@dynamic-labs-sdk/client 1.8.1 → 1.9.0

package/android/gradlew

@@ -1,251 +0,0 @@
-#!/bin/sh
-
-#
-# Copyright © 2015-2021 the original authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-##############################################################################
-#
-#   Gradle start up script for POSIX generated by Gradle.
-#
-#   Important for running:
-#
-#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
-#       noncompliant, but you have some other compliant shell such as ksh or
-#       bash, then to run this script, type that shell name before the whole
-#       command line, like:
-#
-#           ksh Gradle
-#
-#       Busybox and similar reduced shells will NOT work, because this script
-#       requires all of these POSIX shell features:
-#         * functions;
-#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
-#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
-#         * compound commands having a testable exit status, especially «case»;
-#         * various built-in commands including «command», «set», and «ulimit».
-#
-#   Important for patching:
-#
-#   (2) This script targets any POSIX shell, so it avoids extensions provided
-#       by Bash, Ksh, etc; in particular arrays are avoided.
-#
-#       The "traditional" practice of packing multiple parameters into a
-#       space-separated string is a well documented source of bugs and security
-#       problems, so this is (mostly) avoided, by progressively accumulating
-#       options in "$@", and eventually passing that to Java.
-#
-#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
-#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
-#       see the in-line comments for details.
-#
-#       There are tweaks for specific operating systems such as AIX, CygWin,
-#       Darwin, MinGW, and NonStop.
-#
-#   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
-#       within the Gradle project.
-#
-#       You can find Gradle at https://github.com/gradle/gradle/.
-#
-##############################################################################
-
-# Attempt to set APP_HOME
-
-# Resolve links: $0 may be a link
-app_path=$0
-
-# Need this for daisy-chained symlinks.
-while
-    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
-    [ -h "$app_path" ]
-do
-    ls=$( ls -ld "$app_path" )
-    link=${ls#*' -> '}
-    case $link in             #(
-      /*)   app_path=$link ;; #(
-      *)    app_path=$APP_HOME$link ;;
-    esac
-done
-
-# This is normally unused
-# shellcheck disable=SC2034
-APP_BASE_NAME=${0##*/}
-# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
-APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
-
-# Use the maximum available, or set MAX_FD != -1 to use that value.
-MAX_FD=maximum
-
-warn () {
-    echo "$*"
-} >&2
-
-die () {
-    echo
-    echo "$*"
-    echo
-    exit 1
-} >&2
-
-# OS specific support (must be 'true' or 'false').
-cygwin=false
-msys=false
-darwin=false
-nonstop=false
-case "$( uname )" in                #(
-  CYGWIN* )         cygwin=true  ;; #(
-  Darwin* )         darwin=true  ;; #(
-  MSYS* | MINGW* )  msys=true    ;; #(
-  NONSTOP* )        nonstop=true ;;
-esac
-
-CLASSPATH="\\\"\\\""
-
-
-# Determine the Java command to use to start the JVM.
-if [ -n "$JAVA_HOME" ] ; then
-    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
-        # IBM's JDK on AIX uses strange locations for the executables
-        JAVACMD=$JAVA_HOME/jre/sh/java
-    else
-        JAVACMD=$JAVA_HOME/bin/java
-    fi
-    if [ ! -x "$JAVACMD" ] ; then
-        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
-
-Please set the JAVA_HOME variable in your environment to match the
-location of your Java installation."
-    fi
-else
-    JAVACMD=java
-    if ! command -v java >/dev/null 2>&1
-    then
-        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
-
-Please set the JAVA_HOME variable in your environment to match the
-location of your Java installation."
-    fi
-fi
-
-# Increase the maximum file descriptors if we can.
-if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
-    case $MAX_FD in #(
-      max*)
-        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC2039,SC3045
-        MAX_FD=$( ulimit -H -n ) ||
-            warn "Could not query maximum file descriptor limit"
-    esac
-    case $MAX_FD in  #(
-      '' | soft) :;; #(
-      *)
-        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC2039,SC3045
-        ulimit -n "$MAX_FD" ||
-            warn "Could not set maximum file descriptor limit to $MAX_FD"
-    esac
-fi
-
-# Collect all arguments for the java command, stacking in reverse order:
-#   * args from the command line
-#   * the main class name
-#   * -classpath
-#   * -D...appname settings
-#   * --module-path (only if needed)
-#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
-
-# For Cygwin or MSYS, switch paths to Windows format before running java
-if "$cygwin" || "$msys" ; then
-    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
-    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
-
-    JAVACMD=$( cygpath --unix "$JAVACMD" )
-
-    # Now convert the arguments - kludge to limit ourselves to /bin/sh
-    for arg do
-        if
-            case $arg in                                #(
-              -*)   false ;;                            # don't mess with options #(
-              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
-                    [ -e "$t" ] ;;                      #(
-              *)    false ;;
-            esac
-        then
-            arg=$( cygpath --path --ignore --mixed "$arg" )
-        fi
-        # Roll the args list around exactly as many times as the number of
-        # args, so each arg winds up back in the position where it started, but
-        # possibly modified.
