@ -557,6 +564,7 @@ RCT_EXPORT_MODULE(YubikitPiv)
 
 - (void)getCertificate:(NSString *)deviceHandle
                    slot:(NSString *)slot
+       connectionHandle:(nullable NSString *)connectionHandle
                 resolve:(RCTPromiseResolveBlock)resolve
                  reject:(RCTPromiseRejectBlock)reject {
   id<YKFConnectionProtocol> connection = [self connectionForHandle:deviceHandle reject:reject];
@@ -719,6 +727,7 @@ RCT_EXPORT_MODULE(YubikitPiv)
                     slot:(NSString *)slot
                  keyType:(NSString *)keyType
                  payload:(NSString *)payload
+        connectionHandle:(nullable NSString *)connectionHandle
                  resolve:(RCTPromiseResolveBlock)resolve
                   reject:(RCTPromiseRejectBlock)reject {
   id<YKFConnectionProtocol> connection = [self connectionForHandle:deviceHandle reject:reject];

package/lib/module/piv.js

@@ -13,8 +13,14 @@ export function authenticate(deviceHandle, managementKey) {
 export function setManagementKey(deviceHandle, keyType, managementKey, requireTouch) {
   return NativeYubikitPiv.setManagementKey(deviceHandle, keyType, managementKey, requireTouch);
 }
-export function verifyPin(deviceHandle, pin) {
-  return NativeYubikitPiv.verifyPin(deviceHandle, pin);
+
+/**
+ * Pass `connectionHandle` (from `Core.requestConnection`) to run this on an
+ * already-open connection instead of a one-off one - required if a later
+ * call (e.g. `rawSignOrDecrypt`) needs to see the verified PIN on Android.
+ */
+export function verifyPin(deviceHandle, pin, connectionHandle) {
+  return NativeYubikitPiv.verifyPin(deviceHandle, pin, connectionHandle);
 }
 export function getPinAttempts(deviceHandle) {
   return NativeYubikitPiv.getPinAttempts(deviceHandle);
@@ -40,11 +46,11 @@ export function getPukMetadata(deviceHandle) {
 export function getManagementKeyMetadata(deviceHandle) {
   return NativeYubikitPiv.getManagementKeyMetadata(deviceHandle);
 }
-export function getSlotMetadata(deviceHandle, slot) {
-  return NativeYubikitPiv.getSlotMetadata(deviceHandle, slot);
+export function getSlotMetadata(deviceHandle, slot, connectionHandle) {
+  return NativeYubikitPiv.getSlotMetadata(deviceHandle, slot, connectionHandle);
 }
-export function getCertificate(deviceHandle, slot) {
-  return NativeYubikitPiv.getCertificate(deviceHandle, slot);
+export function getCertificate(deviceHandle, slot, connectionHandle) {
+  return NativeYubikitPiv.getCertificate(deviceHandle, slot, connectionHandle);
 }
 export function putCertificate(deviceHandle, slot, certificate, compress) {
   return NativeYubikitPiv.putCertificate(deviceHandle, slot, certificate, compress);
@@ -61,8 +67,8 @@ export function generateKey(deviceHandle, slot, keyType, pinPolicy, touchPolicy)
 export function deleteKey(deviceHandle, slot) {
   return NativeYubikitPiv.deleteKey(deviceHandle, slot);
 }
-export function rawSignOrDecrypt(deviceHandle, slot, keyType, payload) {
-  return NativeYubikitPiv.rawSignOrDecrypt(deviceHandle, slot, keyType, payload);
+export function rawSignOrDecrypt(deviceHandle, slot, keyType, payload, connectionHandle) {
+  return NativeYubikitPiv.rawSignOrDecrypt(deviceHandle, slot, keyType, payload, connectionHandle);
 }
 export function getBioMetadata(deviceHandle) {
   return NativeYubikitPiv.getBioMetadata(deviceHandle);

