@bubblsdk/react-native-sdk 4.1.7 → 5.0.0-alpha.2

package/ios-extension/Sources/BubblCore/Support/AsyncMutex.swift

@@ -0,0 +1,39 @@
+/// A lock for async code: one caller at a time runs the body, the rest wait their turn (in
+/// order) without blocking a thread. An actor alone isn't enough, since an actor lets other
+/// calls in whenever the running one awaits; registering the install must not interleave.
+package actor AsyncMutex {
+    private var locked = false
+    private var waiters: [CheckedContinuation<Void, Never>] = []
+
+    package init() {}
+
+    /// Runs `body` holding the lock, and releases it however `body` ends.
+    package nonisolated func withLock<T: Sendable>(_ body: @Sendable () async throws -> T) async rethrows -> T {
+        await lock()
+        do {
+            let result = try await body()
+            await unlock()
+            return result
+        } catch {
+            await unlock()
+            throw error
+        }
+    }
+
+    private func lock() async {
+        guard locked else {
+            locked = true
+            return
+        }
+        await withCheckedContinuation { waiters.append($0) }
+    }
+
+    private func unlock() {
+        if waiters.isEmpty {
+            locked = false
+        } else {
+            // The lock passes straight to the next waiter: it stays held.
+            waiters.removeFirst().resume()
+        }
+    }
+}

package/ios-extension/Sources/BubblCore/Support/BubblLog.swift

@@ -0,0 +1,52 @@
+import Foundation
+
+/// How much the SDK says (BubblOptions.logLevel), most important first.
+package enum LogSeverity: Int, Sendable, Comparable, CaseIterable {
+    case error, warning, info, debug
+
+    package static func < (lhs: LogSeverity, rhs: LogSeverity) -> Bool { lhs.rawValue < rhs.rawValue }
+}
+
+/// The SDK's log, as Android's BubblLog: one place the core reports whatever it drops or holds
+/// back (a question type a newer dashboard added, a refused event, a batch the server rejected),
+/// so a developer can see why. Silent until the iOS layer points it at os.Logger and sets the
+/// level BubblOptions asks for; a message below that level is never even built.
+///
+/// **What a message may say.** It can end up in Console and sysdiagnose for anyone holding the
+/// device, so: ids, types, counts, codes and statuses only. Never coordinates or fixes, push
+/// tokens, the credential or its secret, survey answers, or the app's own event properties.
+package enum BubblLog {
+    private static let lock = NSLock()
+    nonisolated(unsafe) private static var sink: @Sendable (LogSeverity, String) -> Void = { _, _ in }
+    nonisolated(unsafe) private static var level: LogSeverity = .warning
+    nonisolated(unsafe) private static var lastErrorMessage: String?
+
+    /// Where messages go from now on (the iOS layer, or a test), and from which level up.
+    package static func setSink(level: LogSeverity = .debug, _ sink: @escaping @Sendable (LogSeverity, String) -> Void) {
+        lock.sync {
+            self.sink = sink
+            self.level = level
+        }
+    }
+
+    /// The level messages are kept from (BubblOptions.logLevel).
+    package static func setLevel(_ level: LogSeverity) {
+        lock.sync { self.level = level }
+    }
+
+    /// The last error logged, for diagnostics (kept whatever the level).
+    package static var lastError: String? { lock.sync { lastErrorMessage } }
+
+    package static func error(_ message: @autoclosure () -> String) { log(.error, message) }
+    package static func warning(_ message: @autoclosure () -> String) { log(.warning, message) }
+    package static func info(_ message: @autoclosure () -> String) { log(.info, message) }
+    package static func debug(_ message: @autoclosure () -> String) { log(.debug, message) }
+
+    private static func log(_ level: LogSeverity, _ message: () -> String) {
+        let (sink, wanted) = lock.sync { (self.sink, level <= self.level) }
+        guard wanted || level == .error else { return }
+        let text = message()
+        if level == .error { lock.sync { lastErrorMessage = text } }
+        if wanted { sink(level, text) }
+    }
+}

