@umutcansu/react-native-pinvault 2.8.2 → 2.9.0

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## 2.9.0 — 2026-11-10
+
+### Security
+
+- **Release builds take `requiredSignatures`, `recoveryPublicKeys` and
+  `requiredRecoverySignatures` only from the native security file.** They are
+  part of the library's trust-anchor fingerprint, and a changed fingerprint
+  resets the replay watermarks; a value JS could add and drop again reset
+  them at will. A value the file does not declare is refused
+  (`E_INVALID_CONFIG`) unless it is the default (1, no recovery keys). Copy
+  what JS passes into `pinvault_security.json`. Debug builds are unchanged.
+- **An endpoint that is absolute in another spelling is refused**: whitespace
+  around the value (`" //host/x"`), a backslash anywhere and a bare `scheme:`
+  prefix, on Android and iOS.
+- **A vault file's `endpoint` follows that rule too** and may not contain a
+  `..` path segment (plain or `%2e`); it was checked for `://` and a leading
+  slash only.
+- **Breaking — release builds take `serverScope` and `clientCaPins` only from
+  the native security file.** `serverScope` names the library's config store;
+  a value JS could set where the file named none moved the store to a new
+  namespace without replay watermarks. A value the file does not declare is
+  refused (`E_INVALID_CONFIG`). Copy what JS passes into
+  `pinvault_security.json`. Debug builds are unchanged.
+- **`PinVault.fetch`: a redirect to another host or port takes only `Accept`,
+  `Accept-Language` and `User-Agent` along, and never a body** (a 307/308 that
+  would repeat one is returned as the answer). On Android the plugin now
+  follows redirects itself (OkHttp kept every header but `Authorization`); on
+  iOS the library does.
+- `PinVault.fetch` on iOS: `timeoutMs` is one limit for the whole exchange,
+  redirects included, as on Android.
+- `ios.requireUnlockedDeviceAllowFallback`: the library's
+  `requireUnlockedDevice()` no longer falls back silently on iOS (it fails
+  with `UnlockedDeviceKeyRequiredException`); this is the opt-out, the twin of
+  `android.requireUnlockedDeviceAllowFallback`.
+- Through the library: on iOS, numbers a server sends (attestation intervals,
+  a certificate's version field, a vault file's version header) can no longer
+  overflow and end the app; a blank vault file `signaturePublicKey` no longer
+  turns that file's verification off.
+- Depends on PinVault 2.9.0 (Swift package tag `v2.9.0`).
+
 ## 2.8.2 — 2026-10-21
 
 ### Changed

package/README.md

@@ -29,9 +29,9 @@ npm install @umutcansu/react-native-pinvault
 cd ios && pod install
 ```
 
-The native libraries come with it, at the package's own version: npm 2.8.2
-uses `io.github.umutcansu:pinvault:2.8.2` from Maven Central and the Swift
-package at tag `v2.8.2`. The New Architecture must stay on (React Native's
+The native libraries come with it, at the package's own version: npm 2.9.0
+uses `io.github.umutcansu:pinvault:2.9.0` from Maven Central and the Swift
+package at tag `v2.9.0`. The New Architecture must stay on (React Native's
 default since 0.76).
 
 **iOS.** The pod depends on the PinVault Swift package through React Native's

package/RNPinVault.podspec

@@ -4,7 +4,7 @@ package = JSON.parse(File.read(File.join(__dir__, "package.json")))
 
 # PinVault for iOS is a Swift package (Package.swift at the repository root,
 # product "PinVault"). React Native's spm_dependency adds it to the Pods project:
-#   - consumers: the git URL at the tag of this package's version (v2.8.2);
+#   - consumers: the git URL at the tag of this package's version (v2.9.0);
 #   - development: PINVAULT_IOS_PACKAGE_PATH = a PinVault checkout (the sample's
 #     Podfile sets it to this repository), the counterpart of pinvault.localPath.
 pinvault_url = "https://github.com/umutcansu/PinVault.git"

package/android/build.gradle

@@ -9,7 +9,7 @@ buildscript {
     kotlinVersion: "2.2.0",
     minSdkVersion: 24,
     compileSdkVersion: 36,
-    pinvaultVersion: "2.8.2",
+    pinvaultVersion: "2.9.0",
   ]
   ext.pinvaultRnExt = { prop ->
     rootProject.ext.has(prop) ? rootProject.ext.get(prop) : PinVaultRN[prop]

package/android/src/main/java/io/github/umutcansu/pinvault/reactnative/ConfigParser.kt

@@ -202,12 +202,38 @@ internal object ConfigParser {
      */
     private fun relEndpoint(f: Fields, key: String, max: Int): String? {
         val v = f.string(key, max) ?: return null
-        if (v.contains("://") || v.startsWith("/") || v.startsWith("\\")) {
+        // The URL parser skips leading whitespace and reads `\` as `/`: " //host/x"
+        // and "https:\\host/x" passed a check that only looked at the first character.
+        if (v != v.trim() || v.contains('\\') || v.contains("://") || v.startsWith("/") || SCHEME_PREFIX.containsMatchIn(v)) {
             throw BridgeInputException("${f.path}.$key: must be a relative path, not an absolute URL")
         }
         return v
     }
 
+    /** `scheme:` at the start of a value: an absolute URL however its slashes are written. */
+    private val SCHEME_PREFIX = Regex("^[A-Za-z][A-Za-z0-9+.-]*:")
+
+    /**
+     * A vault file's endpoint: required, held to the same rule as the block's
+     * endpoints ([relEndpoint] — it used to be checked for `://` and a leading
+     * slash only, so " //host/x" or "https:\\host/x" sent the file request and
+     * the file's token to another host), and without a `..` segment: the
+     * endpoint is resolved against the block's URL, and `..` would climb out of
+     * the path the app's native side declared for that Config API.
