@gnolang/gnonative 4.7.1 → 4.7.3

package/android/src/main/java/land/gno/gnonative/GnonativeModule.kt

@@ -17,6 +17,7 @@ class GnonativeModule : Module() {
   private var rootDir: File? = null
   private var socketPort = 0
   private var bridgeGnoNative: Bridge? = null
+  private var nativeDBManager: NativeDBManager? = null
 
   // Each module class must implement the definition function. The definition consists of components
   // that describes the module's functionality and behavior.
@@ -33,6 +34,7 @@ class GnonativeModule : Module() {
     OnCreate {
       context = appContext.reactContext
       rootDir = context!!.filesDir
+      nativeDBManager = NativeDBManager(context!!)
     }
 
     OnDestroy {
@@ -53,8 +55,8 @@ class GnonativeModule : Module() {
       try {
         val config: BridgeConfig = Gnonative.newBridgeConfig() ?: throw Exception("")
         config.rootDir = rootDir!!.absolutePath
+        config.nativeDB = nativeDBManager
         bridgeGnoNative = Gnonative.newBridge(config)
-
         promise.resolve(true)
       } catch (err: CodedException) {
         promise.reject(err)

package/android/src/main/java/land/gno/gnonative/NativeDBManager.kt

@@ -0,0 +1,325 @@
+package land.gno.gnonative
+
+import android.content.Context
+import android.content.SharedPreferences
+import android.os.Build
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyProperties
+import android.util.Base64
+import gnolang.gno.gnonative.NativeDB
+import java.io.ByteArrayOutputStream
+import java.nio.ByteBuffer
+import java.security.KeyStore
+import javax.crypto.Cipher
+import javax.crypto.KeyGenerator
+import javax.crypto.SecretKey
+import javax.crypto.spec.GCMParameterSpec
+import kotlin.math.min
+import androidx.core.content.edit
+
+class NativeDBManager(
+  context: Context,
+  private val prefsName: String = "gnonative_secure_db",
+  private val keyAlias: String = "gnonative_aes_key"
+) : NativeDB {
+
+  // -------- storage / index --------
+  private val prefs: SharedPreferences =
+    context.getSharedPreferences(prefsName, Context.MODE_PRIVATE)
+  private val entryPrefix = "kv:"   // entryPrefix + hexKey -> Base64(encrypted blob)
+  private val idxKey = "__idx__"    // CSV of hex keys in ascending order
+
+  // -------- crypto --------
+  private val ks: KeyStore = KeyStore.getInstance(ANDROID_KEYSTORE).apply { load(null) }
+
+  private val lock = Any()
+
+  init {
+    ensureAesKey()
+    if (!prefs.contains(idxKey)) prefs.edit { putString(idxKey, "") }
+  }
+
+  // ========== NativeDB implementation ==========
+
+  override fun delete(p0: ByteArray?) {
+    val key = requireKey(p0)
+    val hex = hex(key)
+    synchronized(lock) {
+      val idx = loadIndexAsc().toMutableList()
+      val pos = lowerBound(idx, hex)
+      if (pos < idx.size && idx[pos] == hex) {
+        idx.removeAt(pos)
+        saveIndexAsc(idx)
+      }
+      prefs.edit { remove("$entryPrefix$hex") }
+    }
+  }
+
+  override fun deleteSync(p0: ByteArray?) {
+    delete(p0)
+  }
+
+  override fun get(p0: ByteArray?): ByteArray {
+    val key = requireKey(p0)
+    val hex = hex(key)
+    val b64 = synchronized(lock) { prefs.getString("$entryPrefix$hex", null) }
+      ?: return ByteArray(0) // gomobile generated non-null return -> use empty on miss
+    val blob = Base64.decode(b64, Base64.NO_WRAP)
+    return decrypt(blob) ?: throw Exception("Failed to decrypt value for key: $hex")
+  }
+
+  override fun has(p0: ByteArray?): Boolean {
+    val key = requireKey(p0)
+    val hex = hex(key)
+    return synchronized(lock) { prefs.contains("$entryPrefix$hex") }
+  }
+
+  override fun scanChunk(
+    p0: ByteArray?,   // start
+    p1: ByteArray?,   // end
+    p2: ByteArray?,   // seekKey
+    p3: Long,         // limit
+    p4: Boolean       // reverse
+  ): ByteArray {
+    val limit = if (p3 < 0) 0 else min(p3, Int.MAX_VALUE.toLong()).toInt()
+    return synchronized(lock) {
+      val asc = loadIndexAsc() // ascending hex keys
+      val startHex = p0?.let { hex(it) }
+      val endHex   = p1?.let { hex(it) }
+      val seekHex  = p2?.let { hex(it) }
+
+      val loBase = startHex?.let { lowerBound(asc, it) } ?: 0
+      val hiBase = endHex?.let { lowerBound(asc, it) } ?: asc.size
+      var slice: List<String> = if (hiBase <= loBase) emptyList() else asc.subList(loBase, hiBase)
+
+      // seek positioning & direction
+      slice = if (!p4) {
+        val from = seekHex?.let { upperBound(slice, it) } ?: 0
+        if (from >= slice.size) emptyList() else slice.subList(from, slice.size)
+      } else {
+        val positioned = if (seekHex != null) {
+          val idx = upperBound(slice, seekHex) - 1
+          if (idx < 0) emptyList() else slice.subList(0, idx + 1)
+        } else slice
+        positioned.asReversed()
+      }
+
+      val page = if (limit == 0) emptyList() else slice.take(limit)
+      val hasMore = page.isNotEmpty() && page.size < slice.size
+      val nextSeekHex = if (hasMore) page.last() else null
+
+      // materialize kv pairs in traversal order
+      val pairs = ArrayList<Pair<ByteArray, ByteArray>>(page.size)
+      for (h in page) {
+        val b64 = prefs.getString("$entryPrefix$h", null) ?: continue
+        val blob = Base64.decode(b64, Base64.NO_WRAP)
+        val v = decrypt(blob) ?: throw Exception("Failed to decrypt value for key: $h")
+        pairs += (unhex(h) to v)
+      }
+
+      // flags(1) | count(u32 BE) | [kLen k vLen v]* | nextSeekLen(u32 BE) | nextSeek
+      encodeChunkBlobBE(pairs, nextSeekHex?.let { unhex(it) }, hasMore)
+    }
+  }
+
+  override fun set(p0: ByteArray?, p1: ByteArray?) {
+    val key = requireKey(p0)
+    val value = requireValue(p1)
+    val hex = hex(key)
+    val enc = encrypt(value)
+    val b64 = Base64.encodeToString(enc, Base64.NO_WRAP)
+    synchronized(lock) {