package/ios-extension/Sources/BubblCore/Support/JSON.swift

@@ -0,0 +1,31 @@
+import Foundation
+
+/// JSON as the device API speaks it, read loosely: a body that isn't the expected shape is nil
+/// rather than an error, since a proxy's error page or an empty 304 must not throw.
+package enum JSON {
+    /// The object in `text`, or nil when it isn't a JSON object.
+    package static func object(_ text: String) -> [String: Any]? {
+        guard let data = text.data(using: .utf8) else { return nil }
+        return (try? JSONSerialization.jsonObject(with: data)) as? [String: Any]
+    }
+
+    /// A JSON number as Int64, however the platform's JSONSerialization boxed it (NSNumber on
+    /// Apple platforms, Swift numbers elsewhere); nil when it isn't a number.
+    package static func int64(_ value: Any?) -> Int64? {
+        switch value {
+        case let value as Int: Int64(value)
+        case let value as Int64: value
+        case let value as Double: Int64(exactly: value.rounded(.towardZero))
+        case let value as NSNumber: value.int64Value
+        default: nil
+        }
+    }
+
+    /// `value` (a dictionary or array of JSON values) as compact JSON text.
+    package static func string(_ value: Any) -> String {
+        guard JSONSerialization.isValidJSONObject(value),
+              let data = try? JSONSerialization.data(withJSONObject: value, options: [.sortedKeys])
+        else { return "{}" }
+        return String(decoding: data, as: UTF8.self)
+    }
+}

package/ios-extension/Sources/BubblCore/Support/JSONValue.swift

@@ -0,0 +1,94 @@
+/// Any JSON value, as Codable: for the parts of the device API that carry free-form JSON (an
+/// event's `data`, a rejection's `errors`). JSONEncoder and JSONDecoder read and write it the same
+/// way on every platform the core runs on, unlike JSONSerialization's boxed numbers.
+package enum JSONValue: Sendable, Hashable, Codable {
+    case null
+    case bool(Bool)
+    case int(Int64)
+    case double(Double)
+    case string(String)
+    case array([JSONValue])
+    case object([String: JSONValue])
+
+    package init(from decoder: any Decoder) throws {
+        let container = try decoder.singleValueContainer()
+        if container.decodeNil() {
+            self = .null
+        } else if let value = try? container.decode(Bool.self) {
+            self = .bool(value)
+        } else if let value = try? container.decode(Int64.self) {
+            self = .int(value)
+        } else if let value = try? container.decode(Double.self) {
+            self = .double(value)
+        } else if let value = try? container.decode(String.self) {
+            self = .string(value)
+        } else if let value = try? container.decode([JSONValue].self) {
+            self = .array(value)
+        } else {
+            self = .object(try container.decode([String: JSONValue].self))
+        }
+    }
+
