react-native-nitro-storage 0.10.3 → 0.11.0

package/ios/IOSStorageAdapterCpp.mm

@@ -11,6 +11,24 @@
 
 namespace NitroStorage {
 
+// Storage strings are length-delimited; C-string conversion aliases keys at NUL.
+static NSString* nsStringFromStdString(const std::string& value) {
+    NSString* result = [[NSString alloc] initWithBytes:value.data()
+        length:value.size() encoding:NSUTF8StringEncoding];
+    if (!result) {
+        throw std::runtime_error("NitroStorage: String is not valid UTF-8");
+    }
+    return result;
+}
+
+static std::string stdStringFromNSString(NSString* value) {
+    const char* bytes = [value UTF8String];
+    if (!bytes) {
+        throw std::runtime_error("NitroStorage: String cannot be encoded as UTF-8");
+    }
+    return std::string(bytes, [value lengthOfBytesUsingEncoding:NSUTF8StringEncoding]);
+}
+
 static NSString* const kKeychainService = @"com.nitrostorage.keychain";
 static NSString* const kBiometricKeychainService = @"com.nitrostorage.biometric";
 static NSString* const kDiskSuiteName = @"com.nitrostorage.disk";
@@ -82,7 +100,7 @@ static void unregisterLegacyDiskKeys(NSArray<NSString*>* keys) {
 
 // --- Legacy disk key migration ---
 // Versions before the suite domain stored Disk values in standardUserDefaults.
-// A conservative, retryable cutover runs at adapter initialization. A valid
+// A conservative, retryable cutover runs before the first Disk operation. A valid
 // registry is copied into the suite domain and each source is removed only
 // after a target readback confirms the copy. Malformed registries, fallback
 // domains, and persistence failures remain untouched for a later retry.
@@ -90,7 +108,7 @@ static void unregisterLegacyDiskKeys(NSArray<NSString*>* keys) {
 static NSString* const kLegacyDiskMigrationMarkerKey =
     @"__nitro_storage_legacy_disk_migration_v1__";
 
-static std::string NitroDiskStorePath() {
+static std::string ResolveNitroDiskStorePath() {
     NSArray<NSURL*>* urls = [[NSFileManager defaultManager]
         URLsForDirectory:NSApplicationSupportDirectory
                inDomains:NSUserDomainMask];
@@ -104,7 +122,12 @@ static std::string NitroDiskStorePath() {
                   attributes:nil
                        error:nil];
     NSString* path = [[directory URLByAppendingPathComponent:@"nitro-storage-disk.sqlite"] path];
-    return std::string([path UTF8String]);
+    return stdStringFromNSString(path);
+}
+
+static const std::string& NitroDiskStorePath() {
+    static const std::string path = ResolveNitroDiskStorePath();
+    return path;
 }
 
 static NitroStorage::SqliteDiskStore& NitroSqliteDiskStore() {
@@ -116,7 +139,14 @@ static bool isInternalDiskKey(NSString* key) {
         [key isEqualToString:kLegacyDiskMigrationMarkerKey];
 }
 
+static NSString* const kSuiteSqliteMigrationMarker = @"suite_v1";
+
 static void migrateSuiteIntoSqlite() {
+    auto& store = NitroSqliteDiskStore();
+    const std::string marker = stdStringFromNSString(kSuiteSqliteMigrationMarker);
+    if (store.hasMigrationMarker(marker)) {
+        return;
+    }
     NSDictionary<NSString*, id>* entries =
         [NitroDiskDefaults() persistentDomainForName:kDiskSuiteName] ?: @{};
     std::vector<std::pair<std::string, std::string>> pairs;
@@ -129,9 +159,9 @@ static void migrateSuiteIntoSqlite() {
         if (![value isKindOfClass:[NSString class]]) {
             continue;
         }
-        pairs.emplace_back(std::string([key UTF8String]), std::string([(NSString*)value UTF8String]));
+        pairs.emplace_back(stdStringFromNSString(key), stdStringFromNSString((NSString*)value));
     }
-    NitroSqliteDiskStore().migrateIfAbsent(pairs);
+    store.migrateOnce(marker, pairs);
 }
 
 static void runLegacyDiskMigrationCutover(
@@ -288,31 +318,54 @@ static CFStringRef accessControlAttr(int level) {
     }
 }
 
