@parlor/capacitor-device-key 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 cychien
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/Package.swift

@@ -0,0 +1,32 @@
+// swift-tools-version: 5.9
+import PackageDescription
+
+let package = Package(
+    name: "ParlorCapacitorDeviceKey",
+    platforms: [.iOS(.v15), .macOS(.v13)],
+    products: [
+        .library(
+            name: "ParlorCapacitorDeviceKey",
+            targets: ["ParlorDeviceKeyPlugin"])
+    ],
+    dependencies: [
+        .package(url: "https://github.com/ionic-team/capacitor-swift-pm.git", from: "8.0.0")
+    ],
+    targets: [
+        .target(
+            name: "ParlorDeviceKeyCore",
+            path: "ios/Sources/ParlorDeviceKeyCore"),
+        .target(
+            name: "ParlorDeviceKeyPlugin",
+            dependencies: [
+                "ParlorDeviceKeyCore",
+                .product(name: "Capacitor", package: "capacitor-swift-pm"),
+                .product(name: "Cordova", package: "capacitor-swift-pm")
+            ],
+            path: "ios/Sources/ParlorDeviceKeyPlugin"),
+        .testTarget(
+            name: "ParlorDeviceKeyCoreTests",
+            dependencies: ["ParlorDeviceKeyCore"],
+            path: "ios/Tests/ParlorDeviceKeyCoreTests")
+    ]
+)

package/README.md

@@ -1,3 +1,11 @@
-# Temporary Holding Version
+# @parlor/capacitor-device-key
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The native half of the device-key and session-store capabilities on iOS and Android. Installed by `@parlor/capabilities` in Capacitor builds; you do not depend on it directly.
+
+```ts
+import { ParlorSessionStore } from "@parlor/capacitor-device-key";
+
+console.log(typeof ParlorSessionStore);
+```
+
+Docs: https://cychien.github.io/parlor/reference/capabilities/

package/dist/index.d.ts

@@ -0,0 +1,44 @@
+export interface ParlorDeviceKeyPlugin {
+    publicKeys(options: {
+        presence: boolean;
+        challenge: string;
+    }): Promise<{
+        signing: {
+            keyId: string;
+            publicKey: JsonWebKey;
+        };
+        presence?: {
+            keyId: string;
+            publicKey: JsonWebKey;
+        };
+        proof: {
+            signature: string;
+        };
+    }>;
+    sign(options: {
+        keyId: string;
+        payload: string;
+    }): Promise<{
+        signature: string;
+    }>;
+}
+export interface ParlorSessionStorePlugin {
+    get(): Promise<{
+        value?: string;
+    }>;
+    set(options: {
+        value?: string;
+    }): Promise<void>;
+}
+export interface ParlorAuthBrowserPlugin {
+    open(options: {
+        url: string;
+        callbackScheme: string;
+    }): Promise<{
+        url?: string;
+    }>;
+}
+export declare const ParlorDeviceKey: ParlorDeviceKeyPlugin;
+export declare const ParlorSessionStore: ParlorSessionStorePlugin;
+export declare const ParlorAuthBrowser: ParlorAuthBrowserPlugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACrE,OAAO,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,UAAU,CAAA;SAAE,CAAC;QAClD,QAAQ,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,UAAU,CAAA;SAAE,CAAC;QACpD,KAAK,EAAE;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnF;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,IAAI,OAAO,CAAC;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnC,GAAG,CAAC,OAAO,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnF;AAED,eAAO,MAAM,eAAe,uBAA2D,CAAC;AACxF,eAAO,MAAM,kBAAkB,0BACiC,CAAC;AACjE,eAAO,MAAM,iBAAiB,yBACgC,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+import { registerPlugin } from "@capacitor/core";
+export const ParlorDeviceKey = registerPlugin("ParlorDeviceKey");
+export const ParlorSessionStore = registerPlugin("ParlorSessionStore");
+export const ParlorAuthBrowser = registerPlugin("ParlorAuthBrowser");
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAoBjD,MAAM,CAAC,MAAM,eAAe,GAAG,cAAc,CAAwB,iBAAiB,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,kBAAkB,GAC7B,cAAc,CAA2B,oBAAoB,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,iBAAiB,GAC5B,cAAc,CAA0B,mBAAmB,CAAC,CAAC","sourcesContent":["import { registerPlugin } from \"@capacitor/core\";\n\nexport interface ParlorDeviceKeyPlugin {\n  publicKeys(options: { presence: boolean; challenge: string }): Promise<{\n    signing: { keyId: string; publicKey: JsonWebKey };\n    presence?: { keyId: string; publicKey: JsonWebKey };\n    proof: { signature: string };\n  }>;\n  sign(options: { keyId: string; payload: string }): Promise<{ signature: string }>;\n}\n\nexport interface ParlorSessionStorePlugin {\n  get(): Promise<{ value?: string }>;\n  set(options: { value?: string }): Promise<void>;\n}\n\nexport interface ParlorAuthBrowserPlugin {\n  open(options: { url: string; callbackScheme: string }): Promise<{ url?: string }>;\n}\n\nexport const ParlorDeviceKey = registerPlugin<ParlorDeviceKeyPlugin>(\"ParlorDeviceKey\");\nexport const ParlorSessionStore =\n  registerPlugin<ParlorSessionStorePlugin>(\"ParlorSessionStore\");\nexport const ParlorAuthBrowser =\n  registerPlugin<ParlorAuthBrowserPlugin>(\"ParlorAuthBrowser\");\n"]}

