@umutcansu/react-native-pinvault 0.0.0-stage → 2.3.2

package/lib/module/index.js

@@ -0,0 +1,312 @@
+"use strict";
+
+// PinVault for React Native: a thin, typed bridge over the native PinVault
+// libraries. Pinning, keys, signature checks and vault decryption all stay
+// native; this file only shapes inputs and outputs and runs the app's
+// environment guard. Nothing here stores anything (no AsyncStorage) and nothing
+// here logs outside development builds.
+import NativePinVault from "./NativePinVault.js";
+export * from "./types.js";
+
+/** Error codes of rejected promises. */
+
+/** A rejected PinVault call. `exception` is the native exception (class name + message). */
+export class PinVaultError extends Error {
+  constructor(code, message, exception = null) {
+    super(message);
+    this.name = 'PinVaultError';
+    this.code = code;
+    this.exception = exception;
+  }
+}
+const KNOWN_CODES = new Set(['E_INVALID_CONFIG', 'E_INVALID_ARGUMENT', 'E_NOT_STARTED', 'E_FETCH', 'E_NO_ACTIVITY', 'E_NATIVE', 'E_NETWORKING_NOT_PINNED']);
+
+/** Native rejections → PinVaultError (keeps the native code, message and exception). */
+function toPinVaultError(error) {
+  if (error instanceof PinVaultError) return error;
+  const e = error ?? {};
+  const code = typeof e.code === 'string' && KNOWN_CODES.has(e.code) ? e.code : 'E_NATIVE';
+  const message = typeof e.message === 'string' ? e.message : 'PinVault native call failed';
+  const info = e.userInfo ?? null;
+  const exception = info && typeof info.exceptionName === 'string' ? {
+    name: info.exceptionName,
+    message: typeof info.exceptionMessage === 'string' ? info.exceptionMessage : null
+  } : null;
+  return new PinVaultError(code, message, exception);
+}
+async function call(promise) {
+  try {
+    return await promise;
+  } catch (error) {
+    throw toPinVaultError(error);
+  }
+}
+
+// ── Strict JSON ─────────────────────────────────────────────────────────────
+// JSON.stringify silently drops functions and turns NaN into null; the native
+// parser could then not refuse them. Anything that is not plain data is refused here.
+
+/** The native parsers' nesting limit (the root object is level 0). */
+const MAX_DEPTH = 8;
+function assertPlainData(value, path, code, depth = 0) {
+  // Before recursing further: a deep structure would otherwise overflow the JS stack.
+  if (depth > MAX_DEPTH) throw new PinVaultError(code, `${path}: nested too deeply`);
+  if (value === null) return;
+  switch (typeof value) {
+    case 'string':
+    case 'boolean':
+      return;
+    case 'number':
+      if (!Number.isFinite(value)) throw new PinVaultError(code, `${path}: not a finite number`);
+      return;
+    case 'object':
+      {
+        if (Array.isArray(value)) {
+          value.forEach((item, i) => {
+            if (item === undefined) throw new PinVaultError(code, `${path}[${i}]: undefined in a list`);
+            assertPlainData(item, `${path}[${i}]`, code, depth + 1);
+          });
+          return;
+        }
+        const proto = Object.getPrototypeOf(value);
+        if (proto !== Object.prototype && proto !== null) {
+          throw new PinVaultError(code, `${path}: must be a plain object`);
+        }
+        for (const [k, v] of Object.entries(value)) {
+          if (v === undefined) continue; // an optional field left out
+          assertPlainData(v, `${path}.${k}`, code, depth + 1);
+        }
+        return;
+      }
+    default:
+      throw new PinVaultError(code, `${path}: ${typeof value} is not allowed`);
+  }
+}
+function strictJson(value, path, code) {
+  assertPlainData(value, path, code);
+  return JSON.stringify(value);
+}
+
+// ── Environment guard ───────────────────────────────────────────────────────
+
+export const DEFAULT_GUARD_TIMEOUT_MS = 5000;
+let guardSubscription = null;
+
+/**
+ * Runs the app's guard with a timeout. Anything but a `true` within the time —
+ * `false`, another value, a thrown error, a rejected promise, no answer — is a refusal.
+ */
+export async function evaluateGuard(guard, operation, timeoutMs) {
+  let timer;
+  try {
+    const verdict = await Promise.race([Promise.resolve().then(() => guard(operation)), new Promise(resolve => {
+      timer = setTimeout(() => resolve(false), timeoutMs);
+    })]);
+    return verdict === true;
+  } catch (error) {
+    if (__DEV__) console.warn(`PinVault: environmentGuard threw for ${operation}; refused`, error);
+    return false;
+  } finally {
+    if (timer !== undefined) clearTimeout(timer);
+  }
+}
+const GUARDED_OPERATIONS = new Set(['INIT', 'ENROLL', 'FETCH_FILE', 'UNLOCK_FILE']);
+function installGuard(guard, timeoutMs) {
+  guardSubscription?.remove();
+  guardSubscription = null;
+  if (!guard) return;
+  // The JS answer must arrive before the native deadline; leave it a little room.
+  const jsTimeout = Math.max(50, timeoutMs - 100);
+  guardSubscription = NativePinVault.onGuardRequest(request => {
+    const operation = request.operation;
+    if (!GUARDED_OPERATIONS.has(operation)) {
+      NativePinVault.answerGuard(request.requestId, false);
+      return;
+    }
+    void evaluateGuard(guard, operation, jsTimeout).then(allowed => NativePinVault.answerGuard(request.requestId, allowed));
+  });
+}
+
+// ── Start / config ──────────────────────────────────────────────────────────
+
+/**
+ * Starts PinVault (`PinVault.init(context, config)` / `PinVault.shared.start(config:)`).
+ * Fail closed: until it returns `{ type: 'ready' }`, every pinned request is refused.
+ * An invalid config rejects with `E_INVALID_CONFIG` (unknown keys and wrong types included).
+ */
+export async function start(config) {
+  if (config === null || typeof config !== 'object' || Array.isArray(config)) {
+    throw new PinVaultError('E_INVALID_CONFIG', 'config: must be an object');
+  }
+  const {
+    environmentGuard,
+    environmentGuardTimeoutMs,
+    ...rest
+  } = config;
+  if (environmentGuard !== undefined && typeof environmentGuard !== 'function') {
+    throw new PinVaultError('E_INVALID_CONFIG', 'config.environmentGuard: must be a function');
+  }
+  const timeoutMs = environmentGuardTimeoutMs ?? DEFAULT_GUARD_TIMEOUT_MS;
+  if (typeof timeoutMs !== 'number' || !Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 30000) {
+    throw new PinVaultError('E_INVALID_CONFIG', 'config.environmentGuardTimeoutMs: an integer between 100 and 30000');
+  }
+  const nativeConfig = {
+    ...rest
+  };
+  if (environmentGuard) nativeConfig.environmentGuard = {
+    timeoutMs
+  };
+  const json = strictJson(nativeConfig, 'config', 'E_INVALID_CONFIG');
+  installGuard(environmentGuard, timeoutMs);
+  return call(NativePinVault.start(json));
+}
+export const updateNow = () => call(NativePinVault.updateNow());
+export const currentVersion = () => call(NativePinVault.currentVersion());
+export const hostPinVersions = () => call(NativePinVault.hostPinVersions());
+
+/** Active pins of a host (Base64, no `sha256/`), or null when the host has no entry. */
+export async function pinsForHost(hostname) {
+  const result = await call(NativePinVault.pinsForHost(hostname));
+  return result.pins;
+}
+export const signingStatus = configApiId => call(NativePinVault.signingStatus(configApiId ?? null));
+export const isForceUpdate = () => call(NativePinVault.isForceUpdate());
+/** Drops the active pins; the next `start` begins again (watermarks kept). */
+export const reset = () => call(NativePinVault.reset());
+export const schedulePeriodicUpdates = intervalHours => call(NativePinVault.schedulePeriodicUpdates(intervalHours ?? null));
+export const cancelPeriodicUpdates = () => call(NativePinVault.cancelPeriodicUpdates());
+/** Library debug logs. Ignored (returns false) in release builds of the app. */
+export const enableDebugLogging = () => call(NativePinVault.enableDebugLogging());
+
+// ── Pinned HTTP ─────────────────────────────────────────────────────────────
+
+/**
+ * A request through the native pinned client (`PinVault.getClient()` /
+ * `PinVault.shared.session()`): pin check, attestation token, pin-mismatch
+ * recovery. HTTPS only; it never falls back to an unpinned path. A pin
+ * mismatch rejects with `E_FETCH` (`exception.name` e.g. `SSLPeerUnverifiedException`).
