@maccesar/titools 2.2.12 → 2.3.0

package/skills/ti-expert/references/alloy-structure.md

@@ -66,45 +66,44 @@ app/
 
 ## lib/ folder and module require paths
 
-:::danger CRITICAL: lib/ Folder is FLATTENED During Build
-When Alloy compiles, the **entire `lib/` folder is flattened to the root of Resources**. This means:
-- `app/lib/services/authService.js` → `Resources/iphone/services/authService.js`
-- `app/lib/api/authApi.js` → `Resources/iphone/api/authApi.js`
-
-**Therefore, require statements should NOT include `lib/` prefix:**
-```javascript
-// ❌ WRONG - Will fail at runtime
-const authApi = require('lib/api/authApi')
-
-// ✅ CORRECT - Path relative to flattened lib/
-const authApi = require('api/authApi')
-const authService = require('services/authService')
-```
-
-**This applies to:**
-- All files in `app/lib/` (services, api, helpers, etc.)
-- Cross-references within lib/ files
-- Controller requires of lib/ files
-
-**Example project structure:**
-```
-app/
-├── lib/
-│   ├── services/
-│   │   ├── authService.js       # require('services/navigationService')
-│   │   ├── navigationService.js # require('services/notificationService')
-│   │   └── notificationService.js
-│   ├── api/
-│   │   ├── authApi.js           # require('services/authService')
-│   │   ├── userApi.js
-│   │   └── frameApi.js
-│   └── repositories/
-│       ├── userRepository.js
-│       └── settingsRepository.js
-├── controllers/
-│   └── index.js                 # require('services/authService')
-```
-:::
+> **🚨 CRITICAL: lib/ Folder is FLATTENED During Build**
+> When Alloy compiles, the **entire `lib/` folder is flattened to the root of Resources**. This means:
+> - `app/lib/services/authService.js` → `Resources/iphone/services/authService.js`
+> - `app/lib/api/authApi.js` → `Resources/iphone/api/authApi.js`
+>
+> **Therefore, require statements should NOT include `lib/` prefix:**
+> ```javascript
+> // ❌ WRONG - Will fail at runtime
+> const authApi = require('lib/api/authApi')
+>
+> // ✅ CORRECT - Path relative to flattened lib/
+> const authApi = require('api/authApi')
+> const authService = require('services/authService')
+> ```
+>
+> **This applies to:**
+> - All files in `app/lib/` (services, api, helpers, etc.)
+> - Cross-references within lib/ files
+> - Controller requires of lib/ files
+>
+> **Example project structure:**
+> ```
+> app/
+> ├── lib/
+> │   ├── services/
+> │   │   ├── authService.js       # require('services/navigationService')
+> │   │   ├── navigationService.js # require('services/notificationService')
+> │   │   └── notificationService.js
+> │   ├── api/
+> │   │   ├── authApi.js           # require('services/authService')
+> │   │   ├── userApi.js
+> │   │   └── frameApi.js
+> │   └── repositories/
+> │       ├── userRepository.js
+> │       └── settingsRepository.js
+> ├── controllers/
+> │   └── index.js                 # require('services/authService')
+> ```
 