+    package func encode(to encoder: any Encoder) throws {
+        var container = encoder.singleValueContainer()
+        switch self {
+        case .null: try container.encodeNil()
+        case .bool(let value): try container.encode(value)
+        case .int(let value): try container.encode(value)
+        case .double(let value): try container.encode(value)
+        case .string(let value): try container.encode(value)
+        case .array(let value): try container.encode(value)
+        case .object(let value): try container.encode(value)
+        }
+    }
+
+    /// The value at `key`, when this is an object.
+    package subscript(key: String) -> JSONValue? {
+        if case .object(let object) = self { object[key] } else { nil }
+    }
+
+    package var stringValue: String? {
+        if case .string(let value) = self { value } else { nil }
+    }
+
+    /// A number as a whole Int64, never trapping: fractions are cut, and values beyond Int64
+    /// (1e30 from a server) are clamped. Nil for anything that isn't a finite number.
+    package var int64: Int64? {
+        switch self {
+        case .int(let value): return value
+        case .double(let value):
+            guard value.isFinite else { return nil }
+            let whole = value.rounded(.towardZero)
+            if let exact = Int64(exactly: whole) { return exact }
+            return whole > 0 ? .max : .min
+        default: return nil
+        }
+    }
+
+    /// int64, clamped to `range`: for a server number that sets a limit or an interval.
+    package func int64(in range: ClosedRange<Int64>) -> Int64? {
+        int64.map { min(max($0, range.lowerBound), range.upperBound) }
+    }
+
+    /// Whether every number in it is finite: JSON has no NaN or infinity, so JSONEncoder refuses
+    /// them (Android's JSONObject does too).
+    package var isEncodable: Bool {
+        switch self {
+        case .double(let value): value.isFinite
+        case .array(let values): values.allSatisfy(\.isEncodable)
+        case .object(let values): values.values.allSatisfy(\.isEncodable)
+        case .null, .bool, .int, .string: true
+        }
+    }
+}
+
+extension JSONValue: ExpressibleByStringLiteral, ExpressibleByIntegerLiteral, ExpressibleByBooleanLiteral,
+    ExpressibleByFloatLiteral, ExpressibleByDictionaryLiteral, ExpressibleByArrayLiteral, ExpressibleByNilLiteral {
+    package init(stringLiteral value: String) { self = .string(value) }
+    package init(integerLiteral value: Int64) { self = .int(value) }
+    package init(booleanLiteral value: Bool) { self = .bool(value) }
+    package init(floatLiteral value: Double) { self = .double(value) }
+    package init(dictionaryLiteral elements: (String, JSONValue)...) { self = .object(Dictionary(uniqueKeysWithValues: elements)) }
+    package init(arrayLiteral elements: JSONValue...) { self = .array(elements) }
+    package init(nilLiteral: ()) { self = .null }
+}