+ */
+export async function fetch(url, init = {}) {
+  if (typeof url !== 'string') throw new PinVaultError('E_INVALID_ARGUMENT', 'url: must be a string');
+  if (init === null || typeof init !== 'object' || Array.isArray(init)) {
+    throw new PinVaultError('E_INVALID_ARGUMENT', 'init: must be an object');
+  }
+  const json = strictJson({
+    ...init,
+    url
+  }, 'request', 'E_INVALID_ARGUMENT');
+  const response = await call(NativePinVault.fetch(json));
+  return {
+    ...response,
+    ok: response.status >= 200 && response.status < 300
+  };
+}
+
+// ── Enrollment ──────────────────────────────────────────────────────────────
+
+/** The device id PinVault sends (`ANDROID_ID` / `identifierForVendor`, lowercased). */
+export const deviceId = () => call(NativePinVault.deviceId());
+
+/** Token or enrollment-code enrollment. The token goes to native memory for this call only. */
+export const enrollForResult = (token, label) => call(NativePinVault.enrollForResult(token, label ?? null));
+export const autoEnrollForResult = () => call(NativePinVault.autoEnrollForResult());
+export const checkPendingEnrollment = () => call(NativePinVault.checkPendingEnrollment());
+export const isEnrolled = label => call(NativePinVault.isEnrolled(label ?? null));
+export const isEnrollmentPending = label => call(NativePinVault.isEnrollmentPending(label ?? null));
+export const enrollmentVerificationCode = label => call(NativePinVault.enrollmentVerificationCode(label ?? null));
+export const enrolledClientCN = label => call(NativePinVault.enrolledClientCN(label ?? null));
+export const enrolledClientNotAfter = label => call(NativePinVault.enrolledClientNotAfter(label ?? null));
+export const unenroll = (label, options = {}) => call(NativePinVault.unenroll(label ?? null, options.wipeVaultFiles === true));
+export const identityKeySecurityLevel = label => call(NativePinVault.identityKeySecurityLevel(label ?? null));
+
+// ── Vault files ─────────────────────────────────────────────────────────────
+
+/**
+ * The access token of a `TOKEN` / `TOKEN_MTLS` file. Kept in native memory only
+ * (never written to disk, gone when the process ends); `null` forgets it.
+ */
+export const setVaultToken = (key, token) => call(NativePinVault.setVaultToken(key, token));
+/** Forgets every vault token (e.g. on a `REENROLL_REQUIRED` event). Returns how many there were. */
+export const clearVaultTokens = () => call(NativePinVault.clearVaultTokens());
+
+/** Downloads and stores a file. `token` = `setVaultToken(key, token)` before the download. */
+export const fetchFile = (key, options = {}) => call(NativePinVault.fetchFile(key, options.token ?? null));
+
+/**
+ * The stored copy (checked on every read), or null — `fileStatus` says why.
+ * Files behind the screen lock never open here: use `unlockFile`.
+ * Keep the content in memory only as long as you need it, and never log it.
+ */
+export const loadFile = (key, encoding = 'utf8') => call(NativePinVault.loadFile(key, encoding));
+export const fileStatus = key => call(NativePinVault.fileStatus(key));
+
+/** Shows the native screen-lock prompt (BiometricPrompt / LAContext), then returns the content. */
+export const unlockFile = (key, prompt, encoding = 'utf8') => call(NativePinVault.unlockFile(key, strictJson({
+  ...prompt,
+  encoding
+}, 'prompt', 'E_INVALID_ARGUMENT')));
+export const isFileLocked = key => call(NativePinVault.isFileLocked(key));
+export const hasFile = key => call(NativePinVault.hasFile(key));
+export const fileVersion = key => call(NativePinVault.fileVersion(key));
+export const clearFile = key => call(NativePinVault.clearFile(key));
+export const syncAllFiles = () => call(NativePinVault.syncAllFiles());
+
+// ── Attestation ─────────────────────────────────────────────────────────────
+
+export const attestNow = configApiId => call(NativePinVault.attestNow(configApiId ?? null));
+/** `PinVault-Token` for your own client (a bearer credential: never log or store it). */
+export const fetchAttestationToken = host => call(NativePinVault.fetchAttestationToken(host ?? null));
+export const attestationStatus = configApiId => call(NativePinVault.attestationStatus(configApiId ?? null));
+export const attestationHeaderName = () => 'PinVault-Token';
+
+// ── Events ──────────────────────────────────────────────────────────────────
+
+/** Connection telemetry (`onConnectionEvent`). Returns a subscription; call `remove()` when done. */
+export function addConnectionListener(listener) {
+  return NativePinVault.onConnectionEvent(event => listener(event));
+}
+
+/** Everything above as one object, like `PinVault.shared` / the Kotlin `PinVault` object. */
+const PinVault = {
+  start,
+  updateNow,
+  currentVersion,
+  hostPinVersions,
+  pinsForHost,
+  signingStatus,
+  isForceUpdate,
+  reset,
+  schedulePeriodicUpdates,
+  cancelPeriodicUpdates,
+  enableDebugLogging,
+  fetch,
+  deviceId,
+  enrollForResult,
+  autoEnrollForResult,
+  checkPendingEnrollment,
+  isEnrolled,
+  isEnrollmentPending,
+  enrollmentVerificationCode,
+  enrolledClientCN,
+  enrolledClientNotAfter,
+  unenroll,
+  identityKeySecurityLevel,
+  setVaultToken,
+  clearVaultTokens,
+  fetchFile,
+  loadFile,
+  fileStatus,
+  unlockFile,
