@dynamic-labs-sdk/client 1.6.0 → 1.8.0

package/ios/ReactNativeManifestImpl.swift

@@ -0,0 +1,20 @@
+import Foundation
+
+/// Swift implementation of the ReactNativeManifest module.
+/// Returns the SDK manifest (version + any future metadata) baked in at
+/// build time. The SDK version is passed through from the ObjC++ bridge
+/// via the DYNAMIC_SDK_VERSION preprocessor macro.
+@objc public class ReactNativeManifestImpl: NSObject {
+
+  private let sdkVersion: String
+
+  @objc public init(sdkVersion: String) {
+    self.sdkVersion = sdkVersion
+  }
+
+  @objc public func getManifest() -> [String: Any] {
+    return [
+      "sdkVersion": sdkVersion
+    ]
+  }
+}

package/ios/SecKeyAPI.swift

@@ -0,0 +1,57 @@
+import Foundation
+import Security
+
+/// Abstracts the Security/CryptoKit framework C calls that
+/// `SecureEnclaveKeyManager` depends on, so they can be substituted
+/// in unit tests.
+///
+/// Why this exists: the underlying calls (`SecKeyCreateRandomKey`,
+/// `SecKeyCreateSignature`, etc.) require a real Secure Enclave and
+/// therefore cannot run on the iOS Simulator where unit tests execute.
+/// Tests inject a fake; production uses `LiveSecKeyAPI`.
+///
+/// IMPORTANT: covering this seam with mocks gives line coverage, not
+/// security confidence. A manual on-device smoke test of
+/// `generateKeyPair` and `sign` remains required before any release.
+protocol SecKeyAPI {
+  /// Returns true if the device has a Secure Enclave (real hardware
+  /// only; always false on Simulator).
+  func isSecureEnclaveAvailable() -> Bool
+
+  /// Wraps `SecItemCopyMatching`. Returns the status code and, on
+  /// success, the matching keychain item reference.
+  func itemCopyMatching(query: CFDictionary) -> (status: OSStatus, item: CFTypeRef?)
+
+  /// Wraps `SecItemDelete`. The original call site discards the
+  /// result, so this signature mirrors that.
+  func itemDelete(query: CFDictionary) -> OSStatus
+
+  /// Wraps `SecAccessControlCreateWithFlags`. Returns nil only on
+  /// invalid flag combinations, which never happen with the inputs
+  /// this codebase uses — the caller force-unwraps.
+  func createAccessControl(
+    protection: CFTypeRef,
+    flags: SecAccessControlCreateFlags
+  ) -> SecAccessControl?
+
+  /// Wraps `SecKeyCreateRandomKey`. Throws an `NSError` whose
+  /// `localizedDescription` is the underlying `CFError`'s string
+  /// representation; the caller re-wraps with its own domain/code.
+  func createRandomKey(attributes: CFDictionary) throws -> SecKey
+
+  /// Wraps `SecKeyCopyPublicKey`. Returns nil if the platform cannot
+  /// derive the public key from the given private key.
+  func copyPublicKey(_ key: SecKey) -> SecKey?
+
+  /// Wraps `SecKeyCreateSignature`. Returns the raw signature bytes
+  /// or throws if the underlying call fails.
+  func createSignature(
+    key: SecKey,
+    algorithm: SecKeyAlgorithm,
+    data: CFData
+  ) throws -> Data
+
+  /// Wraps `SecKeyCopyExternalRepresentation`. For Secure Enclave
+  /// P-256 keys this returns uncompressed SEC1 (04 || x || y).
+  func copyExternalRepresentation(_ key: SecKey) throws -> Data
+}

