Implement Rust-owned Android Keystore secure storage (#93)

apple/Generated/ironstorage_mobile.swift

@@ -608,6 +608,433 @@ fileprivate struct FfiConverterData: FfiConverterRustBuffer {
 
 
 
+public protocol MobileAndroidKeystore: AnyObject, Sendable {
+
+    func deviceState() throws  -> MobileAndroidDeviceState
+
+    func createKey(specification: MobileAndroidKeySpecification) throws
+
+    func encrypt(alias: String, authorization: MobileAndroidAuthorization, aad: Data, value: Data) throws  -> MobileAndroidCiphertext
+
+    func decrypt(alias: String, authorization: MobileAndroidAuthorization, aad: Data, value: MobileAndroidCiphertext) throws  -> Data
+
+    func deleteKey(alias: String) throws
+
+    func aliases() throws  -> [String]
+
+    func cancelPending()
+
+}
+open class MobileAndroidKeystoreImpl: MobileAndroidKeystore, @unchecked Sendable {
+    fileprivate let handle: UInt64
+
+    /// Used to instantiate a [FFIObject] without an actual handle, for fakes in tests, mostly.
+#if swift(>=5.8)
+    @_documentation(visibility: private)
+#endif
+    public struct NoHandle {
+        public init() {}
+    }
+
+    // TODO: We'd like this to be `private` but for Swifty reasons,
+    // we can't implement `FfiConverter` without making this `required` and we can't
+    // make it `required` without making it `public`.
+#if swift(>=5.8)
+    @_documentation(visibility: private)
+#endif
+    required public init(unsafeFromHandle handle: UInt64) {
+        self.handle = handle
+    }
+
+    // This constructor can be used to instantiate a fake object.
+    // - Parameter noHandle: Placeholder value so we can have a constructor separate from the default empty one that may be implemented for classes extending [FFIObject].
+    //
+    // - Warning:
+    //     Any object instantiated with this constructor cannot be passed to an actual Rust-backed object. Since there isn't a backing handle the FFI lower functions will crash.
+#if swift(>=5.8)
+    @_documentation(visibility: private)
+#endif
+    public init(noHandle: NoHandle) {
+        self.handle = 0
+    }
+
+#if swift(>=5.8)
+    @_documentation(visibility: private)
+#endif
+    public func uniffiCloneHandle() -> UInt64 {
+        return try! rustCall { uniffi_ironstorage_mobile_fn_clone_mobileandroidkeystore(self.handle, $0) }
+    }
+    // No primary constructor declared for this class.
+
+    deinit {
+        if handle == 0 {
+            // Mock objects have handle=0 don't try to free them
+            return
+        }
+
+        try! rustCall { uniffi_ironstorage_mobile_fn_free_mobileandroidkeystore(handle, $0) }
+    }
+
+
+
+
+open func deviceState()throws  -> MobileAndroidDeviceState  {
+    return try  FfiConverterTypeMobileAndroidDeviceState_lift(try rustCallWithError(FfiConverterTypeMobileAndroidKeystoreError_lift) {
+        uniffiCallStatus in
+    uniffi_ironstorage_mobile_fn_method_mobileandroidkeystore_device_state(
+            self.uniffiCloneHandle(),uniffiCallStatus
+    )
+})
+}
+
+open func createKey(specification: MobileAndroidKeySpecification)throws   {try rustCallWithError(FfiConverterTypeMobileAndroidKeystoreError_lift) {
+        uniffiCallStatus in
+    uniffi_ironstorage_mobile_fn_method_mobileandroidkeystore_create_key(
+            self.uniffiCloneHandle(),
+        FfiConverterTypeMobileAndroidKeySpecification_lower(specification),uniffiCallStatus
+    )
+}
+}
+
+open func encrypt(alias: String, authorization: MobileAndroidAuthorization, aad: Data, value: Data)throws  -> MobileAndroidCiphertext  {
+    return try  FfiConverterTypeMobileAndroidCiphertext_lift(try rustCallWithError(FfiConverterTypeMobileAndroidKeystoreError_lift) {
+        uniffiCallStatus in
+    uniffi_ironstorage_mobile_fn_method_mobileandroidkeystore_encrypt(
+            self.uniffiCloneHandle(),
+        FfiConverterString.lower(alias),
+        FfiConverterTypeMobileAndroidAuthorization_lower(authorization),
+        FfiConverterData.lower(aad),
+        FfiConverterData.lower(value),uniffiCallStatus
+    )
+})
+}
+
+open func decrypt(alias: String, authorization: MobileAndroidAuthorization, aad: Data, value: MobileAndroidCiphertext)throws  -> Data  {
+    return try  FfiConverterData.lift(try rustCallWithError(FfiConverterTypeMobileAndroidKeystoreError_lift) {
