zally_flutter_sdk 1.2.0

Continuous Authentication for Flutter. Wraps the native zally iOS and Android SDKs behind one Dart API.

1.2.0 - 2026-10-19

1.1.1 - 2026-09-21

1.1.0 - 2026-09-19

1.0.2 - 2026-09-18

1.0.1 - 2026-09-17

1.0.0 - 2026-09-17

Unreleased

Added

• Optional baseUrl on initialize(), for pointing the SDK at a non production zally stack. Supported only by the internal edition of this package; the published package throws ZallyException with E_UNSUPPORTED_EDITION. The public native SDKs do not carry the API it needs, on either platform.
• An internal edition, selected at build time. Android swaps a source set and resolves com.zally:zally-sdk-internal from GitHub Packages when zallySdkEdition=internal; iOS compiles the path in under ZALLY_INTERNAL_EDITION=1. This replaces vendoring a fork of this package, which is what internal apps were doing.
• Release automation. release.yml tags and registers the artifact, pub-publish.yml publishes to pub.dev from the tag push behind an environment approval.
• CODEOWNERS, Renovate, Dependabot and a SonarCloud configuration.

Fixed

• .pubignore excluded neither coverage/ nor build output. Because a .pubignore replaces .gitignore entirely, a release cut from a CI working tree would have shipped the coverage report inside the published archive.

1.0.0-beta.1

First working release. The previous 1.0.0 entry described a prototype whose native bridges did not compile against any current zally SDK and which was never published. Treat this as the starting point.

Breaking

• Package renamed from zally_sdk to zally_flutter_sdk. The old name collides with the native iOS SDK: CocoaPods and Swift Package Manager both derive the module name zally_sdk for it, and two modules of one name cannot coexist in a build.
• ZallySdk is now an instance, reached through ZallySdk.instance, instead of a class of static methods. Static methods could not be faked in a consumer's tests.
• initialize takes named arguments instead of a ZallyInitializeOptions object, which is now removed.
• UserState.trainingState and UserState.zIdStatus are the enums TrainingState and ZIdStatus rather than bare strings. The raw native strings remain available on trainingStateRaw and zIdStatusRaw.

Fixed

• The client token is no longer captured once and reused forever. The native SDK now asks Dart for a fresh token every time it needs one, so recovery keeps working after a refresh token expires. Previously the SDK received one constant string and authentication died silently at the first expiry.
• The iOS bridge reports failure. initialize, start and stop previously returned success unconditionally, so an authorization failure was indistinguishable from a working SDK.
• iOS getUserState returns the native values. It previously synthesised them from a free-text status string, which made the IMPOSTER and INACTIVE verdicts unreachable and put a non-enum value in trainingState.
• Both native bridges target the current SDK APIs. The Swift called startZally, stopZally and getBiometricState, and the Kotlin called authorize(token =). None of those exist any more.
• The Android bridge cancels its coroutine scope when the engine detaches, and bounds the wait for native initialization, so a stalled SDK surfaces as E_INIT instead of a future that never completes.
• initialize is idempotent, so a hot restart no longer re-initializes a live native singleton.
• The Android build no longer mutates the consumer's root project repositories, which broke any app using RepositoriesMode.FAIL_ON_PROJECT_REPOS.
• The app UUID is no longer logged in release builds.
• analysis_options.yaml used a list-of-maps syntax the analyzer rejects, so no lint had been applied. It now uses flutter_lints.

Added

• userStateStream, a live Stream<UserState> bridging the Android StateFlow and the iOS Combine publisher, so consumers no longer have to poll.
• ZallyException, a typed error carrying a stable code and, for authorization failures, a ZallyAuthReason. Unsupported platforms raise E_UNSUPPORTED_PLATFORM instead of a bare MissingPluginException.
• Swift Package Manager support through ios/zally_flutter_sdk/Package.swift, so an app on Swift Package Manager needs no Podfile edit. The podspec remains for CocoaPods apps and both paths pin the same native version.
• An example app, and 25 Dart tests covering the token round trip, its timeout and null paths, error mapping, and the user state stream.
• Continuous integration that builds the example on both platforms, so the native bridges cannot silently stop compiling again.

Changed

• Native SDK pins: Android com.zally:zally-sdk:3.0.2 from Maven Central, iOS zally-ios-sdk-package 3.0.3. They were 1.0.4 and 1.6.16, on unrelated major versions of the same product, and the iOS pin did not exist in the public package repository.
• Kotlin 2.2.21 and coroutines 1.11.0, required by the Android SDK.
• Minimum Flutter is 3.41.0, the release carrying the fix for CVE-2026-27704. The manifest previously claimed 3.0.0, which could never have built against compileSdk 36 and an iOS 17 target.