package/ios/SecureEnclaveKeyManager.swift

@@ -0,0 +1,191 @@
+import Foundation
+import Security
+import CryptoKit
+
+/// Secure Enclave key manager providing P-256 key generation, signing, and management.
+/// All public keys are returned in uncompressed SEC1 format (65 bytes: 04 || x || y).
+/// All binary data uses base64url encoding (RFC 4648 §5, no padding).
+@objc public class SecureEnclaveKeyManager: NSObject {
+
+  private let api: SecKeyAPI
+
+  // Designated init used by the ObjC++ bridge — wires in the real
+  // Security/CryptoKit calls via LiveSecKeyAPI.
+  @objc public override init() {
+    self.api = LiveSecKeyAPI()
+    super.init()
+  }
+
+  // Designated init used by unit tests to inject a fake SecKeyAPI.
+  // Not @objc-exposed because the protocol is Swift-only.
+  init(api: SecKeyAPI) {
+    self.api = api
+    super.init()
+  }
+
+  @objc public func isAvailable() -> Bool {
+    return api.isSecureEnclaveAvailable()
+  }
+
+  @objc public func hasKey(_ tag: String) -> Bool {
+    let query = baseQuery(for: tag, returning: true)
+    let result = api.itemCopyMatching(query: query as CFDictionary)
+    return result.status == errSecSuccess
+  }
+
+  @objc public func generateKeyPair(_ tag: String) throws -> String {
+    let tagData = tag.data(using: .utf8)!
+
+    let access = api.createAccessControl(
+      protection: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly,
+      flags: .privateKeyUsage
+    )!
+
+    let attributes: [String: Any] = [
+      kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+      kSecAttrKeySizeInBits as String: 256,
+      kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave,
+      kSecPrivateKeyAttrs as String: [
+        kSecAttrIsPermanent as String: true,
+        kSecAttrApplicationTag as String: tagData,
+        kSecAttrAccessControl as String: access,
+      ] as [String: Any],
+    ]
+
+    let privateKey: SecKey
+    do {
+      privateKey = try api.createRandomKey(attributes: attributes as CFDictionary)
+    } catch {
+      throw NSError(
+        domain: "SecureEnclaveKeyManager",
+        code: 1,
+        userInfo: [NSLocalizedDescriptionKey: (error as NSError).localizedDescription]
+      )
+    }
+
+    guard let publicKey = api.copyPublicKey(privateKey) else {
+      throw NSError(
+        domain: "SecureEnclaveKeyManager",
+        code: 2,
+        userInfo: [NSLocalizedDescriptionKey: "Failed to extract public key"]
+      )
+    }
+
+    let publicKeyData = try exportPublicKey(publicKey)
+    return base64urlEncode(publicKeyData)
+  }
+
+  /// Returns the base64url-encoded public key, or an empty string if the key does not exist.
+  /// The ObjC++ bridge maps empty string to null.
+  @objc public func getPublicKey(_ tag: String) throws -> String {
+    let query = baseQuery(for: tag, returning: true)
+    let result = api.itemCopyMatching(query: query as CFDictionary)
+
+    guard result.status == errSecSuccess, let ref = result.item else {
+      // Key not found — return empty string so the bridge can resolve null
+      return ""
+    }
+
+    let privateKey = ref as! SecKey
+    guard let publicKey = api.copyPublicKey(privateKey) else {
+      throw NSError(
+        domain: "SecureEnclaveKeyManager",
+        code: 2,
+        userInfo: [NSLocalizedDescriptionKey: "Failed to extract public key"]
+      )
+    }
+
+    let publicKeyData = try exportPublicKey(publicKey)
+    return base64urlEncode(publicKeyData)
+  }
+
+  @objc public func sign(_ tag: String, payload: String) throws -> String {
+    let query = baseQuery(for: tag, returning: true)
+    let result = api.itemCopyMatching(query: query as CFDictionary)
+
+    guard result.status == errSecSuccess, let ref = result.item else {
+      throw NSError(
+        domain: "SecureEnclaveKeyManager",
+        code: 3,
+        userInfo: [NSLocalizedDescriptionKey: "Key not found for tag: \(tag)"]
+      )
+    }
+
+    let privateKey = ref as! SecKey
+
+    guard let payloadData = base64urlDecode(payload) else {
+      throw NSError(
+        domain: "SecureEnclaveKeyManager",
+        code: 4,
+        userInfo: [NSLocalizedDescriptionKey: "Invalid base64url payload"]
+      )
+    }
+
+    let signature: Data
+    do {
+      signature = try api.createSignature(
+        key: privateKey,
+        algorithm: .ecdsaSignatureMessageX962SHA256,
+        data: payloadData as CFData
+      )
+    } catch {
+      throw NSError(
+        domain: "SecureEnclaveKeyManager",
+        code: 5,
+        userInfo: [NSLocalizedDescriptionKey: (error as NSError).localizedDescription]
+      )
+    }
+
+    return base64urlEncode(signature)
+  }
+
+  @objc public func deleteKey(_ tag: String) {
+    let query = baseQuery(for: tag, returning: false)
+    _ = api.itemDelete(query: query as CFDictionary)
+  }
+
+  // MARK: - Private helpers
+
+  private func baseQuery(for tag: String, returning returnRef: Bool) -> [String: Any] {
+    var query: [String: Any] = [
+      kSecClass as String: kSecClassKey,
+      kSecAttrApplicationTag as String: tag.data(using: .utf8)!,
+      kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+    ]
+    if returnRef {
+      query[kSecReturnRef as String] = true
+    }
+    return query
+  }
+
+  private func exportPublicKey(_ publicKey: SecKey) throws -> Data {
+    do {
+      // SecKeyCopyExternalRepresentation returns uncompressed SEC1 (04 || x || y)
+      return try api.copyExternalRepresentation(publicKey)
+    } catch {
+      throw NSError(
+        domain: "SecureEnclaveKeyManager",
+        code: 2,
+        userInfo: [NSLocalizedDescriptionKey: (error as NSError).localizedDescription]
+      )
+    }
+  }
+
+  private func base64urlEncode(_ data: Data) -> String {
+    data.base64EncodedString()
+      .replacingOccurrences(of: "+", with: "-")
+      .replacingOccurrences(of: "/", with: "_")
+      .replacingOccurrences(of: "=", with: "")
+  }
+
+  private func base64urlDecode(_ string: String) -> Data? {
+    var base64 = string
+      .replacingOccurrences(of: "-", with: "+")
+      .replacingOccurrences(of: "_", with: "/")
+    let remainder = base64.count % 4
+    if remainder > 0 {
+      base64 += String(repeating: "=", count: 4 - remainder)
+    }
+    return Data(base64Encoded: base64)
+  }
+}