+        uniffiCallStatus in
+    uniffi_ironstorage_mobile_fn_method_mobileandroidkeystore_decrypt(
+            self.uniffiCloneHandle(),
+        FfiConverterString.lower(alias),
+        FfiConverterTypeMobileAndroidAuthorization_lower(authorization),
+        FfiConverterData.lower(aad),
+        FfiConverterTypeMobileAndroidCiphertext_lower(value),uniffiCallStatus
+    )
+})
+}
+
+open func deleteKey(alias: String)throws   {try rustCallWithError(FfiConverterTypeMobileAndroidKeystoreError_lift) {
+        uniffiCallStatus in
+    uniffi_ironstorage_mobile_fn_method_mobileandroidkeystore_delete_key(
+            self.uniffiCloneHandle(),
+        FfiConverterString.lower(alias),uniffiCallStatus
+    )
+}
+}
+
+open func aliases()throws  -> [String]  {
+    return try  FfiConverterSequenceString.lift(try rustCallWithError(FfiConverterTypeMobileAndroidKeystoreError_lift) {
+        uniffiCallStatus in
+    uniffi_ironstorage_mobile_fn_method_mobileandroidkeystore_aliases(
+            self.uniffiCloneHandle(),uniffiCallStatus
+    )
+})
+}
+
+open func cancelPending()  {try! rustCall() {
+        uniffiCallStatus in
+    uniffi_ironstorage_mobile_fn_method_mobileandroidkeystore_cancel_pending(
+            self.uniffiCloneHandle(),uniffiCallStatus
+    )
+}
+}
+
+
+
+}
+
+
+
+// Put the implementation in a struct so we don't pollute the top-level namespace
+fileprivate struct UniffiCallbackInterfaceMobileAndroidKeystore {
+
+    // Create the VTable using a series of closures.
+    // Swift automatically converts these into C callback functions.
+    //
+    // Store the vtable directly.
+    static let vtable: UniffiVTableCallbackInterfaceMobileAndroidKeystore = UniffiVTableCallbackInterfaceMobileAndroidKeystore(
+        uniffiFree: { (uniffiHandle: UInt64) -> () in
+            do {
+                try FfiConverterTypeMobileAndroidKeystore.handleMap.remove(handle: uniffiHandle)
+            } catch {
+                print("Uniffi callback interface MobileAndroidKeystore: handle missing in uniffiFree")
+            }
+        },
+        uniffiClone: { (uniffiHandle: UInt64) -> UInt64 in
+            do {
+                return try FfiConverterTypeMobileAndroidKeystore.handleMap.clone(handle: uniffiHandle)
+            } catch {
+                fatalError("Uniffi callback interface MobileAndroidKeystore: handle missing in uniffiClone")
+            }
+        },
+        deviceState: { (
+            uniffiHandle: UInt64,
+            uniffiOutReturn: UnsafeMutablePointer<RustBuffer>,
+            uniffiCallStatus: UnsafeMutablePointer<RustCallStatus>
+        ) in
+            let makeCall = {
+                () throws -> MobileAndroidDeviceState in
+                guard let uniffiObj = try? FfiConverterTypeMobileAndroidKeystore.handleMap.get(handle: uniffiHandle) else {
+                    throw UniffiInternalError.unexpectedStaleHandle
+                }
+                return try uniffiObj.deviceState(
+                )
+            }
+
+
+            let writeReturn = { uniffiOutReturn.pointee = FfiConverterTypeMobileAndroidDeviceState_lower($0) }
+            uniffiTraitInterfaceCallWithError(
+                callStatus: uniffiCallStatus,
+                makeCall: makeCall,
+                writeReturn: writeReturn,
+                lowerError: FfiConverterTypeMobileAndroidKeystoreError_lower
+            )
+        },
+        createKey: { (
+            uniffiHandle: UInt64,
+            specification: RustBuffer,
+            uniffiOutReturn: UnsafeMutableRawPointer,
+            uniffiCallStatus: UnsafeMutablePointer<RustCallStatus>
+        ) in
+            let makeCall = {
+                () throws -> () in
+                guard let uniffiObj = try? FfiConverterTypeMobileAndroidKeystore.handleMap.get(handle: uniffiHandle) else {
+                    throw UniffiInternalError.unexpectedStaleHandle
+                }
+                return try uniffiObj.createKey(
+                     specification: try FfiConverterTypeMobileAndroidKeySpecification_lift(specification)
+                )
+            }
+
+
+            let writeReturn = { () }
+            uniffiTraitInterfaceCallWithError(
+                callStatus: uniffiCallStatus,
+                makeCall: makeCall,
+                writeReturn: writeReturn,