package/ios/Sources/ParlorDeviceKeyCore/KeyEncoding.swift

@@ -0,0 +1,122 @@
+import CryptoKit
+import Foundation
+
+public struct PublicPoint: Equatable {
+    public let x: String
+    public let y: String
+
+    public init(x: String, y: String) {
+        self.x = x
+        self.y = y
+    }
+
+    public var jwk: [String: String] {
+        ["kty": "EC", "crv": "P-256", "x": x, "y": y]
+    }
+}
+
+public enum KeyEncoding {
+    public static func base64url(_ data: Data) -> String {
+        data.base64EncodedString()
+            .replacingOccurrences(of: "+", with: "-")
+            .replacingOccurrences(of: "/", with: "_")
+            .replacingOccurrences(of: "=", with: "")
+    }
+
+    public static func data(fromBase64url text: String) -> Data? {
+        var base64 = text
+            .replacingOccurrences(of: "-", with: "+")
+            .replacingOccurrences(of: "_", with: "/")
+        base64 += String(repeating: "=", count: (4 - base64.count % 4) % 4)
+        return Data(base64Encoded: base64)
+    }
+
+    public static func point(x963 representation: Data) -> PublicPoint? {
+        guard representation.count == 65, representation.first == 0x04 else { return nil }
+        let bytes = representation.dropFirst()
+        return PublicPoint(
+            x: base64url(Data(bytes.prefix(32))),
+            y: base64url(Data(bytes.suffix(32))))
+    }
+
+    public static func thumbprint(_ point: PublicPoint) -> String {
+        let text = "{\"crv\":\"P-256\",\"kty\":\"EC\",\"x\":\"\(point.x)\",\"y\":\"\(point.y)\"}"
+        return base64url(Data(SHA256.hash(data: Data(text.utf8))))
+    }
+
+    public static func enrollmentBytes(
+        challenge: String,
+        signing: PublicPoint,
+        presence: (keyId: String, point: PublicPoint)?
+    ) -> Data {
+        let presenceText =
+            presence.map {
+                "{\"format\":\"es256-raw\",\"id\":\(quoted($0.keyId)),\"publicKey\":\(jwkText($0.point))}"
+            } ?? "null"
+        let text =
+            "{\"challenge\":\(quoted(challenge)),\"presence\":\(presenceText),\"signing\":\(jwkText(signing))}"
+        return Data(text.utf8)
+    }
+
+    public static func rawSignature(fromDER der: Data) -> Data? {
+        let bytes = [UInt8](der)
+        var at = 0
+        guard let sequence = readTag(bytes, &at, expecting: 0x30), sequence == bytes.count - at
+        else { return nil }
+        guard let r = readInteger(bytes, &at), let s = readInteger(bytes, &at), at == bytes.count
+        else { return nil }
+        return Data(r + s)
+    }
+
+    private static func jwkText(_ point: PublicPoint) -> String {
+        "{\"crv\":\"P-256\",\"kty\":\"EC\",\"x\":\(quoted(point.x)),\"y\":\(quoted(point.y))}"
+    }
+
+    private static func quoted(_ text: String) -> String {
+        var out = "\""
+        for scalar in text.unicodeScalars {
+            switch scalar {
+            case "\"": out += "\\\""
+            case "\\": out += "\\\\"
+            case "\n": out += "\\n"
+            case "\r": out += "\\r"
+            case "\t": out += "\\t"
+            default:
+                if scalar.value < 0x20 {
+                    out += String(format: "\\u%04x", scalar.value)
+                } else {
+                    out.unicodeScalars.append(scalar)
+                }
+            }
+        }
+        return out + "\""
+    }
+
+    private static func readTag(_ bytes: [UInt8], _ at: inout Int, expecting tag: UInt8) -> Int? {
+        guard at < bytes.count, bytes[at] == tag else { return nil }
+        at += 1
+        guard at < bytes.count else { return nil }
+        let first = Int(bytes[at])
+        at += 1
+        if first < 0x80 { return first }
+        let count = first & 0x7f
+        guard count >= 1, count <= 2, at + count <= bytes.count else { return nil }
+        var length = 0
+        for _ in 0..<count {
+            length = (length << 8) | Int(bytes[at])
+            at += 1
+        }
+        return length
+    }
+
+    private static func readInteger(_ bytes: [UInt8], _ at: inout Int) -> [UInt8]? {
+        guard let length = readTag(bytes, &at, expecting: 0x02), length > 0,
+            at + length <= bytes.count
+        else { return nil }
+        var value = Array(bytes[at..<(at + length)])
+        at += length
+        while value.count > 1, value.first == 0 { value.removeFirst() }
+        guard value.count <= 32 else { return nil }
+        return [UInt8](repeating: 0, count: 32 - value.count) + value
+    }
+}

