react-native-dpop 0.2.0 → 0.3.0

package/README.md

@@ -54,6 +54,7 @@ const isBound = await dpop.isBoundToAlias();
 - `GenerateProofInput`
 - `DPoPProofContext`
 - `DPoPKeyInfo`
+- `SecureHardwareFallbackReason = 'UNAVAILABLE' | 'PROVIDER_ERROR' | 'POLICY_REJECTED' | 'UNKNOWN'`
 - `PublicJwk`
 - `PublicKeyFormat = 'JWK' | 'DER' | 'RAW'`
 
@@ -97,6 +98,16 @@ Native errors are rejected with codes such as:
 ## Notes
 
 - If no alias is provided, the default alias is `react-native-dpop`.
+- `getKeyInfo` returns cross-platform fields and platform-specific details in `hardware`:
+  - Android: `hardware.android.strongBoxAvailable`, `hardware.android.strongBoxBacked`, `hardware.android.securityLevel`, `hardware.android.strongBoxFallbackReason`
+  - iOS: `hardware.ios.secureEnclaveAvailable`, `hardware.ios.secureEnclaveBacked`, `hardware.ios.securityLevel`, `hardware.ios.secureEnclaveFallbackReason`
+- Fallback reasons are sanitized enums (no raw native error): `UNAVAILABLE`, `PROVIDER_ERROR`, `POLICY_REJECTED`, `UNKNOWN`.
+- `securityLevel` semantics:
+  - `null`: no key material available (or not reported)
+  - `1`: not backed by secure enclave/strong dedicated hardware
+  - `2`: hardware-backed (iOS Secure Enclave, Android typically TEE)
+  - `3`: Android-only StrongBox (when reported by the device)
+- On iOS, `securityLevel` is normalized by this library (`2` for Secure Enclave-backed keys, `1` for Keychain fallback), not a native Apple numeric level API.
 - `htm` is normalized to uppercase in proof generation.
 - `ath` is derived from `accessToken` (`SHA-256`, base64url) when provided.
 - `jti` and `iat` are auto-generated when omitted.

package/android/src/main/java/com/reactnativedpop/DPoPKeyStore.kt

@@ -36,6 +36,14 @@ internal class DPoPKeyStore(private val context: Context) {
   companion object {
     private const val KEYSTORE_PROVIDER = "AndroidKeyStore"
     private const val EC_CURVE = "secp256r1"
+    private const val META_PREFS = "react_native_dpop_keystore_meta"
+    private const val META_STRONGBOX_FALLBACK_PREFIX = "strongbox_fallback_reason_"
+    private const val REASON_UNAVAILABLE = "UNAVAILABLE"
+    private const val REASON_PROVIDER_ERROR = "PROVIDER_ERROR"
+  }
+
+  private val metadataPrefs by lazy {
+    context.getSharedPreferences(META_PREFS, Context.MODE_PRIVATE)
   }
 
   private val keyStore: KeyStore by lazy {
@@ -46,6 +54,7 @@ internal class DPoPKeyStore(private val context: Context) {
     if (keyStore.containsAlias(alias)) {
       keyStore.deleteEntry(alias)
     }
+    clearStrongBoxFallbackReason(alias)
   }
 
   fun generateKeyPair(alias: String): Boolean {
@@ -56,16 +65,20 @@ internal class DPoPKeyStore(private val context: Context) {
     if (keyStore.containsAlias(alias)) {
       keyStore.deleteEntry(alias)
     }
+    clearStrongBoxFallbackReason(alias)
 
     val generator = KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, KEYSTORE_PROVIDER)
     if (isStrongBoxEnabled()) {
       try {
         generator.initialize(buildSpec(alias, useStrongBox = true))
         generator.generateKeyPair()
+        clearStrongBoxFallbackReason(alias)
         return true
       } catch (_: StrongBoxUnavailableException) {
+        storeStrongBoxFallbackReason(alias, REASON_UNAVAILABLE)
         // Fallback to hardware-backed keystore when StrongBox is unavailable.
       } catch (_: ProviderException) {
+        storeStrongBoxFallbackReason(alias, REASON_PROVIDER_ERROR)
         // Some devices expose StrongBox but fail during generation.
       }
     }
@@ -89,6 +102,12 @@ internal class DPoPKeyStore(private val context: Context) {
     return privateKey != null && publicKey != null
   }
 
