@lowdefy/shell 0.0.0-experimental-20261019052246

package/src/auth/getSheetReturnUrl.js

@@ -0,0 +1,35 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+/**
+ * Where the sign-in sheet returns to the shell with its one-time token: on iOS the shell's scheme,
+ * <scheme>://auth, which ASWebAuthenticationSession hands only to the app that opened the sheet;
+ * on Android the app's https app link, <app url>/auth/mobile/callback, which Android opens only in
+ * the shell the app's assetlinks.json names (app.config.ts declares it, authCallbackIntentFilters).
+ *
+ * @param {Object} params
+ * @param {string} params.apiBase The app server's URL.
+ * @param {'ios'|'android'} params.platform
+ * @param {{ scheme }} params.shell The shell config.
+ */
+function getSheetReturnUrl({ apiBase, platform, shell }) {
+  if (platform === 'android') {
+    return `${apiBase.replace(/\/$/, '')}/auth/mobile/callback`;
+  }
+  return `${shell.scheme}://auth`;
+}
+
+export default getSheetReturnUrl;

package/src/auth/getTokenStoreOptions.js

@@ -0,0 +1,46 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import * as SecureStore from 'expo-secure-store';
+
+/**
+ * How the session token is kept in the Keychain or Keystore: on this device only, never in a
+ * backup.
+ *
+ * - A shell with background work (location reports while the phone is locked) keeps it readable
+ *   after the phone's first unlock, so its background task can call the server. Biometrics then
+ *   guard the screens only.
+ * - Any other shell keeps it readable only while the phone is unlocked, and, with biometric
+ *   unlock, behind Face ID or a fingerprint: reading it is the unlock prompt. A change to the
+ *   phone's biometrics makes it unreadable, and the person signs in again.
+ *
+ * A protected item is read and deleted with the same requireAuthentication it was written with.
+ */
+function getTokenStoreOptions({ background, biometric }) {
+  if (background) {
+    return { keychainAccessible: SecureStore.AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY };
+  }
+  if (biometric) {
+    return {
+      keychainAccessible: SecureStore.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
+      requireAuthentication: true,
+      authenticationPrompt: 'Unlock to continue',
+    };
+  }
+  return { keychainAccessible: SecureStore.WHEN_UNLOCKED_THIS_DEVICE_ONLY };
+}
+
+export default getTokenStoreOptions;

package/src/auth/isBackgroundShell.js

@@ -0,0 +1,26 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// The shell profile that reports location in the background (shell.json `profile`). Its
+// background task calls the server while the phone is locked, so its session token must stay
+// readable then, and biometrics guard only its screens.
+const BACKGROUND_PROFILES = ['field-tracking'];
+
+function isBackgroundShell(shell) {
+  return BACKGROUND_PROFILES.includes(shell.profile);
+}
+
+export default isBackgroundShell;

package/src/auth/isSheetReturnLink.js

@@ -0,0 +1,35 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// The link without its query or fragment. React Native's URL has no working pathname, so the
+// link is cut by hand, as parseQuery reads its query.
+function stripQuery(link) {
+  const end = link.search(/[?#]/);
+  return end === -1 ? link : link.slice(0, end);
+}
+
+/**
+ * Whether a link the router is opening is the sign-in sheet's return: the Android app link
+ * <app url>/auth/mobile/callback (getSheetReturnUrl). signInWithSheet reads it from the sheet's
+ * result, so the router must not open it as a page: its query holds the one-time token.
+ *
+ * @param {string} link The URL, or the path, Expo Router received.
+ */
+function isSheetReturnLink(link) {
+  return /^(https:\/\/[^/]+)?(\/.*)?\/auth\/mobile\/callback\/?$/.test(stripQuery(link));
+}
+
+export default isSheetReturnLink;

package/src/auth/parseQuery.js

@@ -0,0 +1,39 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// The query of a URL as { name: value }. React Native's URL has no working searchParams, and the
+// sheet's redirect URL is a custom scheme.
+function parseQuery(url) {
+  const start = url.indexOf('?');
+  if (start === -1) {
+    return {};
+  }
+  const end = url.indexOf('#', start);
+  const query = url.slice(start + 1, end === -1 ? undefined : end);
+  const params = {};
+  query
+    .split('&')
+    .filter((part) => part.length > 0)
+    .forEach((part) => {
+      const separator = part.indexOf('=');
+      const name = separator === -1 ? part : part.slice(0, separator);
+      const value = separator === -1 ? '' : part.slice(separator + 1);
+      params[decodeURIComponent(name)] = decodeURIComponent(value.replace(/\+/g, ' '));
+    });
+  return params;
+}
+
+export default parseQuery;

