@oxy.so/core 7.27.0 → 7.29.0

package/dist/esm/i18n/locales/en-US.js

@@ -664,6 +664,20 @@ const dict = {
                 month: 'Month',
                 year: 'Year',
             },
+            pronouns: {
+                title: 'Pronouns',
+                subtitle: 'How people should refer to you',
+                label: 'Pronouns',
+                options: {
+                    unspecified: 'Not set',
+                    he_him: 'He/him',
+                    she_her: 'She/her',
+                    they_them: 'They/them',
+                    he_they: 'He/they',
+                    she_they: 'She/they',
+                    it_its: 'It/its',
+                },
+            },
             locations: {
                 title: 'Locations',
                 subtitle: "Places you've been or live",

package/dist/esm/i18n/locales/es-ES.js

@@ -366,6 +366,20 @@ const dict = {
                 month: 'Mes',
                 year: 'Año',
             },
+            pronouns: {
+                title: 'Pronombres',
+                subtitle: 'Cómo deben referirse a ti las personas',
+                label: 'Pronombres',
+                options: {
+                    unspecified: 'Sin definir',
+                    he_him: 'He/him',
+                    she_her: 'She/her',
+                    they_them: 'They/them',
+                    he_they: 'He/they',
+                    she_they: 'She/they',
+                    it_its: 'It/its',
+                },
+            },
             locations: {
                 title: 'Ubicaciones',
                 subtitle: 'Lugares donde has estado o vives',

package/dist/esm/session/index.js

@@ -72,6 +72,9 @@ export { createWebAuthStateStore, createNativeAuthStateStore, createMemoryAuthSt
 // Commons private identity key: an app that only needs a session must never be
 // handed the key that signs identity approvals.
 export { createSharedMirroringAuthStateStore, decideSharedDeviceJoin, decideSharedDevicePublish, normalizeSharedDeviceSessionRead, publishProvenDeviceCredential, readLocalDeviceCredential, } from './sharedDeviceCredential.js';
+// Where the shared device credential (and an app's own items) live on iOS:
+// docs/identity/ios-keychain-access-groups.md, ADR 0062.
+export { KeychainAccessUnavailableError, keychainAccessGroupValue, ownKeychainItemPlan, readThroughPlan, deleteThroughPlan, resolveKeychainAccess, } from '../utils/keychainAccessGroups.js';
 // Identity-bound sessions (the identity vault). The pin is the durable
 // `{publicKey, accountId}` binding between this device's PRIMARY identity key
 // and the account it authenticates as; it is what keeps such a client from