package/ios/Sources/ParlorDeviceKeyPlugin/DeviceKeyStore.swift

@@ -0,0 +1,172 @@
+import Foundation
+import LocalAuthentication
+import ParlorDeviceKeyCore
+import Security
+
+enum DeviceKeyError: LocalizedError {
+    case keystore(String)
+    case presenceRefused
+    case unknownKey
+    case badPayload
+
+    var errorDescription: String? {
+        switch self {
+        case .keystore(let reason): return reason
+        case .presenceRefused: return "The presence check did not complete."
+        case .unknownKey: return "This device has no such key."
+        case .badPayload: return "The payload is not base64url."
+        }
+    }
+}
+
+enum KeyRole: String {
+    case signing
+    case presence
+}
+
+struct StoredKey {
+    let ref: SecKey
+    let point: PublicPoint
+    let keyId: String
+    let inSecureEnclave: Bool
+}
+
+final class DeviceKeyStore {
+    private let tagPrefix: String
+
+    init(bundleId: String = Bundle.main.bundleIdentifier ?? "parlor") {
+        tagPrefix = "\(bundleId).parlor.device."
+    }
+
+    func existing(_ role: KeyRole, context: LAContext? = nil) -> StoredKey? {
+        var query = baseQuery(role)
+        query[kSecReturnRef as String] = true
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+        if let context { query[kSecUseAuthenticationContext as String] = context }
+        var item: CFTypeRef?
+        guard SecItemCopyMatching(query as CFDictionary, &item) == errSecSuccess,
+            let item
+        else { return nil }
+        return describe(item as! SecKey)
+    }
+
+    func ensure(_ role: KeyRole) throws -> StoredKey {
+        if let found = existing(role) { return found }
+        if let created = try createInSecureEnclave(role) { return created }
+        return try createInSoftware(role)
+    }
+
+    func canConfirmPresence() -> Bool {
+        var error: NSError?
+        return LAContext().canEvaluatePolicy(.deviceOwnerAuthentication, error: &error)
+    }
+
+    func lookup(keyId: String, context: LAContext) -> (role: KeyRole, key: StoredKey)? {
+        for role in [KeyRole.signing, .presence] {
+            if let key = existing(role, context: context), key.keyId == keyId {
+                return (role, key)
+            }
+        }
+        return nil
+    }
+
+    func sign(_ key: StoredKey, role: KeyRole, payload: Data, context: LAContext) throws -> Data {
+        if role == .presence && !key.inSecureEnclave {
+            try confirmPresence(context)
+        }
+        var error: Unmanaged<CFError>?
+        guard
+            let der = SecKeyCreateSignature(
+                key.ref, .ecdsaSignatureMessageX962SHA256, payload as CFData, &error)
+        else {
+            throw DeviceKeyError.keystore(
+                error?.takeRetainedValue().localizedDescription ?? "The signature failed.")
+        }
+        guard let raw = KeyEncoding.rawSignature(fromDER: der as Data) else {
+            throw DeviceKeyError.keystore("The keystore returned a malformed signature.")
+        }
+        return raw
+    }
+
+    private func confirmPresence(_ context: LAContext) throws {
+        var denied: Error?
+        let done = DispatchSemaphore(value: 0)
+        context.evaluatePolicy(