package/src/auth/purgeAppData.js

@@ -0,0 +1,45 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { appStorageKey } from '@lowdefy/helpers';
+
+import getLastCacheKeyName from '../cache/getLastCacheKeyName.js';
+
+/**
+ * Removes everything the shell keeps for one app's signed-in person: the session token, every
+ * cached root and page of the app (all its callers), the last cache key, and the person's keys in
+ * the device store (SetLocalStorage's user keys, which the core puts under one prefix per app).
+ * Device preferences stay. Nothing a person saw outlives their sign-out.
+ *
+ * @param {Object} params
+ * @param {string} params.appId The app.
+ * @param {Object} params.cacheStore The page cache.
+ * @param {{ keys, remove }} params.kv The device store.
+ * @param {string|null} params.slug The app's slug (lowdefyApp.slug), which names its storage keys.
+ * @param {{ clear }} params.tokenStore The session token store.
+ */
+async function purgeAppData({ appId, cacheStore, kv, slug, tokenStore }) {
+  await tokenStore.clear();
+  await cacheStore.removeApp({ appId });
+  kv.remove(getLastCacheKeyName(appId));
+  // The shell renders every page with basePath '' (PageScreen).
+  const userPrefix = appStorageKey({ basePath: '', name: 'lowdefy_user:', slug });
+  kv.keys()
+    .filter((key) => key.startsWith(userPrefix))
+    .forEach((key) => kv.remove(key));
+}
+
+export default purgeAppData;

package/src/auth/shouldLock.js

@@ -0,0 +1,26 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// Whether the app locks on coming back: it was in the background for unlockAfter seconds or
+// longer. backgroundedAt is null when it never left.
+function shouldLock({ backgroundedAt, now, unlockAfter }) {
+  if (backgroundedAt === null) {
+    return false;
+  }
+  return now - backgroundedAt >= unlockAfter * 1000;
+}
+
+export default shouldLock;

package/src/auth/signInWithSheet.js

@@ -0,0 +1,97 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import * as Crypto from 'expo-crypto';
+import * as WebBrowser from 'expo-web-browser';
+import { Platform } from 'react-native';
+import { createPkceChallenge } from '@lowdefy/client-core';
+
+import getSheetReturnUrl from './getSheetReturnUrl.js';
+import parseQuery from './parseQuery.js';
+
+const VERIFIER_BYTES = 64;
+
+function sha256(data) {
+  return Crypto.digest(Crypto.CryptoDigestAlgorithm.SHA256, data);
+}
+
+/**
+ * Signs in through the app's own sign-in page in a system sheet: every method the web app offers
+ * (passkeys, SSO, magic links, a second factor).
+ *
+ * - The sheet opens /auth/mobile with a random state, a PKCE S256 challenge and the platform. On
+ *   iOS it is ephemeral (no cookies shared with Safari).
+ * - Once the person is signed in, the page asks them to confirm. On Continue the server returns a
+ *   one-time token for a new phone session, bound to the challenge: on iOS to
+ *   <scheme>://auth?token=&state=, which ASWebAuthenticationSession hands only to this app; on
+ *   Android to the verified app link <app url>/auth/mobile/callback?token=&state=, which Android
+ *   opens only in this shell (getSheetReturnUrl).
+ * - The shell checks state is its own, then exchanges the token with the code verifier for the
+ *   session token. A return with another state is refused, so a link this sign-in did not start is
+ *   never exchanged. The verifier lives in this call only: it is in no URL and never stored.
+ *
+ * Returns { status }: `signedIn`, `cancelled` (the person closed the sheet or pressed Cancel) or
+ * `failed`.
+ *
+ * @param {Object} params
+ * @param {string} params.apiBase The app server's URL.
+ * @param {Object} params.authApi createAuthApi.
+ * @param {{ id, scheme }} params.shell The shell config.
+ */
+async function signInWithSheet({ apiBase, authApi, shell }) {
+  const state = Crypto.randomUUID();
+  const { codeVerifier, codeChallenge, codeChallengeMethod } = await createPkceChallenge({
+    verifierBytes: Crypto.getRandomBytes(VERIFIER_BYTES),
+    sha256,
+  });
+  const platform = Platform.OS === 'android' ? 'android' : 'ios';
+  const query = [
+    ['shell', shell.id],
+    ['state', state],
+    ['code_challenge', codeChallenge],
+    ['code_challenge_method', codeChallengeMethod],
+    ['platform', platform],
+  ]
+    .map(([name, value]) => `${name}=${encodeURIComponent(value)}`)
+    .join('&');
+  const returnUrl = getSheetReturnUrl({ apiBase, platform, shell });
+  const result = await WebBrowser.openAuthSessionAsync(
+    `${apiBase}/auth/mobile?${query}`,
+    returnUrl,
+    {
+      preferEphemeralSession: true,
+    }
+  );
+  if (result.type !== 'success') {
+    return { status: 'cancelled' };
+  }
+  if (!result.url.startsWith(returnUrl)) {
+    return { status: 'failed' };
+  }
+  const params = parseQuery(result.url);
+  if (params.state !== state) {
+    return { status: 'failed' };
+  }
+  if (params.error === 'cancelled') {
+    return { status: 'cancelled' };
+  }
+  if (!params.token) {
+    return { status: 'failed' };
+  }
+  return authApi.exchangeToken({ token: params.token, codeVerifier });
+}
+
+export default signInWithSheet;

