@oxy.so/services 1.0.0

package/src/ui/session/backgroundSession.ts

@@ -0,0 +1,313 @@
+/**
+ * The JS half of the native background session credential.
+ *
+ * A home-screen widget or a sync job refreshes while the app process is dead:
+ * there is no JS runtime, so it cannot go through this SDK's normal session lane
+ * at all. Native code needs its own way to obtain a bearer, and this module is
+ * what gives it one — while the app runs, it provisions a purpose-built
+ * credential and hands it to the native store that `so.oxy.session.OxyBackgroundSession`
+ * reads.
+ *
+ * ## Why a separate credential rather than the device secret
+ *
+ * `POST /session/device/token` ROTATES the device secret on every mint, and the
+ * presented secret dies 60 seconds later. Native code minting with it would be a
+ * second writer to the value this SDK's whole session depends on — and since
+ * `createNativeAuthStateStore` serves JS from an in-process mirror that never
+ * re-reads storage, JS would be blind to that rotation. A worker killed between
+ * the server's rotation and its local write would sign the user out of the app.
+ * A credential that nobody rotates removes that failure mode instead of managing
+ * it.
+ *
+ * ## What this does NOT do
+ *
+ * It never reads or writes `oxy.auth.v1` / expo-secure-store. The two credentials
+ * live in different stores with one writer each, so there is nothing to keep in
+ * lockstep and no state that can disagree.
+ *
+ * ## Android only, and web is refused rather than merely unsupported
+ *
+ * Web is gated off by an explicit platform check, not by the native module being
+ * absent — provisioning in a browser origin would be a security downgrade, so it
+ * must not depend on an incidental fact. See {@link loadNativeModule}. iOS has no
+ * implementation yet and resolves to no module, so every function here degrades to
+ * a no-op: an app can enable this and lose nothing on other platforms.
+ */
+import { requireOptionalNativeModule } from 'expo-modules-core';
+import { Platform } from 'react-native';
+import type { OxyServices } from '@oxy.so/core';
+import { logger } from '@oxy.so/core';
+
+/**
+ * The native module's surface. Deliberately write-mostly: there is no `get`,
+ * because JS has no use for the secret it just wrote and keeping native as the
+ * secret's only reader is one less place it can leak from.
+ */
+interface OxyBackgroundSessionNativeModule {
+  /**
+   * Store (replacing) the credential. Resolves `false` when it was rejected or
+   * storage failed.
+   *
+   * Positional scalars rather than one object, matching the native signature — and
+   * that shape is load-bearing, not a preference. Passing an object made this an
+   * Expo Modules `Record`, and a `Record` does not convert in a consumer build of
+   * this package: every call was rejected with `The 1st argument cannot be cast to
+   * type CredentialInput (received class ReadableNativeMap)`, so the credential was
+   * never stored and background refreshes stayed signed out. See the comment on
+   * `AsyncFunction("put")` in `OxyBackgroundSessionModule.kt` for why, and do not
+   * restore the object form without proving on a device that a `Record` converts.
+   *
+   * `expiresAtMs` is epoch millis, parsed from the server's ISO-8601 string here
+   * rather than natively.
+   */
+  put(
+    baseUrl: string,
+    deviceId: string,
+    secret: string,
+    accountId: string,
+    expiresAtMs: number,
+  ): Promise<boolean>;
+  /** Drop the credential and any cached access token. */
+  clear(): Promise<boolean>;
+  /** What is stored: the owning account and its expiry (epoch millis), or `null`. */
+  peek(): Promise<{ accountId: string; expiresAt: number } | null>;
+}
+
+/**
+ * Re-provision once the remaining lifetime drops below this.
+ *
+ * The server issues a 30-day credential; renewing with a week to spare means an
+ * app opened even occasionally always holds a live one, while an app left unopened
+ * for a month lets it lapse — which is the intended outcome, not a failure.
+ */
+const RENEW_WHEN_REMAINING_MS = 7 * 24 * 60 * 60 * 1000;
+
+let nativeModule: OxyBackgroundSessionNativeModule | null | undefined;
+
+/**
+ * Resolve the native module once — and refuse outright on web.