package/lib/module/piv.js.map

@@ -1 +1 @@
-{"version":3,"names":["NativeYubikitPiv","reset","deviceHandle","getSerialNumber","authenticate","managementKey","setManagementKey","keyType","requireTouch","verifyPin","pin","getPinAttempts","changePin","oldPin","newPin","changePuk","oldPuk","newPuk","unblockPin","puk","setPinAttempts","pinAttempts","pukAttempts","getPinMetadata","getPukMetadata","getManagementKeyMetadata","getSlotMetadata","slot","getCertificate","putCertificate","certificate","compress","deleteCertificate","attestKey","generateKey","pinPolicy","touchPolicy","deleteKey","rawSignOrDecrypt","payload","getBioMetadata"],"sourceRoot":"../../src","sources":["piv.ts"],"mappings":";;AAAA,OAAOA,gBAAgB,MAAM,6BAA0B;AAcvD,OAAO,SAASC,KAAKA,CAACC,YAAoB,EAAiB;EACzD,OAAOF,gBAAgB,CAACC,KAAK,CAACC,YAAY,CAAC;AAC7C;AAEA,OAAO,SAASC,eAAeA,CAACD,YAAoB,EAAmB;EACrE,OAAOF,gBAAgB,CAACG,eAAe,CAACD,YAAY,CAAC;AACvD;AAEA,OAAO,SAASE,YAAYA,CAC1BF,YAAoB,EACpBG,aAA2B,EACZ;EACf,OAAOL,gBAAgB,CAACI,YAAY,CAACF,YAAY,EAAEG,aAAa,CAAC;AACnE;AAEA,OAAO,SAASC,gBAAgBA,CAC9BJ,YAAoB,EACpBK,OAA6B,EAC7BF,aAA2B,EAC3BG,YAAqB,EACN;EACf,OAAOR,gBAAgB,CAACM,gBAAgB,CACtCJ,YAAY,EACZK,OAAO,EACPF,aAAa,EACbG,YACF,CAAC;AACH;AAEA,OAAO,SAASC,SAASA,CAACP,YAAoB,EAAEQ,GAAW,EAAiB;EAC1E,OAAOV,gBAAgB,CAACS,SAAS,CAACP,YAAY,EAAEQ,GAAG,CAAC;AACtD;AAEA,OAAO,SAASC,cAAcA,CAACT,YAAoB,EAAmB;EACpE,OAAOF,gBAAgB,CAACW,cAAc,CAACT,YAAY,CAAC;AACtD;AAEA,OAAO,SAASU,SAASA,CACvBV,YAAoB,EACpBW,MAAc,EACdC,MAAc,EACC;EACf,OAAOd,gBAAgB,CAACY,SAAS,CAACV,YAAY,EAAEW,MAAM,EAAEC,MAAM,CAAC;AACjE;AAEA,OAAO,SAASC,SAASA,CACvBb,YAAoB,EACpBc,MAAc,EACdC,MAAc,EACC;EACf,OAAOjB,gBAAgB,CAACe,SAAS,CAACb,YAAY,EAAEc,MAAM,EAAEC,MAAM,CAAC;AACjE;AAEA,OAAO,SAASC,UAAUA,CACxBhB,YAAoB,EACpBiB,GAAW,EACXL,MAAc,EACC;EACf,OAAOd,gBAAgB,CAACkB,UAAU,CAAChB,YAAY,EAAEiB,GAAG,EAAEL,MAAM,CAAC;AAC/D;AAEA,OAAO,SAASM,cAAcA,CAC5BlB,YAAoB,EACpBmB,WAAmB,EACnBC,WAAmB,EACJ;EACf,OAAOtB,gBAAgB,CAACoB,cAAc,CACpClB,YAAY,EACZmB,WAAW,EACXC,WACF,CAAC;AACH;AAEA,OAAO,SAASC,cAAcA,CAACrB,YAAoB,EAA2B;EAC5E,OAAOF,gBAAgB,CAACuB,cAAc,CACpCrB,YACF,CAAC;AACH;AAEA,OAAO,SAASsB,cAAcA,CAACtB,YAAoB,EAA2B;EAC5E,OAAOF,gBAAgB,CAACwB,cAAc,CACpCtB,YACF,CAAC;AACH;AAEA,OAAO,SAASuB,wBAAwBA,CACtCvB,YAAoB,EACe;EACnC,OAAOF,gBAAgB,CAACyB,wBAAwB,CAC9CvB,YACF,CAAC;AACH;AAEA,OAAO,SAASwB,eAAeA,CAC7BxB,YAAoB,EACpByB,IAAa,EACa;EAC1B,OAAO3B,gBAAgB,CAAC0B,eAAe,CACrCxB,YAAY,EACZyB,IACF,CAAC;AACH;AAEA,OAAO,SAASC,cAAcA,CAC5B1B,YAAoB,EACpByB,IAAa,EACU;EACvB,OAAO3B,gBAAgB,CAAC4B,cAAc,CAAC1B,YAAY,EAAEyB,IAAI,CAAC;AAC5D;AAEA,OAAO,SAASE,cAAcA,CAC5B3B,YAAoB,EACpByB,IAAa,EACbG,WAAyB,EACzBC,QAAkB,EACH;EACf,OAAO/B,gBAAgB,CAAC6B,cAAc,CACpC3B,YAAY,EACZyB,IAAI,EACJG,WAAW,EACXC,QACF,CAAC;AACH;AAEA,OAAO,SAASC,iBAAiBA,CAC/B9B,YAAoB,EACpByB,IAAa,EACE;EACf,OAAO3B,gBAAgB,CAACgC,iBAAiB,CAAC9B,YAAY,EAAEyB,IAAI,CAAC;AAC/D;AAEA,OAAO,SAASM,SAASA,CACvB/B,YAAoB,EACpByB,IAAa,EACU;EACvB,OAAO3B,gBAAgB,CAACiC,SAAS,CAAC/B,YAAY,EAAEyB,IAAI,CAAC;AACvD;AAEA,OAAO,SAASO,WAAWA,CACzBhC,YAAoB,EACpByB,IAAa,EACbpB,OAAmB,EACnB4B,SAAuB,EACvBC,WAA2B,EACJ;EACvB,OAAOpC,gBAAgB,CAACkC,WAAW,CACjChC,YAAY,EACZyB,IAAI,EACJpB,OAAO,EACP4B,SAAS,EACTC,WACF,CAAC;AACH;AAEA,OAAO,SAASC,SAASA,CAACnC,YAAoB,EAAEyB,IAAa,EAAiB;EAC5E,OAAO3B,gBAAgB,CAACqC,SAAS,CAACnC,YAAY,EAAEyB,IAAI,CAAC;AACvD;AAEA,OAAO,SAASW,gBAAgBA,CAC9BpC,YAAoB,EACpByB,IAAa,EACbpB,OAAmB,EACnBgC,OAAqB,EACE;EACvB,OAAOvC,gBAAgB,CAACsC,gBAAgB,CACtCpC,YAAY,EACZyB,IAAI,EACJpB,OAAO,EACPgC,OACF,CAAC;AACH;AAEA,OAAO,SAASC,cAAcA,CAACtC,YAAoB,EAA2B;EAC5E,OAAOF,gBAAgB,CAACwC,cAAc,CACpCtC,YACF,CAAC;AACH;AAEA,SAASF,gBAAgB","ignoreList":[]}
+{"version":3,"names":["NativeYubikitPiv","reset","deviceHandle","getSerialNumber","authenticate","managementKey","setManagementKey","keyType","requireTouch","verifyPin","pin","connectionHandle","getPinAttempts","changePin","oldPin","newPin","changePuk","oldPuk","newPuk","unblockPin","puk","setPinAttempts","pinAttempts","pukAttempts","getPinMetadata","getPukMetadata","getManagementKeyMetadata","getSlotMetadata","slot","getCertificate","putCertificate","certificate","compress","deleteCertificate","attestKey","generateKey","pinPolicy","touchPolicy","deleteKey","rawSignOrDecrypt","payload","getBioMetadata"],"sourceRoot":"../../src","sources":["piv.ts"],"mappings":";;AAAA,OAAOA,gBAAgB,MAAM,6BAA0B;AAcvD,OAAO,SAASC,KAAKA,CAACC,YAAoB,EAAiB;EACzD,OAAOF,gBAAgB,CAACC,KAAK,CAACC,YAAY,CAAC;AAC7C;AAEA,OAAO,SAASC,eAAeA,CAACD,YAAoB,EAAmB;EACrE,OAAOF,gBAAgB,CAACG,eAAe,CAACD,YAAY,CAAC;AACvD;AAEA,OAAO,SAASE,YAAYA,CAC1BF,YAAoB,EACpBG,aAA2B,EACZ;EACf,OAAOL,gBAAgB,CAACI,YAAY,CAACF,YAAY,EAAEG,aAAa,CAAC;AACnE;AAEA,OAAO,SAASC,gBAAgBA,CAC9BJ,YAAoB,EACpBK,OAA6B,EAC7BF,aAA2B,EAC3BG,YAAqB,EACN;EACf,OAAOR,gBAAgB,CAACM,gBAAgB,CACtCJ,YAAY,EACZK,OAAO,EACPF,aAAa,EACbG,YACF,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,SAASA,CACvBP,YAAoB,EACpBQ,GAAW,EACXC,gBAAyB,EACV;EACf,OAAOX,gBAAgB,CAACS,SAAS,CAACP,YAAY,EAAEQ,GAAG,EAAEC,gBAAgB,CAAC;AACxE;AAEA,OAAO,SAASC,cAAcA,CAACV,YAAoB,EAAmB;EACpE,OAAOF,gBAAgB,CAACY,cAAc,CAACV,YAAY,CAAC;AACtD;AAEA,OAAO,SAASW,SAASA,CACvBX,YAAoB,EACpBY,MAAc,EACdC,MAAc,EACC;EACf,OAAOf,gBAAgB,CAACa,SAAS,CAACX,YAAY,EAAEY,MAAM,EAAEC,MAAM,CAAC;AACjE;AAEA,OAAO,SAASC,SAASA,CACvBd,YAAoB,EACpBe,MAAc,EACdC,MAAc,EACC;EACf,OAAOlB,gBAAgB,CAACgB,SAAS,CAACd,YAAY,EAAEe,MAAM,EAAEC,MAAM,CAAC;AACjE;AAEA,OAAO,SAASC,UAAUA,CACxBjB,YAAoB,EACpBkB,GAAW,EACXL,MAAc,EACC;EACf,OAAOf,gBAAgB,CAACmB,UAAU,CAACjB,YAAY,EAAEkB,GAAG,EAAEL,MAAM,CAAC;AAC/D;AAEA,OAAO,SAASM,cAAcA,CAC5BnB,YAAoB,EACpBoB,WAAmB,EACnBC,WAAmB,EACJ;EACf,OAAOvB,gBAAgB,CAACqB,cAAc,CACpCnB,YAAY,EACZoB,WAAW,EACXC,WACF,CAAC;AACH;AAEA,OAAO,SAASC,cAAcA,CAACtB,YAAoB,EAA2B;EAC5E,OAAOF,gBAAgB,CAACwB,cAAc,CACpCtB,YACF,CAAC;AACH;AAEA,OAAO,SAASuB,cAAcA,CAACvB,YAAoB,EAA2B;EAC5E,OAAOF,gBAAgB,CAACyB,cAAc,CACpCvB,YACF,CAAC;AACH;AAEA,OAAO,SAASwB,wBAAwBA,CACtCxB,YAAoB,EACe;EACnC,OAAOF,gBAAgB,CAAC0B,wBAAwB,CAC9CxB,YACF,CAAC;AACH;AAEA,OAAO,SAASyB,eAAeA,CAC7BzB,YAAoB,EACpB0B,IAAa,EACbjB,gBAAyB,EACC;EAC1B,OAAOX,gBAAgB,CAAC2B,eAAe,CACrCzB,YAAY,EACZ0B,IAAI,EACJjB,gBACF,CAAC;AACH;AAEA,OAAO,SAASkB,cAAcA,CAC5B3B,YAAoB,EACpB0B,IAAa,EACbjB,gBAAyB,EACF;EACvB,OAAOX,gBAAgB,CAAC6B,cAAc,CAAC3B,YAAY,EAAE0B,IAAI,EAAEjB,gBAAgB,CAAC;AAC9E;AAEA,OAAO,SAASmB,cAAcA,CAC5B5B,YAAoB,EACpB0B,IAAa,EACbG,WAAyB,EACzBC,QAAkB,EACH;EACf,OAAOhC,gBAAgB,CAAC8B,cAAc,CACpC5B,YAAY,EACZ0B,IAAI,EACJG,WAAW,EACXC,QACF,CAAC;AACH;AAEA,OAAO,SAASC,iBAAiBA,CAC/B/B,YAAoB,EACpB0B,IAAa,EACE;EACf,OAAO5B,gBAAgB,CAACiC,iBAAiB,CAAC/B,YAAY,EAAE0B,IAAI,CAAC;AAC/D;AAEA,OAAO,SAASM,SAASA,CACvBhC,YAAoB,EACpB0B,IAAa,EACU;EACvB,OAAO5B,gBAAgB,CAACkC,SAAS,CAAChC,YAAY,EAAE0B,IAAI,CAAC;AACvD;AAEA,OAAO,SAASO,WAAWA,CACzBjC,YAAoB,EACpB0B,IAAa,EACbrB,OAAmB,EACnB6B,SAAuB,EACvBC,WAA2B,EACJ;EACvB,OAAOrC,gBAAgB,CAACmC,WAAW,CACjCjC,YAAY,EACZ0B,IAAI,EACJrB,OAAO,EACP6B,SAAS,EACTC,WACF,CAAC;AACH;AAEA,OAAO,SAASC,SAASA,CAACpC,YAAoB,EAAE0B,IAAa,EAAiB;EAC5E,OAAO5B,gBAAgB,CAACsC,SAAS,CAACpC,YAAY,EAAE0B,IAAI,CAAC;AACvD;AAEA,OAAO,SAASW,gBAAgBA,CAC9BrC,YAAoB,EACpB0B,IAAa,EACbrB,OAAmB,EACnBiC,OAAqB,EACrB7B,gBAAyB,EACF;EACvB,OAAOX,gBAAgB,CAACuC,gBAAgB,CACtCrC,YAAY,EACZ0B,IAAI,EACJrB,OAAO,EACPiC,OAAO,EACP7B,gBACF,CAAC;AACH;AAEA,OAAO,SAAS8B,cAAcA,CAACvC,YAAoB,EAA2B;EAC5E,OAAOF,gBAAgB,CAACyC,cAAc,CACpCvC,YACF,CAAC;AACH;AAEA,SAASF,gBAAgB","ignoreList":[]}