+  isFileLocked,
+  hasFile,
+  fileVersion,
+  clearFile,
+  syncAllFiles,
+  attestNow,
+  fetchAttestationToken,
+  attestationStatus,
+  attestationHeaderName,
+  addConnectionListener
+};
+export default PinVault;
+//# sourceMappingURL=index.js.map

package/lib/module/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["NativePinVault","PinVaultError","Error","constructor","code","message","exception","name","KNOWN_CODES","Set","toPinVaultError","error","e","has","info","userInfo","exceptionName","exceptionMessage","call","promise","MAX_DEPTH","assertPlainData","value","path","depth","Number","isFinite","Array","isArray","forEach","item","i","undefined","proto","Object","getPrototypeOf","prototype","k","v","entries","strictJson","JSON","stringify","DEFAULT_GUARD_TIMEOUT_MS","guardSubscription","evaluateGuard","guard","operation","timeoutMs","timer","verdict","Promise","race","resolve","then","setTimeout","__DEV__","console","warn","clearTimeout","GUARDED_OPERATIONS","installGuard","remove","jsTimeout","Math","max","onGuardRequest","request","answerGuard","requestId","allowed","start","config","environmentGuard","environmentGuardTimeoutMs","rest","isInteger","nativeConfig","json","updateNow","currentVersion","hostPinVersions","pinsForHost","hostname","result","pins","signingStatus","configApiId","isForceUpdate","reset","schedulePeriodicUpdates","intervalHours","cancelPeriodicUpdates","enableDebugLogging","fetch","url","init","response","ok","status","deviceId","enrollForResult","token","label","autoEnrollForResult","checkPendingEnrollment","isEnrolled","isEnrollmentPending","enrollmentVerificationCode","enrolledClientCN","enrolledClientNotAfter","unenroll","options","wipeVaultFiles","identityKeySecurityLevel","setVaultToken","key","clearVaultTokens","fetchFile","loadFile","encoding","fileStatus","unlockFile","prompt","isFileLocked","hasFile","fileVersion","clearFile","syncAllFiles","attestNow","fetchAttestationToken","host","attestationStatus","attestationHeaderName","addConnectionListener","listener","onConnectionEvent","event","PinVault"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA,OAAOA,cAAc,MAA6B,qBAAkB;AAsBpE,cAAc,YAAS;;AAEvB;;AAcA;AACA,OAAO,MAAMC,aAAa,SAASC,KAAK,CAAC;EAIvCC,WAAWA,CAACC,IAAuB,EAAEC,OAAe,EAAEC,SAAqC,GAAG,IAAI,EAAE;IAClG,KAAK,CAACD,OAAO,CAAC;IACd,IAAI,CAACE,IAAI,GAAG,eAAe;IAC3B,IAAI,CAACH,IAAI,GAAGA,IAAI;IAChB,IAAI,CAACE,SAAS,GAAGA,SAAS;EAC5B;AACF;AAEA,MAAME,WAAgC,GAAG,IAAIC,GAAG,CAAC,CAC/C,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,SAAS,EACT,eAAe,EACf,UAAU,EACV,yBAAyB,CAC1B,CAAC;;AAEF;AACA,SAASC,eAAeA,CAACC,KAAc,EAAiB;EACtD,IAAIA,KAAK,YAAYV,aAAa,EAAE,OAAOU,KAAK;EAChD,MAAMC,CAAC,GAAID,KAAK,IAAI,CAAC,CAA+D;EACpF,MAAMP,IAAI,GAAG,OAAOQ,CAAC,CAACR,IAAI,KAAK,QAAQ,IAAII,WAAW,CAACK,GAAG,CAACD,CAAC,CAACR,IAAI,CAAC,GAAIQ,CAAC,CAACR,IAAI,GAAyB,UAAU;EAC/G,MAAMC,OAAO,GAAG,OAAOO,CAAC,CAACP,OAAO,KAAK,QAAQ,GAAGO,CAAC,CAACP,OAAO,GAAG,6BAA6B;EACzF,MAAMS,IAAI,GAAIF,CAAC,CAACG,QAAQ,IAAI,IAAuE;EACnG,MAAMT,SAAS,GACbQ,IAAI,IAAI,OAAOA,IAAI,CAACE,aAAa,KAAK,QAAQ,GAC1C;IACET,IAAI,EAAEO,IAAI,CAACE,aAAa;IACxBX,OAAO,EAAE,OAAOS,IAAI,CAACG,gBAAgB,KAAK,QAAQ,GAAGH,IAAI,CAACG,gBAAgB,GAAG;EAC/E,CAAC,GACD,IAAI;EACV,OAAO,IAAIhB,aAAa,CAACG,IAAI,EAAEC,OAAO,EAAEC,SAAS,CAAC;AACpD;AAEA,eAAeY,IAAIA,CAAIC,OAAyB,EAAc;EAC5D,IAAI;IACF,OAAQ,MAAMA,OAAO;EACvB,CAAC,CAAC,OAAOR,KAAK,EAAE;IACd,MAAMD,eAAe,CAACC,KAAK,CAAC;EAC9B;AACF;;AAEA;AACA;AACA;;AAEA;AACA,MAAMS,SAAS,GAAG,CAAC;AAEnB,SAASC,eAAeA,CAACC,KAAc,EAAEC,IAAY,EAAEnB,IAAuB,EAAEoB,KAAK,GAAG,CAAC,EAAQ;EAC/F;EACA,IAAIA,KAAK,GAAGJ,SAAS,EAAE,MAAM,IAAInB,aAAa,CAACG,IAAI,EAAE,GAAGmB,IAAI,qBAAqB,CAAC;EAClF,IAAID,KAAK,KAAK,IAAI,EAAE;EACpB,QAAQ,OAAOA,KAAK;IAClB,KAAK,QAAQ;IACb,KAAK,SAAS;MACZ;IACF,KAAK,QAAQ;MACX,IAAI,CAACG,MAAM,CAACC,QAAQ,CAACJ,KAAK,CAAC,EAAE,MAAM,IAAIrB,aAAa,CAACG,IAAI,EAAE,GAAGmB,IAAI,uBAAuB,CAAC;MAC1F;IACF,KAAK,QAAQ;MAAE;QACb,IAAII,KAAK,CAACC,OAAO,CAACN,KAAK,CAAC,EAAE;UACxBA,KAAK,CAACO,OAAO,CAAC,CAACC,IAAI,EAAEC,CAAC,KAAK;YACzB,IAAID,IAAI,KAAKE,SAAS,EAAE,MAAM,IAAI/B,aAAa,CAACG,IAAI,EAAE,GAAGmB,IAAI,IAAIQ,CAAC,wBAAwB,CAAC;YAC3FV,eAAe,CAACS,IAAI,EAAE,GAAGP,IAAI,IAAIQ,CAAC,GAAG,EAAE3B,IAAI,EAAEoB,KAAK,GAAG,CAAC,CAAC;UACzD,CAAC,CAAC;UACF;QACF;QACA,MAAMS,KAAK,GAAGC,MAAM,CAACC,cAAc,CAACb,KAAK,CAAC;QAC1C,IAAIW,KAAK,KAAKC,MAAM,CAACE,SAAS,IAAIH,KAAK,KAAK,IAAI,EAAE;UAChD,MAAM,IAAIhC,aAAa,CAACG,IAAI,EAAE,GAAGmB,IAAI,0BAA0B,CAAC;QAClE;QACA,KAAK,MAAM,CAACc,CAAC,EAAEC,CAAC,CAAC,IAAIJ,MAAM,CAACK,OAAO,CAACjB,KAAgC,CAAC,EAAE;UACrE,IAAIgB,CAAC,KAAKN,SAAS,EAAE,SAAS,CAAC;UAC/BX,eAAe,CAACiB,CAAC,EAAE,GAAGf,IAAI,IAAIc,CAAC,EAAE,EAAEjC,IAAI,EAAEoB,KAAK,GAAG,CAAC,CAAC;QACrD;QACA;MACF;IACA;MACE,MAAM,IAAIvB,aAAa,CAACG,IAAI,EAAE,GAAGmB,IAAI,KAAK,OAAOD,KAAK,iBAAiB,CAAC;EAC5E;AACF;AAEA,SAASkB,UAAUA,CAAClB,KAAc,EAAEC,IAAY,EAAEnB,IAAuB,EAAU;EACjFiB,eAAe,CAACC,KAAK,EAAEC,IAAI,EAAEnB,IAAI,CAAC;EAClC,OAAOqC,IAAI,CAACC,SAAS,CAACpB,KAAK,CAAC;AAC9B;;AAEA;;AAEA,OAAO,MAAMqB,wBAAwB,GAAG,IAAI;AAE5C,IAAIC,iBAA4C,GAAG,IAAI;;AAEvD;AACA;AACA;AACA;AACA,OAAO,eAAeC,aAAaA,CACjCC,KAAuB,EACvBC,SAA2B,EAC3BC,SAAiB,EACC;EAClB,IAAIC,KAAgD;EACpD,IAAI;IACF,MAAMC,OAAO,GAAG,MAAMC,OAAO,CAACC,IAAI,CAAU,CAC1CD,OAAO,CAACE,OAAO,CAAC,CAAC,CAACC,IAAI,CAAC,MAAMR,KAAK,CAACC,SAAS,CAAC,CAAC,EAC9C,IAAII,OAAO,CAAWE,OAAO,IAAK;MAChCJ,KAAK,GAAGM,UAAU,CAAC,MAAMF,OAAO,CAAC,KAAK,CAAC,EAAEL,SAAS,CAAC;IACrD,CAAC,CAAC,CACH,CAAC;IACF,OAAOE,OAAO,KAAK,IAAI;EACzB,CAAC,CAAC,OAAOvC,KAAK,EAAE;IACd,IAAI6C,OAAO,EAAEC,OAAO,CAACC,IAAI,CAAC,wCAAwCX,SAAS,WAAW,EAAEpC,KAAK,CAAC;IAC9F,OAAO,KAAK;EACd,CAAC,SAAS;IACR,IAAIsC,KAAK,KAAKjB,SAAS,EAAE2B,YAAY,CAACV,KAAK,CAAC;EAC9C;AACF;AAEA,MAAMW,kBAAuC,GAAG,IAAInD,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;AAExG,SAASoD,YAAYA,CAACf,KAAmC,EAAEE,SAAiB,EAAQ;EAClFJ,iBAAiB,EAAEkB,MAAM,CAAC,CAAC;EAC3BlB,iBAAiB,GAAG,IAAI;EACxB,IAAI,CAACE,KAAK,EAAE;EACZ;EACA,MAAMiB,SAAS,GAAGC,IAAI,CAACC,GAAG,CAAC,EAAE,EAAEjB,SAAS,GAAG,GAAG,CAAC;EAC/CJ,iBAAiB,GAAG5C,cAAc,CAACkE,cAAc,CAAEC,OAAqB,IAAK;IAC3E,MAAMpB,SAAS,GAAGoB,OAAO,CAACpB,SAAS;IACnC,IAAI,CAACa,kBAAkB,CAAC/C,GAAG,CAACkC,SAAS,CAAC,EAAE;MACtC/C,cAAc,CAACoE,WAAW,CAACD,OAAO,CAACE,SAAS,EAAE,KAAK,CAAC;MACpD;IACF;IACA,KAAKxB,aAAa,CAACC,KAAK,EAAEC,SAAS,EAAsBgB,SAAS,CAAC,CAACT,IAAI,CAAEgB,OAAO,IAC/EtE,cAAc,CAACoE,WAAW,CAACD,OAAO,CAACE,SAAS,EAAEC,OAAO,CACvD,CAAC;EACH,CAAC,CAAC;AACJ;;AAEA;;AAEA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,KAAKA,CAACC,MAAsB,EAAuB;EACvE,IAAIA,MAAM,KAAK,IAAI,IAAI,OAAOA,MAAM,KAAK,QAAQ,IAAI7C,KAAK,CAACC,OAAO,CAAC4C,MAAM,CAAC,EAAE;IAC1E,MAAM,IAAIvE,aAAa,CAAC,kBAAkB,EAAE,2BAA2B,CAAC;EAC1E;EACA,MAAM;IAAEwE,gBAAgB;IAAEC,yBAAyB;IAAE,GAAGC;EAAK,CAAC,GAAGH,MAAM;EACvE,IAAIC,gBAAgB,KAAKzC,SAAS,IAAI,OAAOyC,gBAAgB,KAAK,UAAU,EAAE;IAC5E,MAAM,IAAIxE,aAAa,CAAC,kBAAkB,EAAE,6CAA6C,CAAC;EAC5F;EACA,MAAM+C,SAAS,GAAG0B,yBAAyB,IAAI/B,wBAAwB;EACvE,IACE,OAAOK,SAAS,KAAK,QAAQ,IAC7B,CAACvB,MAAM,CAACmD,SAAS,CAAC5B,SAAS,CAAC,IAC5BA,SAAS,GAAG,GAAG,IACfA,SAAS,GAAG,KAAK,EACjB;IACA,MAAM,IAAI/C,aAAa,CAAC,kBAAkB,EAAE,oEAAoE,CAAC;EACnH;EACA,MAAM4E,YAAqC,GAAG;IAAE,GAAGF;EAAK,CAAC;EACzD,IAAIF,gBAAgB,EAAEI,YAAY,CAACJ,gBAAgB,GAAG;IAAEzB;EAAU,CAAC;EACnE,MAAM8B,IAAI,GAAGtC,UAAU,CAACqC,YAAY,EAAE,QAAQ,EAAE,kBAAkB,CAAC;EACnEhB,YAAY,CAACY,gBAAgB,EAAEzB,SAAS,CAAC;EACzC,OAAO9B,IAAI,CAAalB,cAAc,CAACuE,KAAK,CAACO,IAAI,CAAC,CAAC;AACrD;AAEA,OAAO,MAAMC,SAAS,GAAGA,CAAA,KAA6B7D,IAAI,CAAClB,cAAc,CAAC+E,SAAS,CAAC,CAAC,CAAC;AACtF,OAAO,MAAMC,cAAc,GAAGA,CAAA,KAAuB9D,IAAI,CAAClB,cAAc,CAACgF,cAAc,CAAC,CAAC,CAAC;AAC1F,OAAO,MAAMC,eAAe,GAAGA,CAAA,KAAuC/D,IAAI,CAAClB,cAAc,CAACiF,eAAe,CAAC,CAAC,CAAC;;AAE5G;AACA,OAAO,eAAeC,WAAWA,CAACC,QAAgB,EAA4B;EAC5E,MAAMC,MAAM,GAAG,MAAMlE,IAAI,CAA4BlB,cAAc,CAACkF,WAAW,CAACC,QAAQ,CAAC,CAAC;EAC1F,OAAOC,MAAM,CAACC,IAAI;AACpB;AAEA,OAAO,MAAMC,aAAa,GAAIC,WAAoB,IAChDrE,IAAI,CAAClB,cAAc,CAACsF,aAAa,CAACC,WAAW,IAAI,IAAI,CAAC,CAAC;AACzD,OAAO,MAAMC,aAAa,GAAGA,CAAA,KAAwBtE,IAAI,CAAClB,cAAc,CAACwF,aAAa,CAAC,CAAC,CAAC;AACzF;AACA,OAAO,MAAMC,KAAK,GAAGA,CAAA,KAAqBvE,IAAI,CAAClB,cAAc,CAACyF,KAAK,CAAC,CAAC,CAAC;AACtE,OAAO,MAAMC,uBAAuB,GAAIC,aAAsB,IAC5DzE,IAAI,CAAClB,cAAc,CAAC0F,uBAAuB,CAACC,aAAa,IAAI,IAAI,CAAC,CAAC;AACrE,OAAO,MAAMC,qBAAqB,GAAGA,CAAA,KAAqB1E,IAAI,CAAClB,cAAc,CAAC4F,qBAAqB,CAAC,CAAC,CAAC;AACtG;AACA,OAAO,MAAMC,kBAAkB,GAAGA,CAAA,KAAwB3E,IAAI,CAAClB,cAAc,CAAC6F,kBAAkB,CAAC,CAAC,CAAC;;AAEnG;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,KAAKA,CAACC,GAAW,EAAEC,IAAyB,GAAG,CAAC,CAAC,EAA6B;EAClG,IAAI,OAAOD,GAAG,KAAK,QAAQ,EAAE,MAAM,IAAI9F,aAAa,CAAC,oBAAoB,EAAE,uBAAuB,CAAC;EACnG,IAAI+F,IAAI,KAAK,IAAI,IAAI,OAAOA,IAAI,KAAK,QAAQ,IAAIrE,KAAK,CAACC,OAAO,CAACoE,IAAI,CAAC,EAAE;IACpE,MAAM,IAAI/F,aAAa,CAAC,oBAAoB,EAAE,yBAAyB,CAAC;EAC1E;EACA,MAAM6E,IAAI,GAAGtC,UAAU,CAAC;IAAE,GAAGwD,IAAI;IAAED;EAAI,CAAC,EAAE,SAAS,EAAE,oBAAoB,CAAC;EAC1E,MAAME,QAAQ,GAAG,MAAM/E,IAAI,CAA+BlB,cAAc,CAAC8F,KAAK,CAAChB,IAAI,CAAC,CAAC;EACrF,OAAO;IAAE,GAAGmB,QAAQ;IAAEC,EAAE,EAAED,QAAQ,CAACE,MAAM,IAAI,GAAG,IAAIF,QAAQ,CAACE,MAAM,GAAG;EAAI,CAAC;AAC7E;;AAEA;;AAEA;AACA,OAAO,MAAMC,QAAQ,GAAGA,CAAA,KAA8BlF,IAAI,CAAClB,cAAc,CAACoG,QAAQ,CAAC,CAAC,CAAC;;AAErF;AACA,OAAO,MAAMC,eAAe,GAAGA,CAACC,KAAa,EAAEC,KAAc,KAC3DrF,IAAI,CAAClB,cAAc,CAACqG,eAAe,CAACC,KAAK,EAAEC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC5D,OAAO,MAAMC,mBAAmB,GAAGA,CAAA,KACjCtF,IAAI,CAAClB,cAAc,CAACwG,mBAAmB,CAAC,CAAC,CAAC;AAC5C,OAAO,MAAMC,sBAAsB,GAAGA,CAAA,KACpCvF,IAAI,CAAClB,cAAc,CAACyG,sBAAsB,CAAC,CAAC,CAAC;AAC/C,OAAO,MAAMC,UAAU,GAAIH,KAAc,IAAuBrF,IAAI,CAAClB,cAAc,CAAC0G,UAAU,CAACH,KAAK,IAAI,IAAI,CAAC,CAAC;AAC9G,OAAO,MAAMI,mBAAmB,GAAIJ,KAAc,IAChDrF,IAAI,CAAClB,cAAc,CAAC2G,mBAAmB,CAACJ,KAAK,IAAI,IAAI,CAAC,CAAC;AACzD,OAAO,MAAMK,0BAA0B,GAAIL,KAAc,IACvDrF,IAAI,CAAClB,cAAc,CAAC4G,0BAA0B,CAACL,KAAK,IAAI,IAAI,CAAC,CAAC;AAChE,OAAO,MAAMM,gBAAgB,GAAIN,KAAc,IAC7CrF,IAAI,CAAClB,cAAc,CAAC6G,gBAAgB,CAACN,KAAK,IAAI,IAAI,CAAC,CAAC;AACtD,OAAO,MAAMO,sBAAsB,GAAIP,KAAc,IACnDrF,IAAI,CAAClB,cAAc,CAAC8G,sBAAsB,CAACP,KAAK,IAAI,IAAI,CAAC,CAAC;AAC5D,OAAO,MAAMQ,QAAQ,GAAGA,CAACR,KAAc,EAAES,OAAqC,GAAG,CAAC,CAAC,KACjF9F,IAAI,CAAClB,cAAc,CAAC+G,QAAQ,CAACR,KAAK,IAAI,IAAI,EAAES,OAAO,CAACC,cAAc,KAAK,IAAI,CAAC,CAAC;AAC/E,OAAO,MAAMC,wBAAwB,GAAIX,KAAc,IACrDrF,IAAI,CAAClB,cAAc,CAACkH,wBAAwB,CAACX,KAAK,IAAI,IAAI,CAAC,CAAC;;AAE9D;;AAEA;AACA;AACA;AACA;AACA,OAAO,MAAMY,aAAa,GAAGA,CAACC,GAAW,EAAEd,KAAoB,KAC7DpF,IAAI,CAAClB,cAAc,CAACmH,aAAa,CAACC,GAAG,EAAEd,KAAK,CAAC,CAAC;AAChD;AACA,OAAO,MAAMe,gBAAgB,GAAGA,CAAA,KAAuBnG,IAAI,CAAClB,cAAc,CAACqH,gBAAgB,CAAC,CAAC,CAAC;;AAE9F;AACA,OAAO,MAAMC,SAAS,GAAGA,CAACF,GAAW,EAAEJ,OAA2B,GAAG,CAAC,CAAC,KACrE9F,IAAI,CAAClB,cAAc,CAACsH,SAAS,CAACF,GAAG,EAAEJ,OAAO,CAACV,KAAK,IAAI,IAAI,CAAC,CAAC;;AAE5D;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMiB,QAAQ,GAAGA,CAACH,GAAW,EAAEI,QAAyB,GAAG,MAAM,KACtEtG,IAAI,CAAClB,cAAc,CAACuH,QAAQ,CAACH,GAAG,EAAEI,QAAQ,CAAC,CAAC;AAC9C,OAAO,MAAMC,UAAU,GAAIL,GAAW,IAA+BlG,IAAI,CAAClB,cAAc,CAACyH,UAAU,CAACL,GAAG,CAAC,CAAC;;AAEzG;AACA,OAAO,MAAMM,UAAU,GAAGA,CACxBN,GAAW,EACXO,MAA6B,EAC7BH,QAAyB,GAAG,MAAM,KAElCtG,IAAI,CAAClB,cAAc,CAAC0H,UAAU,CAACN,GAAG,EAAE5E,UAAU,CAAC;EAAE,GAAGmF,MAAM;EAAEH;AAAS,CAAC,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAE3G,OAAO,MAAMI,YAAY,GAAIR,GAAW,IAAuBlG,IAAI,CAAClB,cAAc,CAAC4H,YAAY,CAACR,GAAG,CAAC,CAAC;AACrG,OAAO,MAAMS,OAAO,GAAIT,GAAW,IAAuBlG,IAAI,CAAClB,cAAc,CAAC6H,OAAO,CAACT,GAAG,CAAC,CAAC;AAC3F,OAAO,MAAMU,WAAW,GAAIV,GAAW,IAAsBlG,IAAI,CAAClB,cAAc,CAAC8H,WAAW,CAACV,GAAG,CAAC,CAAC;AAClG,OAAO,MAAMW,SAAS,GAAIX,GAAW,IAAoBlG,IAAI,CAAClB,cAAc,CAAC+H,SAAS,CAACX,GAAG,CAAC,CAAC;AAC5F,OAAO,MAAMY,YAAY,GAAGA,CAAA,KAAgD9G,IAAI,CAAClB,cAAc,CAACgI,YAAY,CAAC,CAAC,CAAC;;AAE/G;;AAEA,OAAO,MAAMC,SAAS,GAAI1C,WAAoB,IAC5CrE,IAAI,CAAClB,cAAc,CAACiI,SAAS,CAAC1C,WAAW,IAAI,IAAI,CAAC,CAAC;AACrD;AACA,OAAO,MAAM2C,qBAAqB,GAAIC,IAAa,IACjDjH,IAAI,CAAClB,cAAc,CAACkI,qBAAqB,CAACC,IAAI,IAAI,IAAI,CAAC,CAAC;AAC1D,OAAO,MAAMC,iBAAiB,GAAI7C,WAAoB,IACpDrE,IAAI,CAAClB,cAAc,CAACoI,iBAAiB,CAAC7C,WAAW,IAAI,IAAI,CAAC,CAAC;AAC7D,OAAO,MAAM8C,qBAAqB,GAAGA,CAAA,KAAc,gBAAgB;;AAEnE;;AAEA;AACA,OAAO,SAASC,qBAAqBA,CAACC,QAAkD,EAAsB;EAC5G,OAAOvI,cAAc,CAACwI,iBAAiB,CAAEC,KAAK,IAAKF,QAAQ,CAACE,KAAgC,CAAC,CAAC;AAChG;;AAEA;AACA,MAAMC,QAAQ,GAAG;EACfnE,KAAK;EACLQ,SAAS;EACTC,cAAc;EACdC,eAAe;EACfC,WAAW;EACXI,aAAa;EACbE,aAAa;EACbC,KAAK;EACLC,uBAAuB;EACvBE,qBAAqB;EACrBC,kBAAkB;EAClBC,KAAK;EACLM,QAAQ;EACRC,eAAe;EACfG,mBAAmB;EACnBC,sBAAsB;EACtBC,UAAU;EACVC,mBAAmB;EACnBC,0BAA0B;EAC1BC,gBAAgB;EAChBC,sBAAsB;EACtBC,QAAQ;EACRG,wBAAwB;EACxBC,aAAa;EACbE,gBAAgB;EAChBC,SAAS;EACTC,QAAQ;EACRE,UAAU;EACVC,UAAU;EACVE,YAAY;EACZC,OAAO;EACPC,WAAW;EACXC,SAAS;EACTC,YAAY;EACZC,SAAS;EACTC,qBAAqB;EACrBE,iBAAiB;EACjBC,qBAAqB;EACrBC;AACF,CAAU;AAEV,eAAeI,QAAQ","ignoreList":[]}

package/lib/module/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/lib/module/types.js

@@ -0,0 +1,2 @@
+"use strict";
+//# sourceMappingURL=types.js.map

package/lib/module/types.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sourceRoot":"../../src","sources":["types.ts"],"mappings":"","ignoreList":[]}

package/lib/typescript/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/lib/typescript/src/NativePinVault.d.ts

@@ -0,0 +1,50 @@
+import { type TurboModule, type CodegenTypes } from 'react-native';
+export type GuardRequest = {
+    requestId: string;
+    operation: string;
+};
+export interface Spec extends TurboModule {
+    start(configJson: string): Promise<CodegenTypes.UnsafeObject>;
+    updateNow(): Promise<CodegenTypes.UnsafeObject>;
+    currentVersion(): Promise<number>;
+    hostPinVersions(): Promise<CodegenTypes.UnsafeObject>;
+    pinsForHost(hostname: string): Promise<CodegenTypes.UnsafeObject>;
+    signingStatus(configApiId: string | null): Promise<CodegenTypes.UnsafeObject>;
+    isForceUpdate(): Promise<boolean>;
+    reset(): Promise<void>;
+    schedulePeriodicUpdates(intervalHours: number | null): Promise<boolean>;
+    cancelPeriodicUpdates(): Promise<void>;
+    enableDebugLogging(): Promise<boolean>;
+    fetch(requestJson: string): Promise<CodegenTypes.UnsafeObject>;
+    deviceId(): Promise<string | null>;
+    enrollForResult(token: string, label: string | null): Promise<CodegenTypes.UnsafeObject>;
+    autoEnrollForResult(): Promise<CodegenTypes.UnsafeObject>;
+    checkPendingEnrollment(): Promise<CodegenTypes.UnsafeObject>;
+    isEnrolled(label: string | null): Promise<boolean>;
+    isEnrollmentPending(label: string | null): Promise<boolean>;
+    enrollmentVerificationCode(label: string | null): Promise<string | null>;
+    enrolledClientCN(label: string | null): Promise<string | null>;
+    enrolledClientNotAfter(label: string | null): Promise<number | null>;
+    unenroll(label: string | null, wipeVaultFiles: boolean): Promise<void>;
+    identityKeySecurityLevel(label: string | null): Promise<string | null>;
+    setVaultToken(key: string, token: string | null): Promise<void>;
+    clearVaultTokens(): Promise<number>;
+    fetchFile(key: string, token: string | null): Promise<CodegenTypes.UnsafeObject>;
+    loadFile(key: string, encoding: string): Promise<string | null>;
+    fileStatus(key: string): Promise<string>;
+    unlockFile(key: string, promptJson: string): Promise<CodegenTypes.UnsafeObject>;
+    isFileLocked(key: string): Promise<boolean>;
+    hasFile(key: string): Promise<boolean>;
+    fileVersion(key: string): Promise<number>;
+    clearFile(key: string): Promise<void>;
+    syncAllFiles(): Promise<CodegenTypes.UnsafeObject>;
+    attestNow(configApiId: string | null): Promise<CodegenTypes.UnsafeObject>;
+    fetchAttestationToken(host: string | null): Promise<CodegenTypes.UnsafeObject>;
+    attestationStatus(configApiId: string | null): Promise<CodegenTypes.UnsafeObject>;
+    answerGuard(requestId: string, allowed: boolean): void;
+    readonly onConnectionEvent: CodegenTypes.EventEmitter<CodegenTypes.UnsafeObject>;
+    readonly onGuardRequest: CodegenTypes.EventEmitter<GuardRequest>;
+}
+declare const _default: Spec;
+export default _default;