+  fun isStrongBoxAvailable(): Boolean = isStrongBoxEnabled()
+
+  fun getStrongBoxFallbackReason(alias: String): String? {
+    return metadataPrefs.getString(strongBoxFallbackKey(alias), null)
+  }
+
   fun getKeyInfo(alias: String): KeyStoreKeyInfo {
     val keyPair = getKeyPair(alias)
     val keyFactory = KeyFactory.getInstance(keyPair.privateKey.algorithm, KEYSTORE_PROVIDER)
@@ -165,4 +184,14 @@ internal class DPoPKeyStore(private val context: Context) {
       false
     }
   }
+
+  private fun storeStrongBoxFallbackReason(alias: String, reason: String) {
+    metadataPrefs.edit().putString(strongBoxFallbackKey(alias), reason).apply()
+  }
+
+  private fun clearStrongBoxFallbackReason(alias: String) {
+    metadataPrefs.edit().remove(strongBoxFallbackKey(alias)).apply()
+  }
+
+  private fun strongBoxFallbackKey(alias: String): String = "$META_STRONGBOX_FALLBACK_PREFIX$alias"
 }

package/android/src/main/java/com/reactnativedpop/DPoPModule.kt

@@ -70,26 +70,52 @@ class DPoPModule(reactContext: ReactApplicationContext) :
     try {
       val effectiveAlias = resolveAlias(alias)
       if (!keyStore.hasKeyPair(effectiveAlias)) {
+        val fallbackReason = keyStore.getStrongBoxFallbackReason(effectiveAlias)
+        val hardwareAndroid = Arguments.createMap().apply {
+          putBoolean("strongBoxAvailable", keyStore.isStrongBoxAvailable())
+          putBoolean("strongBoxBacked", false)
+          if (fallbackReason != null) {
+            putString("strongBoxFallbackReason", fallbackReason)
+          } else {
+            putNull("strongBoxFallbackReason")
+          }
+        }
+        val hardware = Arguments.createMap().apply {
+          putMap("android", hardwareAndroid)
+        }
         val result = Arguments.createMap().apply {
           putString("alias", effectiveAlias)
           putBoolean("hasKeyPair", false)
+          putMap("hardware", hardware)
         }
         promise.resolve(result)
         return
       }
 
       val keyInfo = keyStore.getKeyInfo(effectiveAlias)
+      val fallbackReason = keyStore.getStrongBoxFallbackReason(effectiveAlias)
+      val hardwareAndroid = Arguments.createMap().apply {
+        putBoolean("strongBoxAvailable", keyInfo.strongBoxAvailable)
+        putBoolean("strongBoxBacked", keyInfo.strongBoxBacked)
+        if (keyInfo.securityLevel != null) {
+          putInt("securityLevel", keyInfo.securityLevel)
+        }
+        if (fallbackReason != null) {
+          putString("strongBoxFallbackReason", fallbackReason)
+        } else {
+          putNull("strongBoxFallbackReason")
+        }
+      }
+      val hardware = Arguments.createMap().apply {
+        putMap("android", hardwareAndroid)
+      }
       val result = Arguments.createMap().apply {
         putString("alias", keyInfo.alias)
         putString("algorithm", keyInfo.algorithm)
         putString("curve", keyInfo.curve)
         putBoolean("hasKeyPair", true)
         putBoolean("insideSecureHardware", keyInfo.insideSecureHardware)
-        putBoolean("strongBoxAvailable", keyInfo.strongBoxAvailable)
-        putBoolean("strongBoxBacked", keyInfo.strongBoxBacked)
-        if (keyInfo.securityLevel != null) {
-          putInt("securityLevel", keyInfo.securityLevel)
-        }
+        putMap("hardware", hardware)
       }
       promise.resolve(result)
     } catch (e: Exception) {

package/ios/DPoPKeyStore.swift

@@ -12,20 +12,23 @@ struct DPoPKeyInfo {
   let curve: String
   let hasKeyPair: Bool
   let insideSecureHardware: Bool
-  let strongBoxAvailable: Bool
-  let strongBoxBacked: Bool
 }
 
