@necessarysdk/react-native 0.0.0-stage → 0.1.5

package/lib/errors.d.ts

@@ -0,0 +1,43 @@
+/** The failures the SDK reports. */
+/**
+ * A failure of the phone's keystore or of a prompt: [code] says which -- `KEY_UNAVAILABLE` (the
+ * keystore could not be reached for the installation key; no key was made over it: try again, or
+ * reset()), `STEPUP_KEY_INVALIDATED` (the key can never sign again: re-enrol),
+ * `STEPUP_KEY_UNAVAILABLE` (the keystore could not say whether the key is usable, or could not be
+ * reached; it was kept: try again, or re-enrol), `STEPUP_CANCELLED`, `STEPUP_REENROL_PENDING` and
+ * the like -- and [message] says it in words, followed by everything that failed beneath it
+ * (`[cause: ...]`) down to the keystore's own answer wherever the phone gives one.
+ */
+export declare class NativeKeyException extends Error {
+    /** What failed, for the app to act on. */
+    readonly code: string;
+    constructor(code: string, message: string);
+    toString(): string;
+}
+/**
+ * A refusal from your backend, or a request that did not reach it: the backend's
+ * `{"error": {"code", "message", "details"}}` (the guide, section 4), with the HTTP status.
+ */
+export declare class ApiException extends Error {
+    /** The HTTP status, when the backend answered. */
+    readonly statusCode?: number;
+    /** The backend's `code`: what the app acts on. */
+    readonly code?: string;
+    /** The backend's `details`, such as `retry_after_seconds`. */
+    readonly details?: Record<string, unknown>;
+    constructor(message: string, options?: {
+        statusCode?: number;
+        code?: string;
+        details?: Record<string, unknown>;
+    });
+    toString(): string;
+}
+/**
+ * A call that DeviceTrust.reset or DeviceTrust.close ended while it ran: what it found belongs to
+ * an installation that is gone, or to a client that is closed, so nothing of it was kept. After a
+ * reset, call again.
+ */
+export declare class InterruptedCallException extends Error {
+    constructor(message: string);
+    toString(): string;
+}

package/lib/errors.js

@@ -0,0 +1,56 @@
+"use strict";
+/** The failures the SDK reports. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InterruptedCallException = exports.ApiException = exports.NativeKeyException = void 0;
+/**
+ * A failure of the phone's keystore or of a prompt: [code] says which -- `KEY_UNAVAILABLE` (the
+ * keystore could not be reached for the installation key; no key was made over it: try again, or
+ * reset()), `STEPUP_KEY_INVALIDATED` (the key can never sign again: re-enrol),
+ * `STEPUP_KEY_UNAVAILABLE` (the keystore could not say whether the key is usable, or could not be
+ * reached; it was kept: try again, or re-enrol), `STEPUP_CANCELLED`, `STEPUP_REENROL_PENDING` and
+ * the like -- and [message] says it in words, followed by everything that failed beneath it
+ * (`[cause: ...]`) down to the keystore's own answer wherever the phone gives one.
+ */
+class NativeKeyException extends Error {
+    constructor(code, message) {
+        super(message);
+        this.name = 'NativeKeyException';
+        this.code = code;
+    }
+    toString() {
+        return `${this.message} [${this.code}]`;
+    }
+}
+exports.NativeKeyException = NativeKeyException;
+/**
+ * A refusal from your backend, or a request that did not reach it: the backend's
+ * `{"error": {"code", "message", "details"}}` (the guide, section 4), with the HTTP status.
+ */
+class ApiException extends Error {
+    constructor(message, options = {}) {
+        super(message);
+        this.name = 'ApiException';
+        this.statusCode = options.statusCode;
+        this.code = options.code;
+        this.details = options.details;
+    }
+    toString() {
+        return this.message;
+    }
+}
+exports.ApiException = ApiException;
+/**
+ * A call that DeviceTrust.reset or DeviceTrust.close ended while it ran: what it found belongs to
+ * an installation that is gone, or to a client that is closed, so nothing of it was kept. After a
+ * reset, call again.
+ */
+class InterruptedCallException extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'InterruptedCallException';
+    }
+    toString() {
+        return this.message;
+    }
+}
+exports.InterruptedCallException = InterruptedCallException;