+      val idx = loadIndexAsc().toMutableList()
+      val pos = lowerBound(idx, hex)
+      if (pos == idx.size || idx[pos] != hex) {
+        idx.add(pos, hex)
+        saveIndexAsc(idx)
+      }
+      prefs.edit { putString("$entryPrefix$hex", b64) }
+    }
+  }
+
+  override fun setSync(p0: ByteArray?, p1: ByteArray?) {
+    set(p0, p1)
+  }
+
+  // ========== helpers ==========
+
+  private fun requireKey(b: ByteArray?): ByteArray {
+    require(!(b == null || b.isEmpty())) { "key must not be null/empty" }
+    return b
+  }
+  private fun requireValue(b: ByteArray?): ByteArray {
+    require(b != null) { "value must not be null" }
+    return b
+  }
+
+  // ----- index (csv of hex keys, ascending) -----
+  private fun loadIndexAsc(): List<String> {
+    val csv = prefs.getString(idxKey, "") ?: ""
+    return if (csv.isEmpty()) emptyList() else csv.split(',').filter { it.isNotEmpty() }
+  }
+  private fun saveIndexAsc(keys: List<String>) {
+    prefs.edit { putString(idxKey, if (keys.isEmpty()) "" else keys.joinToString(",")) }
+  }
+
+  private fun lowerBound(list: List<String>, key: String): Int {
+    var lo = 0; var hi = list.size
+    while (lo < hi) {
+      val mid = (lo + hi) ushr 1
+      if (list[mid] < key) lo = mid + 1 else hi = mid
+    }
+    return lo
+  }
+  private fun upperBound(list: List<String>, key: String): Int {
+    var lo = 0; var hi = list.size
+    while (lo < hi) {
+      val mid = (lo + hi) ushr 1
+      if (list[mid] <= key) lo = mid + 1 else hi = mid
+    }
+    return lo
+  }
+
+  // crypto AES/GCM, StrongBox preferred
+  private fun ensureAesKey() {
+    if (getAesKey() != null) return
+
+    val kg = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, ANDROID_KEYSTORE)
+    val base = KeyGenParameterSpec.Builder(
+      keyAlias, KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
+    )
+      .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
+      .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
+      .setKeySize(256)
+      .setRandomizedEncryptionRequired(true)
+
+    try {
+      if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
+        base.setIsStrongBoxBacked(true)
+      }
+      kg.init(base.build())
+      kg.generateKey()
+      return
+    } catch (_: Throwable) {
+      // fall back below without StrongBox
+    }
+
+    kg.init(
+      KeyGenParameterSpec.Builder(
+        keyAlias, KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
+      )
+        .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
+        .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
+        .setKeySize(256)
+        .setRandomizedEncryptionRequired(true)
+        .build()
+    )
+    kg.generateKey()
+  }
+
+  private fun getAesKey(): SecretKey? {
+    val e = ks.getEntry(keyAlias, null) as? KeyStore.SecretKeyEntry
+    return e?.secretKey
+  }
+
+  private fun encrypt(plain: ByteArray): ByteArray {
+    val key = getAesKey() ?: error("AES key missing")
+
+    val c = Cipher.getInstance(AES_GCM)
+    c.init(Cipher.ENCRYPT_MODE, key)
+
+    val iv = c.iv
+    val ct = c.doFinal(plain)
+
+    // payload: [version=1][ivLen][iv][ct]
+    val out = ByteArray(1 + 1 + iv.size + ct.size)
+    var i = 0
+    out[i++] = 1
+    out[i++] = iv.size.toByte()
+    System.arraycopy(iv, 0, out, i, iv.size); i += iv.size
+    System.arraycopy(ct, 0, out, i, ct.size)
+    return out
+  }
+
+  private fun decrypt(blob: ByteArray?): ByteArray? {
+    if (blob == null || blob.size < 1 + 1 + 12) return null // iv is usually 12 bytes
+    var i = 0
+    val ver = blob[i++]
+    require(ver.toInt() == 1) { "bad payload version=$ver" }
+    val ivLen = blob[i++].toInt() and 0xFF
+    require(ivLen in 12..32) { "bad iv length" }
+    require(blob.size >= 1 + 1 + ivLen + 1) { "short blob" }
+    val iv = ByteArray(ivLen)
+    System.arraycopy(blob, i, iv, 0, ivLen); i += ivLen
+    val ct = ByteArray(blob.size - i)
+    System.arraycopy(blob, i, ct, 0, ct.size)
+
+    val key = getAesKey() ?: error("AES key missing")
+    val c = Cipher.getInstance(AES_GCM)
+    c.init(Cipher.DECRYPT_MODE, key, GCMParameterSpec(128, iv))
+    return c.doFinal(ct)
+  }
+
+  // chunk framing (match Go format)
+  private fun encodeChunkBlobBE(
+    entries: List<Pair<ByteArray, ByteArray>>,
+    nextSeek: ByteArray?,
+    hasMore: Boolean
+  ): ByteArray {
+    val bos = ByteArrayOutputStream()
+
+    // flags (bit0 = hasMore)
+    bos.write(if (hasMore) 0x01 else 0x00)
+
+    // count (u32 BE)
+    bos.write(u32be(entries.size))
+
+    // entries
+    for ((k, v) in entries) {
+      bos.write(u32be(k.size)); bos.write(k)
+      bos.write(u32be(v.size)); bos.write(v)
+    }
+
+    // nextSeek
+    val ns = nextSeek ?: ByteArray(0)
+    bos.write(u32be(ns.size))
+    if (ns.isNotEmpty()) bos.write(ns)
+
+    return bos.toByteArray()
+  }
+
+  // ----- utils -----
+  private fun u32be(n: Int): ByteArray {
+    val bb = ByteBuffer.allocate(4)
+    bb.putInt(n) // big-endian by default
+    return bb.array()
+  }
+
+  private fun hex(b: ByteArray): String {
+    val out = CharArray(b.size * 2)
+    val h = "0123456789abcdef".toCharArray()
+    var i = 0
+    for (v in b) {
+      val x = v.toInt() and 0xFF
+      out[i++] = h[x ushr 4]; out[i++] = h[x and 0x0F]
+    }
+    return String(out)
+  }
+
+  private fun unhex(s: String): ByteArray {
+    require(s.length % 2 == 0) { "odd hex length" }
+    val out = ByteArray(s.length / 2)
+    var i = 0; var j = 0
+    while (i < s.length) {
+      val hi = Character.digit(s[i++], 16)
+      val lo = Character.digit(s[i++], 16)
+      out[j++] = ((hi shl 4) or lo).toByte()
+    }
+    return out
+  }
+
+  companion object {
+    private const val ANDROID_KEYSTORE = "AndroidKeyStore"
+    private const val AES_GCM = "AES/GCM/NoPadding"
+  }
+}