-IOSStorageAdapterCpp::IOSStorageAdapterCpp() {
+IOSStorageAdapterCpp::IOSStorageAdapterCpp() = default;
+IOSStorageAdapterCpp::~IOSStorageAdapterCpp() {}
+
+void IOSStorageAdapterCpp::ensureDiskMigrated() {
+    if (diskMigrated_.load(std::memory_order_acquire)) {
+        return;
+    }
+    std::lock_guard<std::mutex> lock(diskMigrationMutex_);
+    if (diskMigrated_.load(std::memory_order_relaxed)) {
+        return;
+    }
     runLegacyDiskMigrationCutover(
         NitroDiskDefaults(),
         [NSUserDefaults standardUserDefaults]
     );
     migrateSuiteIntoSqlite();
+    diskMigrated_.store(true, std::memory_order_release);
 }
-IOSStorageAdapterCpp::~IOSStorageAdapterCpp() {}
 
 #ifdef NITRO_STORAGE_TESTING
 void resetSqliteDiskStoreForTesting() {
     SqliteDiskStore::resetShared();
-    NSString* path = [NSString stringWithUTF8String:NitroDiskStorePath().c_str()];
+    NSString* path = nsStringFromStdString(NitroDiskStorePath());
     NSFileManager* files = [NSFileManager defaultManager];
     [files removeItemAtPath:path error:nil];
     [files removeItemAtPath:[path stringByAppendingString:@"-wal"] error:nil];
     [files removeItemAtPath:[path stringByAppendingString:@"-shm"] error:nil];
 }
+
+void resetSharedSqliteDiskStoreForTesting() {
+    SqliteDiskStore::resetShared();
+}
+
+bool sqliteDiskStoreHasKeyForTesting(const std::string& key) {
+    return NitroSqliteDiskStore().has(key);
+}
+
+std::string diskStorePathForTesting() {
+    return NitroDiskStorePath();
+}
 #endif
 
 // --- Disk ---
 
 void IOSStorageAdapterCpp::setDisk(const std::string& key, const std::string& value) {
+    ensureDiskMigrated();
     NitroSqliteDiskStore().set(key, value);
-    NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
+    NSString* nsKey = nsStringFromStdString(key);
     NSUserDefaults* defaults = NitroDiskDefaults();
     NSUserDefaults* standard = [NSUserDefaults standardUserDefaults];
     if (defaults != standard && [standard objectForKey:nsKey] != nil) {
@@ -322,20 +375,22 @@ void IOSStorageAdapterCpp::setDisk(const std::string& key, const std::string& va
 }
 
 std::optional<std::string> IOSStorageAdapterCpp::getDisk(const std::string& key) {
+    ensureDiskMigrated();
     if (auto stored = NitroSqliteDiskStore().get(key)) {
         return stored;
     }
-    NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
+    NSString* nsKey = nsStringFromStdString(key);
     NSString* result = migrateLegacyDiskValue(nsKey);
     if (!result) return std::nullopt;
-    const std::string value([result UTF8String]);
+    const std::string value = stdStringFromNSString(result);
     NitroSqliteDiskStore().set(key, value);
     return value;
 }
 
 void IOSStorageAdapterCpp::deleteDisk(const std::string& key) {
+    ensureDiskMigrated();
     NitroSqliteDiskStore().remove(key);
-    NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
+    NSString* nsKey = nsStringFromStdString(key);
     NSUserDefaults* defaults = NitroDiskDefaults();
     [defaults removeObjectForKey:nsKey];
     NSUserDefaults* standard = [NSUserDefaults standardUserDefaults];
@@ -346,10 +401,11 @@ void IOSStorageAdapterCpp::deleteDisk(const std::string& key) {
 }
 
 bool IOSStorageAdapterCpp::hasDisk(const std::string& key) {
+    ensureDiskMigrated();
     if (NitroSqliteDiskStore().has(key)) {
         return true;
     }
-    NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
+    NSString* nsKey = nsStringFromStdString(key);
     NSUserDefaults* defaults = NitroDiskDefaults();
     if ([defaults objectForKey:nsKey] != nil) {
         return true;
@@ -362,6 +418,7 @@ bool IOSStorageAdapterCpp::hasDisk(const std::string& key) {
 }
 