package/package.json

@@ -1,38 +1,47 @@
 {
   "name": "@dynamic-labs-sdk/client",
-  "version": "1.6.0",
+  "version": "1.8.0",
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.esm.js",
   "types": "./dist/exports/index.d.ts",
   "files": [
-    "dist"
+    "dist",
+    "ios",
+    "android",
+    "dynamic-labs-sdk-client.podspec",
+    "react-native.config.cjs",
+    "src/turboModules"
   ],
   "exports": {
     "./package.json": "./package.json",
     ".": {
+      "react-native": "./dist/index.native.esm.js",
       "types": "./dist/exports/index.d.ts",
       "import": "./dist/index.esm.js",
       "default": "./dist/index.cjs"
     },
     "./core": {
+      "react-native": "./dist/core.native.esm.js",
       "types": "./dist/exports/core.d.ts",
       "import": "./dist/core.esm.js",
       "default": "./dist/core.cjs"
     },
     "./waas": {
+      "react-native": "./dist/waas.native.esm.js",
       "types": "./dist/exports/waas.d.ts",
       "import": "./dist/waas.esm.js",
       "default": "./dist/waas.cjs"
     },
     "./waas/core": {
+      "react-native": "./dist/waasCore.native.esm.js",
       "types": "./dist/exports/waasCore.d.ts",
       "import": "./dist/waasCore.esm.js",
       "default": "./dist/waasCore.cjs"
     }
   },
   "dependencies": {
-    "@dynamic-labs-wallet/browser-wallet-client": "1.0.7",
+    "@dynamic-labs-wallet/browser-wallet-client": "1.0.16",
     "@dynamic-labs-wallet/forward-mpc-client": "0.10.1",
     "@dynamic-labs/sdk-api-core": "0.0.1015",
     "@simplewebauthn/browser": "13.1.0",
@@ -40,7 +49,7 @@
     "buffer": "6.0.3",
     "eventemitter3": "5.0.1",
     "zod": "4.0.5",
-    "@dynamic-labs-sdk/assert-package-version": "1.6.0"
+    "@dynamic-labs-sdk/assert-package-version": "1.8.0"
   },
   "devDependencies": {
     "@inrupt/jest-jsdom-polyfills": "4.0.5",
@@ -84,11 +93,13 @@
   },
   "scripts": {
     "build": "rm -rf dist && tsdown && pnpm exec tsc --emitDeclarationOnly -p ./tsconfig.lib.json && pnpm exec tsc --noEmit -p ./tsconfig.lib.native.json",
-    "lint": "eslint .",
+    "lint": "eslint . && pnpm --filter @tools/check-native-module-names run check .",
     "lint:fix": "eslint . --fix",
     "test": "vitest run",
     "test:watch": "vitest",
     "test-with-coverage": "vitest run --coverage",
+    "test:xcode": "bash scripts/run-xcode-tests.sh",
+    "test:android": "bash scripts/run-android-tests.sh",
     "check-versions": "pnpm --filter @tools/sync-package-versions run sync --check-only --package-filter client"
   }
 }