 final class DPoPKeyStore {
   private let secureEnclave = SecureEnclaveKeyStore()
   private let keychain = KeychainKeyStore()
+  private let fallbackReasonDefaults = UserDefaults.standard
+  private let fallbackReasonPrefix = "react_native_dpop_secure_enclave_fallback_reason_"
+  private lazy var secureEnclaveAvailable = secureEnclave.isAvailable()
 
   func generateKeyPair(alias: String) throws {
     try deleteKeyPair(alias: alias)
 
     do {
       try secureEnclave.generateKeyPair(alias: alias)
+      clearSecureEnclaveFallbackReason(alias: alias)
     } catch {
+      storeSecureEnclaveFallbackReason(alias: alias, reason: mapSecureEnclaveFallbackReason(error))
       try keychain.generateKeyPair(alias: alias)
     }
   }
@@ -33,6 +36,7 @@ final class DPoPKeyStore {
   func deleteKeyPair(alias: String) throws {
     try secureEnclave.deleteKeyPair(alias: alias)
     try keychain.deleteKeyPair(alias: alias)
+    clearSecureEnclaveFallbackReason(alias: alias)
   }
 
   func hasKeyPair(alias: String) -> Bool {
@@ -64,9 +68,7 @@ final class DPoPKeyStore {
         algorithm: "EC",
         curve: "P-256",
         hasKeyPair: true,
-        insideSecureHardware: true,
-        strongBoxAvailable: false,
-        strongBoxBacked: false
+        insideSecureHardware: true
       )
     }
 
@@ -76,9 +78,7 @@ final class DPoPKeyStore {
         algorithm: "EC",
         curve: "P-256",
         hasKeyPair: true,
-        insideSecureHardware: false,
-        strongBoxAvailable: false,
-        strongBoxBacked: false
+        insideSecureHardware: false
       )
     }
 
@@ -87,13 +87,48 @@ final class DPoPKeyStore {
       algorithm: "EC",
       curve: "P-256",
       hasKeyPair: false,
-      insideSecureHardware: false,
-      strongBoxAvailable: false,
-      strongBoxBacked: false
+      insideSecureHardware: false
     )
   }
 
   func isHardwareBacked(alias: String) -> Bool {
     secureEnclave.isHardwareBacked(alias: alias)
   }
+
+  func isSecureEnclaveAvailable() -> Bool {
+    secureEnclaveAvailable
+  }
+
+  func getSecureEnclaveFallbackReason(alias: String) -> String? {
+    fallbackReasonDefaults.string(forKey: fallbackReasonKey(alias: alias))
+  }
+
+  private func storeSecureEnclaveFallbackReason(alias: String, reason: String) {
+    fallbackReasonDefaults.set(reason, forKey: fallbackReasonKey(alias: alias))
+  }
+
+  private func clearSecureEnclaveFallbackReason(alias: String) {
+    fallbackReasonDefaults.removeObject(forKey: fallbackReasonKey(alias: alias))
+  }
+
+  private func fallbackReasonKey(alias: String) -> String {
+    "\(fallbackReasonPrefix)\(alias)"
+  }
+
+  private func mapSecureEnclaveFallbackReason(_ error: Error) -> String {
+    let nsError = error as NSError
+
+    if nsError.domain == NSOSStatusErrorDomain {
+      switch nsError.code {
+      case Int(errSecNotAvailable), Int(errSecUnimplemented):
+        return "UNAVAILABLE"
+      case Int(errSecAuthFailed), Int(errSecInteractionNotAllowed), Int(errSecUserCanceled):
+        return "POLICY_REJECTED"
+      default:
+        return "PROVIDER_ERROR"
+      }
+    }
+
+    return "UNKNOWN"
+  }
 }

package/ios/DPoPModule.swift

@@ -44,23 +44,43 @@ final class DPoPModule {
 
   func getKeyInfo(alias: String?) -> [String: Any] {
     let effectiveAlias = resolveAlias(alias)
+    let secureEnclaveAvailable = keyStore.isSecureEnclaveAvailable()
+    let fallbackReason = keyStore.getSecureEnclaveFallbackReason(alias: effectiveAlias)
+    let secureEnclaveFallbackReason: Any = fallbackReason ?? NSNull()
     let keyInfo = keyStore.getKeyInfo(alias: effectiveAlias)
 
     if !keyInfo.hasKeyPair {
       return [
         "alias": effectiveAlias,
-        "hasKeyPair": false
+        "hasKeyPair": false,
+        "hardware": [
+          "ios": [
+            "secureEnclaveAvailable": secureEnclaveAvailable,
+            "secureEnclaveBacked": false,
+            "securityLevel": NSNull(),
+            "secureEnclaveFallbackReason": secureEnclaveFallbackReason
+          ]
+        ]
       ]
     }
 
