@chipmobilesdk/rn-notification 0.4.1 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,88 @@
 # @chipmobilesdk/rn-notification
 
+## 0.5.0
+
+### Minor Changes
+
+- Privacy (NOT-14), on top of `NotificationError` now extending `SdkError` from the new
+  `@chipmobilesdk/rn-core` dependency: ([#17](https://github.com/operationd8979/chip-mobile-sdk/pull/17))
+
+  - Text the user types into a reply action is no longer written to disk. It is held in
+    memory, so a handler registered later in the same process still receives
+    `inputText`; after process death the event arrives without it.
+  - A state snapshot reports pending entries with their content and routing values
+    reduced to their shape (`[string:12]`). Pass `verbose: () => true` to
+    `createSnapshot` to include the values while debugging.
+  - A `NotificationError`'s `context`, and every diagnostic context, also has token-,
+    URL- and e-mail-shaped strings removed under any key.
+
+- One diagnostic stream: install a sink with `installSdkSink` from
+  `@chipmobilesdk/rn-core` and it receives what every package observes (events,
+  failures, warnings) as `SdkDiagnostic`s, redacted. Listeners are notified through
+  rn-core, so a listener that throws no longer stops the others nor fails the call that
+  notified, and its error is reported rather than swallowed. ([#17](https://github.com/operationd8979/chip-mobile-sdk/pull/17))
+
+  - rn-ads: a banner's auto-refresh is a new cycle, so its `loaded` and `impression`
+    events are no longer deduplicated away; the dedupe memory is bounded. A throwing
+    status, consent or placement listener is reported as an `internal_error` event.
+  - rn-i18n: new `onDiagnostic` config receives every diagnostic (`I18nDiagnostic`,
+    with a stable `code`); without it, warnings go to `console.warn` in development
+    builds only. The warn-once memory is bounded.
+  - rn-chart: now depends on rn-core for its diagnostics.
+  - rn-payment: status, entitlement and pending listeners report a throw to the logger
+    instead of swallowing it.
+
+- Native peers load through `lazyPeer` from `@chipmobilesdk/rn-core`, on first use,
+  and a missing one is each package's own typed error. ([#17](https://github.com/operationd8979/chip-mobile-sdk/pull/17))
+
+  - rn-auth: creating `auth` no longer loads react-native-app-auth or
+    react-native-keychain; each loads on first use. New entrypoints
+    `@chipmobilesdk/rn-auth/app-auth` and `/keychain`. The default platform comes from
+    rn-core.
+  - rn-camera: a preview whose VisionCamera feed cannot load fails the session with
+    `cameraUnavailable` (new `controller.reportSurfaceUnavailable()`), instead of
+    showing black with no error. A missing VisionCamera module is `cameraUnavailable`.
+  - rn-notification: `createMmkvStore` reports a fallback to memory as
+    `STATE_STORE_DEGRADED` (to the SDK sinks and a new `onDegraded` option) and
+    exposes `durable`.
+  - rn-payment: an iOS app validates its catalog against the iOS product ids; the
+    default platform used to be Android everywhere. A missing react-native-iap is
+    `PAYMENT_UNAVAILABLE`.
+  - rn-theme: `buildThemes` runs without React Native (new `hairlineWidth` option) and
+    importing the package no longer loads Unistyles; `applyThemeMode` loads it on
+    first use.
+  - rn-ads, rn-local-db: the same loading, with the same error codes as before.
+
+- Formatters come from rn-core's cache instead of being built per call. ([#17](https://github.com/operationd8979/chip-mobile-sdk/pull/17))
+
+  - rn-notification: resolving a time zone builds one `Intl.DateTimeFormat` per zone
+    instead of one per occurrence; expanding 32 series of 32 occurrences went from
+    about 230 ms to under 30 ms on Node. Zone validity is memoized.
+  - rn-i18n: number, currency and date formatters are cached. A bad option (an unknown
+    currency such as `usd1`) goes through the invalid-format policy instead of
+    throwing out of a render, and a locale's `defaultCurrency` must be a three-letter
+    ISO 4217 code at startup.
+
+### Patch Changes
+
+- One app-lifecycle source, and a startup that needs no extra frame. ([#17](https://github.com/operationd8979/chip-mobile-sdk/pull/17))
+
+  - rn-core: `appLifecycle()`, a shared, reference-counted `AppState` subscription that
+    reports changes only (`active`, `inactive`, `background`), with `onForeground` for a
+    return from the background and `createManualLifecycle` in `./testing`.
+  - rn-camera, rn-ads and rn-notification hear the lifecycle through it instead of
+    subscribing to `AppState` each, so an app holds one native listener. The camera
+    controller's core layer no longer imports `react-native`.
+  - rn-payment: `syncOnForeground(engine)` and `<PaymentProvider syncOnForeground>` call
+    `handleForeground()` on each return from the background. Off by default; calling
+    `handleForeground()` yourself works as before.
+  - rn-i18n: `i18n.initSync()` resolves the locale before the first render when the
+    storage adapter has the new optional `getItemSync`, and returns false otherwise.
+    `localeStorageFromKeyValue(port)` builds such an adapter from rn-core's
+    `KeyValuePort` (MMKV).
+- Updated dependencies ([#17](https://github.com/operationd8979/chip-mobile-sdk/pull/17), [#17](https://github.com/operationd8979/chip-mobile-sdk/pull/17), [#17](https://github.com/operationd8979/chip-mobile-sdk/pull/17)):
+  - @chipmobilesdk/rn-core@0.1.0
+
 ## 0.4.1
 
