@rakomi/react-native 0.0.0 → 0.2.0

package/dist/passkey-adapter-D_Z3Z7lV.d.ts

@@ -0,0 +1,469 @@
+import { CryptoProvider, KeyValueStore, PasskeyCeremonyAdapter } from '@rakomi/sdk-core';
+
+/**
+ * `NativeAuthAdapter` — single typed surface that swaps every
+ * browser-coupled primitive in `@rakomi/react` for an RN/Expo equivalent.
+ *
+ * It is the source of truth for which native module backs each capability.
+ * The default impl in `./expo-adapter.ts` wires Expo modules; bare-RN consumers
+ * wire their own via `<RakomiProvider nativeAdapter={...}>`.
+ *
+ * Forward-compat slots (typed, optional, no default impl):
+ * - `verifiers` for EUDI Wallet attestation (eIDAS 2 / Reg. 2024/1183, end-2026 mandate).
+ * - `dpopProver` for RFC 9449 DPoP.
+ * - `pushAuthorizationRequest` for RFC 9126 PAR.
+ *
+ * Hardening rules:
+ * - The provider MUST `Object.freeze` the adapter on first use.
+ * - Adapter methods MUST NOT log token values.
+ * - Adapter is the ONLY layer touching expo-* modules — keeps SDK core platform-neutral.
+ */
+
+interface BrowserAuthSessionOptions {
+    /**
+   * iOS-only. Defaults to `true` for stricter privacy
+   * (no shared cookies). Consumer can opt out via `<RakomiProvider browserPreferEphemeralSession={false}>`.
+   */
+    preferEphemeralSession?: boolean;
+}
+type BrowserAuthSessionResult = {
+    type: 'success';
+    url: string;
+} | {
+    type: 'cancel';
+} | {
+    type: 'dismiss';
+} | {
+    type: 'locked';
+};
+interface SystemBrowser {
+    /**
+   * Open `authUrl` in the OS system browser (ASWebAuthenticationSession on iOS,
+   * Custom Tabs on Android). The OS returns a `redirectUri`-prefixed URL when
+   * the OAuth provider redirects.
+   *
+   * Implementations MUST NOT use any kind of WebView (RFC 8252).
+   */
+    openAuthSession(authUrl: string, redirectUri: string, options?: BrowserAuthSessionOptions): Promise<BrowserAuthSessionResult>;
+}
+interface DeepLinkSubscription {
+    /** Stop receiving callbacks. Idempotent. */
+    remove(): void;
+}
+interface DeepLinkProvider {
+    /**
+     * Return the URL the app was launched with, if any. Cold start case.
+     */
+    getInitialUrl(): Promise<string | null>;
+    /**
+   * Subscribe to incoming deep links. Listener is called with each URL.
+   * Implementations MUST debounce duplicate URLs within ~60s (single-use guard)
+   * — but typically the SDK layer enforces this, not the adapter.
+   */
+    addListener(listener: (url: string) => void): DeepLinkSubscription;
+}
+type BiometricResult = {
+    success: true;
+} | {
+    success: false;
+    reason: 'cancelled' | 'lockout' | 'not_enrolled' | 'unavailable' | 'unknown';
+};
+interface BiometricGate {
+    /**
+     * Return `true` if the device has hardware AND the user has enrolled biometrics
+     * (or a passcode, when `disableDeviceFallback === false`).
+     */
+    isAvailable(): Promise<boolean>;
+    /**
+   * Prompt the user for biometric authentication.
+   *
+   * `strict: true` disables passcode fallback (`disableDeviceFallback: true`).
+   * Default is `false` (allow device passcode).
+   */
+    authenticate(options: {
+        promptMessage: string;
+        strict?: boolean;
+    }): Promise<BiometricResult>;
+}
+type AppStateValue = 'active' | 'background' | 'inactive' | 'unknown';
+interface AppStateSubscription {
+    remove(): void;
+}
+interface AppLifecycle {
+    /**
+   * Subscribe to AppState transitions.
+   *
+   * Android Q+ fires `AppState` twice on keyboard
+   * dismiss — the SDK layer (not the adapter) MUST debounce ~300ms.