package/lib/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Device integrity for React Native apps: the client half of the public integration guide. A key
+ * the SDK never exports, signed measurements of the phone and the app, and request proofs; the
+ * app's backend decides what they mean.
+ */
+export * from './client';
+export * from './collector';
+export * from './deviceTrust';
+export * from './errors';
+export * from './installationKey';
+export * from './installationStore';
+export * from './protocol';
+export * from './reinstallHint';
+export * from './report';
+export * from './requestProof';
+export * from './secureScreen';
+export * from './stepUpKey';
+export * from './transport';

package/lib/index.js

@@ -0,0 +1,34 @@
+"use strict";
+/**
+ * Device integrity for React Native apps: the client half of the public integration guide. A key
+ * the SDK never exports, signed measurements of the phone and the app, and request proofs; the
+ * app's backend decides what they mean.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./client"), exports);
+__exportStar(require("./collector"), exports);
+__exportStar(require("./deviceTrust"), exports);
+__exportStar(require("./errors"), exports);
+__exportStar(require("./installationKey"), exports);
+__exportStar(require("./installationStore"), exports);
+__exportStar(require("./protocol"), exports);
+__exportStar(require("./reinstallHint"), exports);
+__exportStar(require("./report"), exports);
+__exportStar(require("./requestProof"), exports);
+__exportStar(require("./secureScreen"), exports);
+__exportStar(require("./stepUpKey"), exports);
+__exportStar(require("./transport"), exports);

package/lib/installationKey.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The installation key: one non-exportable P-256 key per installation, made and held by the
+ * phone's keystore -- StrongBox or the trusted execution environment, the Secure Enclave, or
+ * where that refuses the Keychain.
+ */
+/** A P-256 public key as a JWK: `kty`, `crv`, `alg`, `x`, `y`. */
+export type PublicJwk = Record<string, unknown>;
+/** The members of [jwk] in the order the phone writes them: kty, crv, alg, x, y, then any other. */
+export declare function orderedJwk(jwk: Record<string, unknown>): PublicJwk;
+/** RFC 7638 thumbprint of an EC public JWK, in lowercase hex: the same form a backend derives. */
+export declare function jwkThumbprint(jwk: PublicJwk): string;
+export declare class NativeKeyMetadata {
+    readonly publicKey: PublicJwk;
+    readonly algorithm: string;
+    readonly keyAlias: string;
+    readonly provider: string;
+    readonly securityLevel: string;
+    readonly hardwareBacked: boolean;
+    readonly privateKeyExportable: boolean;
+    readonly signatureFormat: string;
+    readonly created: boolean;
+    constructor(value: {
+        publicKey: PublicJwk;
+        algorithm: string;
+        keyAlias: string;
+        provider: string;
+        securityLevel: string;
+        hardwareBacked: boolean;
+        privateKeyExportable: boolean;
+        signatureFormat: string;
+        created: boolean;
+    });
+    static fromPlatform(value: Record<string, unknown>): NativeKeyMetadata;
+}
+export declare class NativeInstallationKey {
+    getOrCreateKey(): Promise<NativeKeyMetadata>;
+    signPayload(payloadBase64Url: string): Promise<string>;
+    deleteKey(): Promise<void>;
+}
+export declare class InstallationIdentity {
+    readonly installationId: string;
+    readonly nativeKey: NativeInstallationKey;
+    readonly metadata: NativeKeyMetadata;
+    constructor(value: {
+        installationId: string;
+        nativeKey: NativeInstallationKey;
+        metadata: NativeKeyMetadata;
+    });
+    get publicKeyJson(): PublicJwk;
+    get algorithm(): string;
+    get keyAlias(): string;
+    get provider(): string;
+    get securityLevel(): string;
+    get hardwareBacked(): boolean;
+    get privateKeyExportable(): boolean;
+    get signatureFormat(): string;
+    get createdThisLaunch(): boolean;
+    /** The key's RFC 7638 thumbprint, in lowercase hex. */
+    get keyThumbprint(): string;
+    signPayload(payloadBase64Url: string): Promise<string>;
+    withInstallationId(canonicalInstallationId: string): InstallationIdentity;
+}