 ## Data layer: two approaches
 
@@ -338,9 +337,8 @@ const loadData = () => {
 }
 ```
 
-:::tip Widget Styles
-Widgets have their own `styles/widget.tss` file. Define all widget-specific styles there to keep them self-contained and portable.
-:::
+> **💡 Widget Styles**
+> Widgets have their own `styles/widget.tss` file. Define all widget-specific styles there to keep them self-contained and portable.
 
 ### Widget ↔ controller communication
 

package/skills/ti-expert/references/anti-patterns.md

@@ -76,6 +76,39 @@
 - iOS: Use `Ti.UI.iOS.createDocumentViewer` for files, or simple `Ti.UI.createOptionDialog` + `Ti.UI.Clipboard` for links
 - Android: Use `Ti.Android.createIntent` with ACTION_SEND
 
+## Community-Discovered Patterns
+
+### 15. Using extendEdges without autoAdjustScrollViewInsets (iOS)
+
+**Anti-pattern:** Setting `extendEdges: [Ti.UI.EXTEND_EDGE_ALL]` on a Window without also setting `autoAdjustScrollViewInsets: true`.
+
+```javascript
+// Wrong: content overlaps behind navigation bar
+const win = Ti.UI.createWindow({
+  title: 'My Screen',
+  largeTitleEnabled: true,
+  extendEdges: [Ti.UI.EXTEND_EDGE_ALL]
+  // missing autoAdjustScrollViewInsets!
+});
+```
+
+**Why it's wrong:** `extendEdges` tells iOS to extend the view's content behind the navigation bar and tab bar. Without `autoAdjustScrollViewInsets: true`, iOS does not adjust the ScrollView's content insets, so the scroll content starts at y=0 — directly behind the navigation bar.
+
+**Fix:** Always pair `extendEdges` with `autoAdjustScrollViewInsets`:
+
+```javascript
+const win = Ti.UI.createWindow({
+  title: 'My Screen',
+  largeTitleEnabled: true,
+  extendEdges: [Ti.UI.EXTEND_EDGE_ALL],
+  autoAdjustScrollViewInsets: true
+});
+```
+
+These three properties work together: `extendEdges` creates the blur/translucent effect, `autoAdjustScrollViewInsets` prevents content overlap, and `largeTitleEnabled` shows the collapsible large title. Without `extendEdges`, the large title also renders with a visible delay (empty nav bar gap appears first, then the title draws).
+
+This applies to Windows inside both standalone NavigationWindow and TabGroup (which wraps each Tab in an implicit NavigationWindow on iOS).
+
 ---
 
 ## Quick reference table
@@ -88,3 +121,4 @@
 | `lib/` prefix           | lib/ is flattened        | Use path without lib/ |
 | `$.index.open()`        | Wrong ID reference       | Use actual Window ID  |
 | `createNotification`    | API doesn't exist        | `createAlertDialog`   |
+| `extendEdges` alone     | Content behind nav bar   | Add `autoAdjustScrollViewInsets: true` |

package/skills/ti-expert/references/code-conventions.md

@@ -386,13 +386,13 @@ const Backbone = require('alloy/backbone')
 
 const EventBus = _.clone(Backbone.Events)
 
-// Named export for event constants
-exports.Events = {
+// Attach event constants directly to the bus object so they survive module.exports
+EventBus.Events = {
   USER_UPDATED: 'user:updated',
   SYNC_COMPLETE: 'sync:complete'
 }
 
-// Default export for the bus itself
+// Export the bus (EventBus.Events is accessible as a property)
 module.exports = EventBus
 
 // Usage
@@ -400,6 +400,8 @@ const EventBus = require('services/eventBus')
 const { Events } = EventBus
 ```
 
+> Note: setting `exports.Events = {...}` before `module.exports = EventBus` has no effect — the `module.exports` assignment discards the prior `exports` object. Attach constants directly to the object being exported instead.
+
 ### Re-exports (Barrel Files)
 ```javascript
 // lib/api/index.js - Barrel file

package/skills/ti-expert/references/error-handling.md

@@ -4,7 +4,10 @@
 
 ```javascript
 // lib/core/appError.js
-module.exports = class AppError extends Error {
+// IMPORTANT: Use named exports (exports.Foo), NOT module.exports = class Foo.
+// Multiple `module.exports =` assignments overwrite each other — only the last one survives.
+
+class AppError extends Error {
   constructor(message, code, statusCode = 500) {
     super(message)
     this.code = code
@@ -14,32 +17,36 @@ module.exports = class AppError extends Error {
   }
 }
 
-// Specific error types
-module.exports = class NetworkError extends AppError {
+class NetworkError extends AppError {
   constructor(message = 'Network request failed') {
     super(message, 'NETWORK_ERROR', 0)
   }
 }
 
-module.exports = class AuthError extends AppError {
+class AuthError extends AppError {
   constructor(message = 'Authentication failed') {
     super(message, 'AUTH_ERROR', 401)
   }
 }
 
-module.exports = class ValidationError extends AppError {
+class ValidationError extends AppError {
   constructor(message = 'Validation failed') {
     super(message, 'VALIDATION_ERROR', 400)
   }
 }
 
-module.exports = class NotFoundError extends AppError {
+class NotFoundError extends AppError {
   constructor(message = 'Resource not found') {
     super(message, 'NOT_FOUND', 404)
   }
 }
 