+            .deviceOwnerAuthentication, localizedReason: "Confirm it is you"
+        ) { ok, error in
+            if !ok { denied = error ?? DeviceKeyError.presenceRefused }
+            done.signal()
+        }
+        done.wait()
+        if denied != nil { throw DeviceKeyError.presenceRefused }
+    }
+
+    private func tag(_ role: KeyRole) -> Data {
+        Data((tagPrefix + role.rawValue).utf8)
+    }
+
+    private func baseQuery(_ role: KeyRole) -> [String: Any] {
+        [
+            kSecClass as String: kSecClassKey,
+            kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+            kSecAttrApplicationTag as String: tag(role),
+        ]
+    }
+
+    private func describe(_ ref: SecKey) -> StoredKey? {
+        guard let publicKey = SecKeyCopyPublicKey(ref),
+            let representation = SecKeyCopyExternalRepresentation(publicKey, nil) as Data?,
+            let point = KeyEncoding.point(x963: representation)
+        else { return nil }
+        let attributes = SecKeyCopyAttributes(ref) as? [String: Any]
+        let token = attributes?[kSecAttrTokenID as String] as? String
+        return StoredKey(
+            ref: ref,
+            point: point,
+            keyId: KeyEncoding.thumbprint(point),
+            inSecureEnclave: token == (kSecAttrTokenIDSecureEnclave as String))
+    }
+
+    private func create(_ role: KeyRole, secureEnclave: Bool) throws -> StoredKey? {
+        var privateAttributes: [String: Any] = [
+            kSecAttrIsPermanent as String: true,
+            kSecAttrApplicationTag as String: tag(role),
+        ]
+        var attributes: [String: Any] = [
+            kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+            kSecAttrKeySizeInBits as String: 256,
+        ]
+        if secureEnclave {
+            var flags: SecAccessControlCreateFlags = [.privateKeyUsage]
+            if role == .presence { flags.insert(.userPresence) }
+            guard
+                let access = SecAccessControlCreateWithFlags(
+                    nil, kSecAttrAccessibleWhenUnlockedThisDeviceOnly, flags, nil)
+            else { return nil }
+            privateAttributes[kSecAttrAccessControl as String] = access
+            attributes[kSecAttrTokenID as String] = kSecAttrTokenIDSecureEnclave
+        } else {
+            privateAttributes[kSecAttrAccessible as String] =
+                kSecAttrAccessibleWhenUnlockedThisDeviceOnly
+        }
+        attributes[kSecPrivateKeyAttrs as String] = privateAttributes
+        var error: Unmanaged<CFError>?
+        guard let ref = SecKeyCreateRandomKey(attributes as CFDictionary, &error) else {
+            if secureEnclave { return nil }
+            throw DeviceKeyError.keystore(
+                error?.takeRetainedValue().localizedDescription ?? "The key could not be created.")
+        }
+        return describe(ref)
+    }
+
+    private func createInSecureEnclave(_ role: KeyRole) throws -> StoredKey? {
+        try create(role, secureEnclave: true)
+    }
+
+    private func createInSoftware(_ role: KeyRole) throws -> StoredKey {
+        guard let key = try create(role, secureEnclave: false) else {
+            throw DeviceKeyError.keystore("The key could not be created.")
+        }
+        return key
+    }
+}

