react-native-dpop 0.2.0 → 0.4.0

package/README.md

@@ -4,18 +4,19 @@ React Native library for DPoP proof generation and key management.
 
 ## Features
 
-- Generate DPoP proofs (`dpop+jwt`) signed with ES256.
-- Manage key pairs in the device keystore (create, rotate, delete).
-- Export public key in `JWK`, `DER`, or `RAW` format.
-- Calculate JWK thumbprint (`SHA-256`, base64url).
-- Verify if a proof is bound to a given key alias.
-- Retrieve non-sensitive key metadata (hardware-backed, StrongBox info, etc.).
-- iOS key storage uses Secure Enclave when available, with Keychain fallback.
+- Generate DPoP proofs (`dpop+jwt`) signed with ES256
+- Manage key pairs in the platform keystore
+- Export the public key as `JWK`, `DER`, or `RAW`
+- Calculate JWK thumbprints (`SHA-256`, base64url)
+- Verify whether a proof is bound to a given key alias
+- Retrieve non-sensitive key metadata, including secure hardware details
+- Use Secure Enclave on iOS when available, with Keychain fallback
+- Prefer StrongBox on Android when available, with hardware-backed fallback
 
-## Platform Support
+## Platform support
 
-- Android: supported.
-- iOS: supported.
+- Android
+- iOS
 
 ## Installation
 
@@ -23,13 +24,13 @@ React Native library for DPoP proof generation and key management.
 npm install react-native-dpop
 ```
 
-For iOS, install pods in your app project:
+For iOS:
 
 ```sh
 cd ios && pod install
 ```
 
-## Quick Start
+## Quick start
 
 ```ts
 import { DPoP } from 'react-native-dpop';
@@ -38,26 +39,18 @@ const dpop = await DPoP.generateProof({
   htu: 'https://api.example.com/token',
   htm: 'POST',
   accessToken: 'ACCESS_TOKEN',
-  nonce: 'server-nonce',
+  nonce: 'SERVER_NONCE',
 });
 
 const proof = dpop.proof;
 const thumbprint = await dpop.calculateThumbprint();
 const publicJwk = await dpop.getPublicKey('JWK');
-const isBound = await dpop.isBoundToAlias();
+const keyInfo = await DPoP.getKeyInfo();
 ```
 
 ## API
 
-### Types
-
-- `GenerateProofInput`
-- `DPoPProofContext`
-- `DPoPKeyInfo`
-- `PublicJwk`
-- `PublicKeyFormat = 'JWK' | 'DER' | 'RAW'`
-
-### `DPoP` static methods
+### Static methods
 
 - `DPoP.generateProof(input): Promise<DPoP>`
 - `DPoP.assertHardwareBacked(alias?): Promise<void>`
@@ -66,22 +59,97 @@ const isBound = await dpop.isBoundToAlias();
 - `DPoP.hasKeyPair(alias?): Promise<boolean>`
 - `DPoP.rotateKeyPair(alias?): Promise<void>`
 
-### `DPoP` instance fields
+### Instance members
 
 - `proof: string`
 - `proofContext: DPoPProofContext`
 - `alias?: string`
-
-### `DPoP` instance methods
-
 - `calculateThumbprint(): Promise<string>`
 - `getPublicKey(format): Promise<PublicJwk | string>`
 - `signWithDpopPrivateKey(payload): Promise<string>`
 - `isBoundToAlias(alias?): Promise<boolean>`
 
-## Error Codes
+### Main types
 
-Native errors are rejected with codes such as:
+- `GenerateProofInput`
+- `DPoPProofContext`
+- `DPoPKeyInfo`
+- `PublicJwk`
+- `PublicKeyFormat = 'JWK' | 'DER' | 'RAW'`
+- `SecureHardwareFallbackReason = 'UNAVAILABLE' | 'PROVIDER_ERROR' | 'POLICY_REJECTED' | 'UNKNOWN'`
+- `AndroidSecurityLevelName = 'SOFTWARE' | 'TRUSTED_ENVIRONMENT' | 'STRONGBOX'`
+- `IOSSecurityLevelName = 'SOFTWARE' | 'SECURE_ENCLAVE'`
+
+## `getKeyInfo()`
+
+`getKeyInfo()` returns shared fields plus platform-specific hardware metadata.
+
+```ts
+type DPoPKeyInfo = {
+  alias: string;
+  hasKeyPair: boolean;
+  algorithm?: string;
+  curve?: string;
+  insideSecureHardware?: boolean;
+  hardware?: {
+    android?: {
+      strongBoxAvailable: boolean;
+      strongBoxBacked: boolean;
+      securityLevel?: number;
+      securityLevelName?: 'SOFTWARE' | 'TRUSTED_ENVIRONMENT' | 'STRONGBOX';
+      strongBoxFallbackReason?: 'UNAVAILABLE' | 'PROVIDER_ERROR' | 'POLICY_REJECTED' | 'UNKNOWN' | null;
+    };
+    ios?: {
+      secureEnclaveAvailable: boolean;
+      secureEnclaveBacked: boolean;
+      securityLevel?: number | null;
+      securityLevelName?: 'SOFTWARE' | 'SECURE_ENCLAVE';
+      secureEnclaveFallbackReason?: 'UNAVAILABLE' | 'PROVIDER_ERROR' | 'POLICY_REJECTED' | 'UNKNOWN' | null;
+    };
+  };
+};
+```
+
+### Security level semantics
+
+- `securityLevel = 1`
+  Software-backed key material
+- `securityLevel = 2`
+  Hardware-backed key material
+  On Android this usually means TEE
+  On iOS this means Secure Enclave
+- `securityLevel = 3`
+  Android StrongBox-backed key
+- `securityLevel = null`
+  No key material available, or the native platform did not report a numeric level
+
+### Fallback semantics
+
+- On Android, the library tries StrongBox first when available
+- On iOS, the library tries Secure Enclave first when available
+- Fallback reasons are sanitized enums rather than raw native errors
+- On iOS Simulator, `secureEnclaveFallbackReason` is expected to be `UNAVAILABLE`
+
+## Notes
+
+- Default alias: `react-native-dpop`
+- `htm` is normalized to uppercase
+- `ath` is derived from `accessToken` when provided
+- `jti` and `iat` are auto-generated when omitted
+- For React Native 0.75 on Android, the library ensures `iat` is sent as a number to avoid an older bridge nullability issue with `Double`
+
+## Example apps
+
+This repository includes two example apps:
+
+- `examples/v0.75`
+- `examples/v0.83`
+
+The root `example` script points to `examples/v0.83`.