package/lib/installationKey.js

@@ -0,0 +1,185 @@
+"use strict";
+/**
+ * The installation key: one non-exportable P-256 key per installation, made and held by the
+ * phone's keystore -- StrongBox or the trusted execution environment, the Secure Enclave, or
+ * where that refuses the Keychain.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstallationIdentity = exports.NativeInstallationKey = exports.NativeKeyMetadata = void 0;
+exports.orderedJwk = orderedJwk;
+exports.jwkThumbprint = jwkThumbprint;
+const errors_1 = require("./errors");
+const bytes_1 = require("./util/bytes");
+const native_1 = require("./util/native");
+/** The members of [jwk] in the order the phone writes them: kty, crv, alg, x, y, then any other. */
+function orderedJwk(jwk) {
+    const ordered = {};
+    for (const name of ['kty', 'crv', 'alg', 'x', 'y']) {
+        if (name in jwk) {
+            ordered[name] = jwk[name];
+        }
+    }
+    for (const [name, value] of Object.entries(jwk)) {
+        if (!(name in ordered)) {
+            ordered[name] = value;
+        }
+    }
+    return ordered;
+}
+/** RFC 7638 thumbprint of an EC public JWK, in lowercase hex: the same form a backend derives. */
+function jwkThumbprint(jwk) {
+    // RFC 7638 canonical member order for an EC public JWK.
+    return (0, bytes_1.sha256Hex)(JSON.stringify({ crv: jwk['crv'], kty: 'EC', x: jwk['x'], y: jwk['y'] }));
+}
+class NativeKeyMetadata {
+    constructor(value) {
+        this.publicKey = value.publicKey;
+        this.algorithm = value.algorithm;
+        this.keyAlias = value.keyAlias;
+        this.provider = value.provider;
+        this.securityLevel = value.securityLevel;
+        this.hardwareBacked = value.hardwareBacked;
+        this.privateKeyExportable = value.privateKeyExportable;
+        this.signatureFormat = value.signatureFormat;
+        this.created = value.created;
+    }
+    static fromPlatform(value) {
+        const rawPublicKey = value['public_key'];
+        if (!(0, native_1.isObject)(rawPublicKey)) {
+            throw new TypeError('The native key provider returned no public key.');
+        }
+        const publicKey = orderedJwk(rawPublicKey);
+        const requiredString = (field) => {
+            const item = value[field];
+            if (typeof item !== 'string' || item.length === 0) {
+                throw new TypeError(`The native key provider returned an invalid ${field}.`);
+            }
+            return item;
+        };
+        const requiredBool = (field) => {
+            const item = value[field];
+            if (typeof item !== 'boolean') {
+                throw new TypeError(`The native key provider returned an invalid ${field}.`);
+            }
+            return item;
+        };
+        if (publicKey['kty'] !== 'EC' ||
+            publicKey['crv'] !== 'P-256' ||
+            publicKey['alg'] !== 'ES256' ||
+            typeof publicKey['x'] !== 'string' ||
+            typeof publicKey['y'] !== 'string') {
+            throw new TypeError('The native key provider did not return an EC P-256 public JWK.');
+        }
+        return new NativeKeyMetadata({
+            publicKey,
+            algorithm: requiredString('algorithm'),
+            keyAlias: requiredString('key_alias'),
+            provider: requiredString('provider'),
+            securityLevel: requiredString('security_level'),
+            hardwareBacked: requiredBool('hardware_backed'),
+            privateKeyExportable: requiredBool('private_key_exportable'),
+            signatureFormat: requiredString('signature_format'),
+            created: requiredBool('created'),
+        });
+    }
+}
+exports.NativeKeyMetadata = NativeKeyMetadata;
+const KEY_MODULE_MISSING = new errors_1.NativeKeyException('NATIVE_KEY_PLUGIN_MISSING', "The SDK's installation-key module is not linked into this app: rebuild the app.");
+class NativeInstallationKey {
+    async getOrCreateKey() {
+        const native = (0, native_1.installationKeyModule)();
+        if (native === null) {
+            throw KEY_MODULE_MISSING;
+        }
+        let value;
+        try {
+            value = await native.getOrCreateKey();
+        }
+        catch (error) {
+            throw (0, native_1.nativeFailure)(error, 'The native key provider failed.');
+        }
+        if (!(0, native_1.isObject)(value)) {
+            throw new errors_1.NativeKeyException('EMPTY_NATIVE_RESPONSE', 'The native key provider returned no key metadata.');
+        }
+        return NativeKeyMetadata.fromPlatform(value);
+    }
+    async signPayload(payloadBase64Url) {
+        const native = (0, native_1.installationKeyModule)();
+        if (native === null) {
+            throw KEY_MODULE_MISSING;
+        }
+        let signature;
+        try {
+            signature = await native.sign(payloadBase64Url);
+        }
+        catch (error) {
+            throw (0, native_1.nativeFailure)(error, 'The native key provider could not sign the challenge.');
+        }
+        if (typeof signature !== 'string' || signature.length === 0) {
+            throw new errors_1.NativeKeyException('EMPTY_NATIVE_SIGNATURE', 'The native key provider returned no signature.');
+        }
+        return signature;
+    }
+    async deleteKey() {
+        const native = (0, native_1.installationKeyModule)();
+        if (native === null) {
+            throw KEY_MODULE_MISSING;
+        }
+        try {
+            await native.deleteKey();
+        }
+        catch (error) {
+            throw (0, native_1.nativeFailure)(error, 'The native installation key could not be deleted.');
+        }
+    }
+}
+exports.NativeInstallationKey = NativeInstallationKey;
+class InstallationIdentity {
+    constructor(value) {
+        this.installationId = value.installationId;
+        this.nativeKey = value.nativeKey;
+        this.metadata = value.metadata;
+    }
+    get publicKeyJson() {
+        return this.metadata.publicKey;
+    }
+    get algorithm() {
+        return this.metadata.algorithm;
+    }
+    get keyAlias() {
+        return this.metadata.keyAlias;
+    }
+    get provider() {
+        return this.metadata.provider;
+    }
+    get securityLevel() {
+        return this.metadata.securityLevel;
+    }
+    get hardwareBacked() {
+        return this.metadata.hardwareBacked;
+    }
+    get privateKeyExportable() {
+        return this.metadata.privateKeyExportable;
+    }
+    get signatureFormat() {
+        return this.metadata.signatureFormat;
+    }
+    get createdThisLaunch() {
+        return this.metadata.created;
+    }
+    /** The key's RFC 7638 thumbprint, in lowercase hex. */
+    get keyThumbprint() {
+        return jwkThumbprint(this.publicKeyJson);
+    }
+    signPayload(payloadBase64Url) {
+        return this.nativeKey.signPayload(payloadBase64Url);
+    }
+    withInstallationId(canonicalInstallationId) {
+        return new InstallationIdentity({
+            installationId: canonicalInstallationId,
+            nativeKey: this.nativeKey,
+            metadata: this.metadata,
+        });
+    }
+}
+exports.InstallationIdentity = InstallationIdentity;