 std::vector<std::string> IOSStorageAdapterCpp::getAllKeysDisk() {
+    ensureDiskMigrated();
     std::unordered_set<std::string> combined;
     for (const auto& key : NitroSqliteDiskStore().getAllKeys()) {
         combined.insert(key);
@@ -371,13 +428,13 @@ std::vector<std::string> IOSStorageAdapterCpp::getAllKeysDisk() {
     NSUserDefaults* standard = [NSUserDefaults standardUserDefaults];
     for (NSString* key in entries) {
         if (!isInternalDiskKey(key)) {
-            combined.insert(std::string([key UTF8String]));
+            combined.insert(stdStringFromNSString(key));
         }
     }
     for (NSString* key in [registeredLegacyDiskKeys() allObjects]) {
         if ([entries objectForKey:key] == nil &&
             [standard stringForKey:key] != nil) {
-            combined.insert(std::string([key UTF8String]));
+            combined.insert(stdStringFromNSString(key));
         }
     }
     std::vector<std::string> keys;
@@ -389,6 +446,7 @@ std::vector<std::string> IOSStorageAdapterCpp::getAllKeysDisk() {
 }
 
 std::vector<std::string> IOSStorageAdapterCpp::getKeysByPrefixDisk(const std::string& prefix) {
+    ensureDiskMigrated();
     std::unordered_set<std::string> combined;
     for (const auto& key : NitroSqliteDiskStore().getKeysByPrefix(prefix)) {
         combined.insert(key);
@@ -407,6 +465,7 @@ std::vector<std::string> IOSStorageAdapterCpp::getKeysByPrefixDisk(const std::st
 }
 
 size_t IOSStorageAdapterCpp::sizeDisk() {
+    ensureDiskMigrated();
     return getAllKeysDisk().size();
 }
 
@@ -414,12 +473,13 @@ void IOSStorageAdapterCpp::setDiskBatch(
     const std::vector<std::string>& keys,
     const std::vector<std::string>& values
 ) {
+    ensureDiskMigrated();
     NitroSqliteDiskStore().setBatch(keys, values);
     NSUserDefaults* defaults = NitroDiskDefaults();
     NSUserDefaults* standard = [NSUserDefaults standardUserDefaults];
     NSMutableArray* legacyKeysToRemove = [NSMutableArray array];
     for (size_t i = 0; i < keys.size() && i < values.size(); ++i) {
-        NSString* nsKey = [NSString stringWithUTF8String:keys[i].c_str()];
+        NSString* nsKey = nsStringFromStdString(keys[i]);
         if (defaults != standard && [standard objectForKey:nsKey] != nil) {
             [legacyKeysToRemove addObject:nsKey];
         }
@@ -433,6 +493,7 @@ void IOSStorageAdapterCpp::setDiskBatch(
 std::vector<std::optional<std::string>> IOSStorageAdapterCpp::getDiskBatch(
     const std::vector<std::string>& keys
 ) {
+    ensureDiskMigrated();
     std::vector<std::optional<std::string>> results;
     results.reserve(keys.size());
     for (const auto& key : keys) {
@@ -442,9 +503,10 @@ std::vector<std::optional<std::string>> IOSStorageAdapterCpp::getDiskBatch(
 }
 
 void IOSStorageAdapterCpp::deleteDiskBatch(const std::vector<std::string>& keys) {
+    ensureDiskMigrated();
     NitroSqliteDiskStore().removeBatch(keys);
     for (const auto& key : keys) {
-        NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
+        NSString* nsKey = nsStringFromStdString(key);
         NSUserDefaults* defaults = NitroDiskDefaults();
         [defaults removeObjectForKey:nsKey];
         NSUserDefaults* standard = [NSUserDefaults standardUserDefaults];
@@ -456,6 +518,7 @@ void IOSStorageAdapterCpp::deleteDiskBatch(const std::vector<std::string>& keys)
 }
 
 void IOSStorageAdapterCpp::clearDisk() {
+    ensureDiskMigrated();
     NitroSqliteDiskStore().clear();
     NSUserDefaults* defaults = NitroDiskDefaults();
     NSDictionary<NSString*, id>* entries = [defaults persistentDomainForName:kDiskSuiteName] ?: @{};
@@ -509,6 +572,19 @@ static void throwIfDeleteFailed(OSStatus status, const std::string& operation) {
     throw keychainStatusError(status, operation);
 }
 
+static void throwIfLookupFailed(OSStatus status, const std::string& operation) {
+    if (status == errSecSuccess || status == errSecItemNotFound) {
+        return;
+    }
+    if (status == errSecInteractionNotAllowed) {
+        throw taggedStorageError(
+            "keychain_locked",
+            "NitroStorage: Keychain is locked (errSecInteractionNotAllowed) during " + operation
+        );
+    }
+    throw keychainStatusError(status, operation);
+}
+
 static BiometricKeychainSnapshot captureBiometricValue(
     NSString* nsKey,
     NSString* group
@@ -552,7 +628,7 @@ static BiometricKeychainSnapshot captureBiometricValue(
         throw std::runtime_error("NitroStorage: Biometric snapshot value is not UTF-8");
     }
     snapshot.present = true;
-    snapshot.value = std::string([stringValue UTF8String]);
+    snapshot.value = stdStringFromNSString(stringValue);
     snapshot.accessControl = (SecAccessControlRef)CFRetain((__bridge CFTypeRef)accessControl);
     CFRelease(result);
     return snapshot;
@@ -571,10 +647,6 @@ static NSMutableDictionary* allAccountsQuery(NSString* service, NSString* access
     return query;
 }
 
