@rakomi/react-native 0.0.0 → 0.2.0

package/dist/native/index.d.cts

@@ -0,0 +1,143 @@
+import { N as NativeAuthAdapter } from '../passkey-adapter-D_Z3Z7lV.cjs';
+export { A as AppLifecycle, r as AppStateSubscription, a as AppStateValue, b as AttestationVerifier, B as BackgroundTask, c as BiometricGate, d as BiometricResult, e as BrowserAuthSessionOptions, f as BrowserAuthSessionResult, C as ConnectivityProvider, g as CreateDefaultExpoAdapterOptions, h as CreateNativeDpopProverOptions, i as CreateNativePasskeyAdapterOptions, j as DeepLinkProvider, s as DeepLinkSubscription, k as DpopProofInput, D as DpopProver, l as NativeDpopModuleSpec, m as NativePasskeyCeremonyAdapter, n as NativePasskeyModuleSpec, t as NetInfoSubscription, P as ParClient, S as SystemBrowser, T as TokenCache, o as createDefaultExpoAdapter, p as createNativeDpopProver, q as createNativePasskeyAdapter, u as probePlatformAuthenticator } from '../passkey-adapter-D_Z3Z7lV.cjs';
+import '@rakomi/sdk-core';
+
+/**
+ * Reference implementation: bare React Native `NativeAuthAdapter`.
+ *
+ * For consumers NOT on Expo. Wires the same contract the default Expo adapter
+ * implements (`createDefaultExpoAdapter`) but using bare-RN-friendly community
+ * packages:
+ *
+ * - `react-native-keychain` for secure storage
+ * - `react-native-inappbrowser-reborn` for system browser (Custom Tabs / SFSafariViewController)
+ * - `react-native-quick-crypto` for `getRandomBytes` + `digestSha256`
+ * - `react-native/Linking` for deep-link callback ingest
+ * - `react-native-biometrics` for biometric gate
+ * - `react-native/AppState` for app-lifecycle transitions
+ * - `@react-native-community/netinfo` for connectivity
+ *
+ * **Not a default export** bare-RN consumers MUST call `createBareRnAdapter`
+ * explicitly and pass the result via `<RakomiProvider nativeAdapter={...}>`. We
+ * keep this in `src/native/` as documentation/reference; the actual implementation
+ * stubs are intentional — `NotImplementedError` thrown lines indicate where the
+ * bare-RN package import goes. Replace the throws with the real package binding.
+ *
+ * Why stubbed: bare-RN packages have install-time native code that can't be
+ * imported at SDK build time. Consumer's bundler links them at app build.
+ */
+
+interface CreateBareRnAdapterOptions {
+    /** Required injection — `react-native-quick-crypto` named exports. */
+    quickCrypto: {
+        randomBytes(length: number): Uint8Array;
+        createHash(alg: 'sha256'): {
+            update(b: Uint8Array): {
+                digest(): Uint8Array;
+            };
+        };
+    };
+    /** Required injection — `react-native-keychain` namespace. */
+    keychain: {
+        setGenericPassword(username: string, password: string, options: {
+            service: string;
+            accessible?: string;
+        }): Promise<unknown>;
+        getGenericPassword(options: {
+            service: string;
+            authenticationPrompt?: {
+                title: string;
+            };
+        }): Promise<{
+            username: string;
+            password: string;
+        } | false>;
+        resetGenericPassword(options: {
+            service: string;
+        }): Promise<boolean>;
+    };
+    /** Required injection — `react-native-inappbrowser-reborn` namespace. */
+    inAppBrowser: {
+        isAvailable(): Promise<boolean>;
+        openAuth(url: string, redirectUri: string, options?: {
+            ephemeralWebSession?: boolean;
+        }): Promise<{
+            type: 'success' | 'cancel' | 'dismiss';
+            url?: string;
+        }>;
+    };
+    /** Required injection — `react-native-biometrics` instance. */
+    biometrics: {
+        isSensorAvailable(): Promise<{
+            available: boolean;
+            biometryType?: string;
+        }>;
+        simplePrompt(options: {
+            promptMessage: string;
+            cancelButtonText?: string;
+        }): Promise<{
+            success: boolean;
+            error?: string;
+        }>;
+    };
+    /** Required injection — `react-native/Linking` namespace. */
+    linking: {
+        getInitialURL(): Promise<string | null>;
+        addEventListener(event: 'url', handler: (e: {
+            url: string;
+        }) => void): {
+            remove(): void;
+        };
+    };
+    /** Required injection — `react-native/AppState` namespace. */
+    appState: {
+        currentState: 'active' | 'background' | 'inactive' | 'unknown';
+        addEventListener(event: 'change', handler: (state: 'active' | 'background' | 'inactive' | 'unknown') => void): {
+            remove(): void;
+        };
+    };
+    /** Required injection — `@react-native-community/netinfo` namespace. */
+    netInfo: {
+        fetch(): Promise<{
+            isConnected: boolean | null;
+        }>;
+        addEventListener(handler: (state: {
+            isConnected: boolean | null;
+        }) => void): () => void;
+    };
+    /** Tenant-scoped Keychain service prefix. Default `'rakomi'`. */
+    keychainServicePrefix?: string;
+}
+declare function createBareRnAdapter(options: CreateBareRnAdapterOptions): NativeAuthAdapter;
+
+/** Which ceremony produced this envelope. The required-set differs per direction — deliberately. */
+type CredentialEnvelopeKind = 'registration' | 'assertion';
+/** The envelope broke the W3C contract. Terminal: the module is broken, retrying changes nothing. */
+declare class CredentialEnvelopeError extends Error {
+    constructor(message: string);
+}
+/**
+ * Validate a parsed native response against the W3C envelope for `kind`.