+     */
+    private fun vaultEndpoint(f: Fields): String {
+        val endpoint = relEndpoint(f, "endpoint", 512) ?: throw BridgeInputException("${f.path}.endpoint: required")
+        if (hasParentSegment(endpoint)) {
+            throw BridgeInputException("${f.path}.endpoint: must not contain a '..' path segment")
+        }
+        return endpoint
+    }
+
+    /** True when the path of [endpoint] has a `..` segment, written plainly or as `%2e` (URL parsers read both). */
+    internal fun hasParentSegment(endpoint: String): Boolean =
+        endpoint.substringBefore('?').substringBefore('#').split('/')
+            .any { it.replace("%2e", ".", ignoreCase = true) == ".." }
+
     fun hostPin(p: Fields): HostPin {
         val hostname = p.requireString("hostname", 255)
         val pins = p.stringList("sha256", MAX_PINS_PER_HOST, 128) ?: throw BridgeInputException("${p.path}.sha256: required")
@@ -370,10 +396,7 @@ internal object ConfigParser {
         if (!VAULT_KEY.matches(key) || key.all { it == '.' }) {
             throw BridgeInputException("${f.path}.key: must match [A-Za-z0-9._-]{1,64} and not be only dots")
         }
-        val endpoint = f.requireString("endpoint", 512)
-        if (endpoint.contains("://") || endpoint.startsWith("/") || endpoint.startsWith("\\")) {
-            throw BridgeInputException("${f.path}.endpoint: must be a relative path, not an absolute URL")
-        }
+        val endpoint = vaultEndpoint(f)
         val jsSignatureKey = f.string("signaturePublicKey", KEY_LENGTH, multiline = true)
         val updateWithPins = f.bool("updateWithPins")
         val storage = f.enum("storage", StorageStrategy.values())

package/android/src/main/java/io/github/umutcansu/pinvault/reactnative/NativeSecurity.kt

@@ -349,15 +349,31 @@ internal object SecurityPolicy {
             return nativeValue
         }
 
+        // The signing keys' threshold, the recovery keys and theirs are part of the
+        // library's trust-anchor fingerprint, and a changed fingerprint resets the
+        // replay watermarks. In a release build they are the file's alone: a value
+        // the bundle could add and drop again would reset them at will (a default — 1,
+        // no recovery keys — changes nothing and is let through).
+        // `serverScope` names the library's config store: another scope is another
+        // namespace, which starts with no watermarks at all — a bundle that sets one
+        // makes the device accept a replayed old config. `clientCaPins` decide which
+        // CA may issue the device's identity. Both follow the same rule.
+        fun <T : Any> anchorOnly(key: String, nativeValue: T?, jsValue: T?, isDefault: (T) -> Boolean): T? {
+            if (release && nativeValue == null && jsValue != null && !isDefault(jsValue)) throw BridgeInputException(
+                "$path.$key: a release build takes it only from the app's native security file (${native.source}); " +
+                    "declare $key for Config API '$id' there")
+            return jsValue
+        }
+
         return SecurityFields(
             bootstrapPins = pins,
             oneKey = oneKey,
             keys = keys,
-            requiredSignatures = one("requiredSignatures", block.requiredSignatures, js.requiredSignatures),
-            recoveryKeys = list("recoveryPublicKeys", block.recoveryPublicKeys, js.recoveryKeys),
-            requiredRecovery = one("requiredRecoverySignatures", block.requiredRecoverySignatures, js.requiredRecovery),
-            serverScope = one("serverScope", block.serverScope, js.serverScope),
-            clientCaPins = list("clientCaPins", block.clientCaPins, js.clientCaPins),
+            requiredSignatures = one("requiredSignatures", block.requiredSignatures, anchorOnly("requiredSignatures", block.requiredSignatures, js.requiredSignatures) { it == 1 }),
+            recoveryKeys = list("recoveryPublicKeys", block.recoveryPublicKeys, anchorOnly("recoveryPublicKeys", block.recoveryPublicKeys, js.recoveryKeys) { it.isEmpty() }),
+            requiredRecovery = one("requiredRecoverySignatures", block.requiredRecoverySignatures, anchorOnly("requiredRecoverySignatures", block.requiredRecoverySignatures, js.requiredRecovery) { it == 1 }),
+            serverScope = one("serverScope", block.serverScope, anchorOnly("serverScope", block.serverScope, js.serverScope) { false }),
+            clientCaPins = list("clientCaPins", block.clientCaPins, anchorOnly("clientCaPins", block.clientCaPins, js.clientCaPins) { it.isEmpty() }),
             // The file is the source of truth for the relaxations too.
             allowUnsigned = block.allowUnsigned,
             allowUnpinned = block.allowUnpinnedConfigApi,

package/android/src/main/java/io/github/umutcansu/pinvault/reactnative/PinnedFetch.kt

@@ -8,9 +8,12 @@ import okhttp3.MediaType.Companion.toMediaTypeOrNull
 import okhttp3.OkHttpClient
 import okhttp3.Request
 import okhttp3.RequestBody.Companion.toRequestBody
+import okhttp3.Response
 import okio.Buffer
 import okio.ByteString.Companion.decodeBase64
 import java.io.IOException
+import java.io.InterruptedIOException
+import java.net.ProtocolException
 import java.util.concurrent.TimeUnit
 
 /** A `fetch(url, init)` from JS, checked. */
@@ -32,7 +35,9 @@ internal class ResponseTooLargeException(limit: Long) : IOException("Response la
  * The plugin's own `fetch`: parsed strictly, sent through the pinned client
  * the library hands out (`PinVault.getClient()` or `getClient(settings)`),
  * HTTPS only, bounded in both directions. A redirect from `https` into plain
- * `http` is not followed (the 3xx comes back), as on iOS.
