@buoy-gg/storage 5.0.0 → 6.0.1

package/lib/commonjs/storage/utils/SecureStoreRegistry.js

@@ -0,0 +1,149 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.registerSecureStoreKeys = registerSecureStoreKeys;
+exports.secureStoreRegistry = void 0;
+exports.unregisterSecureStoreKey = unregisterSecureStoreKey;
+/**
+ * Expo SecureStore Registry
+ *
+ * SecureStore (iOS Keychain / Android KeyStore) has NO key-enumeration API —
+ * unlike AsyncStorage (`getAllKeys`) and MMKV (`getAllKeys()`), there is no way
+ * to ask "what's stored?". Apps must therefore register the keys they want
+ * visible in the Storage tool.
+ *
+ * The SecureStore module itself is passed in at registration (never imported
+ * here) — the same Metro-safe pattern as `registerMMKVInstance`: this package
+ * has zero dependency on `expo-secure-store`, so bare RN apps without it
+ * bundle fine.
+ *
+ * @module SecureStoreRegistry
+ */
+
+/**
+ * Subset of expo-secure-store's SecureStoreOptions that the tool tracks.
+ * `keychainService` MUST match what the value was written with, or reads
+ * return null. `requireAuthentication` keys trigger a biometric prompt on
+ * read, so the tool never auto-reads them.
+ *
+ * @public
+ */
+
+/**
+ * Structural type for the expo-secure-store module. Matches
+ * `import * as SecureStore from "expo-secure-store"` without depending on it.
+ *
+ * @public
+ */
+
+/**
+ * A key to expose in the Storage tool: either a bare key name, or a key with
+ * the SecureStore options it was written with (+ optional description shown
+ * in the expanded card).
+ *
+ * @public
+ */
+
+/**
+ * Normalized info for a registered SecureStore key.
+ *
+ * @public
+ */
+
+class SecureStoreRegistry {
+  module = null;
+  keys = new Map();
+
+  /**
+   * Register the SecureStore module and the keys to expose. Callable multiple
+   * times — keys accumulate, the latest module wins.
+   */
+  register(module, descriptors) {
+    this.module = module;
+    for (const d of descriptors) {
+      const entry = typeof d === "string" ? {
+        key: d,
+        options: {}
+      } : {
+        key: d.key,
+        description: d.description,
+        options: {
+          keychainService: d.keychainService,
+          requireAuthentication: d.requireAuthentication,
+          authenticationPrompt: d.authenticationPrompt
+        }
+      };
+      this.keys.set(entry.key, entry);
+    }
+  }
+
+  /** Remove a key from the registry (does not delete the stored value). */
+  unregister(key) {
+    this.keys.delete(key);
+  }
+
+  /** The registered SecureStore module, or null if none registered yet. */
+  getModule() {
+    return this.module;
+  }
+
+  /** All registered key entries. */
+  getAll() {
+    return Array.from(this.keys.values());
+  }
+
+  /** Number of registered keys. */
+  count() {
+    return this.keys.size;
+  }
+
+  /**
+   * Delete a stored value via the registered module, using the options the
+   * key was registered with (required for keychainService-scoped keys).
+   */
+  async deleteValue(key) {
+    const entry = this.keys.get(key);
+    if (!this.module || !entry) return;
+    await this.module.deleteItemAsync(key, entry.options);
+  }
+}
+
+/**
+ * Singleton registry instance (advanced usage — most apps only need
+ * {@link registerSecureStoreKeys}).
+ */
+const secureStoreRegistry = exports.secureStoreRegistry = new SecureStoreRegistry();
+
+/**
+ * Register Expo SecureStore keys with React Buoy DevTools.
+ *
+ * **⚠️ REQUIRED for SecureStore visibility**: SecureStore has no
+ * key-enumeration API, so the tool can only show keys you declare here.
+ * Pass the module itself so this package never has to import
+ * `expo-secure-store`.
+ *
+ * @example
+ * ```typescript
+ * import * as SecureStore from "expo-secure-store";
+ * import { registerSecureStoreKeys } from "@buoy-gg/storage";
+ *
+ * registerSecureStoreKeys(SecureStore, [
+ *   "auth.token",
+ *   { key: "session", keychainService: "com.myapp.auth" },
+ *   // Never auto-read; shown as biometric-protected:
+ *   { key: "pin", requireAuthentication: true },
+ * ]);
+ * ```
+ */
+function registerSecureStoreKeys(module, keys) {
+  secureStoreRegistry.register(module, keys);
+}
+
+/**
+ * Remove a key from the DevTools registry (the stored value is untouched).
+ */
+function unregisterSecureStoreKey(key) {
+  secureStoreRegistry.unregister(key);
+}

package/lib/module/index.js

@@ -55,6 +55,11 @@ export { undoOperation, jumpToState, canUndo } from "./storage/utils/storageTime
 // =============================================================================
 export { registerMMKVInstance, unregisterMMKVInstance } from "./storage/utils/MMKVInstanceRegistry";
 