+ *
+ * Throws {@link CredentialEnvelopeError} naming the field and the violated rule — never the field's
+ * VALUE. A `PasskeyError` message reaches logs and crash reporters; a credential id and a
+ * `clientDataJSON` are durable user identifiers, so the diagnosis must be free of them.
+ */
+declare function assertW3cCredentialEnvelope(kind: CredentialEnvelopeKind, parsed: unknown): void;
+/**
+ * Validate, then **re-project** the envelope onto the members the contract knows.
+ *
+ * Validating without projecting is a check, not a boundary. The bridge used to forward the whole parsed
+ * object, and the server accepts the credential as an opaque blob — so every extra member a buggy or
+ * hostile module invented rode straight through to persistence. A `transports` that is a *string*
+ * instead of an array, or a five-thousand-element array, lands in the database and then poisons every
+ * subsequent `allowCredentials` for that user. Dropping unknown members costs nothing (the server reads
+ * none of them) and closes the class outright, instead of blacklisting the shapes we happened to think
+ * of.
+ *
+ * `Object.create(null)` for the projection, so a `"__proto__"` key that survived `JSON.parse` as an own
+ * property cannot be carried into an object with a real prototype further down.
+ */
+declare function sanitizeCredentialEnvelope(kind: CredentialEnvelopeKind, parsed: unknown): Record<string, unknown>;
+
+export { type CreateBareRnAdapterOptions, CredentialEnvelopeError, type CredentialEnvelopeKind, NativeAuthAdapter, assertW3cCredentialEnvelope, createBareRnAdapter, sanitizeCredentialEnvelope };

package/dist/native/index.d.ts

@@ -0,0 +1,143 @@
+import { N as NativeAuthAdapter } from '../passkey-adapter-D_Z3Z7lV.js';
+export { A as AppLifecycle, r as AppStateSubscription, a as AppStateValue, b as AttestationVerifier, B as BackgroundTask, c as BiometricGate, d as BiometricResult, e as BrowserAuthSessionOptions, f as BrowserAuthSessionResult, C as ConnectivityProvider, g as CreateDefaultExpoAdapterOptions, h as CreateNativeDpopProverOptions, i as CreateNativePasskeyAdapterOptions, j as DeepLinkProvider, s as DeepLinkSubscription, k as DpopProofInput, D as DpopProver, l as NativeDpopModuleSpec, m as NativePasskeyCeremonyAdapter, n as NativePasskeyModuleSpec, t as NetInfoSubscription, P as ParClient, S as SystemBrowser, T as TokenCache, o as createDefaultExpoAdapter, p as createNativeDpopProver, q as createNativePasskeyAdapter, u as probePlatformAuthenticator } from '../passkey-adapter-D_Z3Z7lV.js';
+import '@rakomi/sdk-core';
+
+/**
+ * Reference implementation: bare React Native `NativeAuthAdapter`.
+ *
+ * For consumers NOT on Expo. Wires the same contract the default Expo adapter
+ * implements (`createDefaultExpoAdapter`) but using bare-RN-friendly community
+ * packages:
+ *
+ * - `react-native-keychain` for secure storage
+ * - `react-native-inappbrowser-reborn` for system browser (Custom Tabs / SFSafariViewController)
+ * - `react-native-quick-crypto` for `getRandomBytes` + `digestSha256`
+ * - `react-native/Linking` for deep-link callback ingest
+ * - `react-native-biometrics` for biometric gate
+ * - `react-native/AppState` for app-lifecycle transitions
+ * - `@react-native-community/netinfo` for connectivity
+ *
+ * **Not a default export** bare-RN consumers MUST call `createBareRnAdapter`
+ * explicitly and pass the result via `<RakomiProvider nativeAdapter={...}>`. We
+ * keep this in `src/native/` as documentation/reference; the actual implementation
+ * stubs are intentional — `NotImplementedError` thrown lines indicate where the
+ * bare-RN package import goes. Replace the throws with the real package binding.