+
+## Errors
+
+Native rejections use codes such as:
 
 - `ERR_DPOP_GENERATE_PROOF`
 - `ERR_DPOP_CALCULATE_THUMBPRINT`
@@ -94,13 +162,6 @@ Native errors are rejected with codes such as:
 - `ERR_DPOP_ASSERT_HARDWARE_BACKED`
 - `ERR_DPOP_IS_BOUND_TO_ALIAS`
 
-## Notes
-
-- If no alias is provided, the default alias is `react-native-dpop`.
-- `htm` is normalized to uppercase in proof generation.
-- `ath` is derived from `accessToken` (`SHA-256`, base64url) when provided.
-- `jti` and `iat` are auto-generated when omitted.
-
 ## Contributing
 
 - [Development workflow](CONTRIBUTING.md#development-workflow)

package/ReactNativeDPoP.podspec

@@ -11,7 +11,7 @@ Pod::Spec.new do |s|
   s.license      = package["license"]
   s.authors      = package["author"]
 
-  s.platforms    = { :ios => min_ios_version_supported }
+  s.platforms    = { :ios => "14.0" }
   s.source       = { :git => "https://github.com/Cirilord/react-native-dpop.git", :tag => "#{s.version}" }
 
   s.source_files = "ios/**/*.{h,m,mm,swift,cpp}"

package/android/src/main/java/com/reactnativedpop/DPoPKeyStore.kt

@@ -28,6 +28,7 @@ internal data class KeyStoreKeyInfo(
   val curve: String,
   val insideSecureHardware: Boolean,
   val securityLevel: Int?,
+  val securityLevelName: String,
   val strongBoxAvailable: Boolean,
   val strongBoxBacked: Boolean
 )
@@ -36,6 +37,14 @@ internal class DPoPKeyStore(private val context: Context) {
   companion object {
     private const val KEYSTORE_PROVIDER = "AndroidKeyStore"
     private const val EC_CURVE = "secp256r1"
+    private const val META_PREFS = "react_native_dpop_keystore_meta"
+    private const val META_STRONGBOX_FALLBACK_PREFIX = "strongbox_fallback_reason_"
+    private const val REASON_UNAVAILABLE = "UNAVAILABLE"
+    private const val REASON_PROVIDER_ERROR = "PROVIDER_ERROR"
+  }
+
+  private val metadataPrefs by lazy {
+    context.getSharedPreferences(META_PREFS, Context.MODE_PRIVATE)
   }
 
   private val keyStore: KeyStore by lazy {
@@ -46,6 +55,7 @@ internal class DPoPKeyStore(private val context: Context) {
     if (keyStore.containsAlias(alias)) {
       keyStore.deleteEntry(alias)
     }
+    clearStrongBoxFallbackReason(alias)
   }
 
   fun generateKeyPair(alias: String): Boolean {
@@ -56,16 +66,20 @@ internal class DPoPKeyStore(private val context: Context) {
     if (keyStore.containsAlias(alias)) {
       keyStore.deleteEntry(alias)
     }
+    clearStrongBoxFallbackReason(alias)
 
     val generator = KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, KEYSTORE_PROVIDER)
     if (isStrongBoxEnabled()) {
       try {
         generator.initialize(buildSpec(alias, useStrongBox = true))
         generator.generateKeyPair()
+        clearStrongBoxFallbackReason(alias)
         return true
       } catch (_: StrongBoxUnavailableException) {
+        storeStrongBoxFallbackReason(alias, REASON_UNAVAILABLE)
         // Fallback to hardware-backed keystore when StrongBox is unavailable.
       } catch (_: ProviderException) {
+        storeStrongBoxFallbackReason(alias, REASON_PROVIDER_ERROR)
         // Some devices expose StrongBox but fail during generation.
       }
     }
@@ -89,6 +103,12 @@ internal class DPoPKeyStore(private val context: Context) {
     return privateKey != null && publicKey != null
   }
 
+  fun isStrongBoxAvailable(): Boolean = isStrongBoxEnabled()
+
+  fun getStrongBoxFallbackReason(alias: String): String? {
+    return metadataPrefs.getString(strongBoxFallbackKey(alias), null)
+  }
+
   fun getKeyInfo(alias: String): KeyStoreKeyInfo {
     val keyPair = getKeyPair(alias)
     val keyFactory = KeyFactory.getInstance(keyPair.privateKey.algorithm, KEYSTORE_PROVIDER)
@@ -100,6 +120,7 @@ internal class DPoPKeyStore(private val context: Context) {
       curve = "P-256",
       insideSecureHardware = keyInfo.isInsideSecureHardware,
       securityLevel = readSecurityLevel(keyInfo),
+      securityLevelName = readSecurityLevelName(keyInfo),
       strongBoxAvailable = isStrongBoxEnabled(),
       strongBoxBacked = readStrongBoxBacked(keyInfo)
     )
@@ -153,6 +174,24 @@ internal class DPoPKeyStore(private val context: Context) {
     }
   }
 
+  private fun readSecurityLevelName(keyInfo: KeyInfo): String {
+    val strongBoxBacked = readStrongBoxBacked(keyInfo)
+    val securityLevel = readSecurityLevel(keyInfo)
+
+    return when (securityLevel) {
+      1 -> "SOFTWARE"
+      2 -> "TRUSTED_ENVIRONMENT"
+      3 -> "STRONGBOX"
+      else -> {
+        when {
+          strongBoxBacked -> "STRONGBOX"
+          keyInfo.isInsideSecureHardware -> "TRUSTED_ENVIRONMENT"
+          else -> "SOFTWARE"
+        }
+      }
+    }
+  }
+
   private fun readStrongBoxBacked(keyInfo: KeyInfo): Boolean {
     if (Build.VERSION.SDK_INT < Build.VERSION_CODES.P) {
       return false
@@ -165,4 +204,14 @@ internal class DPoPKeyStore(private val context: Context) {
       false
     }
   }
+
+  private fun storeStrongBoxFallbackReason(alias: String, reason: String) {
+    metadataPrefs.edit().putString(strongBoxFallbackKey(alias), reason).apply()
+  }
+
+  private fun clearStrongBoxFallbackReason(alias: String) {
+    metadataPrefs.edit().remove(strongBoxFallbackKey(alias)).apply()
+  }
+
+  private fun strongBoxFallbackKey(alias: String): String = "$META_STRONGBOX_FALLBACK_PREFIX$alias"
 }

package/android/src/main/java/com/reactnativedpop/DPoPModule.kt

@@ -12,10 +12,32 @@ class DPoPModule(reactContext: ReactApplicationContext) :
   NativeReactNativeDPoPSpec(reactContext) {
   private val keyStore = DPoPKeyStore(reactContext)
 
+  companion object {
+    private const val DEFAULT_ALIAS = "react-native-dpop"
+    const val NAME = NativeReactNativeDPoPSpec.NAME
+    private const val UNKNOWN_STRONGBOX_FALLBACK_REASON = "UNKNOWN"
+  }
+
   private fun resolveAlias(alias: String?): String {
     return alias ?: DEFAULT_ALIAS
   }
 
+  private fun resolveStrongBoxFallbackReason(
+    strongBoxAvailable: Boolean,
+    strongBoxBacked: Boolean,
+    fallbackReason: String?