package/src/auth/signInWithSheet.test.js

@@ -0,0 +1,205 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { createHash } from 'node:crypto';
+import { jest } from '@jest/globals';
+import { Platform } from 'react-native';
+
+import getSheetReturnUrl from './getSheetReturnUrl.js';
+import isSheetReturnLink from './isSheetReturnLink.js';
+import parseQuery from './parseQuery.js';
+import signInWithSheet from './signInWithSheet.js';
+
+jest.mock('expo-crypto', () => {
+  const nodeCrypto = jest.requireActual('node:crypto');
+  return {
+    CryptoDigestAlgorithm: { SHA256: 'SHA-256' },
+    digest: jest.fn(async (algorithm, data) =>
+      nodeCrypto.createHash('sha256').update(data).digest()
+    ),
+    getRandomBytes: jest.fn((count) => new Uint8Array(nodeCrypto.randomBytes(count))),
+    randomUUID: jest.fn(() => 'state-1'),
+  };
+});
+
+jest.mock('expo-web-browser', () => ({ openAuthSessionAsync: jest.fn() }));
+
+const WebBrowser = jest.requireMock('expo-web-browser');
+
+const apiBase = 'https://field.example.com';
+const shell = { id: 'field', scheme: 'com.example.field' };
+
+function base64Url(buffer) {
+  return Buffer.from(buffer).toString('base64url');
+}
+
+function createAuthApi() {
+  return { exchangeToken: jest.fn(async () => ({ status: 'signedIn' })) };
+}
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+function onAndroid() {
+  jest.replaceProperty(Platform, 'OS', 'android');
+}
+
+test('the sheet opens /auth/mobile ephemeral, with the shell, a state, an S256 challenge and the platform', async () => {
+  WebBrowser.openAuthSessionAsync.mockResolvedValue({
+    type: 'success',
+    url: 'com.example.field://auth?token=ott-1&state=state-1',
+  });
+  const authApi = createAuthApi();
+  expect(await signInWithSheet({ apiBase, authApi, shell })).toEqual({ status: 'signedIn' });
+  const [url, redirectUrl, options] = WebBrowser.openAuthSessionAsync.mock.calls[0];
+  expect(url.startsWith(`${apiBase}/auth/mobile?`)).toBe(true);
+  const query = parseQuery(url);
+  expect(query.shell).toBe('field');
+  expect(query.state).toBe('state-1');
+  expect(query.code_challenge_method).toBe('S256');
+  expect(query.code_challenge).toMatch(/^[A-Za-z0-9_-]{43}$/);
+  expect(query.platform).toBe('ios');
+  expect(redirectUrl).toBe('com.example.field://auth');
+  expect(options).toEqual({ preferEphemeralSession: true });
+
+  // The verifier goes only to the exchange, and it is the one the challenge was made from.
+  const { token, codeVerifier } = authApi.exchangeToken.mock.calls[0][0];
+  expect(token).toBe('ott-1');
+  expect(codeVerifier).toHaveLength(86);
+  expect(base64Url(createHash('sha256').update(codeVerifier).digest())).toBe(query.code_challenge);
+  expect(url).not.toContain(codeVerifier);
+});
+
+test('each sign-in makes a new verifier, which stays in the call that made it', async () => {
+  WebBrowser.openAuthSessionAsync.mockResolvedValue({
+    type: 'success',
+    url: 'com.example.field://auth?token=ott-1&state=state-1',
+  });
+  const authApi = createAuthApi();
+  await signInWithSheet({ apiBase, authApi, shell });
+  await signInWithSheet({ apiBase, authApi, shell });
+  const [first, second] = authApi.exchangeToken.mock.calls.map(([params]) => params.codeVerifier);
+  expect(first).not.toBe(second);
+  // No call out of the sign-in but the exchange carries the verifier: not the sheet, not storage.
+  const Crypto = jest.requireMock('expo-crypto');
+  const otherCalls = JSON.stringify([
+    WebBrowser.openAuthSessionAsync.mock.calls,
+    Crypto.randomUUID.mock.calls,
+    Crypto.getRandomBytes.mock.calls,
+  ]);
+  expect(otherCalls).not.toContain(first);
+  expect(otherCalls).not.toContain(second);
+});
+
+test('a redirect with another state is refused and the token is not exchanged', async () => {
+  WebBrowser.openAuthSessionAsync.mockResolvedValue({
+    type: 'success',
+    url: 'com.example.field://auth?token=ott-1&state=someone-else',
+  });
+  const authApi = createAuthApi();
+  expect(await signInWithSheet({ apiBase, authApi, shell })).toEqual({ status: 'failed' });