+    let secureEnclaveBacked = secureEnclaveAvailable && keyInfo.insideSecureHardware
+    let securityLevel = secureEnclaveBacked ? 2 : 1
+
     return [
       "alias": keyInfo.alias,
       "algorithm": keyInfo.algorithm,
       "curve": keyInfo.curve,
       "hasKeyPair": true,
-      "insideSecureHardware": keyInfo.insideSecureHardware,
-      "strongBoxAvailable": keyInfo.strongBoxAvailable,
-      "strongBoxBacked": keyInfo.strongBoxBacked
+      "insideSecureHardware": secureEnclaveBacked,
+      "hardware": [
+        "ios": [
+          "secureEnclaveAvailable": secureEnclaveAvailable,
+          "secureEnclaveBacked": secureEnclaveBacked,
+          "securityLevel": securityLevel,
+          "secureEnclaveFallbackReason": secureEnclaveFallbackReason
+        ]
+      ]
     ]
   }
 

package/ios/SecureEnclaveKeyStore.swift

@@ -4,6 +4,21 @@ import Security
 final class SecureEnclaveKeyStore {
   private let service = "com.dpop.secureenclave"
 
+  func isAvailable() -> Bool {
+    #if targetEnvironment(simulator)
+      return false
+    #else
+      let probeAlias = "__secure_enclave_probe_\(UUID().uuidString)"
+      do {
+        try generateKeyPair(alias: probeAlias)
+        try deleteKeyPair(alias: probeAlias)
+        return true
+      } catch {
+        return false
+      }
+    #endif
+  }
+
   func generateKeyPair(alias: String) throws {
     try deleteKeyPair(alias: alias)
 