-static NSString* nsStringFromStdString(const std::string& value) {
-    return [NSString stringWithUTF8String:value.c_str()];
-}
-
 static NSData* nsDataFromStdString(const std::string& value) {
     return [nsStringFromStdString(value) dataUsingEncoding:NSUTF8StringEncoding];
 }
@@ -587,7 +659,8 @@ static void setSecureValue(
 ) {
     NSMutableDictionary* query = baseKeychainQuery(nsKey, kKeychainService, group);
     NSDictionary* updateAttributes = @{
-        (__bridge id)kSecValueData: data
+        (__bridge id)kSecValueData: data,
+        (__bridge id)kSecAttrAccessible: (__bridge id)accessControlAttr(accessControlLevel)
     };
 
     OSStatus status = SecItemUpdate((__bridge CFDictionaryRef)query, (__bridge CFDictionaryRef)updateAttributes);
@@ -633,7 +706,7 @@ static std::optional<std::string> getSecureValue(NSString* nsKey, NSString* grou
     if (status == errSecSuccess && result) {
         NSData* data = (__bridge_transfer NSData*)result;
         NSString* str = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
-        if (str) return std::string([str UTF8String]);
+        if (str) return stdStringFromNSString(str);
     }
     if (status == errSecInteractionNotAllowed) {
         throw taggedStorageError(
@@ -714,6 +787,10 @@ static std::vector<std::string> keychainAccountsForService(NSString* service, NS
             "The item is not accessible until the device is unlocked."
         );
     }
+    if (status != errSecSuccess && status != errSecItemNotFound) {
+        if (result) CFRelease(result);
+        throw keychainStatusError(status, "Secure key enumeration");
+    }
     if (status == errSecSuccess && result) {
         id items = (__bridge_transfer id)result;
         NSArray* itemArray = nil;
@@ -727,7 +804,7 @@ static std::vector<std::string> keychainAccountsForService(NSString* service, NS
             for (NSDictionary* item in itemArray) {
                 NSString* account = item[(__bridge id)kSecAttrAccount];
                 if (account) {
-                    keys.push_back(std::string([account UTF8String]));
+                    keys.push_back(stdStringFromNSString(account));
                 }
             }
         }
@@ -745,7 +822,7 @@ void IOSStorageAdapterCpp::setSecure(const std::string& key, const std::string&
         groupStr = keychainAccessGroup_;
         accessControlLevel = accessControlLevel_;
     }
-    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
+    NSString* group = groupStr.empty() ? nil : nsStringFromStdString(groupStr);
     setSecureValue(nsKey, data, group, accessControlLevel);
     markSecureKeySet(key);
 }
@@ -757,7 +834,7 @@ std::optional<std::string> IOSStorageAdapterCpp::getSecure(const std::string& ke
         std::lock_guard<std::mutex> lock(accessGroupMutex_);
         groupStr = keychainAccessGroup_;
     }
-    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
+    NSString* group = groupStr.empty() ? nil : nsStringFromStdString(groupStr);
     return getSecureValue(nsKey, group);
 }
 
@@ -768,28 +845,35 @@ void IOSStorageAdapterCpp::deleteSecure(const std::string& key) {
         std::lock_guard<std::mutex> lock(accessGroupMutex_);
         groupStr = keychainAccessGroup_;
     }
-    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
+    NSString* group = groupStr.empty() ? nil : nsStringFromStdString(groupStr);
     deleteSecureValue(nsKey, group);
     markSecureKeyRemoved(key);
     markBiometricKeyRemoved(key);
 }
 