+// =============================================================================
+// SECURE STORE REGISTRATION (For users to register their expo-secure-store keys)
+// SecureStore has no key-enumeration API, so keys must be declared to appear.
+// =============================================================================
+export { registerSecureStoreKeys, unregisterSecureStoreKey } from "./storage/utils/SecureStoreRegistry";
 // =============================================================================
 // EXTERNAL SYNC (Adapter for @buoy-gg/external-sync's useExternalSync)
 // =============================================================================

package/lib/module/storage/components/GameUIStorageBrowser.js

@@ -10,17 +10,13 @@ import { StorageFilterCards } from "./StorageFilterCards";
 import { useAsyncStorageKeys } from "../hooks/useAsyncStorageKeys";
 import { addListener } from "../utils/AsyncStorageListener";
 import { useMultiMMKVKeys } from "../hooks/useMMKVKeys";
+import { useSecureStoreKeys } from "../hooks/useSecureStoreKeys";
 import { useMMKVInstances } from "../hooks/useMMKVInstances";
-import { isMMKVAvailable } from "../utils/mmkvAvailability";
 import { StorageActionButtons } from "./StorageActionButtons";
 import { SelectionActionBar } from "./SelectionActionBar";
-
-// Conditionally import MMKV listener
-let addMMKVListener;
-if (isMMKVAvailable()) {
-  const listener = require("../utils/MMKVListener");
-  addMMKVListener = listener.addMMKVListener;
-}
+// Pure JS (no react-native-mmkv dependency) — works with any registered
+// instance, including remote-backed wrappers on the desktop dashboard.
+import { addMMKVListener } from "../utils/MMKVListener";
 
 // Import shared Game UI components
 import { gameUIColors, macOSColors, HardDrive } from "@buoy-gg/shared-ui";
@@ -122,20 +118,29 @@ export function GameUIStorageBrowser({
     return allMMKVKeys.filter(k => k.instanceId === selectedMMKVInstance);
   }, [allMMKVKeys, selectedMMKVInstance]);
 
-  // Merge storage keys from AsyncStorage and MMKV
+  // Use SecureStore hook — only surfaces keys declared via registerSecureStoreKeys()
+  const {
+    storageKeys: secureStorageKeys,
+    isLoading: isLoadingSecure,
+    error: secureError,
+    refresh: refreshSecure
+  } = useSecureStoreKeys();
+
+  // Merge storage keys from AsyncStorage, MMKV, and SecureStore
   const allStorageKeys = useMemo(() => {
-    return [...asyncStorageKeys, ...mmkvStorageKeys];
-  }, [asyncStorageKeys, mmkvStorageKeys]);
+    return [...asyncStorageKeys, ...mmkvStorageKeys, ...secureStorageKeys];
+  }, [asyncStorageKeys, mmkvStorageKeys, secureStorageKeys]);
 
   // Determine loading and error states
-  const isLoading = isLoadingAsync || isLoadingMMKV;
-  const error = asyncError || mmkvError;
+  const isLoading = isLoadingAsync || isLoadingMMKV || isLoadingSecure;
+  const error = asyncError || mmkvError || secureError;
 
   // Combined refresh function
   const refresh = useCallback(() => {
     refreshAsync();
     refreshMMKV();
-  }, [refreshAsync, refreshMMKV]);
+    refreshSecure();
+  }, [refreshAsync, refreshMMKV, refreshSecure]);
 
   // Generate unique identifier for a storage key
   const getKeyIdentifier = useCallback(storageKey => {
@@ -248,11 +253,8 @@ export function GameUIStorageBrowser({
     };
   }, [refreshAsync]);
 