+  ): String? {
+    if (fallbackReason != null) {
+      return fallbackReason
+    }
+
+    return if (strongBoxAvailable && !strongBoxBacked) {
+      UNKNOWN_STRONGBOX_FALLBACK_REASON
+    } else {
+      null
+    }
+  }
+
   override fun assertHardwareBacked(alias: String?, promise: Promise) {
     try {
       val effectiveAlias = resolveAlias(alias)
@@ -70,26 +92,62 @@ class DPoPModule(reactContext: ReactApplicationContext) :
     try {
       val effectiveAlias = resolveAlias(alias)
       if (!keyStore.hasKeyPair(effectiveAlias)) {
+        val strongBoxAvailable = keyStore.isStrongBoxAvailable()
+        val fallbackReason = resolveStrongBoxFallbackReason(
+          strongBoxAvailable = strongBoxAvailable,
+          strongBoxBacked = false,
+          fallbackReason = keyStore.getStrongBoxFallbackReason(effectiveAlias)
+        )
+        val hardwareAndroid = Arguments.createMap().apply {
+          putBoolean("strongBoxAvailable", strongBoxAvailable)
+          putBoolean("strongBoxBacked", false)
+          if (fallbackReason != null) {
+            putString("strongBoxFallbackReason", fallbackReason)
+          } else {
+            putNull("strongBoxFallbackReason")
+          }
+        }
+        val hardware = Arguments.createMap().apply {
+          putMap("android", hardwareAndroid)
+        }
         val result = Arguments.createMap().apply {
           putString("alias", effectiveAlias)
           putBoolean("hasKeyPair", false)
+          putMap("hardware", hardware)
         }
         promise.resolve(result)
         return
       }
 
       val keyInfo = keyStore.getKeyInfo(effectiveAlias)
+      val fallbackReason = resolveStrongBoxFallbackReason(
+        strongBoxAvailable = keyInfo.strongBoxAvailable,
+        strongBoxBacked = keyInfo.strongBoxBacked,
+        fallbackReason = keyStore.getStrongBoxFallbackReason(effectiveAlias)
+      )
+      val hardwareAndroid = Arguments.createMap().apply {
+        putBoolean("strongBoxAvailable", keyInfo.strongBoxAvailable)
+        putBoolean("strongBoxBacked", keyInfo.strongBoxBacked)
+        if (keyInfo.securityLevel != null) {
+          putInt("securityLevel", keyInfo.securityLevel)
+        }
+        putString("securityLevelName", keyInfo.securityLevelName)
+        if (fallbackReason != null) {
+          putString("strongBoxFallbackReason", fallbackReason)
+        } else {
+          putNull("strongBoxFallbackReason")
+        }
+      }
+      val hardware = Arguments.createMap().apply {
+        putMap("android", hardwareAndroid)
+      }
       val result = Arguments.createMap().apply {
         putString("alias", keyInfo.alias)
         putString("algorithm", keyInfo.algorithm)
         putString("curve", keyInfo.curve)
         putBoolean("hasKeyPair", true)
         putBoolean("insideSecureHardware", keyInfo.insideSecureHardware)
-        putBoolean("strongBoxAvailable", keyInfo.strongBoxAvailable)
-        putBoolean("strongBoxBacked", keyInfo.strongBoxBacked)
-        if (keyInfo.securityLevel != null) {
-          putInt("securityLevel", keyInfo.securityLevel)
-        }
+        putMap("hardware", hardware)
       }
       promise.resolve(result)
     } catch (e: Exception) {
@@ -294,9 +352,4 @@ class DPoPModule(reactContext: ReactApplicationContext) :
       promise.reject("ERR_DPOP_GENERATE_PROOF", e.message, e)
     }
   }
-
-  companion object {
-    private const val DEFAULT_ALIAS = "react-native-dpop"
-    const val NAME = NativeReactNativeDPoPSpec.NAME
-  }
 }

package/android/src/main/java/com/reactnativedpop/DPoPPackage.kt

@@ -5,7 +5,6 @@ import com.facebook.react.bridge.NativeModule
 import com.facebook.react.bridge.ReactApplicationContext
 import com.facebook.react.module.model.ReactModuleInfo
 import com.facebook.react.module.model.ReactModuleInfoProvider
-import java.util.HashMap
 
 class DPoPPackage : BaseReactPackage() {
   override fun getModule(name: String, reactContext: ReactApplicationContext): NativeModule? {
@@ -19,12 +18,13 @@ class DPoPPackage : BaseReactPackage() {
   override fun getReactModuleInfoProvider() = ReactModuleInfoProvider {
     mapOf(
       DPoPModule.NAME to ReactModuleInfo(
-        name = DPoPModule.NAME,
-        className = DPoPModule.NAME,
-        canOverrideExistingModule = false,
-        needsEagerInit = false,
-        isCxxModule = false,
-        isTurboModule = true
+        DPoPModule.NAME,
+        DPoPModule::class.java.name,
+        false,
+        false,
+        false,
+        false,
+        true
       )
     )
   }

package/ios/DPoPKeyStore.swift

@@ -12,20 +12,24 @@ struct DPoPKeyInfo {
   let curve: String
   let hasKeyPair: Bool
   let insideSecureHardware: Bool
-  let strongBoxAvailable: Bool
-  let strongBoxBacked: Bool
 }
 
 final class DPoPKeyStore {
   private let secureEnclave = SecureEnclaveKeyStore()
   private let keychain = KeychainKeyStore()
+  private let fallbackReasonDefaults = UserDefaults.standard
+  private let fallbackReasonPrefix = "react_native_dpop_secure_enclave_fallback_reason_"
+  private let unavailableFallbackReason = "UNAVAILABLE"
+  private lazy var secureEnclaveAvailable = secureEnclave.isAvailable()
 
   func generateKeyPair(alias: String) throws {
     try deleteKeyPair(alias: alias)
 
     do {
       try secureEnclave.generateKeyPair(alias: alias)
+      clearSecureEnclaveFallbackReason(alias: alias)