 ### Patch Changes

package/README.md

@@ -312,6 +312,8 @@ notifications.onInteraction(async event => {
 
 One handler, identical shape in foreground, background, and cold start. Events that arrive before your handler registers are **buffered durably** — they survive process death, which is exactly what a cold-start tap is.
 
+Text the user typed into a reply action (`inputText`) is the exception: it is free text, so it is **never written to disk**. It is held in memory beside the buffer, so a handler that registers later in the same process still receives it; if the process dies first, the event is delivered without `inputText`.
+
 When the target is gone, call `reportTargetMissing()` and pick your own fallback. No platform error is ever shown to the user.
 
 ## Push
@@ -353,7 +355,7 @@ Six collections, in app-private, backup-excluded storage:
 | Permission history | 64 | — |
 | Last reconcile summary | 1 | — |
 
-**No notification content, no push token, no desired set.** The interaction buffer is the sole content-bearing exception, and it evicts on delivery.
+**No notification content, no push token, no desired set, no typed reply.** The interaction buffer is the sole content-bearing exception (its routing payload), and it evicts on delivery.
 
 Corrupt state is **discarded and rebuilt**, never blocking. What you lose: deduplication history and buffered interactions. What is unaffected: **every notification already scheduled with the OS**.
 
@@ -404,7 +406,11 @@ Delivery accuracy: within **60 s** with exact alarms; within **15 min** without,
 
 ## Diagnostic identifiers
 
-43 stable identifiers across validation, reconciliation, permissions, channels, interaction, push, state, and volume. Every one is reachable through the fault injector. See `ALL_DIAGNOSTIC_CODES`.
+`NotificationError` extends `SdkError` from `@chipmobilesdk/rn-core` (`isSdkError`, `error.pkg === 'rn-notification'`), and its `context` is redacted when the error is built: content keys become their shape, and other strings lose anything shaped like a token, URL or e-mail address.
+
+The state snapshot (`createSnapshot`) reports the pending set entry by entry, but a snapshot is what gets pasted into a bug report, so each entry's content and routing values are reduced to their shape (`[string:12]`). Pass `verbose: () => true` to include the values while debugging.
+
+45 stable identifiers across validation, reconciliation, permissions, channels, interaction, push, state, and volume. Every one is reachable through the fault injector. See `ALL_DIAGNOSTIC_CODES`.
 