-  // Auto-refresh on MMKV storage events (only if MMKV is available)
+  // Auto-refresh on MMKV storage events
   useEffect(() => {
-    if (!isMMKVAvailable() || !addMMKVListener) {
-      return; // Skip if MMKV not available
-    }
     let timeoutId;
     const unsubscribe = addMMKVListener(event => {
       // Only refresh if event is for the selected instance

package/lib/module/storage/components/SelectionActionBar.js

@@ -6,6 +6,7 @@ import { Trash2, CopyButton, CheckSquare, EyeOff, ProUpgradeModal } from "@buoy-
 import { macOSColors } from "@buoy-gg/shared-ui";
 import { useIsPro } from "@buoy-gg/license";
 import { removeMany } from "../utils/asyncStorageCompat";
+import { secureStoreRegistry } from "../utils/SecureStoreRegistry";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 export function SelectionActionBar({
   selectedKeys,
@@ -68,12 +69,19 @@ export function SelectionActionBar({
           // Group keys by storage type
           const asyncKeys = selectedKeys.filter(k => k.storageType === "async");
           const mmkvKeys = selectedKeys.filter(k => k.storageType === "mmkv");
+          const secureKeys = selectedKeys.filter(k => k.storageType === "secure");
 
           // Delete AsyncStorage keys
           if (asyncKeys.length > 0) {
             await removeMany(asyncKeys.map(k => k.key));
           }
 
+          // Delete SecureStore keys (via the registry, which knows each
+          // key's keychainService options)
+          for (const k of secureKeys) {
+            await secureStoreRegistry.deleteValue(k.key);
+          }
+
           // Delete MMKV keys
           if (mmkvKeys.length > 0) {
             // Group by instance

package/lib/module/storage/components/StorageEventCard.js

@@ -9,7 +9,7 @@
  */
 
 import { memo } from "react";
-import { useRelativeTime, macOSColors, parseValue, CompactRow } from "@buoy-gg/shared-ui";
+import { RelativeTime, macOSColors, parseValue, CompactRow } from "@buoy-gg/shared-ui";
 import { translateStorageAction } from "../utils/storageActionHelpers";
 
 /** Value type for storage events */
@@ -82,7 +82,6 @@ export const StorageEventCard = /*#__PURE__*/memo(function StorageEventCard({
   const actionColor = getActionColor(data.lastAction);
   const actionLabel = translateStorageAction(data.lastAction);
   const totalOps = data.totalOperations ?? 1;
-  const relativeTime = useRelativeTime(data.lastEventTimestamp);
   return /*#__PURE__*/_jsx(CompactRow
   // Status section (left) - shows "Storage" with action-colored dot
   , {
@@ -99,7 +98,9 @@ export const StorageEventCard = /*#__PURE__*/memo(function StorageEventCard({
     showChevron: showChevron
     // Bottom right - timestamp
     ,
-    bottomRightText: relativeTime
+    bottomRightText: /*#__PURE__*/_jsx(RelativeTime, {
+      timestamp: data.lastEventTimestamp
+    })
     // Interaction
     ,
     isSelected: isSelected,

package/lib/module/storage/components/StorageFilterCards.js

@@ -6,7 +6,6 @@ import { isMMKVAvailable } from "../utils/mmkvAvailability";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // Feature flags - set to true when implemented
 const IS_MMKV_IMPLEMENTED = true; // ✅ MMKV support is now implemented
-const IS_SECURE_STORE_IMPLEMENTED = false;
 
 // Runtime availability checks
 const IS_MMKV_AVAILABLE = isMMKVAvailable();
@@ -179,7 +178,7 @@ export function StorageFilterCards({
           } : {
             color: macOSColors.text.muted
           }],
-          children: "Coming Soon"
+          children: displayStats.secureCount
         })]
       })]
     })]

package/lib/module/storage/components/StorageKeyRow.js

@@ -1,5 +1,6 @@
 "use strict";
 
+import { memo } from "react";
 import { View, Text, StyleSheet, TouchableOpacity } from "react-native";
 import { macOSColors, CompactRow, TypeBadge, HardDrive, Square, CheckSquare, EyeOff, Pin, ExpandedInfoRow, PillBadge } from "@buoy-gg/shared-ui";
 import { getStorageTypeLabel } from "../utils/storageQueryUtils";
@@ -70,7 +71,11 @@ const formatValue = value => {
   const str = typeof value === "string" ? value : JSON.stringify(value);
   return str;
 };
-export function StorageKeyRow({
+
+// Memo justified by profiling (tool-bench 2026-07-06): the browser tab
+// renders every key row on each parent render (ScrollView, no
+// virtualization) — memo keeps unchanged keys from re-rendering.
+export const StorageKeyRow = /*#__PURE__*/memo(function StorageKeyRow({
   storageKey,
   isExpanded,
   onPress,
@@ -312,7 +317,7 @@ export function StorageKeyRow({
       })]
     })]
   });
-}
+});
 const getStorageTypeColor = storageType => {
   switch (storageType) {
     case "mmkv":