package/lib/installationStore.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Where the SDK keeps the installation ID: in the platform's secure storage beside the key -- on
+ * iOS in the Keychain, on this device only, readable after the first unlock; elsewhere encrypted
+ * under a key the platform keystore holds.
+ */
+import { InstallationIdentity, NativeInstallationKey } from './installationKey';
+/** The secure storage the store writes to: replaced in tests. */
+export interface SecureStorage {
+    read(key: string): Promise<string | null>;
+    write(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+/** The phone's secure storage, through the SDK's native module. */
+export declare class NativeSecureStorage implements SecureStorage {
+    read(key: string): Promise<string | null>;
+    write(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+/** A random (version 4) UUID, from the platform's secure random source. */
+export declare function randomUuid(): Promise<string>;
+export declare class InstallationStore {
+    static readonly installationIdKey = "recognition.installation_id.v2";
+    static readonly stepUpReenrolKey = "recognition.stepup_reenrol_pending.v1";
+    readonly key: NativeInstallationKey;
+    protected readonly storage: SecureStorage;
+    private loading;
+    constructor(options?: {
+        key?: NativeInstallationKey;
+        storage?: SecureStorage;
+    });
+    /**
+     * The installation: its key, made on first use, and its ID. A key made now
+     * ([InstallationIdentity.createdThisLaunch]) is a new installation, so it gets a new ID even where
+     * one was stored: that ID belongs to the key that was lost, and a backend refuses a known ID under
+     * another key. Calls at once share one load, so that one key never gets two IDs.
+     */
+    loadOrCreate(): Promise<InstallationIdentity>;
+    private load;
+    /**
+     * Keeps the installation your backend answered for this key, which may not be the ID proposed.
+     * Only this opaque ID is stored here; the private key never leaves the platform's keystore.
+     */
+    saveInstallationId(installationId: string): Promise<void>;
+    /** Whether a step-up key was replaced and the backend has not yet taken the new one (DeviceTrust.reenrolStepUp) -- kept across restarts. */
+    stepUpReenrolPending(): Promise<boolean>;
+    setStepUpReenrolPending(pending: boolean): Promise<void>;
+    /** Deletes the key and the installation ID: the next start is a new installation. */
+    clear(): Promise<void>;
+}