 Some are **reported outcomes, not failures** — the operation succeeded and something you should know happened alongside it: `TRUNCATED_OVER_CEILING`, `EXACT_ALARM_UNAVAILABLE`, `TARGET_MISSING`, `PENDING_SET_DISCREPANCY`, `BURST_THRESHOLD_EXCEEDED`, `PAYLOAD_VERSION_SKEW`, `PAYLOAD_DUPLICATE`, `STATE_CAP_EVICTED`, `STATE_CORRUPT_REBUILT`, `DND_BYPASS_UNAVAILABLE`, `TONE_LABELS_REFRESHED`, `REPEAT_ALERT_UNAVAILABLE`, `REPEAT_STOP_HANDLER_MISSING`. Use `isNonFailure(code)`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@chipmobilesdk/rn-notification",
-	"version": "0.4.1",
+	"version": "0.5.0",
 	"private": false,
 	"license": "UNLICENSED",
 	"main": "src/index.ts",
@@ -31,9 +31,12 @@
 	],
 	"sideEffects": false,
 	"scripts": {
-		"typecheck": "tsc -p tsconfig.json --noEmit",
+		"typecheck": "tsc -p tsconfig.json && tsc -p tsconfig.test.json",
 		"pack:check": "npm pack --dry-run"
 	},
+	"dependencies": {
+		"@chipmobilesdk/rn-core": "^0.1.0"
+	},
 	"peerDependencies": {
 		"@react-native-firebase/app": ">=26.0.0",
 		"@react-native-firebase/messaging": ">=26.0.0",

package/src/contract/errors.ts

@@ -11,6 +11,10 @@
  * See `specs/009-rn-notification-package/contracts/errors.md`.
  */
 
+import { SdkError } from '@chipmobilesdk/rn-core';
+
+import { redactContext } from '../diagnostics/redact';
+
 export const DIAGNOSTIC_CODES = {
 	// --- Validation: raised before any platform call -------------------------
 	INVALID_ID_EMPTY: 'INVALID_ID_EMPTY',
@@ -66,6 +70,8 @@ export const DIAGNOSTIC_CODES = {
 	// --- Persisted state -----------------------------------------------------
 	STATE_CORRUPT_REBUILT: 'STATE_CORRUPT_REBUILT',
 	STATE_WRITE_FAILED: 'STATE_WRITE_FAILED',
+	/** The durable store could not open; state lasts for this session only. */
+	STATE_STORE_DEGRADED: 'STATE_STORE_DEGRADED',
 	STATE_CAP_EVICTED: 'STATE_CAP_EVICTED',
 
 	// --- Volume --------------------------------------------------------------
@@ -91,16 +97,18 @@ export const ALL_DIAGNOSTIC_CODES: readonly DiagnosticCode[] = Object.freeze(
  * a rule, the *shape* of the violation is reported — a length, a character
  * position — rather than the value itself.
  */
-export class NotificationError extends Error {
-	readonly code: DiagnosticCode;
+export class NotificationError extends SdkError<DiagnosticCode> {
 	readonly context?: Readonly<Record<string, unknown>>;
 
 	constructor(code: DiagnosticCode, message: string, context?: Readonly<Record<string, unknown>>) {
-		super(message);
+		super('rn-notification', code, { message });
 		this.name = 'NotificationError';
-		this.code = code;
-		this.context = context;
-		Object.setPrototypeOf(this, NotificationError.prototype);
+		// Redacted on the way in: an error object reaches crash reporters, which
+		// never run with verbose diagnostics.
+		const redacted = redactContext(context, false);
+		if (redacted !== undefined) {
+			this.context = redacted;
+		}
 	}
 }
 

package/src/diagnostics/events.ts

@@ -7,6 +7,8 @@
  * or stays silent.
  */
 
+import { createDiagnosticChannel } from '@chipmobilesdk/rn-core';
+
 import type { DiagnosticEvent, DiagnosticSeverity, EventSink } from '../contract/diagnostics';
 import type { DiagnosticCode } from '../contract/errors';
 import { isNonFailure } from '../contract/errors';
@@ -18,6 +20,8 @@ export interface EmitterOptions {
 	readonly now?: () => number;
 }
 
+const channel = createDiagnosticChannel<DiagnosticCode>('rn-notification');
+
 export class DiagnosticEmitter {
 	private sink?: EventSink;
 	private verbose: boolean;
@@ -47,12 +51,17 @@ export class DiagnosticEmitter {
 		context?: Readonly<Record<string, unknown>>,
 		severity?: DiagnosticSeverity,
 	): void {
+		const resolvedSeverity = severity ?? (isNonFailure(code) ? 'info' : 'error');
+		// The app's SDK sinks (`installSdkSink`, CORE-08) never get content, even
+		// with verbose diagnostics on: verbose is for this package's own sink.
+		channel.emit(code, resolvedSeverity, redactContext(context, false));
+
 		// No sink means no work at all — not a buffer that grows until one appears.
 		if (this.sink === undefined) return;
 
 		const event: DiagnosticEvent = {
 			code,
-			severity: severity ?? (isNonFailure(code) ? 'info' : 'error'),
+			severity: resolvedSeverity,
 			message,
 			at: this.now(),
 			context: redactContext(context, this.verbose),

package/src/diagnostics/redact.ts

@@ -10,6 +10,8 @@
  * — which is what actually helps someone debug a validation failure anyway.
  */
 