package/lib/module/storage/hooks/useMMKVInstances.js

@@ -15,14 +15,10 @@
  */
 
 import { useState, useEffect } from 'react';
-import { isMMKVAvailable } from '../utils/mmkvAvailability';
-
-// Conditionally import registry
-let mmkvInstanceRegistry;
-if (isMMKVAvailable()) {
-  const registry = require('../utils/MMKVInstanceRegistry');
-  mmkvInstanceRegistry = registry.mmkvInstanceRegistry;
-}
+// The registry is pure JS (no react-native-mmkv dependency) — import it
+// unconditionally so registered instances show up even without the native
+// module (e.g. remote-backed wrappers on the desktop dashboard).
+import { mmkvInstanceRegistry } from '../utils/MMKVInstanceRegistry';
 
 /**
  * Metadata about an MMKV instance with additional runtime information
@@ -67,12 +63,6 @@ export function useMMKVInstances(autoRefresh = false) {
   const fetchInstances = () => {
     setIsLoading(true);
     try {
-      // Guard: Check if MMKV is available
-      if (!isMMKVAvailable() || !mmkvInstanceRegistry) {
-        setInstances([]);
-        setIsLoading(false);
-        return; // Silently return empty when MMKV not available
-      }
       const allInstances = mmkvInstanceRegistry.getAll();
 
       // Enhance with metadata
@@ -160,8 +150,7 @@ export function useMMKVInstances(autoRefresh = false) {
 export function useMMKVInstance(instanceId) {
   const [instance, setInstance] = useState(null);
   useEffect(() => {
-    // Guard: Check if MMKV is available
-    if (!isMMKVAvailable() || !mmkvInstanceRegistry) {
+    if (!mmkvInstanceRegistry) {
       setInstance(null);
       return;
     }
@@ -205,8 +194,7 @@ export function useMMKVInstance(instanceId) {
 export function useMMKVInstanceExists(instanceId) {
   const [exists, setExists] = useState(false);
   useEffect(() => {
-    // Guard: Check if MMKV is available
-    if (!isMMKVAvailable() || !mmkvInstanceRegistry) {
+    if (!mmkvInstanceRegistry) {
       setExists(false);
       return;
     }

package/lib/module/storage/hooks/useMMKVKeys.js

@@ -14,20 +14,14 @@
  */
 
 import { useState, useEffect, useCallback, useRef } from 'react';
-import { isMMKVAvailable } from '../utils/mmkvAvailability';
+// Pure-JS utilities (no react-native-mmkv dependency) — safe to import
+// unconditionally. They operate on whatever instance objects are registered,
+// including remote-backed wrappers on the desktop dashboard.
+import { detectMMKVType, isTypeMatch } from '../utils/mmkvTypeDetection';
 
 // Conditionally import MMKV types
-
 // Use 'any' to avoid hard dependency on react-native-mmkv
 
-// Conditionally import utilities only if MMKV is available
-let detectMMKVType;
-let isTypeMatch;
-if (isMMKVAvailable()) {
-  const typeDetection = require('../utils/mmkvTypeDetection');
-  detectMMKVType = typeDetection.detectMMKVType;
-  isTypeMatch = typeDetection.isTypeMatch;
-}
 /**
  * Hook to fetch and monitor keys from an MMKV instance
  *
@@ -86,14 +80,9 @@ export function useMMKVKeys(instance, instanceId, requiredStorageKeys = []) {
     setIsLoading(true);
     setError(null);
     try {
-      // Guard: Check if MMKV is available
-      if (!isMMKVAvailable()) {
-        setStorageKeys([]);
-        setIsLoading(false);
-        return; // Silently return empty when MMKV not available
-      }
-
-      // Guard: Check if instance is provided
+      // Guard: Check if instance is provided. (No isMMKVAvailable() gate —
+      // registered instances may be remote-backed wrappers with no native
+      // module, e.g. on the desktop dashboard.)
       if (!instance) {
         setStorageKeys([]);
         setIsLoading(false);