 bool IOSStorageAdapterCpp::hasSecure(const std::string& key) {
-    NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
+    NSString* nsKey = nsStringFromStdString(key);
     std::string groupStr;
     {
         std::lock_guard<std::mutex> lock(accessGroupMutex_);
         groupStr = keychainAccessGroup_;
     }
-    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
+    NSString* group = groupStr.empty() ? nil : nsStringFromStdString(groupStr);
     NSMutableDictionary* secureQuery = baseKeychainQuery(nsKey, kKeychainService, group);
     disableKeychainInteraction(secureQuery);
-    if (SecItemCopyMatching((__bridge CFDictionaryRef)secureQuery, NULL) == errSecSuccess) {
+    const OSStatus secureStatus = SecItemCopyMatching((__bridge CFDictionaryRef)secureQuery, NULL);
+    if (secureStatus == errSecSuccess) {
         return true;
     }
+    throwIfLookupFailed(secureStatus, "Secure has");
     NSMutableDictionary* biometricQuery = baseKeychainQuery(nsKey, kBiometricKeychainService, group);
     disableKeychainInteraction(biometricQuery);
-    return SecItemCopyMatching((__bridge CFDictionaryRef)biometricQuery, NULL) == errSecSuccess;
+    const OSStatus biometricStatus = SecItemCopyMatching((__bridge CFDictionaryRef)biometricQuery, NULL);
+    if (biometricStatus == errSecSuccess || biometricStatus == errSecInteractionNotAllowed) {
+        return true;
+    }
+    throwIfLookupFailed(biometricStatus, "Secure has");
+    return false;
 }
 
 std::vector<std::string> IOSStorageAdapterCpp::getAllKeysSecure() {
@@ -836,14 +920,18 @@ void IOSStorageAdapterCpp::setSecureBatch(
         groupStr = keychainAccessGroup_;
         accessControlLevel = accessControlLevel_;
     }
-    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
+    NSString* group = groupStr.empty() ? nil : nsStringFromStdString(groupStr);
     for (size_t i = 0; i < keys.size() && i < values.size(); ++i) {
-        setSecureValue(
-            nsStringFromStdString(keys[i]),
-            nsDataFromStdString(values[i]),
-            group,
-            accessControlLevel
-        );
+        try {
+            setSecureValue(
+                nsStringFromStdString(keys[i]),
+                nsDataFromStdString(values[i]),
+                group,
+                accessControlLevel
+            );
+        } catch (const std::exception& error) {
+            throw PartialBatchError(i, error.what());
+        }
         markSecureKeySet(keys[i]);
     }
 }
@@ -856,7 +944,7 @@ std::vector<std::optional<std::string>> IOSStorageAdapterCpp::getSecureBatch(
         std::lock_guard<std::mutex> lock(accessGroupMutex_);
         groupStr = keychainAccessGroup_;
     }
-    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
+    NSString* group = groupStr.empty() ? nil : nsStringFromStdString(groupStr);
     std::vector<std::optional<std::string>> results;
     results.reserve(keys.size());
     for (const auto& key : keys) {
@@ -871,11 +959,15 @@ void IOSStorageAdapterCpp::deleteSecureBatch(const std::vector<std::string>& key
         std::lock_guard<std::mutex> lock(accessGroupMutex_);
         groupStr = keychainAccessGroup_;
     }
-    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
-    for (const auto& key : keys) {
-        deleteSecureValue(nsStringFromStdString(key), group);
-        markSecureKeyRemoved(key);
-        markBiometricKeyRemoved(key);
+    NSString* group = groupStr.empty() ? nil : nsStringFromStdString(groupStr);
+    for (size_t i = 0; i < keys.size(); ++i) {
+        try {
+            deleteSecureValue(nsStringFromStdString(keys[i]), group);
+        } catch (const std::exception& error) {
+            throw PartialBatchError(i, error.what());
+        }
+        markSecureKeyRemoved(keys[i]);
+        markBiometricKeyRemoved(keys[i]);
     }
 }
 
@@ -885,7 +977,7 @@ void IOSStorageAdapterCpp::clearSecure() {
         std::lock_guard<std::mutex> lock(accessGroupMutex_);
         groupStr = keychainAccessGroup_;
     }
-    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
+    NSString* group = groupStr.empty() ? nil : nsStringFromStdString(groupStr);
     NSMutableDictionary* secureQuery = [@{
         (__bridge id)kSecClass: (__bridge id)kSecClassGenericPassword,
         (__bridge id)kSecAttrService: kKeychainService
@@ -954,7 +1046,7 @@ void IOSStorageAdapterCpp::setSecureBiometricWithLevel(const std::string& key, c
     if (level < 0 || level > 2) {
         throw std::runtime_error("NitroStorage: Invalid biometric level");
     }
-    NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
+    NSString* nsKey = nsStringFromStdString(key);
     NSData* data = nsDataFromStdString(value);
     std::string groupStr;
     int accessControlLevel;
@@ -963,7 +1055,7 @@ void IOSStorageAdapterCpp::setSecureBiometricWithLevel(const std::string& key, c
         groupStr = keychainAccessGroup_;
         accessControlLevel = accessControlLevel_;
     }
-    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
+    NSString* group = groupStr.empty() ? nil : nsStringFromStdString(groupStr);
 
