@chipmobilesdk/rn-auth 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -1,113 +1,239 @@
-# Changelog
-
-All notable changes to `@chipmobilesdk/rn-auth` are documented here. This project
-adheres to [Semantic Versioning](https://semver.org/).
-
-## [0.3.0] - 2026-11-01
-
-Minor release fixing session integrity. Two type changes can need a one-line code
-change (see Changed): `signOutGlobal()` resolves to a result instead of `void`, and
-`OidcTokens.refreshToken` / `idToken` are optional.
-
-### Fixed
-
-- **A sign-out during a token refresh no longer revives the session.** The refresh
-  wrote its refresh token back into memory and set the state to `authenticated`
-  after the sign-out. Every session start and end now bumps a session generation,
-  and work that crossed one is discarded.
-- **Rotated refresh tokens are persisted.** A rotation only reached memory, so a
-  restart came back with a token the provider may already have retired. Concurrent
-  `requestAccessToken` calls for one resource now share one network refresh, and a
-  cache hit no longer flashes `token-refreshing`.
-- **Restore deletes the stored session only on an `invalid_grant` verdict.** Any
-  error other than a recognised network failure used to delete it, so a timeout or a
-  5xx signed users out. Errors are classified by OAuth and AADSTS codes in an ordered
-  table (`oidc/classifyError.ts`) instead of loose substrings; unclassified errors
-  restore `offline`.
-- **Restore no longer stays `loading`** when the Keychain write fails, and keeps the
-  stored profile when a refresh returns no id token.
-- **Sign-in commits only what it stored.** A failed Keychain write left a refresh
-  token in memory under an `error` state; an authorize without a refresh token now
-  reports a developer-facing `configuration-error` instead of a session that never
-  survives a restart.
-- **`signOutGlobal()` sends the id token hint** and reports a failed end-session
-  instead of swallowing it.
-- **A throwing state listener no longer turns a completed sign-in into an error.**
-- **The development-only `console.warn` of the raw native error is removed.** It
-  bypassed redaction.
-
-### Changed
-
-- `signOutGlobal()` resolves to `GlobalSignOutResult` (`{ global: 'ended' | 'failed',
-  error? }`) instead of `void`.
-- `OidcTokens.refreshToken` and `OidcTokens.idToken` are optional; a provider that
-  omits them is reported as absent rather than as an empty string. The persisted
-  session artifact gains an optional `idToken`; artifacts written by 0.2.1 still
-  restore.
-
-## [0.2.0] - 2026-06-30
-
-Add Facebook as a social sign-in provider (additive, backward compatible).
-
-### Added
-
-- `'facebook'` is now a valid `ProviderId`. Facebook is federated inside the
-  Entra External ID tenant like Google/Apple and routed with `domain_hint`
-  (`facebook.com`) — no native Facebook SDK and no new dependency.
-- `auth.action.continueFacebook` message key with English default
-  `'Continue with Facebook'`.
-- `Auth.getPlatformProviders()` and the `useSignInProviders()` hook return all
-  available providers for the current platform in configuration order, so a
-  platform can present multiple sign-in buttons (e.g. Google + Facebook).
-
-### Changed
-
-- `defaultProviderForPlatform` / `getPlatformProvider()` / `useSignInProvider()`
-  now return the first available provider in configuration order. Behavior is
-  unchanged for existing single-provider (Google/Apple-only) configurations.
-
-### Notes
-
-- Backward compatible: apps that do not configure Facebook observe no change.
-- Adoption: add `{ id: 'facebook', platforms: ['ios','android'], domainHint:
-  'facebook.com', labelKey: 'auth.action.continueFacebook' }` to `providers`,
-  federate Facebook in the tenant, and render `useSignInProviders()` for the
-  multi-button experience. See the README and
-  `specs/004-facebook-auth-provider/`.
-- iOS: offering Facebook (a third-party login) requires Sign in with Apple to
-  remain available (Apple guideline 4.8) — it does. Update Apple App Privacy and
-  Google Play Data Safety to add Facebook before release.