package/lib/module/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["NativeReactNativeDPoP","DPoP","constructor","proof","proofContext","alias","calculateThumbprint","getPublicKey","format","getPublicKeyDer","getPublicKeyRaw","getPublicKeyJwk","signWithDpopPrivateKey","payload","isBoundToAlias","generateProof","input","result","htu","htm","nonce","accessToken","additional","kid","jti","iat","assertHardwareBacked","deleteKeyPair","getKeyInfo","hasKeyPair","rotateKeyPair"],"sourceRoot":"../../src","sources":["index.tsx"],"mappings":";;AAAA,OAAOA,qBAAqB,MAAM,4BAAyB;AAoD3D,OAAO,MAAMC,IAAI,CAAC;EAKRC,WAAWA,CAACC,KAAa,EAAEC,YAA8B,EAAEC,KAAc,EAAE;IACjF,IAAI,CAACF,KAAK,GAAGA,KAAK;IAClB,IAAI,CAACC,YAAY,GAAGA,YAAY;IAChC,IAAI,CAACC,KAAK,GAAGA,KAAK;EACpB;EAEA,MAAaC,mBAAmBA,CAAA,EAAoB;IAClD,OAAON,qBAAqB,CAACM,mBAAmB,CAAC,IAAI,CAACD,KAAK,IAAI,IAAI,CAAC;EACtE;EAEA,MAAaE,YAAYA,CAACC,MAAuB,EAA+B;IAC9E,IAAIA,MAAM,KAAK,KAAK,EAAE;MACpB,OAAOR,qBAAqB,CAACS,eAAe,CAAC,IAAI,CAACJ,KAAK,IAAI,IAAI,CAAC;IAClE;IACA,IAAIG,MAAM,KAAK,KAAK,EAAE;MACpB,OAAOR,qBAAqB,CAACU,eAAe,CAAC,IAAI,CAACL,KAAK,IAAI,IAAI,CAAC;IAClE;IAEA,OAAOL,qBAAqB,CAACW,eAAe,CAAC,IAAI,CAACN,KAAK,IAAI,IAAI,CAAC;EAClE;EAEA,MAAaO,sBAAsBA,CAACC,OAAe,EAAmB;IACpE,OAAOb,qBAAqB,CAACY,sBAAsB,CAACC,OAAO,EAAE,IAAI,CAACR,KAAK,IAAI,IAAI,CAAC;EAClF;EAEA,MAAaS,cAAcA,CAACT,KAAc,EAAoB;IAC5D,OAAOL,qBAAqB,CAACc,cAAc,CAAC,IAAI,CAACX,KAAK,EAAEE,KAAK,IAAI,IAAI,CAACA,KAAK,IAAI,IAAI,CAAC;EACtF;EAEA,aAAoBU,aAAaA,CAACC,KAAyB,EAAiB;IAC1E,MAAMC,MAAM,GAAI,MAAMjB,qBAAqB,CAACe,aAAa,CACvDC,KAAK,CAACE,GAAG,EACTF,KAAK,CAACG,GAAG,EACTH,KAAK,CAACI,KAAK,IAAI,IAAI,EACnBJ,KAAK,CAACK,WAAW,IAAI,IAAI,EACzBL,KAAK,CAACM,UAAU,IAAI,IAAI,EACxBN,KAAK,CAACO,GAAG,IAAI,IAAI,EACjBP,KAAK,CAACQ,GAAG,IAAI,IAAI,EACjBR,KAAK,CAACS,GAAG,IAAI,IAAI,EACjBT,KAAK,CAACX,KAAK,IAAI,IACjB,CAAyB;IAEzB,OAAO,IAAIJ,IAAI,CAACgB,MAAM,CAACd,KAAK,EAAEc,MAAM,CAACb,YAAY,EAAEY,KAAK,CAACX,KAAK,CAAC;EACjE;EAEA,aAAoBqB,oBAAoBA,CAACrB,KAAc,EAAiB;IACtE,MAAML,qBAAqB,CAAC0B,oBAAoB,CAACrB,KAAK,IAAI,IAAI,CAAC;EACjE;EAEA,aAAoBsB,aAAaA,CAACtB,KAAc,EAAiB;IAC/D,MAAML,qBAAqB,CAAC2B,aAAa,CAACtB,KAAK,IAAI,IAAI,CAAC;EAC1D;EAEA,aAAoBuB,UAAUA,CAACvB,KAAc,EAAwB;IACnE,OAAOL,qBAAqB,CAAC4B,UAAU,CAACvB,KAAK,IAAI,IAAI,CAAC;EACxD;EAEA,aAAoBwB,UAAUA,CAACxB,KAAc,EAAoB;IAC/D,OAAOL,qBAAqB,CAAC6B,UAAU,CAACxB,KAAK,IAAI,IAAI,CAAC;EACxD;EAEA,aAAoByB,aAAaA,CAACzB,KAAc,EAAiB;IAC/D,MAAML,qBAAqB,CAAC8B,aAAa,CAACzB,KAAK,IAAI,IAAI,CAAC;EAC1D;AACF","ignoreList":[]}
