@rakomi/react-native 0.1.0 → 0.2.0

package/dist/{expo-adapter-CtPCEgue.d.cts → passkey-adapter-D_Z3Z7lV.d.cts}

@@ -1,4 +1,4 @@
-import { CryptoProvider, KeyValueStore } from '@rakomi/sdk-core';
+import { CryptoProvider, KeyValueStore, PasskeyCeremonyAdapter } from '@rakomi/sdk-core';
 
 /**
  * `NativeAuthAdapter` — single typed surface that swaps every
@@ -202,6 +202,21 @@ interface NativeAuthAdapter {
     readonly par?: ParClient;
     /** Optional best-effort background refresh hook. */
     readonly backgroundTask?: BackgroundTask;
+    /**
+     * The passkey ceremony, delegated to the platform.
+     *
+     * The contract is `@rakomi/sdk-core`'s `PasskeyCeremonyAdapter` — imported, never re-declared
+     * here. A second interface for the same thing would let the browser binding and the native
+     * binding drift, and the conformance suite both of them run could only ever test one of them.
+     *
+     * Build one with `createNativePasskeyAdapter({ module })` from `@rakomi/react-native/native`.
+     * On Expo web a host may put a browser adapter in this same slot — the slot is platform-agnostic.
+     *
+     * A future SECOND ceremony type (a device-bound key, a hybrid/CTAP flow) gets its OWN optional
+     * slot; this one never becomes a type union. A union would destroy the totality of the shared
+     * conformance suite, which validates exactly ONE contract.
+     */
+    readonly passkeys?: PasskeyCeremonyAdapter;
 }
 /**
  * `tokenCache` injection sugar (shorthand).
@@ -296,4 +311,159 @@ interface CreateDefaultExpoAdapterOptions {
     tokenCache?: TokenCache;
 }
 
-export { type AppLifecycle as A, type BackgroundTask as B, type ConnectivityProvider as C, type DpopProver as D, type NativeAuthAdapter as N, type ParClient as P, type SystemBrowser as S, type TokenCache as T, type AppStateValue as a, type AttestationVerifier as b, type BiometricGate as c, type BiometricResult as d, type BrowserAuthSessionOptions as e, type BrowserAuthSessionResult as f, type CreateDefaultExpoAdapterOptions as g, type CreateNativeDpopProverOptions as h, type DeepLinkProvider as i, type DpopProofInput as j, type NativeDpopModuleSpec as k, createDefaultExpoAdapter as l, createNativeDpopProver as m, type AppStateSubscription as n, type DeepLinkSubscription as o, type NetInfoSubscription as p };
+/**
+ * The raw native-module surface a host exposes for passkey ceremonies.
+ *
+ * It is a structural duck-type: no brand, no symbol, no base class. **Any module satisfying this
+ * spec is a drop-in replacement; the SDK does not know which one you used** — your own Swift/Kotlin
+ * module, a community package, or a future first-party Expo module.
+ *
+ * ## What crosses the bridge
+ *
+ * Both ceremony methods take the server's options as a **JSON string** and resolve the finished
+ * credential as a **JSON string**. See the file header for why this is not an object.
+ *
+ * ## What the module MUST return (W3C WebAuthn **Level 3** JSON serialization, §5.1.8 / §5.1.9 —
+ * Candidate Recommendation; these JSON dictionaries do not exist in Level 2)
+ *
+ * `createPasskey` (registration):
+ *
+ * | member | required |
+ * |---|---|
+ * | `id`, `rawId`, `type: "public-key"` | MUST |
+ * | `response.clientDataJSON`, `response.attestationObject` | MUST |
+ * | `response.authenticatorData`, `response.publicKeyAlgorithm` | MUST |
+ * | `response.transports` | MUST (omitting it silently degrades later autofill) |
+ * | `clientExtensionResults` | MUST |
+ * | `authenticatorAttachment`, `response.publicKey` | optional |
+ *
+ * `getPasskey` (assertion):
+ *
+ * | member | required |
+ * |---|---|
+ * | `id`, `rawId`, `type: "public-key"` | MUST |
+ * | `response.clientDataJSON`, `response.authenticatorData`, `response.signature` | MUST |
+ * | `clientExtensionResults` | MUST |
+ * | `response.userHandle` | optional |
+ *
+ * **ENCODING — the single most common integration failure.** Every binary member is
+ * **base64url WITHOUT padding** (RFC 4648 **§5**). On iOS, `Data.base64EncodedString()` emits
+ * *standard* base64 (RFC 4648 **§4**, with `+`, `/` and `=`) — that is WRONG and the bridge rejects
+ * it with a message naming the field.