package/react-native.config.cjs

@@ -0,0 +1,14 @@
+module.exports = {
+  dependency: {
+    platforms: {
+      ios: {
+        podspecPath: `${__dirname}/dynamic-labs-sdk-client.podspec`,
+      },
+      android: {
+        sourceDir: `${__dirname}/android`,
+        packageImportPath: 'import xyz.dynamic.client.DynamicClientPackage;',
+        packageInstance: 'new DynamicClientPackage()',
+      },
+    },
+  },
+};

package/src/turboModules/NativeDynamicWebView.native.spec.ts

@@ -0,0 +1,61 @@
+/// <reference types="vitest/globals" />
+
+const turboModuleGetMock = vi.fn();
+
+vi.mock('react-native', () => ({
+  TurboModuleRegistry: {
+    get get() {
+      return turboModuleGetMock;
+    },
+  },
+}));
+
+describe('NativeDynamicWebView', () => {
+  beforeEach(() => {
+    vi.resetModules();
+  });
+
+  describe('when the TurboModuleRegistry resolves the native module', () => {
+    const resolvedModule = {
+      addListener: vi.fn(),
+      close: vi.fn(),
+      open: vi.fn(),
+      removeListeners: vi.fn(),
+      sendMessage: vi.fn(),
+    };
+
+    beforeEach(() => {
+      turboModuleGetMock.mockReturnValue(resolvedModule);
+    });
+
+    it('should expose the resolved module as the default export', async () => {
+      const imported = await import('./NativeDynamicWebView');
+
+      expect(imported.default).toBe(resolvedModule);
+    });
+
+    it("should look up the native module under the 'DynamicClientWebView' key that matches the iOS and Android registration", async () => {
+      await import('./NativeDynamicWebView');
+
+      expect(turboModuleGetMock).toHaveBeenCalledWith('DynamicClientWebView');
+    });
+
+    it('should resolve the native module exactly once at import time', async () => {
+      await import('./NativeDynamicWebView');
+
+      expect(turboModuleGetMock).toHaveBeenCalledOnce();
+    });
+  });
+
+  describe('when the TurboModuleRegistry cannot resolve the native module', () => {
+    beforeEach(() => {
+      turboModuleGetMock.mockReturnValue(null);
+    });
+
+    it('should expose null as the default export so consumers can surface a linking error', async () => {
+      const imported = await import('./NativeDynamicWebView');
+
+      expect(imported.default).toBeNull();
+    });
+  });
+});