+  expect(authApi.exchangeToken).not.toHaveBeenCalled();
+});
+
+test('a redirect without a token fails', async () => {
+  WebBrowser.openAuthSessionAsync.mockResolvedValue({
+    type: 'success',
+    url: 'com.example.field://auth?state=state-1',
+  });
+  const authApi = createAuthApi();
+  expect(await signInWithSheet({ apiBase, authApi, shell })).toEqual({ status: 'failed' });
+  expect(authApi.exchangeToken).not.toHaveBeenCalled();
+});
+
+test('on Android the sheet returns by the https app link and exchanges its token', async () => {
+  onAndroid();
+  WebBrowser.openAuthSessionAsync.mockResolvedValue({
+    type: 'success',
+    url: `${apiBase}/auth/mobile/callback?token=ott-1&state=state-1`,
+  });
+  const authApi = createAuthApi();
+  expect(await signInWithSheet({ apiBase, authApi, shell })).toEqual({ status: 'signedIn' });
+  const [url, redirectUrl] = WebBrowser.openAuthSessionAsync.mock.calls[0];
+  expect(parseQuery(url).platform).toBe('android');
+  expect(redirectUrl).toBe(`${apiBase}/auth/mobile/callback`);
+  expect(authApi.exchangeToken.mock.calls[0][0].token).toBe('ott-1');
+});
+
+test('on Android a callback with another state is refused and the token is not exchanged', async () => {
+  onAndroid();
+  WebBrowser.openAuthSessionAsync.mockResolvedValue({
+    type: 'success',
+    url: `${apiBase}/auth/mobile/callback?token=ott-1&state=someone-else`,
+  });
+  const authApi = createAuthApi();
+  expect(await signInWithSheet({ apiBase, authApi, shell })).toEqual({ status: 'failed' });
+  expect(authApi.exchangeToken).not.toHaveBeenCalled();
+});
+
+test('on Android a return to the custom scheme is not the app link and is refused', async () => {
+  onAndroid();
+  WebBrowser.openAuthSessionAsync.mockResolvedValue({
+    type: 'success',
+    url: 'com.example.field://auth?token=ott-1&state=state-1',
+  });
+  const authApi = createAuthApi();
+  expect(await signInWithSheet({ apiBase, authApi, shell })).toEqual({ status: 'failed' });
+  expect(authApi.exchangeToken).not.toHaveBeenCalled();
+});
+
+test('Cancel on the confirmation page cancels the sign-in', async () => {
+  WebBrowser.openAuthSessionAsync.mockResolvedValue({
+    type: 'success',
+    url: 'com.example.field://auth?error=cancelled&state=state-1',
+  });
+  const authApi = createAuthApi();
+  expect(await signInWithSheet({ apiBase, authApi, shell })).toEqual({ status: 'cancelled' });
+  expect(authApi.exchangeToken).not.toHaveBeenCalled();
+});
+
+test('getSheetReturnUrl is the scheme on iOS and the app link under the app url on Android', () => {
+  expect(getSheetReturnUrl({ apiBase, platform: 'ios', shell })).toBe('com.example.field://auth');
+  expect(getSheetReturnUrl({ apiBase: `${apiBase}/app/`, platform: 'android', shell })).toBe(
+    `${apiBase}/app/auth/mobile/callback`
+  );
+});
+
+test('isSheetReturnLink tells the app link return from page links', () => {
+  expect(isSheetReturnLink(`${apiBase}/auth/mobile/callback?token=ott-1&state=s`)).toBe(true);
+  expect(isSheetReturnLink(`${apiBase}/app/auth/mobile/callback`)).toBe(true);
+  expect(isSheetReturnLink('/auth/mobile/callback?token=ott-1')).toBe(true);
+  expect(isSheetReturnLink(`${apiBase}/auth/mobile`)).toBe(false);
+  expect(isSheetReturnLink(`${apiBase}/jobs?next=/auth/mobile/callback`)).toBe(false);
+  expect(isSheetReturnLink('/jobs/42')).toBe(false);
+  expect(isSheetReturnLink('com.example.field://jobs')).toBe(false);
+});
+
+test('closing the sheet cancels the sign-in', async () => {
+  WebBrowser.openAuthSessionAsync.mockResolvedValue({ type: 'cancel' });
+  const authApi = createAuthApi();
+  expect(await signInWithSheet({ apiBase, authApi, shell })).toEqual({ status: 'cancelled' });
+  expect(authApi.exchangeToken).not.toHaveBeenCalled();
+});
+
+test('parseQuery reads a custom-scheme URL query, decoding each value', () => {
+  expect(parseQuery('com.example.field://auth?token=a%2Bb&state=x+y&empty#frag')).toEqual({
+    token: 'a+b',
+    state: 'x y',
+    empty: '',
+  });
+  expect(parseQuery('com.example.field://auth')).toEqual({});
+});