+//# sourceMappingURL=NativePinVault.d.ts.map

package/lib/typescript/src/NativePinVault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NativePinVault.d.ts","sourceRoot":"","sources":["../../../src/NativePinVault.ts"],"names":[],"mappings":"AAQA,OAAO,EAAuB,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAExF,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,IAAK,SAAQ,WAAW;IAEvC,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAC9D,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAChD,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,eAAe,IAAI,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IACtD,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAClE,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAC9E,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAGvC,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAG/D,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IACzF,mBAAmB,IAAI,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAC1D,sBAAsB,IAAI,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAC7D,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzE,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/D,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAGvE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IACjF,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAChE,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAChF,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAGnD,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAC1E,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAC/E,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAGlF,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IAGvD,QAAQ,CAAC,iBAAiB,EAAE,YAAY,CAAC,YAAY,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IACjF,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;CAClE;;AAED,wBAAoE"}

package/lib/typescript/src/index.d.ts

@@ -0,0 +1,150 @@
+import type { AttestationStatus, AttestationTokenResult, ClientCertEnrollmentResult, ContentEncoding, EnvironmentGuard, GuardedOperation, InitResult, KeySecurityLevel, PinVaultConfig, PinVaultConnectionEvent, PinVaultRequestInit, PinVaultResponse, SigningStatus, UpdateResult, VaultFileResult, VaultFileStatus, VaultFileUnlockPrompt, VaultFileUnlockResult } from './types.js';
+export * from './types.js';
+/** Error codes of rejected promises. */
+export type PinVaultErrorCode = 
+/** The config (or a request) was refused by the strict native parser or a builder rule. */
+'E_INVALID_CONFIG' | 'E_INVALID_ARGUMENT'
+/** An operation that needs `start()` first. */
+ | 'E_NOT_STARTED'
+/** The pinned request failed: pin mismatch, TLS, network, timeout, size limit. */
+ | 'E_FETCH' | 'E_NO_ACTIVITY' | 'E_NATIVE'
+/** `requirePinnedReactNativeNetworking`: React Native's own networking is not pinned. */
+ | 'E_NETWORKING_NOT_PINNED';
+/** A rejected PinVault call. `exception` is the native exception (class name + message). */
+export declare class PinVaultError extends Error {
+    readonly code: PinVaultErrorCode;
+    readonly exception: {
+        name: string;
+        message: string | null;
+    } | null;
+    constructor(code: PinVaultErrorCode, message: string, exception?: PinVaultError['exception']);
+}
+export declare const DEFAULT_GUARD_TIMEOUT_MS = 5000;
+/**
+ * Runs the app's guard with a timeout. Anything but a `true` within the time —
+ * `false`, another value, a thrown error, a rejected promise, no answer — is a refusal.
+ */
+export declare function evaluateGuard(guard: EnvironmentGuard, operation: GuardedOperation, timeoutMs: number): Promise<boolean>;
+/**
+ * Starts PinVault (`PinVault.init(context, config)` / `PinVault.shared.start(config:)`).
+ * Fail closed: until it returns `{ type: 'ready' }`, every pinned request is refused.
+ * An invalid config rejects with `E_INVALID_CONFIG` (unknown keys and wrong types included).
+ */
+export declare function start(config: PinVaultConfig): Promise<InitResult>;
+export declare const updateNow: () => Promise<UpdateResult>;
+export declare const currentVersion: () => Promise<number>;
+export declare const hostPinVersions: () => Promise<Record<string, number>>;
+/** Active pins of a host (Base64, no `sha256/`), or null when the host has no entry. */
+export declare function pinsForHost(hostname: string): Promise<string[] | null>;
+export declare const signingStatus: (configApiId?: string) => Promise<SigningStatus | null>;
+export declare const isForceUpdate: () => Promise<boolean>;
+/** Drops the active pins; the next `start` begins again (watermarks kept). */
+export declare const reset: () => Promise<void>;
+export declare const schedulePeriodicUpdates: (intervalHours?: number) => Promise<boolean>;
+export declare const cancelPeriodicUpdates: () => Promise<void>;
+/** Library debug logs. Ignored (returns false) in release builds of the app. */
+export declare const enableDebugLogging: () => Promise<boolean>;
+/**
+ * A request through the native pinned client (`PinVault.getClient()` /
+ * `PinVault.shared.session()`): pin check, attestation token, pin-mismatch
+ * recovery. HTTPS only; it never falls back to an unpinned path. A pin
+ * mismatch rejects with `E_FETCH` (`exception.name` e.g. `SSLPeerUnverifiedException`).