package/src/turboModules/NativeDynamicWebView.ts

@@ -0,0 +1,40 @@
+// This file is a TurboModule spec consumed by React Native codegen.
+// The `interface`, `default export`, and the `react-native` import are hard
+// requirements of the codegen parser and intentionally deviate from the
+// project's conventions. Codegen discovers specs by the `Native*` filename
+// prefix, so this file cannot be renamed to `.native.ts`.
+
+import { type TurboModule, TurboModuleRegistry } from 'react-native';
+import type { UnsafeObject } from 'react-native/Libraries/Types/CodegenTypes';
+
+export interface Spec extends TurboModule {
+  addListener(eventName: string): void;
+  close(instanceId: string): void;
+  /**
+   * Creates a WKWebView for the given instanceId and begins loading `url`.
+   *
+   * Resolves on `didCommit` — i.e. the first byte of a 2xx/3xx HTTP
+   * response has been received and content parsing has started. Page-ready
+   * (e.g. the hosted iframe's `iframe-ready-*` handshake) is a separate
+   * concern and must be observed by the caller via the message bus; this
+   * Promise does not wait for it.
+   *
+   * Rejects with a `code` of `webview_<reason>` where `<reason>` is one of:
+   *   - `invalid_url` — URL string was not parseable
+   *   - `no_host_view` — no foreground window to attach the WebView
+   *   - `http_error` — response status was >= 400 (userInfo contains `DynamicWebViewStatusCode`)
+   *   - `navigation_failed` — DNS, TLS, connection failure, or post-commit abort
+   *   - `cancelled` — `close(instanceId)` was called while this open was pending
+   *   - `instance_busy` — `open` was called for an instanceId that already has an active WebView
+   *   - `content_process_terminated` — the WKWebView WebContent process died during load
+   *   - `unsupported` — the device's Android System WebView is too old to support the secure bridge (Android only)
+   *
+   * rejection codes into typed `WebViewLoadFailedError` instances.
+   */
+  open(instanceId: string, url: string): Promise<void>;
+  removeListeners(count: number): void;
+  sendMessage(instanceId: string, data: UnsafeObject): void;
+}
+
+// eslint-disable-next-line import/no-default-export
+export default TurboModuleRegistry.get<Spec>('DynamicClientWebView');

package/src/turboModules/NativeKeychain.native.spec.ts

@@ -0,0 +1,47 @@
+/// <reference types="vitest/globals" />
+
+const turboModuleGetEnforcingMock = vi.fn();
+
+vi.mock('react-native', () => ({
+  TurboModuleRegistry: {
+    get getEnforcing() {
+      return turboModuleGetEnforcingMock;
+    },
+  },
+}));
+
+describe('NativeKeychain', () => {
+  const resolvedModule = {
+    deleteKey: vi.fn(),
+    generateKeyPair: vi.fn(),
+    getPublicKey: vi.fn(),
+    hasKey: vi.fn(),
+    isAvailable: vi.fn(),
+    sign: vi.fn(),
+  };
+
+  beforeEach(() => {
+    vi.resetModules();
+    turboModuleGetEnforcingMock.mockReturnValue(resolvedModule);
+  });
+
+  it('should expose the resolved module as the default export', async () => {
+    const imported = await import('./NativeKeychain');
+
+    expect(imported.default).toBe(resolvedModule);
+  });
+
+  it("should look up the native module under the 'DynamicClientKeychain' key that matches the iOS and Android registration", async () => {
+    await import('./NativeKeychain');
+
+    expect(turboModuleGetEnforcingMock).toHaveBeenCalledWith(
+      'DynamicClientKeychain'
+    );
+  });
+
+  it('should resolve the native module exactly once at import time', async () => {
+    await import('./NativeKeychain');
+
+    expect(turboModuleGetEnforcingMock).toHaveBeenCalledOnce();
+  });
+});