+   */
+    addStateChangeListener(listener: (next: AppStateValue) => void): AppStateSubscription;
+    /** Read current state synchronously. */
+    getCurrent(): AppStateValue;
+}
+interface NetInfoSubscription {
+    remove(): void;
+}
+interface ConnectivityProvider {
+    /** Resolve once with the current connectivity state. */
+    isConnected(): Promise<boolean>;
+    /** Subscribe to connectivity transitions. */
+    addListener(listener: (isConnected: boolean) => void): NetInfoSubscription;
+}
+/** Reserved for EUDI Wallet attestation verifiers (eIDAS 2). */
+interface AttestationVerifier {
+    readonly id: string;
+    verify(presentation: unknown): Promise<{
+        ok: boolean;
+        reason?: string;
+    }>;
+}
+/**
+ * RFC 9449 DPoP proof generator — the canonical cross-port prover contract.
+ * `@rakomi/node`'s `createDpopProver` is the conformance oracle the proof
+ * *shape* matches byte-for-byte in structure.
+ *
+ * SECURITY — the production RN prover MUST bridge signing to the native
+ * keystore (iOS Keychain / Secure Enclave, Android Keystore/StrongBox) and MUST
+ * NEVER sign in the JS bundle: only `{jti, iat, nonce?}` + the signature cross
+ * the bridge; the private key never leaves the secure element. The prover OWNS
+ * every security-relevant proof field — `jti` (CSPRNG UUID, fresh per call),
+ * `iat` (seconds NumericDate), `typ: "dpop+jwt"`, the public-only `jwk`, and the
+ * pinned `alg` (`ES256` — the cross-port baseline, Secure-Enclave-eligible;
+ * NEVER derived from a key or any input). The caller supplies ONLY the canonical
+ * request binding (`htm`/`htu`) and the optional server `nonce`; it can never
+ * influence the algorithm or inject claims, and the proof carries NO PII
+ * (exactly `{htm, htu, jti, iat}` body + optional `nonce`).
+ */
+interface DpopProofInput {
+    /** HTTP method of the bound request — `"POST"` for the refresh call. */
+    htm: string;
+    /**
+     * The ALREADY-canonical `htu` (RFC 9449 §4.3 — scheme+host+path, query/fragment
+     * stripped, default port stripped). The SDK decision layer canonicalizes; the
+     * prover signs it verbatim and MUST NOT re-derive or mutate it.
+     */
+    htu: string;
+    /** Optional RFC 9449 §8 server nonce, echoed into the proof on a retry. */
+    nonce?: string;
+}
+interface DpopProver {
+    /**
+     * Build a compact-serialized DPoP-proof JWT for the bound request. Resolves to
+     * the `DPoP` header value. The prover signs with the session's single native
+     * keypair (one keypair per session — never re-generated per call). MUST reject
+     * (never return an empty/falsy string) if the native signer is unavailable so
+     * the SDK surfaces `dpop_prover_unavailable` instead of a silent Bearer call.
+     */
+    createProof(input: DpopProofInput): Promise<string>;
+    /**
+     * RFC 7638 SHA-256 thumbprint of the prover's public JWK — lets the SDK's
+     * bound-state cross-check pair `token_type === "DPoP"` with a `jkt` sanity
+     * check (`jkt`-continuity). Resolves the SAME value for the life
+     * of the session's keypair.
+     */
+    jktHint(): Promise<string>;
+}
+/** Reserved for RFC 9126 PAR (Pushed Authorization Requests). */
+interface ParClient {
+    push(authorizationRequest: Record<string, string>): Promise<{
+        requestUri: string;
+        expiresIn: number;
+    }>;
+}
+/**
+ * Background-fetch contract — best-effort token refresh while the app is suspended
+ * (Expo Task Manager / expo-background-fetch on Expo, BGTaskScheduler on iOS / WorkManager on Android
+ * for bare-RN consumers).
+ *
+ * The OS controls scheduling; the SDK only registers the work and provides the handler.
+ * best-effort, NOT guaranteed delivery.