package/ios/Sources/ParlorDeviceKeyPlugin/ParlorAuthBrowserPlugin.swift

@@ -0,0 +1,58 @@
+import AuthenticationServices
+import Capacitor
+import Foundation
+
+@objc(ParlorAuthBrowserPlugin)
+public class ParlorAuthBrowserPlugin: CAPPlugin, CAPBridgedPlugin,
+    ASWebAuthenticationPresentationContextProviding
+{
+    public let identifier = "ParlorAuthBrowserPlugin"
+    public let jsName = "ParlorAuthBrowser"
+    public let pluginMethods: [CAPPluginMethod] = [
+        CAPPluginMethod(name: "open", returnType: CAPPluginReturnPromise)
+    ]
+
+    private var session: ASWebAuthenticationSession?
+
+    @objc func open(_ call: CAPPluginCall) {
+        guard let address = call.getString("url"), let url = URL(string: address),
+            url.scheme == "https" || url.scheme == "http",
+            let scheme = call.getString("callbackScheme"), !scheme.isEmpty
+        else {
+            call.reject("An http(s) url and a callbackScheme are required.")
+            return
+        }
+        DispatchQueue.main.async {
+            self.session?.cancel()
+            var running: ASWebAuthenticationSession?
+            let session = ASWebAuthenticationSession(url: url, callbackURLScheme: scheme) {
+                [weak self] callback, error in
+                if let self, self.session === running { self.session = nil }
+                running = nil
+                if let callback {
+                    call.resolve(["url": callback.absoluteString])
+                } else if let error = error as? ASWebAuthenticationSessionError,
+                    error.code == .canceledLogin
+                {
+                    call.resolve([:])
+                } else {
+                    call.reject(error?.localizedDescription ?? "Sign-in did not finish.")
+                }
+            }
+            session.presentationContextProvider = self
+            running = session
+            self.session = session
+            if !session.start() {
+                self.session = nil
+                running = nil
+                call.reject("The sign-in browser could not open.")
+            }
+        }
+    }
+
+    public func presentationAnchor(for session: ASWebAuthenticationSession)
+        -> ASPresentationAnchor
+    {
+        bridge?.webView?.window ?? ASPresentationAnchor()
+    }
+}

package/ios/Sources/ParlorDeviceKeyPlugin/ParlorDeviceKeyPlugin.swift

@@ -0,0 +1,76 @@
+import Capacitor
+import Foundation
+import LocalAuthentication
+import ParlorDeviceKeyCore
+
+@objc(ParlorDeviceKeyPlugin)
+public class ParlorDeviceKeyPlugin: CAPPlugin, CAPBridgedPlugin {
+    public let identifier = "ParlorDeviceKeyPlugin"
+    public let jsName = "ParlorDeviceKey"
+    public let pluginMethods: [CAPPluginMethod] = [
+        CAPPluginMethod(name: "publicKeys", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "sign", returnType: CAPPluginReturnPromise),
+    ]
+
+    private let store = DeviceKeyStore()
+    private let queue = DispatchQueue(label: "dev.parlor.device-key")
+
+    @objc func publicKeys(_ call: CAPPluginCall) {
+        guard let challenge = call.getString("challenge") else {
+            call.reject("challenge is required")
+            return
+        }
+        let wantsPresence = call.getBool("presence") ?? false
+        queue.async {
+            do {
+                let signing = try self.store.ensure(.signing)
+                var presence: StoredKey?
+                if wantsPresence && self.store.canConfirmPresence() {
+                    presence = try? self.store.ensure(.presence)
+                }
+                let enrollment = KeyEncoding.enrollmentBytes(
+                    challenge: challenge,
+                    signing: signing.point,
+                    presence: presence.map { ($0.keyId, $0.point) })
+                let proof = try self.store.sign(
+                    signing, role: .signing, payload: enrollment, context: LAContext())
+                var reply: [String: Any] = [
+                    "signing": ["keyId": signing.keyId, "publicKey": signing.point.jwk],
+                    "proof": ["signature": KeyEncoding.base64url(proof)],
+                ]
+                if let presence {
+                    reply["presence"] = ["keyId": presence.keyId, "publicKey": presence.point.jwk]
+                }
+                call.resolve(reply)
+            } catch {
+                call.reject(error.localizedDescription)
+            }
+        }
+    }
+
+    @objc func sign(_ call: CAPPluginCall) {
+        guard let keyId = call.getString("keyId"), let encoded = call.getString("payload") else {
+            call.reject("keyId and payload are required")
+            return
+        }
+        guard let payload = KeyEncoding.data(fromBase64url: encoded) else {
+            call.reject(DeviceKeyError.badPayload.localizedDescription)
+            return
+        }
+        queue.async {
+            let context = LAContext()
+            context.localizedReason = "Confirm it is you"
+            guard let found = self.store.lookup(keyId: keyId, context: context) else {
+                call.reject(DeviceKeyError.unknownKey.localizedDescription)
+                return
+            }
+            do {
+                let signature = try self.store.sign(
+                    found.key, role: found.role, payload: payload, context: context)
+                call.resolve(["signature": KeyEncoding.base64url(signature)])
+            } catch {
+                call.reject(error.localizedDescription)
+            }
+        }
+    }
+}