+ *
+ * (The bridge ENFORCES a subset of the table above — the fields the SDK's own fixtures carry and the
+ * server actually consumes. The rest are a MUST for you, not a MUST for the validator; sending them
+ * is what keeps your integration correct as the server tightens.)
+ *
+ * ## Rejection vocabulary — CLOSED
+ *
+ * Reject with an object carrying a `code`:
+ * - `PASSKEY_CANCELLED` — the user dismissed the sheet, or the OS cancelled.
+ * - `PASSKEY_UNSUPPORTED` — no passkey support on this OS version, or no credential provider.
+ * - `PASSKEY_NO_CREDENTIAL` — the user has no passkey for this relying party.
+ *
+ * Any other rejection is a genuine failure and is passed through untouched. **Do NOT set a
+ * rejection's `name` to `AbortError` / `NotAllowedError` / `TimeoutError` unless it really is a
+ * cancellation** — the SDK matches on those names and will read your intent as "the user cancelled".
+ *
+ * ## Stability (this is a SemVer surface even though we never compile your module)
+ *
+ * Your module is Swift or Kotlin: our typecheck will never see it, so a breaking change to this spec
+ * breaks every existing module **at runtime**, not at compile time — and the SDK's 24-month support
+ * policy means a module written today must still satisfy this spec two years from now. Therefore:
+ * - a new **optional** member → MINOR;
+ * - a new **optional trailing parameter** on an existing method → MINOR (a lower-arity function
+ *   stays assignable — which is exactly why we do not reserve parameters "just in case");
+ * - a **required** method, a parameter-type change, or a change to the rejection vocabulary → MAJOR;
+ * - the rejection vocabulary is CLOSED: a new code is first a change in `@rakomi/sdk-core`, and only
+ *   then a lane here.
+ *
+ * ## Orphan credentials — a residual you should know about
+ *
+ * If a registration ceremony is abandoned *after* the platform provider (iCloud Keychain / Google
+ * Password Manager) already created the credential, the user holds a passkey for your app that the
+ * server never learned about; their next sign-in with it fails. Implementing
+ * {@link NativePasskeyModuleSpec.cancelPasskeyRequest} narrows that window. The SDK does not
+ * reconcile orphans.
+ */
+interface NativePasskeyModuleSpec {
+    /**
+     * Whether this platform can run a passkey ceremony at all.
+     *
+     * **Advisory, not a verdict.** Every module in the ecosystem answers this from the OS version, so
+     * it says `true` on an Android emulator with no credential provider and on an iOS version where
+     * the platform provider does not exist. The SDK treats a throw or a non-`true` value as `false`
+     * (fail-closed) but cannot catch an honest `true` with no provider behind it — the authoritative
+     * verdict is the ceremony's own outcome.
+     */
+    isPasskeySupported(): Promise<boolean>;
+    /** Run the registration ceremony. `requestJson` is the server's options, verbatim. */
+    createPasskey(requestJson: string): Promise<string>;
+    /** Run the assertion ceremony. `requestJson` is the server's options, verbatim. */
+    getPasskey(requestJson: string): Promise<string>;
+    /**
+     * Optional: is a *platform* authenticator (Face ID / fingerprint / screen lock) available?