+ */
+interface BackgroundTask {
+    /**
+     * Register a periodic refresh task. The handler is called by the OS at OS-decided intervals
+     * (≥15 min on Android; OS-throttled on iOS). Returns an unregister function.
+     */
+    register(handler: () => Promise<void>, options?: {
+        minimumIntervalSeconds?: number;
+    }): Promise<() => Promise<void>>;
+    /** Resolve `true` if the OS reports background-fetch as available + not user-disabled. */
+    isAvailable(): Promise<boolean>;
+}
+interface NativeAuthAdapter {
+    readonly crypto: CryptoProvider;
+    readonly storage: KeyValueStore;
+    readonly browser: SystemBrowser;
+    readonly deepLink: DeepLinkProvider;
+    readonly biometric: BiometricGate;
+    readonly appLifecycle: AppLifecycle;
+    readonly connectivity: ConnectivityProvider;
+    readonly verifiers?: readonly AttestationVerifier[];
+    readonly dpopProver?: DpopProver;
+    readonly par?: ParClient;
+    /** Optional best-effort background refresh hook. */
+    readonly backgroundTask?: BackgroundTask;
+    /**
+     * The passkey ceremony, delegated to the platform.
+     *
+     * The contract is `@rakomi/sdk-core`'s `PasskeyCeremonyAdapter` — imported, never re-declared
+     * here. A second interface for the same thing would let the browser binding and the native
+     * binding drift, and the conformance suite both of them run could only ever test one of them.
+     *
+     * Build one with `createNativePasskeyAdapter({ module })` from `@rakomi/react-native/native`.
+     * On Expo web a host may put a browser adapter in this same slot — the slot is platform-agnostic.
+     *
+     * A future SECOND ceremony type (a device-bound key, a hybrid/CTAP flow) gets its OWN optional
+     * slot; this one never becomes a type union. A union would destroy the totality of the shared
+     * conformance suite, which validates exactly ONE contract.
+     */
+    readonly passkeys?: PasskeyCeremonyAdapter;
+}
+/**
+ * `tokenCache` injection sugar (shorthand).
+ *
+ * If a consumer just wants to override storage without re-implementing the full adapter,
+ * they pass `tokenCache` and the SDK constructs an adapter that delegates only
+ * `storage` to `tokenCache` while inheriting the rest from the default Expo adapter.
+ */
+interface TokenCache {
+    getToken(key: string): Promise<string | null>;
+    saveToken(key: string, value: string): Promise<void>;
+    clearToken(key: string): Promise<void>;
+}
+
+/**
+ * The raw native-module surface a RN host exposes for DPoP signing — a
+ * TurboModule / legacy NativeModule whose methods take POSITIONAL arguments and
+ * return Promises (RN bridge convention: no `undefined` across the bridge — an
+ * absent nonce is passed as `null`).
+ *
+ * contract the native implementation MUST honour:
+ * - Generate ONE session keypair in the secure element on first use and hold it
+ * for the module instance's lifetime (one keypair per session); NEVER
+ * regenerate per call (a fresh key ⇒ `jkt` mismatch ⇒ 401 on every refresh).
+ * - `createDpopProof` builds + signs the FULL compact proof JWT natively and
+ * resolves the `DPoP` header value; it owns `jti`/`iat`/`typ`/`jwk`/`alg`.
+ * - Reject (Promise rejection) when the secure element is unavailable — NEVER
+ * resolve an empty string or a Bearer-shaped placeholder.
+ */
+interface NativeDpopModuleSpec {
+    /**
+     * Build + sign the compact DPoP-proof JWT in the secure element for the bound
+     * request. `nonce` is `null` unless this is the RFC 9449 §8 nonce retry.
+     * Resolves the `DPoP` header value.
+     */
+    createDpopProof(htm: string, htu: string, nonce: string | null): Promise<string>;
+    /** RFC 7638 SHA-256 thumbprint of the session public key (stable for the key's life). */
+    dpopJktThumbprint(): Promise<string>;
+}
+interface CreateNativeDpopProverOptions {
+    /**
+   * The host's native DPoP module. On bare RN this is the linked native module
+   * (`NativeModules.RakomiDpop`); on Expo it is the Expo module's JS surface.