+ */
+export declare function fetch(url: string, init?: PinVaultRequestInit): Promise<PinVaultResponse>;
+/** The device id PinVault sends (`ANDROID_ID` / `identifierForVendor`, lowercased). */
+export declare const deviceId: () => Promise<string | null>;
+/** Token or enrollment-code enrollment. The token goes to native memory for this call only. */
+export declare const enrollForResult: (token: string, label?: string) => Promise<ClientCertEnrollmentResult>;
+export declare const autoEnrollForResult: () => Promise<ClientCertEnrollmentResult>;
+export declare const checkPendingEnrollment: () => Promise<ClientCertEnrollmentResult>;
+export declare const isEnrolled: (label?: string) => Promise<boolean>;
+export declare const isEnrollmentPending: (label?: string) => Promise<boolean>;
+export declare const enrollmentVerificationCode: (label?: string) => Promise<string | null>;
+export declare const enrolledClientCN: (label?: string) => Promise<string | null>;
+export declare const enrolledClientNotAfter: (label?: string) => Promise<number | null>;
+export declare const unenroll: (label?: string, options?: {
+    wipeVaultFiles?: boolean;
+}) => Promise<void>;
+export declare const identityKeySecurityLevel: (label?: string) => Promise<KeySecurityLevel | null>;
+/**
+ * The access token of a `TOKEN` / `TOKEN_MTLS` file. Kept in native memory only
+ * (never written to disk, gone when the process ends); `null` forgets it.
+ */
+export declare const setVaultToken: (key: string, token: string | null) => Promise<void>;
+/** Forgets every vault token (e.g. on a `REENROLL_REQUIRED` event). Returns how many there were. */
+export declare const clearVaultTokens: () => Promise<number>;
+/** Downloads and stores a file. `token` = `setVaultToken(key, token)` before the download. */
+export declare const fetchFile: (key: string, options?: {
+    token?: string;
+}) => Promise<VaultFileResult>;
+/**
+ * The stored copy (checked on every read), or null — `fileStatus` says why.
+ * Files behind the screen lock never open here: use `unlockFile`.
+ * Keep the content in memory only as long as you need it, and never log it.
+ */
+export declare const loadFile: (key: string, encoding?: ContentEncoding) => Promise<string | null>;
+export declare const fileStatus: (key: string) => Promise<VaultFileStatus>;
+/** Shows the native screen-lock prompt (BiometricPrompt / LAContext), then returns the content. */
+export declare const unlockFile: (key: string, prompt: VaultFileUnlockPrompt, encoding?: ContentEncoding) => Promise<VaultFileUnlockResult>;
+export declare const isFileLocked: (key: string) => Promise<boolean>;
+export declare const hasFile: (key: string) => Promise<boolean>;
+export declare const fileVersion: (key: string) => Promise<number>;
+export declare const clearFile: (key: string) => Promise<void>;
+export declare const syncAllFiles: () => Promise<Record<string, VaultFileResult>>;
+export declare const attestNow: (configApiId?: string) => Promise<AttestationStatus>;
+/** `PinVault-Token` for your own client (a bearer credential: never log or store it). */
+export declare const fetchAttestationToken: (host?: string) => Promise<AttestationTokenResult>;
+export declare const attestationStatus: (configApiId?: string) => Promise<AttestationStatus>;
+export declare const attestationHeaderName: () => string;
+/** Connection telemetry (`onConnectionEvent`). Returns a subscription; call `remove()` when done. */
+export declare function addConnectionListener(listener: (event: PinVaultConnectionEvent) => void): {
+    remove(): void;
+};
+/** Everything above as one object, like `PinVault.shared` / the Kotlin `PinVault` object. */
+declare const PinVault: {
+    readonly start: typeof start;
+    readonly updateNow: () => Promise<UpdateResult>;
+    readonly currentVersion: () => Promise<number>;
+    readonly hostPinVersions: () => Promise<Record<string, number>>;
+    readonly pinsForHost: typeof pinsForHost;
+    readonly signingStatus: (configApiId?: string) => Promise<SigningStatus | null>;
+    readonly isForceUpdate: () => Promise<boolean>;
+    readonly reset: () => Promise<void>;
+    readonly schedulePeriodicUpdates: (intervalHours?: number) => Promise<boolean>;
+    readonly cancelPeriodicUpdates: () => Promise<void>;
+    readonly enableDebugLogging: () => Promise<boolean>;
+    readonly fetch: typeof fetch;
+    readonly deviceId: () => Promise<string | null>;
+    readonly enrollForResult: (token: string, label?: string) => Promise<ClientCertEnrollmentResult>;
+    readonly autoEnrollForResult: () => Promise<ClientCertEnrollmentResult>;
+    readonly checkPendingEnrollment: () => Promise<ClientCertEnrollmentResult>;
+    readonly isEnrolled: (label?: string) => Promise<boolean>;
+    readonly isEnrollmentPending: (label?: string) => Promise<boolean>;
+    readonly enrollmentVerificationCode: (label?: string) => Promise<string | null>;
+    readonly enrolledClientCN: (label?: string) => Promise<string | null>;
+    readonly enrolledClientNotAfter: (label?: string) => Promise<number | null>;
+    readonly unenroll: (label?: string, options?: {
+        wipeVaultFiles?: boolean;
+    }) => Promise<void>;
+    readonly identityKeySecurityLevel: (label?: string) => Promise<KeySecurityLevel | null>;
+    readonly setVaultToken: (key: string, token: string | null) => Promise<void>;
+    readonly clearVaultTokens: () => Promise<number>;
+    readonly fetchFile: (key: string, options?: {
+        token?: string;
+    }) => Promise<VaultFileResult>;
+    readonly loadFile: (key: string, encoding?: ContentEncoding) => Promise<string | null>;
+    readonly fileStatus: (key: string) => Promise<VaultFileStatus>;
+    readonly unlockFile: (key: string, prompt: VaultFileUnlockPrompt, encoding?: ContentEncoding) => Promise<VaultFileUnlockResult>;
+    readonly isFileLocked: (key: string) => Promise<boolean>;
+    readonly hasFile: (key: string) => Promise<boolean>;
+    readonly fileVersion: (key: string) => Promise<number>;
+    readonly clearFile: (key: string) => Promise<void>;
+    readonly syncAllFiles: () => Promise<Record<string, VaultFileResult>>;