package/ios/Frameworks/GnoCore.xcframework/Info.plist

@@ -8,32 +8,32 @@
 			<key>BinaryPath</key>
 			<string>GnoCore.framework/Versions/A/GnoCore</string>
 			<key>LibraryIdentifier</key>
-			<string>ios-arm64</string>
+			<string>ios-arm64_x86_64-simulator</string>
 			<key>LibraryPath</key>
 			<string>GnoCore.framework</string>
 			<key>SupportedArchitectures</key>
 			<array>
 				<string>arm64</string>
+				<string>x86_64</string>
 			</array>
 			<key>SupportedPlatform</key>
 			<string>ios</string>
+			<key>SupportedPlatformVariant</key>
+			<string>simulator</string>
 		</dict>
 		<dict>
 			<key>BinaryPath</key>
 			<string>GnoCore.framework/Versions/A/GnoCore</string>
 			<key>LibraryIdentifier</key>
-			<string>ios-arm64_x86_64-simulator</string>
+			<string>ios-arm64</string>
 			<key>LibraryPath</key>
 			<string>GnoCore.framework</string>
 			<key>SupportedArchitectures</key>
 			<array>
 				<string>arm64</string>
-				<string>x86_64</string>
 			</array>
 			<key>SupportedPlatform</key>
 			<string>ios</string>
-			<key>SupportedPlatformVariant</key>
-			<string>simulator</string>
 		</dict>
 	</array>
 	<key>CFBundlePackageType</key>

package/ios/Frameworks/GnoCore.xcframework/ios-arm64/GnoCore.framework/Headers/GnoGnonative.objc.h