     } catch {
+      storeSecureEnclaveFallbackReason(alias: alias, reason: mapSecureEnclaveFallbackReason(error))
       try keychain.generateKeyPair(alias: alias)
     }
   }
@@ -33,6 +37,7 @@ final class DPoPKeyStore {
   func deleteKeyPair(alias: String) throws {
     try secureEnclave.deleteKeyPair(alias: alias)
     try keychain.deleteKeyPair(alias: alias)
+    clearSecureEnclaveFallbackReason(alias: alias)
   }
 
   func hasKeyPair(alias: String) -> Bool {
@@ -64,9 +69,7 @@ final class DPoPKeyStore {
         algorithm: "EC",
         curve: "P-256",
         hasKeyPair: true,
-        insideSecureHardware: true,
-        strongBoxAvailable: false,
-        strongBoxBacked: false
+        insideSecureHardware: true
       )
     }
 
@@ -76,9 +79,7 @@ final class DPoPKeyStore {
         algorithm: "EC",
         curve: "P-256",
         hasKeyPair: true,
-        insideSecureHardware: false,
-        strongBoxAvailable: false,
-        strongBoxBacked: false
+        insideSecureHardware: false
       )
     }
 
@@ -87,13 +88,56 @@ final class DPoPKeyStore {
       algorithm: "EC",
       curve: "P-256",
       hasKeyPair: false,
-      insideSecureHardware: false,
-      strongBoxAvailable: false,
-      strongBoxBacked: false
+      insideSecureHardware: false
     )
   }
 
   func isHardwareBacked(alias: String) -> Bool {
     secureEnclave.isHardwareBacked(alias: alias)
   }
+
+  func isSecureEnclaveAvailable() -> Bool {
+    secureEnclaveAvailable
+  }
+
+  func getSecureEnclaveFallbackReason(alias: String) -> String? {
+    if !secureEnclaveAvailable && keychain.hasKeyPair(alias: alias) {
+      return unavailableFallbackReason
+    }
+
+    if let storedReason = fallbackReasonDefaults.string(forKey: fallbackReasonKey(alias: alias)) {
+      return storedReason
+    }
+
+    return nil
+  }
+
+  private func storeSecureEnclaveFallbackReason(alias: String, reason: String) {
+    fallbackReasonDefaults.set(reason, forKey: fallbackReasonKey(alias: alias))
+  }
+
+  private func clearSecureEnclaveFallbackReason(alias: String) {
+    fallbackReasonDefaults.removeObject(forKey: fallbackReasonKey(alias: alias))
+  }
+
+  private func fallbackReasonKey(alias: String) -> String {
+    "\(fallbackReasonPrefix)\(alias)"
+  }
+
+  private func mapSecureEnclaveFallbackReason(_ error: Error) -> String {
+    let nsError = error as NSError
+
+    if nsError.domain == NSOSStatusErrorDomain {
+      switch nsError.code {
+      case Int(errSecNotAvailable), Int(errSecUnimplemented):
+        return "UNAVAILABLE"
+      case Int(errSecAuthFailed), Int(errSecInteractionNotAllowed), Int(errSecUserCanceled):
+        return "POLICY_REJECTED"
+      default:
+        return "PROVIDER_ERROR"
+      }
+    }
+
+    return "UNKNOWN"
+  }
 }

package/ios/DPoPModule.swift

@@ -7,6 +7,8 @@ final class DPoPModule {
 
   private let keyStore = DPoPKeyStore()
   private let defaultAlias = "react-native-dpop"
+  private let unknownSecureEnclaveFallbackReason = "UNKNOWN"
+  private let unavailableSecureEnclaveFallbackReason = "UNAVAILABLE"
 
   private init() {}
 
@@ -44,26 +46,75 @@ final class DPoPModule {
 
   func getKeyInfo(alias: String?) -> [String: Any] {
     let effectiveAlias = resolveAlias(alias)
+    let secureEnclaveAvailable = keyStore.isSecureEnclaveAvailable()
     let keyInfo = keyStore.getKeyInfo(alias: effectiveAlias)
+    let secureEnclaveBacked = secureEnclaveAvailable && keyInfo.insideSecureHardware
+    let fallbackReason = resolveSecureEnclaveFallbackReason(
+      secureEnclaveAvailable: secureEnclaveAvailable,
+      secureEnclaveBacked: secureEnclaveBacked,
+      hasKeyPair: keyInfo.hasKeyPair,
+      fallbackReason: keyStore.getSecureEnclaveFallbackReason(alias: effectiveAlias)
+    )
+    let secureEnclaveFallbackReason: Any = fallbackReason ?? NSNull()
 
     if !keyInfo.hasKeyPair {
       return [
         "alias": effectiveAlias,
-        "hasKeyPair": false
+        "hasKeyPair": false,
+        "hardware": [
+          "ios": [
+            "secureEnclaveAvailable": secureEnclaveAvailable,
+            "secureEnclaveBacked": false,
+            "securityLevel": NSNull(),
+            "securityLevelName": "SOFTWARE",
+            "secureEnclaveFallbackReason": secureEnclaveFallbackReason
+          ]
+        ]
       ]
     }
 
+    let securityLevel = secureEnclaveBacked ? 2 : 1
+    let securityLevelName = secureEnclaveBacked ? "SECURE_ENCLAVE" : "SOFTWARE"
+
     return [
       "alias": keyInfo.alias,
       "algorithm": keyInfo.algorithm,
       "curve": keyInfo.curve,
       "hasKeyPair": true,
-      "insideSecureHardware": keyInfo.insideSecureHardware,
-      "strongBoxAvailable": keyInfo.strongBoxAvailable,
-      "strongBoxBacked": keyInfo.strongBoxBacked
+      "insideSecureHardware": secureEnclaveBacked,
+      "hardware": [
+        "ios": [
+          "secureEnclaveAvailable": secureEnclaveAvailable,
+          "secureEnclaveBacked": secureEnclaveBacked,
+          "securityLevel": securityLevel,
+          "securityLevelName": securityLevelName,
+          "secureEnclaveFallbackReason": secureEnclaveFallbackReason
+        ]
+      ]
     ]
   }
 
+  private func resolveSecureEnclaveFallbackReason(
+    secureEnclaveAvailable: Bool,
+    secureEnclaveBacked: Bool,
+    hasKeyPair: Bool,
+    fallbackReason: String?
