@umutcansu/react-native-pinvault 0.0.0-stage → 2.3.2

package/lib/typescript/src/types.d.ts

@@ -0,0 +1,346 @@
+export type TimeUnit = 'MILLISECONDS' | 'SECONDS' | 'MINUTES' | 'HOURS' | 'DAYS';
+/** `amount` + `unit`, as the builder methods take them (`expiredConfigGrace(1, TimeUnit.HOURS)`). */
+export type Duration = {
+    amount: number;
+    unit: TimeUnit;
+};
+/** A pin entry (`HostPin`). At least two pins (primary + backup), Base64 SPKI SHA-256 without `sha256/`. */
+export type HostPin = {
+    hostname: string;
+    sha256: string[];
+    version?: number;
+    forceUpdate?: boolean;
+    mtls?: boolean;
+    clientCertVersion?: number;
+};
+/** One Config API (`configApi(id, url) { … }`). Keys are the `ConfigApiBlock.Builder` methods. */
+export type ConfigApiBlock = {
+    id: string;
+    url: string;
+    bootstrapPins?: HostPin[];
+    configEndpoint?: string;
+    healthEndpoint?: string;
+    /** `signaturePublicKey(key)`: one key. Use either this or `signaturePublicKeys`. */
+    signaturePublicKey?: string;
+    signaturePublicKeys?: string[];
+    requiredSignatures?: number;
+    recoveryPublicKeys?: string[];
+    requiredRecoverySignatures?: number;
+    allowUnsigned?: boolean;
+    serverScope?: string;
+    allowUnpinnedConfigApi?: boolean;
+    allowServerGeneratedKey?: boolean;
+    clientCaPins?: string[];
+    maxClientCertLifetimeDays?: number;
+    clientCertHosts?: string[];
+    enrollmentEndpoint?: string;
+    clientCertEndpoint?: string;
+    vaultReportEndpoint?: string;
+    clientCertLabel?: string;
+    wantPinsFor?: string[];
+    renewalUrl?: string;
+    enrollmentUrl?: string;
+    clientCertRenewalThreshold?: number;
+    disableClientCertRenewal?: boolean;
+    attestation?: boolean;
+    attestationInterval?: Duration;
+    tokenHosts?: string[];
+};
+export type StorageStrategy = 'ENCRYPTED_PREFS' | 'ENCRYPTED_FILE';
+export type VaultFileAccessPolicy = 'PUBLIC' | 'API_KEY' | 'TOKEN' | 'TOKEN_MTLS';
+export type VaultFileEncryption = 'PLAIN' | 'AT_REST' | 'END_TO_END' | 'USER_AUTH';
+export type UserAuth = 'NONE' | 'REQUIRED' | 'IF_SCREEN_LOCK';
+/**
+ * One vault file (`vaultFile(key) { … }`). For `TOKEN` / `TOKEN_MTLS` files the
+ * native side installs the `accessToken { … }` provider itself: it reads the token
+ * you set with `setVaultToken(key, token)` (or pass to `fetchFile(key, { token })`),
+ * which stays in native memory only.
+ */
+export type VaultFileConfig = {
+    key: string;
+    endpoint: string;
+    signaturePublicKey?: string;
+    updateWithPins?: boolean;
+    storage?: StorageStrategy;
+    configApi?: string;
+    accessPolicy?: VaultFileAccessPolicy;
+    encryption?: VaultFileEncryption;
+    userAuth?: UserAuth;
+    maxOfflineAge?: Duration;
+    wipeWhenStale?: boolean;
+};
+/** Operations the environment guard is asked about (`GuardedOperation`). */
+export type GuardedOperation = 'INIT' | 'ENROLL' | 'FETCH_FILE' | 'UNLOCK_FILE';
+/**
+ * The app's device verdict (root / jailbreak / hooking detection of your choice)
+ * before every guarded operation. Runs in JS, so code that hooks the JS runtime
+ * can answer for it: treat it as one more signal, the decisive check is the
+ * server's attestation verdict. Fail closed: a timeout, a thrown error or a
+ * non-`true` value refuses the operation.