+{"version":3,"names":["NativeReactNativeDPoP","DPoP","constructor","proof","proofContext","alias","calculateThumbprint","getPublicKey","format","getPublicKeyDer","getPublicKeyRaw","getPublicKeyJwk","signWithDpopPrivateKey","payload","isBoundToAlias","generateProof","input","result","htu","htm","nonce","accessToken","additional","kid","jti","iat","assertHardwareBacked","deleteKeyPair","getKeyInfo","hasKeyPair","rotateKeyPair"],"sourceRoot":"../../src","sources":["index.tsx"],"mappings":";;AAAA,OAAOA,qBAAqB,MAAM,4BAAyB;AAiE3D,OAAO,MAAMC,IAAI,CAAC;EAKRC,WAAWA,CAACC,KAAa,EAAEC,YAA8B,EAAEC,KAAc,EAAE;IACjF,IAAI,CAACF,KAAK,GAAGA,KAAK;IAClB,IAAI,CAACC,YAAY,GAAGA,YAAY;IAChC,IAAI,CAACC,KAAK,GAAGA,KAAK;EACpB;EAEA,MAAaC,mBAAmBA,CAAA,EAAoB;IAClD,OAAON,qBAAqB,CAACM,mBAAmB,CAAC,IAAI,CAACD,KAAK,IAAI,IAAI,CAAC;EACtE;EAEA,MAAaE,YAAYA,CAACC,MAAuB,EAA+B;IAC9E,IAAIA,MAAM,KAAK,KAAK,EAAE;MACpB,OAAOR,qBAAqB,CAACS,eAAe,CAAC,IAAI,CAACJ,KAAK,IAAI,IAAI,CAAC;IAClE;IACA,IAAIG,MAAM,KAAK,KAAK,EAAE;MACpB,OAAOR,qBAAqB,CAACU,eAAe,CAAC,IAAI,CAACL,KAAK,IAAI,IAAI,CAAC;IAClE;IAEA,OAAOL,qBAAqB,CAACW,eAAe,CAAC,IAAI,CAACN,KAAK,IAAI,IAAI,CAAC;EAClE;EAEA,MAAaO,sBAAsBA,CAACC,OAAe,EAAmB;IACpE,OAAOb,qBAAqB,CAACY,sBAAsB,CAACC,OAAO,EAAE,IAAI,CAACR,KAAK,IAAI,IAAI,CAAC;EAClF;EAEA,MAAaS,cAAcA,CAACT,KAAc,EAAoB;IAC5D,OAAOL,qBAAqB,CAACc,cAAc,CAAC,IAAI,CAACX,KAAK,EAAEE,KAAK,IAAI,IAAI,CAACA,KAAK,IAAI,IAAI,CAAC;EACtF;EAEA,aAAoBU,aAAaA,CAACC,KAAyB,EAAiB;IAC1E,MAAMC,MAAM,GAAI,MAAMjB,qBAAqB,CAACe,aAAa,CACvDC,KAAK,CAACE,GAAG,EACTF,KAAK,CAACG,GAAG,EACTH,KAAK,CAACI,KAAK,IAAI,IAAI,EACnBJ,KAAK,CAACK,WAAW,IAAI,IAAI,EACzBL,KAAK,CAACM,UAAU,IAAI,IAAI,EACxBN,KAAK,CAACO,GAAG,IAAI,IAAI,EACjBP,KAAK,CAACQ,GAAG,IAAI,IAAI,EACjBR,KAAK,CAACS,GAAG,IAAI,IAAI,EACjBT,KAAK,CAACX,KAAK,IAAI,IACjB,CAAyB;IAEzB,OAAO,IAAIJ,IAAI,CAACgB,MAAM,CAACd,KAAK,EAAEc,MAAM,CAACb,YAAY,EAAEY,KAAK,CAACX,KAAK,CAAC;EACjE;EAEA,aAAoBqB,oBAAoBA,CAACrB,KAAc,EAAiB;IACtE,MAAML,qBAAqB,CAAC0B,oBAAoB,CAACrB,KAAK,IAAI,IAAI,CAAC;EACjE;EAEA,aAAoBsB,aAAaA,CAACtB,KAAc,EAAiB;IAC/D,MAAML,qBAAqB,CAAC2B,aAAa,CAACtB,KAAK,IAAI,IAAI,CAAC;EAC1D;EAEA,aAAoBuB,UAAUA,CAACvB,KAAc,EAAwB;IACnE,OAAOL,qBAAqB,CAAC4B,UAAU,CAACvB,KAAK,IAAI,IAAI,CAAC;EACxD;EAEA,aAAoBwB,UAAUA,CAACxB,KAAc,EAAoB;IAC/D,OAAOL,qBAAqB,CAAC6B,UAAU,CAACxB,KAAK,IAAI,IAAI,CAAC;EACxD;EAEA,aAAoByB,aAAaA,CAACzB,KAAc,EAAiB;IAC/D,MAAML,qBAAqB,CAAC8B,aAAa,CAACzB,KAAK,IAAI,IAAI,CAAC;EAC1D;AACF","ignoreList":[]}