package/dist/esm/utils/keychainAccessGroups.js

@@ -0,0 +1,231 @@
+/**
+ * iOS keychain access groups: which group each Oxy keychain item lives in, and
+ * which apps may read it (docs/identity/ios-keychain-access-groups.md, ADR 0062).
+ *
+ * | Group                         | Held by                      | Item class        |
+ * |-------------------------------|------------------------------|-------------------|
+ * | `<TEAM>.so.oxy.identity`      | Commons only (listed FIRST)  | `identity-secret` |
+ * | `<TEAM>.so.oxy.wallet`        | Commons, the Peable wallet   | `spending-key`    |
+ * | `<TEAM>.group.so.oxy.shared`  | every Oxy app                | `shared`          |
+ *
+ * - `identity-secret`: the personal root (primary and backup slots), the
+ *   personal and organization recovery phrases, the organization index. Only
+ *   Commons may read or write them.
+ * - `spending-key`: private keys an app other than Commons signs or derives
+ *   with in process — the personal key's shared slot and organization pairs
+ *   (`deriveScopedSeed`, `signSocialReceive`). Commons writes them; the Peable
+ *   wallet reads them.
+ * - `shared`: what every Oxy app may read: the shared public key and the
+ *   device-session credential.
+ *
+ * The ROLE of this binary comes from the keychain itself: an item written
+ * without a group lands in the app's default group, the first entry of its
+ * `keychain-access-groups` entitlement, and `@oxy.so/app-preset` lets only
+ * Commons put the identity group first and only the Peable wallet the wallet
+ * group. The same probe gives the team prefix, which `kSecAttrAccessGroup`
+ * needs and JavaScript cannot otherwise see.
+ *
+ * Android and web have no access groups: there every helper here answers the
+ * single-store behaviour (`ungrouped`), and Android's narrowing is Commons'
+ * identity host. An iOS build whose native module predates the probe is also
+ * `ungrouped` — exactly what that build's entitlements (one shared group) do.
+ *
+ * This module never imports the identity stack: services' device-session store
+ * and Peable's wallet storage use it too.
+ */
+import { loadKeychainDefaultAccessGroup } from '@oxy.so/protocol';
+import { isIOS } from './platform.js';
+/** The group names after the team prefix, exactly as the entitlements list them. */
+export const KEYCHAIN_ACCESS_GROUPS = {
+    identity: 'so.oxy.identity',
+    wallet: 'so.oxy.wallet',
+    shared: 'group.so.oxy.shared',
+};
+/** Thrown while the probe cannot answer (before first unlock). Transient. */
+export class KeychainAccessUnavailableError extends Error {
+    constructor(cause) {
+        super('The keychain cannot say which access groups this app holds right now.');
+        this.cause = cause;
+        this.name = 'KeychainAccessUnavailableError';
+    }
+}
+/**
+ * The single place each item class is assigned a group. A new kind of item
+ * (F1's retained keys, for one) picks its class and reuses everything below.
+ */
+export function keychainGroupFor(item) {
+    switch (item) {
+        case 'identity-secret':
+            return 'identity';
+        case 'spending-key':
+            return 'wallet';
+        case 'shared':
+            return 'shared';
+    }
+}
+/** Whether `role` holds the group `item` lives in. */
+export function mayHoldKeychainItem(role, item) {
+    switch (role) {
+        case 'holder':
+            return true;
+        case 'wallet':
+            return item !== 'identity-secret';
+        case 'member':
+            return item === 'shared';
+    }
+}
+/** Parse the default access group the probe reported. Exported for tests. */
+export function keychainAccessFromDefaultGroup(defaultGroup) {
+    const dot = defaultGroup.indexOf('.');
+    if (dot <= 0 || dot === defaultGroup.length - 1) {
+        // Not `<prefix>.<group>`: an unsigned simulator build. Nothing to split.
+        return { mode: 'ungrouped' };
+    }
+    const prefix = defaultGroup.slice(0, dot + 1);
+    const group = defaultGroup.slice(dot + 1);
+    const role = group === KEYCHAIN_ACCESS_GROUPS.identity
+        ? 'holder'
+        : group === KEYCHAIN_ACCESS_GROUPS.wallet
+            ? 'wallet'
+            : 'member';
+    return { mode: 'grouped', prefix, defaultGroup, role };
+}
+let resolvedAccess = null;
+/**
+ * This binary's keychain access, memoized once known. THROWS
+ * {@link KeychainAccessUnavailableError} while the probe cannot answer, which
+ * every caller already treats as "storage unavailable, retry".
+ */
+export async function resolveKeychainAccess() {
+    if (resolvedAccess) {
+        return resolvedAccess;
+    }
+    if (!isIOS()) {
+        // Not memoized: until `@oxy.so/services` registers the platform, a phone
+        // reads as "not iOS", and caching that would keep the whole process on the
+        // pre-split behaviour.
+        return { mode: 'ungrouped' };
+    }
+    let probe;
+    try {
+        probe = await loadKeychainDefaultAccessGroup();
+    }