package/lib/installationStore.js

@@ -0,0 +1,127 @@
+"use strict";
+/**
+ * Where the SDK keeps the installation ID: in the platform's secure storage beside the key -- on
+ * iOS in the Keychain, on this device only, readable after the first unlock; elsewhere encrypted
+ * under a key the platform keystore holds.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstallationStore = exports.NativeSecureStorage = void 0;
+exports.randomUuid = randomUuid;
+const errors_1 = require("./errors");
+const native_1 = require("./util/native");
+const requestProof_1 = require("./requestProof");
+const installationKey_1 = require("./installationKey");
+const STORAGE_MODULE_MISSING = () => new errors_1.NativeKeyException('NATIVE_STORAGE_PLUGIN_MISSING', "The SDK's storage module is not linked into this app: rebuild the app.");
+/** The phone's secure storage, through the SDK's native module. */
+class NativeSecureStorage {
+    async read(key) {
+        const native = (0, native_1.storageModule)();
+        if (native === null)
+            throw STORAGE_MODULE_MISSING();
+        try {
+            const value = await native.read(key);
+            return typeof value === 'string' ? value : null;
+        }
+        catch (error) {
+            throw (0, native_1.nativeFailure)(error, 'The secure storage could not be read.');
+        }
+    }
+    async write(key, value) {
+        const native = (0, native_1.storageModule)();
+        if (native === null)
+            throw STORAGE_MODULE_MISSING();
+        try {
+            await native.write(key, value);
+        }
+        catch (error) {
+            throw (0, native_1.nativeFailure)(error, 'The secure storage could not be written.');
+        }
+    }
+    async delete(key) {
+        const native = (0, native_1.storageModule)();
+        if (native === null)
+            throw STORAGE_MODULE_MISSING();
+        try {
+            await native.remove(key);
+        }
+        catch (error) {
+            throw (0, native_1.nativeFailure)(error, 'The secure storage could not be cleared.');
+        }
+    }
+}
+exports.NativeSecureStorage = NativeSecureStorage;
+/** A random (version 4) UUID, from the platform's secure random source. */
+async function randomUuid() {
+    const bytes = await (0, requestProof_1.secureRandomBytes)(16);
+    bytes[6] = (bytes[6] & 0x0f) | 0x40;
+    bytes[8] = (bytes[8] & 0x3f) | 0x80;
+    const hexBytes = Array.from(bytes, (byte) => (byte < 16 ? '0' : '') + byte.toString(16));
+    return [
+        hexBytes.slice(0, 4).join(''),
+        hexBytes.slice(4, 6).join(''),
+        hexBytes.slice(6, 8).join(''),
+        hexBytes.slice(8, 10).join(''),
+        hexBytes.slice(10, 16).join(''),
+    ].join('-');
+}
+class InstallationStore {
+    constructor(options = {}) {
+        this.loading = null;
+        this.key = options.key ?? new installationKey_1.NativeInstallationKey();
+        this.storage = options.storage ?? new NativeSecureStorage();
+    }
+    /**
+     * The installation: its key, made on first use, and its ID. A key made now
+     * ([InstallationIdentity.createdThisLaunch]) is a new installation, so it gets a new ID even where
+     * one was stored: that ID belongs to the key that was lost, and a backend refuses a known ID under
+     * another key. Calls at once share one load, so that one key never gets two IDs.
+     */
+    loadOrCreate() {
+        const running = this.loading;
+        if (running !== null) {
+            return running;
+        }
+        const loading = this.load().finally(() => {
+            if (this.loading === loading) {
+                this.loading = null;
+            }
+        });
+        this.loading = loading;
+        return loading;
+    }
+    async load() {
+        const stored = await this.storage.read(InstallationStore.installationIdKey);
+        const metadata = await this.key.getOrCreateKey();
+        let installationId = stored ?? '';
+        if (installationId.length === 0 || metadata.created) {
+            installationId = await randomUuid();
+            await this.saveInstallationId(installationId);
+        }
+        return new installationKey_1.InstallationIdentity({ installationId, nativeKey: this.key, metadata });
+    }
+    /**
+     * Keeps the installation your backend answered for this key, which may not be the ID proposed.
+     * Only this opaque ID is stored here; the private key never leaves the platform's keystore.
+     */
+    saveInstallationId(installationId) {
+        return this.storage.write(InstallationStore.installationIdKey, installationId);
+    }
+    /** Whether a step-up key was replaced and the backend has not yet taken the new one (DeviceTrust.reenrolStepUp) -- kept across restarts. */
+    async stepUpReenrolPending() {
+        return (await this.storage.read(InstallationStore.stepUpReenrolKey)) !== null;
+    }
+    setStepUpReenrolPending(pending) {
+        return pending
+            ? this.storage.write(InstallationStore.stepUpReenrolKey, '1')
+            : this.storage.delete(InstallationStore.stepUpReenrolKey);
+    }
+    /** Deletes the key and the installation ID: the next start is a new installation. */
+    async clear() {
+        await this.key.deleteKey();
+        await this.storage.delete(InstallationStore.installationIdKey);
+        await this.storage.delete(InstallationStore.stepUpReenrolKey);
+    }
+}
+exports.InstallationStore = InstallationStore;
+InstallationStore.installationIdKey = 'recognition.installation_id.v2';
+InstallationStore.stepUpReenrolKey = 'recognition.stepup_reenrol_pending.v1';