package/ios-extension/Sources/BubblCore/Support/Locking.swift

@@ -0,0 +1,11 @@
+import Foundation
+
+extension NSLock {
+    /// Runs `body` holding the lock. (Foundation's own `withLock` isn't on every platform the
+    /// core builds for.)
+    package func sync<T>(_ body: () throws -> T) rethrows -> T {
+        lock()
+        defer { unlock() }
+        return try body()
+    }
+}

package/ios-extension/Sources/BubblCore/Support/ValueStore.swift

@@ -0,0 +1,109 @@
+import Foundation
+
+/// A small piece of the engine's state kept between launches (what's been shown, the config, the
+/// device's segments…). `load` is nil when nothing has been saved yet.
+package protocol ValueStore<Value>: Sendable {
+    associatedtype Value: Codable & Sendable
+    func load() throws -> Value?
+    func save(_ value: Value) throws
+    func delete() throws
+}
+
+/// The file couldn't be read or written, so it did neither. Before the first unlock after a reboot
+/// iOS keeps protected files closed; an unreadable file is never taken for "nothing saved".
+package struct ValueStoreUnavailable: Error {
+    package let underlying: any Error
+}
+
+/// A value read once and then kept in memory, for state that's asked for often. Only a successful
+/// read is kept: one that failed (the file locked) is tried again next time.
+package final class Cached<Value: Sendable>: @unchecked Sendable {
+    private let lock = NSLock()
+    private var loaded = false
+    private var stored: Value?
+
+    package init() {}
+
+    /// The kept value, or `load`'s result (kept) the first time.
+    package func value(_ load: () throws -> Value?) rethrows -> Value? {
+        try lock.sync {
+            if loaded { return stored }
+            let value = try load()
+            stored = value
+            loaded = true
+            return value
+        }
+    }
+
+    package func set(_ value: Value?) {
+        lock.sync {
+            stored = value
+            loaded = true
+        }
+    }
+}
+
+/// A ValueStore in memory: for tests.
+package final class InMemoryValueStore<Value: Codable & Sendable>: ValueStore, @unchecked Sendable {
+    private let lock = NSLock()
+    private var value: Value?
+
+    package init(_ value: Value? = nil) {
+        self.value = value
+    }
+
+    package func load() -> Value? { lock.sync { value } }
+    package func save(_ value: Value) { lock.sync { self.value = value } }
+    package func delete() { lock.sync { value = nil } }
+}
+
+/// A ValueStore as one JSON file, written atomically (on iOS, with file protection). A missing
+/// file is nothing saved, and so is one that reads but doesn't decode (from an older build, or
+/// corrupt); one that can't be read at all throws ValueStoreUnavailable.
+package final class FileValueStore<Value: Codable & Sendable>: ValueStore, @unchecked Sendable {
+    private let lock = NSLock()
+    private let url: URL
+    private let writeOptions: Data.WritingOptions
+
+    /// - Parameter writeOptions: added to `.atomic`; on iOS, the file protection class.
+    package init(url: URL, writeOptions: Data.WritingOptions = []) {
+        self.url = url
+        self.writeOptions = writeOptions.union(.atomic)
+    }
+
+    package func load() throws -> Value? {
+        try lock.sync {
+            guard FileManager.default.fileExists(atPath: url.path) else { return nil }
+            let data: Data
+            do {
+                data = try Data(contentsOf: url)
+            } catch {
+                throw ValueStoreUnavailable(underlying: error)
+            }
+            return try? JSONDecoder().decode(Value.self, from: data)
+        }
+    }
+
+    package func save(_ value: Value) throws {
+        try lock.sync {
+            let data = try JSONEncoder().encode(value)
+            do {
+                try FileManager.default.createDirectory(at: url.deletingLastPathComponent(), withIntermediateDirectories: true)
+                try data.write(to: url, options: writeOptions)
+            } catch {
+                throw ValueStoreUnavailable(underlying: error)
+            }
+        }
+    }
+
+    package func delete() throws {
+        try lock.sync {
+            guard FileManager.default.fileExists(atPath: url.path) else { return }
+            do {
+                try FileManager.default.removeItem(at: url)
+            } catch {
+                throw ValueStoreUnavailable(underlying: error)
+            }
+        }
+    }
+}

package/ios-extension/Sources/BubblNotificationService/BubblNotificationService.swift