+  ) -> String? {
+    if let fallbackReason {
+      return fallbackReason
+    }
+
+    if hasKeyPair && !secureEnclaveAvailable {
+      return unavailableSecureEnclaveFallbackReason
+    }
+
+    if hasKeyPair && !secureEnclaveBacked {
+      return unknownSecureEnclaveFallbackReason
+    }
+
+    return nil
+  }
+
   func getPublicKeyDer(alias: String?) throws -> String {
     let effectiveAlias = resolveAlias(alias)
     if !keyStore.hasKeyPair(alias: effectiveAlias) {
@@ -327,12 +378,19 @@ final class DPoPModule {
     additional: [String: Any]?,
     kid: String?,
     jti: String?,
-    iat: NSNumber?,
+    iat: Any?,
     alias: String?,
     resolve: @escaping RCTPromiseResolveBlock,
     reject: @escaping RCTPromiseRejectBlock
   ) {
     do {
+      let normalizedIat: NSNumber?
+      if iat is NSNull {
+        normalizedIat = nil
+      } else {
+        normalizedIat = iat as? NSNumber
+      }
+
       resolve(
         try DPoPModule.shared.generateProof(
           htu: htu,
@@ -342,7 +400,7 @@ final class DPoPModule {
           additional: additional,
           kid: kid,
           jti: jti,
-          iat: iat,
+          iat: normalizedIat,
           alias: alias
         )
       )

package/ios/DPoPModuleBridge.mm

@@ -70,7 +70,7 @@ RCT_EXTERN_METHOD(generateProof:(NSString *)htu
                   additional:(NSDictionary * _Nullable)additional
                   kid:(NSString * _Nullable)kid
                   jti:(NSString * _Nullable)jti
-                  iat:(NSNumber * _Nullable)iat
+                  iat:(id _Nullable)iat
                   alias:(NSString * _Nullable)alias
                   resolve:(RCTPromiseResolveBlock)resolve
                   reject:(RCTPromiseRejectBlock)reject)

package/ios/SecureEnclaveKeyStore.swift

@@ -4,6 +4,21 @@ import Security
 final class SecureEnclaveKeyStore {
   private let service = "com.dpop.secureenclave"
 
+  func isAvailable() -> Bool {
+    #if targetEnvironment(simulator)
+      return false
+    #else
+      let probeAlias = "__secure_enclave_probe_\(UUID().uuidString)"
+      do {
+        try generateKeyPair(alias: probeAlias)
+        try deleteKeyPair(alias: probeAlias)
+        return true
+      } catch {
+        return false
+      }
+    #endif
+  }
+
   func generateKeyPair(alias: String) throws {
     try deleteKeyPair(alias: alias)
 

package/lib/module/NativeReactNativeDPoP.js

@@ -1,6 +1,8 @@
 "use strict";
 
 import { NativeModules, TurboModuleRegistry } from 'react-native';
-const nativeDpopModule = TurboModuleRegistry.get('ReactNativeDPoP') ?? NativeModules.ReactNativeDPoP;
+const nativeDpopModule =
+// eslint-disable-next-line dot-notation -- required by noPropertyAccessFromIndexSignature from @tsconfig/strictest
+TurboModuleRegistry.get('ReactNativeDPoP') ?? NativeModules['ReactNativeDPoP'];
 export default nativeDpopModule;
 //# sourceMappingURL=NativeReactNativeDPoP.js.map

package/lib/module/NativeReactNativeDPoP.js.map

@@ -1 +1 @@
-{"version":3,"names":["NativeModules","TurboModuleRegistry","nativeDpopModule","get","ReactNativeDPoP"],"sourceRoot":"../../src","sources":["NativeReactNativeDPoP.ts"],"mappings":";;AACA,SAASA,aAAa,EAAEC,mBAAmB,QAAQ,cAAc;AA4BjE,MAAMC,gBAAgB,GACpBD,mBAAmB,CAACE,GAAG,CAAO,iBAAiB,CAAC,IAAKH,aAAa,CAACI,eAAoC;AAEzG,eAAeF,gBAAgB","ignoreList":[]}
+{"version":3,"names":["NativeModules","TurboModuleRegistry","nativeDpopModule","get"],"sourceRoot":"../../src","sources":["NativeReactNativeDPoP.ts"],"mappings":";;AACA,SAASA,aAAa,EAAEC,mBAAmB,QAAQ,cAAc;AA4BjE,MAAMC,gBAAgB;AACpB;AACAD,mBAAmB,CAACE,GAAG,CAAO,iBAAiB,CAAC,IAAKH,aAAa,CAAC,iBAAiB,CAAsB;AAE5G,eAAeE,gBAAgB","ignoreList":[]}

package/lib/module/index.js

@@ -26,7 +26,9 @@ export class DPoP {
     return NativeReactNativeDPoP.isBoundToAlias(this.proof, alias ?? this.alias ?? null);
   }
   static async generateProof(input) {
-    const result = await NativeReactNativeDPoP.generateProof(input.htu, input.htm, input.nonce ?? null, input.accessToken ?? null, input.additional ?? null, input.kid ?? null, input.jti ?? null, input.iat ?? null, input.alias ?? null);
+    const result = await NativeReactNativeDPoP.generateProof(input.htu, input.htm, input.nonce ?? null, input.accessToken ?? null, input.additional ?? null, input.kid ?? null, input.jti ?? null,
+    // RN 0.75 Android bridge can crash when a nullable Double arrives as null.