+import { createRedactor } from '@chipmobilesdk/rn-core';
+
 /** Keys whose values are never emitted at any verbosity below verbose. */
 const REDACTED_KEYS = new Set([
 	'title',
@@ -26,17 +28,12 @@ const REDACTED_KEYS = new Set([
 	'data',
 ]);
 
-const REDACTED = '[redacted]';
-
-function describe(value: unknown): string {
-	if (value === null) return '[null]';
-	if (value === undefined) return '[undefined]';
-	if (typeof value === 'string') return `[string:${value.length}]`;
-	if (typeof value === 'number' || typeof value === 'boolean') return REDACTED;
-	if (Array.isArray(value)) return `[array:${value.length}]`;
-	if (typeof value === 'object') return `[object:${Object.keys(value).length}]`;
-	return REDACTED;
-}
+/**
+ * rn-core's redactor: the keys above are replaced by their shape (a length, a
+ * type), and every other string is pattern-redacted, so a token or an e-mail
+ * address under an innocent key such as `reason` does not get through either.
+ */
+const redactor = createRedactor({ shapeKeys: REDACTED_KEYS });
 
 /**
  * Strips content values from a diagnostic context.
@@ -49,21 +46,7 @@ export function redactContext(
 	context: Readonly<Record<string, unknown>> | undefined,
 	verbose: boolean,
 ): Readonly<Record<string, unknown>> | undefined {
-	if (context === undefined) return undefined;
-	if (verbose) return context;
-
-	const walk = (value: unknown, depth: number): unknown => {
-		if (depth > 6 || value === null || typeof value !== 'object') return value;
-		if (Array.isArray(value)) return value.map(item => walk(item, depth + 1));
-
-		const output: Record<string, unknown> = {};
-		for (const [key, inner] of Object.entries(value as Record<string, unknown>)) {
-			output[key] = REDACTED_KEYS.has(key) ? describe(inner) : walk(inner, depth + 1);
-		}
-		return output;
-	};
-
-	return walk(context, 0) as Readonly<Record<string, unknown>>;
+	return verbose ? context : redactor.context(context);
 }
 
 /** True when a key would be redacted. Exported so tests can assert the policy directly. */

package/src/diagnostics/snapshot.ts

@@ -9,6 +9,8 @@
  * into a bug report.
  */
 
+import { describeShape } from '@chipmobilesdk/rn-core';
+
 import type { StateSnapshot } from '../contract/diagnostics';
 import type { PendingEntry } from '../contract/notification';
 import type { PermissionReport, RestrictionReport } from '../contract/permission';
@@ -30,6 +32,35 @@ export interface SnapshotDependencies {
 	readonly lastMaintenance: () => MaintenanceResult | undefined;
 	/** Presence only — never the value. */
 	readonly hasPushToken: () => boolean;
+	/**
+	 * Whether verbose diagnostics are on. Off (the default), pending entries carry
+	 * the shape of their content and routing (`[string:12]`), not the values.
+	 */
+	readonly verbose?: () => boolean;
+}
+
+/**
+ * A pending entry with content replaced by its shape. A snapshot is the thing
+ * most likely to be pasted into a bug report, so it never carries notification
+ * text or routing values unless verbose diagnostics is on (NOT-14).
+ */
+function withoutContent(entry: PendingEntry): PendingEntry {
+	const { content, routing } = entry;
+	return {
+		...entry,
+		content: {
+			title: describeShape(content.title),
+			body: describeShape(content.body),
+			...(content.subtitle === undefined ? {} : { subtitle: describeShape(content.subtitle) }),
+		},
+		...(routing === undefined
+			? {}
+			: {
+					routing: Object.fromEntries(
+						Object.entries(routing).map(([key, value]) => [key, describeShape(value)]),
+					),
+				}),
+	};
 }
 
 export function createSnapshot(deps: SnapshotDependencies) {
@@ -52,7 +83,9 @@ export function createSnapshot(deps: SnapshotDependencies) {
 					appliedVersion: tone.appliedVersion,
 				})),
 				pendingCount: pending.length,
-				pending: pending as readonly PendingEntry[],
+				pending: deps.verbose?.()
+					? (pending as readonly PendingEntry[])
+					: pending.map(entry => withoutContent(entry as PendingEntry)),
 				lastReconcile: deps.lastReconcile(),
 				lastMaintenance: maintenance,
 				discrepancy,

package/src/engine/notify-kit-engine.ts

@@ -11,6 +11,8 @@
  * the normal diagnostic path rather than crashing at import time.
  */
 