+ * `http` is not followed (the 3xx comes back), as on iOS. A redirect to
+ * another host or port takes only [CROSS_ORIGIN_HEADERS] along and never a
+ * body ([followUp]).
  */
 internal object PinnedFetch {
 
@@ -50,6 +55,56 @@ internal object PinnedFetch {
         "Host", "Connection", "Keep-Alive", "Proxy-Connection", "TE", "Trailer", "Transfer-Encoding", "Upgrade", "Content-Length",
     )
 
+    /**
+     * The only request headers that follow a redirect to another host or port
+     * (lower case): what the client accepts and what it is. Everything else
+     * the caller set was meant for the host it named.
+     */
+    val CROSS_ORIGIN_HEADERS = setOf("accept", "accept-language", "user-agent")
+
+    /** As OkHttp's own limit. */
+    const val MAX_FOLLOW_UPS = 20
+    private val REDIRECT_CODES = setOf(300, 301, 302, 303, 307, 308)
+
+    /** Why a caller may not set request header [name], or null when it may: the library's and the HTTP client's own. */
+    fun refusedHeader(name: String): String? = when {
+        LIBRARY_HEADERS.any { it.equals(name, ignoreCase = true) } -> "set by PinVault itself (a token host's requests carry it)"
+        CLIENT_HEADERS.any { it.equals(name, ignoreCase = true) } -> "set by the HTTP client (host, connection and framing headers)"
+        else -> null
+    }
+
+    /**
+     * [refusedHeader] for a WebSocket's upgrade request, which is an HTTP
+     * request like any other (a caller's `Host` would name another site on the
+     * pinned connection), plus the handshake's own `Sec-WebSocket-*` headers.
+     */
+    fun refusedSocketHeader(name: String): String? = refusedHeader(name)
+        ?: if (name.startsWith("Sec-WebSocket-", ignoreCase = true)) "set by the WebSocket handshake" else null
+
+    const val MAX_SOCKET_PROTOCOLS = 8
+    const val MAX_SOCKET_PROTOCOL_LENGTH = 64
+
+    /**
+     * A WebSocket's subprotocols as the caller listed them, checked: the
+     * bridge writes `Sec-WebSocket-Protocol` from this list itself (the header
+     * is refused from the caller, [refusedSocketHeader]). Each entry is an
+     * RFC 7230 token — so no comma, space or control character can add a
+     * second value or a second header — of bounded length, and none twice
+     * (RFC 6455 §4.1).
+     */
+    fun socketProtocols(raw: List<*>?): List<String> {
+        if (raw == null) return emptyList()
+        if (raw.size > MAX_SOCKET_PROTOCOLS) throw BridgeInputException("protocols: at most $MAX_SOCKET_PROTOCOLS")
+        val seen = HashSet<String>()
+        return raw.map { entry ->
+            if (entry !is String || entry.length > MAX_SOCKET_PROTOCOL_LENGTH || !TOKEN.matches(entry)) {
+                throw BridgeInputException("protocols: each must be a token (RFC 7230) of at most $MAX_SOCKET_PROTOCOL_LENGTH characters")
+            }
+            if (!seen.add(entry)) throw BridgeInputException("protocols: '$entry' is listed twice")
+            entry
+        }
+    }
+
     fun parse(json: String): FetchRequest {
         // Base64 inflates by 4/3; leave room for the other fields.
         val f = StrictJson.parseObject(json, "request", maxChars = (MAX_REQUEST_BYTES * 4 / 3 + 64 * 1024).toInt())
@@ -61,12 +116,7 @@ internal object PinnedFetch {
         val headers = Headers.Builder()
         f.stringMap("headers", 128, 256, 8192)?.forEach { (name, value) ->
             if (!TOKEN.matches(name)) throw BridgeInputException("request.headers: '${name.take(40)}' is not a header name")
-            if (LIBRARY_HEADERS.any { it.equals(name, ignoreCase = true) }) {
-                throw BridgeInputException("request.headers.$name: set by PinVault itself (a token host's requests carry it)")
-            }
-            if (CLIENT_HEADERS.any { it.equals(name, ignoreCase = true) }) {
-                throw BridgeInputException("request.headers.$name: set by the HTTP client (host, connection and framing headers)")
-            }
+            refusedHeader(name)?.let { why -> throw BridgeInputException("request.headers.$name: $why") }
             if (value.any { it == '\r' || it == '\n' || it.code == 0 }) {
                 throw BridgeInputException("request.headers.$name: line breaks are not allowed")
             }
@@ -104,18 +154,77 @@ internal object PinnedFetch {
     /** Runs [request] on [client] (a pinned client from the library); blocking. */
     fun execute(client: OkHttpClient, request: FetchRequest): Map<String, Any?> {
         // newBuilder shares the pool, the pinned socket factory and the
-        // library's interceptors; it only stops https → http redirects.