package/src/auth/styles.js

@@ -0,0 +1,78 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { StyleSheet } from 'react-native';
+
+const styles = StyleSheet.create({
+  screen: {
+    flexGrow: 1,
+    justifyContent: 'center',
+    padding: 24,
+    gap: 16,
+  },
+  appName: {
+    fontSize: 28,
+    fontWeight: '700',
+    textAlign: 'center',
+    marginBottom: 8,
+  },
+  label: {
+    fontSize: 16,
+  },
+  input: {
+    borderRadius: 10,
+    paddingHorizontal: 16,
+    paddingVertical: 12,
+    fontSize: 17,
+  },
+  codeInput: {
+    letterSpacing: 8,
+    textAlign: 'center',
+    fontSize: 24,
+  },
+  message: {
+    fontSize: 15,
+  },
+  error: {
+    fontSize: 15,
+  },
+  button: {
+    alignItems: 'center',
+    paddingVertical: 14,
+    borderRadius: 12,
+  },
+  buttonDisabled: {
+    opacity: 0.5,
+  },
+  buttonText: {
+    color: '#FFFFFF',
+    fontSize: 17,
+    fontWeight: '600',
+  },
+  links: {
+    flexDirection: 'row',
+    justifyContent: 'space-between',
+  },
+  link: {
+    fontSize: 17,
+    paddingVertical: 8,
+  },
+  centered: {
+    alignSelf: 'center',
+  },
+});
+
+export default styles;

package/src/auth/unregisterPushToken.js

@@ -0,0 +1,21 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// Unregisters this phone's push token for the app at sign-out, so no notification for the person
+// reaches it afterwards. Push arrives with its own design; until then there is nothing to remove.
+async function unregisterPushToken() {}
+
+export default unregisterPushToken;