package/lib/module/specs/NativeYubikitPiv.js.map

@@ -1 +1 @@
-{"version":3,"names":["TurboModuleRegistry","getEnforcing"],"sourceRoot":"../../../src","sources":["specs/NativeYubikitPiv.ts"],"mappings":";;AAAA,SAASA,mBAAmB,QAA0B,cAAc;AA2GpE,eAAeA,mBAAmB,CAACC,YAAY,CAAO,YAAY,CAAC","ignoreList":[]}
+{"version":3,"names":["TurboModuleRegistry","getEnforcing"],"sourceRoot":"../../../src","sources":["specs/NativeYubikitPiv.ts"],"mappings":";;AAAA,SAASA,mBAAmB,QAA0B,cAAc;AA+HpE,eAAeA,mBAAmB,CAACC,YAAY,CAAO,YAAY,CAAC","ignoreList":[]}

package/lib/typescript/src/piv.d.ts

@@ -4,7 +4,12 @@ export declare function reset(deviceHandle: string): Promise<void>;
 export declare function getSerialNumber(deviceHandle: string): Promise<number>;
 export declare function authenticate(deviceHandle: string, managementKey: Base64String): Promise<void>;
 export declare function setManagementKey(deviceHandle: string, keyType: PivManagementKeyType, managementKey: Base64String, requireTouch: boolean): Promise<void>;
-export declare function verifyPin(deviceHandle: string, pin: string): Promise<void>;
+/**
+ * Pass `connectionHandle` (from `Core.requestConnection`) to run this on an
+ * already-open connection instead of a one-off one - required if a later
+ * call (e.g. `rawSignOrDecrypt`) needs to see the verified PIN on Android.
+ */
+export declare function verifyPin(deviceHandle: string, pin: string, connectionHandle?: string): Promise<void>;
 export declare function getPinAttempts(deviceHandle: string): Promise<number>;
 export declare function changePin(deviceHandle: string, oldPin: string, newPin: string): Promise<void>;
 export declare function changePuk(deviceHandle: string, oldPuk: string, newPuk: string): Promise<void>;
@@ -13,14 +18,14 @@ export declare function setPinAttempts(deviceHandle: string, pinAttempts: number
 export declare function getPinMetadata(deviceHandle: string): Promise<PivPinMetadata>;
 export declare function getPukMetadata(deviceHandle: string): Promise<PivPinMetadata>;
 export declare function getManagementKeyMetadata(deviceHandle: string): Promise<PivManagementKeyMetadata>;
-export declare function getSlotMetadata(deviceHandle: string, slot: PivSlot): Promise<PivSlotMetadata>;
-export declare function getCertificate(deviceHandle: string, slot: PivSlot): Promise<Base64String>;
+export declare function getSlotMetadata(deviceHandle: string, slot: PivSlot, connectionHandle?: string): Promise<PivSlotMetadata>;
+export declare function getCertificate(deviceHandle: string, slot: PivSlot, connectionHandle?: string): Promise<Base64String>;
 export declare function putCertificate(deviceHandle: string, slot: PivSlot, certificate: Base64String, compress?: boolean): Promise<void>;
 export declare function deleteCertificate(deviceHandle: string, slot: PivSlot): Promise<void>;
 export declare function attestKey(deviceHandle: string, slot: PivSlot): Promise<Base64String>;
 export declare function generateKey(deviceHandle: string, slot: PivSlot, keyType: PivKeyType, pinPolicy: PivPinPolicy, touchPolicy: PivTouchPolicy): Promise<Base64String>;
 export declare function deleteKey(deviceHandle: string, slot: PivSlot): Promise<void>;
-export declare function rawSignOrDecrypt(deviceHandle: string, slot: PivSlot, keyType: PivKeyType, payload: Base64String): Promise<Base64String>;
+export declare function rawSignOrDecrypt(deviceHandle: string, slot: PivSlot, keyType: PivKeyType, payload: Base64String, connectionHandle?: string): Promise<Base64String>;
 export declare function getBioMetadata(deviceHandle: string): Promise<PivBioMetadata>;
 export { NativeYubikitPiv };
 //# sourceMappingURL=piv.d.ts.map