+import { lazyPeer } from '@chipmobilesdk/rn-core';
+
 import { Platform } from 'react-native';
 import type {
 	NotificationEngineAdapter,
@@ -164,17 +166,24 @@ function compact<T extends Record<string, unknown>>(value: T): Partial<T> {
 	return output as Partial<T>;
 }
 
-function loadEngine(): NotifyKitModule {
+const notifyKit = lazyPeer('react-native-notify-kit', () => {
+	// Inside `try`, so Metro bundles an app that leaves this optional peer out.
 	try {
-		const module = require('react-native-notify-kit') as { default: NotifyKitModule };
-		return module.default;
-	} catch (error) {
-		throw new NotificationError(
-			DIAGNOSTIC_CODES.PUSH_UNAVAILABLE,
-			'react-native-notify-kit is not installed or its native module is not linked. Install it as a peer dependency and rebuild the app.',
-			{ reason: error instanceof Error ? error.name : 'unknown' },
-		);
+		return require('react-native-notify-kit') as { default: NotifyKitModule };
+	} catch (cause) {
+		throw cause;
 	}
+});
+
+function loadEngine(): NotifyKitModule {
+	return notifyKit.require(
+		(_peer, cause) =>
+			new NotificationError(
+				DIAGNOSTIC_CODES.PUSH_UNAVAILABLE,
+				'react-native-notify-kit is not installed or its native module is not linked. Install it as a peer dependency and rebuild the app.',
+				{ reason: cause instanceof Error ? cause.name : 'unknown' },
+			),
+	).default;
 }
 
 /**

package/src/initialize.ts

@@ -15,7 +15,7 @@
  * only ran when the app invoked it by hand.
  */
 
-import { AppState } from 'react-native';
+import { appLifecycle } from '@chipmobilesdk/rn-core';
 import type { InitializeResult, NotificationConfig } from './contract/diagnostics';
 import { DEFAULT_LOOKAHEAD, LOOKAHEAD_BOUNDS, type LookaheadConfig } from './contract/recurrence';
 import type { MaintenanceResult } from './contract/reconcile';
@@ -35,11 +35,18 @@ export interface AppStateSource {
 	addEventListener(type: 'change', listener: (state: string) => void): { remove(): void };
 }
 
+/** rn-core's shared lifecycle port in the observer's shape: one native subscription for every package (PERF-07). */
+const sharedLifecycle: AppStateSource = {
+	addEventListener: (_type, listener) => ({
+		remove: appLifecycle().subscribe(state => listener(state)),
+	}),
+};
+
 export interface RuntimeDependencies {
 	readonly engine: NotificationEngineAdapter;
 	readonly store: StateStore;
 	readonly now?: () => number;
-	/** Injected in tests; defaults to React Native's `AppState`. */
+	/** Injected in tests; defaults to rn-core's shared `appLifecycle()`. */
 	readonly appState?: AppStateSource;
 	/** Injected in tests; defaults to the platform zone reader. */
 	readonly timeZone?: TimeZoneReader;
@@ -196,7 +203,7 @@ export async function initialize(
 			},
 		);
 	};
-	const subscription = (deps.appState ?? AppState).addEventListener('change', onAppState);
+	const subscription = (deps.appState ?? sharedLifecycle).addEventListener('change', onAppState);
 
 	const runtime: NotificationRuntime = {
 		engine: deps.engine,

package/src/push/fcm-provider.ts

@@ -11,6 +11,8 @@
  * not install.
  */
 
+import { lazyPeer } from '@chipmobilesdk/rn-core';
+
 import type { PushAvailability, PushProviderAdapter } from './provider-adapter';
 import type { Unsubscribe } from '../contract/interaction';
 
@@ -31,15 +33,20 @@ interface MessagingInstance {
 	isDeviceRegisteredForRemoteMessages?: boolean;
 }
 