package/lib/module/storage/hooks/useSecureStoreKeys.js

@@ -0,0 +1,101 @@
+"use strict";
+
+import { useState, useEffect, useCallback } from "react";
+import { secureStoreRegistry } from "../utils/SecureStoreRegistry";
+
+/**
+ * Placeholder value shown for `requireAuthentication` keys. Reading those
+ * triggers a biometric (Face ID / fingerprint) prompt, so the tool never
+ * auto-reads them — it just shows they exist.
+ */
+const BIOMETRIC_PLACEHOLDER = "•••••• (biometric protected)";
+/**
+ * Read all registered SecureStore keys into StorageKeyInfo[] for the browser.
+ *
+ * SecureStore has no enumeration API, so this only surfaces keys declared via
+ * `registerSecureStoreKeys()` (see SecureStoreRegistry). Values are read with
+ * the options each key was registered with (keychainService must match), and
+ * biometric-protected keys are listed without being read.
+ */
+export function useSecureStoreKeys() {
+  const [storageKeys, setStorageKeys] = useState([]);
+  const [isLoading, setIsLoading] = useState(true);
+  const [error, setError] = useState(null);
+  const fetchSecureStoreData = useCallback(async () => {
+    const module = secureStoreRegistry.getModule();
+    const entries = secureStoreRegistry.getAll();
+    if (!module || entries.length === 0) {
+      setStorageKeys([]);
+      setIsLoading(false);
+      return;
+    }
+    setIsLoading(true);
+    setError(null);
+    try {
+      const keys = [];
+      for (const entry of entries) {
+        if (entry.options.requireAuthentication) {
+          // Never auto-read: reading would fire a biometric prompt.
+          keys.push({
+            key: entry.key,
+            value: BIOMETRIC_PLACEHOLDER,
+            storageType: "secure",
+            status: "optional_present",
+            category: "optional",
+            description: entry.description ?? "Protected by biometric authentication — value not read by DevTools",
+            ...(entry.options.keychainService && {
+              instanceId: entry.options.keychainService
+            })
+          });
+          continue;
+        }
+        let rawValue = null;
+        try {
+          rawValue = await module.getItemAsync(entry.key, entry.options);
+        } catch {
+          // Key unreadable (e.g. keychain state changed) — treat as missing.
+        }
+
+        // Parse JSON values for the DataViewer, same as the AsyncStorage hook.
+        let parsedValue = rawValue;
+        if (rawValue) {
+          try {
+            parsedValue = JSON.parse(rawValue);
+          } catch {
+            parsedValue = rawValue;
+          }
+        }
+        keys.push({
+          key: entry.key,
+          value: rawValue === null ? undefined : parsedValue,
+          storageType: "secure",
+          status: rawValue === null ? "required_missing" : "optional_present",
+          category: rawValue === null ? "required" : "optional",
+          ...(entry.description && {
+            description: entry.description
+          }),
+          ...(entry.options.keychainService && {
+            instanceId: entry.options.keychainService
+          })
+        });
+      }
+      setStorageKeys(keys);
+    } catch (err) {
+      setError(err instanceof Error ? err : new Error("Failed to read SecureStore"));
+      setStorageKeys([]);
+    } finally {
+      setIsLoading(false);
+    }
+  }, []);
+
+  // Initial fetch (registration happens at app startup, before the tool opens)
+  useEffect(() => {
+    fetchSecureStoreData();
+  }, [fetchSecureStoreData]);
+  return {
+    storageKeys,
+    isLoading,
+    error,
+    refresh: fetchSecureStoreData
+  };
+}

package/lib/module/storage/hooks/useStorageEvents.js

@@ -48,24 +48,38 @@ export function useStorageEvents(options = {}) {
       setIsCapturing(false);
       return;
     }
-    const unsubscribe = storageEventStore.subscribeToEvents(allEvents => {
-      // Filter by storage type if specified
-      let filtered = allEvents;
-      if (storageType !== "all") {
-        filtered = allEvents.filter(e => e.storageType === storageType);
-      }
 
-      // Limit events
-      if (filtered.length > maxEvents) {
-        filtered = filtered.slice(0, maxEvents);
-      }
-      setEvents(filtered);
+    // Frame-coalesced (same pattern as network's useNetworkEventList):
+    // bursts of storage writes land as ONE commit per frame instead of
+    // one per emission — the dominant live-churn cost measured on the
+    // network tool (tool-bench 2026-07-06).
+    let rafId = null;
+    let pending = null;
+    const unsubscribe = storageEventStore.subscribeToEvents(allEvents => {
+      pending = allEvents;
+      if (rafId != null) return;
+      rafId = requestAnimationFrame(() => {
+        rafId = null;
+        if (!pending) return;
+        // Filter by storage type if specified
+        let filtered = pending;
+        pending = null;
+        if (storageType !== "all") {
+          filtered = filtered.filter(e => e.storageType === storageType);
+        }
+        // Limit events
+        if (filtered.length > maxEvents) {
+          filtered = filtered.slice(0, maxEvents);
+        }
+        setEvents(filtered);
+      });
     });
 