+                lowerError: FfiConverterTypeMobileAndroidKeystoreError_lower
+            )
+        },
+        encrypt: { (
+            uniffiHandle: UInt64,
+            alias: RustBuffer,
+            authorization: RustBuffer,
+            aad: RustBuffer,
+            value: RustBuffer,
+            uniffiOutReturn: UnsafeMutablePointer<RustBuffer>,
+            uniffiCallStatus: UnsafeMutablePointer<RustCallStatus>
+        ) in
+            let makeCall = {
+                () throws -> MobileAndroidCiphertext in
+                guard let uniffiObj = try? FfiConverterTypeMobileAndroidKeystore.handleMap.get(handle: uniffiHandle) else {
+                    throw UniffiInternalError.unexpectedStaleHandle
+                }
+                return try uniffiObj.encrypt(
+                     alias: try FfiConverterString.lift(alias),
+                     authorization: try FfiConverterTypeMobileAndroidAuthorization_lift(authorization),
+                     aad: try FfiConverterData.lift(aad),
+                     value: try FfiConverterData.lift(value)
+                )
+            }
+
+
+            let writeReturn = { uniffiOutReturn.pointee = FfiConverterTypeMobileAndroidCiphertext_lower($0) }
+            uniffiTraitInterfaceCallWithError(
+                callStatus: uniffiCallStatus,
+                makeCall: makeCall,
+                writeReturn: writeReturn,
+                lowerError: FfiConverterTypeMobileAndroidKeystoreError_lower
+            )
+        },
+        decrypt: { (
+            uniffiHandle: UInt64,
+            alias: RustBuffer,
+            authorization: RustBuffer,
+            aad: RustBuffer,
+            value: RustBuffer,
+            uniffiOutReturn: UnsafeMutablePointer<RustBuffer>,
+            uniffiCallStatus: UnsafeMutablePointer<RustCallStatus>
+        ) in
+            let makeCall = {
+                () throws -> Data in
+                guard let uniffiObj = try? FfiConverterTypeMobileAndroidKeystore.handleMap.get(handle: uniffiHandle) else {
+                    throw UniffiInternalError.unexpectedStaleHandle
+                }
+                return try uniffiObj.decrypt(
+                     alias: try FfiConverterString.lift(alias),
+                     authorization: try FfiConverterTypeMobileAndroidAuthorization_lift(authorization),
+                     aad: try FfiConverterData.lift(aad),
+                     value: try FfiConverterTypeMobileAndroidCiphertext_lift(value)
+                )
+            }
+
+
+            let writeReturn = { uniffiOutReturn.pointee = FfiConverterData.lower($0) }
+            uniffiTraitInterfaceCallWithError(
+                callStatus: uniffiCallStatus,
+                makeCall: makeCall,
+                writeReturn: writeReturn,
+                lowerError: FfiConverterTypeMobileAndroidKeystoreError_lower
+            )
+        },
+        deleteKey: { (
+            uniffiHandle: UInt64,
+            alias: RustBuffer,
+            uniffiOutReturn: UnsafeMutableRawPointer,
+            uniffiCallStatus: UnsafeMutablePointer<RustCallStatus>
+        ) in
+            let makeCall = {
+                () throws -> () in
+                guard let uniffiObj = try? FfiConverterTypeMobileAndroidKeystore.handleMap.get(handle: uniffiHandle) else {
+                    throw UniffiInternalError.unexpectedStaleHandle
+                }
+                return try uniffiObj.deleteKey(
+                     alias: try FfiConverterString.lift(alias)
+                )
+            }
+
+
+            let writeReturn = { () }
+            uniffiTraitInterfaceCallWithError(
+                callStatus: uniffiCallStatus,
+                makeCall: makeCall,
+                writeReturn: writeReturn,
+                lowerError: FfiConverterTypeMobileAndroidKeystoreError_lower
+            )
+        },
+        aliases: { (
+            uniffiHandle: UInt64,
+            uniffiOutReturn: UnsafeMutablePointer<RustBuffer>,
+            uniffiCallStatus: UnsafeMutablePointer<RustCallStatus>
+        ) in
+            let makeCall = {
+                () throws -> [String] in
+                guard let uniffiObj = try? FfiConverterTypeMobileAndroidKeystore.handleMap.get(handle: uniffiHandle) else {
+                    throw UniffiInternalError.unexpectedStaleHandle