+     *
+     * A UI hint only — never a gate. A synced passkey on another device is still a passkey, so a
+     * `false` here does not mean "no passkeys". Omit it and the SDK reports `null` (unknown) rather
+     * than guessing.
+     */
+    isPlatformAuthenticatorAvailable?(): Promise<boolean>;
+    /**
+     * Optional: dismiss the in-flight native sheet (iOS `ASAuthorizationController.cancel()`;
+     * Android's `CredentialManager` calls are cancellable). Best-effort — a throw is ignored.
+     *
+     * It takes no request id because the native side has nothing to correlate against: the passkey sheet
+     * is an **OS-global modal**, and a cancel dismisses whatever is on screen. The SDK does NOT serialise
+     * ceremonies — nothing here can, since the sheet is owned by the OS — so the bridge instead fires the
+     * cancel only while the aborting ceremony is still the one in flight, making a stale abort a no-op
+     * rather than a teardown of somebody else's sheet. Preventing a second ceremony from being STARTED is
+     * a UI concern and belongs to the provider.
+     */
+    cancelPasskeyRequest?(): void | Promise<void>;
+}
+interface CreateNativePasskeyAdapterOptions {
+    /**
+     * The host's native passkey module. On bare RN this is the linked native module
+     * (`NativeModules.RakomiPasskey`); on Expo it is the Expo module's JS surface; it may also be a
+     * community package wrapped to satisfy {@link NativePasskeyModuleSpec}.
+     */
+    module: NativePasskeyModuleSpec;
+}
+/**
+ * Adapt a host's native passkey module to the canonical `PasskeyCeremonyAdapter` contract. Wire the
+ * result into `NativeAuthAdapter.passkeys`.
+ *
+ * The module's SHAPE is validated here, at wiring time, and a missing method throws loudly — in the
+ * host's adapter-construction code, where the bug is, rather than degrading to "passkeys are not
+ * supported on this device", which is a lie that hides the host's bug. An ABSENT adapter and a
+ * BROKEN adapter are different diagnoses and must not be collapsed.
+ *
+ * @public — additive-only.
+ */
+/**
+ * The core's ceremony contract, plus the one native-only capability the hook needs and the contract
+ * has no place for: the platform-authenticator hint. It is attached HERE rather than plumbed through
+ * the host, because the probe needs the MODULE and the hook only ever sees the adapter.
+ *
+ * Structurally a `PasskeyCeremonyAdapter`, so it drops into `nativeAdapter.passkeys` unchanged.
+ */
+interface NativePasskeyCeremonyAdapter extends PasskeyCeremonyAdapter {
+    /** `true` / `false` / `null` — and `null` means UNKNOWN, never "no". */
+    hasPlatformAuthenticator(): Promise<boolean | null>;
+}
+declare function createNativePasskeyAdapter(options: CreateNativePasskeyAdapterOptions): NativePasskeyCeremonyAdapter;
+/**
+ * Ask the host's module whether a *platform* authenticator is available.
+ *
+ * `null` means **unknown**, and it is `null` in all three shapes of "the module does not really
+ * implement this", because in React Native a missing method has three shapes, not one: it is absent
+ * (a legacy `NativeModules` object), or it exists but throws synchronously (a TurboModule whose
+ * codegen compiled the spec but whose native side did not implement it), or it exists but rejects
+ * (an Expo module proxy). None of them may answer `false` — that would be the lie "this device has
+ * no platform authenticator" — and none of them may be inferred from `isSupported()`, because a
+ * synced passkey is a passkey without a local platform authenticator.