+    catch (cause) {
+        throw new KeychainAccessUnavailableError(cause);
+    }
+    if (probe.state === 'unavailable') {
+        throw new KeychainAccessUnavailableError(probe.cause);
+    }
+    resolvedAccess =
+        probe.state === 'resolved'
+            ? keychainAccessFromDefaultGroup(probe.accessGroup)
+            : { mode: 'ungrouped' };
+    return resolvedAccess;
+}
+/** Forget the memoized access. Tests only. @internal */
+export function resetKeychainAccessForTests() {
+    resolvedAccess = null;
+}
+/** The full `kSecAttrAccessGroup` value of `group`, or `undefined` when ungrouped. */
+export function keychainAccessGroupValue(access, group) {
+    return access.mode === 'grouped' ? `${access.prefix}${KEYCHAIN_ACCESS_GROUPS[group]}` : undefined;
+}
+function option(value) {
+    return value === undefined ? {} : { accessGroup: value };
+}
+/**
+ * The option bags a READ of `item` tries, in order: its own group, then the
+ * shared group, where every item lived before the split (release 4 of the doc
+ * drops that fallback). Empty when this app may not hold the item: the caller
+ * answers `null` without touching the keychain.
+ */
+export function keychainReadPlan(access, item) {
+    if (access.mode === 'ungrouped') {
+        return [{}];
+    }
+    if (!mayHoldKeychainItem(access.role, item)) {
+        return [];
+    }
+    const own = keychainGroupFor(item);
+    const plan = [option(keychainAccessGroupValue(access, own))];
+    if (own !== 'shared') {
+        plan.push(option(keychainAccessGroupValue(access, 'shared')));
+    }
+    return plan;
+}
+/**
+ * Every place a DELETE of `item` must reach: the read plan, so a delete never
+ * leaves a pre-split copy behind in the shared group.
+ */
+export function keychainDeletePlan(access, item) {
+    return keychainReadPlan(access, item);
+}
+/**
+ * The option a WRITE of `item` carries. THROWS when this app may not hold the
+ * item: an identity secret written by any app but Commons would land in that
+ * app's default group, a second holder nobody knows about.
+ */
+export function keychainWriteOption(access, item) {
+    if (access.mode === 'ungrouped') {
+        return {};
+    }
+    if (!mayHoldKeychainItem(access.role, item)) {
+        throw new Error(`This app (keychain role "${access.role}") may not hold a ${item} keychain item; only Commons writes the identity.`);
+    }
+    return option(keychainAccessGroupValue(access, keychainGroupFor(item)));
+}
+/**
+ * The plan for an app's OWN items (its session credential, its settings, an
+ * imported wallet's phrase) in Commons and the Peable wallet, whose default
+ * group the split changed: written to the default group explicitly — where a
+ * write without a group goes anyway — and read from it FIRST, then from every
+ * group (`{}`), where all of them were written before. Without the explicit
+ * order a read could return whichever of two copies the keychain met first.
+ * Deletes reach every group, as they always did.
+ *
+ * Every other app (`member`) and Android/web keep the calls they always made.
+ */
+export function ownKeychainItemPlan(access) {
+    if (access.mode === 'ungrouped' || access.role === 'member') {
+        return { read: [{}], write: {}, delete: [{}] };
+    }
+    return {
+        read: [option(access.defaultGroup), {}],
+        write: option(access.defaultGroup),
+        delete: [{}],
+    };
+}
+/** Read `key` through `plan`: the first non-null answer. A thrown read propagates. */
+export async function readThroughPlan(store, key, options, plan) {
+    for (const group of plan) {
+        const value = await store.getItemAsync(key, { ...options, ...group });
+        if (value !== null && value !== undefined) {
+            return value;
+        }
+    }
+    return null;
+}
+/** Delete `key` from every location in `plan`. A thrown delete propagates. */
+export async function deleteThroughPlan(store, key, options, plan) {
+    for (const group of plan) {
+        await store.deleteItemAsync(key, { ...options, ...group });
+    }
+}
+/**
+ * `store` with every call routed to `item`'s groups for this app: reads walk
+ * the read plan, writes carry the write option (throwing for a role that may
+ * not hold the item), deletes reach every location. The constants of the
+ * wrapped store are kept, so `store.WHEN_UNLOCKED_THIS_DEVICE_ONLY` still reads.
+ */
+export function groupedKeychainStore(store, access, item) {
+    const plan = keychainReadPlan(access, item);
+    const wrapped = {
+        getItemAsync: (key, options) => readThroughPlan(store, key, options ?? {}, plan),
+        setItemAsync: async (key, value, options) => {
+            const group = keychainWriteOption(access, item);
+            await store.setItemAsync(key, value, { ...(options ?? {}), ...group });
+        },
+        deleteItemAsync: (key, options) => deleteThroughPlan(store, key, options ?? {}, plan),
+    };
+    return Object.assign(Object.create(store), wrapped);
+}