-function loadMessaging(): MessagingModule | undefined {
+const messagingPeer = lazyPeer('@react-native-firebase/messaging', () => {
+	// Inside `try`, so Metro bundles an app that leaves this optional peer out.
 	try {
-		const module = require('@react-native-firebase/messaging') as { default: MessagingModule };
-		return module.default;
-	} catch {
-		// Absent optional peer, or missing native module. Reported as
-		// unavailability through the normal path rather than thrown at import.
-		return undefined;
+		return require('@react-native-firebase/messaging') as { default: MessagingModule };
+	} catch (cause) {
+		throw cause;
 	}
+});
+
+function loadMessaging(): MessagingModule | undefined {
+	// Absent optional peer, or missing native module: reported as unavailability
+	// through the normal path rather than thrown at import.
+	const result = messagingPeer.get();
+	return result.ok ? result.module.default : undefined;
 }
 
 export interface FcmProviderOptions {

package/src/schedule/anchor.ts

@@ -16,12 +16,27 @@
  * each entry is what makes that detectable instead of invisible.
  */
 
+import {
+	getDateTimeFormat,
+	isValidTimeZone as isZoneValid,
+	lazyPeer,
+} from '@chipmobilesdk/rn-core';
+
 import type { AnchoringMode, PendingEntry } from '../contract/notification';
 import { DEFAULT_ANCHORING_MODE } from '../contract/notification';
 
 /** Reads the platform time zone. Injected so the pure logic needs no native module. */
 export type TimeZoneReader = () => string;
 
+const localizePeer = lazyPeer('react-native-localize', () => {
+	// Inside `try`, so Metro bundles an app that leaves this optional peer out.
+	try {
+		return require('react-native-localize') as { getTimeZone(): string };
+	} catch (cause) {
+		throw cause;
+	}
+});
+
 /**
  * Resolves the platform zone via `react-native-localize`.
  *
@@ -32,9 +47,10 @@ export type TimeZoneReader = () => string;
  */
 export function createPlatformTimeZoneReader(): TimeZoneReader {
 	return () => {
+		const localize = localizePeer.get();
 		try {
-			const localize = require('react-native-localize') as { getTimeZone(): string };
-			return localize.getTimeZone();
+			if (localize.ok) return localize.module.getTimeZone();
+			return Intl.DateTimeFormat().resolvedOptions().timeZone ?? 'UTC';
 		} catch {
 			try {
 				return Intl.DateTimeFormat().resolvedOptions().timeZone ?? 'UTC';
@@ -65,15 +81,22 @@ export interface WallClockParts {
  * tone id here — so it must be checked before it reaches `Intl`.
  */
 export function isValidTimeZone(timeZone: string): boolean {
-	if (timeZone.length === 0) return false;
-	try {
-		new Intl.DateTimeFormat('en-US', { timeZone }).format(0);
-		return true;
-	} catch {
-		return false;
-	}
+	// rn-core memoizes the answer per zone: a recurrence expansion asks thousands
+	// of times about the same few zones (PERF-01).
+	return isZoneValid(timeZone);
 }
 
+/** The options `partsInZone` formats with; one shared formatter per zone. */
+const PARTS_OPTIONS = {
+	year: 'numeric',
+	month: '2-digit',
+	day: '2-digit',
+	hour: '2-digit',
+	minute: '2-digit',
+	second: '2-digit',
+	hour12: false,
+} as const;
+
 /**
  * Decomposes an instant into the clock reading it produces in a given zone.
  *
@@ -82,16 +105,9 @@ export function isValidTimeZone(timeZone: string): boolean {
  */
 export function partsInZone(instant: number, timeZone: string): WallClockParts {
 	const zone = isValidTimeZone(timeZone) ? timeZone : 'UTC';
-	const formatter = new Intl.DateTimeFormat('en-US', {
-		timeZone: zone,
-		year: 'numeric',
-		month: '2-digit',
-		day: '2-digit',
-		hour: '2-digit',
-		minute: '2-digit',
-		second: '2-digit',
-		hour12: false,
-	});
+	// Built once per zone and reused (PERF-01): constructing one per call was
+	// most of the cost of expanding a recurrence.
+	const formatter = getDateTimeFormat('en-US', { ...PARTS_OPTIONS, timeZone: zone });
 