+    input.iat ?? Math.floor(Date.now() / 1000), input.alias ?? null);
     return new DPoP(result.proof, result.proofContext, input.alias);
   }
   static async assertHardwareBacked(alias) {

package/lib/module/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["NativeReactNativeDPoP","DPoP","constructor","proof","proofContext","alias","calculateThumbprint","getPublicKey","format","getPublicKeyDer","getPublicKeyRaw","getPublicKeyJwk","signWithDpopPrivateKey","payload","isBoundToAlias","generateProof","input","result","htu","htm","nonce","accessToken","additional","kid","jti","iat","assertHardwareBacked","deleteKeyPair","getKeyInfo","hasKeyPair","rotateKeyPair"],"sourceRoot":"../../src","sources":["index.tsx"],"mappings":";;AAAA,OAAOA,qBAAqB,MAAM,4BAAyB;AAoD3D,OAAO,MAAMC,IAAI,CAAC;EAKRC,WAAWA,CAACC,KAAa,EAAEC,YAA8B,EAAEC,KAAc,EAAE;IACjF,IAAI,CAACF,KAAK,GAAGA,KAAK;IAClB,IAAI,CAACC,YAAY,GAAGA,YAAY;IAChC,IAAI,CAACC,KAAK,GAAGA,KAAK;EACpB;EAEA,MAAaC,mBAAmBA,CAAA,EAAoB;IAClD,OAAON,qBAAqB,CAACM,mBAAmB,CAAC,IAAI,CAACD,KAAK,IAAI,IAAI,CAAC;EACtE;EAEA,MAAaE,YAAYA,CAACC,MAAuB,EAA+B;IAC9E,IAAIA,MAAM,KAAK,KAAK,EAAE;MACpB,OAAOR,qBAAqB,CAACS,eAAe,CAAC,IAAI,CAACJ,KAAK,IAAI,IAAI,CAAC;IAClE;IACA,IAAIG,MAAM,KAAK,KAAK,EAAE;MACpB,OAAOR,qBAAqB,CAACU,eAAe,CAAC,IAAI,CAACL,KAAK,IAAI,IAAI,CAAC;IAClE;IAEA,OAAOL,qBAAqB,CAACW,eAAe,CAAC,IAAI,CAACN,KAAK,IAAI,IAAI,CAAC;EAClE;EAEA,MAAaO,sBAAsBA,CAACC,OAAe,EAAmB;IACpE,OAAOb,qBAAqB,CAACY,sBAAsB,CAACC,OAAO,EAAE,IAAI,CAACR,KAAK,IAAI,IAAI,CAAC;EAClF;EAEA,MAAaS,cAAcA,CAACT,KAAc,EAAoB;IAC5D,OAAOL,qBAAqB,CAACc,cAAc,CAAC,IAAI,CAACX,KAAK,EAAEE,KAAK,IAAI,IAAI,CAACA,KAAK,IAAI,IAAI,CAAC;EACtF;EAEA,aAAoBU,aAAaA,CAACC,KAAyB,EAAiB;IAC1E,MAAMC,MAAM,GAAI,MAAMjB,qBAAqB,CAACe,aAAa,CACvDC,KAAK,CAACE,GAAG,EACTF,KAAK,CAACG,GAAG,EACTH,KAAK,CAACI,KAAK,IAAI,IAAI,EACnBJ,KAAK,CAACK,WAAW,IAAI,IAAI,EACzBL,KAAK,CAACM,UAAU,IAAI,IAAI,EACxBN,KAAK,CAACO,GAAG,IAAI,IAAI,EACjBP,KAAK,CAACQ,GAAG,IAAI,IAAI,EACjBR,KAAK,CAACS,GAAG,IAAI,IAAI,EACjBT,KAAK,CAACX,KAAK,IAAI,IACjB,CAAyB;IAEzB,OAAO,IAAIJ,IAAI,CAACgB,MAAM,CAACd,KAAK,EAAEc,MAAM,CAACb,YAAY,EAAEY,KAAK,CAACX,KAAK,CAAC;EACjE;EAEA,aAAoBqB,oBAAoBA,CAACrB,KAAc,EAAiB;IACtE,MAAML,qBAAqB,CAAC0B,oBAAoB,CAACrB,KAAK,IAAI,IAAI,CAAC;EACjE;EAEA,aAAoBsB,aAAaA,CAACtB,KAAc,EAAiB;IAC/D,MAAML,qBAAqB,CAAC2B,aAAa,CAACtB,KAAK,IAAI,IAAI,CAAC;EAC1D;EAEA,aAAoBuB,UAAUA,CAACvB,KAAc,EAAwB;IACnE,OAAOL,qBAAqB,CAAC4B,UAAU,CAACvB,KAAK,IAAI,IAAI,CAAC;EACxD;EAEA,aAAoBwB,UAAUA,CAACxB,KAAc,EAAoB;IAC/D,OAAOL,qBAAqB,CAAC6B,UAAU,CAACxB,KAAK,IAAI,IAAI,CAAC;EACxD;EAEA,aAAoByB,aAAaA,CAACzB,KAAc,EAAiB;IAC/D,MAAML,qBAAqB,CAAC8B,aAAa,CAACzB,KAAK,IAAI,IAAI,CAAC;EAC1D;AACF","ignoreList":[]}
+{"version":3,"names":["NativeReactNativeDPoP","DPoP","constructor","proof","proofContext","alias","calculateThumbprint","getPublicKey","format","getPublicKeyDer","getPublicKeyRaw","getPublicKeyJwk","signWithDpopPrivateKey","payload","isBoundToAlias","generateProof","input","result","htu","htm","nonce","accessToken","additional","kid","jti","iat","Math","floor","Date","now","assertHardwareBacked","deleteKeyPair","getKeyInfo","hasKeyPair","rotateKeyPair"],"sourceRoot":"../../src","sources":["index.tsx"],"mappings":";;AAAA,OAAOA,qBAAqB,MAAM,4BAAyB;AAqE3D,OAAO,MAAMC,IAAI,CAAC;EAKRC,WAAWA,CAACC,KAAa,EAAEC,YAA8B,EAAEC,KAAc,EAAE;IACjF,IAAI,CAACF,KAAK,GAAGA,KAAK;IAClB,IAAI,CAACC,YAAY,GAAGA,YAAY;IAChC,IAAI,CAACC,KAAK,GAAGA,KAAK;EACpB;EAEA,MAAaC,mBAAmBA,CAAA,EAAoB;IAClD,OAAON,qBAAqB,CAACM,mBAAmB,CAAC,IAAI,CAACD,KAAK,IAAI,IAAI,CAAC;EACtE;EAEA,MAAaE,YAAYA,CAACC,MAAuB,EAA+B;IAC9E,IAAIA,MAAM,KAAK,KAAK,EAAE;MACpB,OAAOR,qBAAqB,CAACS,eAAe,CAAC,IAAI,CAACJ,KAAK,IAAI,IAAI,CAAC;IAClE;IACA,IAAIG,MAAM,KAAK,KAAK,EAAE;MACpB,OAAOR,qBAAqB,CAACU,eAAe,CAAC,IAAI,CAACL,KAAK,IAAI,IAAI,CAAC;IAClE;IAEA,OAAOL,qBAAqB,CAACW,eAAe,CAAC,IAAI,CAACN,KAAK,IAAI,IAAI,CAAC;EAClE;EAEA,MAAaO,sBAAsBA,CAACC,OAAe,EAAmB;IACpE,OAAOb,qBAAqB,CAACY,sBAAsB,CAACC,OAAO,EAAE,IAAI,CAACR,KAAK,IAAI,IAAI,CAAC;EAClF;EAEA,MAAaS,cAAcA,CAACT,KAAc,EAAoB;IAC5D,OAAOL,qBAAqB,CAACc,cAAc,CAAC,IAAI,CAACX,KAAK,EAAEE,KAAK,IAAI,IAAI,CAACA,KAAK,IAAI,IAAI,CAAC;EACtF;EAEA,aAAoBU,aAAaA,CAACC,KAAyB,EAAiB;IAC1E,MAAMC,MAAM,GAAI,MAAMjB,qBAAqB,CAACe,aAAa,CACvDC,KAAK,CAACE,GAAG,EACTF,KAAK,CAACG,GAAG,EACTH,KAAK,CAACI,KAAK,IAAI,IAAI,EACnBJ,KAAK,CAACK,WAAW,IAAI,IAAI,EACzBL,KAAK,CAACM,UAAU,IAAI,IAAI,EACxBN,KAAK,CAACO,GAAG,IAAI,IAAI,EACjBP,KAAK,CAACQ,GAAG,IAAI,IAAI;IACjB;IACAR,KAAK,CAACS,GAAG,IAAIC,IAAI,CAACC,KAAK,CAACC,IAAI,CAACC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,EAC1Cb,KAAK,CAACX,KAAK,IAAI,IACjB,CAAyB;IAEzB,OAAO,IAAIJ,IAAI,CAACgB,MAAM,CAACd,KAAK,EAAEc,MAAM,CAACb,YAAY,EAAEY,KAAK,CAACX,KAAK,CAAC;EACjE;EAEA,aAAoByB,oBAAoBA,CAACzB,KAAc,EAAiB;IACtE,MAAML,qBAAqB,CAAC8B,oBAAoB,CAACzB,KAAK,IAAI,IAAI,CAAC;EACjE;EAEA,aAAoB0B,aAAaA,CAAC1B,KAAc,EAAiB;IAC/D,MAAML,qBAAqB,CAAC+B,aAAa,CAAC1B,KAAK,IAAI,IAAI,CAAC;EAC1D;EAEA,aAAoB2B,UAAUA,CAAC3B,KAAc,EAAwB;IACnE,OAAOL,qBAAqB,CAACgC,UAAU,CAAC3B,KAAK,IAAI,IAAI,CAAC;EACxD;EAEA,aAAoB4B,UAAUA,CAAC5B,KAAc,EAAoB;IAC/D,OAAOL,qBAAqB,CAACiC,UAAU,CAAC5B,KAAK,IAAI,IAAI,CAAC;EACxD;EAEA,aAAoB6B,aAAaA,CAAC7B,KAAc,EAAiB;IAC/D,MAAML,qBAAqB,CAACkC,aAAa,CAAC7B,KAAK,IAAI,IAAI,CAAC;EAC1D;AACF","ignoreList":[]}

package/lib/typescript/examples/shared/DPoPExampleContent.d.ts

@@ -0,0 +1,2 @@
+export default function DPoPExampleContent(): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=DPoPExampleContent.d.ts.map