+ */
+declare function probePlatformAuthenticator(mod: NativePasskeyModuleSpec): Promise<boolean | null>;
+
+export { type AppLifecycle as A, type BackgroundTask as B, type ConnectivityProvider as C, type DpopProver as D, type NativeAuthAdapter as N, type ParClient as P, type SystemBrowser as S, type TokenCache as T, type AppStateValue as a, type AttestationVerifier as b, type BiometricGate as c, type BiometricResult as d, type BrowserAuthSessionOptions as e, type BrowserAuthSessionResult as f, type CreateDefaultExpoAdapterOptions as g, type CreateNativeDpopProverOptions as h, type CreateNativePasskeyAdapterOptions as i, type DeepLinkProvider as j, type DpopProofInput as k, type NativeDpopModuleSpec as l, type NativePasskeyCeremonyAdapter as m, type NativePasskeyModuleSpec as n, createDefaultExpoAdapter as o, createNativeDpopProver as p, createNativePasskeyAdapter as q, type AppStateSubscription as r, type DeepLinkSubscription as s, type NetInfoSubscription as t, probePlatformAuthenticator as u };

package/dist/{expo-adapter-CtPCEgue.d.ts → passkey-adapter-D_Z3Z7lV.d.ts}

@@ -1,4 +1,4 @@
-import { CryptoProvider, KeyValueStore } from '@rakomi/sdk-core';
+import { CryptoProvider, KeyValueStore, PasskeyCeremonyAdapter } from '@rakomi/sdk-core';
 
 /**
  * `NativeAuthAdapter` — single typed surface that swaps every
@@ -202,6 +202,21 @@ interface NativeAuthAdapter {
     readonly par?: ParClient;
     /** Optional best-effort background refresh hook. */
     readonly backgroundTask?: BackgroundTask;
+    /**
+     * The passkey ceremony, delegated to the platform.
+     *
+     * The contract is `@rakomi/sdk-core`'s `PasskeyCeremonyAdapter` — imported, never re-declared
+     * here. A second interface for the same thing would let the browser binding and the native
+     * binding drift, and the conformance suite both of them run could only ever test one of them.
+     *
+     * Build one with `createNativePasskeyAdapter({ module })` from `@rakomi/react-native/native`.
+     * On Expo web a host may put a browser adapter in this same slot — the slot is platform-agnostic.
+     *
+     * A future SECOND ceremony type (a device-bound key, a hybrid/CTAP flow) gets its OWN optional
+     * slot; this one never becomes a type union. A union would destroy the totality of the shared
+     * conformance suite, which validates exactly ONE contract.
+     */
+    readonly passkeys?: PasskeyCeremonyAdapter;
 }
 /**
  * `tokenCache` injection sugar (shorthand).
@@ -296,4 +311,159 @@ interface CreateDefaultExpoAdapterOptions {
     tokenCache?: TokenCache;
 }
 
-export { type AppLifecycle as A, type BackgroundTask as B, type ConnectivityProvider as C, type DpopProver as D, type NativeAuthAdapter as N, type ParClient as P, type SystemBrowser as S, type TokenCache as T, type AppStateValue as a, type AttestationVerifier as b, type BiometricGate as c, type BiometricResult as d, type BrowserAuthSessionOptions as e, type BrowserAuthSessionResult as f, type CreateDefaultExpoAdapterOptions as g, type CreateNativeDpopProverOptions as h, type DeepLinkProvider as i, type DpopProofInput as j, type NativeDpopModuleSpec as k, createDefaultExpoAdapter as l, createNativeDpopProver as m, type AppStateSubscription as n, type DeepLinkSubscription as o, type NetInfoSubscription as p };
+/**
+ * The raw native-module surface a host exposes for passkey ceremonies.
+ *
+ * It is a structural duck-type: no brand, no symbol, no base class. **Any module satisfying this
+ * spec is a drop-in replacement; the SDK does not know which one you used** — your own Swift/Kotlin
+ * module, a community package, or a future first-party Expo module.
+ *
+ * ## What crosses the bridge
+ *
+ * Both ceremony methods take the server's options as a **JSON string** and resolve the finished
+ * credential as a **JSON string**. See the file header for why this is not an object.