+ */
+export type EnvironmentGuard = (operation: GuardedOperation) => boolean | Promise<boolean>;
+/** `PinVaultConfig.Builder`, as JSON. */
+export type PinVaultConfig = {
+    configApis?: ConfigApiBlock[];
+    vaultFiles?: VaultFileConfig[];
+    staticPins?: {
+        pins: HostPin[];
+        version?: number;
+        forceUpdate?: boolean;
+    };
+    maxRetryCount?: number;
+    updateIntervalHours?: number;
+    updateIntervalMinutes?: number;
+    deviceAlias?: string;
+    expiredConfigGrace?: Duration;
+    requireCaTrust?: string[];
+    wipeVaultFilesOnRevocation?: boolean;
+    vaultFileMaxOfflineAge?: Duration;
+    requireUnlockedDevice?: boolean;
+    requireHardwareBackedKeys?: boolean;
+    managedTrustRoots?: boolean;
+    expectedSignerSha256?: string[];
+    environmentGuard?: EnvironmentGuard;
+    /** How long the native side waits for `environmentGuard` (ms, 100–30000, default 5000). */
+    environmentGuardTimeoutMs?: number;
+    /**
+     * `start` fails with `E_NETWORKING_NOT_PINNED` when React Native's own networking
+     * does not go through PinVault: on Android when another library replaced the
+     * OkHttp hooks (or they are not installed), on iOS when RCTNetworking does not
+     * pick the plugin's request handler for https. Default false (a warning is logged).
+     */
+    requirePinnedReactNativeNetworking?: boolean;
+    /** Android-only settings (ignored on iOS). */
+    android?: {
+        /** `requireUnlockedDevice(allowFallback = true)`. */
+        requireUnlockedDeviceAllowFallback?: boolean;
+        /**
+         * Pin React Native's own `fetch` / `XMLHttpRequest` / `WebSocket` / images (default true).
+         * The plugin's content provider installs the hooks before the app starts; `false`
+         * is refused while they are installed — opt out natively (README, "Networking").
+         */
+        pinGlobalNetworking?: boolean;
+        /** Keep React Native's 10 MiB disk HTTP cache for its `fetch` / XHR (default false: no disk cache). */
+        keepReactNativeHttpCache?: boolean;
+        /** Keep React Native's persistent cookie jar for its `fetch` / XHR (default false: no cookies). */
+        keepReactNativeCookies?: boolean;
+    };
+    /** iOS-only settings (ignored on Android). */
+    ios?: {
+        /** `resolve(host:to:)`: connect to `address` while pinning and verifying `host`. */
+        resolve?: Record<string, string>;
+        expectedBundleIds?: string[];
+        expectedTeamIds?: string[];
+        /** `userAuthStrength(_:)`; `BIOMETRIC_CURRENT_SET` = `userAuthBiometricOnly()`. */
+        userAuthStrength?: 'DEVICE_OWNER' | 'BIOMETRIC_CURRENT_SET';
+        /** The largest answer React Native's own https request may get (bytes, default 50 MiB, at most 256 MiB). */
+        reactNativeMaxResponseBytes?: number;
+    };
+};
+/** A native exception: its class name (`SSLPinningException`, …) and message. */
+export type NativeException = {
+    name: string;
+    message: string | null;
+};
+export type InitResult = {
+    type: 'ready';
+    version: number;
+} | {
+    type: 'failed';
+    reason: string;
+    exception: NativeException | null;
+};
+export type UpdateResult = {
+    type: 'updated';
+    newVersion: number;
+} | {
+    type: 'alreadyCurrent';
+} | {
+    type: 'failed';
+    reason: string;
+    exception: NativeException | null;
+};
+export type KeySecurityLevel = 'STRONGBOX' | 'TRUSTED_ENVIRONMENT' | 'SOFTWARE' | 'UNKNOWN' | 'SECURE_ENCLAVE';
+export type EnrollmentRefusal = 'INVALID_TOKEN' | 'TOKEN_REQUIRED' | 'DEVICE_ALREADY_ENROLLED' | 'REVOKED' | 'REJECTED' | 'LIMIT_REACHED' | 'EXPIRED' | 'ATTESTATION_FAILED' | 'CSR_REQUIRED' | 'OTHER';
+export type ClientCertEnrollmentResult = {
+    type: 'enrolled';
+    alreadyEnrolled: boolean;
+    keySecurityLevel: KeySecurityLevel | null;
+} | {
+    type: 'refused';
+    reason: EnrollmentRefusal;
+    httpStatus: number;
+    serverError: string | null;
+    message: string | null;
+} | {
+    type: 'pending';
+    requestId: string;
+    clientId: string | null;
+    message: string | null;
+    retryAfterSeconds: number | null;
+    verificationCode: string | null;
+} | {
+    type: 'failed';
+    message: string;
+    cause: NativeException | null;
+};
+/**
+ * `VaultFileResult`. `updated` carries no content: read it with `loadFile(key)`
+ * (or `unlockFile` for files behind the screen lock).