package/lib/native/NativeNecessaryInstallationKey.d.ts

@@ -0,0 +1,10 @@
+import type { TurboModule } from 'react-native';
+/** The installation key, in the phone's keystore: made on first use, never exported. */
+export interface Spec extends TurboModule {
+    getOrCreateKey(): Promise<Object>;
+    sign(payload: string): Promise<string>;
+    deleteKey(): Promise<boolean>;
+    reinstallHintIdentifier(): Promise<string>;
+}
+declare const _default: Spec | null | undefined;
+export default _default;

package/lib/native/NativeNecessaryInstallationKey.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const react_native_1 = require("react-native");
+exports.default = react_native_1.TurboModuleRegistry.get('NecessaryInstallationKey');

package/lib/native/NativeNecessaryIntegrity.d.ts

@@ -0,0 +1,8 @@
+import type { TurboModule } from 'react-native';
+/** The collector: measures what a challenge asks for and the app enabled, and nothing else. */
+export interface Spec extends TurboModule {
+    collect(requiredProbes: string[], challengeNonce: string, optionalProbes: string[], enabledMeasurements: string[]): Promise<Object>;
+    requestLocationPermission(): Promise<string>;
+}
+declare const _default: Spec | null | undefined;
+export default _default;

package/lib/native/NativeNecessaryIntegrity.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const react_native_1 = require("react-native");
+exports.default = react_native_1.TurboModuleRegistry.get('NecessaryIntegrity');

package/lib/native/NativeNecessarySecureScreen.d.ts

@@ -0,0 +1,7 @@
+import type { TurboModule } from 'react-native';
+/** Protection of the app's window while a secret is typed. */
+export interface Spec extends TurboModule {
+    protect(on: boolean): Promise<Object>;
+}
+declare const _default: Spec | null | undefined;
+export default _default;

package/lib/native/NativeNecessarySecureScreen.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const react_native_1 = require("react-native");
+exports.default = react_native_1.TurboModuleRegistry.get('NecessarySecureScreen');

package/lib/native/NativeNecessaryStepUpKey.d.ts

@@ -0,0 +1,9 @@
+import type { TurboModule } from 'react-native';
+/** The step-up key: a second key that the person must unlock with the screen lock. */
+export interface Spec extends TurboModule {
+    getOrCreateKey(factor: string, mode: string, windowSeconds: number): Promise<Object>;
+    sign(payload: string, reason: string, mode: string): Promise<string>;
+    deleteKey(): Promise<boolean>;
+}
+declare const _default: Spec | null | undefined;
+export default _default;

package/lib/native/NativeNecessaryStepUpKey.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const react_native_1 = require("react-native");
+exports.default = react_native_1.TurboModuleRegistry.get('NecessaryStepUpKey');

package/lib/native/NativeNecessaryStorage.d.ts

@@ -0,0 +1,14 @@
+import type { TurboModule } from 'react-native';
+/**
+ * The phone's secure storage for the installation ID and the pending step-up re-enrolment (the
+ * Keychain, readable after the first unlock, on this device only; values encrypted under a key in
+ * the platform keystore), and the platform's secure random source.
+ */
+export interface Spec extends TurboModule {
+    read(key: string): Promise<string | null>;
+    write(key: string, value: string): Promise<boolean>;
+    remove(key: string): Promise<boolean>;
+    randomBytes(count: number): Promise<string>;
+}
+declare const _default: Spec | null | undefined;
+export default _default;

package/lib/native/NativeNecessaryStorage.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const react_native_1 = require("react-native");
+exports.default = react_native_1.TurboModuleRegistry.get('NecessaryStorage');