+ *
+ * ## What the module MUST return (W3C WebAuthn **Level 3** JSON serialization, §5.1.8 / §5.1.9 —
+ * Candidate Recommendation; these JSON dictionaries do not exist in Level 2)
+ *
+ * `createPasskey` (registration):
+ *
+ * | member | required |
+ * |---|---|
+ * | `id`, `rawId`, `type: "public-key"` | MUST |
+ * | `response.clientDataJSON`, `response.attestationObject` | MUST |
+ * | `response.authenticatorData`, `response.publicKeyAlgorithm` | MUST |
+ * | `response.transports` | MUST (omitting it silently degrades later autofill) |
+ * | `clientExtensionResults` | MUST |
+ * | `authenticatorAttachment`, `response.publicKey` | optional |
+ *
+ * `getPasskey` (assertion):
+ *
+ * | member | required |
+ * |---|---|
+ * | `id`, `rawId`, `type: "public-key"` | MUST |
+ * | `response.clientDataJSON`, `response.authenticatorData`, `response.signature` | MUST |
+ * | `clientExtensionResults` | MUST |
+ * | `response.userHandle` | optional |
+ *
+ * **ENCODING — the single most common integration failure.** Every binary member is
+ * **base64url WITHOUT padding** (RFC 4648 **§5**). On iOS, `Data.base64EncodedString()` emits
+ * *standard* base64 (RFC 4648 **§4**, with `+`, `/` and `=`) — that is WRONG and the bridge rejects
+ * it with a message naming the field.
+ *
+ * (The bridge ENFORCES a subset of the table above — the fields the SDK's own fixtures carry and the
+ * server actually consumes. The rest are a MUST for you, not a MUST for the validator; sending them
+ * is what keeps your integration correct as the server tightens.)
+ *
+ * ## Rejection vocabulary — CLOSED
+ *
+ * Reject with an object carrying a `code`:
+ * - `PASSKEY_CANCELLED` — the user dismissed the sheet, or the OS cancelled.
+ * - `PASSKEY_UNSUPPORTED` — no passkey support on this OS version, or no credential provider.
+ * - `PASSKEY_NO_CREDENTIAL` — the user has no passkey for this relying party.
+ *
+ * Any other rejection is a genuine failure and is passed through untouched. **Do NOT set a
+ * rejection's `name` to `AbortError` / `NotAllowedError` / `TimeoutError` unless it really is a
+ * cancellation** — the SDK matches on those names and will read your intent as "the user cancelled".
+ *
+ * ## Stability (this is a SemVer surface even though we never compile your module)
+ *
+ * Your module is Swift or Kotlin: our typecheck will never see it, so a breaking change to this spec
+ * breaks every existing module **at runtime**, not at compile time — and the SDK's 24-month support
+ * policy means a module written today must still satisfy this spec two years from now. Therefore:
+ * - a new **optional** member → MINOR;
+ * - a new **optional trailing parameter** on an existing method → MINOR (a lower-arity function
+ *   stays assignable — which is exactly why we do not reserve parameters "just in case");
+ * - a **required** method, a parameter-type change, or a change to the rejection vocabulary → MAJOR;
+ * - the rejection vocabulary is CLOSED: a new code is first a change in `@rakomi/sdk-core`, and only
+ *   then a lane here.
+ *
+ * ## Orphan credentials — a residual you should know about
+ *
+ * If a registration ceremony is abandoned *after* the platform provider (iCloud Keychain / Google
+ * Password Manager) already created the credential, the user holds a passkey for your app that the
+ * server never learned about; their next sign-in with it fails. Implementing
+ * {@link NativePasskeyModuleSpec.cancelPasskeyRequest} narrows that window. The SDK does not
+ * reconcile orphans.
+ */
+interface NativePasskeyModuleSpec {
+    /**
+     * Whether this platform can run a passkey ceremony at all.
+     *
+     * **Advisory, not a verdict.** Every module in the ecosystem answers this from the OS version, so
+     * it says `true` on an Android emulator with no credential provider and on an iOS version where
+     * the platform provider does not exist. The SDK treats a throw or a non-`true` value as `false`
+     * (fail-closed) but cannot catch an honest `true` with no provider behind it — the authoritative
+     * verdict is the ceremony's own outcome.