-
-## [0.1.0] - 2026-06-24
-
-Initial release of the reusable Microsoft Entra External ID auth library.
-
-### Added
-
-- `createAuth(config, options?)` controller with a single active account: sign-in,
-  session restore, local `signOut()` and global `signOutGlobal()`, per-resource
-  `requestAccessToken()`, `getAccessTier()`, and a `requirePremium()` gate.
-- `AuthProvider` plus `useAuth`, `useProfile`, `useAccessTier`, `useAccessToken`,
-  and `useSignInProvider` hooks.
-- Injectable ports `OidcAuthClient` and `SecureTokenStore`, with default adapters
-  `createAppAuthClient()` (react-native-app-auth, PKCE public client) and
-  `createKeychainSecureStore()` (react-native-keychain).
-- Social routing via per-provider `domain_hint` (Google on Android, Apple on iOS),
-  with Google/Apple federated inside the tenant — no native social SDK required.
-- Access-tier evaluation (`evaluateAccessTier`) that prefers stable group object
-  ids, ignores display names, and fails closed on missing/stale/overage claims.
-- Token + refresh persistence restricted to platform secure storage; access
-  tokens cached in memory with silent refresh.
-- Stable user-facing message keys with English defaults (`DEFAULT_MESSAGES`),
-  no i18n runtime dependency.
-- Diagnostics (`AuthError`/`AuthConfigError`) with secret/token redaction.
-
-### Notes
-
-- New package; no migration required. Adoption notes and the tenant/provider
-  prerequisite checklist are in the README.
-- Native redirect configuration and on-device provider flows must be validated
-  per `specs/003-mobile-entra-auth/contracts/native-setup.md` (the R8 spike).
-
-[0.2.0]: #
-[0.1.0]: #
+# @chipmobilesdk/rn-auth
+
+## 0.4.0
+
+### Minor Changes
+
+- One diagnostic stream: install a sink with `installSdkSink` from
+  `@chipmobilesdk/rn-core` and it receives what every package observes (events,
+  failures, warnings) as `SdkDiagnostic`s, redacted. Listeners are notified through
+  rn-core, so a listener that throws no longer stops the others nor fails the call that
+  notified, and its error is reported rather than swallowed. ([#17](https://github.com/operationd8979/chip-mobile-sdk/pull/17))
+
+  - rn-ads: a banner's auto-refresh is a new cycle, so its `loaded` and `impression`
+    events are no longer deduplicated away; the dedupe memory is bounded. A throwing
+    status, consent or placement listener is reported as an `internal_error` event.
+  - rn-i18n: new `onDiagnostic` config receives every diagnostic (`I18nDiagnostic`,
+    with a stable `code`); without it, warnings go to `console.warn` in development
+    builds only. The warn-once memory is bounded.
+  - rn-chart: now depends on rn-core for its diagnostics.
+  - rn-payment: status, entitlement and pending listeners report a throw to the logger
+    instead of swallowing it.
+
+- The package's errors extend `SdkError` from the new `@chipmobilesdk/rn-core`
+  dependency: `isSdkError` recognises them alongside every other package's, and each
+  carries `pkg`, `code` and `retryable`. Names and codes are unchanged. ([#17](https://github.com/operationd8979/chip-mobile-sdk/pull/17))
+
+  - rn-ai and rn-camera: `retryable` is the new name of `recoverable`, which stays as a
+    deprecated alias.
+  - rn-auth: `retryable` is true for `network-unavailable`. `redact` also removes URLs,
+    e-mail addresses and UUIDs.
+  - rn-ads: `redact` also removes JWTs and e-mail addresses, and reduces an `AdsError`
+    to its code.
+  - rn-ai: an error message quoted from the gateway is pattern-redacted.
+  - rn-camera: `redact` also removes JWTs, e-mail addresses and UUIDs.