-        val callClient = client.newBuilder().followSslRedirects(false).build()
+        // library's interceptors. Redirects are followed here, not by OkHttp:
+        // OkHttp sends every header but Authorization — and the body of a
+        // 307/308 — to whatever host the Location names (see followUp).
+        val callClient = client.newBuilder().followRedirects(false).followSslRedirects(false).build()
         val contentType = request.headers["Content-Type"]?.toMediaTypeOrNull()
         val body = when {
             request.body != null -> request.body.toRequestBody(contentType)
             request.method in setOf("POST", "PUT", "PATCH") -> ByteArray(0).toRequestBody(contentType)
             else -> null
         }
-        val okRequest = Request.Builder().url(request.url).headers(request.headers).method(request.method, body).build()
-        val call = callClient.newCall(okRequest)
-        request.timeoutMs?.let { call.timeout().timeout(it, TimeUnit.MILLISECONDS) }
-        call.execute().use { response ->
+        var okRequest = Request.Builder().url(request.url).headers(request.headers).method(request.method, body).build()
+        // One time limit for the whole exchange, redirects included, as when OkHttp followed them.
+        val deadline = request.timeoutMs?.let { System.nanoTime() + TimeUnit.MILLISECONDS.toNanos(it) }
+        var followUps = 0
+        while (true) {
+            val call = callClient.newCall(okRequest)
+            if (deadline != null) {
+                val left = deadline - System.nanoTime()
+                if (left <= 0) throw InterruptedIOException("timeout")
+                call.timeout().timeout(left, TimeUnit.NANOSECONDS)
+            }
+            val response = call.execute()
+            // A client the app told not to follow redirects still does not.
+            val next = if (client.followRedirects) followUp(okRequest, response) else null
+            if (next == null) return read(response, request)
+            response.close()
+            followUps++
+            if (followUps > MAX_FOLLOW_UPS) throw ProtocolException("Too many follow-up requests: $followUps")
+            okRequest = next
+        }
+    }
+
+    /**
+     * The next request for a 3xx, or null when [response] is the answer.
+     * Built from [sent] — the request as this class made it, not as the
+     * library's interceptors completed it: what they add (the attestation
+     * token of a token host) is added again for the next hop, for its host.
+     *
+     * To the same host and port everything goes along, as OkHttp does it
+     * (301/302/303 turn a POST into a GET; 307/308 repeat method and body).
+     * To another host or port only [CROSS_ORIGIN_HEADERS] go along — a fixed
+     * list of credential names would miss an app's own session or API-key
+     * header — and a body is not sent again: a 307/308 that would repeat it
+     * there is the answer. A redirect into plain `http` is never followed.
+     */
+    internal fun followUp(sent: Request, response: Response): Request? {
+        if (response.code !in REDIRECT_CODES) return null
+        val location = response.header("Location") ?: return null
+        val target = sent.url.resolve(location) ?: return null
+        if (!target.isHttps) return null
+        val next = sent.newBuilder().url(target)
+        var repeatsBody = false
+        if (sent.method != "GET" && sent.method != "HEAD") {
+            if (response.code == 307 || response.code == 308) {
+                repeatsBody = (sent.body?.contentLength() ?: 0L) != 0L
+            } else {
+                next.method("GET", null)
+                listOf("Transfer-Encoding", "Content-Length", "Content-Type").forEach { next.removeHeader(it) }
+            }
+        }
+        val sameOrigin = target.host == sent.url.host && target.port == sent.url.port
+        if (!sameOrigin) {
+            if (repeatsBody) return null
+            sent.headers.names().filter { it.lowercase() !in CROSS_ORIGIN_HEADERS }.forEach { next.removeHeader(it) }
+        }
+        return next.build()
+    }
+
+    /** Reads [response] under the request's size limit and maps it for the bridge; closes it. */
+    private fun read(response: Response, request: FetchRequest): Map<String, Any?> {
+        response.use {
             val responseBody = response.body
             val declared = responseBody?.contentLength() ?: -1L
             if (declared > request.maxResponseBytes) throw ResponseTooLargeException(request.maxResponseBytes)

package/ios/Core/ConfigParser.swift

@@ -99,7 +99,7 @@ public enum ConfigParser {
         } else if let max = require.vaultFileMaxOfflineAgeMs {
             builder.vaultFileMaxOfflineAge(max, .milliseconds)
         }
-        if try root.bool("requireUnlockedDevice") == true || require.requireUnlockedDevice { builder.requireUnlockedDevice() }
+        let requireUnlocked = try root.bool("requireUnlockedDevice") == true || require.requireUnlockedDevice
         if try root.bool("requireHardwareBackedKeys") == true || require.requireHardwareBackedKeys { builder.requireHardwareBackedKeys() }
         if try root.bool("managedTrustRoots") == true || require.managedTrustRoots { builder.managedTrustRoots() }
         if let v = try root.stringList("expectedSignerSha256", maxItems: 16, maxLength: 128) { builder.expectedSignerSha256(v) }
@@ -121,7 +121,11 @@ public enum ConfigParser {
         // Android-only settings: the Android side reads them; here only their shape is checked.
         _ = try root.object("android")
         var maxRN = ReactNetworking.defaultMaxResponseBytes
+        // `requireUnlockedDevice(allowFallback: true)`: off unless the app asks for it here
+        // (the Android twin is `android.requireUnlockedDeviceAllowFallback`).