package/lib/typescript/src/piv.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"piv.d.ts","sourceRoot":"","sources":["../../../src/piv.ts"],"names":[],"mappings":"AAAA,OAAO,gBAAgB,MAAM,6BAA0B,CAAC;AACxD,OAAO,KAAK,EACV,YAAY,EACZ,cAAc,EACd,UAAU,EACV,wBAAwB,EACxB,oBAAoB,EACpB,cAAc,EACd,YAAY,EACZ,OAAO,EACP,eAAe,EACf,cAAc,EACf,MAAM,YAAS,CAAC;AAEjB,wBAAgB,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzD;AAED,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAErE;AAED,wBAAgB,YAAY,CAC1B,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,YAAY,GAC1B,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,YAAY,EAC3B,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAgB,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1E;AAED,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpE;AAED,wBAAgB,SAAS,CACvB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAgB,SAAS,CACvB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAgB,UAAU,CACxB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAgB,cAAc,CAC5B,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAI5E;AAED,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAI5E;AAED,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAInC;AAED,wBAAgB,eAAe,CAC7B,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,eAAe,CAAC,CAK1B;AAED,wBAAgB,cAAc,CAC5B,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED,wBAAgB,cAAc,CAC5B,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EACb,WAAW,EAAE,YAAY,EACzB,QAAQ,CAAC,EAAE,OAAO,GACjB,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAgB,SAAS,CACvB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED,wBAAgB,WAAW,CACzB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,YAAY,EACvB,WAAW,EAAE,cAAc,GAC1B,OAAO,CAAC,YAAY,CAAC,CAQvB;AAED,wBAAgB,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,YAAY,CAAC,CAOvB;AAED,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAI5E;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"piv.d.ts","sourceRoot":"","sources":["../../../src/piv.ts"],"names":[],"mappings":"AAAA,OAAO,gBAAgB,MAAM,6BAA0B,CAAC;AACxD,OAAO,KAAK,EACV,YAAY,EACZ,cAAc,EACd,UAAU,EACV,wBAAwB,EACxB,oBAAoB,EACpB,cAAc,EACd,YAAY,EACZ,OAAO,EACP,eAAe,EACf,cAAc,EACf,MAAM,YAAS,CAAC;AAEjB,wBAAgB,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzD;AAED,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAErE;AAED,wBAAgB,YAAY,CAC1B,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,YAAY,GAC1B,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,YAAY,EAC3B,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,MAAM,EACX,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpE;AAED,wBAAgB,SAAS,CACvB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAgB,SAAS,CACvB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAgB,UAAU,CACxB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAgB,cAAc,CAC5B,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAI5E;AAED,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAI5E;AAED,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAInC;AAED,wBAAgB,eAAe,CAC7B,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EACb,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,eAAe,CAAC,CAM1B;AAED,wBAAgB,cAAc,CAC5B,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EACb,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED,wBAAgB,cAAc,CAC5B,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EACb,WAAW,EAAE,YAAY,EACzB,QAAQ,CAAC,EAAE,OAAO,GACjB,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAgB,SAAS,CACvB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED,wBAAgB,WAAW,CACzB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,YAAY,EACvB,WAAW,EAAE,cAAc,GAC1B,OAAO,CAAC,YAAY,CAAC,CAQvB;AAED,wBAAgB,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,YAAY,EACrB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,YAAY,CAAC,CAQvB;AAED,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAI5E;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC"}