+                }
+                return try uniffiObj.aliases(
+                )
+            }
+
+
+            let writeReturn = { uniffiOutReturn.pointee = FfiConverterSequenceString.lower($0) }
+            uniffiTraitInterfaceCallWithError(
+                callStatus: uniffiCallStatus,
+                makeCall: makeCall,
+                writeReturn: writeReturn,
+                lowerError: FfiConverterTypeMobileAndroidKeystoreError_lower
+            )
+        },
+        cancelPending: { (
+            uniffiHandle: UInt64,
+            uniffiOutReturn: UnsafeMutableRawPointer,
+            uniffiCallStatus: UnsafeMutablePointer<RustCallStatus>
+        ) in
+            let makeCall = {
+                () throws -> () in
+                guard let uniffiObj = try? FfiConverterTypeMobileAndroidKeystore.handleMap.get(handle: uniffiHandle) else {
+                    throw UniffiInternalError.unexpectedStaleHandle
+                }
+                return uniffiObj.cancelPending(
+                )
+            }
+
+
+            let writeReturn = { () }
+            uniffiTraitInterfaceCall(
+                callStatus: uniffiCallStatus,
+                makeCall: makeCall,
+                writeReturn: writeReturn
+            )
+        }
+    )
+
+    // Rust stores this pointer for future callback invocations, so it must live
+    // for the process lifetime (not just for the init function call).
+    //
+    // `nonisolated(unsafe)` is needed under Swift 6 strict concurrency.
+    // This is safe because the pointee is initialized once during static init
+    // and never mutated by either side of the FFI.  Its fields are C function pointers.
+    nonisolated(unsafe) static let vtablePtr: UnsafePointer<UniffiVTableCallbackInterfaceMobileAndroidKeystore> = {
+        let ptr = UnsafeMutablePointer<UniffiVTableCallbackInterfaceMobileAndroidKeystore>.allocate(capacity: 1)
+        ptr.initialize(to: vtable)
+        return UnsafePointer(ptr)
+    }()
+}
+
+private func uniffiCallbackInitMobileAndroidKeystore() {
+    uniffi_ironstorage_mobile_fn_init_callback_vtable_mobileandroidkeystore(UniffiCallbackInterfaceMobileAndroidKeystore.vtablePtr)
+}
+
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+public struct FfiConverterTypeMobileAndroidKeystore: FfiConverter {
+    fileprivate static let handleMap = UniffiHandleMap<MobileAndroidKeystore>()
+
+    typealias FfiType = UInt64
+    typealias SwiftType = MobileAndroidKeystore
+
+    public static func lift(_ handle: UInt64) throws -> MobileAndroidKeystore {
+        if ((handle & 1) == 0) {
+            // Rust-generated handle, construct a new class that uses the handle to implement the
+            // interface
+            return MobileAndroidKeystoreImpl(unsafeFromHandle: handle)
+        } else {
+            // Swift-generated handle, get the object from the handle map
+            return try handleMap.remove(handle: handle)
+        }
+    }
+
+    public static func lower(_ value: MobileAndroidKeystore) -> UInt64 {
+         if let rustImpl = value as? MobileAndroidKeystoreImpl {
+             // Rust-implemented object.  Clone the handle and return it
+            return rustImpl.uniffiCloneHandle()
+         } else {
+            // Swift object, generate a new vtable handle and return that.
+            return handleMap.insert(obj: value)
+         }
+    }
+
+    public static func read(from buf: inout (data: Data, offset: Data.Index)) throws -> MobileAndroidKeystore {
+        let handle: UInt64 = try readInt(&buf)
+        return try lift(handle)
+    }
+
+    public static func write(_ value: MobileAndroidKeystore, into buf: inout [UInt8]) {
+        writeInt(&buf, lower(value))
+    }
+}
+
+
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+public func FfiConverterTypeMobileAndroidKeystore_lift(_ handle: UInt64) throws -> MobileAndroidKeystore {
+    return try FfiConverterTypeMobileAndroidKeystore.lift(handle)
+}
+
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+public func FfiConverterTypeMobileAndroidKeystore_lower(_ value: MobileAndroidKeystore) -> UInt64 {
+    return FfiConverterTypeMobileAndroidKeystore.lower(value)
+}
+
+
+
+
+
+
 public protocol MobileAuthenticationProtocol: AnyObject, Sendable {
 