 	const fields: Record<string, number> = {};
 	for (const part of formatter.formatToParts(new Date(instant))) {

package/src/state/interaction-buffer.ts

@@ -9,11 +9,28 @@
  * cannot be delivered without its routing payload. It is evicted the moment it
  * is delivered, and time-limited regardless, so an event nobody ever collects
  * cannot sit on disk forever.
+ *
+ * Text the user typed into a reply action is never written to disk (NOT-14): it
+ * is free text, and the store is not encrypted. It is held in memory beside the
+ * buffer, so a handler registered later in the same process still receives it;
+ * if the process dies first, the event is delivered without `inputText`.
  */
 
 import type { StateManager, BufferedInteraction } from './record';
 import type { InteractionEvent } from '../contract/interaction';
 
+/** Typed replies, in memory only, per state manager and buffered event id. */
+const typedReplies = new WeakMap<StateManager, Map<string, string>>();
+
+function repliesOf(state: StateManager): Map<string, string> {
+	let replies = typedReplies.get(state);
+	if (!replies) {
+		replies = new Map();
+		typedReplies.set(state, replies);
+	}
+	return replies;
+}
+
 /** Identity for a buffered event, derived so re-buffering cannot duplicate. */
 function bufferedId(event: InteractionEvent): string {
 	return `${event.kind}:${event.notificationId}:${event.actionId ?? ''}:${event.occurredAt}`;
@@ -21,6 +38,9 @@ function bufferedId(event: InteractionEvent): string {
 
 export function buffer(state: StateManager, event: InteractionEvent): void {
 	const id = bufferedId(event);
+	if (event.inputText !== undefined) {
+		repliesOf(state).set(id, event.inputText);
+	}
 
 	state.update('interactionBuffer', current => {
 		if (current.some(entry => entry.id === id)) return current;
@@ -31,7 +51,6 @@ export function buffer(state: StateManager, event: InteractionEvent): void {
 			kind: event.kind,
 			notificationId: event.notificationId,
 			actionId: event.actionId,
-			inputText: event.inputText,
 			routing: event.routing,
 			ownerTag: event.ownerTag,
 		};
@@ -52,12 +71,15 @@ export function drain(state: StateManager): readonly InteractionEvent[] {
 	if (buffered.length === 0) return [];
 
 	state.update('interactionBuffer', () => []);
+	const replies = repliesOf(state);
 
 	return buffered.map(entry => ({
 		kind: entry.kind,
 		notificationId: entry.notificationId,
 		actionId: entry.actionId,
-		inputText: entry.inputText,
+		// A record written before 0.5 may still carry the text on disk; it is
+		// delivered once, and the buffer was just cleared.
+		inputText: takeReply(replies, entry.id) ?? entry.inputText,
 		routing: entry.routing,
 		ownerTag: entry.ownerTag,
 		occurredAt: entry.at,
@@ -71,3 +93,9 @@ export function drain(state: StateManager): readonly InteractionEvent[] {
 export function bufferedCount(state: StateManager): number {
 	return state.read().interactionBuffer.length;
 }
+
+function takeReply(replies: Map<string, string>, id: string): string | undefined {
+	const text = replies.get(id);
+	replies.delete(id);
+	return text;
+}

package/src/state/mmkv-store.ts

@@ -16,19 +16,35 @@
  * README. It is the app's manifest, so it is the app's declaration to make.
  */
 
-import { Platform } from 'react-native';
+import {
+	createDiagnosticChannel,
+	currentPlatform,
+	lazyPeer,
+	openDurable,
+	type MmkvLike,
+} from '@chipmobilesdk/rn-core';
+
+import { DIAGNOSTIC_CODES } from '../contract/errors';
 import type { StateStore } from './store';
-import { createMemoryStore } from './store';
 
 const INSTANCE_ID = 'chipmobilesdk.notification';
 
-/** The slice of a react-native-mmkv v4 instance this store uses (v4 names). */
-interface MmkvLike {
-	getString(key: string): string | undefined;
-	set(key: string, value: string): void;
-	remove(key: string): unknown;
-	clearAll(): void;
-	getAllKeys(): string[];
+const mmkv = lazyPeer('react-native-mmkv', () => {
+	// Inside `try`, so Metro bundles an app that leaves this optional peer out.
+	try {
+		return require('react-native-mmkv') as {
+			createMMKV: (config: { id: string; path?: string }) => MmkvLike;
+		};
+	} catch (cause) {
+		throw cause;
+	}
+});
+
+const channel = createDiagnosticChannel('rn-notification');
+
+export interface MmkvStoreOptions {
+	/** Told once, with the reason, when the store falls back to memory. */
+	readonly onDegraded?: (cause: unknown) => void;
 }
 