+ */
+export type VaultFileResult = {
+    type: 'updated';
+    key: string;
+    version: number;
+} | {
+    type: 'alreadyCurrent';
+    key: string;
+    version: number;
+} | {
+    type: 'failed';
+    key: string;
+    reason: string;
+    code: string;
+    exception: NativeException | null;
+};
+export type VaultFileStatus = 'AVAILABLE' | 'LOCKED' | 'NOT_STORED' | 'STALE' | 'NEEDS_FETCH' | 'INTEGRITY_FAILED' | 'STORAGE_UNAVAILABLE';
+export type ContentEncoding = 'utf8' | 'base64';
+export type VaultFileUnlockPrompt = {
+    title: string;
+    subtitle?: string;
+    description?: string;
+    negativeButtonText?: string;
+};
+export type VaultFileUnlockResult = {
+    type: 'unlocked';
+    key: string;
+    version: number;
+    content: string;
+    encoding: ContentEncoding;
+} | {
+    type: 'notFound';
+    key: string;
+} | {
+    type: 'cancelled';
+    key: string;
+} | {
+    type: 'invalidated';
+    key: string;
+} | {
+    type: 'stale';
+    key: string;
+} | {
+    type: 'failed';
+    key: string;
+    reason: string;
+    exception: NativeException | null;
+};
+export type AttestationResult = 'PASS' | 'REJECT' | 'FAILED' | 'NOT_ATTESTED' | 'UNSUPPORTED';
+export type AttestationStatus = {
+    configApiId: string;
+    result: AttestationResult;
+    arc: string | null;
+    rejectionReasons: string[];
+    warnings: string[];
+    tokenExpiresAt: number | null;
+    lastAttestedAt: number | null;
+    nextAttestAt: number | null;
+    clockSkewMs: number | null;
+    lastError: string | null;
+    policyVersion: number | null;
+};
+/** `PinVault-Token` for your own HTTP client. The value is a bearer credential: never log it. */
+export type AttestationTokenResult = {
+    type: 'token';
+    value: string;
+    expiresAt: number;
+} | {
+    type: 'rejected';
+    status: AttestationStatus;
+} | {
+    type: 'failed';
+    message: string;
+} | {
+    type: 'unsupported';
+};
+export type SigningStatus = {
+    configApiId: string;
+    trustedKeyIds: string[];
+    requiredSignatures: number;
+    keySetVersion: number;
+    recoveryKeyIds: string[];
+    lastConfigSignedBy: string[];
+};
+/** `PinVaultConnectionEvent`. Never carries a token, a password or file content. */
+export type PinVaultConnectionEvent = {
+    type: 'connection';
+    hostname: string;
+    success: boolean;
+    pinVersion: number;
+    deviceManufacturer: string;
+    deviceModel: string;
+    actualPin: string;
+    expectedPins: string[];
+} | {
+    type: 'configUpdate';
+    status: 'UPDATED' | 'UNCHANGED' | 'FAILED';
+    newVersion: number;
+    deviceManufacturer: string;
+    deviceModel: string;
+    failureReason: string | null;
+} | {
+    type: 'clientCertRenewal';
+    status: 'RENEWED' | 'NOT_NEEDED' | 'REENROLL_REQUIRED' | 'FAILED';
+    notAfterEpochMs: number;
+    via: string | null;
+    configApiId: string;
+    deviceManufacturer: string;
+    deviceModel: string;
+    failureReason: string | null;
+} | {
+    type: 'attestation';
+    configApiId: string;
+    status: 'PASS' | 'REJECT' | 'FAILED';
+    arc: string | null;
+    rejectionReasons: string[];
+    warnings: string[];
+    tokenExpiresAt: number | null;
+    deviceManufacturer: string;
+    deviceModel: string;
+    failureReason: string | null;
+};
+export type HttpMethod = 'GET' | 'HEAD' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'OPTIONS';
+/**
+ * `HttpConnectionSettings` (seconds). With settings the request uses
+ * `getClient(settings)` / `session(settings:)`: pinning without pin-mismatch recovery.