     func acknowledgeWatchSnapshot(receipt: Data) throws  -> MobileWatchSnapshotStatus
@@ -2528,6 +2955,8 @@ public protocol MobilePrivateRuntimeProtocol: AnyObject, Sendable {
 
     func activate() throws
 
+    func androidSecretBackend(keystore: MobileAndroidKeystore) throws  -> MobileSecretBackend
+
     func authentication(backend: MobileSecretBackend, clock: MobileClock) throws  -> MobileAuthentication
 
     func clearDisposableCache() throws
@@ -2602,6 +3031,16 @@ open func activate()throws   {try rustCallWithError(FfiConverterTypeMobilePrivat
 }
 }
 
+open func androidSecretBackend(keystore: MobileAndroidKeystore)throws  -> MobileSecretBackend  {
+    return try  FfiConverterTypeMobileSecretBackend_lift(try rustCallWithError(FfiConverterTypeMobilePrivateStorageFfiError_lift) {
+        uniffiCallStatus in
+    uniffi_ironstorage_mobile_fn_method_mobileprivateruntime_android_secret_backend(
+            self.uniffiCloneHandle(),
+        FfiConverterTypeMobileAndroidKeystore_lower(keystore),uniffiCallStatus
+    )
+})
+}
+
 open func authentication(backend: MobileSecretBackend, clock: MobileClock)throws  -> MobileAuthentication  {
     return try  FfiConverterTypeMobileAuthentication_lift(try rustCallWithError(FfiConverterTypeMobileAuthenticationFfiError_lift) {
         uniffiCallStatus in
@@ -3230,6 +3669,192 @@ public func FfiConverterTypeMobileTotpOperation_lower(_ value: MobileTotpOperati
 
 
 