-// Error codes for reference
+exports.AppError = AppError
+exports.NetworkError = NetworkError
+exports.AuthError = AuthError
+exports.ValidationError = ValidationError
+exports.NotFoundError = NotFoundError
+
 exports.ErrorCodes = {
   NETWORK_ERROR: 'NETWORK_ERROR',
   AUTH_ERROR: 'AUTH_ERROR',

package/skills/ti-expert/references/examples.md

@@ -736,9 +736,11 @@ function init() {
 }
 
 function onTabFocus(e) {
-  // Analytics tracking
+  // Track tab changes via your analytics service
+  // Note: Ti.Analytics was removed from the Titanium SDK.
+  // Use a third-party analytics service (e.g., Firebase, Segment) instead.
   const tabNames = ['home', 'search', 'cart', 'profile']
-  Ti.Analytics.featureEvent(`tab:${tabNames[e.index]}`)
+  Analytics.track(`tab:${tabNames[e.index]}`)
 }
 
 function onCartUpdated({ itemCount }) {

package/skills/ti-expert/references/performance-optimization.md

@@ -212,12 +212,14 @@ $.cleanup = cleanup
 ```javascript
 // lib/services/database.js
 exports.DB = {
-  // Use transactions for multiple writes
+  // Use transactions to speed batch inserts
+  // Per official docs: use db.execute('BEGIN') / db.execute('COMMIT') — there are no
+  // dedicated begin_transaction() / commit() / rollback() methods on Ti.Database.DB.
   batchInsert(items) {
     const db = Ti.Database.open('mydb')
 
     try {
-      db.begin_transaction()
+      db.execute('BEGIN')
 
       items.forEach(item => {
         db.execute(
@@ -228,12 +230,12 @@ exports.DB = {
         )
       })
 
-      db.commit()
+      db.execute('COMMIT')
 
       console.log(`Inserted ${items.length} items`)
 
     } catch (e) {
-      db.rollback()
+      db.execute('ROLLBACK')
       console.error('Batch insert failed', e)
       throw e
 
@@ -574,14 +576,14 @@ function cleanup() {
 
 ### Common use cases
 
-| Pattern | Use Case | Delay |
+| Pattern  | Use Case         | Delay        |
 | -------- | ---------------- | ------------ |
-| Debounce | Search input | 300ms |
-| Debounce | Auto-save | 1000ms |
-| Debounce | Window resize | 150ms |
-| Throttle | Scroll events | 50-100ms |
+| Debounce | Search input     | 300ms        |
+| Debounce | Auto-save        | 1000ms       |
+| Debounce | Window resize    | 150ms        |
+| Throttle | Scroll events    | 50-100ms     |
 | Throttle | Mouse/touch move | 16ms (60fps) |
-| Throttle | API polling | 5000ms+ |
+| Throttle | API polling      | 5000ms+      |
 
 ### Combined pattern for real-time + final
 
@@ -622,18 +624,18 @@ function cleanup() {
 
 ## Performance checklist
 
-| Area | Check |
+| Area          | Check                                   |
 | ------------- | --------------------------------------- |
-| **Bridge** | Cached Ti.Platform properties |
-| **Bridge** | Using applyProperties for updates |
-| **Bridge** | TSS styles instead of inline attributes |
-| **Memory** | All global listeners cleaned up |
-| **Memory** | Heavy objects nulled in cleanup |
-| **Memory** | Images resized appropriately |
-| **Database** | Using transactions for batch ops |
-| **Database** | Indexes on frequently queried columns |
-| **Database** | ResultSets and DB handles closed |
-| **Animation** | Using native animations, not intervals |
-| **Animation** | GPU-accelerated properties preferred |
-| **Timing** | Debounce on search/input |
-| **Timing** | Throttle on scroll/touch events |
+| **Bridge**    | Cached Ti.Platform properties           |
+| **Bridge**    | Using applyProperties for updates       |
+| **Bridge**    | TSS styles instead of inline attributes |
+| **Memory**    | All global listeners cleaned up         |
+| **Memory**    | Heavy objects nulled in cleanup         |
+| **Memory**    | Images resized appropriately            |
+| **Database**  | Using transactions for batch ops        |
+| **Database**  | Indexes on frequently queried columns   |
+| **Database**  | ResultSets and DB handles closed        |
+| **Animation** | Using native animations, not intervals  |
+| **Animation** | GPU-accelerated properties preferred    |
+| **Timing**    | Debounce on search/input                |
+| **Timing**    | Throttle on scroll/touch events         |

package/skills/ti-expert/references/security-device.md

@@ -502,6 +502,9 @@ exports.SecurityService = {
   },
 
   _showBlockedScreen() {
+    // Note: iOS guidelines prohibit programmatically terminating an app.
+    // The best practice is to show a blocking dialog and prevent further interaction.
+    // On Android you can call Ti.Android.currentActivity.finish() to close the activity.
     const dialog = Ti.UI.createAlertDialog({
       title: L('security_blocked_title'),
       message: L('security_blocked_msg'),
@@ -509,10 +512,10 @@ exports.SecurityService = {
     })
 
     dialog.addEventListener('click', () => {
-      // Close the app (iOS) or minimize (Android)
-      if (OS_IOS) {
-        Ti.Platform.openURL('prefs:root=General')
+      if (OS_ANDROID) {
+        Ti.Android.currentActivity.finish()
       }
+      // On iOS: leave the dialog visible — Apple guidelines prohibit force-quitting apps.
     })
 
     dialog.show()
@@ -550,15 +553,15 @@ setInterval(() => {
 
 ## Security checklist
 
-| Category | Check | Implementation |
+| Category       | Check                      | Implementation           |
 | -------------- | -------------------------- | ------------------------ |
-| **Biometrics** | Use ti.identity for auth | BiometricService wrapper |
-| **Biometrics** | Never store biometric data | System handles storage |
-| **Biometrics** | Fallback to password | Always offer alternative |
-| **Deep Links** | Whitelist allowed schemes | ALLOWED_SCHEMES constant |
-| **Deep Links** | Whitelist allowed hosts | ALLOWED_HOSTS constant |
-| **Deep Links** | Sanitize all parameters | _sanitizeParams() |
-| **Deep Links** | Check auth requirements | requiresAuth per route |
-| **Integrity** | Check for jailbreak/root | checkDeviceIntegrity() |
-| **Integrity** | Define security policy | block/restrict/warn |
-| **Integrity** | Log security events | Always log compromises |
+| **Biometrics** | Use ti.identity for auth   | BiometricService wrapper |
+| **Biometrics** | Never store biometric data | System handles storage   |
+| **Biometrics** | Fallback to password       | Always offer alternative |
+| **Deep Links** | Whitelist allowed schemes  | ALLOWED_SCHEMES constant |
+| **Deep Links** | Whitelist allowed hosts    | ALLOWED_HOSTS constant   |
+| **Deep Links** | Sanitize all parameters    | _sanitizeParams()        |
+| **Deep Links** | Check auth requirements    | requiresAuth per route   |
+| **Integrity**  | Check for jailbreak/root   | checkDeviceIntegrity()   |
+| **Integrity**  | Define security policy     | block/restrict/warn      |
+| **Integrity**  | Log security events        | Always log compromises   |

package/skills/ti-expert/references/security-fundamentals.md

@@ -4,107 +4,90 @@
 
 **NEVER store tokens in:** `Ti.App.Properties` (plaintext), localStorage, or files.
 
-**USE platform-specific secure storage:**
+**USE the `ti.identity` module** — it handles iOS Keychain and Android Keystore through a unified API. Both platforms use `Identity.createKeychainItem()`.
 