@@ -13,11 +13,23 @@
 
 @class GnoGnonativeBridge;
 @class GnoGnonativeBridgeConfig;
+@protocol GnoGnonativeNativeDB;
+@class GnoGnonativeNativeDB;
 @protocol GnoGnonativePromiseBlock;
 @class GnoGnonativePromiseBlock;
 @protocol GnoGnonativeServiceClient;
 @class GnoGnonativeServiceClient;
 
+@protocol GnoGnonativeNativeDB <NSObject>
+- (BOOL)delete:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)deleteSync:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (NSData* _Nullable)get:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)has:(NSData* _Nullable)key ret0_:(BOOL* _Nullable)ret0_ error:(NSError* _Nullable* _Nullable)error;
+- (NSData* _Nullable)scanChunk:(NSData* _Nullable)start end:(NSData* _Nullable)end seekKey:(NSData* _Nullable)seekKey limit:(long)limit reverse:(BOOL)reverse error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)set:(NSData* _Nullable)key value:(NSData* _Nullable)value error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)setSync:(NSData* _Nullable)key value:(NSData* _Nullable)value error:(NSError* _Nullable* _Nullable)error;
+@end
+
 @protocol GnoGnonativePromiseBlock <NSObject>
 - (void)callReject:(NSError* _Nullable)error;
 - (void)callResolve:(NSString* _Nullable)reply;
@@ -53,6 +65,7 @@
 
 - (nonnull instancetype)initWithRef:(_Nonnull id)ref;
 - (nullable instancetype)init;
+@property (nonatomic) id<GnoGnonativeNativeDB> _Nullable nativeDB;
 @property (nonatomic) NSString* _Nonnull rootDir;
 @property (nonatomic) NSString* _Nonnull tmpDir;
 @property (nonatomic) BOOL useTcpListener;
@@ -66,10 +79,29 @@ FOUNDATION_EXPORT GnoGnonativeBridgeConfig* _Nullable GnoGnonativeNewBridgeConfi
 // skipped function NewServiceClient with unsupported parameter or return types
 
 
+@class GnoGnonativeNativeDB;
+
 @class GnoGnonativePromiseBlock;
 
 @class GnoGnonativeServiceClient;
 
+/**
+ * NativeDB is implemented in the native (Kotlin/Swift) layer.
+ */
+@interface GnoGnonativeNativeDB : NSObject <goSeqRefInterface, GnoGnonativeNativeDB> {
+}
+@property(strong, readonly) _Nonnull id _ref;
+
+- (nonnull instancetype)initWithRef:(_Nonnull id)ref;
+- (BOOL)delete:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)deleteSync:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (NSData* _Nullable)get:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)has:(NSData* _Nullable)key ret0_:(BOOL* _Nullable)ret0_ error:(NSError* _Nullable* _Nullable)error;
+- (NSData* _Nullable)scanChunk:(NSData* _Nullable)start end:(NSData* _Nullable)end seekKey:(NSData* _Nullable)seekKey limit:(long)limit reverse:(BOOL)reverse error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)set:(NSData* _Nullable)key value:(NSData* _Nullable)value error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)setSync:(NSData* _Nullable)key value:(NSData* _Nullable)value error:(NSError* _Nullable* _Nullable)error;
+@end
+
 @interface GnoGnonativePromiseBlock : NSObject <goSeqRefInterface, GnoGnonativePromiseBlock> {
 }
 @property(strong, readonly) _Nonnull id _ref;

package/ios/Frameworks/GnoCore.xcframework/ios-arm64/GnoCore.framework/Versions/A/Headers/GnoGnonative.objc.h

@@ -13,11 +13,23 @@
 
 @class GnoGnonativeBridge;
 @class GnoGnonativeBridgeConfig;
+@protocol GnoGnonativeNativeDB;
+@class GnoGnonativeNativeDB;
 @protocol GnoGnonativePromiseBlock;
 @class GnoGnonativePromiseBlock;
 @protocol GnoGnonativeServiceClient;
 @class GnoGnonativeServiceClient;
 
+@protocol GnoGnonativeNativeDB <NSObject>
+- (BOOL)delete:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)deleteSync:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (NSData* _Nullable)get:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)has:(NSData* _Nullable)key ret0_:(BOOL* _Nullable)ret0_ error:(NSError* _Nullable* _Nullable)error;
+- (NSData* _Nullable)scanChunk:(NSData* _Nullable)start end:(NSData* _Nullable)end seekKey:(NSData* _Nullable)seekKey limit:(long)limit reverse:(BOOL)reverse error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)set:(NSData* _Nullable)key value:(NSData* _Nullable)value error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)setSync:(NSData* _Nullable)key value:(NSData* _Nullable)value error:(NSError* _Nullable* _Nullable)error;
+@end
+
 @protocol GnoGnonativePromiseBlock <NSObject>
 - (void)callReject:(NSError* _Nullable)error;
 - (void)callResolve:(NSString* _Nullable)reply;
@@ -53,6 +65,7 @@
 
 - (nonnull instancetype)initWithRef:(_Nonnull id)ref;
 - (nullable instancetype)init;
+@property (nonatomic) id<GnoGnonativeNativeDB> _Nullable nativeDB;
 @property (nonatomic) NSString* _Nonnull rootDir;
 @property (nonatomic) NSString* _Nonnull tmpDir;
 @property (nonatomic) BOOL useTcpListener;
@@ -66,10 +79,29 @@ FOUNDATION_EXPORT GnoGnonativeBridgeConfig* _Nullable GnoGnonativeNewBridgeConfi
 // skipped function NewServiceClient with unsupported parameter or return types
 