+   * The module MUST be backed by the platform secure element.
+   */
+    module: NativeDpopModuleSpec;
+}
+/**
+ * Adapt a host's native DPoP signing module to the canonical {@link DpopProver}
+ * contract. Wire the result into the consumer's `NativeAuthAdapter.dpopProver`
+ * slot; `<RakomiProvider>` then auto-constructs the session-scoped `DpopSession`.
+ *
+ * The adapter enforces the no-silent-downgrade invariant: if the native
+ * signer rejects OR returns a falsy proof, `createProof` throws so the refresh
+ * path surfaces `auth/dpop_prover_unavailable` and makes NO proof-less network
+ * call — it never falls back to an empty/Bearer request.
+ *
+ * @public — additive-only.
+ */
+declare function createNativeDpopProver(options: CreateNativeDpopProverOptions): DpopProver;
+
+/**
+ * Default Expo adapter — wires the `NativeAuthAdapter` interface to Expo modules.
+ *
+ * Modules are imported dynamically inside the factory so:
+ * - Bare-RN consumers who pass a custom adapter don't pay the Expo bundle cost.
+ * - Consumers who never use biometric don't pay the `expo-local-authentication`
+ *   cost (lazy-load).
+ *
+ * Hardening:
+ * - The returned adapter is `Object.freeze`-able by callers; this module returns
+ *   a plain object — `<RakomiProvider>` freezes it on mount.
+ * - No `console.log` of token values anywhere in this file.
+ *
+ * Native-passkey integration (`react-native-passkey`, ASAuthorization) is
+ * out-of-scope here.
+ */
+
+/**
+ * Build the default Expo-backed `NativeAuthAdapter`.
+ *
+ * Each capability is lazily resolved on first use to keep the cold-import bundle
+ * small (perf budget). The resolution is memoised internally.
+ */
+declare function createDefaultExpoAdapter(options?: CreateDefaultExpoAdapterOptions): NativeAuthAdapter;
+interface CreateDefaultExpoAdapterOptions {
+    /**
+   * Override storage with the consumer's own token cache (sugar).
+   * When provided, `crypto`/`browser`/`deepLink`/`biometric`/`appLifecycle`/`connectivity`
+   * still come from Expo defaults; only storage is replaced.
+   */
+    tokenCache?: TokenCache;
+}
+
+/**
+ * The raw native-module surface a host exposes for passkey ceremonies.
+ *
+ * It is a structural duck-type: no brand, no symbol, no base class. **Any module satisfying this
+ * spec is a drop-in replacement; the SDK does not know which one you used** — your own Swift/Kotlin
+ * module, a community package, or a future first-party Expo module.
+ *
+ * ## What crosses the bridge
+ *
+ * Both ceremony methods take the server's options as a **JSON string** and resolve the finished
+ * credential as a **JSON string**. See the file header for why this is not an object.
+ *
+ * ## What the module MUST return (W3C WebAuthn **Level 3** JSON serialization, §5.1.8 / §5.1.9 —
+ * Candidate Recommendation; these JSON dictionaries do not exist in Level 2)
+ *
+ * `createPasskey` (registration):
+ *
+ * | member | required |
+ * |---|---|
+ * | `id`, `rawId`, `type: "public-key"` | MUST |
+ * | `response.clientDataJSON`, `response.attestationObject` | MUST |
+ * | `response.authenticatorData`, `response.publicKeyAlgorithm` | MUST |
+ * | `response.transports` | MUST (omitting it silently degrades later autofill) |
+ * | `clientExtensionResults` | MUST |
+ * | `authenticatorAttachment`, `response.publicKey` | optional |
+ *
+ * `getPasskey` (assertion):
+ *
+ * | member | required |
+ * |---|---|
+ * | `id`, `rawId`, `type: "public-key"` | MUST |
+ * | `response.clientDataJSON`, `response.authenticatorData`, `response.signature` | MUST |
+ * | `clientExtensionResults` | MUST |
+ * | `response.userHandle` | optional |
+ *
+ * **ENCODING — the single most common integration failure.** Every binary member is
+ * **base64url WITHOUT padding** (RFC 4648 **§5**). On iOS, `Data.base64EncodedString()` emits
+ * *standard* base64 (RFC 4648 **§4**, with `+`, `/` and `=`) — that is WRONG and the bridge rejects
+ * it with a message naming the field.