 ```javascript
 // lib/services/tokenStorage.js
+const Identity = require('ti.identity')
+
+// Create a keychainItem once per identifier
+function createItem(identifier) {
+  return Identity.createKeychainItem({ identifier })
+}
+
 exports.TokenStorage = {
   save(token) {
-    if (Ti.Platform.osname === 'android') {
-      // Use Android KeyStore
-      const keyStore = Ti.Android.createKeyStore({
-        name: 'SecureKeyStore'
-      })
-      keyStore.addEntry('authToken', token)
-    } else {
-      // Use iOS Keychain
-      Ti.KeychainItem.setItem({
-        identifier: 'authToken',
-        value: token,
-        accessGroup: 'com.yourapp.keychain'
+    return new Promise((resolve, reject) => {
+      const item = createItem('authToken')
+      item.addEventListener('save', (e) => {
+        e.success ? resolve() : reject(new Error(e.error))
       })
-    }
+      item.save(token)
+    })
   },
 
   get() {
-    if (Ti.Platform.osname === 'android') {
-      const keyStore = Ti.Android.createKeyStore({
-        name: 'SecureKeyStore'
+    return new Promise((resolve, reject) => {
+      const item = createItem('authToken')
+      item.addEventListener('read', (e) => {
+        e.success ? resolve(e.value) : reject(new Error(e.error))
       })
-      return keyStore.getEntry('authToken')
-    } else {
-      return Ti.KeychainItem.getItem({
-        identifier: 'authToken',
-        accessGroup: 'com.yourapp.keychain'
-      })
-    }
+      item.read()
+    })
   },
 