@@ -0,0 +1,124 @@
+#if os(iOS)
+import Foundation
+import UniformTypeIdentifiers
+import UserNotifications
+#if !COCOAPODS
+import BubblCore
+#endif
+
+/// Adds the picture to Bubbl's pushes (optional). Add a Notification Service Extension target to
+/// the app, add this package's BubblNotificationService product to it, and make the extension's
+/// principal class a subclass:
+///
+///     import BubblNotificationService
+///     class NotificationService: BubblNotificationService {}
+///
+/// The push's image_url is downloaded (https only, at most 10 MB, within the time iOS gives) and
+/// attached; anything that goes wrong shows the push as it came. Other pushes pass through
+/// untouched (and all of them below iOS 17, where Bubbl does nothing): an app with its own
+/// extension work can override `didReceive` and call `super` only for pushes where `isBubbl(_:)`
+/// is true.
+///
+/// Nothing is recorded here: the extension is a separate process with no access to Bubbl's
+/// state, and it doesn't need any.
+open class BubblNotificationService: UNNotificationServiceExtension, @unchecked Sendable {
+    private static let maxImageBytes = 10 * 1024 * 1024
+
+    private let lock = NSLock()
+    private var deliver: ((UNNotificationContent) -> Void)?
+    private var content: UNMutableNotificationContent?
+    private var download: URLSessionDownloadTask?
+
+    /// How long the picture may take to download. iOS gives the extension about 30 s in all.
+    open var imageTimeout: TimeInterval { 20 }
+
+    /// Whether a push is Bubbl's.
+    public static func isBubbl(_ request: UNNotificationRequest) -> Bool {
+        PushMessage.isBubbl(data(request.content.userInfo))
+    }
+
+    open override func didReceive(_ request: UNNotificationRequest, withContentHandler contentHandler: @escaping (UNNotificationContent) -> Void) {
+        // Below iOS 17 Bubbl does nothing: pushes pass through as they came.
+        guard #available(iOS 17, *) else {
+            contentHandler(request.content)
+            return
+        }
+        guard let imageUrl = PushMessage.imageUrl(Self.data(request.content.userInfo)),
+              let url = URL(string: imageUrl),
+              let content = request.content.mutableCopy() as? UNMutableNotificationContent
+        else {
+            contentHandler(request.content)
+            return
+        }
+
+        let configuration = URLSessionConfiguration.ephemeral
+        configuration.timeoutIntervalForResource = imageTimeout
+        let session = URLSession(configuration: configuration)
+        let task = session.downloadTask(with: url) { [weak self] location, response, _ in
+            self?.attach(location, response)
+            self?.finish()
+        }
+        lock.sync {
+            deliver = contentHandler
+            self.content = content
+            download = task
+        }
+        task.resume()
+        session.finishTasksAndInvalidate()
+    }
+
+    /// iOS is about to end the extension: show the push with whatever is ready.
+    open override func serviceExtensionTimeWillExpire() {
+        lock.sync { download }?.cancel()
+        finish()
+    }
+
+    @available(iOS 17, *)
+    private func attach(_ location: URL?, _ response: URLResponse?) {
+        guard let location, let http = response as? HTTPURLResponse, (200...299).contains(http.statusCode),
+              let size = try? location.resourceValues(forKeys: [.fileSizeKey]).fileSize, size > 0, size <= Self.maxImageBytes
+        else { return }
+
+        // iOS tells the picture's kind from the file's extension: from the MIME type, else the URL.
+        let fromMime = http.mimeType.flatMap { UTType(mimeType: $0)?.preferredFilenameExtension }
+        guard let fileExtension = fromMime ?? http.url.map(\.pathExtension).flatMap({ $0.isEmpty ? nil : $0 }) else { return }
+
+        let file = FileManager.default.temporaryDirectory
+            .appendingPathComponent(UUID().uuidString)
+            .appendingPathExtension(fileExtension)
+        do {
+            try FileManager.default.moveItem(at: location, to: file)
+            let attachment = try UNNotificationAttachment(identifier: "bubbl-image", url: file)
+            lock.sync { content?.attachments = [attachment] }
+        } catch {
+            // Not a picture iOS can show: the push goes as it came.
+        }
+    }
+
+    /// Hands iOS the content, once (the download and the time running out may both get here).
+    private func finish() {
+        let (deliver, content) = lock.sync {
+            defer { self.deliver = nil }
+            return (self.deliver, self.content)
+        }
+        if let deliver, let content { deliver(content) }
+    }
+
+    /// The push's top-level data as JSON: Bubbl's keys are strings (or 1/true for the flags).
+    private static func data(_ userInfo: [AnyHashable: Any]) -> [String: JSONValue] {
+        var data: [String: JSONValue] = [:]
+        for (key, value) in userInfo {
+            guard let key = key as? String else { continue }
+            switch value {
+            case let text as String:
+                data[key] = .string(text)
+            case let number as NSNumber:
+                data[key] = CFGetTypeID(number) == CFBooleanGetTypeID() ? .bool(number.boolValue) : .int(number.int64Value)
+            default:
+                continue
+            }
+        }
+        return data
+    }
+}
+#endif