package/lib/typescript/examples/shared/DPoPExampleContent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DPoPExampleContent.d.ts","sourceRoot":"","sources":["../../../../examples/shared/DPoPExampleContent.tsx"],"names":[],"mappings":"AAIA,MAAM,CAAC,OAAO,UAAU,kBAAkB,4CA0BzC"}

package/lib/typescript/examples/v0.75/App.d.ts

@@ -0,0 +1,2 @@
+export default function App(): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=App.d.ts.map

package/lib/typescript/examples/v0.75/App.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"App.d.ts","sourceRoot":"","sources":["../../../../examples/v0.75/App.tsx"],"names":[],"mappings":"AAIA,MAAM,CAAC,OAAO,UAAU,GAAG,4CAM1B"}

package/lib/typescript/examples/v0.83/App.d.ts

@@ -0,0 +1,2 @@
+export default function App(): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=App.d.ts.map

package/lib/typescript/examples/v0.83/App.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"App.d.ts","sourceRoot":"","sources":["../../../../examples/v0.83/App.tsx"],"names":[],"mappings":"AAKA,MAAM,CAAC,OAAO,UAAU,GAAG,4CAM1B"}

package/lib/typescript/src/NativeReactNativeDPoP.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"NativeReactNativeDPoP.d.ts","sourceRoot":"","sources":["../../../src/NativeReactNativeDPoP.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAE9E,MAAM,WAAW,IAAK,SAAQ,WAAW;IACvC,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACxD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/E,aAAa,CACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,UAAU,EAAE,YAAY,GAAG,IAAI,EAC/B,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAAC,YAAY,CAAC,CAAC;CAC1B;wBAKkC,IAAI;AAAvC,wBAAwC"}
+{"version":3,"file":"NativeReactNativeDPoP.d.ts","sourceRoot":"","sources":["../../../src/NativeReactNativeDPoP.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAE9E,MAAM,WAAW,IAAK,SAAQ,WAAW;IACvC,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACxD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/E,aAAa,CACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,UAAU,EAAE,YAAY,GAAG,IAAI,EAC/B,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAAC,YAAY,CAAC,CAAC;CAC1B;wBAMkC,IAAI;AAAvC,wBAAwC"}

package/lib/typescript/src/index.d.ts

@@ -6,15 +6,31 @@ export type PublicJwk = {
     y: string;
 };
 export type PublicKeyFormat = 'JWK' | 'DER' | 'RAW';
+export type SecureHardwareFallbackReason = 'UNAVAILABLE' | 'PROVIDER_ERROR' | 'POLICY_REJECTED' | 'UNKNOWN';
+export type AndroidSecurityLevelName = 'SOFTWARE' | 'TRUSTED_ENVIRONMENT' | 'STRONGBOX';
+export type IOSSecurityLevelName = 'SOFTWARE' | 'SECURE_ENCLAVE';
 export type DPoPKeyInfo = {
     alias: string;
     hasKeyPair: boolean;
     algorithm?: string;
     curve?: string;
     insideSecureHardware?: boolean;
-    securityLevel?: number;
-    strongBoxAvailable?: boolean;
-    strongBoxBacked?: boolean;
+    hardware?: {
+        android?: {
+            strongBoxAvailable: boolean;
+            strongBoxBacked: boolean;
+            securityLevel?: number;
+            securityLevelName?: AndroidSecurityLevelName;
+            strongBoxFallbackReason?: SecureHardwareFallbackReason | null;
+        };
+        ios?: {
+            secureEnclaveAvailable: boolean;
+            secureEnclaveBacked: boolean;
+            securityLevel?: number | null;
+            securityLevelName?: IOSSecurityLevelName;
+            secureEnclaveFallbackReason?: SecureHardwareFallbackReason | null;
+        };
+    };
 };
 export type GenerateProofInput = {
     htu: string;
@@ -39,7 +55,7 @@ export type DPoPProofContext = {
 };
 export declare class DPoP {
     readonly proof: string;
-    readonly alias?: string;
+    readonly alias: string | undefined;
     readonly proofContext: DPoPProofContext;
     private constructor();
     calculateThumbprint(): Promise<string>;

package/lib/typescript/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.tsx"],"names":[],"mappings":"AAEA,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,OAAO,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAEpD,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAOF,qBAAa,IAAI;IACf,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,KAAK,CAAC,EAAE,MAAM,CAAC;IAC/B,SAAgB,YAAY,EAAE,gBAAgB,CAAC;IAE/C,OAAO;IAMM,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAItC,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC;IAWlE,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIxD,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;WAIzC,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;WAgBvD,oBAAoB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;WAInD,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;WAI5C,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;WAIhD,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;WAI5C,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.tsx"],"names":[],"mappings":"AAEA,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,OAAO,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAEpD,MAAM,MAAM,4BAA4B,GAAG,aAAa,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAC5G,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,qBAAqB,GAAG,WAAW,CAAC;AACxF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAEjE,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE;YACR,kBAAkB,EAAE,OAAO,CAAC;YAC5B,eAAe,EAAE,OAAO,CAAC;YACzB,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;YAC7C,uBAAuB,CAAC,EAAE,4BAA4B,GAAG,IAAI,CAAC;SAC/D,CAAC;QACF,GAAG,CAAC,EAAE;YACJ,sBAAsB,EAAE,OAAO,CAAC;YAChC,mBAAmB,EAAE,OAAO,CAAC;YAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YAC9B,iBAAiB,CAAC,EAAE,oBAAoB,CAAC;YACzC,2BAA2B,CAAC,EAAE,4BAA4B,GAAG,IAAI,CAAC;SACnE,CAAC;KACH,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAOF,qBAAa,IAAI;IACf,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,SAAgB,YAAY,EAAE,gBAAgB,CAAC;IAE/C,OAAO;IAMM,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAItC,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC;IAWlE,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIxD,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;WAIzC,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;WAiBvD,oBAAoB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;WAInD,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;WAI5C,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;WAIhD,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;WAI5C,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-dpop",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "React Native library for DPoP proof generation and key management.",
   "keywords": [
     "android",
@@ -18,6 +18,7 @@
   "license": "MIT",
   "author": "Pedro Cirilo <phscirilo123@gmail.com> (https://github.com/Cirilord)",
   "main": "./lib/module/index.js",
+  "react-native": "./src/index.tsx",
   "types": "./lib/typescript/src/index.d.ts",
   "exports": {
     ".": {
@@ -47,11 +48,12 @@
     "!**/.*"
   ],
   "scripts": {
-    "clean": "del-cli android/build example/android/build example/android/app/build example/ios/build lib",
-    "example": "yarn workspace react-native-dpop-example",
+    "clean": "del-cli android/build examples/v0.83/android/build examples/v0.83/android/app/build examples/v0.83/ios/build lib",
+    "example": "yarn workspace react-native-dpop-example-v0.83",
     "lint": "eslint \"**/*.{js,ts,tsx}\"",
     "prepare": "bob build",
-    "release": "release-it --only-version",
+    "release": "release-it",
+    "release:version": "release-it --only-version",
     "test": "jest",
     "typecheck": "tsc"
   },
@@ -70,12 +72,14 @@
     "@react-native/babel-preset": "0.83.0",
     "@react-native/eslint-config": "0.83.0",
     "@release-it/conventional-changelog": "^10.0.1",
+    "@tsconfig/strictest": "^2.0.8",
     "@types/jest": "^29.5.14",
     "@types/react": "^19.2.0",
     "commitlint": "^19.8.1",
     "del-cli": "^6.0.0",
     "eslint": "^9.35.0",
     "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-prettier": "^5.5.4",
     "jest": "^29.7.0",
     "lefthook": "^2.0.3",
@@ -88,7 +92,8 @@
     "typescript": "^5.9.2"
   },
   "workspaces": [
-    "example"
+    "examples/v0.75",
+    "examples/v0.83"
   ],
   "packageManager": "yarn@4.11.0",
   "react-native-builder-bob": {

package/src/NativeReactNativeDPoP.ts

@@ -28,6 +28,7 @@ export interface Spec extends TurboModule {
 }
 
 const nativeDpopModule =
-  TurboModuleRegistry.get<Spec>('ReactNativeDPoP') ?? (NativeModules.ReactNativeDPoP as Spec | undefined);
+  // eslint-disable-next-line dot-notation -- required by noPropertyAccessFromIndexSignature from @tsconfig/strictest
+  TurboModuleRegistry.get<Spec>('ReactNativeDPoP') ?? (NativeModules['ReactNativeDPoP'] as Spec | undefined);
 
 export default nativeDpopModule as Spec;

package/src/index.tsx

@@ -11,15 +11,32 @@ export type PublicJwk = {
 
 export type PublicKeyFormat = 'JWK' | 'DER' | 'RAW';
 
+export type SecureHardwareFallbackReason = 'UNAVAILABLE' | 'PROVIDER_ERROR' | 'POLICY_REJECTED' | 'UNKNOWN';
+export type AndroidSecurityLevelName = 'SOFTWARE' | 'TRUSTED_ENVIRONMENT' | 'STRONGBOX';
+export type IOSSecurityLevelName = 'SOFTWARE' | 'SECURE_ENCLAVE';
+
 export type DPoPKeyInfo = {
   alias: string;
   hasKeyPair: boolean;
   algorithm?: string;
   curve?: string;
   insideSecureHardware?: boolean;
-  securityLevel?: number;
-  strongBoxAvailable?: boolean;
-  strongBoxBacked?: boolean;
+  hardware?: {
+    android?: {
+      strongBoxAvailable: boolean;
+      strongBoxBacked: boolean;
+      securityLevel?: number;
+      securityLevelName?: AndroidSecurityLevelName;
+      strongBoxFallbackReason?: SecureHardwareFallbackReason | null;
+    };
+    ios?: {
+      secureEnclaveAvailable: boolean;
+      secureEnclaveBacked: boolean;
+      securityLevel?: number | null;
+      securityLevelName?: IOSSecurityLevelName;
+      secureEnclaveFallbackReason?: SecureHardwareFallbackReason | null;
+    };
+  };
 };
 
 export type GenerateProofInput = {
@@ -52,7 +69,7 @@ type GenerateProofResult = {
 
 export class DPoP {
   public readonly proof: string;
-  public readonly alias?: string;
+  public readonly alias: string | undefined;
   public readonly proofContext: DPoPProofContext;
 
   private constructor(proof: string, proofContext: DPoPProofContext, alias?: string) {
@@ -93,7 +110,8 @@ export class DPoP {
       input.additional ?? null,
       input.kid ?? null,
       input.jti ?? null,
-      input.iat ?? null,
+      // RN 0.75 Android bridge can crash when a nullable Double arrives as null.
+      input.iat ?? Math.floor(Date.now() / 1000),
       input.alias ?? null
     )) as GenerateProofResult;