package/dist/types/crypto/index.d.ts

@@ -19,6 +19,10 @@ export type { IdentityDeviceBackupStore } from './deviceBackup';
 export type { IdentitySignerStore } from './identitySigner';
 export { generateOrganizationKey, organizationKeyFromPhrase, storeOrganizationKey, getOrganizationPublicKey, getOrganizationPrivateKey, getOrganizationRecoveryPhrase, listOrganizationKeys, deleteOrganizationKey, syncOrganizationKeys, isOrganizationAccountId, isHealthyOrganizationKeyPair, } from './organizationKeys';
 export type { OrganizationKeyPair, GeneratedOrganizationKey, StoredOrganizationKey, } from './organizationKeys';
+export { KEYCHAIN_ACCESS_GROUPS, KeychainAccessUnavailableError, keychainGroupFor, mayHoldKeychainItem, resolveKeychainAccess, keychainAccessGroupValue, keychainReadPlan, keychainDeletePlan, keychainWriteOption, ownKeychainItemPlan, readThroughPlan, deleteThroughPlan, groupedKeychainStore, } from '../utils/keychainAccessGroups';
+export type { KeychainAccess, KeychainAccessGroupName, KeychainGroupOption, KeychainItemClass, KeychainRole, KeychainStoreLike, } from '../utils/keychainAccessGroups';
+export { ensureKeychainGroupsMigrated } from './keychainGroupMigration';
+export type { KeychainGroupMigrationReport, KeychainItemMigrationOutcome, } from './keychainGroupMigration';
 export { SignatureService } from './signatureService';
 export type { SignedMessage, AuthChallenge } from './signatureService';
 export { RecoveryPhraseService, BACKUP_KDF_ENCRYPTION_INFO } from './recoveryPhrase';

package/dist/types/crypto/keyManager.d.ts

@@ -238,6 +238,13 @@ export declare class KeyManager {
      * Called internally when shared identity is created/deleted/imported
      */
     private static invalidateSharedCache;
+    /**
+     * iOS: write the personal key's cross-app slot — the private key to the
+     * wallet group (Commons and the Peable wallet), the public key to the shared
+     * group (every Oxy app). Throws in any app that may not hold the private key.
+     * @internal
+     */
+    private static _writeIosSharedSlot;
     /**
      * Lowercase and pad to canonical 64-hex-char form.
      *
@@ -717,7 +724,8 @@ export declare class KeyManager {
      * `HDKey.fromMasterSeed` and never touches the identity key.
      *
      * Key source (native only):
-     * - iOS: the shared identity in `group.so.oxy.shared`, then this device's
+     * - iOS: the shared slot's private key in the wallet keychain group (Commons
+     *   and the Peable wallet only; `null` in every other app), then this device's
      *   primary identity.
      * - Android: Commons (the one app with a signer store) uses its own primary
      *   identity; every other app asks Commons over IPC and never reads a local

package/dist/types/crypto/keychainGroupMigration.d.ts

@@ -0,0 +1,27 @@
+/** What happened to one item (or pair) in a run. */
+export type KeychainItemMigrationOutcome = 'absent' | 'moved' | 'conflict' | 'unhealthy' | 'failed' | 'deferred';
+export interface KeychainGroupMigrationReport {
+    /**
+     * - `not-applicable`: not Commons on a split-aware iOS build; nothing to move.
+     * - `complete`: nothing secret is left in the shared group.
+     * - `incomplete`: something stayed (`conflict`, `unhealthy` or `failed`);
+     *   retried next launch.
+     * - `deferred`: the keychain could not be read (locked); retried on the next
+     *   storage access.
+     */
+    state: 'not-applicable' | 'complete' | 'incomplete' | 'deferred';
+    /** Outcome per item label (`primary`, `phrase`, `organization-1`, …). */
+    items: Record<string, KeychainItemMigrationOutcome>;
+}
+/** Run the migration once. Exported for tests; production code awaits the gate. */
+export declare function runKeychainGroupMigration(): Promise<KeychainGroupMigrationReport>;
+/**
+ * The gate every Commons identity-storage access awaits. One run per process
+ * (`complete`, `incomplete` and `not-applicable` are kept; `incomplete` is
+ * retried on the next launch); a `deferred` run is forgotten, so the next
+ * access tries again once the keychain unlocks. Concurrent callers share one
+ * run. Never throws.
+ */
+export declare function ensureKeychainGroupsMigrated(): Promise<KeychainGroupMigrationReport>;
+/** Forget the memoized run. Tests only. @internal */
+export declare function resetKeychainGroupMigrationForTests(): void;