+public struct MobileAndroidCiphertext: Equatable, Hashable {
+    public var nonce: Data
+    public var bytes: Data
+
+    // Default memberwise initializers are never public by default, so we
+    // declare one manually.
+    public init(nonce: Data, bytes: Data) {
+        self.nonce = nonce
+        self.bytes = bytes
+    }
+
+
+
+
+}
+
+#if compiler(>=6)
+extension MobileAndroidCiphertext: Sendable {}
+#endif
+
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+public struct FfiConverterTypeMobileAndroidCiphertext: FfiConverterRustBuffer {
+    public static func read(from buf: inout (data: Data, offset: Data.Index)) throws -> MobileAndroidCiphertext {
+        return
+            try MobileAndroidCiphertext(
+                nonce: FfiConverterData.read(from: &buf),
+                bytes: FfiConverterData.read(from: &buf)
+        )
+    }
+
+    public static func write(_ value: MobileAndroidCiphertext, into buf: inout [UInt8]) {
+        FfiConverterData.write(value.nonce, into: &buf)
+        FfiConverterData.write(value.bytes, into: &buf)
+    }
+}
+
+
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+public func FfiConverterTypeMobileAndroidCiphertext_lift(_ buf: RustBuffer) throws -> MobileAndroidCiphertext {
+    return try FfiConverterTypeMobileAndroidCiphertext.lift(buf)
+}
+
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+public func FfiConverterTypeMobileAndroidCiphertext_lower(_ value: MobileAndroidCiphertext) -> RustBuffer {
+    return FfiConverterTypeMobileAndroidCiphertext.lower(value)
+}
+
+
+public struct MobileAndroidDeviceState: Equatable, Hashable {
+    public var api: UInt32
+    public var locked: Bool
+    public var secure: Bool
+    public var strongBiometric: Bool
+    public var strongbox: Bool
+
+    // Default memberwise initializers are never public by default, so we
+    // declare one manually.
+    public init(api: UInt32, locked: Bool, secure: Bool, strongBiometric: Bool, strongbox: Bool) {
+        self.api = api
+        self.locked = locked
+        self.secure = secure
+        self.strongBiometric = strongBiometric
+        self.strongbox = strongbox
+    }
+
+
+
+
+}
+
+#if compiler(>=6)
+extension MobileAndroidDeviceState: Sendable {}
+#endif
+
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+public struct FfiConverterTypeMobileAndroidDeviceState: FfiConverterRustBuffer {
+    public static func read(from buf: inout (data: Data, offset: Data.Index)) throws -> MobileAndroidDeviceState {
+        return
+            try MobileAndroidDeviceState(
+                api: FfiConverterUInt32.read(from: &buf),
+                locked: FfiConverterBool.read(from: &buf),
+                secure: FfiConverterBool.read(from: &buf),
+                strongBiometric: FfiConverterBool.read(from: &buf),
+                strongbox: FfiConverterBool.read(from: &buf)
+        )
+    }
+
+    public static func write(_ value: MobileAndroidDeviceState, into buf: inout [UInt8]) {
+        FfiConverterUInt32.write(value.api, into: &buf)
+        FfiConverterBool.write(value.locked, into: &buf)
+        FfiConverterBool.write(value.secure, into: &buf)
+        FfiConverterBool.write(value.strongBiometric, into: &buf)
+        FfiConverterBool.write(value.strongbox, into: &buf)
+    }
+}
+
+
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+public func FfiConverterTypeMobileAndroidDeviceState_lift(_ buf: RustBuffer) throws -> MobileAndroidDeviceState {
+    return try FfiConverterTypeMobileAndroidDeviceState.lift(buf)
+}
+
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+public func FfiConverterTypeMobileAndroidDeviceState_lower(_ value: MobileAndroidDeviceState) -> RustBuffer {
+    return FfiConverterTypeMobileAndroidDeviceState.lower(value)
+}
+
+
+public struct MobileAndroidKeySpecification: Equatable, Hashable {
+    public var alias: String
+    public var authorization: MobileAndroidAuthorization
+    public var unlockedDevice: Bool
+    public var invalidateOnEnrollment: Bool
+    public var strongbox: Bool
+
+    // Default memberwise initializers are never public by default, so we
+    // declare one manually.
+    public init(alias: String, authorization: MobileAndroidAuthorization, unlockedDevice: Bool, invalidateOnEnrollment: Bool, strongbox: Bool) {
+        self.alias = alias
+        self.authorization = authorization
+        self.unlockedDevice = unlockedDevice
+        self.invalidateOnEnrollment = invalidateOnEnrollment
+        self.strongbox = strongbox
+    }
+
+
+
+
+}
+
+#if compiler(>=6)
+extension MobileAndroidKeySpecification: Sendable {}
+#endif
+
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+public struct FfiConverterTypeMobileAndroidKeySpecification: FfiConverterRustBuffer {
+    public static func read(from buf: inout (data: Data, offset: Data.Index)) throws -> MobileAndroidKeySpecification {
+        return
+            try MobileAndroidKeySpecification(
+                alias: FfiConverterString.read(from: &buf),
+                authorization: FfiConverterTypeMobileAndroidAuthorization.read(from: &buf),
+                unlockedDevice: FfiConverterBool.read(from: &buf),
+                invalidateOnEnrollment: FfiConverterBool.read(from: &buf),
+                strongbox: FfiConverterBool.read(from: &buf)
+        )
+    }
+
+    public static func write(_ value: MobileAndroidKeySpecification, into buf: inout [UInt8]) {
+        FfiConverterString.write(value.alias, into: &buf)
+        FfiConverterTypeMobileAndroidAuthorization.write(value.authorization, into: &buf)
+        FfiConverterBool.write(value.unlockedDevice, into: &buf)
+        FfiConverterBool.write(value.invalidateOnEnrollment, into: &buf)
+        FfiConverterBool.write(value.strongbox, into: &buf)
+    }
+}
+
+
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+public func FfiConverterTypeMobileAndroidKeySpecification_lift(_ buf: RustBuffer) throws -> MobileAndroidKeySpecification {
+    return try FfiConverterTypeMobileAndroidKeySpecification.lift(buf)
+}
+
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+public func FfiConverterTypeMobileAndroidKeySpecification_lower(_ value: MobileAndroidKeySpecification) -> RustBuffer {
+    return FfiConverterTypeMobileAndroidKeySpecification.lower(value)
+}
+
+
 public struct MobileAuthenticationState: Equatable, Hashable {
     public var unlocked: Bool
     public var biometricUnlockEnabled: Bool
@@ -6359,6 +6984,210 @@ public func FfiConverterTypeMobileWatchSnapshotTransfer_lower(_ value: MobileWat
 
 
 