 
+@class GnoGnonativeNativeDB;
+
 @class GnoGnonativePromiseBlock;
 
 @class GnoGnonativeServiceClient;
 
+/**
+ * NativeDB is implemented in the native (Kotlin/Swift) layer.
+ */
+@interface GnoGnonativeNativeDB : NSObject <goSeqRefInterface, GnoGnonativeNativeDB> {
+}
+@property(strong, readonly) _Nonnull id _ref;
+
+- (nonnull instancetype)initWithRef:(_Nonnull id)ref;
+- (BOOL)delete:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)deleteSync:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (NSData* _Nullable)get:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)has:(NSData* _Nullable)key ret0_:(BOOL* _Nullable)ret0_ error:(NSError* _Nullable* _Nullable)error;
+- (NSData* _Nullable)scanChunk:(NSData* _Nullable)start end:(NSData* _Nullable)end seekKey:(NSData* _Nullable)seekKey limit:(long)limit reverse:(BOOL)reverse error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)set:(NSData* _Nullable)key value:(NSData* _Nullable)value error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)setSync:(NSData* _Nullable)key value:(NSData* _Nullable)value error:(NSError* _Nullable* _Nullable)error;
+@end
+
 @interface GnoGnonativePromiseBlock : NSObject <goSeqRefInterface, GnoGnonativePromiseBlock> {
 }
 @property(strong, readonly) _Nonnull id _ref;

package/ios/Frameworks/GnoCore.xcframework/ios-arm64/GnoCore.framework/Versions/Current/Headers/GnoGnonative.objc.h

@@ -13,11 +13,23 @@
 
 @class GnoGnonativeBridge;
 @class GnoGnonativeBridgeConfig;
+@protocol GnoGnonativeNativeDB;
+@class GnoGnonativeNativeDB;
 @protocol GnoGnonativePromiseBlock;
 @class GnoGnonativePromiseBlock;
 @protocol GnoGnonativeServiceClient;
 @class GnoGnonativeServiceClient;
 
+@protocol GnoGnonativeNativeDB <NSObject>
+- (BOOL)delete:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)deleteSync:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (NSData* _Nullable)get:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)has:(NSData* _Nullable)key ret0_:(BOOL* _Nullable)ret0_ error:(NSError* _Nullable* _Nullable)error;
+- (NSData* _Nullable)scanChunk:(NSData* _Nullable)start end:(NSData* _Nullable)end seekKey:(NSData* _Nullable)seekKey limit:(long)limit reverse:(BOOL)reverse error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)set:(NSData* _Nullable)key value:(NSData* _Nullable)value error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)setSync:(NSData* _Nullable)key value:(NSData* _Nullable)value error:(NSError* _Nullable* _Nullable)error;
+@end
+
 @protocol GnoGnonativePromiseBlock <NSObject>
 - (void)callReject:(NSError* _Nullable)error;
 - (void)callResolve:(NSString* _Nullable)reply;
@@ -53,6 +65,7 @@
 
 - (nonnull instancetype)initWithRef:(_Nonnull id)ref;
 - (nullable instancetype)init;
+@property (nonatomic) id<GnoGnonativeNativeDB> _Nullable nativeDB;
 @property (nonatomic) NSString* _Nonnull rootDir;
 @property (nonatomic) NSString* _Nonnull tmpDir;
 @property (nonatomic) BOOL useTcpListener;
@@ -66,10 +79,29 @@ FOUNDATION_EXPORT GnoGnonativeBridgeConfig* _Nullable GnoGnonativeNewBridgeConfi
 // skipped function NewServiceClient with unsupported parameter or return types
 
 
+@class GnoGnonativeNativeDB;
+
 @class GnoGnonativePromiseBlock;
 
 @class GnoGnonativeServiceClient;
 
+/**
+ * NativeDB is implemented in the native (Kotlin/Swift) layer.
+ */
+@interface GnoGnonativeNativeDB : NSObject <goSeqRefInterface, GnoGnonativeNativeDB> {
+}
+@property(strong, readonly) _Nonnull id _ref;
+
+- (nonnull instancetype)initWithRef:(_Nonnull id)ref;
+- (BOOL)delete:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)deleteSync:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (NSData* _Nullable)get:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)has:(NSData* _Nullable)key ret0_:(BOOL* _Nullable)ret0_ error:(NSError* _Nullable* _Nullable)error;
+- (NSData* _Nullable)scanChunk:(NSData* _Nullable)start end:(NSData* _Nullable)end seekKey:(NSData* _Nullable)seekKey limit:(long)limit reverse:(BOOL)reverse error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)set:(NSData* _Nullable)key value:(NSData* _Nullable)value error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)setSync:(NSData* _Nullable)key value:(NSData* _Nullable)value error:(NSError* _Nullable* _Nullable)error;
+@end
+
 @interface GnoGnonativePromiseBlock : NSObject <goSeqRefInterface, GnoGnonativePromiseBlock> {
 }
 @property(strong, readonly) _Nonnull id _ref;

package/ios/Frameworks/GnoCore.xcframework/ios-arm64_x86_64-simulator/GnoCore.framework/Headers/GnoGnonative.objc.h