     const BiometricKeychainSnapshot previousBiometric = captureBiometricValue(nsKey, group);
     const std::optional<std::string> previousPlain = getSecureValue(nsKey, group);
@@ -1064,13 +1156,13 @@ void IOSStorageAdapterCpp::setSecureBiometricWithLevel(const std::string& key, c
 }
 
 std::optional<std::string> IOSStorageAdapterCpp::getSecureBiometric(const std::string& key) {
-    NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
+    NSString* nsKey = nsStringFromStdString(key);
     std::string groupStr;
     {
         std::lock_guard<std::mutex> lock(accessGroupMutex_);
         groupStr = keychainAccessGroup_;
     }
-    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
+    NSString* group = groupStr.empty() ? nil : nsStringFromStdString(groupStr);
     NSMutableDictionary* query = baseKeychainQuery(nsKey, kBiometricKeychainService, group);
     query[(__bridge id)kSecReturnData] = @YES;
     query[(__bridge id)kSecMatchLimit] = (__bridge id)kSecMatchLimitOne;
@@ -1080,7 +1172,7 @@ std::optional<std::string> IOSStorageAdapterCpp::getSecureBiometric(const std::s
     if (status == errSecSuccess && result) {
         NSData* data = (__bridge_transfer NSData*)result;
         NSString* str = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
-        if (str) return std::string([str UTF8String]);
+        if (str) return stdStringFromNSString(str);
     }
     if (status == errSecInteractionNotAllowed) {
         throw taggedStorageError(
@@ -1102,13 +1194,13 @@ std::optional<std::string> IOSStorageAdapterCpp::getSecureBiometric(const std::s
 }
 
 void IOSStorageAdapterCpp::deleteSecureBiometric(const std::string& key) {
-    NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
+    NSString* nsKey = nsStringFromStdString(key);
     std::string groupStr;
     {
         std::lock_guard<std::mutex> lock(accessGroupMutex_);
         groupStr = keychainAccessGroup_;
     }
-    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
+    NSString* group = groupStr.empty() ? nil : nsStringFromStdString(groupStr);
     NSMutableDictionary* query = baseKeychainQuery(nsKey, kBiometricKeychainService, group);
     const OSStatus status = SecItemDelete((__bridge CFDictionaryRef)query);
     throwIfDeleteFailed(status, "Biometric delete");
@@ -1116,13 +1208,13 @@ void IOSStorageAdapterCpp::deleteSecureBiometric(const std::string& key) {
 }
 
 bool IOSStorageAdapterCpp::hasSecureBiometric(const std::string& key) {
-    NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
+    NSString* nsKey = nsStringFromStdString(key);
     std::string groupStr;
     {
         std::lock_guard<std::mutex> lock(accessGroupMutex_);
         groupStr = keychainAccessGroup_;
     }
-    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
+    NSString* group = groupStr.empty() ? nil : nsStringFromStdString(groupStr);
     NSMutableDictionary* query = baseKeychainQuery(nsKey, kBiometricKeychainService, group);
     disableKeychainInteraction(query);
     const OSStatus status = SecItemCopyMatching((__bridge CFDictionaryRef)query, NULL);
@@ -1143,7 +1235,7 @@ void IOSStorageAdapterCpp::clearSecureBiometric() {
         std::lock_guard<std::mutex> lock(accessGroupMutex_);
         groupStr = keychainAccessGroup_;
     }
-    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
+    NSString* group = groupStr.empty() ? nil : nsStringFromStdString(groupStr);
     NSMutableDictionary* query = [@{
         (__bridge id)kSecClass: (__bridge id)kSecClassGenericPassword,
         (__bridge id)kSecAttrService: kBiometricKeychainService
@@ -1179,7 +1271,7 @@ void IOSStorageAdapterCpp::ensureSecureKeyCacheHydrated() {
         std::lock_guard<std::mutex> lock(accessGroupMutex_);
         groupStr = keychainAccessGroup_;
     }
-    NSString* nsGroup = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
+    NSString* nsGroup = groupStr.empty() ? nil : nsStringFromStdString(groupStr);
 