package/lib/typescript/src/specs/NativeYubikitPiv.d.ts

@@ -23,7 +23,14 @@ export interface Spec extends TurboModule {
     getSerialNumber(deviceHandle: string): Promise<number>;
     authenticate(deviceHandle: string, managementKey: string): Promise<void>;
     setManagementKey(deviceHandle: string, keyType: string, managementKey: string, requireTouch: boolean): Promise<void>;
-    verifyPin(deviceHandle: string, pin: string): Promise<void>;
+    /**
+     * `connectionHandle` (from `Core.requestConnection`) is optional - when
+     * omitted, a fresh connection is opened and closed for just this call. On
+     * Android, PIN-verified status is scoped to the connection, not the
+     * device, so verifying here and signing in a later call only sees the
+     * verified PIN if both calls share the same held connectionHandle.
+     */
+    verifyPin(deviceHandle: string, pin: string, connectionHandle?: string): Promise<void>;
     getPinAttempts(deviceHandle: string): Promise<number>;
     changePin(deviceHandle: string, oldPin: string, newPin: string): Promise<void>;
     changePuk(deviceHandle: string, oldPuk: string, newPuk: string): Promise<void>;
@@ -32,14 +39,14 @@ export interface Spec extends TurboModule {
     getPinMetadata(deviceHandle: string): Promise<PivPinMetadata>;
     getPukMetadata(deviceHandle: string): Promise<PivPinMetadata>;
     getManagementKeyMetadata(deviceHandle: string): Promise<PivManagementKeyMetadata>;
-    getSlotMetadata(deviceHandle: string, slot: string): Promise<PivSlotMetadata>;
-    getCertificate(deviceHandle: string, slot: string): Promise<string>;
+    getSlotMetadata(deviceHandle: string, slot: string, connectionHandle?: string): Promise<PivSlotMetadata>;
+    getCertificate(deviceHandle: string, slot: string, connectionHandle?: string): Promise<string>;
     putCertificate(deviceHandle: string, slot: string, certificate: string, compress?: boolean): Promise<void>;
     deleteCertificate(deviceHandle: string, slot: string): Promise<void>;
     attestKey(deviceHandle: string, slot: string): Promise<string>;
     generateKey(deviceHandle: string, slot: string, keyType: string, pinPolicy: string, touchPolicy: string): Promise<string>;
     deleteKey(deviceHandle: string, slot: string): Promise<void>;
-    rawSignOrDecrypt(deviceHandle: string, slot: string, keyType: string, payload: string): Promise<string>;
+    rawSignOrDecrypt(deviceHandle: string, slot: string, keyType: string, payload: string, connectionHandle?: string): Promise<string>;
     getBioMetadata(deviceHandle: string): Promise<PivBioMetadata>;
 }
 declare const _default: Spec;

package/lib/typescript/src/specs/NativeYubikitPiv.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"NativeYubikitPiv.d.ts","sourceRoot":"","sources":["../../../../src/specs/NativeYubikitPiv.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAErE,UAAU,cAAc;IACtB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,UAAU,wBAAwB;IAChC,OAAO,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACjD,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,UAAU,eAAe;IACvB,OAAO,EACH,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,QAAQ,CAAC;IACb,SAAS,EACL,SAAS,GACT,OAAO,GACP,MAAM,GACN,QAAQ,GACR,YAAY,GACZ,cAAc,CAAC;IACnB,WAAW,EAAE,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACvD,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,cAAc;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,IAAK,SAAQ,WAAW;IACvC,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvD,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,gBAAgB,CACd,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,SAAS,CACP,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CACP,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,cAAc,CACZ,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9D,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9D,wBAAwB,CACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrC,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAE9E,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,cAAc,CACZ,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,OAAO,GACjB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/D,WAAW,CACT,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D,gBAAgB,CACd,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC/D;;AAED,wBAAoE"}
+{"version":3,"file":"NativeYubikitPiv.d.ts","sourceRoot":"","sources":["../../../../src/specs/NativeYubikitPiv.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAErE,UAAU,cAAc;IACtB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,UAAU,wBAAwB;IAChC,OAAO,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACjD,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,UAAU,eAAe;IACvB,OAAO,EACH,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,QAAQ,CAAC;IACb,SAAS,EACL,SAAS,GACT,OAAO,GACP,MAAM,GACN,QAAQ,GACR,YAAY,GACZ,cAAc,CAAC;IACnB,WAAW,EAAE,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACvD,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,cAAc;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,IAAK,SAAQ,WAAW;IACvC,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvD,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,gBAAgB,CACd,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;;OAMG;IACH,SAAS,CACP,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,MAAM,EACX,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,SAAS,CACP,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CACP,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,cAAc,CACZ,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9D,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9D,wBAAwB,CACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrC,eAAe,CACb,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,eAAe,CAAC,CAAC;IAE5B,cAAc,CACZ,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,cAAc,CACZ,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,OAAO,GACjB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/D,WAAW,CACT,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D,gBAAgB,CACd,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC/D;;AAED,wBAAoE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@doko/react-native-yubikit",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "description": "Yubikit bindings for React Native",
   "keywords": [
     "android",
@@ -50,18 +50,6 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "scripts": {
-    "example": "pnpm --filter react-native-yubikit-example",
-    "clean": "del-cli lib",
-    "prepare": "bob build",
-    "typecheck": "tsc",
-    "lint": "oxlint",
-    "lint:fix": "oxlint --fix",
-    "format": "oxfmt",
-    "format:check": "oxfmt --check",
-    "test": "jest",
-    "release": "release-it --only-version"
-  },
   "devDependencies": {
     "@commitlint/config-conventional": "^21.2.0",
     "@jest/globals": "^29.7.0",
@@ -109,7 +97,6 @@
       ]
     }
   },
-  "packageManager": "pnpm@11.10.0",
   "codegenConfig": {
     "name": "YubikitSpec",
     "type": "modules",
@@ -177,5 +164,16 @@
         }
       }
     }
+  },
+  "scripts": {
+    "example": "pnpm --filter react-native-yubikit-example",
+    "clean": "del-cli lib",
+    "typecheck": "tsc",
+    "lint": "oxlint",
+    "lint:fix": "oxlint --fix",
+    "format": "oxfmt",
+    "format:check": "oxfmt --check",
+    "test": "jest",
+    "release": "release-it --only-version"
   }
-}
+}