+  - rn-theme: `ThemeConfigError` has `code: 'invalid_config'` and `ThemeContrastError`
+    `code: 'contrast'` (new `ThemeErrorCode` type).
+  - rn-i18n: `I18nConfigError` has `code: 'invalid_config'` and `UnitConversionError`
+    `code: 'unit_conversion'` (new `I18nErrorCode` type).
+
+- Native peers load through `lazyPeer` from `@chipmobilesdk/rn-core`, on first use,
+  and a missing one is each package's own typed error. ([#17](https://github.com/operationd8979/chip-mobile-sdk/pull/17))
+
+  - rn-auth: creating `auth` no longer loads react-native-app-auth or
+    react-native-keychain; each loads on first use. New entrypoints
+    `@chipmobilesdk/rn-auth/app-auth` and `/keychain`. The default platform comes from
+    rn-core.
+  - rn-camera: a preview whose VisionCamera feed cannot load fails the session with
+    `cameraUnavailable` (new `controller.reportSurfaceUnavailable()`), instead of
+    showing black with no error. A missing VisionCamera module is `cameraUnavailable`.
+  - rn-notification: `createMmkvStore` reports a fallback to memory as
+    `STATE_STORE_DEGRADED` (to the SDK sinks and a new `onDegraded` option) and
+    exposes `durable`.
+  - rn-payment: an iOS app validates its catalog against the iOS product ids; the
+    default platform used to be Android everywhere. A missing react-native-iap is
+    `PAYMENT_UNAVAILABLE`.
+  - rn-theme: `buildThemes` runs without React Native (new `hairlineWidth` option) and
+    importing the package no longer loads Unistyles; `applyThemeMode` loads it on
+    first use.
+  - rn-ads, rn-local-db: the same loading, with the same error codes as before.
+
+- Hooks read through `useSyncExternalStore` (rn-core's `useExternalStore`) and
+  re-render only when what they return changes. ([#17](https://github.com/operationd8979/chip-mobile-sdk/pull/17))
+
+  - rn-auth: `useProfile` and `useAccessTier` no longer re-render for a status change,
+    and the provider's context no longer changes on every transition. New
+    `useAuthSelector`. `auth.getState()` returns the same frozen object until the state
+    changes, instead of a copy per call.
+  - rn-payment: `useEntitlement` re-renders only when its own entitlement changes; the
+    engine keeps unchanged entitlement objects across syncs and does not notify for a
+    sync that changed nothing.
+  - rn-ads: `usePlacementState` and `useAdsStatus` read tear-free; `useAdsEvents` keeps
+    one subscription when given an inline listener.
+  - rn-i18n: `useTranslation` returns the same `t` until the locale changes, and
+    `useLocale`'s `setLocale` is stable.
+  - rn-ai: new `useAiBehaviorState`, with `client.subscribe` and a stable
+    `client.getBehaviorState()`.
+
+- Every package's own copy is an rn-core message catalog that an app can translate. ([#17](https://github.com/operationd8979/chip-mobile-sdk/pull/17))
+
+  - rn-i18n: new `runtimeEntriesFromCatalog(catalog)` registers any SDK catalog in one
+    line, converting `{name}` variables to `{{name}}`.
+  - rn-ai: new `messageKeyForError(error)` gives the copy for every error code, and
+    `aiMessageSet`. The input placeholder default is neutral ("Type a message…"), and
+    two keys were added for errors that had none (`ai.error.signIn`, `ai.error.generic`).
+  - rn-auth: new `authMessages`, the catalog split into user and developer copy.
+  - rn-payment: new `paymentMessages`.
+  - rn-chart: summaries, announcements, adjustable-action labels, built-in state text
+    and legend hints come from `chartStrings`; pass `strings` to translate them. The
+    `accessibility.summaryFormatter` prop, declared before, now replaces the summary.