+ *
+ * ## Web is excluded on purpose, and not merely because the module is absent
+ *
+ * The credential is deliberately NON-ROTATING and long-lived, which is safe only
+ * because native background code is its sole consumer and nobody rotates it. A
+ * browser origin already holds the ROTATING `deviceSecret`, and it has no
+ * background worker to serve — so provisioning there would add a strictly weaker
+ * long-lived secret alongside a stronger short-lived one. That is a downgrade, not
+ * a harmless no-op, and the harm lands at the PROVISION CALL (which mints a live
+ * server-side credential) regardless of whether anything manages to store it.
+ *
+ * That property must not rest on `requireOptionalNativeModule` happening to return
+ * `null` on web. It does today — the module is registered for android only — but
+ * that is an incidental fact a future web shim or a web-build native-module mock
+ * would quietly reverse. So the platform is checked FIRST, before we even ask the
+ * registry, and every entry point in this module inherits the gate.
+ *
+ * (A pre-deploy server makes this visible too: oxy-api's `sessionDevice` router
+ * applies `requireSameSiteOrigin` path-agnostically, so an unmatched path answers
+ * `404` to a native caller but `403 BAD_ORIGIN` to a browser one. Core's degrade is
+ * deliberately narrow — `404 → null` only — because a real origin misconfiguration
+ * on a CURRENT server also returns 403, and swallowing that would hide a genuine
+ * bug. Platform gating belongs here, where the platform is actually known.)
+ *
+ * `requireOptionalNativeModule` (a static import Metro always resolves) rather
+ * than a dynamic `import(moduleName)`: the latter compiles to `require(variable)`
+ * in the CJS build, which Metro cannot resolve inside a consuming app — it
+ * silently returned `null` there, which is exactly how the cross-app SSO bridge
+ * broke once. Same reasoning as `loadSharedIdentityBridge` in `@oxy.so/protocol`.
+ */
+function loadNativeModule(): OxyBackgroundSessionNativeModule | null {
+  if (nativeModule === undefined) {
+    if (Platform.OS === 'web') {
+      nativeModule = null;
+      return nativeModule;
+    }
+    const native = requireOptionalNativeModule<Partial<OxyBackgroundSessionNativeModule>>(
+      'OxyBackgroundSession',
+    );
+    nativeModule =
+      native &&
+      typeof native.put === 'function' &&
+      typeof native.clear === 'function' &&
+      typeof native.peek === 'function'
+        ? {
+            put: native.put.bind(native),
+            clear: native.clear.bind(native),
+            peek: native.peek.bind(native),
+          }
+        : null;
+  }
+  return nativeModule;
+}
+
+/** Whether this platform/app can hold a background credential at all. */
+export function isBackgroundSessionSupported(): boolean {
+  return loadNativeModule() !== null;
+}
+
+/**
+ * Drop the stored credential. No-op where unsupported, and never throws.
+ *
+ * Called on sign-out and BEFORE an account switch's network work, so the window
+ * in which background code could still serve the previous account is as short as
+ * one local write.
+ */
+export async function clearBackgroundSession(): Promise<void> {
+  const native = loadNativeModule();
+  if (!native) {
+    return;
+  }
+  try {
+    await native.clear();
+  } catch (error) {
+    logger.warn('[backgroundSession] could not clear the native background credential', {
+      component: 'backgroundSession',
+      error,
+    });
+  }
+}
+
+export interface BackgroundSessionSyncInput {
+  oxyServices: OxyServices;
+  /** The signed-in account, or `null` when signed out. */
+  userId: string | null;
+  /** Whether a bearer is available yet — provisioning requires one. */
+  canUsePrivateApi: boolean;
+  /**
+   * Whether this run is still the current one. A run that loses its relevance
+   * mid-flight (unmount, or another identity change) must not write the
+   * credential it was about to write.
+   */
+  isCurrent: () => boolean;
+}
+
+/**
+ * Fail LOUDLY when the installed `@oxy.so/core` predates
+ * `provisionBackgroundCredential`.
+ *
+ * This is the one failure here that is a build/dependency mistake rather than a
+ * runtime condition, and it is the one that must never be quiet. Everything else
+ * in `syncBackgroundSession` is caught and logged at warn, which is right for a
+ * flaky network — but applying that to a version skew would leave background
+ * refreshes permanently non-functional behind a warning nobody reads. So this
+ * throws, and logs at ERROR first so it is still visible in a release build whose
+ * rejection handler is silent.