+        var allowFallback = false
         if let ios = try root.object("ios") {
+            allowFallback = try ios.bool("requireUnlockedDeviceAllowFallback") == true
             if let v = try ios.int64("reactNativeMaxResponseBytes", min: 1, max: ReactNetworking.maxResponseBytesLimit) { maxRN = v }
             try applyResolve(try ios.stringMap("resolve", maxItems: 64, maxKeyLength: 255, maxValueLength: 255),
                              native: native, release: release, to: builder)
@@ -147,6 +151,10 @@ public enum ConfigParser {
             if let v = require.expectedTeamIds { builder.expectedTeamId(v) }
             if let v = require.userAuthStrength { builder.userAuthStrength(v) }
         }
+        if allowFallback && !requireUnlocked {
+            throw BridgeInputError("config.ios.requireUnlockedDeviceAllowFallback: needs requireUnlockedDevice: true")
+        }
+        if requireUnlocked { builder.requireUnlockedDevice(allowFallback: allowFallback) }
 
         try root.finish()
         if let listener { builder.onConnectionEvent(listener) }
@@ -225,12 +233,38 @@ public enum ConfigParser {
     /// is refused (RN-2). Returns nil when the optional field is absent.
     static func relEndpoint(_ f: Fields, _ key: String, maxLength: Int) throws -> String? {
         guard let v = try f.string(key, maxLength: maxLength) else { return nil }
-        if v.contains("://") || v.hasPrefix("/") || v.hasPrefix("\\") {
+        // Whitespace around it, a backslash anywhere (parsers read it as `/`) or a
+        // `scheme:` prefix: an absolute URL however its slashes are written.
+        if v != v.trimmingCharacters(in: .whitespacesAndNewlines) || v.contains("\\") || v.contains("://") || v.hasPrefix("/")
+            || v.range(of: "^[A-Za-z][A-Za-z0-9+.-]*:", options: .regularExpression) != nil {
             throw BridgeInputError("\(f.path).\(key): must be a relative path, not an absolute URL")
         }
         return v
     }
 
+    /// A vault file's endpoint: required, held to the same rule as the block's
+    /// endpoints (`relEndpoint` — it used to be checked for `://` and a leading
+    /// slash only, so " //host/x" or "https:\\host/x" sent the file request and
+    /// the file's token to another host), and without a `..` segment: the
+    /// endpoint is resolved against the block's URL, and `..` would climb out of
+    /// the path the app's native side declared for that Config API.
+    static func vaultEndpoint(_ f: Fields) throws -> String {
+        guard let endpoint = try relEndpoint(f, "endpoint", maxLength: 512) else {
+            throw BridgeInputError("\(f.path).endpoint: required")
+        }
+        if hasParentSegment(endpoint) {
+            throw BridgeInputError("\(f.path).endpoint: must not contain a '..' path segment")
+        }
+        return endpoint
+    }
+
+    /// True when the path of `endpoint` has a `..` segment, written plainly or as `%2e` (URL parsers read both).
+    static func hasParentSegment(_ endpoint: String) -> Bool {
+        let path = endpoint.prefix { $0 != "?" && $0 != "#" }
+        return path.split(separator: "/", omittingEmptySubsequences: false)
+            .contains { $0.replacingOccurrences(of: "%2e", with: ".", options: .caseInsensitive) == ".." }
+    }
+
     public static func hostPin(_ p: Fields) throws -> HostPin {
         let hostname = try p.requireString("hostname", maxLength: 255)
         guard let pins = try p.stringList("sha256", maxItems: maxPinsPerHost, maxLength: 128) else {
@@ -411,10 +445,7 @@ public enum ConfigParser {
 
     static func addVaultFile(_ builder: PinVaultConfig.Builder, _ f: Fields, _ tokens: VaultTokenStore, native: NativeSecurity?) throws {
         let key = try f.requireString("key", maxLength: 128)
-        let endpoint = try f.requireString("endpoint", maxLength: 512)
-        if endpoint.contains("://") || endpoint.hasPrefix("/") || endpoint.hasPrefix("\\") {
-            throw BridgeInputError("\(f.path).endpoint: must be a relative path, not an absolute URL")
-        }
+        let endpoint = try vaultEndpoint(f)
         let jsSignatureKey = try f.string("signaturePublicKey", maxLength: keyLength, multiline: true)
         let updateWithPins = try f.bool("updateWithPins")
         let storage = try f.enumValue("storage", StorageStrategy.self)

package/ios/Core/NativeSecurity.swift

@@ -311,11 +311,32 @@ enum SecurityPolicy {
             if let j, !NativeSecurity.sameKeys(j, n) { throw fixed(key) }
             return n
         }
-        out.requiredSignatures = try one("requiredSignatures", block.requiredSignatures, js.requiredSignatures)
-        out.recoveryKeys = try list("recoveryPublicKeys", block.recoveryPublicKeys, js.recoveryKeys)
-        out.requiredRecovery = try one("requiredRecoverySignatures", block.requiredRecoverySignatures, js.requiredRecovery)
-        out.serverScope = try one("serverScope", block.serverScope, js.serverScope)
-        out.clientCaPins = try list("clientCaPins", block.clientCaPins, js.clientCaPins)
+        // The signing keys' threshold, the recovery keys and theirs are part of the
+        // library's trust-anchor fingerprint, and a changed fingerprint resets the
+        // replay watermarks. In a release build they are the file's alone: a value
+        // the bundle could add and drop again would reset them at will (a default — 1,
+        // no recovery keys — changes nothing and is let through).