     // Mark as capturing after successful subscription
     setIsCapturing(true);
     return () => {
       unsubscribe();
+      if (rafId != null) cancelAnimationFrame(rafId);
       // Note: Don't set isCapturing=false here because we might be
       // re-subscribing due to dependency change, not actually stopping
     };

package/lib/module/storage/sync/storageSyncAdapter.js

@@ -5,6 +5,14 @@ import { isDevToolsStorageKey } from "@buoy-gg/shared-ui";
 import { readMany, writeMany, removeMany } from "../utils/asyncStorageCompat";
 import { storageEventStore } from "../stores/storageEventStore";
 import { clearAllAppStorage } from "../utils/clearAllStorage";
+import { mmkvInstanceRegistry } from "../utils/MMKVInstanceRegistry";
+import { detectMMKVType } from "../utils/mmkvTypeDetection";
+import { secureStoreRegistry } from "../utils/SecureStoreRegistry";
+
+/** One MMKV entry in a `mmkv.snapshot` result. */
+
+/** One MMKV instance in a `mmkv.snapshot` result. */
+
 /**
  * Sync adapter for the storage tool, consumed by @buoy-gg/external-sync's
  * `useExternalSync` (structurally matches its ToolSyncAdapter interface so
@@ -57,6 +65,80 @@ export const storageSyncAdapter = {
     "async.removeItem": params => AsyncStorage.removeItem(params.key),
     "async.multiRemove": params => removeMany(params.keys),
     "async.multiSet": params => writeMany(params.pairs),
-    "async.clear": () => AsyncStorage.clear()
+    "async.clear": () => AsyncStorage.clear(),
+    // ── Remote MMKV proxy (desktop browse mode + MCP) ──
+    // MMKV has no remote presence off-device; these read/write the registered
+    // instances so sync clients can browse them like AsyncStorage.
+    "mmkv.snapshot": () => mmkvInstanceRegistry.getAll().map(({
+      id,
+      instance,
+      encrypted,
+      readOnly
+    }) => {
+      let entries = [];
+      try {
+        entries = instance.getAllKeys().filter(key => !isDevToolsStorageKey(key)).map(key => {
+          const {
+            value,
+            type: valueType
+          } = detectMMKVType(instance, key);
+          return {
+            key,
+            value,
+            valueType
+          };
+        });
+      } catch {
+        // Instance unreadable — return it with no entries rather than failing
+      }
+      return {
+        id,
+        encrypted,
+        readOnly,
+        entries
+      };
+    }),
+    "mmkv.set": params => {
+      const {
+        instanceId,
+        key,
+        value
+      } = params;
+      mmkvInstanceRegistry.get(instanceId)?.instance.set(key, value);
+    },
+    "mmkv.remove": params => {
+      const {
+        instanceId,
+        key
+      } = params;
+      const instance = mmkvInstanceRegistry.get(instanceId)?.instance;
+      // v4 renamed delete() to remove() — support both
+      if (instance?.remove) instance.remove(key);else instance?.delete?.(key);
+    },
+    // ── Remote SecureStore proxy ──
+    // Only registered keys are known (SecureStore has no enumeration API).
+    // Biometric-protected keys are never read — reads would fire an auth prompt.
+    "secure.keys": () => secureStoreRegistry.getAll().map(({
+      key,
+      options,
+      description
+    }) => ({
+      key,
+      description,
+      keychainService: options.keychainService,
+      requireAuthentication: options.requireAuthentication ?? false
+    })),
+    "secure.get": params => {
+      const {
+        key
+      } = params;
+      const entry = secureStoreRegistry.getAll().find(e => e.key === key);
+      const module = secureStoreRegistry.getModule();
+      if (!entry || !module || entry.options.requireAuthentication) {
+        return Promise.resolve(null);
+      }
+      return module.getItemAsync(key, entry.options);
+    },
+    "secure.delete": params => secureStoreRegistry.deleteValue(params.key)
   }
 };