@@ -13,11 +13,23 @@
 
 @class GnoGnonativeBridge;
 @class GnoGnonativeBridgeConfig;
+@protocol GnoGnonativeNativeDB;
+@class GnoGnonativeNativeDB;
 @protocol GnoGnonativePromiseBlock;
 @class GnoGnonativePromiseBlock;
 @protocol GnoGnonativeServiceClient;
 @class GnoGnonativeServiceClient;
 
+@protocol GnoGnonativeNativeDB <NSObject>
+- (BOOL)delete:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)deleteSync:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (NSData* _Nullable)get:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)has:(NSData* _Nullable)key ret0_:(BOOL* _Nullable)ret0_ error:(NSError* _Nullable* _Nullable)error;
+- (NSData* _Nullable)scanChunk:(NSData* _Nullable)start end:(NSData* _Nullable)end seekKey:(NSData* _Nullable)seekKey limit:(long)limit reverse:(BOOL)reverse error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)set:(NSData* _Nullable)key value:(NSData* _Nullable)value error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)setSync:(NSData* _Nullable)key value:(NSData* _Nullable)value error:(NSError* _Nullable* _Nullable)error;
+@end
+
 @protocol GnoGnonativePromiseBlock <NSObject>
 - (void)callReject:(NSError* _Nullable)error;
 - (void)callResolve:(NSString* _Nullable)reply;
@@ -53,6 +65,7 @@
 
 - (nonnull instancetype)initWithRef:(_Nonnull id)ref;
 - (nullable instancetype)init;
+@property (nonatomic) id<GnoGnonativeNativeDB> _Nullable nativeDB;
 @property (nonatomic) NSString* _Nonnull rootDir;
 @property (nonatomic) NSString* _Nonnull tmpDir;
 @property (nonatomic) BOOL useTcpListener;
@@ -66,10 +79,29 @@ FOUNDATION_EXPORT GnoGnonativeBridgeConfig* _Nullable GnoGnonativeNewBridgeConfi
 // skipped function NewServiceClient with unsupported parameter or return types
 
 
+@class GnoGnonativeNativeDB;
+
 @class GnoGnonativePromiseBlock;
 
 @class GnoGnonativeServiceClient;
 
+/**
+ * NativeDB is implemented in the native (Kotlin/Swift) layer.
+ */
+@interface GnoGnonativeNativeDB : NSObject <goSeqRefInterface, GnoGnonativeNativeDB> {
+}
+@property(strong, readonly) _Nonnull id _ref;
+
+- (nonnull instancetype)initWithRef:(_Nonnull id)ref;
+- (BOOL)delete:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)deleteSync:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (NSData* _Nullable)get:(NSData* _Nullable)key error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)has:(NSData* _Nullable)key ret0_:(BOOL* _Nullable)ret0_ error:(NSError* _Nullable* _Nullable)error;
+- (NSData* _Nullable)scanChunk:(NSData* _Nullable)start end:(NSData* _Nullable)end seekKey:(NSData* _Nullable)seekKey limit:(long)limit reverse:(BOOL)reverse error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)set:(NSData* _Nullable)key value:(NSData* _Nullable)value error:(NSError* _Nullable* _Nullable)error;
+- (BOOL)setSync:(NSData* _Nullable)key value:(NSData* _Nullable)value error:(NSError* _Nullable* _Nullable)error;
+@end
+
 @interface GnoGnonativePromiseBlock : NSObject <goSeqRefInterface, GnoGnonativePromiseBlock> {
 }
 @property(strong, readonly) _Nonnull id _ref;

package/ios/GnonativeModule.swift

@@ -60,6 +60,7 @@ public class GnonativeModule: Module {
         }
         config.rootDir = self.appRootDir!
         config.tmpDir = self.tmpDir!
+        config.nativeDB = NativeDBManager.shared
         
         // On simulator we can't create an UDS, see comment below
 #if targetEnvironment(simulator)