+ *
+ * Reachable only through a runtime skew: the declared `@oxy.so/core` range covers
+ * the method, so a correctly-resolved install cannot get here, and TypeScript
+ * rules it out at compile time.
+ */
+function assertProvisioningAvailable(oxyServices: OxyServices): void {
+  if (typeof oxyServices.provisionBackgroundCredential === 'function') {
+    return;
+  }
+  const message =
+    '[backgroundSession] the installed @oxy.so/core has no provisionBackgroundCredential, ' +
+    'so no background credential can be provisioned and native background refreshes will ' +
+    'never authenticate. Install a @oxy.so/core that satisfies this package\'s declared range.';
+  logger.error(message, undefined, { component: 'backgroundSession' });
+  throw new Error(message);
+}
+
+/**
+ * Bring the native credential in line with the session JS currently holds.
+ *
+ * Ordering is the load-bearing part: a credential belonging to a DIFFERENT
+ * account is cleared before any network call, so a crash mid-provision leaves
+ * background code signed out rather than serving the previous account's data
+ * under the new account's name. The server enforces the same rule independently
+ * (a mint is re-authorized against the live device session, and against its ACTIVE
+ * account), so this is the fast local half of a belt-and-braces pair, not the only
+ * guard.
+ *
+ * Throws for exactly one thing — a `@oxy.so/core` too old to provision (see
+ * {@link assertProvisioningAvailable}). Every other failure is caught and logged:
+ * a background credential is an enhancement, and failing to provision one must
+ * not disturb the session that is working.
+ */
+export async function syncBackgroundSession(input: BackgroundSessionSyncInput): Promise<void> {
+  const native = loadNativeModule();
+  if (!native) {
+    return;
+  }
+  const { oxyServices, userId, canUsePrivateApi, isCurrent } = input;
+
+  // Before the try, so the catch below cannot turn a dependency skew into a
+  // warning. Signed-out is exempt: clearing needs no core method, and a sign-out
+  // must never be blocked by one.
+  if (userId) {
+    assertProvisioningAvailable(oxyServices);
+  }
+
+  try {
+    if (!userId) {
+      // Signed out. Local-only, so it works with no bearer and no network.
+      await native.clear();
+      return;
+    }
+
+    const stored = await native.peek();
+    if (stored && stored.accountId !== userId) {
+      // Identity changed under a live credential — clear FIRST, provision after.
+      await native.clear();
+    }
+
+    const isForCurrentAccount = stored?.accountId === userId;
+    const hasLifeLeft =
+      isForCurrentAccount && stored.expiresAt - Date.now() > RENEW_WHEN_REMAINING_MS;
+    if (hasLifeLeft) {
+      return;
+    }
+
+    // Everything below needs a bearer. Without one yet (cold boot still
+    // resolving) there is nothing to do but wait for the next run — the token
+    // landing re-triggers this.
+    if (!canUsePrivateApi || !isCurrent()) {
+      return;
+    }
+
+    const provisioned = await oxyServices.provisionBackgroundCredential();
+    if (!provisioned) {
+      // `null` means the endpoint is not deployed yet. Expected during the
+      // rollout window (api leads the SDK) and deliberately quiet.
+      return;
+    }
+    if (!isCurrent()) {
+      return;
+    }
+    if (provisioned.accountId !== userId) {
+      // The active account moved while the request was in flight, so this
+      // credential is already for the wrong account. Drop it; the next run
+      // provisions for the account that is actually signed in.
+      await native.clear();
+      return;
+    }
+
+    const expiresAt = Date.parse(provisioned.expiresAt);
+    if (!Number.isFinite(expiresAt)) {
+      logger.warn('[backgroundSession] server returned an unparseable credential expiry', {
+        component: 'backgroundSession',
+      });
+      return;
+    }
+
+    const persisted = await native.put(
+      oxyServices.getBaseURL(),
+      provisioned.deviceId,
+      provisioned.secret,
+      provisioned.accountId,
+      expiresAt,
+    );
+    if (!persisted) {
+      logger.warn(
+        '[backgroundSession] the native store did not retain the background credential; background refreshes stay signed out until the next attempt',
+        { component: 'backgroundSession' },
+      );
+    }
+  } catch (error) {
+    logger.warn('[backgroundSession] could not sync the native background credential', {
+      component: 'backgroundSession',
+      error,
+    });
+  }
+}

package/src/ui/session/createSessionClient.ts

@@ -0,0 +1,59 @@
+import {
+  SessionClient,
+  createSessionClientHost,
+  type OxyServices,
+  type SessionStateOrigin,
+} from '@oxy.so/core';
+import { createTokenTransport } from './tokenTransport';
+
+/**
+ * Wire a `SessionClient` for `@oxy.so/services`.