package/ios-sdk/BubblCore/API/ApiResponse.swift

@@ -0,0 +1,90 @@
+import Foundation
+
+/// A device API v1 response: its status, body and headers, and — for an error — what the engine
+/// should do about it (`handling`, from the contract's error table).
+package struct ApiResponse: Sendable {
+    package let status: Int
+    package let body: String
+    private let raw: HttpResponse
+    private let forcedHandling: ErrorHandling?
+
+    package init(_ raw: HttpResponse, handledAs forcedHandling: ErrorHandling? = nil) {
+        status = raw.status
+        body = raw.body
+        self.raw = raw
+        self.forcedHandling = forcedHandling
+    }
+
+    package var isSuccessful: Bool { (200...299).contains(status) || status == 304 }
+
+    /// The body as a JSON object, or nil when it isn't one (a 304, or a proxy's error page).
+    package var json: [String: Any]? { JSON.object(body) }
+
+    /// The body decoded as `T`, or nil when it isn't one. Codable reads the same on every
+    /// platform, so parsing goes through here rather than `json`.
+    package func decode<T: Decodable>(_ type: T.Type) -> T? {
+        try? JSONDecoder().decode(type, from: Data(body.utf8))
+    }
+
+    /// The error's stable `code`, when the body has one.
+    package var code: String? {
+        (json?["code"] as? String).flatMap { $0.isEmpty ? nil : $0 }
+    }
+
+    /// What to do about a failed response; nil for a success.
+    package var handling: ErrorHandling? {
+        isSuccessful ? nil : forcedHandling ?? ErrorActions.forResponse(status: status, code: code)
+    }
+
+    /// The same response, handled as `handling` says instead of by its code.
+    package func handled(as handling: ErrorHandling) -> ApiResponse {
+        ApiResponse(raw, handledAs: handling)
+    }
+
+    package func header(_ name: String) -> String? { raw.header(name) }
+}
+
+/// Why a call to the device API didn't get through, reduced to what whoever scheduled it (a
+/// background task, an app resume) has to do next. Built from the contract's error table.
+package enum ApiFailure: Sendable, Equatable {
+    /// Try again later with exponential backoff (5xx, no network).
+    case backoff
+    /// The server asked for a wait (429, request_in_progress).
+    case retryAfter(seconds: Int)
+    /// Stop calling the API for a while (workspace paused, free tier); keep queuing.
+    case pause(hours: Int, code: String?)
+    /// The server doesn't know this device yet: PUT /device, then try again.
+    case describeDevice
+    /// The request can never succeed as sent: discard it (and refetch geofences, if said).
+    case drop(refreshGeofences: Bool, status: Int, code: String?)
+    /// Something only a developer can fix (misconfiguration): surface it in diagnostics.
+    case stopped(status: Int, code: String?)
+
+    private static let defaultRetrySeconds = 30
+    private static let defaultPauseHours = 1
+
+    /// What a failed `response` means for the caller. Never called with a success.
+    package static func of(_ response: ApiResponse) -> ApiFailure {
+        guard let handling = response.handling else { return .stopped(status: response.status, code: response.code) }
+
+        switch handling.action {
+        case .backoff:
+            return .backoff
+        case .waitAndRetry:
+            let seconds = response.header("Retry-After").flatMap { Int($0.trimmingCharacters(in: .whitespaces)) }
+            return .retryAfter(seconds: max(seconds ?? defaultRetrySeconds, 1))
+        case .pause:
+            return .pause(hours: handling.pauseHours ?? defaultPauseHours, code: response.code)
+        case .describeDevice:
+            return .describeDevice
+        case .drop:
+            return .drop(refreshGeofences: false, status: response.status, code: response.code)
+        case .dropAndRefreshGeofences:
+            return .drop(refreshGeofences: true, status: response.status, code: response.code)
+        // The client has already registered again or corrected the clock once; what's left of
+        // those, and everything else, needs a person.
+        case .reRegister, .correctClockAndRetry, .stopAndReport, .showMessage:
+            return .stopped(status: response.status, code: response.code)
+        }
+    }
+}