package/ios/NativeDBManager.swift

@@ -0,0 +1,317 @@
+//
+//  NativeDBManager.swift
+//  Pods
+//
+//  Created by Rémi BARBERO on 25/09/2025.
+//
+
+import Foundation
+import Security
+import GnoCore
+
+public class NativeDBManager: NSObject, GnoGnonativeNativeDBProtocol {
+    public static var shared: NativeDBManager = NativeDBManager()
+    
+    // MARK: - Private Properties
+    private let service: String
+    private let accessGroup: String?
+    
+    // MARK: - Initialization
+    init(service: String = Bundle.main.bundleIdentifier ?? "GnoNativeService", accessGroup: String? = nil) {
+        self.service = service
+        self.accessGroup = accessGroup
+    }
+    
+    // MARK: - Public Interface Implementation
+    
+    public func get(_ key: Data?) throws -> Data {
+        guard let key = key, !key.isEmpty else {
+            throw NativeDBError.invalidArgument(description: "Key must not be nil or empty.")
+        }
+        let account = keyToAccount(key)
+        
+        var query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: account,
+            kSecReturnData as String: true,
+            kSecMatchLimit as String: kSecMatchLimitOne
+        ]
+        
+        if let accessGroup = accessGroup {
+            query[kSecAttrAccessGroup as String] = accessGroup
+        }
+        
+        var result: AnyObject?
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        
+        switch status {
+        case errSecSuccess:
+            return (result as? Data) ?? Data()
+        case errSecItemNotFound:
+            // This is not an error; it's the expected result for a missing key.
+            return Data()
+        default:
+            throw NativeDBError.keychainError(status: status, message: "Failed to get item.")
+        }
+    }
+    
+    public func delete(_ key: Data?) throws {
+        try self.deleteSync(key)
+    }
+    
+    public func deleteSync(_ key: Data?) throws {
+        guard let key = key, !key.isEmpty else {
+            throw NativeDBError.invalidArgument(description: "Key must not be nil or empty.")
+        }
+        
+        let account = keyToAccount(key)
+        
+        var query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: account
+        ]
+        
+        if let accessGroup = accessGroup {
+            query[kSecAttrAccessGroup as String] = accessGroup
+        }
+        
+        let status = SecItemDelete(query as CFDictionary)
+        
+        // Deleting a non-existent item is not considered an error.
+        if status != errSecSuccess && status != errSecItemNotFound {
+            throw NativeDBError.keychainError(status: status, message: "Failed to delete item.")
+        }
+    }
+    
+    public func has(_ key: Data?, ret0_ returnPointer: UnsafeMutablePointer<ObjCBool>?) throws {
+        // 1. Ensure the return pointer provided by the caller is valid.
+        guard let returnPointer = returnPointer else {
+            throw NativeDBError.invalidArgument(description: "Return pointer must not be nil.")
+        }
+        
+        // 2. Validate the input key.
+        guard let key = key, !key.isEmpty else {
+            throw NativeDBError.invalidArgument(description: "Key must not be nil or empty.")
+        }
+        
+        let account = keyToAccount(key)
+        
+        var query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: account
+        ]
+        if let accessGroup = accessGroup {
+            query[kSecAttrAccessGroup as String] = accessGroup
+        }
+        
+        let status = SecItemCopyMatching(query as CFDictionary, nil)
+        
+        // 3. Handle the result from the Keychain.
+        switch status {
+        case errSecSuccess:
+            // Key exists. Write `true` to the pointer's memory location.
+            returnPointer.pointee = ObjCBool(true)
+        case errSecItemNotFound:
+            // Key does not exist. Write `false` to the pointer's memory location.
+            returnPointer.pointee = ObjCBool(false)
+        default:
+            // A real keychain error occurred. Throw an error.
+            throw NativeDBError.keychainError(status: status, message: "Failed to check for item existence.")
+        }
+    }
+    
+    public func set(_ key: Data?, value: Data?) throws {
+        try self.setSync(key, value: value)
+    }
+    
+    public func setSync(_ key: Data?, value: Data?) throws {
+        guard let key = key, !key.isEmpty else {
+            throw NativeDBError.invalidArgument(description: "Key must not be nil or empty.")
+        }
+        guard let value = value else {
+            throw NativeDBError.invalidArgument(description: "Value must not be nil.")
+        }
+        
+        let account = keyToAccount(key)
+        
+        // First, try to update existing item
+        var query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: account
+        ]
+        
+        if let accessGroup = accessGroup {
+            query[kSecAttrAccessGroup as String] = accessGroup
+        }
+        
+        let attributes: [String: Any] = [
+            kSecValueData as String: value
+        ]
+        
+        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
+        
+        switch updateStatus {
+        case errSecSuccess:
+            // Update was successful.
+            return
+        case errSecItemNotFound:
+            // Item doesn't exist, so add it.
+            var newItem = query
+            newItem[kSecValueData as String] = value
+            newItem[kSecAttrAccessible as String] = kSecAttrAccessibleWhenUnlockedThisDeviceOnly
+            
+            let addStatus = SecItemAdd(newItem as CFDictionary, nil)
+            if addStatus != errSecSuccess {
+                throw NativeDBError.keychainError(status: addStatus, message: "Failed to add new item.")
+            }
+        default:
+            // Another error occurred during update.