package/src/piv.ts

@@ -41,8 +41,17 @@ export function setManagementKey(
   );
 }
 
-export function verifyPin(deviceHandle: string, pin: string): Promise<void> {
-  return NativeYubikitPiv.verifyPin(deviceHandle, pin);
+/**
+ * Pass `connectionHandle` (from `Core.requestConnection`) to run this on an
+ * already-open connection instead of a one-off one - required if a later
+ * call (e.g. `rawSignOrDecrypt`) needs to see the verified PIN on Android.
+ */
+export function verifyPin(
+  deviceHandle: string,
+  pin: string,
+  connectionHandle?: string
+): Promise<void> {
+  return NativeYubikitPiv.verifyPin(deviceHandle, pin, connectionHandle);
 }
 
 export function getPinAttempts(deviceHandle: string): Promise<number> {
@@ -107,19 +116,22 @@ export function getManagementKeyMetadata(
 
 export function getSlotMetadata(
   deviceHandle: string,
-  slot: PivSlot
+  slot: PivSlot,
+  connectionHandle?: string
 ): Promise<PivSlotMetadata> {
   return NativeYubikitPiv.getSlotMetadata(
     deviceHandle,
-    slot
+    slot,
+    connectionHandle
   ) as Promise<PivSlotMetadata>;
 }
 
 export function getCertificate(
   deviceHandle: string,
-  slot: PivSlot
+  slot: PivSlot,
+  connectionHandle?: string
 ): Promise<Base64String> {
-  return NativeYubikitPiv.getCertificate(deviceHandle, slot);
+  return NativeYubikitPiv.getCertificate(deviceHandle, slot, connectionHandle);
 }
 
 export function putCertificate(
@@ -174,13 +186,15 @@ export function rawSignOrDecrypt(
   deviceHandle: string,
   slot: PivSlot,
   keyType: PivKeyType,
-  payload: Base64String
+  payload: Base64String,
+  connectionHandle?: string
 ): Promise<Base64String> {
   return NativeYubikitPiv.rawSignOrDecrypt(
     deviceHandle,
     slot,
     keyType,
-    payload
+    payload,
+    connectionHandle
   );
 }
 

package/src/specs/NativeYubikitPiv.ts

@@ -49,7 +49,18 @@ export interface Spec extends TurboModule {
     requireTouch: boolean
   ): Promise<void>;
 
-  verifyPin(deviceHandle: string, pin: string): Promise<void>;
+  /**
+   * `connectionHandle` (from `Core.requestConnection`) is optional - when
+   * omitted, a fresh connection is opened and closed for just this call. On
+   * Android, PIN-verified status is scoped to the connection, not the
+   * device, so verifying here and signing in a later call only sees the
+   * verified PIN if both calls share the same held connectionHandle.
+   */
+  verifyPin(
+    deviceHandle: string,
+    pin: string,
+    connectionHandle?: string
+  ): Promise<void>;
   getPinAttempts(deviceHandle: string): Promise<number>;
   changePin(
     deviceHandle: string,
@@ -73,9 +84,17 @@ export interface Spec extends TurboModule {
   getManagementKeyMetadata(
     deviceHandle: string
   ): Promise<PivManagementKeyMetadata>;
-  getSlotMetadata(deviceHandle: string, slot: string): Promise<PivSlotMetadata>;
+  getSlotMetadata(
+    deviceHandle: string,
+    slot: string,
+    connectionHandle?: string
+  ): Promise<PivSlotMetadata>;
 
-  getCertificate(deviceHandle: string, slot: string): Promise<string>;
+  getCertificate(
+    deviceHandle: string,
+    slot: string,
+    connectionHandle?: string
+  ): Promise<string>;
   putCertificate(
     deviceHandle: string,
     slot: string,
@@ -99,7 +118,8 @@ export interface Spec extends TurboModule {
     deviceHandle: string,
     slot: string,
     keyType: string,
-    payload: string
+    payload: string,
+    connectionHandle?: string
   ): Promise<string>;
 
   getBioMetadata(deviceHandle: string): Promise<PivBioMetadata>;