package/dist/types/crypto/keychainItems.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The names of every identity item `KeyManager` and `./organizationKeys` keep
+ * in `expo-secure-store`, in one place so the access-group migration
+ * (`./keychainGroupMigration`) moves exactly what those modules read. Values
+ * are stable on-device identifiers: renaming one strands what is stored.
+ */
+/** Legacy (pre-v2) and shared-slot keys; the legacy ones have no keychain service. */
+export declare const STORAGE_KEYS: {
+    readonly PRIVATE_KEY: "oxy_identity_private_key";
+    readonly PUBLIC_KEY: "oxy_identity_public_key";
+    readonly BACKUP_PRIVATE_KEY: "oxy_identity_backup_private_key";
+    readonly BACKUP_PUBLIC_KEY: "oxy_identity_backup_public_key";
+    readonly BACKUP_TIMESTAMP: "oxy_identity_backup_timestamp";
+    readonly SHARED_PRIVATE_KEY: "oxy_shared_identity_private_key";
+    readonly SHARED_PUBLIC_KEY: "oxy_shared_identity_public_key";
+};
+export declare const V2_PRIMARY_KEYCHAIN_SERVICE = "oxy_identity";
+export declare const V2_BACKUP_KEYCHAIN_SERVICE = "oxy_identity_backup";
+export declare const V2_STORAGE_KEYS: {
+    readonly PRIVATE_KEY: "oxy_identity_private_key_v2";
+    readonly PUBLIC_KEY: "oxy_identity_public_key_v2";
+    readonly BACKUP_PRIVATE_KEY: "oxy_identity_backup_private_key_v2";
+    readonly BACKUP_PUBLIC_KEY: "oxy_identity_backup_public_key_v2";
+    readonly BACKUP_TIMESTAMP: "oxy_identity_backup_timestamp_v2";
+};
+export declare const RECOVERY_MNEMONIC_KEYCHAIN_SERVICE = "oxy_identity_mnemonic";
+export declare const RECOVERY_MNEMONIC_STORAGE_KEY = "oxy_identity_mnemonic_v1";
+/** Organization keys (ADR 0061 D6). On iOS the pair has no keychain service. */
+export declare const ORGANIZATION_ANDROID_KEYCHAIN_SERVICE = "oxy_org_identity";
+export declare const ORGANIZATION_MNEMONIC_KEYCHAIN_SERVICE = "oxy_org_identity_mnemonic";
+export declare const ORGANIZATION_INDEX_KEYCHAIN_SERVICE = "oxy_org_identity_index";
+export declare const ORGANIZATION_INDEX_STORAGE_KEY = "oxy_org_identity_index_v1";
+export declare const organizationPrivateKeyName: (accountId: string) => string;
+export declare const organizationPublicKeyName: (accountId: string) => string;
+export declare const organizationMnemonicName: (accountId: string) => string;
+/** Whether `value` is an account id an organization key can be stored under. */
+export declare function isOrganizationAccountId(value: string): boolean;
+/** The account ids in a stored organization index; anything malformed is skipped. */
+export declare function parseOrganizationIndex(raw: string | null): string[];
+/** The stored form of an organization index: unique, sorted. */
+export declare function serializeOrganizationIndex(ids: readonly string[]): string;