package/ios/Sources/ParlorDeviceKeyPlugin/ParlorSessionStorePlugin.swift

@@ -0,0 +1,61 @@
+import Capacitor
+import Foundation
+import Security
+
+@objc(ParlorSessionStorePlugin)
+public class ParlorSessionStorePlugin: CAPPlugin, CAPBridgedPlugin {
+    public let identifier = "ParlorSessionStorePlugin"
+    public let jsName = "ParlorSessionStore"
+    public let pluginMethods: [CAPPluginMethod] = [
+        CAPPluginMethod(name: "get", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "set", returnType: CAPPluginReturnPromise),
+    ]
+
+    private let account = "parlor.session"
+
+    private var identity: [String: Any] {
+        [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: Bundle.main.bundleIdentifier ?? "parlor",
+            kSecAttrAccount as String: account,
+        ]
+    }
+
+    @objc func get(_ call: CAPPluginCall) {
+        var query = identity
+        query[kSecReturnData as String] = true
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+        var item: CFTypeRef?
+        let status = SecItemCopyMatching(query as CFDictionary, &item)
+        if status == errSecItemNotFound {
+            call.resolve([:])
+        } else if status == errSecSuccess, let data = item as? Data,
+            let value = String(data: data, encoding: .utf8)
+        {
+            call.resolve(["value": value])
+        } else {
+            call.reject("The Keychain could not be read (\(status)).")
+        }
+    }
+
+    @objc func set(_ call: CAPPluginCall) {
+        let deleted = SecItemDelete(identity as CFDictionary)
+        guard deleted == errSecSuccess || deleted == errSecItemNotFound else {
+            call.reject("The Keychain could not be updated (\(deleted)).")
+            return
+        }
+        guard let value = call.getString("value"), !value.isEmpty else {
+            call.resolve()
+            return
+        }
+        var attributes = identity
+        attributes[kSecValueData as String] = Data(value.utf8)
+        attributes[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+        let status = SecItemAdd(attributes as CFDictionary, nil)
+        if status == errSecSuccess {
+            call.resolve()
+        } else {
+            call.reject("The Keychain could not be updated (\(status)).")
+        }
+    }
+}