-        #
-        # NB: a `for` loop captures its iteration list before it begins, so
-        # changing the positional parameters here affects neither the number of
-        # iterations, nor the values presented in `arg`.
-        shift                   # remove old arg
-        set -- "$@" "$arg"      # push replacement arg
-    done
-fi
-
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
-
-# Collect all arguments for the java command:
-#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
-#     and any embedded shellness will be escaped.
-#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
-#     treated as '${Hostname}' itself on the command line.
-
-set -- \
-        "-Dorg.gradle.appname=$APP_BASE_NAME" \
-        -classpath "$CLASSPATH" \
-        -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
-        "$@"
-
-# Stop when "xargs" is not available.
-if ! command -v xargs >/dev/null 2>&1
-then
-    die "xargs is not available"
-fi
-
-# Use "xargs" to parse quoted args.
-#
-# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
-#
-# In Bash we could simply go:
-#
-#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
-#   set -- "${ARGS[@]}" "$@"
-#
-# but POSIX shell has neither arrays nor command substitution, so instead we
-# post-process each arg (as a line of input to sed) to backslash-escape any
-# character that might be a shell metacharacter, then use eval to reverse
-# that process (while maintaining the separation between arguments), and wrap
-# the whole thing up as a single "set" statement.
-#
-# This will of course break if any of these variables contains a newline or
-# an unmatched quote.
-#
-
-eval "set -- $(
-        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
-        xargs -n1 |
-        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
-        tr '\n' ' '
-    )" '"$@"'
-
-exec "$JAVACMD" "$@"

package/android/gradlew.bat

@@ -1,94 +0,0 @@
-@rem
-@rem Copyright 2015 the original author or authors.
-@rem
-@rem Licensed under the Apache License, Version 2.0 (the "License");
-@rem you may not use this file except in compliance with the License.
-@rem You may obtain a copy of the License at
-@rem
-@rem      https://www.apache.org/licenses/LICENSE-2.0
-@rem
-@rem Unless required by applicable law or agreed to in writing, software
-@rem distributed under the License is distributed on an "AS IS" BASIS,
-@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-@rem See the License for the specific language governing permissions and
-@rem limitations under the License.
-@rem
-@rem SPDX-License-Identifier: Apache-2.0
-@rem
-
-@if "%DEBUG%"=="" @echo off
-@rem ##########################################################################
-@rem
-@rem  Gradle startup script for Windows
-@rem
-@rem ##########################################################################
-
-@rem Set local scope for the variables with windows NT shell
-if "%OS%"=="Windows_NT" setlocal
-
-set DIRNAME=%~dp0
-if "%DIRNAME%"=="" set DIRNAME=.
-@rem This is normally unused
-set APP_BASE_NAME=%~n0
-set APP_HOME=%DIRNAME%
-
-@rem Resolve any "." and ".." in APP_HOME to make it shorter.
-for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
-
-@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
-
-@rem Find java.exe
-if defined JAVA_HOME goto findJavaFromJavaHome
-
-set JAVA_EXE=java.exe
-%JAVA_EXE% -version >NUL 2>&1
-if %ERRORLEVEL% equ 0 goto execute
-
-echo. 1>&2
-echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
-echo. 1>&2
-echo Please set the JAVA_HOME variable in your environment to match the 1>&2
-echo location of your Java installation. 1>&2
-
-goto fail
-
-:findJavaFromJavaHome
-set JAVA_HOME=%JAVA_HOME:"=%
-set JAVA_EXE=%JAVA_HOME%/bin/java.exe
-
-if exist "%JAVA_EXE%" goto execute
-
-echo. 1>&2
-echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
-echo. 1>&2
-echo Please set the JAVA_HOME variable in your environment to match the 1>&2
-echo location of your Java installation. 1>&2
-
-goto fail
-
-:execute
-@rem Setup the command line
-
-set CLASSPATH=
-
-
-@rem Execute Gradle
-"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
-
-:end
-@rem End local scope for the variables with windows NT shell
-if %ERRORLEVEL% equ 0 goto mainEnd
-
-:fail
-rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
-rem the _cmd.exe /c_ return code!