+ */
+export type HttpConnectionSettings = {
+    connectTimeout?: number;
+    readTimeout?: number;
+    writeTimeout?: number;
+    callTimeout?: number;
+};
+export type PinVaultRequestInit = {
+    method?: HttpMethod;
+    headers?: Record<string, string>;
+    /** Request body: text, or Base64 with `bodyEncoding: 'base64'`. At most 10 MiB. */
+    body?: string;
+    bodyEncoding?: ContentEncoding;
+    /** How the response body comes back (default `utf8`). */
+    responseEncoding?: ContentEncoding;
+    /** Whole-call timeout in ms (default: the client's). */
+    timeoutMs?: number;
+    /** Larger responses are refused (default 10 MiB, at most 50 MiB). */
+    maxResponseBytes?: number;
+    settings?: HttpConnectionSettings;
+};
+export type PinVaultResponse = {
+    status: number;
+    url: string;
+    /** Lower-case names; repeated headers joined with `, `. */
+    headers: Record<string, string>;
+    body: string;
+    bodyEncoding: ContentEncoding;
+    ok: boolean;
+};
+//# sourceMappingURL=types.d.ts.map

package/lib/typescript/src/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,QAAQ,GAAG,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;AAEjF,qGAAqG;AACrG,MAAM,MAAM,QAAQ,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAE1D,4GAA4G;AAC5G,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,kGAAkG;AAClG,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,QAAQ,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;AACnE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,YAAY,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,GAAG,WAAW,CAAC;AACnF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,aAAa,CAAC,EAAE,QAAQ,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,QAAQ,GAAG,YAAY,GAAG,aAAa,CAAC;AAEhF;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,gBAAgB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE3F,yCAAyC;AACzC,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,QAAQ,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,sBAAsB,CAAC,EAAE,QAAQ,CAAC;IAClC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,2FAA2F;IAC3F,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAC;IAC7C,8CAA8C;IAC9C,OAAO,CAAC,EAAE;QACR,qDAAqD;QACrD,kCAAkC,CAAC,EAAE,OAAO,CAAC;QAC7C;;;;WAIG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,uGAAuG;QACvG,wBAAwB,CAAC,EAAE,OAAO,CAAC;QACnC,mGAAmG;QACnG,sBAAsB,CAAC,EAAE,OAAO,CAAC;KAClC,CAAC;IACF,8CAA8C;IAC9C,GAAG,CAAC,EAAE;QACJ,oFAAoF;QACpF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,mFAAmF;QACnF,gBAAgB,CAAC,EAAE,cAAc,GAAG,uBAAuB,CAAC;QAC5D,4GAA4G;QAC5G,2BAA2B,CAAC,EAAE,MAAM,CAAC;KACtC,CAAC;CACH,CAAC;AAIF,iFAAiF;AACjF,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvE,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAAC;AAE1E,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAAC;AAE1E,MAAM,MAAM,gBAAgB,GACxB,WAAW,GACX,qBAAqB,GACrB,UAAU,GACV,SAAS,GACT,gBAAgB,CAAC;AAErB,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,gBAAgB,GAChB,yBAAyB,GACzB,SAAS,GACT,UAAU,GACV,eAAe,GACf,SAAS,GACT,oBAAoB,GACpB,cAAc,GACd,OAAO,CAAC;AAEZ,MAAM,MAAM,0BAA0B,GAClC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAA;CAAE,GACzF;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvE;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAAC;AAErG,MAAM,MAAM,eAAe,GACvB,WAAW,GACX,QAAQ,GACR,YAAY,GACZ,OAAO,GACP,aAAa,GACb,kBAAkB,GAClB,qBAAqB,CAAC;AAE1B,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEhD,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAC7B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,GAC9F;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvF,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,cAAc,GAAG,aAAa,CAAC;AAE9F,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,sBAAsB,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC;AAE5B,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B,CAAC;AAIF,oFAAoF;AACpF,MAAM