+ *
+ * Why stubbed: bare-RN packages have install-time native code that can't be
+ * imported at SDK build time. Consumer's bundler links them at app build.
+ */
+
+interface CreateBareRnAdapterOptions {
+    /** Required injection — `react-native-quick-crypto` named exports. */
+    quickCrypto: {
+        randomBytes(length: number): Uint8Array;
+        createHash(alg: 'sha256'): {
+            update(b: Uint8Array): {
+                digest(): Uint8Array;
+            };
+        };
+    };
+    /** Required injection — `react-native-keychain` namespace. */
+    keychain: {
+        setGenericPassword(username: string, password: string, options: {
+            service: string;
+            accessible?: string;
+        }): Promise<unknown>;
+        getGenericPassword(options: {
+            service: string;
+            authenticationPrompt?: {
+                title: string;
+            };
+        }): Promise<{
+            username: string;
+            password: string;
+        } | false>;
+        resetGenericPassword(options: {
+            service: string;
+        }): Promise<boolean>;
+    };
+    /** Required injection — `react-native-inappbrowser-reborn` namespace. */
+    inAppBrowser: {
+        isAvailable(): Promise<boolean>;
+        openAuth(url: string, redirectUri: string, options?: {
+            ephemeralWebSession?: boolean;
+        }): Promise<{
+            type: 'success' | 'cancel' | 'dismiss';
+            url?: string;
+        }>;
+    };
+    /** Required injection — `react-native-biometrics` instance. */
+    biometrics: {
+        isSensorAvailable(): Promise<{
+            available: boolean;
+            biometryType?: string;
+        }>;
+        simplePrompt(options: {
+            promptMessage: string;
+            cancelButtonText?: string;
+        }): Promise<{
+            success: boolean;
+            error?: string;
+        }>;
+    };
+    /** Required injection — `react-native/Linking` namespace. */
+    linking: {
+        getInitialURL(): Promise<string | null>;
+        addEventListener(event: 'url', handler: (e: {
+            url: string;
+        }) => void): {
+            remove(): void;
+        };
+    };
+    /** Required injection — `react-native/AppState` namespace. */
+    appState: {
+        currentState: 'active' | 'background' | 'inactive' | 'unknown';
+        addEventListener(event: 'change', handler: (state: 'active' | 'background' | 'inactive' | 'unknown') => void): {
+            remove(): void;
+        };
+    };
+    /** Required injection — `@react-native-community/netinfo` namespace. */
+    netInfo: {
+        fetch(): Promise<{
+            isConnected: boolean | null;
+        }>;
+        addEventListener(handler: (state: {
+            isConnected: boolean | null;
+        }) => void): () => void;
+    };
+    /** Tenant-scoped Keychain service prefix. Default `'rakomi'`. */
+    keychainServicePrefix?: string;
+}
+declare function createBareRnAdapter(options: CreateBareRnAdapterOptions): NativeAuthAdapter;
+
+/** Which ceremony produced this envelope. The required-set differs per direction — deliberately. */
+type CredentialEnvelopeKind = 'registration' | 'assertion';
+/** The envelope broke the W3C contract. Terminal: the module is broken, retrying changes nothing. */
+declare class CredentialEnvelopeError extends Error {
+    constructor(message: string);
+}
+/**
+ * Validate a parsed native response against the W3C envelope for `kind`.
+ *
+ * Throws {@link CredentialEnvelopeError} naming the field and the violated rule — never the field's
+ * VALUE. A `PasskeyError` message reaches logs and crash reporters; a credential id and a
+ * `clientDataJSON` are durable user identifiers, so the diagnosis must be free of them.
+ */
+declare function assertW3cCredentialEnvelope(kind: CredentialEnvelopeKind, parsed: unknown): void;
+/**
+ * Validate, then **re-project** the envelope onto the members the contract knows.
+ *
+ * Validating without projecting is a check, not a boundary. The bridge used to forward the whole parsed
+ * object, and the server accepts the credential as an opaque blob — so every extra member a buggy or
+ * hostile module invented rode straight through to persistence. A `transports` that is a *string*
+ * instead of an array, or a five-thousand-element array, lands in the database and then poisons every
+ * subsequent `allowCredentials` for that user. Dropping unknown members costs nothing (the server reads
+ * none of them) and closes the class outright, instead of blacklisting the shapes we happened to think
+ * of.
+ *
+ * `Object.create(null)` for the projection, so a `"__proto__"` key that survived `JSON.parse` as an own
+ * property cannot be carried into an object with a real prototype further down.
+ */
+declare function sanitizeCredentialEnvelope(kind: CredentialEnvelopeKind, parsed: unknown): Record<string, unknown>;
+
+export { type CreateBareRnAdapterOptions, CredentialEnvelopeError, type CredentialEnvelopeKind, NativeAuthAdapter, assertW3cCredentialEnvelope, createBareRnAdapter, sanitizeCredentialEnvelope };