package/ios-sdk/BubblCore/API/CredentialStore.swift

@@ -0,0 +1,116 @@
+import Foundation
+
+/// The install's credential, read together so a registration in between can't mix old and new.
+package struct SigningCredential: Sendable, Equatable {
+    package let keyId: String
+    package let secret: String
+
+    package init(keyId: String, secret: String) {
+        self.keyId = keyId
+        self.secret = secret
+    }
+}
+
+/// What reading the credential found. `unavailable` is not `missing`: before the first unlock
+/// after a reboot iOS can relaunch the app (for a region event) while the Keychain can't be read
+/// yet. Taking that for "not registered" would register again and replace a working credential.
+package enum CredentialRead: Sendable, Equatable {
+    case present(SigningCredential)
+    case missing
+    case unavailable
+}
+
+/// Where the install's signing credential lives: the Keychain on a device
+/// (AfterFirstUnlockThisDeviceOnly), memory in tests.
+package protocol CredentialStore: Sendable {
+    /// The key id and secret, read together.
+    func read() -> CredentialRead
+
+    /// Keep a new credential, replacing any old one. Throws when it couldn't be kept (the Keychain
+    /// refused it): the registration it came from then doesn't count.
+    func save(keyId: String, secret: String) throws
+
+    /// Forget the credential (deleteMyData, or an earlier installation's). Throws when it couldn't
+    /// be forgotten (the Keychain refused), so nothing claims the device's data is gone when it isn't.
+    func clear() throws
+}
+
+/// A credential kept only while this install's id is. On iOS the Keychain outlives the app and its
+/// files don't: after a reinstall the old install's credential would sign for a new install id.
+/// A credential with no install id beside it (none saved, not merely unreadable) belongs to an
+/// earlier installation, so it's forgotten and this install registers as itself, as on Android,
+/// where uninstalling wipes the Keystore. Checked once per process: from then on a credential is
+/// only saved by a registration, which makes the install id first.
+package final class InstallBoundCredentialStore: CredentialStore, @unchecked Sendable {
+    private let base: any CredentialStore
+    private let installId: any ValueStore<String>
+    private let lock = NSLock()
+    private var checked = false
+
+    package init(_ base: any CredentialStore, installId: any ValueStore<String>) {
+        self.base = base
+        self.installId = installId
+    }
+
+    package func read() -> CredentialRead {
+        lock.sync {
+            let read = base.read()
+            guard !checked, case .present = read else {
+                if read == .missing { checked = true }
+                return read
+            }
+            let id: String?
+            do {
+                id = try installId.load()
+            } catch {
+                return .unavailable
+            }
+            if let id, !id.isEmpty {
+                checked = true
+                return read
+            }
+            do {
+                try base.clear()
+            } catch {
+                // Still there: not this install's, and not gone either. Asked again next time.
+                return .unavailable
+            }
+            checked = true
+            BubblLog.info("A credential left by an earlier installation of the app was forgotten")
+            return .missing
+        }
+    }
+
+    package func save(keyId: String, secret: String) throws {
+        try base.save(keyId: keyId, secret: secret)
+    }
+
+    package func clear() throws {
+        try base.clear()
+    }
+}
+
+/// A CredentialStore in memory: for tests, and for nothing else.
+package final class InMemoryCredentialStore: CredentialStore, @unchecked Sendable {
+    private let lock = NSLock()
+    private var credential: SigningCredential?
+
+    package init() {}
+
+    /// The current key id, for tests.
+    package func keyId() -> String? {
+        lock.sync { credential?.keyId }
+    }
+
+    package func read() -> CredentialRead {
+        lock.sync { credential.map(CredentialRead.present) ?? .missing }
+    }
+
+    package func save(keyId: String, secret: String) throws {
+        lock.sync { credential = SigningCredential(keyId: keyId, secret: secret) }
+    }
+
+    package func clear() throws {
+        lock.sync { credential = nil }
+    }
+}