package/src/turboModules/NativeKeychain.ts

@@ -0,0 +1,19 @@
+// This file is a TurboModule spec consumed by React Native codegen.
+// The `interface`, `default export`, and `react-native` import are hard
+// requirements of the codegen parser and intentionally deviate from the
+// project's conventions. Codegen discovers specs by the `Native*` filename
+// prefix, so this file cannot be renamed to `.native.ts`.
+
+import { type TurboModule, TurboModuleRegistry } from 'react-native';
+
+export interface Spec extends TurboModule {
+  deleteKey(key: string): Promise<void>;
+  generateKeyPair(key: string): Promise<{ publicKey: string }>;
+  getPublicKey(key: string): Promise<{ publicKey: string } | null>;
+  hasKey(key: string): Promise<boolean>;
+  isAvailable(): Promise<boolean>;
+  sign(key: string, payload: string): Promise<{ signature: string }>;
+}
+
+// eslint-disable-next-line import/no-default-export
+export default TurboModuleRegistry.getEnforcing<Spec>('DynamicClientKeychain');

package/src/turboModules/NativeReactNativeManifest.native.spec.ts

@@ -0,0 +1,55 @@
+/// <reference types="vitest/globals" />
+
+const turboModuleGetMock = vi.fn();
+
+vi.mock('react-native', () => ({
+  TurboModuleRegistry: {
+    get get() {
+      return turboModuleGetMock;
+    },
+  },
+}));
+
+describe('NativeReactNativeManifest', () => {
+  beforeEach(() => {
+    vi.resetModules();
+  });
+
+  describe('when the TurboModuleRegistry resolves the native module', () => {
+    const resolvedModule = { getManifest: vi.fn() };
+
+    beforeEach(() => {
+      turboModuleGetMock.mockReturnValue(resolvedModule);
+    });
+
+    it('should expose the resolved module as the default export', async () => {
+      const imported = await import('./NativeReactNativeManifest');
+
+      expect(imported.default).toBe(resolvedModule);
+    });
+
+    it("should look up the native module under the 'DynamicClientManifest' key that matches the iOS and Android registration", async () => {
+      await import('./NativeReactNativeManifest');
+
+      expect(turboModuleGetMock).toHaveBeenCalledWith('DynamicClientManifest');
+    });
+
+    it('should resolve the native module exactly once at import time', async () => {
+      await import('./NativeReactNativeManifest');
+
+      expect(turboModuleGetMock).toHaveBeenCalledOnce();
+    });
+  });
+
+  describe('when the TurboModuleRegistry cannot resolve the native module', () => {
+    beforeEach(() => {
+      turboModuleGetMock.mockReturnValue(null);
+    });
+
+    it('should expose null as the default export so consumers can surface a linking error', async () => {
+      const imported = await import('./NativeReactNativeManifest');
+
+      expect(imported.default).toBeNull();
+    });
+  });
+});

package/src/turboModules/NativeReactNativeManifest.ts

@@ -0,0 +1,28 @@
+/**
+ * React Native TurboModule spec for the `ReactNativeManifest` native module.
+ *
+ * Consumed by React Native codegen to emit the Android/iOS native interfaces.
+ * The filename must stay prefixed with `Native` — codegen's parser discovers
+ * spec files by that convention and will silently skip anything else, leaving
+ * the native module uncompiled. Do not rename this file.
+ *
+ * The `interface` keyword, the `default export`, and the locally-declared
+ * `ReactNativeManifest` type are hard requirements of the codegen parser and
+ * intentionally deviate from project conventions: codegen parses this file
+ * statically and does NOT follow imported type aliases, so the return shape
+ * must be defined inline here. The canonical type lives in
+ * `nativeManifest.types.ts`; the `assertSameShape` line below is a TS-only
+ * check that fails the build if the two definitions drift.
+ */
+import { type TurboModule, TurboModuleRegistry } from 'react-native';
+
+export type ReactNativeManifest = {
+  sdkVersion: string;
+};
+
+export interface Spec extends TurboModule {
+  getManifest(): ReactNativeManifest;
+}
+
+// eslint-disable-next-line import/no-default-export -- codegen requires a default export of the TurboModule spec
+export default TurboModuleRegistry.get<Spec>('DynamicClientManifest');