-set EXIT_CODE=%ERRORLEVEL%
-if %EXIT_CODE% equ 0 set EXIT_CODE=1
-if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
-exit /b %EXIT_CODE%
-
-:mainEnd
-if "%OS%"=="Windows_NT" endlocal
-
-:omega

package/android/settings.gradle

@@ -1,30 +0,0 @@
-// Standalone settings for the test-only Gradle build of this RN library
-// module. Production consumers build it via React Native autolinking inside
-// their app (e.g. apps/expo-demo/android); this file exists solely so the
-// module can be compiled and unit-tested in isolation by `pnpm test:android`.
-//
-// We resolve @react-native/gradle-plugin out of the monorepo node_modules
-// (the same `node --print require.resolve(...)` trick the Expo demo app uses
-// in apps/expo-demo/android/settings.gradle) and includeBuild it as a
-// composite build. A TOP-LEVEL includeBuild (not pluginManagement) is what
-// lets `com.facebook.react:react-native-gradle-plugin` on the buildscript
-// classpath in build.gradle be substituted by the local build, so the
-// `com.facebook.react` plugin — which drives TurboModule codegen — resolves
-// without being published anywhere.
-def reactNativeGradlePlugin = new File(
-  providers.exec {
-    workingDir(rootDir)
-    commandLine("node", "--print", "require.resolve('@react-native/gradle-plugin/package.json', { paths: [require.resolve('react-native/package.json')] })")
-  }.standardOutput.asText.get().trim()
-).getParentFile().absolutePath
-
-includeBuild(reactNativeGradlePlugin)
-
-rootProject.name = 'dynamic-client-android'
-
-// Marker read by build.gradle to gate the test-only configuration (codegen
-// repointing, pinned react-android, test deps, JaCoCo). This settings file is
-// only evaluated when the module is built standalone; a consuming app provides
-// its own settings, so the flag stays unset there and the app build is
-// unaffected.
-gradle.ext.dynamicClientStandaloneBuild = true

package/android/src/test/java/xyz/dynamic/client/keychain/KeyStoreKeyManagerTest.kt

@@ -1,288 +0,0 @@
-package xyz.dynamic.client.keychain
-
-import android.content.Context
-import android.security.keystore.KeyGenParameterSpec
-import android.security.keystore.KeyProperties
-import android.security.keystore.StrongBoxUnavailableException
-import io.mockk.every
-import io.mockk.mockk
-import io.mockk.mockkStatic
-import io.mockk.slot
-import io.mockk.unmockkAll
-import io.mockk.verify
-import java.security.KeyPair
-import java.security.KeyPairGenerator
-import java.security.KeyStore
-import java.security.Signature
-import java.security.spec.ECGenParameterSpec
-import java.util.Base64
-import org.junit.After
-import org.junit.Assert.assertArrayEquals
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertNull
-import org.junit.Assert.assertThrows
-import org.junit.Assert.assertTrue
-import org.junit.Before
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.robolectric.RobolectricTestRunner
-import org.robolectric.annotation.Config
-
-// SECURITY CAVEAT (mirrors SecureEnclaveKeyManagerTests.swift): these tests use
-// MockK to stand in for the AndroidKeyStore JCA provider, which is hardware
-// (TEE/StrongBox) and does not exist under Robolectric. They verify that
-// KeyStoreKeyManager calls the right APIs with the right arguments and handles
-// the returned values correctly — they do NOT verify the KeyStore hardware
-// itself. A manual on-device smoke test of generateKeyPair and sign remains
-// required before release. The base64url and SEC1-extraction logic, by
-// contrast, is exercised for real (android.util.Base64 runs under Robolectric).
-@RunWith(RobolectricTestRunner::class)
-@Config(sdk = [35])
-class KeyStoreKeyManagerTest {
-
-    private val androidKeyStore = "AndroidKeyStore"
-
-    // A genuine P-256 keypair generated on the JVM, used as the fixture the
-    // mocked AndroidKeyStore "returns". Generated BEFORE any mockkStatic call
-    // so the real SunEC provider is still in place.