+     */
+    isPasskeySupported(): Promise<boolean>;
+    /** Run the registration ceremony. `requestJson` is the server's options, verbatim. */
+    createPasskey(requestJson: string): Promise<string>;
+    /** Run the assertion ceremony. `requestJson` is the server's options, verbatim. */
+    getPasskey(requestJson: string): Promise<string>;
+    /**
+     * Optional: is a *platform* authenticator (Face ID / fingerprint / screen lock) available?
+     *
+     * A UI hint only — never a gate. A synced passkey on another device is still a passkey, so a
+     * `false` here does not mean "no passkeys". Omit it and the SDK reports `null` (unknown) rather
+     * than guessing.
+     */
+    isPlatformAuthenticatorAvailable?(): Promise<boolean>;
+    /**
+     * Optional: dismiss the in-flight native sheet (iOS `ASAuthorizationController.cancel()`;
+     * Android's `CredentialManager` calls are cancellable). Best-effort — a throw is ignored.
+     *
+     * It takes no request id because the native side has nothing to correlate against: the passkey sheet
+     * is an **OS-global modal**, and a cancel dismisses whatever is on screen. The SDK does NOT serialise
+     * ceremonies — nothing here can, since the sheet is owned by the OS — so the bridge instead fires the
+     * cancel only while the aborting ceremony is still the one in flight, making a stale abort a no-op
+     * rather than a teardown of somebody else's sheet. Preventing a second ceremony from being STARTED is
+     * a UI concern and belongs to the provider.
+     */
+    cancelPasskeyRequest?(): void | Promise<void>;
+}
+interface CreateNativePasskeyAdapterOptions {
+    /**
+     * The host's native passkey module. On bare RN this is the linked native module
+     * (`NativeModules.RakomiPasskey`); on Expo it is the Expo module's JS surface; it may also be a
+     * community package wrapped to satisfy {@link NativePasskeyModuleSpec}.
+     */
+    module: NativePasskeyModuleSpec;
+}
+/**
+ * Adapt a host's native passkey module to the canonical `PasskeyCeremonyAdapter` contract. Wire the
+ * result into `NativeAuthAdapter.passkeys`.
+ *
+ * The module's SHAPE is validated here, at wiring time, and a missing method throws loudly — in the
+ * host's adapter-construction code, where the bug is, rather than degrading to "passkeys are not
+ * supported on this device", which is a lie that hides the host's bug. An ABSENT adapter and a
+ * BROKEN adapter are different diagnoses and must not be collapsed.
+ *
+ * @public — additive-only.
+ */
+/**
+ * The core's ceremony contract, plus the one native-only capability the hook needs and the contract
+ * has no place for: the platform-authenticator hint. It is attached HERE rather than plumbed through
+ * the host, because the probe needs the MODULE and the hook only ever sees the adapter.
+ *
+ * Structurally a `PasskeyCeremonyAdapter`, so it drops into `nativeAdapter.passkeys` unchanged.
+ */
+interface NativePasskeyCeremonyAdapter extends PasskeyCeremonyAdapter {
+    /** `true` / `false` / `null` — and `null` means UNKNOWN, never "no". */
+    hasPlatformAuthenticator(): Promise<boolean | null>;
+}
+declare function createNativePasskeyAdapter(options: CreateNativePasskeyAdapterOptions): NativePasskeyCeremonyAdapter;
+/**
+ * Ask the host's module whether a *platform* authenticator is available.
+ *
+ * `null` means **unknown**, and it is `null` in all three shapes of "the module does not really
+ * implement this", because in React Native a missing method has three shapes, not one: it is absent
+ * (a legacy `NativeModules` object), or it exists but throws synchronously (a TurboModule whose
+ * codegen compiled the spec but whose native side did not implement it), or it exists but rejects
+ * (an Expo module proxy). None of them may answer `false` — that would be the lie "this device has
+ * no platform authenticator" — and none of them may be inferred from `isSupported()`, because a
+ * synced passkey is a passkey without a local platform authenticator.