,MAAM,uBAAuB,GAC/B;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,GACD;IACE,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,GACD;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,mBAAmB,GAAG,QAAQ,CAAC;IAClE,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,GACD;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACrC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAAC;AAIN,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE1F;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,sBAAsB,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,eAAe,CAAC;IAC9B,EAAE,EAAE,OAAO,CAAC;CACb,CAAC"}

package/package.json

@@ -1,6 +1,130 @@
 {
   "name": "@umutcansu/react-native-pinvault",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "2.3.2",
+  "description": "PinVault for React Native: dynamic certificate pinning with signed remote configs, mTLS enrollment and signed vault files, as a thin bridge over the native PinVault libraries",
+  "main": "./lib/module/index.js",
+  "types": "./lib/typescript/src/index.d.ts",
+  "exports": {
+    ".": {
+      "pinvault-source": "./src/index.ts",
+      "types": "./lib/typescript/src/index.d.ts",
+      "default": "./lib/module/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "src",
+    "lib",
+    "android/build.gradle",
+    "android/consumer-rules.pro",
+    "android/src/main",
+    "ios/*.h",
+    "ios/*.mm",
+    "ios/*.swift",
+    "ios/Core",
+    "*.podspec",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE",
+    "!**/__tests__",
+    "!**/__mocks__",
+    "!**/.*"
+  ],
+  "scripts": {
+    "prepare": "bob build",
+    "typecheck": "tsc --noEmit",
+    "test": "jest",
+    "clean": "rm -rf lib android/build"
+  },
+  "keywords": [
+    "react-native",
+    "certificate-pinning",
+    "ssl-pinning",
+    "mtls",
+    "security",
+    "ios",
+    "android"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/umutcansu/PinVault.git",
+    "directory": "pinvault-react-native"
+  },
+  "author": "Umut Cansu <umutcansu@gmail.com> (https://github.com/umutcansu)",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/umutcansu/PinVault/issues"
+  },
+  "homepage": "https://github.com/umutcansu/PinVault/tree/main/pinvault-react-native#readme",
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "peerDependencies": {
+    "react": "*",
+    "react-native": ">=0.87.0"
+  },
+  "devDependencies": {
+    "@jest/globals": "^29.7.0",
+    "@react-native/babel-preset": "0.87.1",
+    "@react-native/jest-preset": "0.87.1",
+    "@types/jest": "^29.5.14",
+    "@types/react": "^19.2.0",
+    "jest": "^29.7.0",
+    "react": "19.2.3",
+    "react-native": "0.87.1",
+    "react-native-builder-bob": "^0.43.1",
+    "typescript": "^6.0.3"
+  },
+  "react-native-builder-bob": {
+    "source": "src",
+    "output": "lib",
+    "targets": [
+      [
+        "module",
+        {
+          "esm": true
+        }
+      ],
+      [
+        "typescript",
+        {
+          "project": "tsconfig.build.json"
+        }
+      ]
+    ]
+  },
+  "codegenConfig": {
+    "name": "RNPinVaultSpec",
+    "type": "modules",
+    "jsSrcsDir": "src",
+    "android": {
+      "javaPackageName": "io.github.umutcansu.pinvault.reactnative"
+    },
+    "ios": {
+      "modules": {
+        "RNPinVault": {
+          "className": "RNPinVault"
+        }
+      },
+      "modulesConformingToProtocol": {
+        "RCTURLRequestHandler": [
+          "RNPinVaultURLRequestHandler"
+        ]
+      }
+    }
+  },
+  "jest": {
+    "preset": "@react-native/jest-preset",
+    "testEnvironmentOptions": {
+      "customExportConditions": [
+        "require",
+        "react-native",
+        "pinvault-source"
+      ]
+    },
+    "modulePathIgnorePatterns": [
+      "<rootDir>/lib/"
+    ]
+  }
+}

package/src/NativePinVault.ts

@@ -0,0 +1,72 @@
+// TurboModule codegen spec (New Architecture only).