 /**
@@ -36,40 +52,41 @@ interface MmkvLike {
  *
  * The fallback is deliberate: a missing optional native module degrades
  * deduplication and cold-start buffering to session scope, which is a
- * documented degradation. It must never stop notifications being delivered.
+ * documented degradation. It must never stop notifications being delivered, and
+ * it is never silent (NOT-15): it reports `STATE_STORE_DEGRADED` to the app's SDK
+ * sinks and to `onDegraded`, and the store reports `durable: false`.
  */
-export function createMmkvStore(): StateStore {
-	let instance: MmkvLike;
-
-	try {
-		// Required lazily so the package loads in environments without the native module.
-		// v4's factory: up to 0.2.0 this called the v3 `new MMKV()`, which v4 — the
-		// only major the peer range allows — no longer exports as a value, so every
-		// device silently got the session-scoped memory store.
-		const { createMMKV } = require('react-native-mmkv') as {
-			createMMKV: (config: { id: string; path?: string }) => MmkvLike;
-		};
-
-		instance = createMMKV({
-			id: INSTANCE_ID,
-			// Caches is backup-excluded by platform design; see the note above.
-			path: Platform.OS === 'ios' ? 'Library/Caches/chipmobilesdk-notification' : undefined,
-		});
-	} catch {
-		return createMemoryStore();
-	}
-
+export function createMmkvStore(options: MmkvStoreOptions = {}): StateStore {
+	const port = openDurable(
+		() =>
+			// v4's factory: up to 0.2.0 this called the v3 `new MMKV()`, which v4 no
+			// longer exports as a value, so every device silently got memory.
+			mmkv
+				.require(peer => new Error(`${peer} is not installed`))
+				.createMMKV({
+					id: INSTANCE_ID,
+					// Caches is backup-excluded by platform design; see the note above.
+					...(currentPlatform() === 'ios'
+						? { path: 'Library/Caches/chipmobilesdk-notification' }
+						: {}),
+				}),
+		cause => {
+			channel.emit(DIAGNOSTIC_CODES.STATE_STORE_DEGRADED, 'warn');
+			options.onDegraded?.(cause);
+		},
+	);
 	return {
-		getString: key => instance.getString(key),
-		setString: (key, value) => instance.set(key, value),
-		delete: key => instance.remove(key),
-		clearAll: () => instance.clearAll(),
+		getString: key => port.getString(key),
+		setString: (key, value) => port.set(key, value),
+		delete: key => port.remove(key),
+		clearAll: () => port.clearAll(),
 		approximateBytes: () => {
 			let total = 0;
-			for (const key of instance.getAllKeys()) {
-				total += key.length + (instance.getString(key)?.length ?? 0);
+			for (const key of port.keys()) {
+				total += key.length + (port.getString(key)?.length ?? 0);
 			}
 			return total;
 		},
+		durable: port.durable,
 	};
 }

package/src/state/record.ts

@@ -35,6 +35,10 @@ export interface BufferedInteraction extends Timestamped {
 	readonly kind: 'tap' | 'action' | 'dismiss';
 	readonly notificationId: string;
 	readonly actionId?: string;
+	/**
+	 * Only ever present in a record written before 0.5: typed replies are no
+	 * longer persisted (interaction-buffer.ts).
+	 */
 	readonly inputText?: string;
 	/** The one content-bearing thing persisted. Evicted the moment it is delivered. */
 	readonly routing?: RoutingPayload;

package/src/state/store.ts

@@ -13,6 +13,8 @@ export interface StateStore {
 	clearAll(): void;
 	/** Approximate on-disk size, for the health report. */
 	approximateBytes(): number;
+	/** False when writes do not survive a restart (the memory fallback). */
+	readonly durable?: boolean;
 }
 
 /** In-memory store, used by tests and as the fallback when MMKV is unavailable. */
@@ -36,5 +38,6 @@ export function createMemoryStore(): StateStore {
 			}
 			return total;
 		},
+		durable: false,
 	};
 }