     // These can throw errSecInteractionNotAllowed — let the exception propagate
     // so the cache is NOT marked hydrated (will be retried on next access)

package/lib/commonjs/capabilities.js

@@ -6,18 +6,13 @@ Object.defineProperty(exports, "__esModule", {
 exports.DEFAULT_SECURE_WRITES_ASYNC = void 0;
 exports.resolveNativeWriteBuffering = resolveNativeWriteBuffering;
 exports.resolveWebWriteBuffering = resolveWebWriteBuffering;
+var _webBackendContract = require("./web-backend-contract");
 function resolveWebWriteBuffering(diskBackendName, secureBackendName) {
   return {
-    disk: isIndexedDBWebBackendByName(diskBackendName),
-    secure: isIndexedDBWebBackendByName(secureBackendName)
+    disk: (0, _webBackendContract.isIndexedDBBackendName)(diskBackendName),
+    secure: (0, _webBackendContract.isIndexedDBBackendName)(secureBackendName)
   };
 }
-function isIndexedDBWebBackendByName(backendName) {
-  if (!backendName) {
-    return false;
-  }
-  return backendName.startsWith("indexeddb:");
-}
 const DEFAULT_SECURE_WRITES_ASYNC = exports.DEFAULT_SECURE_WRITES_ASYNC = false;
 function resolveNativeWriteBuffering(platform, secureWritesAsync = DEFAULT_SECURE_WRITES_ASYNC) {
   return {

package/lib/commonjs/capabilities.js.map

@@ -1 +1 @@
-{"version":3,"names":["resolveWebWriteBuffering","diskBackendName","secureBackendName","disk","isIndexedDBWebBackendByName","secure","backendName","startsWith","DEFAULT_SECURE_WRITES_ASYNC","exports","resolveNativeWriteBuffering","platform","secureWritesAsync"],"sourceRoot":"../../src","sources":["capabilities.ts"],"mappings":";;;;;;;;AAUO,SAASA,wBAAwBA,CACtCC,eAAmC,EACnCC,iBAAqC,EACrB;EAChB,OAAO;IACLC,IAAI,EAAEC,2BAA2B,CAACH,eAAe,CAAC;IAClDI,MAAM,EAAED,2BAA2B,CAACF,iBAAiB;EACvD,CAAC;AACH;AAEA,SAASE,2BAA2BA,CAACE,WAA+B,EAAW;EAC7E,IAAI,CAACA,WAAW,EAAE;IAChB,OAAO,KAAK;EACd;EACA,OAAOA,WAAW,CAACC,UAAU,CAAC,YAAY,CAAC;AAC7C;AAEO,MAAMC,2BAA2B,GAAAC,OAAA,CAAAD,2BAAA,GAAG,KAAK;AAEzC,SAASE,2BAA2BA,CACzCC,QAA2B,EAC3BC,iBAA0B,GAAGJ,2BAA2B,EACxC;EAChB,OAAO;IACLL,IAAI,EAAE,IAAI;IACVE,MAAM,EAAEM,QAAQ,KAAK,SAAS,GAAGC,iBAAiB,GAAG;EACvD,CAAC;AACH","ignoreList":[]}
+{"version":3,"names":["_webBackendContract","require","resolveWebWriteBuffering","diskBackendName","secureBackendName","disk","isIndexedDBBackendName","secure","DEFAULT_SECURE_WRITES_ASYNC","exports","resolveNativeWriteBuffering","platform","secureWritesAsync"],"sourceRoot":"../../src","sources":["capabilities.ts"],"mappings":";;;;;;;;AAAA,IAAAA,mBAAA,GAAAC,OAAA;AAYO,SAASC,wBAAwBA,CACtCC,eAAmC,EACnCC,iBAAqC,EACrB;EAChB,OAAO;IACLC,IAAI,EAAE,IAAAC,0CAAsB,EAACH,eAAe,CAAC;IAC7CI,MAAM,EAAE,IAAAD,0CAAsB,EAACF,iBAAiB;EAClD,CAAC;AACH;AAEO,MAAMI,2BAA2B,GAAAC,OAAA,CAAAD,2BAAA,GAAG,KAAK;AAEzC,SAASE,2BAA2BA,CACzCC,QAA2B,EAC3BC,iBAA0B,GAAGJ,2BAA2B,EACxC;EAChB,OAAO;IACLH,IAAI,EAAE,IAAI;IACVE,MAAM,EAAEI,QAAQ,KAAK,SAAS,GAAGC,iBAAiB,GAAG;EACvD,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/index.js