+public enum MobileAndroidAuthorization: Equatable, Hashable {
+
+    case none
+    case strongBiometric
+    case userPresence
+
+
+
+
+
+}
+
+#if compiler(>=6)
+extension MobileAndroidAuthorization: Sendable {}
+#endif
+
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+public struct FfiConverterTypeMobileAndroidAuthorization: FfiConverterRustBuffer {
+    typealias SwiftType = MobileAndroidAuthorization
+
+    public static func read(from buf: inout (data: Data, offset: Data.Index)) throws -> MobileAndroidAuthorization {
+        let variant: Int32 = try readInt(&buf)
+        switch variant {
+
+        case 1: return .none
+
+        case 2: return .strongBiometric
+
+        case 3: return .userPresence
+
+        default: throw UniffiInternalError.unexpectedEnumCase
+        }
+    }
+
+    public static func write(_ value: MobileAndroidAuthorization, into buf: inout [UInt8]) {
+        switch value {
+
+
+        case .none:
+            writeInt(&buf, Int32(1))
+
+
+        case .strongBiometric:
+            writeInt(&buf, Int32(2))
+
+
+        case .userPresence:
+            writeInt(&buf, Int32(3))
+
+        }
+    }
+}
+
+
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+public func FfiConverterTypeMobileAndroidAuthorization_lift(_ buf: RustBuffer) throws -> MobileAndroidAuthorization {
+    return try FfiConverterTypeMobileAndroidAuthorization.lift(buf)
+}
+
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+public func FfiConverterTypeMobileAndroidAuthorization_lower(_ value: MobileAndroidAuthorization) -> RustBuffer {
+    return FfiConverterTypeMobileAndroidAuthorization.lower(value)
+}
+
+
+
+public
+enum MobileAndroidKeystoreError: Swift.Error, Equatable, Hashable, Foundation.LocalizedError {
+
+
+
+    case MissingKey
+    case Invalidated
+    case Lockout
+    case Locked
+    case Denied
+    case Cancelled
+    case Corrupted
+    case UnsupportedProtection
+    case StrongboxUnavailable
+    case AlreadyExists
+    case Unavailable
+
+
+
+
+
+
+    public var errorDescription: String? {
+        String(reflecting: self)
+    }
+
+}
+
+#if compiler(>=6)
+extension MobileAndroidKeystoreError: Sendable {}
+#endif
+
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+public struct FfiConverterTypeMobileAndroidKeystoreError: FfiConverterRustBuffer {
+    typealias SwiftType = MobileAndroidKeystoreError
+
+    public static func read(from buf: inout (data: Data, offset: Data.Index)) throws -> MobileAndroidKeystoreError {
+        let variant: Int32 = try readInt(&buf)
+        switch variant {
+
+
+
+
+        case 1: return .MissingKey
+        case 2: return .Invalidated
+        case 3: return .Lockout
+        case 4: return .Locked
+        case 5: return .Denied
+        case 6: return .Cancelled
+        case 7: return .Corrupted
+        case 8: return .UnsupportedProtection
+        case 9: return .StrongboxUnavailable
+        case 10: return .AlreadyExists
+        case 11: return .Unavailable
+
+         default: throw UniffiInternalError.unexpectedEnumCase
+        }
+    }
+
+    public static func write(_ value: MobileAndroidKeystoreError, into buf: inout [UInt8]) {
+        switch value {
+
+
+
+
+
+        case .MissingKey:
+            writeInt(&buf, Int32(1))
+
+
+        case .Invalidated:
+            writeInt(&buf, Int32(2))
+
+
+        case .Lockout:
+            writeInt(&buf, Int32(3))
+
+
+        case .Locked:
+            writeInt(&buf, Int32(4))
+
+
+        case .Denied:
+            writeInt(&buf, Int32(5))
+
+
+        case .Cancelled:
+            writeInt(&buf, Int32(6))
+
+
+        case .Corrupted:
+            writeInt(&buf, Int32(7))
+
+
+        case .UnsupportedProtection:
+            writeInt(&buf, Int32(8))
+
+
+        case .StrongboxUnavailable:
+            writeInt(&buf, Int32(9))
+
+
+        case .AlreadyExists:
+            writeInt(&buf, Int32(10))
+
+
+        case .Unavailable:
+            writeInt(&buf, Int32(11))
+
+        }
+    }
+}
+
+
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+public func FfiConverterTypeMobileAndroidKeystoreError_lift(_ buf: RustBuffer) throws -> MobileAndroidKeystoreError {
+    return try FfiConverterTypeMobileAndroidKeystoreError.lift(buf)
+}
+
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+public func FfiConverterTypeMobileAndroidKeystoreError_lower(_ value: MobileAndroidKeystoreError) -> RustBuffer {
+    return FfiConverterTypeMobileAndroidKeystoreError.lower(value)
+}
+
+
+
 public enum MobileAppearance: Equatable, Hashable {
 
     case system
@@ -9165,6 +9994,9 @@ enum MobileSecretError: Swift.Error, Equatable, Hashable, Foundation.LocalizedEr
     case Corrupted
     case UnsupportedProtection
     case Unavailable
+    case DeviceKeyMissing
+    case Invalidated
+    case Lockout
 
 
 
@@ -9202,6 +10034,9 @@ public struct FfiConverterTypeMobileSecretError: FfiConverterRustBuffer {
         case 6: return .Corrupted
         case 7: return .UnsupportedProtection
         case 8: return .Unavailable
+        case 9: return .DeviceKeyMissing
+        case 10: return .Invalidated
+        case 11: return .Lockout
 
          default: throw UniffiInternalError.unexpectedEnumCase
         }
@@ -9245,6 +10080,18 @@ public struct FfiConverterTypeMobileSecretError: FfiConverterRustBuffer {
         case .Unavailable:
             writeInt(&buf, Int32(8))
 