+
+- Port conformance suites: one list of checks that a package's fake and its real adapter
+  both pass, so a test written against the fake proves something about the device. ([#17](https://github.com/operationd8979/chip-mobile-sdk/pull/17))
+
+  - rn-core: `@chipmobilesdk/rn-core/testing` adds `runChecks`, `expectConformance`,
+    `ensure` and `createFaultRegistry` (deterministic fault injection by named point).
+  - rn-camera: a `./testing` entrypoint with `runPermissionPortConformance`,
+    `runCameraEngineConformance` and the test adapter, which stays on the main
+    entrypoint too until the next major. `createTestCamera(...).prompts()` counts system
+    prompts.
+  - rn-payment: `runProviderPortConformance` in `./testing`, passed by the fake store and
+    the Play adapter.
+  - rn-ads: `runAdsEngineConformance` in `./testing`, passed by the fake engine and the
+    AdMob adapter.
+  - rn-auth: a `./testing` entrypoint with `createMemorySecureStore`,
+    `runSecureTokenStoreConformance` and `runOidcAuthClientConformance`, passed by the
+    in-memory doubles and the keychain and app-auth adapters.
+
+### Patch Changes
+
+- Optional properties in the public types (`AuthState`, `Profile`, `UseAccessTokenResult`
+  and others) now accept an explicit `undefined`, so apps compiling with
+  `exactOptionalPropertyTypes` type-check against the package. No runtime change. ([#17](https://github.com/operationd8979/chip-mobile-sdk/pull/17))
+- Updated dependencies ([#17](https://github.com/operationd8979/chip-mobile-sdk/pull/17), [#17](https://github.com/operationd8979/chip-mobile-sdk/pull/17), [#17](https://github.com/operationd8979/chip-mobile-sdk/pull/17)):
+  - @chipmobilesdk/rn-core@0.1.0
+
+## 0.3.1
+
+### Patch Changes
+
+- Packaging only; no code change. The package no longer declares `engines.node`: a
+  React Native package does not run on Node, so the field only produced install
+  warnings in apps on another Node version. rn-i18n's command-line tooling does run
+  on Node; its README's compatibility table states the version it needs. ([#14](https://github.com/operationd8979/chip-mobile-sdk/pull/14))
+
+## [0.3.0] - 2026-11-01
+
+Minor release fixing session integrity. Two type changes can need a one-line code
+change (see Changed): `signOutGlobal()` resolves to a result instead of `void`, and
+`OidcTokens.refreshToken` / `idToken` are optional.
+
+### Fixed
+
+- **A sign-out during a token refresh no longer revives the session.** The refresh
+  wrote its refresh token back into memory and set the state to `authenticated`
+  after the sign-out. Every session start and end now bumps a session generation,
+  and work that crossed one is discarded.
+- **Rotated refresh tokens are persisted.** A rotation only reached memory, so a
+  restart came back with a token the provider may already have retired. Concurrent
+  `requestAccessToken` calls for one resource now share one network refresh, and a
+  cache hit no longer flashes `token-refreshing`.
+- **Restore deletes the stored session only on an `invalid_grant` verdict.** Any
+  error other than a recognised network failure used to delete it, so a timeout or a
+  5xx signed users out. Errors are classified by OAuth and AADSTS codes in an ordered
+  table (`oidc/classifyError.ts`) instead of loose substrings; unclassified errors
+  restore `offline`.
+- **Restore no longer stays `loading`** when the Keychain write fails, and keeps the
+  stored profile when a refresh returns no id token.
+- **Sign-in commits only what it stored.** A failed Keychain write left a refresh
+  token in memory under an `error` state; an authorize without a refresh token now
+  reports a developer-facing `configuration-error` instead of a session that never
+  survives a restart.
+- **`signOutGlobal()` sends the id token hint** and reports a failed end-session
+  instead of swallowing it.
+- **A throwing state listener no longer turns a completed sign-in into an error.**
+- **The development-only `console.warn` of the raw native error is removed.** It
+  bypassed redaction.