@@ -21,13 +21,14 @@ Object.defineProperty(exports, "StorageScope", {
     return _Storage.StorageScope;
   }
 });
-Object.defineProperty(exports, "createIndexedDBBackend", {
+exports.createStorageItem = exports.createSetItem = exports.createSecureAuthStorage = exports.createIndexedDBBackend = void 0;
+Object.defineProperty(exports, "describeWebBackendCapabilities", {
   enumerable: true,
   get: function () {
-    return _indexeddbBackend.createIndexedDBBackend;
+    return _webBackendContract.describeWebBackendCapabilities;
   }
 });
-exports.diskItem = exports.createStorageItem = exports.createSetItem = exports.createSecureAuthStorage = void 0;
+exports.diskItem = void 0;
 exports.flushWebStorageBackends = flushWebStorageBackends;
 exports.getBatch = void 0;
 Object.defineProperty(exports, "getStorageErrorCode", {
@@ -38,6 +39,12 @@ Object.defineProperty(exports, "getStorageErrorCode", {
 });
 exports.getWebDiskStorageBackend = getWebDiskStorageBackend;
 exports.getWebSecureStorageBackend = getWebSecureStorageBackend;
+Object.defineProperty(exports, "isIndexedDBWebBackend", {
+  enumerable: true,
+  get: function () {
+    return _webBackendContract.isIndexedDBWebBackend;
+  }
+});
 Object.defineProperty(exports, "isKeychainLockedError", {
   enumerable: true,
   get: function () {
@@ -94,14 +101,15 @@ Object.defineProperty(exports, "useStorageValue", {
 var _reactNative = require("react-native");
 var _reactNativeNitroModules = require("react-native-nitro-modules");
 var _capabilities = require("./capabilities");
+var _indexeddbBackend = require("./indexeddb-backend");
 var _internal = require("./internal");
 var _shared = require("./shared");
 var _storageCore = require("./storage-core");
 var _Storage = require("./Storage.types");
 var _migration = require("./migration");
 var _storageRuntime = require("./storage-runtime");
+var _webBackendContract = require("./web-backend-contract");
 var _storageHooks = require("./storage-hooks");
-var _indexeddbBackend = require("./indexeddb-backend");
 let _storageModule = null;
 function getStorageModule() {
   if (!_storageModule) {
@@ -197,6 +205,10 @@ function buildNativeAdapter(internals) {
         (0, _shared.notifyAllListeners)(internals.getScopedListeners(scope));
         return;
       }
+      if (consumeSuppressedNativeEvent(scope, key)) {
+        (0, _shared.notifyKeyListeners)(internals.getScopedListeners(scope), key);
+        return;
+      }
       const oldValue = scope === _Storage.StorageScope.Secure ? undefined : internals.readCachedRawValue(scope, key);
       if (scope === _Storage.StorageScope.Secure) {
         internals.invalidateRawCache(scope, key);
@@ -204,9 +216,6 @@ function buildNativeAdapter(internals) {
         internals.cacheRawValue(scope, key, value);
       }
       (0, _shared.notifyKeyListeners)(internals.getScopedListeners(scope), key);
-      if (consumeSuppressedNativeEvent(scope, key)) {
-        return;
-      }
       internals.emitKeyChange(scope, key, oldValue === undefined ? undefined : (0, _internal.unescapeCollidingRawValue)(oldValue), value === undefined ? undefined : (0, _internal.unescapeCollidingRawValue)(value), "external", "native");
     });
     scopedUnsubscribers.set(scope, typeof unsubscribe === "function" ? unsubscribe : () => {});
@@ -271,7 +280,7 @@ const storage = exports.storage = {
   getCapabilities: () => ({
     platform: "native",
     backend: {
-      disk: "platform-preferences",
+      disk: "sqlite",
       secure: nativeSecureBackend
     },
     writeBuffering: (0, _capabilities.resolveNativeWriteBuffering)(_reactNative.Platform.OS === "android" ? "android" : "ios", secureWritesBuffered),
@@ -326,4 +335,10 @@ function getWebDiskStorageBackend() {
 async function flushWebStorageBackends() {
   // Native platforms do not use web storage backends.
 }
+/**
+ * @deprecated Import `createIndexedDBBackend` from
+ * `react-native-nitro-storage/indexeddb-backend` instead. The root export
+ * will be removed in a future minor release.
+ */
+const createIndexedDBBackend = exports.createIndexedDBBackend = _indexeddbBackend.createIndexedDBBackend;
 //# sourceMappingURL=index.js.map