-    private lateinit var realKeyPair: KeyPair
-    private lateinit var manager: KeyStoreKeyManager
-
-    @Before
-    fun setUp() {
-        val kpg = KeyPairGenerator.getInstance("EC")
-        kpg.initialize(ECGenParameterSpec("secp256r1"))
-        realKeyPair = kpg.generateKeyPair()
-        manager = KeyStoreKeyManager()
-    }
-
-    @After
-    fun tearDown() {
-        unmockkAll()
-    }
-
-    // Independent oracle for the manager's base64url encoding (last 65 bytes of
-    // the X.509 SubjectPublicKeyInfo = the uncompressed SEC1 point).
-    private fun expectedEncodedPublicKey(): String {
-        val x509 = realKeyPair.public.encoded
-        val sec1 = x509.copyOfRange(x509.size - 65, x509.size)
-        return Base64.getUrlEncoder().withoutPadding().encodeToString(sec1)
-    }
-
-    // region base64url
-
-    @Test
-    fun base64urlDecode_decodesUrlAlphabetWithoutPadding() {
-        // "-_-_AA" is base64url for FB FF BF 00 — exercises the - and _
-        // substitutions and the stripped padding (same vector as the iOS test).
-        val decoded = KeyStoreKeyManager.base64urlDecode("-_-_AA")
-        assertArrayEquals(byteArrayOf(0xFB.toByte(), 0xFF.toByte(), 0xBF.toByte(), 0x00), decoded)
-    }
-
-    @Test
-    fun base64urlDecode_roundTripsArbitraryBytes() {
-        val original = byteArrayOf(0x04, 0xAB.toByte(), 0xCD.toByte(), 0x00, 0x7F)
-        val encoded = Base64.getUrlEncoder().withoutPadding().encodeToString(original)
-        assertArrayEquals(original, KeyStoreKeyManager.base64urlDecode(encoded))
-    }
-
-    // endregion
-
-    // region isAvailable
-
-    @Test
-    fun isAvailable_trueWhenKeyStoreLoads() {
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns mockk(relaxed = true)
-        assertTrue(manager.isAvailable(null))
-    }
-
-    @Test
-    fun isAvailable_falseWhenKeyStoreThrows() {
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } throws RuntimeException("no provider")
-        assertFalse(manager.isAvailable(null))
-    }
-
-    @Test
-    fun isAvailable_trueWithStrongBoxFeature() {
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns mockk(relaxed = true)
-        val context = mockk<Context>(relaxed = true)
-        every { context.packageManager.hasSystemFeature(any()) } returns true
-        assertTrue(manager.isAvailable(context))
-    }
-
-    // endregion
-
-    // region hasKey / deleteKey
-
-    @Test
-    fun hasKey_reflectsContainsAlias() {
-        val keyStore = mockk<KeyStore>(relaxed = true)
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
-        every { keyStore.containsAlias("present") } returns true
-        every { keyStore.containsAlias("absent") } returns false
-
-        assertTrue(manager.hasKey("present"))
-        assertFalse(manager.hasKey("absent"))
-    }
-
-    @Test
-    fun deleteKey_deletesEntryForAlias() {
-        val keyStore = mockk<KeyStore>(relaxed = true)
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
-
-        manager.deleteKey("doomed")
-
-        verify { keyStore.deleteEntry("doomed") }
-    }
-
-    // endregion
-
-    // region getPublicKey
-
-    @Test
-    fun getPublicKey_nullWhenEntryMissing() {
-        val keyStore = mockk<KeyStore>(relaxed = true)
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
-        every { keyStore.getEntry("missing", null) } returns null
-
-        assertNull(manager.getPublicKey("missing"))
-    }
-
-    @Test
-    fun getPublicKey_returnsBase64urlSec1PointForPrivateKeyEntry() {
-        val keyStore = mockk<KeyStore>(relaxed = true)
-        val entry = mockk<KeyStore.PrivateKeyEntry>(relaxed = true)
-        every { entry.certificate.publicKey.encoded } returns realKeyPair.public.encoded
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
-        every { keyStore.getEntry("tag", null) } returns entry
-
-        assertEquals(expectedEncodedPublicKey(), manager.getPublicKey("tag"))
-    }
-
-    // endregion
-
-    // region sign
-
-    @Test
-    fun sign_throwsWhenKeyMissing() {
-        val keyStore = mockk<KeyStore>(relaxed = true)
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
-        every { keyStore.getEntry("missing", null) } returns null
-
-        val ex = assertThrows(IllegalArgumentException::class.java) {