   clear() {
-    if (Ti.Platform.osname === 'android') {
-      const keyStore = Ti.Android.createKeyStore({
-        name: 'SecureKeyStore'
-      })
-      keyStore.removeEntry('authToken')
-    } else {
-      Ti.KeychainItem.removeItem({
-        identifier: 'authToken',
-        accessGroup: 'com.yourapp.keychain'
+    return new Promise((resolve, reject) => {
+      const item = createItem('authToken')
+      item.addEventListener('reset', (e) => {
+        e.success ? resolve() : reject(new Error(e.error))
       })
-    }
+      item.reset()
+    })
   }
 }
 ```
 
+> Verified against official `ti.identity` module docs. `Identity.createKeychainItem({identifier})` is the cross-platform API — it maps to iOS Keychain and Android Keystore automatically. `Ti.Android.createKeyStore()` and `Ti.KeychainItem.setItem()` do NOT exist.
+
 ## Certificate pinning
 
-Prevent man-in-the-middle attacks by pinning SSL certificates:
+Prevent man-in-the-middle attacks by pinning SSL certificates using the **`ti.https` module** (community module — not built into the SDK):
 
 ```javascript
 // lib/api/pinnedClient.js
-exports.createPinnedClient = function() {
-  const client = Ti.Network.createHTTPClient({
-    // Security: Enable certificate pinning
-    certificatePinning: true,
+// Requires: ti.https module — install via npm or tiapp.xml modules section
+const HTTPS = require('ti.https')
+
+const securityManager = HTTPS.createX509CertificatePinningSecurityManager([
+  {
+    url: 'https://api.example.com',
+    serverCertificate: Ti.Filesystem.getFile(
+      Ti.Filesystem.resourcesDirectory, 'certificates/api-pin.pem'
+    ).read()
+  }
+])
 
-    // Specify allowed certificates
+exports.createPinnedClient = function(options = {}) {
+  return Ti.Network.createHTTPClient({
+    securityManager,           // must be set at creation time
     validatesSecureCertificate: true,
-
-    onload: () => {
-      // Success
-    },
-
-    onerror: (e) => {
-      // Certificate validation failed
-      if (e.error.indexOf('certificate') >= 0) {
-        Ti.API.error('Certificate pinning failed - possible MITM attack')
-      }
-    }
+    timeout: 10000,
+    ...options
   })
-
-  return client
 }
 ```
 
-**Add certificates to tiapp.xml:**
-
-```xml
-<ti:app>
-  <certificates>
-    <certificate>
-      <name>api.example.com</name>
-      <type>rsa</type>
-      <file>certificates/api-pin.pem</file>
-    </certificate>
-  </certificates>
-</ti:app>
-```
+> `certificatePinning: true` is NOT a valid `HTTPClient` property. Certificate pinning requires the `ti.https` module and must be set via the `securityManager` property when creating the client. Note that the `validatesSecureCertificate` property of `HTTPClient` is not honored for pinned URLs — the security manager takes precedence.
 
 ## Data encryption at rest
 
+> **Community pattern** — `ti.crypto` is a third-party community module (not part of the Titanium SDK core). Verify availability and compatibility before using in production.
+
 ```javascript
 // lib/services/encryption.js
 // AES-256 encryption for sensitive local data
+// Requires: ti.crypto community module
 
 const crypto = require('ti.crypto')
 