+            throw NativeDBError.keychainError(status: updateStatus, message: "Failed to update item.")
+        }
+    }
+    
+    public func scanChunk(_ start: Data?, end: Data?, seekKey: Data?, limit: Int, reverse: Bool) throws -> Data {
+        // 1) fetch all items for this service
+        var query: [String: Any] = [
+            kSecClass as String:             kSecClassGenericPassword,
+            kSecAttrService as String:       service,
+            kSecMatchLimit as String:        kSecMatchLimitAll,
+            kSecReturnAttributes as String:  true,
+            kSecReturnData as String:        true,
+        ]
+        
+        if let accessGroup = accessGroup {
+            query[kSecAttrAccessGroup as String] = accessGroup
+        }
+        var result: CFTypeRef?
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        
+        var pairs: [(key: Data, val: Data)] = []
+        if status == errSecSuccess, let items = result as? [[String: Any]] {
+            for item in items {
+                guard let account = item[kSecAttrAccount as String] as? String,
+                      let keyBytes = accountToKey(account),
+                      let val  = item[kSecValueData as String] as? Data else { continue }
+                if inRange(keyBytes, start: start, end: end) {
+                    pairs.append((keyBytes, val))
+                }
+            }
+        }
+        
+        // 2) sort
+        if reverse {
+            pairs.sort { a, b in
+                // descending: a > b
+                return lt(b.key, a.key)
+            }
+        } else {
+            pairs.sort { a, b in
+                // ascending: a < b
+                return lt(a.key, b.key)
+            }
+        }
+        
+        // 3) apply seekKey (exclusive)
+        if let sk = seekKey, !sk.isEmpty {
+            if reverse {
+                // keep items with key < seekKey
+                let idx = pairs.firstIndex(where: { lt($0.key, sk) }) ?? pairs.count
+                // pairs are descending, so drop while key >= seekKey
+                pairs = Array(pairs[idx...])
+            } else {
+                // keep items with key > seekKey
+                let idx = pairs.lastIndex(where: { lte($0.key, sk) }) ?? -1
+                let startIdx = idx + 1
+                pairs = (startIdx < pairs.count) ? Array(pairs[startIdx...]) : []
+            }
+        }
+        
+        // 4) limit
+        let lim = max(0, Int(limit))
+        let chunk = (lim > 0 && lim < pairs.count) ? Array(pairs.prefix(lim)) : pairs
+        let hasMore = chunk.count < pairs.count
+        let nextSeek = chunk.last?.key ?? Data()
+        
+        // 6) Frame the blob
+        var blob = Data(capacity: 1 + 4) // will grow as needed
+        var flags: UInt8 = 0
+        if hasMore { flags |= 0x01 }
+        blob.append(&flags, count: 1)
+        
+        var countBE = UInt32(chunk.count).bigEndian
+        withUnsafeBytes(of: &countBE) { blob.append($0.bindMemory(to: UInt8.self)) }
+        
+        for (k, v) in chunk {
+            var klen = UInt32(k.count).bigEndian
+            var vlen = UInt32(v.count).bigEndian
+            withUnsafeBytes(of: &klen) { blob.append($0.bindMemory(to: UInt8.self)) }
+            blob.append(k)
+            withUnsafeBytes(of: &vlen) { blob.append($0.bindMemory(to: UInt8.self)) }
+            blob.append(v)
+        }
+        
+        var nlen = UInt32(nextSeek.count).bigEndian
+        withUnsafeBytes(of: &nlen) { blob.append($0.bindMemory(to: UInt8.self)) }
+        blob.append(nextSeek)
+        
+        return blob
+    }
+    
+    // MARK: - Utility Methods
+    
+    private func keyToAccount(_ key: Data) -> String {
+        return String(data: key, encoding: .utf8) ?? key.base64EncodedString()
+    }
+    
+    private func accountToKey(_ account: String) -> Data? {
+        // Try UTF-8 first
+        if let utf8Data = account.data(using: .utf8) {
+            // Check if this was originally a base64 string by trying to decode it
+            if let base64Data = Data(base64Encoded: account), base64Data != utf8Data {
+                // This account was base64 encoded, return the decoded data
+                return base64Data
+            } else {
+                // This was a UTF-8 string, return the UTF-8 data
+                return utf8Data
+            }
+        }
+        
+        // Fallback: try base64 decoding
+        return Data(base64Encoded: account)
+    }
+    
+    // --- byte-wise comparisons on decoded keys ---
+    @inline(__always)
+    private func lt(_ a: Data, _ b: Data) -> Bool {
+        a.lexicographicallyPrecedes(b)
+    }
+    @inline(__always)
+    private func gte(_ a: Data, _ b: Data) -> Bool { !lt(a, b) }
+    @inline(__always)
+    private func lte(_ a: Data, _ b: Data) -> Bool { !lt(b, a) }
+    @inline(__always)
+    private func inRange(_ k: Data, start: Data?, end: Data?) -> Bool {
+        if let s = start, lt(k, s) { return false }    // k >= s
+        if let e = end, !lt(k, e) { return false }     // k < e
+        return true
+    }
+}
+
+public enum NativeDBError: Error, LocalizedError {
+    case invalidArgument(description: String)
+    case keychainError(status: OSStatus, message: String)
+    
+    public var errorDescription: String? {
+        switch self {
+        case .invalidArgument(let description):
+            return "Invalid Argument: \(description)"
+        case .keychainError(let status, let message):
+            let statusMessage = SecCopyErrorMessageString(status, nil) as String? ?? "Unknown error"
+            return "Keychain Error: \(message) (status: \(status), reason: \(statusMessage))"
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gnolang/gnonative",
-  "version": "4.7.1",
+  "version": "4.7.3",
   "description": "Develop for Gno using your app's native language ",
   "main": "build/index.js",
   "types": "build/index.d.ts",