+ *
+ * (The bridge ENFORCES a subset of the table above — the fields the SDK's own fixtures carry and the
+ * server actually consumes. The rest are a MUST for you, not a MUST for the validator; sending them
+ * is what keeps your integration correct as the server tightens.)
+ *
+ * ## Rejection vocabulary — CLOSED
+ *
+ * Reject with an object carrying a `code`:
+ * - `PASSKEY_CANCELLED` — the user dismissed the sheet, or the OS cancelled.
+ * - `PASSKEY_UNSUPPORTED` — no passkey support on this OS version, or no credential provider.
+ * - `PASSKEY_NO_CREDENTIAL` — the user has no passkey for this relying party.
+ *
+ * Any other rejection is a genuine failure and is passed through untouched. **Do NOT set a
+ * rejection's `name` to `AbortError` / `NotAllowedError` / `TimeoutError` unless it really is a
+ * cancellation** — the SDK matches on those names and will read your intent as "the user cancelled".
+ *
+ * ## Stability (this is a SemVer surface even though we never compile your module)
+ *
+ * Your module is Swift or Kotlin: our typecheck will never see it, so a breaking change to this spec
+ * breaks every existing module **at runtime**, not at compile time — and the SDK's 24-month support
+ * policy means a module written today must still satisfy this spec two years from now. Therefore:
+ * - a new **optional** member → MINOR;
+ * - a new **optional trailing parameter** on an existing method → MINOR (a lower-arity function
+ *   stays assignable — which is exactly why we do not reserve parameters "just in case");
+ * - a **required** method, a parameter-type change, or a change to the rejection vocabulary → MAJOR;
+ * - the rejection vocabulary is CLOSED: a new code is first a change in `@rakomi/sdk-core`, and only
+ *   then a lane here.
+ *
+ * ## Orphan credentials — a residual you should know about
+ *
+ * If a registration ceremony is abandoned *after* the platform provider (iCloud Keychain / Google
+ * Password Manager) already created the credential, the user holds a passkey for your app that the
+ * server never learned about; their next sign-in with it fails. Implementing
+ * {@link NativePasskeyModuleSpec.cancelPasskeyRequest} narrows that window. The SDK does not
+ * reconcile orphans.
+ */
+interface NativePasskeyModuleSpec {
+    /**
+     * Whether this platform can run a passkey ceremony at all.
+     *
+     * **Advisory, not a verdict.** Every module in the ecosystem answers this from the OS version, so
+     * it says `true` on an Android emulator with no credential provider and on an iOS version where
+     * the platform provider does not exist. The SDK treats a throw or a non-`true` value as `false`
+     * (fail-closed) but cannot catch an honest `true` with no provider behind it — the authoritative
+     * verdict is the ceremony's own outcome.
+     */
+    isPasskeySupported(): Promise<boolean>;
+    /** Run the registration ceremony. `requestJson` is the server's options, verbatim. */
+    createPasskey(requestJson: string): Promise<string>;
+    /** Run the assertion ceremony. `requestJson` is the server's options, verbatim. */
+    getPasskey(requestJson: string): Promise<string>;
+    /**
+     * Optional: is a *platform* authenticator (Face ID / fingerprint / screen lock) available?
+     *
+     * A UI hint only — never a gate. A synced passkey on another device is still a passkey, so a
+     * `false` here does not mean "no passkeys". Omit it and the SDK reports `null` (unknown) rather
+     * than guessing.
+     */
+    isPlatformAuthenticatorAvailable?(): Promise<boolean>;
+    /**
+     * Optional: dismiss the in-flight native sheet (iOS `ASAuthorizationController.cancel()`;
+     * Android's `CredentialManager` calls are cancellable). Best-effort — a throw is ignored.