+        // `serverScope` names the library's config store: another scope is another
+        // namespace, which starts with no watermarks at all — a bundle that sets one
+        // makes the device accept a replayed old config. `clientCaPins` decide which
+        // CA may issue the device's identity. Both follow the same rule.
+        func anchorOnly<T>(_ key: String, _ n: T?, _ j: T?, isDefault: (T) -> Bool) throws -> T? {
+            if release, n == nil, let j, !isDefault(j) {
+                throw BridgeInputError("\(path).\(key): a release build takes it only from the app's native security file (\(native.source)); "
+                    + "declare \(key) for Config API '\(id)' there")
+            }
+            return j
+        }
+        out.requiredSignatures = try one("requiredSignatures", block.requiredSignatures,
+            try anchorOnly("requiredSignatures", block.requiredSignatures, js.requiredSignatures) { $0 == 1 })
+        out.recoveryKeys = try list("recoveryPublicKeys", block.recoveryPublicKeys,
+            try anchorOnly("recoveryPublicKeys", block.recoveryPublicKeys, js.recoveryKeys) { $0.isEmpty })
+        out.requiredRecovery = try one("requiredRecoverySignatures", block.requiredRecoverySignatures,
+            try anchorOnly("requiredRecoverySignatures", block.requiredRecoverySignatures, js.requiredRecovery) { $0 == 1 })
+        out.serverScope = try one("serverScope", block.serverScope,
+            try anchorOnly("serverScope", block.serverScope, js.serverScope) { _ in false })
+        out.clientCaPins = try list("clientCaPins", block.clientCaPins,
+            try anchorOnly("clientCaPins", block.clientCaPins, js.clientCaPins) { $0.isEmpty })
         // The file is the source of truth for the relaxations too.
         out.allowUnsigned = block.allowUnsigned
         out.allowUnpinned = block.allowUnpinnedConfigApi

package/ios/Core/PinnedFetch.swift

@@ -33,6 +33,69 @@ public enum PinnedFetch {
     static let clientHeaders = ["Host", "Connection", "Keep-Alive", "Proxy-Connection", "TE", "Trailer",
                                 "Transfer-Encoding", "Upgrade", "Content-Length"]
 
+    /// Why a caller may not set request header `name`, or nil when it may: the library's and the HTTP client's own.
+    public static func refusedHeader(_ name: String) -> String? {
+        if libraryHeaders.contains(where: { $0.caseInsensitiveCompare(name) == .orderedSame }) {
+            return "set by PinVault itself (a token host's requests carry it)"
+        }
+        if clientHeaders.contains(where: { $0.caseInsensitiveCompare(name) == .orderedSame }) {
+            return "set by the HTTP client (host, connection and framing headers)"
+        }
+        return nil
+    }
+
+    /// ``refusedHeader(_:)`` for a WebSocket's upgrade request, which is an HTTP
+    /// request like any other (a caller's `Host` would name another site on the
+    /// pinned connection), plus the handshake's own `Sec-WebSocket-*` headers.
+    public static func refusedSocketHeader(_ name: String) -> String? {
+        if let why = refusedHeader(name) { return why }
+        return name.lowercased().hasPrefix("sec-websocket-") ? "set by the WebSocket handshake" : nil
+    }
+
+    public static let maxSocketProtocols = 8
+    public static let maxSocketProtocolLength = 64
+
+    /// A WebSocket's subprotocols as the caller listed them, checked: the
+    /// bridge writes `Sec-WebSocket-Protocol` from this list itself (the header
+    /// is refused from the caller, ``refusedSocketHeader(_:)``). Each entry is
+    /// an RFC 7230 token — so no comma, space or control character can add a
+    /// second value or a second header — of bounded length, and none twice
+    /// (RFC 6455 §4.1).
+    public static func socketProtocols(_ raw: [Any]?) throws -> [String] {
+        guard let raw else { return [] }
+        if raw.count > maxSocketProtocols { throw BridgeInputError("protocols: at most \(maxSocketProtocols)") }
+        var seen = Set<String>()
+        return try raw.map { entry in
+            guard let name = entry as? String, !name.isEmpty, name.unicodeScalars.count <= maxSocketProtocolLength,
+                  name.unicodeScalars.allSatisfy({ tokenChars.contains($0) }) else {
+                throw BridgeInputError("protocols: each must be a token (RFC 7230) of at most \(maxSocketProtocolLength) characters")
+            }
+            if !seen.insert(name).inserted { throw BridgeInputError("protocols: '\(name)' is listed twice") }
+            return name
+        }
+    }
+
+    /// `operation` under one time limit for the whole exchange, redirects
+    /// included (Android: OkHttp's call timeout). A request's own
+    /// `timeoutInterval` starts again at every hop and only counts idle time;
+    /// `timeoutMs` promises the caller an answer or a failure by then.
+    static func withDeadline<T>(_ timeoutMs: Int64?, _ operation: @escaping () async throws -> T) async throws -> T {
+        guard let timeoutMs else { return try await operation() }
+        return try await withThrowingTaskGroup(of: T?.self) { group in
+            group.addTask { try await operation() }
+            group.addTask {
+                try await Task.sleep(nanoseconds: UInt64(timeoutMs) * 1_000_000)
+                return nil
+            }
+            // Whichever ends first decides; the other is cancelled (a running request with it).