-            manager.sign("missing", byteArrayOf(1, 2, 3))
-        }
-        assertEquals("Key not found: missing", ex.message)
-    }
-
-    @Test
-    fun sign_usesEcdsaSha256AndReturnsBase64urlSignature() {
-        val keyStore = mockk<KeyStore>(relaxed = true)
-        val entry = mockk<KeyStore.PrivateKeyEntry>(relaxed = true)
-        every { entry.privateKey } returns realKeyPair.private
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
-        every { keyStore.getEntry("tag", null) } returns entry
-
-        val signatureBytes = byteArrayOf(0xDE.toByte(), 0xAD.toByte())
-        val signature = mockk<Signature>(relaxed = true)
-        every { signature.sign() } returns signatureBytes
-        mockkStatic(Signature::class)
-        every { Signature.getInstance("SHA256withECDSA") } returns signature
-
-        val payload = byteArrayOf(0x01, 0x02)
-        val result = manager.sign("tag", payload)
-
-        assertEquals(
-            Base64.getUrlEncoder().withoutPadding().encodeToString(signatureBytes),
-            result,
-        )
-        verify { signature.initSign(realKeyPair.private) }
-        verify { signature.update(payload) }
-    }
-
-    // endregion
-
-    // region generateKeyPair
-
-    private fun stubKeyStoreWithoutAlias(): KeyStore {
-        val keyStore = mockk<KeyStore>(relaxed = true)
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
-        every { keyStore.containsAlias(any()) } returns false
-        return keyStore
-    }
-
-    @Test
-    fun generateKeyPair_throwsWhenAliasAlreadyExists() {
-        val keyStore = mockk<KeyStore>(relaxed = true)
-        mockkStatic(KeyStore::class)
-        every { KeyStore.getInstance(androidKeyStore) } returns keyStore
-        every { keyStore.containsAlias("dupe") } returns true
-
-        val ex = assertThrows(IllegalArgumentException::class.java) {
-            manager.generateKeyPair("dupe")
-        }
-        assertEquals("Key already exists for alias: dupe", ex.message)
-    }
-
-    @Test
-    fun generateKeyPair_initializesSpecWithExpectedShape() {
-        stubKeyStoreWithoutAlias()
-        val kpg = mockk<KeyPairGenerator>(relaxed = true)
-        every { kpg.generateKeyPair() } returns realKeyPair
-        mockkStatic(KeyPairGenerator::class)
-        every { KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, androidKeyStore) } returns kpg
-
-        val specSlot = slot<java.security.spec.AlgorithmParameterSpec>()
-        every { kpg.initialize(capture(specSlot)) } returns Unit
-
-        val encoded = manager.generateKeyPair("mytag")
-
-        val spec = specSlot.captured as KeyGenParameterSpec
-        assertEquals("mytag", spec.keystoreAlias)
-        assertEquals(
-            KeyProperties.PURPOSE_SIGN or KeyProperties.PURPOSE_VERIFY,
-            spec.purposes,
-        )
-        assertTrue(spec.digests.contains(KeyProperties.DIGEST_SHA256))
-        assertEquals(
-            "secp256r1",
-            (spec.algorithmParameterSpec as ECGenParameterSpec).name,
-        )
-        // On API >= P the first attempt requests StrongBox backing.
-        assertTrue(spec.isStrongBoxBacked)
-        assertEquals(expectedEncodedPublicKey(), encoded)
-    }
-
-    @Test
-    fun generateKeyPair_fallsBackToSoftwareWhenStrongBoxUnavailable() {
-        stubKeyStoreWithoutAlias()
-        val kpg = mockk<KeyPairGenerator>(relaxed = true)
-        // First (StrongBox) attempt fails; second (software) attempt succeeds.
-        every { kpg.generateKeyPair() } throws StrongBoxUnavailableException() andThen realKeyPair
-        mockkStatic(KeyPairGenerator::class)
-        every { KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, androidKeyStore) } returns kpg
-
-        val specSlots = mutableListOf<java.security.spec.AlgorithmParameterSpec>()
-        every { kpg.initialize(capture(specSlots)) } returns Unit
-
-        val encoded = manager.generateKeyPair("mytag")
-
-        assertEquals(2, specSlots.size)
-        assertTrue((specSlots[0] as KeyGenParameterSpec).isStrongBoxBacked)
-        assertFalse((specSlots[1] as KeyGenParameterSpec).isStrongBoxBacked)
-        assertEquals(expectedEncodedPublicKey(), encoded)
-    }
-
-    // endregion
-}