+     *
+     * It takes no request id because the native side has nothing to correlate against: the passkey sheet
+     * is an **OS-global modal**, and a cancel dismisses whatever is on screen. The SDK does NOT serialise
+     * ceremonies — nothing here can, since the sheet is owned by the OS — so the bridge instead fires the
+     * cancel only while the aborting ceremony is still the one in flight, making a stale abort a no-op
+     * rather than a teardown of somebody else's sheet. Preventing a second ceremony from being STARTED is
+     * a UI concern and belongs to the provider.
+     */
+    cancelPasskeyRequest?(): void | Promise<void>;
+}
+interface CreateNativePasskeyAdapterOptions {
+    /**
+     * The host's native passkey module. On bare RN this is the linked native module
+     * (`NativeModules.RakomiPasskey`); on Expo it is the Expo module's JS surface; it may also be a
+     * community package wrapped to satisfy {@link NativePasskeyModuleSpec}.
+     */
+    module: NativePasskeyModuleSpec;
+}
+/**
+ * Adapt a host's native passkey module to the canonical `PasskeyCeremonyAdapter` contract. Wire the
+ * result into `NativeAuthAdapter.passkeys`.
+ *
+ * The module's SHAPE is validated here, at wiring time, and a missing method throws loudly — in the
+ * host's adapter-construction code, where the bug is, rather than degrading to "passkeys are not
+ * supported on this device", which is a lie that hides the host's bug. An ABSENT adapter and a
+ * BROKEN adapter are different diagnoses and must not be collapsed.
+ *
+ * @public — additive-only.
+ */
+/**
+ * The core's ceremony contract, plus the one native-only capability the hook needs and the contract
+ * has no place for: the platform-authenticator hint. It is attached HERE rather than plumbed through
+ * the host, because the probe needs the MODULE and the hook only ever sees the adapter.
+ *
+ * Structurally a `PasskeyCeremonyAdapter`, so it drops into `nativeAdapter.passkeys` unchanged.
+ */
+interface NativePasskeyCeremonyAdapter extends PasskeyCeremonyAdapter {
+    /** `true` / `false` / `null` — and `null` means UNKNOWN, never "no". */
+    hasPlatformAuthenticator(): Promise<boolean | null>;
+}
+declare function createNativePasskeyAdapter(options: CreateNativePasskeyAdapterOptions): NativePasskeyCeremonyAdapter;
+/**
+ * Ask the host's module whether a *platform* authenticator is available.
+ *
+ * `null` means **unknown**, and it is `null` in all three shapes of "the module does not really
+ * implement this", because in React Native a missing method has three shapes, not one: it is absent
+ * (a legacy `NativeModules` object), or it exists but throws synchronously (a TurboModule whose
+ * codegen compiled the spec but whose native side did not implement it), or it exists but rejects
+ * (an Expo module proxy). None of them may answer `false` — that would be the lie "this device has
+ * no platform authenticator" — and none of them may be inferred from `isSupported()`, because a
+ * synced passkey is a passkey without a local platform authenticator.