package/ios/Tests/ParlorDeviceKeyCoreTests/KeyEncodingChecks.swift

@@ -0,0 +1,63 @@
+import CryptoKit
+import XCTest
+
+@testable import ParlorDeviceKeyCore
+
+final class KeyEncodingTests: XCTestCase {
+    private let signing = PublicPoint(
+        x: "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU",
+        y: "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0")
+    private let presence = PublicPoint(
+        x: "WKn-ZIGevcwGIyyrzFoZNBdaq9_TsDRN9lH8s6Ra6vc",
+        y: "KE0n8UyW-WMcIRb9_SkfD1BO2nO8w0z0K_Bm3b1o9uw")
+
+    func testThumbprintMatchesTheWebAdapter() {
+        XCTAssertEqual(
+            KeyEncoding.thumbprint(signing), "oKIywvGUpTVTyxMQ3bwIIeQUudfr_CkLMjCE19ECD-U")
+    }
+
+    func testEnrollmentBytesMatchTheCanonicalJson() {
+        let bytes = KeyEncoding.enrollmentBytes(challenge: "AQID-g", signing: signing, presence: nil)
+        XCTAssertEqual(
+            String(decoding: bytes, as: UTF8.self),
+            "{\"challenge\":\"AQID-g\",\"presence\":null,\"signing\":{\"crv\":\"P-256\",\"kty\":\"EC\",\"x\":\"\(signing.x)\",\"y\":\"\(signing.y)\"}}"
+        )
+        let both = KeyEncoding.enrollmentBytes(
+            challenge: "AQID-g", signing: signing,
+            presence: (KeyEncoding.thumbprint(presence), presence))
+        XCTAssertEqual(
+            String(decoding: both, as: UTF8.self),
+            "{\"challenge\":\"AQID-g\",\"presence\":{\"format\":\"es256-raw\",\"id\":\"HePMXFv0dmgSDC07-rfMd1T6M1tz4TSm2ovWfz3HKvc\",\"publicKey\":{\"crv\":\"P-256\",\"kty\":\"EC\",\"x\":\"\(presence.x)\",\"y\":\"\(presence.y)\"}},\"signing\":{\"crv\":\"P-256\",\"kty\":\"EC\",\"x\":\"\(signing.x)\",\"y\":\"\(signing.y)\"}}"
+        )
+    }
+
+    func testPointFromX963SplitsTheCoordinates() {
+        let key = P256.Signing.PrivateKey().publicKey
+        let raw = key.rawRepresentation
+        let point = KeyEncoding.point(x963: key.x963Representation)
+        XCTAssertEqual(point?.x, KeyEncoding.base64url(raw.prefix(32)))
+        XCTAssertEqual(point?.y, KeyEncoding.base64url(raw.suffix(32)))
+        XCTAssertNil(KeyEncoding.point(x963: raw))
+    }
+
+    func testDerSignaturesBecomeRawRAndS() throws {
+        let key = P256.Signing.PrivateKey()
+        for round in 0..<64 {
+            let signature = try key.signature(for: Data("payload \(round)".utf8))
+            XCTAssertEqual(
+                KeyEncoding.rawSignature(fromDER: signature.derRepresentation),
+                signature.rawRepresentation)
+        }
+    }
+
+    func testMalformedDerIsRefused() {
+        XCTAssertNil(KeyEncoding.rawSignature(fromDER: Data([0x30, 0x02, 0x02, 0x00])))
+        XCTAssertNil(KeyEncoding.rawSignature(fromDER: Data()))
+    }
+
+    func testBase64urlRoundTrips() {
+        let data = Data([1, 2, 3, 250])
+        XCTAssertEqual(KeyEncoding.base64url(data), "AQID-g")
+        XCTAssertEqual(KeyEncoding.data(fromBase64url: "AQID-g"), data)
+    }
+}

package/package.json

@@ -1,6 +1,43 @@
 {
   "name": "@parlor/capacitor-device-key",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "description": "Capacitor plugins for the device key and the session store, backed by the iOS keystore",
+  "homepage": "https://cychien.github.io/parlor",
+  "bugs": "https://github.com/cychien/parlor/issues",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cychien/parlor.git",
+    "directory": "packages/capacitor-device-key"
+  },
+  "files": [
+    "dist",
+    "ios",
+    "Package.swift"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "devDependencies": {
+    "@capacitor/core": "^8.5.2",
+    "@types/node": "^24.14.0",
+    "typescript": "^7.0.2"
+  },
+  "peerDependencies": {
+    "@capacitor/core": ">=8"
+  },
+  "capacitor": {
+    "ios": {
+      "src": "ios"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
 }