package/dist/types/crypto/organizationKeys.d.ts

@@ -8,8 +8,10 @@
  * other Oxy apps reach it the way they reach the personal identity, by
  * derivation and never by the key:
  *
- * - iOS: the keychain access group `group.so.oxy.shared`, like the personal
- *   shared slot. Only Commons writes it.
+ * - iOS: the pair in the wallet keychain group (`<TEAM>.so.oxy.wallet`), which
+ *   only Commons and the Peable wallet hold; the phrase and the index in the
+ *   identity group, Commons only (docs/identity/ios-keychain-access-groups.md).
+ *   Only Commons writes them; every other app reads nothing.
  * - Android: Commons' own expo-secure-store slot, mirrored into the identity
  *   signer store (`./identitySigner`) that Commons' identity host answers
  *   `accountId` requests from. Every other app asks Commons over IPC
@@ -17,11 +19,13 @@
  *
  * The phrase is kept only in Commons, on the device that created or imported
  * it, so an owner can show it to another owner (ADR 0061 D5); it never reaches
- * the keychain group, an IPC answer or a log.
+ * the wallet or shared group, an IPC answer or a log.
  *
  * This module imports nothing from `./keyManager` (which imports it): the
  * signer store comes from `./identitySigner`'s registry.
  */
+import { isOrganizationAccountId } from './keychainItems';
+export { isOrganizationAccountId };
 /** A secp256k1 pair: private key 64 hex, public key lowercase uncompressed (`04…`, 130 hex). */
 export interface OrganizationKeyPair {
     privateKey: string;
@@ -35,8 +39,6 @@ export interface GeneratedOrganizationKey extends OrganizationKeyPair {
 export interface StoredOrganizationKey extends OrganizationKeyPair {
     mnemonic?: string;
 }
-/** Whether `value` is an account id an organization key can be stored under. */
-export declare function isOrganizationAccountId(value: string): boolean;
 /** True only when both halves are well-formed AND the public key derives from the private one. */
 export declare function isHealthyOrganizationKeyPair(privateKey: string | null | undefined, publicKey: string | null | undefined): boolean;
 /**
@@ -55,7 +57,7 @@ export declare function organizationKeyFromPhrase(phrase: string): Promise<Organ
 /**
  * Keep an organization key on this device. Commons only: on Android it needs
  * the identity signer store Commons registers, so the identity host can serve
- * it; on iOS only Commons calls it (the keychain group is shared).
+ * it; on iOS only Commons holds the groups it writes (any other app throws).
  *
  * Refuses a pair whose public key does not derive from its private key, and a
  * phrase that does not derive the pair. Overwrites whatever this device held for
@@ -64,15 +66,15 @@ export declare function organizationKeyFromPhrase(phrase: string): Promise<Organ
 export declare function storeOrganizationKey(accountId: string, key: StoredOrganizationKey): Promise<void>;
 /**
  * The organization's public key as THIS device can reach it, or `null`.
- * iOS: the keychain group. Android: Commons' own slot inside Commons, and
+ * iOS: the wallet keychain group (Commons, the Peable wallet). Android: Commons' own slot inside Commons, and
  * Commons' identity host (`describe` with `accountId`) everywhere else. Compare
  * it with the organization's DID `#key-1` before receiving (Peable ADR 0002).
  */
 export declare function getOrganizationPublicKey(accountId: string): Promise<string | null>;
 /**
  * The organization's private key, where this app may hold it: Commons (both
- * platforms) and, on iOS, the keychain group. `null` on Android outside
- * Commons. Use it to sign within the app only; never transmit it.
+ * platforms) and, on iOS, the Peable wallet through the wallet keychain group.
+ * `null` everywhere else. Use it to sign within the app only; never transmit it.
  */
 export declare function getOrganizationPrivateKey(accountId: string): Promise<string | null>;
 /** The organization's phrase, if this device created or imported it with one. Commons only. */

package/dist/types/crypto/secureStoreOptions.d.ts

@@ -0,0 +1,15 @@
+export interface OxySecureStoreOptions {
+    /** Keychain service name (Android keystore alias / iOS `kSecAttrService`). */
+    keychainService?: string;
+    /** Item accessibility: the `ExpoSecureStoreLike` constant, e.g. `WHEN_UNLOCKED_THIS_DEVICE_ONLY`. */
+    keychainAccessible?: number;
+    /** Prompt shown for biometric-protected items. */
+    authenticationPrompt?: string;
+    /** Whether Face ID / Touch ID is required to read the item. */
+    requireAuthentication?: boolean;
+    /**
+     * iOS `kSecAttrAccessGroup`: the FULL, team-prefixed entitlement value. Set
+     * only through `../utils/keychainAccessGroups`, never by hand.
+     */
+    accessGroup?: string;
+}

package/dist/types/i18n/locales/en-US.d.ts

@@ -655,6 +655,20 @@ declare const dict: {
                 month: string;
                 year: string;
             };
+            pronouns: {
+                title: string;
+                subtitle: string;
+                label: string;
+                options: {
+                    unspecified: string;
+                    he_him: string;
+                    she_her: string;
+                    they_them: string;
+                    he_they: string;
+                    she_they: string;
+                    it_its: string;
+                };
+            };
             locations: {
                 title: string;
                 subtitle: string;