+
+### Changed
+
+- `signOutGlobal()` resolves to `GlobalSignOutResult` (`{ global: 'ended' | 'failed',
+  error? }`) instead of `void`.
+- `OidcTokens.refreshToken` and `OidcTokens.idToken` are optional; a provider that
+  omits them is reported as absent rather than as an empty string. The persisted
+  session artifact gains an optional `idToken`; artifacts written by 0.2.1 still
+  restore.
+
+## [0.2.1] - 2026-08-01
+
+### Changed
+
+- The package now ships its agent skill (`skills/`), which consuming apps
+  copy in with `scripts/sync-sdk-skills.mjs`. No code change.
+
+## [0.2.0] - 2026-06-30
+
+Add Facebook as a social sign-in provider (additive, backward compatible).
+
+### Added
+
+- `'facebook'` is now a valid `ProviderId`. Facebook is federated inside the
+  Entra External ID tenant like Google/Apple and routed with `domain_hint`
+  (`facebook.com`) — no native Facebook SDK and no new dependency.
+- `auth.action.continueFacebook` message key with English default
+  `'Continue with Facebook'`.
+- `Auth.getPlatformProviders()` and the `useSignInProviders()` hook return all
+  available providers for the current platform in configuration order, so a
+  platform can present multiple sign-in buttons (e.g. Google + Facebook).
+
+### Changed
+
+- `defaultProviderForPlatform` / `getPlatformProvider()` / `useSignInProvider()`
+  now return the first available provider in configuration order. Behavior is
+  unchanged for existing single-provider (Google/Apple-only) configurations.
+
+### Notes
+
+- Backward compatible: apps that do not configure Facebook observe no change.
+- Adoption: add `{ id: 'facebook', platforms: ['ios','android'], domainHint:
+  'facebook.com', labelKey: 'auth.action.continueFacebook' }` to `providers`,
+  federate Facebook in the tenant, and render `useSignInProviders()` for the
+  multi-button experience. See the README and
+  `specs/004-facebook-auth-provider/`.
+- iOS: offering Facebook (a third-party login) requires Sign in with Apple to
+  remain available (Apple guideline 4.8) — it does. Update Apple App Privacy and
+  Google Play Data Safety to add Facebook before release.
+
+## [0.1.0] - 2026-06-24
+
+Initial release of the reusable Microsoft Entra External ID auth library.
+
+### Added
+
+- `createAuth(config, options?)` controller with a single active account: sign-in,
+  session restore, local `signOut()` and global `signOutGlobal()`, per-resource
+  `requestAccessToken()`, `getAccessTier()`, and a `requirePremium()` gate.
+- `AuthProvider` plus `useAuth`, `useProfile`, `useAccessTier`, `useAccessToken`,
+  and `useSignInProvider` hooks.
+- Injectable ports `OidcAuthClient` and `SecureTokenStore`, with default adapters
+  `createAppAuthClient()` (react-native-app-auth, PKCE public client) and
+  `createKeychainSecureStore()` (react-native-keychain).
+- Social routing via per-provider `domain_hint` (Google on Android, Apple on iOS),
+  with Google/Apple federated inside the tenant — no native social SDK required.
+- Access-tier evaluation (`evaluateAccessTier`) that prefers stable group object
+  ids, ignores display names, and fails closed on missing/stale/overage claims.
+- Token + refresh persistence restricted to platform secure storage; access
+  tokens cached in memory with silent refresh.
+- Stable user-facing message keys with English defaults (`DEFAULT_MESSAGES`),
+  no i18n runtime dependency.
+- Diagnostics (`AuthError`/`AuthConfigError`) with secret/token redaction.
+
+### Notes
+
+- New package; no migration required. Adoption notes and the tenant/provider
+  prerequisite checklist are in the README.
+- Native redirect configuration and on-device provider flows must be validated
+  per `specs/003-mobile-entra-auth/contracts/native-setup.md` (the R8 spike).
+
+[0.2.0]: #
+[0.1.0]: #