+ */
+declare function probePlatformAuthenticator(mod: NativePasskeyModuleSpec): Promise<boolean | null>;
+
+export { type AppLifecycle as A, type BackgroundTask as B, type ConnectivityProvider as C, type DpopProver as D, type NativeAuthAdapter as N, type ParClient as P, type SystemBrowser as S, type TokenCache as T, type AppStateValue as a, type AttestationVerifier as b, type BiometricGate as c, type BiometricResult as d, type BrowserAuthSessionOptions as e, type BrowserAuthSessionResult as f, type CreateDefaultExpoAdapterOptions as g, type CreateNativeDpopProverOptions as h, type CreateNativePasskeyAdapterOptions as i, type DeepLinkProvider as j, type DpopProofInput as k, type NativeDpopModuleSpec as l, type NativePasskeyCeremonyAdapter as m, type NativePasskeyModuleSpec as n, createDefaultExpoAdapter as o, createNativeDpopProver as p, createNativePasskeyAdapter as q, type AppStateSubscription as r, type DeepLinkSubscription as s, type NetInfoSubscription as t, probePlatformAuthenticator as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rakomi/react-native",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "React Native / Expo SDK for Rakomi authentication.",
   "keywords": [
     "rakomi",
@@ -83,11 +83,11 @@
     }
   },
   "devDependencies": {
-    "@rakomi/react": "0.1.0"
+    "@rakomi/react": "0.2.0"
   },
   "dependencies": {
     "jose": "^6.2.3",
-    "@rakomi/sdk-core": "^0.1.0"
+    "@rakomi/sdk-core": "^0.2.0"
   },
   "scripts": {
     "build": "NODE_OPTIONS=--max-old-space-size=4096 tsup",

package/sbom.cdx.json

@@ -3,9 +3,15 @@
   "specVersion": "1.6",
   "version": 1,
   "metadata": {
+    "supplier": {
+      "name": "CRE8EVE Sp. z o.o.",
+      "url": [
+        "https://rakomi.com"
+      ]
+    },
     "authors": [
       {
-        "name": "CRE8EVE"
+        "name": "CRE8EVE Sp. z o.o."
       }
     ],
     "tools": {
@@ -14,16 +20,16 @@
           "type": "application",
           "group": "rakomi",
           "name": "generate-sbom",
-          "version": "sha256:6612f58a07b8"
+          "version": "sha256:9472206f8105"
         }
       ]
     },
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/%40rakomi%2Freact-native@0.1.0",
+      "bom-ref": "pkg:npm/%40rakomi%2Freact-native@0.2.0",
       "name": "@rakomi/react-native",
-      "version": "0.1.0",
-      "purl": "pkg:npm/%40rakomi%2Freact-native@0.1.0",
+      "version": "0.2.0",
+      "purl": "pkg:npm/%40rakomi%2Freact-native@0.2.0",
       "licenses": [
         {
           "license": {
@@ -36,10 +42,10 @@
   "components": [
     {
       "type": "library",
-      "bom-ref": "pkg:npm/@rakomi/sdk-core@0.1.0",
+      "bom-ref": "pkg:npm/@rakomi/sdk-core@0.2.0",
       "name": "@rakomi/sdk-core",
-      "version": "0.1.0",
-      "purl": "pkg:npm/@rakomi/sdk-core@0.1.0",
+      "version": "0.2.0",
+      "purl": "pkg:npm/@rakomi/sdk-core@0.2.0",
       "licenses": [
         {
           "license": {
@@ -50,10 +56,10 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:npm/jose@6.2.3",
+      "bom-ref": "pkg:npm/jose@6.2.9",
       "name": "jose",
-      "version": "6.2.3",
-      "purl": "pkg:npm/jose@6.2.3",
+      "version": "6.2.9",
+      "purl": "pkg:npm/jose@6.2.9",
       "licenses": [
         {
           "license": {