+//
+// The native side is a thin bridge over the PinVault libraries
+// (Android: io.github.umutcansu:pinvault, iOS: the PinVault Swift package).
+// Every structured input crosses as a JSON string and is parsed STRICTLY on the
+// native side (unknown keys and wrong types are refused, sizes are bounded);
+// results come back as plain objects that keep the native names. Use the typed
+// wrappers in `index.ts`, not this module directly.
+import { TurboModuleRegistry, type TurboModule, type CodegenTypes } from 'react-native';
+
+export type GuardRequest = {
+  requestId: string;
+  operation: string;
+};
+
+export interface Spec extends TurboModule {
+  // ── Start / config ────────────────────────────────────────────────────────
+  start(configJson: string): Promise<CodegenTypes.UnsafeObject>;
+  updateNow(): Promise<CodegenTypes.UnsafeObject>;
+  currentVersion(): Promise<number>;
+  hostPinVersions(): Promise<CodegenTypes.UnsafeObject>;
+  pinsForHost(hostname: string): Promise<CodegenTypes.UnsafeObject>;
+  signingStatus(configApiId: string | null): Promise<CodegenTypes.UnsafeObject>;
+  isForceUpdate(): Promise<boolean>;
+  reset(): Promise<void>;
+  schedulePeriodicUpdates(intervalHours: number | null): Promise<boolean>;
+  cancelPeriodicUpdates(): Promise<void>;
+  enableDebugLogging(): Promise<boolean>;
+
+  // ── Pinned HTTP ───────────────────────────────────────────────────────────
+  fetch(requestJson: string): Promise<CodegenTypes.UnsafeObject>;
+
+  // ── Enrollment ────────────────────────────────────────────────────────────
+  deviceId(): Promise<string | null>;
+  enrollForResult(token: string, label: string | null): Promise<CodegenTypes.UnsafeObject>;
+  autoEnrollForResult(): Promise<CodegenTypes.UnsafeObject>;
+  checkPendingEnrollment(): Promise<CodegenTypes.UnsafeObject>;
+  isEnrolled(label: string | null): Promise<boolean>;
+  isEnrollmentPending(label: string | null): Promise<boolean>;
+  enrollmentVerificationCode(label: string | null): Promise<string | null>;
+  enrolledClientCN(label: string | null): Promise<string | null>;
+  enrolledClientNotAfter(label: string | null): Promise<number | null>;
+  unenroll(label: string | null, wipeVaultFiles: boolean): Promise<void>;
+  identityKeySecurityLevel(label: string | null): Promise<string | null>;
+
+  // ── Vault files ───────────────────────────────────────────────────────────
+  setVaultToken(key: string, token: string | null): Promise<void>;
+  clearVaultTokens(): Promise<number>;
+  fetchFile(key: string, token: string | null): Promise<CodegenTypes.UnsafeObject>;
+  loadFile(key: string, encoding: string): Promise<string | null>;
+  fileStatus(key: string): Promise<string>;
+  unlockFile(key: string, promptJson: string): Promise<CodegenTypes.UnsafeObject>;
+  isFileLocked(key: string): Promise<boolean>;
+  hasFile(key: string): Promise<boolean>;
+  fileVersion(key: string): Promise<number>;
+  clearFile(key: string): Promise<void>;
+  syncAllFiles(): Promise<CodegenTypes.UnsafeObject>;
+
+  // ── Attestation ───────────────────────────────────────────────────────────
+  attestNow(configApiId: string | null): Promise<CodegenTypes.UnsafeObject>;
+  fetchAttestationToken(host: string | null): Promise<CodegenTypes.UnsafeObject>;
+  attestationStatus(configApiId: string | null): Promise<CodegenTypes.UnsafeObject>;
+
+  // ── environmentGuard answers (JS → native) ────────────────────────────────
+  answerGuard(requestId: string, allowed: boolean): void;
+
+  // ── Events ────────────────────────────────────────────────────────────────
+  readonly onConnectionEvent: CodegenTypes.EventEmitter<CodegenTypes.UnsafeObject>;
+  readonly onGuardRequest: CodegenTypes.EventEmitter<GuardRequest>;
+}
+
+export default TurboModuleRegistry.getEnforcing<Spec>('RNPinVault');