+    readonly attestNow: (configApiId?: string) => Promise<AttestationStatus>;
+    readonly fetchAttestationToken: (host?: string) => Promise<AttestationTokenResult>;
+    readonly attestationStatus: (configApiId?: string) => Promise<AttestationStatus>;
+    readonly attestationHeaderName: () => string;
+    readonly addConnectionListener: typeof addConnectionListener;
+};
+export default PinVault;
+//# sourceMappingURL=index.d.ts.map

package/lib/typescript/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,iBAAiB,EACjB,sBAAsB,EACtB,0BAA0B,EAC1B,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,YAAS,CAAC;AAEjB,cAAc,YAAS,CAAC;AAExB,wCAAwC;AACxC,MAAM,MAAM,iBAAiB;AAC3B,2FAA2F;AACzF,kBAAkB,GAClB,oBAAoB;AACtB,+CAA+C;GAC7C,eAAe;AACjB,kFAAkF;GAChF,SAAS,GACT,eAAe,GACf,UAAU;AACZ,yFAAyF;GACvF,yBAAyB,CAAC;AAE9B,4FAA4F;AAC5F,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;gBAExD,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,aAAa,CAAC,WAAW,CAAQ;CAMnG;AAqFD,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAI7C;;;GAGG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAwBD;;;;GAIG;AACH,wBAAsB,KAAK,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAsBvE;AAED,eAAO,MAAM,SAAS,QAAO,OAAO,CAAC,YAAY,CAAqC,CAAC;AACvF,eAAO,MAAM,cAAc,QAAO,OAAO,CAAC,MAAM,CAA0C,CAAC;AAC3F,eAAO,MAAM,eAAe,QAAO,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAA2C,CAAC;AAE7G,wFAAwF;AACxF,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAG5E;AAED,eAAO,MAAM,aAAa,GAAI,cAAc,MAAM,KAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CACxB,CAAC;AAC1D,eAAO,MAAM,aAAa,QAAO,OAAO,CAAC,OAAO,CAAyC,CAAC;AAC1F,8EAA8E;AAC9E,eAAO,MAAM,KAAK,QAAO,OAAO,CAAC,IAAI,CAAiC,CAAC;AACvE,eAAO,MAAM,uBAAuB,GAAI,gBAAgB,MAAM,KAAG,OAAO,CAAC,OAAO,CACX,CAAC;AACtE,eAAO,MAAM,qBAAqB,QAAO,OAAO,CAAC,IAAI,CAAiD,CAAC;AACvG,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAO,OAAO,CAAC,OAAO,CAA8C,CAAC;AAIpG;;;;;GAKG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAQlG;AAID,uFAAuF;AACvF,eAAO,MAAM,QAAQ,QAAO,OAAO,CAAC,MAAM,GAAG,IAAI,CAAoC,CAAC;AAEtF,+FAA+F;AAC/F,eAAO,MAAM,eAAe,GAAI,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAG,OAAO,CAAC,0BAA0B,CACtC,CAAC;AAC7D,eAAO,MAAM,mBAAmB,QAAO,OAAO,CAAC,0BAA0B,CAC7B,CAAC;AAC7C,eAAO,MAAM,sBAAsB,QAAO,OAAO,CAAC,0BAA0B,CAC7B,CAAC;AAChD,eAAO,MAAM,UAAU,GAAI,QAAQ,MAAM,KAAG,OAAO,CAAC,OAAO,CAAmD,CAAC;AAC/G,eAAO,MAAM,mBAAmB,GAAI,QAAQ,MAAM,KAAG,OAAO,CAAC,OAAO,CACX,CAAC;AAC1D,eAAO,MAAM,0BAA0B,GAAI,QAAQ,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CACjB,CAAC;AACjE,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CACjB,CAAC;AACvD,eAAO,MAAM,sBAAsB,GAAI,QAAQ,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CACjB,CAAC;AAC7D,eAAO,MAAM,QAAQ,GAAI,QAAQ,MAAM,EAAE,UAAS;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAO,KAAG,OAAO,CAAC,IAAI,CACnB,CAAC;AAChF,eAAO,MAAM,wBAAwB,GAAI,QAAQ,MAAM,KAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAC3B,CAAC;AAI/D;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,MAAM,EAAE,OAAO,MAAM,GAAG,IAAI,KAAG,OAAO,CAAC,IAAI,CAC9B,CAAC;AACjD,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,QAAO,OAAO,CAAC,MAAM,CAA4C,CAAC;AAE/F,8FAA8F;AAC9F,eAAO,MAAM,SAAS,GAAI,KAAK,MAAM,EAAE,UAAS;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,KAAG,OAAO,CAAC,eAAe,CACrC,CAAC;AAE7D;;;;GAIG;AACH,eAAO,MAAM,QAAQ,GAAI,KAAK,MAAM,EAAE,WAAU,eAAwB,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAClD,CAAC;AAC/C,eAAO,MAAM,UAAU,GAAI,KAAK,MAAM,KAAG,OAAO,CAAC,eAAe,CAAyC,CAAC;AAE1G,mGAAmG;AACnG,eAAO,MAAM,UAAU,GACrB,KAAK,MAAM,EACX,QAAQ,qBAAqB,EAC7B,WAAU,eAAwB,KACjC,OAAO,CAAC,qBAAqB,CAC2E,CAAC;AAE5G,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,KAAG,OAAO,CAAC,OAAO,CAA2C,CAAC;AACtG,eAAO,MAAM,OAAO,GAAI,KAAK,MAAM,KAAG,OAAO,CAAC,OAAO,CAAsC,CAAC;AAC5F,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,OAAO,CAAC,MAAM,CAA0C,CAAC;AACnG,eAAO,MAAM,SAAS,GAAI,KAAK,MAAM,KAAG,OAAO,CAAC,IAAI,CAAwC,CAAC;AAC7F,eAAO,MAAM,YAAY,QAAO,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAwC,CAAC;AAIhH,eAAO,MAAM,SAAS,GAAI,cAAc,MAAM,KAAG,OAAO,CAAC,iBAAiB,CACrB,CAAC;AACtD,yFAAyF;AACzF,eAAO,MAAM,qBAAqB,GAAI,OAAO,MAAM,KAAG,OAAO,CAAC,sBAAsB,CAC1B,CAAC;AAC3D,eAAO,MAAM,iBAAiB,GAAI,cAAc,MAAM,KAAG,OAAO,CAAC,iBAAiB,CACrB,CAAC;AAC9D,eAAO,MAAM,qBAAqB,QAAO,MAA0B,CAAC;AAIpE,qGAAqG;AACrG,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,GAAG;IAAE,MAAM,IAAI,IAAI,CAAA;CAAE,CAE5G;AAED,6FAA6F;AAC7F,QAAA,MAAM,QAAQ;;8BA1He,OAAO,CAAC,YAAY,CAAC;mCAChB,OAAO,CAAC,MAAM,CAAC;oCACd,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;;2CAQtB,MAAM,KAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;kCAEjD,OAAO,CAAC,OAAO,CAAC;0BAExB,OAAO,CAAC,IAAI,CAAC;uDACkB,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC;0CAExC,OAAO,CAAC,IAAI,CAAC;uCAEhB,OAAO,CAAC,OAAO,CAAC;;6BAuB1B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;sCAGX,MAAM,UAAU,MAAM,KAAG,OAAO,CAAC,0BAA0B,CAAC;wCAE5D,OAAO,CAAC,0BAA0B,CAAC;2CAEhC,OAAO,CAAC,0BAA0B,CAAC;kCAE1C,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC;2CAChB,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC;kDAElB,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;wCAEzC,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;8CAEzB,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;gCAE7C,MAAM,YAAW;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,KAAQ,OAAO,CAAC,IAAI,CAAC;gDAElD,MAAM,KAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;kCASvD,MAAM,SAAS,MAAM,GAAG,IAAI,KAAG,OAAO,CAAC,IAAI,CAAC;qCAG3C,OAAO,CAAC,MAAM,CAAC;8BAGpB,MAAM,YAAW;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KAAQ,OAAO,CAAC,eAAe,CAAC;6BAQpE,MAAM,aAAY,eAAe,KAAY,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;+BAEjE,MAAM,KAAG,OAAO,CAAC,eAAe,CAAC;+BAI1D,MAAM,UACH,qBAAqB,aACnB,eAAe,KACxB,OAAO,CAAC,qBAAqB,CAAC;iCAGC,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC;4BAC9B,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC;gCACrB,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC;8BAC1B,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;iCACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;uCAIhC,MAAM,KAAG,OAAO,CAAC,iBAAiB,CAAC;4CAG9B,MAAM,KAAG,OAAO,CAAC,sBAAsB,CAAC;+CAErC,MAAM,KAAG,OAAO,CAAC,iBAAiB,CAAC;0CAE1C,MAAM;;CAkDrC,CAAC;AAEX,eAAe,QAAQ,CAAC"}