+
+        case .DeviceKeyMissing:
+            writeInt(&buf, Int32(9))
+
+
+        case .Invalidated:
+            writeInt(&buf, Int32(10))
+
+
+        case .Lockout:
+            writeInt(&buf, Int32(11))
+
         }
     }
 }
@@ -10974,6 +11821,27 @@ private let initializationResult: InitializationResult = {
     if (uniffi_ironstorage_mobile_checksum_method_mobiletotpoperation_progress() != 30340) {
         return InitializationResult.apiChecksumMismatch
     }
+    if (uniffi_ironstorage_mobile_checksum_method_mobileandroidkeystore_device_state() != 19346) {
+        return InitializationResult.apiChecksumMismatch
+    }
+    if (uniffi_ironstorage_mobile_checksum_method_mobileandroidkeystore_create_key() != 7937) {
+        return InitializationResult.apiChecksumMismatch
+    }
+    if (uniffi_ironstorage_mobile_checksum_method_mobileandroidkeystore_encrypt() != 65449) {
+        return InitializationResult.apiChecksumMismatch
+    }
+    if (uniffi_ironstorage_mobile_checksum_method_mobileandroidkeystore_decrypt() != 39727) {
+        return InitializationResult.apiChecksumMismatch
+    }
+    if (uniffi_ironstorage_mobile_checksum_method_mobileandroidkeystore_delete_key() != 20162) {
+        return InitializationResult.apiChecksumMismatch
+    }
+    if (uniffi_ironstorage_mobile_checksum_method_mobileandroidkeystore_aliases() != 16519) {
+        return InitializationResult.apiChecksumMismatch
+    }
+    if (uniffi_ironstorage_mobile_checksum_method_mobileandroidkeystore_cancel_pending() != 39774) {
+        return InitializationResult.apiChecksumMismatch
+    }
     if (uniffi_ironstorage_mobile_checksum_method_mobileclipboard_read() != 47092) {
         return InitializationResult.apiChecksumMismatch
     }
@@ -11010,6 +11878,9 @@ private let initializationResult: InitializationResult = {
     if (uniffi_ironstorage_mobile_checksum_method_mobileprivateruntime_activate() != 64835) {
         return InitializationResult.apiChecksumMismatch
     }
+    if (uniffi_ironstorage_mobile_checksum_method_mobileprivateruntime_android_secret_backend() != 24373) {
+        return InitializationResult.apiChecksumMismatch
+    }
     if (uniffi_ironstorage_mobile_checksum_method_mobileprivateruntime_authentication() != 21237) {
         return InitializationResult.apiChecksumMismatch
     }
@@ -11029,6 +11900,7 @@ private let initializationResult: InitializationResult = {
         return InitializationResult.apiChecksumMismatch
     }
 
+    uniffiCallbackInitMobileAndroidKeystore()
     uniffiCallbackInitMobileClipboard()
     uniffiCallbackInitMobileClock()
     uniffiCallbackInitMobileSecretBackend()
@@ -11050,6 +11922,22 @@ public func uniffiEnsureIronstorageMobileInitialized() {
 
 // swiftlint:enable all
 // IronStorage diagnostic redaction; wire values and checksums remain generated.
+extension MobileAndroidCiphertext: CustomStringConvertible, CustomDebugStringConvertible {
+    public var description: String { "MobileAndroidCiphertext([REDACTED])" }
+    public var debugDescription: String { description }
+}
+extension MobileAndroidDeviceState: CustomStringConvertible, CustomDebugStringConvertible {
+    public var description: String { "MobileAndroidDeviceState([REDACTED])" }
+    public var debugDescription: String { description }
+}
+extension MobileAndroidKeySpecification: CustomStringConvertible, CustomDebugStringConvertible {
+    public var description: String { "MobileAndroidKeySpecification([REDACTED])" }
+    public var debugDescription: String { description }
+}
+extension MobileAndroidKeystoreError: CustomStringConvertible, CustomDebugStringConvertible {
+    public var description: String { "MobileAndroidKeystoreError([REDACTED])" }
+    public var debugDescription: String { description }
+}
 extension MobileAuthenticationFfiError: CustomStringConvertible, CustomDebugStringConvertible {
     public var description: String { "MobileAuthenticationFfiError([REDACTED])" }
     public var debugDescription: String { description }