+            defer { group.cancelAll() }
+            guard let first = try await group.next(), let value = first else {
+                throw PinVaultError.io(message: "timeout", cause: URLError(.timedOut))
+            }
+            return value
+        }
+    }
+
     public static func parse(_ json: String) throws -> FetchRequest {
         let f = try StrictJSON.parseObject(json, path: "request", maxChars: Int(maxRequestBytes * 4 / 3) + 64 * 1024)
         let urlText = try f.requireString("url", maxLength: 8192)
@@ -47,12 +110,7 @@ public enum PinnedFetch {
             guard name.unicodeScalars.allSatisfy({ tokenChars.contains($0) }) else {
                 throw BridgeInputError("request.headers: '\(name.prefix(40))' is not a header name")
             }
-            if libraryHeaders.contains(where: { $0.caseInsensitiveCompare(name) == .orderedSame }) {
-                throw BridgeInputError("request.headers.\(name): set by PinVault itself (a token host's requests carry it)")
-            }
-            if clientHeaders.contains(where: { $0.caseInsensitiveCompare(name) == .orderedSame }) {
-                throw BridgeInputError("request.headers.\(name): set by the HTTP client (host, connection and framing headers)")
-            }
+            if let why = refusedHeader(name) { throw BridgeInputError("request.headers.\(name): \(why)") }
             if value.unicodeScalars.contains(where: { $0 == "\r" || $0 == "\n" || $0.value == 0 }) {
                 throw BridgeInputError("request.headers.\(name): line breaks are not allowed")
             }
@@ -105,7 +163,10 @@ public enum PinnedFetch {
     /// library stops reading once the body passes `maxResponseBytes` (a
     /// declared `Content-Length` over it is refused before the body is read).
     public static func execute(_ session: PinnedSession, _ r: FetchRequest) async throws -> [String: Any] {
-        let (data, response) = try await session.data(for: urlRequest(r), maxResponseBytes: r.maxResponseBytes)
+        let request = urlRequest(r)
+        let (data, response) = try await withDeadline(r.timeoutMs) {
+            try await session.data(for: request, maxResponseBytes: r.maxResponseBytes)
+        }
         guard let http = response as? HTTPURLResponse else { throw BridgeInputError("not an HTTP response") }
         return try map(http, data, r)
     }

package/lib/typescript/src/types.d.ts

@@ -149,6 +149,12 @@ export type PinVaultConfig = {
         userAuthStrength?: 'DEVICE_OWNER' | 'BIOMETRIC_CURRENT_SET';
         /** The largest answer React Native's own https request may get (bytes, default 50 MiB, at most 256 MiB). */
         reactNativeMaxResponseBytes?: number;
+        /**
+         * `requireUnlockedDevice(allowFallback: true)`: when the Keychain refuses a key that
+         * works only while the device is unlocked, make it without that requirement instead
+         * of failing with `UnlockedDeviceKeyRequiredException` (the default since 2.9.0).
+         */
+        requireUnlockedDeviceAllowFallback?: boolean;
     };
 };
 /** A native exception: its class name (`SSLPinningException`, …) and message. */

package/lib/typescript/src/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,QAAQ,GAAG,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;AAEjF,qGAAqG;AACrG,MAAM,MAAM,QAAQ,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAE1D,4GAA4G;AAC5G,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,kGAAkG;AAClG,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,QAAQ,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;AACnE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,YAAY,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,GAAG,WAAW,CAAC;AACnF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,aAAa,CAAC,EAAE,QAAQ,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,QAAQ,GAAG,YAAY,GAAG,aAAa,GAAG,WAAW,CAAC;AAE9F;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,gBAAgB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE3F,yCAAyC;AACzC,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,QAAQ,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,sBAAsB,CAAC,EAAE,QAAQ,CAAC;IAClC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,2FAA2F;IAC3F,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAC;IAC7C,8CAA8C;IAC9C,OAAO,CAAC,EAAE;QACR,qDAAqD;QACrD,kCAAkC,CAAC,EAAE,OAAO,CAAC;QAC7C;;;;WAIG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,uGAAuG;QACvG,wBAAwB,CAAC,EAAE,OAAO,CAAC;QACnC,mGAAmG;QACnG,sBAAsB,CAAC,EAAE,OAAO,CAAC;KAClC,CAAC;IACF,8CAA8C;IAC9C,GAAG,CAAC,EAAE;QACJ,oFAAoF;QACpF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,sFAAsF;QACtF,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,gGAAgG;QAChG,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,mFAAmF;QACnF,gBAAgB,CAAC,EAAE,cAAc,GAAG,uBAAuB,CAAC;QAC5D,4GAA4G;QAC5G,2BAA2B,CAAC,EAAE,MAAM,CAAC;KACtC,CAAC;CACH,CAAC;AAIF,iFAAiF;AACjF,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvE;;;GAGG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,qBAAqB,EAAE,OAAO,CAAA;CAAE,GAClE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAAC,qBAAqB,EAAE,OAAO,CAAA;CAAE,CAAC;AAE1G,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAAC;AAE1E,MAAM,MAAM,gBAAgB,GACxB,WAAW,GACX,qBAAqB,GACrB,UAAU,GACV,SAAS,GACT,gBAAgB,CAAC;AAErB,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,gBAAgB,GAChB,yBAAyB,GACzB,SAAS,GACT,UAAU,GACV,eAAe,GACf,SAAS,GACT,oBAAoB,GACpB,cAAc,GACd,OAAO,CAAC;AAEZ,MAAM,MAAM,0BAA0B,GAClC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAA;CAAE,GACzF;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvE;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAAC;AAErG,MAAM,MAAM,eAAe,GACvB,WAAW,GACX,QAAQ,GACR,YAAY,GACZ,OAAO,GACP,aAAa,GACb,kBAAkB,GAClB,qBAAqB,CAAC;AAE1B,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEhD,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAC7B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,GAC9F;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvF,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,cAAc,GAAG,aAAa,CAAC;AAE9F,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,sBAAsB,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC;AAE5B,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B,CAAC;AAIF,oFAAoF;AACpF,MAAM,MAAM,uBAAuB,GAC/B;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,GACD;IACE,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,GACD;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,mBAAmB,GAAG,QAAQ,CAAC;IAClE,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,GACD;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACrC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAAC;AAIN,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE1F;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,sBAAsB,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,eAAe,CAAC;IAC9B,EAAE,EAAE,OAAO,CAAC;CACb,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,QAAQ,GAAG,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;AAEjF,qGAAqG;AACrG,MAAM,MAAM,QAAQ,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAE1D,4GAA4G;AAC5G,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,kGAAkG;AAClG,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,QAAQ,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;AACnE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,YAAY,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,GAAG,WAAW,CAAC;AACnF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,aAAa,CAAC,EAAE,QAAQ,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,QAAQ,GAAG,YAAY,GAAG,aAAa,GAAG,WAAW,CAAC;AAE9F;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,gBAAgB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE3F,yCAAyC;AACzC,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,QAAQ,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,sBAAsB,CAAC,EAAE,QAAQ,CAAC;IAClC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,2FAA2F;IAC3F,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAC;IAC7C,8CAA8C;IAC9C,OAAO,CAAC,EAAE;QACR,qDAAqD;QACrD,kCAAkC,CAAC,EAAE,OAAO,CAAC;QAC7C;;;;WAIG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,uGAAuG;QACvG,wBAAwB,CAAC,EAAE,OAAO,CAAC;QACnC,mGAAmG;QACnG,sBAAsB,CAAC,EAAE,OAAO,CAAC;KAClC,CAAC;IACF,8CAA8C;IAC9C,GAAG,CAAC,EAAE;QACJ,oFAAoF;QACpF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,sFAAsF;QACtF,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,gGAAgG;QAChG,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,mFAAmF;QACnF,gBAAgB,CAAC,EAAE,cAAc,GAAG,uBAAuB,CAAC;QAC5D,4GAA4G;QAC5G,2BAA2B,CAAC,EAAE,MAAM,CAAC;QACrC;;;;WAIG;QACH,kCAAkC,CAAC,EAAE,OAAO,CAAC;KAC9C,CAAC;CACH,CAAC;AAIF,iFAAiF;AACjF,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvE;;;GAGG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,qBAAqB,EAAE,OAAO,CAAA;CAAE,GAClE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAAC,qBAAqB,EAAE,OAAO,CAAA;CAAE,CAAC;AAE1G,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAAC;AAE1E,MAAM,MAAM,gBAAgB,GACxB,WAAW,GACX,qBAAqB,GACrB,UAAU,GACV,SAAS,GACT,gBAAgB,CAAC;AAErB,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,gBAAgB,GAChB,yBAAyB,GACzB,SAAS,GACT,UAAU,GACV,eAAe,GACf,SAAS,GACT,oBAAoB,GACpB,cAAc,GACd,OAAO,CAAC;AAEZ,MAAM,MAAM,0BAA0B,GAClC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAA;CAAE,GACzF;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvE;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAAC;AAErG,MAAM,MAAM,eAAe,GACvB,WAAW,GACX,QAAQ,GACR,YAAY,GACZ,OAAO,GACP,aAAa,GACb,kBAAkB,GAClB,qBAAqB,CAAC;AAE1B,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEhD,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAC7B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,GAC9F;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvF,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,cAAc,GAAG,aAAa,CAAC;AAE9F,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,sBAAsB,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC;AAE5B,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B,CAAC;AAIF,oFAAoF;AACpF,MAAM,MAAM,uBAAuB,GAC/B;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,GACD;IACE,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,GACD;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,mBAAmB,GAAG,QAAQ,CAAC;IAClE,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,GACD;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACrC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAAC;AAIN,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE1F;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,sBAAsB,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,eAAe,CAAC;IAC9B,EAAE,EAAE,OAAO,CAAC;CACb,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@umutcansu/react-native-pinvault",
-  "version": "2.8.2",
+  "version": "2.9.0",
   "description": "PinVault for React Native: dynamic certificate pinning with signed remote configs, mTLS enrollment and signed vault files, as a thin bridge over the native PinVault libraries",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

package/src/types.ts

@@ -157,6 +157,12 @@ export type PinVaultConfig = {
     userAuthStrength?: 'DEVICE_OWNER' | 'BIOMETRIC_CURRENT_SET';
     /** The largest answer React Native's own https request may get (bytes, default 50 MiB, at most 256 MiB). */
     reactNativeMaxResponseBytes?: number;
+    /**
+     * `requireUnlockedDevice(allowFallback: true)`: when the Keychain refuses a key that
+     * works only while the device is unlocked, make it without that requirement instead
+     * of failing with `UnlockedDeviceKeyRequiredException` (the default since 2.9.0).
+     */
+    requireUnlockedDeviceAllowFallback?: boolean;
   };
 };