package/dist/types/i18n/locales/es-ES.d.ts

@@ -366,6 +366,20 @@ declare const dict: {
                 month: string;
                 year: string;
             };
+            pronouns: {
+                title: string;
+                subtitle: string;
+                label: string;
+                options: {
+                    unspecified: string;
+                    he_him: string;
+                    she_her: string;
+                    they_them: string;
+                    he_they: string;
+                    she_they: string;
+                    it_its: string;
+                };
+            };
             locations: {
                 title: string;
                 subtitle: string;

package/dist/types/models/interfaces.d.ts

@@ -1,4 +1,4 @@
-import type { AccountKind, AccountCategoryId, AvatarCharacter, UserNameResponse, UserRelationship, ThemePreference, OxyNotificationEntityType, OxyNotificationType } from '@oxy.so/contracts';
+import type { AccountKind, AccountCategoryId, AvatarCharacter, UserNameResponse, UserRelationship, ThemePreference, OxyNotificationEntityType, OxyNotificationType, Pronouns } from '@oxy.so/contracts';
 export interface OxyConfig {
     baseURL: string;
     cloudURL?: string;
@@ -135,6 +135,11 @@ export interface User {
         image?: string;
         id?: string;
     }>;
+    /**
+     * How a person account names its pronouns, from the closed list. An account
+     * that is not a person (organization, channel, bot, …) is always `unspecified`.
+     */
+    pronouns?: Pronouns;
     _count?: {
         followers?: number;
         following?: number;

package/dist/types/session/index.d.ts

@@ -29,6 +29,8 @@ export { createWebAuthStateStore, createNativeAuthStateStore, createMemoryAuthSt
 export type { PersistedAuthState, AuthStateStore, AuthStateWriteGuard, NativeKeyValueStorage, } from './authStateStore';
 export { createSharedMirroringAuthStateStore, decideSharedDeviceJoin, decideSharedDevicePublish, normalizeSharedDeviceSessionRead, publishProvenDeviceCredential, readLocalDeviceCredential, } from './sharedDeviceCredential';
 export type { SharedDeviceCredential, SharedDeviceCredentialRead, SharedDeviceCredentialStore, SharedDeviceJoinDecision, SharedDeviceJoinSkipReason, SharedDevicePublishDecision, SharedDevicePublishOutcome, SharedDevicePublishSkipReason, } from './sharedDeviceCredential';
+export { KeychainAccessUnavailableError, keychainAccessGroupValue, ownKeychainItemPlan, readThroughPlan, deleteThroughPlan, resolveKeychainAccess, } from '../utils/keychainAccessGroups';
+export type { KeychainAccess, KeychainGroupOption } from '../utils/keychainAccessGroups';
 export { createWebIdentityPinStore, createNativeIdentityPinStore, createMemoryIdentityPinStore, identityPinMatches, IDENTITY_PIN_STORAGE_KEY, } from './identityPin';
 export type { IdentityPin, IdentityPinStore } from './identityPin';
 export { resolveIdentityPin, establishIdentitySession, } from './identitySession';