@@ -125,30 +108,6 @@ exports.decrypt = function(encryptedData, key) {
     options: { mode: crypto.CBC }
   })
 }
-
-// Usage: Secure cache of sensitive user data
-module.exports = class SecureCache {
-  constructor(encryptionKey) {
-    this.key = encryptionKey
-    this.cache = {}
-  }
-
-  set(key, value) {
-    const encrypted = encrypt(JSON.stringify(value), this.key)
-    this.cache[key] = encrypted
-  }
-
-  get(key) {
-    if (!this.cache[key]) return null
-
-    const decrypted = decrypt(this.cache[key], this.key)
-    return JSON.parse(decrypted)
-  }
-
-  clear() {
-    this.cache = {}
-  }
-}
 ```
 
 ## Secure HTTP communication
@@ -270,15 +229,15 @@ exports.Validator = {
 
 ## Owasp mobile security checklist
 
-| Category | Check | Implementation |
+| Category             | Check                       | Implementation                     |
 | -------------------- | --------------------------- | ---------------------------------- |
-| **Data Storage** | Credentials stored securely | Keychain/KeyStore for tokens |
-| **Data Storage** | Sensitive data encrypted | AES-256 for cached data |
-| **Communication** | HTTPS only | `validatesSecureCertificate: true` |
-| **Communication** | Certificate pinning | SSL pinning enabled |
-| **Authentication** | Token refresh | Auto-refresh before expiry |
-| **Authentication** | Session timeout | Auto-logout after inactivity |
-| **Input Validation** | Server-side validation | Never trust client input |
-| **Input Validation** | Sanitize user input | Remove XSS patterns |
-| **Cryptography** | No hardcoded keys | Keys from secure storage |
-| **Cryptography** | Use standard algorithms | AES-256, SHA-256 |
+| **Data Storage**     | Credentials stored securely | Keychain/KeyStore for tokens       |
+| **Data Storage**     | Sensitive data encrypted    | AES-256 for cached data            |
+| **Communication**    | HTTPS only                  | `validatesSecureCertificate: true` |
+| **Communication**    | Certificate pinning         | SSL pinning enabled                |
+| **Authentication**   | Token refresh               | Auto-refresh before expiry         |
+| **Authentication**   | Session timeout             | Auto-logout after inactivity       |
+| **Input Validation** | Server-side validation      | Never trust client input           |
+| **Input Validation** | Sanitize user input         | Remove XSS patterns                |
+| **Cryptography**     | No hardcoded keys           | Keys from secure storage           |
+| **Cryptography**     | Use standard algorithms     | AES-256, SHA-256                   |

package/skills/ti-expert/references/state-management.md

@@ -20,6 +20,7 @@ Create a single source of truth using Backbone.Events:
 ```javascript
 // lib/services/stateStore.js
 const Backbone = require('alloy/backbone')
+const _ = require('alloy/underscore')._
 
 class StateStore {
   constructor() {
@@ -280,13 +281,13 @@ Ti.App.addEventListener('resume', () => {
 
 ## Anti-patterns
 
-| Anti-Pattern | Why It's Bad | Solution |
+| Anti-Pattern                          | Why It's Bad                 | Solution                                 |
 | ------------------------------------- | ---------------------------- | ---------------------------------------- |
-| `Ti.App.fireEvent` for state | No cleanup, memory leaks | Use StateStore with `offChange` |
-| Direct collection mutation | Bypasses reactivity | Use collection methods (`add`, `remove`) |
-| State in multiple places | Inconsistency bugs | Single source of truth |
-| Global variables (`Alloy.Globals`) | No reactivity, hard to track | Use StateStore |
-| Controller-to-controller direct calls | Tight coupling | Use StateStore or events |
+| `Ti.App.fireEvent` for state          | No cleanup, memory leaks     | Use StateStore with `offChange`          |
+| Direct collection mutation            | Bypasses reactivity          | Use collection methods (`add`, `remove`) |
+| State in multiple places              | Inconsistency bugs           | Single source of truth                   |
+| Global variables (`Alloy.Globals`)    | No reactivity, hard to track | Use StateStore                           |
+| Controller-to-controller direct calls | Tight coupling               | Use StateStore or events                 |
 
 ## Persistence strategies
 
@@ -472,14 +473,14 @@ exports.appStore = {
 
 ### Choosing a strategy
 
-| Data Type | Strategy | Reason |
-| ------------------ | ------------------- | ---------------------- |
-| User preferences | Ti.App.Properties | Simple main-value, fast |
-| Auth tokens | Keychain/KeyStore | Security |
-| User profile | Properties + Secure | Mixed sensitivity |
-| Lists (100+ items) | SQLite | Query, pagination |
-| Offline queue | SQLite | Durability, FIFO |
-| Cache | In-memory + SQLite | Speed + persistence |
+| Data Type          | Strategy            | Reason                  |
+| ------------------ | ------------------- | ----------------------- |
+| User preferences   | Ti.App.Properties   | Simple main-value, fast |
+| Auth tokens        | Keychain/KeyStore   | Security                |
+| User profile       | Properties + Secure | Mixed sensitivity       |
+| Lists (100+ items) | SQLite              | Query, pagination       |
+| Offline queue      | SQLite              | Durability, FIFO        |
+| Cache              | In-memory + SQLite  | Speed + persistence     |
 
 ## State middleware