+ */
+declare function probePlatformAuthenticator(mod: NativePasskeyModuleSpec): Promise<boolean | null>;
+
+export { type AppLifecycle as A, type BackgroundTask as B, type ConnectivityProvider as C, type DpopProver as D, type NativeAuthAdapter as N, type ParClient as P, type SystemBrowser as S, type TokenCache as T, type AppStateValue as a, type AttestationVerifier as b, type BiometricGate as c, type BiometricResult as d, type BrowserAuthSessionOptions as e, type BrowserAuthSessionResult as f, type CreateDefaultExpoAdapterOptions as g, type CreateNativeDpopProverOptions as h, type CreateNativePasskeyAdapterOptions as i, type DeepLinkProvider as j, type DpopProofInput as k, type NativeDpopModuleSpec as l, type NativePasskeyCeremonyAdapter as m, type NativePasskeyModuleSpec as n, createDefaultExpoAdapter as o, createNativeDpopProver as p, createNativePasskeyAdapter as q, type AppStateSubscription as r, type DeepLinkSubscription as s, type NetInfoSubscription as t, probePlatformAuthenticator as u };

package/package.json

@@ -1,7 +1,98 @@
 {
   "name": "@rakomi/react-native",
-  "version": "0.0.0",
-  "description": "Reserved placeholder — first stable release published via OIDC provenance. Do not install.",
-  "license": "Apache-2.0",
-  "private": false
-}
+  "version": "0.2.0",
+  "description": "React Native / Expo SDK for Rakomi authentication.",
+  "keywords": [
+    "rakomi",
+    "authentication",
+    "auth",
+    "oauth",
+    "oidc",
+    "react-native",
+    "expo",
+    "sdk"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rakomidev/rakomi-js.git"
+  },
+  "bugs": {
+    "url": "https://github.com/rakomidev/rakomi-js/issues"
+  },
+  "homepage": "https://github.com/rakomidev/rakomi-js#readme",
+  "rakomi": {
+    "apiVersion": "2026-03-01"
+  },
+  "publishConfig": {
+    "provenance": true
+  },
+  "type": "module",
+  "license": "MIT",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./native": {
+      "import": {
+        "types": "./dist/native/index.d.ts",
+        "default": "./dist/native/index.js"
+      },
+      "require": {
+        "types": "./dist/native/index.d.cts",
+        "default": "./dist/native/index.cjs"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "author": "CRE8EVE Sp. z o.o.",
+  "files": [
+    "dist",
+    "!dist/metafile-*.json",
+    "README.md",
+    "LICENSE",
+    "SECURITY.md",
+    "COMPLIANCE.md",
+    "THIRD-PARTY-NOTICES",
+    "sbom.cdx.json"
+  ],
+  "peerDependencies": {
+    "expo": ">=54",
+    "react": ">=18",
+    "react-native": ">=0.81"
+  },
+  "peerDependenciesMeta": {
+    "expo": {
+      "optional": true
+    },
+    "react-native": {
+      "optional": false
+    },
+    "react": {
+      "optional": false
+    }
+  },
+  "devDependencies": {
+    "@rakomi/react": "0.2.0"
+  },
+  "dependencies": {
+    "jose": "^6.2.3",
+    "@rakomi/sdk-core": "^0.2.0"
+  },
+  "scripts": {
+    "build": "NODE_OPTIONS=--max-old-space-size=4096 tsup",
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.typetest.json",
+    "lint": "eslint src/ test/ --max-warnings=0",
+    "test": "vitest run"
+  }
+}

package/sbom.cdx.json

@@ -0,0 +1,72 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.6",
+  "version": 1,
+  "metadata": {
+    "supplier": {
+      "name": "CRE8EVE Sp. z o.o.",
+      "url": [
+        "https://rakomi.com"
+      ]
+    },
+    "authors": [
+      {
+        "name": "CRE8EVE Sp. z o.o."
+      }
+    ],
+    "tools": {
+      "components": [
+        {
+          "type": "application",
+          "group": "rakomi",
+          "name": "generate-sbom",
+          "version": "sha256:9472206f8105"
+        }
+      ]
+    },
+    "component": {
+      "type": "library",
+      "bom-ref": "pkg:npm/%40rakomi%2Freact-native@0.2.0",
+      "name": "@rakomi/react-native",
+      "version": "0.2.0",
+      "purl": "pkg:npm/%40rakomi%2Freact-native@0.2.0",
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ]
+    }
+  },
+  "components": [
+    {
+      "type": "library",
+      "bom-ref": "pkg:npm/@rakomi/sdk-core@0.2.0",
+      "name": "@rakomi/sdk-core",
+      "version": "0.2.0",
+      "purl": "pkg:npm/@rakomi/sdk-core@0.2.0",
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ]
+    },
+    {
+      "type": "library",
+      "bom-ref": "pkg:npm/jose@6.2.9",
+      "name": "jose",
+      "version": "6.2.9",
+      "purl": "pkg:npm/jose@6.2.9",
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ]
+    }
+  ]
+}