package/dist/types/utils/keychainAccessGroups.d.ts

@@ -0,0 +1,104 @@
+/** The group names after the team prefix, exactly as the entitlements list them. */
+export declare const KEYCHAIN_ACCESS_GROUPS: {
+    readonly identity: "so.oxy.identity";
+    readonly wallet: "so.oxy.wallet";
+    readonly shared: "group.so.oxy.shared";
+};
+export type KeychainAccessGroupName = keyof typeof KEYCHAIN_ACCESS_GROUPS;
+/** What a keychain item IS, which decides its group. See the table above. */
+export type KeychainItemClass = 'identity-secret' | 'spending-key' | 'shared';
+/** Which holder this binary is, from its default access group. */
+export type KeychainRole = 'holder' | 'wallet' | 'member';
+/**
+ * - `grouped`: iOS with the probe answered. `prefix` ends with its dot
+ *   (`ABCDE12345.`); `defaultGroup` is the full default group string.
+ * - `ungrouped`: Android, web, or an iOS native build without the probe.
+ */
+export type KeychainAccess = {
+    mode: 'grouped';
+    prefix: string;
+    defaultGroup: string;
+    role: KeychainRole;
+} | {
+    mode: 'ungrouped';
+};
+/** The `expo-secure-store` option this module sets (its real name since 58). */
+export interface KeychainGroupOption {
+    accessGroup?: string;
+}
+/** Thrown while the probe cannot answer (before first unlock). Transient. */
+export declare class KeychainAccessUnavailableError extends Error {
+    readonly cause?: unknown | undefined;
+    readonly name = "KeychainAccessUnavailableError";
+    constructor(cause?: unknown | undefined);
+}
+/**
+ * The single place each item class is assigned a group. A new kind of item
+ * (F1's retained keys, for one) picks its class and reuses everything below.
+ */
+export declare function keychainGroupFor(item: KeychainItemClass): KeychainAccessGroupName;
+/** Whether `role` holds the group `item` lives in. */
+export declare function mayHoldKeychainItem(role: KeychainRole, item: KeychainItemClass): boolean;
+/** Parse the default access group the probe reported. Exported for tests. */
+export declare function keychainAccessFromDefaultGroup(defaultGroup: string): KeychainAccess;
+/**
+ * This binary's keychain access, memoized once known. THROWS
+ * {@link KeychainAccessUnavailableError} while the probe cannot answer, which
+ * every caller already treats as "storage unavailable, retry".
+ */
+export declare function resolveKeychainAccess(): Promise<KeychainAccess>;
+/** Forget the memoized access. Tests only. @internal */
+export declare function resetKeychainAccessForTests(): void;
+/** The full `kSecAttrAccessGroup` value of `group`, or `undefined` when ungrouped. */
+export declare function keychainAccessGroupValue(access: KeychainAccess, group: KeychainAccessGroupName): string | undefined;
+/**
+ * The option bags a READ of `item` tries, in order: its own group, then the
+ * shared group, where every item lived before the split (release 4 of the doc
+ * drops that fallback). Empty when this app may not hold the item: the caller
+ * answers `null` without touching the keychain.
+ */
+export declare function keychainReadPlan(access: KeychainAccess, item: KeychainItemClass): KeychainGroupOption[];
+/**
+ * Every place a DELETE of `item` must reach: the read plan, so a delete never
+ * leaves a pre-split copy behind in the shared group.
+ */
+export declare function keychainDeletePlan(access: KeychainAccess, item: KeychainItemClass): KeychainGroupOption[];
+/**
+ * The option a WRITE of `item` carries. THROWS when this app may not hold the
+ * item: an identity secret written by any app but Commons would land in that
+ * app's default group, a second holder nobody knows about.
+ */
+export declare function keychainWriteOption(access: KeychainAccess, item: KeychainItemClass): KeychainGroupOption;
+/**
+ * The plan for an app's OWN items (its session credential, its settings, an
+ * imported wallet's phrase) in Commons and the Peable wallet, whose default
+ * group the split changed: written to the default group explicitly — where a
+ * write without a group goes anyway — and read from it FIRST, then from every
+ * group (`{}`), where all of them were written before. Without the explicit
+ * order a read could return whichever of two copies the keychain met first.
+ * Deletes reach every group, as they always did.
+ *
+ * Every other app (`member`) and Android/web keep the calls they always made.
+ */
+export declare function ownKeychainItemPlan(access: KeychainAccess): {
+    read: KeychainGroupOption[];
+    write: KeychainGroupOption;
+    delete: KeychainGroupOption[];
+};
+/** The subset of `expo-secure-store` a grouped store wraps. */
+export interface KeychainStoreLike {
+    getItemAsync(key: string, options?: object): Promise<string | null>;
+    setItemAsync(key: string, value: string, options?: object): Promise<void>;
+    deleteItemAsync(key: string, options?: object): Promise<void>;
+}
+/** Read `key` through `plan`: the first non-null answer. A thrown read propagates. */
+export declare function readThroughPlan(store: KeychainStoreLike, key: string, options: object, plan: readonly KeychainGroupOption[]): Promise<string | null>;
+/** Delete `key` from every location in `plan`. A thrown delete propagates. */
+export declare function deleteThroughPlan(store: KeychainStoreLike, key: string, options: object, plan: readonly KeychainGroupOption[]): Promise<void>;
+/**
+ * `store` with every call routed to `item`'s groups for this app: reads walk
+ * the read plan, writes carry the write option (throwing for a role that may
+ * not hold the item), deletes reach every location. The constants of the
+ * wrapped store are kept, so `store.WHEN_UNLOCKED_THIS_DEVICE_ONLY` still reads.
+ */
+export declare function groupedKeychainStore<S extends KeychainStoreLike>(store: S, access: KeychainAccess, item: KeychainItemClass): S;