package/lib/typescript/src/index.d.ts

@@ -6,15 +6,27 @@ export type PublicJwk = {
     y: string;
 };
 export type PublicKeyFormat = 'JWK' | 'DER' | 'RAW';
+export type SecureHardwareFallbackReason = 'UNAVAILABLE' | 'PROVIDER_ERROR' | 'POLICY_REJECTED' | 'UNKNOWN';
 export type DPoPKeyInfo = {
     alias: string;
     hasKeyPair: boolean;
     algorithm?: string;
     curve?: string;
     insideSecureHardware?: boolean;
-    securityLevel?: number;
-    strongBoxAvailable?: boolean;
-    strongBoxBacked?: boolean;
+    hardware?: {
+        android?: {
+            strongBoxAvailable: boolean;
+            strongBoxBacked: boolean;
+            securityLevel?: number;
+            strongBoxFallbackReason?: SecureHardwareFallbackReason | null;
+        };
+        ios?: {
+            secureEnclaveAvailable: boolean;
+            secureEnclaveBacked: boolean;
+            securityLevel?: number | null;
+            secureEnclaveFallbackReason?: SecureHardwareFallbackReason | null;
+        };
+    };
 };
 export type GenerateProofInput = {
     htu: string;

package/lib/typescript/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.tsx"],"names":[],"mappings":"AAEA,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,OAAO,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAEpD,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAOF,qBAAa,IAAI;IACf,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,KAAK,CAAC,EAAE,MAAM,CAAC;IAC/B,SAAgB,YAAY,EAAE,gBAAgB,CAAC;IAE/C,OAAO;IAMM,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAItC,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC;IAWlE,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIxD,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;WAIzC,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;WAgBvD,oBAAoB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;WAInD,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;WAI5C,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;WAIhD,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;WAI5C,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.tsx"],"names":[],"mappings":"AAEA,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,OAAO,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAEpD,MAAM,MAAM,4BAA4B,GAAG,aAAa,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAE5G,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE;YACR,kBAAkB,EAAE,OAAO,CAAC;YAC5B,eAAe,EAAE,OAAO,CAAC;YACzB,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,uBAAuB,CAAC,EAAE,4BAA4B,GAAG,IAAI,CAAC;SAC/D,CAAC;QACF,GAAG,CAAC,EAAE;YACJ,sBAAsB,EAAE,OAAO,CAAC;YAChC,mBAAmB,EAAE,OAAO,CAAC;YAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YAC9B,2BAA2B,CAAC,EAAE,4BAA4B,GAAG,IAAI,CAAC;SACnE,CAAC;KACH,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAOF,qBAAa,IAAI;IACf,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,KAAK,CAAC,EAAE,MAAM,CAAC;IAC/B,SAAgB,YAAY,EAAE,gBAAgB,CAAC;IAE/C,OAAO;IAMM,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAItC,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC;IAWlE,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIxD,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;WAIzC,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;WAgBvD,oBAAoB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;WAInD,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;WAI5C,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;WAIhD,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;WAI5C,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-dpop",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "React Native library for DPoP proof generation and key management.",
   "keywords": [
     "android",
@@ -51,7 +51,8 @@
     "example": "yarn workspace react-native-dpop-example",
     "lint": "eslint \"**/*.{js,ts,tsx}\"",
     "prepare": "bob build",
-    "release": "release-it --only-version",
+    "release": "release-it",
+    "release:version": "release-it --only-version",
     "test": "jest",
     "typecheck": "tsc"
   },

package/src/index.tsx

@@ -11,15 +11,28 @@ export type PublicJwk = {
 
 export type PublicKeyFormat = 'JWK' | 'DER' | 'RAW';
 
+export type SecureHardwareFallbackReason = 'UNAVAILABLE' | 'PROVIDER_ERROR' | 'POLICY_REJECTED' | 'UNKNOWN';
+
 export type DPoPKeyInfo = {
   alias: string;
   hasKeyPair: boolean;
   algorithm?: string;
   curve?: string;
   insideSecureHardware?: boolean;
-  securityLevel?: number;
-  strongBoxAvailable?: boolean;
-  strongBoxBacked?: boolean;
+  hardware?: {
+    android?: {
+      strongBoxAvailable: boolean;
+      strongBoxBacked: boolean;
+      securityLevel?: number;
+      strongBoxFallbackReason?: SecureHardwareFallbackReason | null;
+    };
+    ios?: {
+      secureEnclaveAvailable: boolean;
+      secureEnclaveBacked: boolean;
+      securityLevel?: number | null;
+      secureEnclaveFallbackReason?: SecureHardwareFallbackReason | null;
+    };
+  };
 };
 
 export type GenerateProofInput = {