+ *
+ * The platform-agnostic parts (host adapter, client, projection helpers) live
+ * ONCE in `@oxy.so/core`; this thin factory only injects the pieces specific to
+ * the RN/Expo SDK:
+ *
+ *  - `socket.io-client`'s `io`, STATICALLY imported (socket.io-client is a real
+ *    dependency of `@oxy.so/services`) so realtime session sync never relies on
+ *    core's lazy dynamic import of a bare specifier — bundler-fragile in
+ *    Metro/Expo-web against the published core dist.
+ *  - the device-first {@link createTokenTransport}, which mints a fallback token
+ *    through the ONE shared `httpService.refreshAccessToken` single-flight (it
+ *    reads the persisted `deviceId` + `deviceSecret` via the installed handler,
+ *    so it takes no `store` of its own).
+ *
+ * `onUnauthenticated` fires when an applied device state has zero accounts. It
+ * receives the {@link SessionStateOrigin} so the provider can gate the
+ * destructive credential wipe: a `request`-origin verdict (a REST sign-out /
+ * revocation) clears the persisted store; a `push`-origin verdict (a possibly
+ * transient socket broadcast) clears only the local UI session and KEEPS the
+ * durable device credential. The host is returned alongside the client so the
+ * caller can call `host.setCurrentAccountId(...)` as the active account changes.
+ *
+ * The realtime socket uses bearer when authenticated, or deviceId+deviceSecret
+ * when signed out (after the one-shot join redirect).
+ *
+ * `getPinnedAccountId` reports the account an IDENTITY-BOUND provider
+ * (`sessionMode: 'identity'`) is pinned to, and `null` for every account-mode
+ * provider — which is exactly the value `SessionClient` and the transport read
+ * when the option is absent, so account mode is unchanged. While it reports an
+ * account, the client tracks device state truthfully but never re-binds its
+ * bearer to the device's mutable active account.
+ */
+export function createSessionClient(
+  oxyServices: OxyServices,
+  onUnauthenticated?: (origin: SessionStateOrigin) => void,
+  getPinnedAccountId?: () => string | null,
+): {
+  client: SessionClient;
+  host: ReturnType<typeof createSessionClientHost>;
+} {
+  const host = createSessionClientHost(oxyServices);
+  const transport = createTokenTransport(oxyServices, getPinnedAccountId);
+  const client = new SessionClient(host, {
+    transport,
+    onUnauthenticated,
+    getPinnedAccountId,
+  });
+  return { client, host };
+}

package/src/ui/session/identityBinding.ts

@@ -0,0 +1,116 @@
+/**
+ * Identity-bound sessions — the PLATFORM half of `sessionMode: 'identity'`.
+ *
+ * `@oxy.so/core` owns everything platform-agnostic about an identity-bound
+ * session: the pin store shapes, `resolveIdentityPin`,
+ * `establishIdentitySession`, and the pinned cold-boot / re-mint lanes. What it
+ * deliberately leaves out is WHICH pin store a given runtime should use, so this
+ * module supplies it — web `localStorage` vs the same native SecureStore adapter
+ * the device credential already persists through — and adds the one piece of
+ * state the provider needs on top: a memoised, SYNCHRONOUSLY readable pinned
+ * account id.
+ *
+ * Why the memo matters: `SessionClient.getPinnedAccountId` is a synchronous read
+ * on the socket/apply path, while resolving the pin is asynchronous (a storage
+ * read plus a keychain read, through `resolveIdentityPin`). The provider
+ * resolves it before the cold boot and after every (re-)established identity
+ * session; every read after that is free.
+ */
+import {
+  createNativeIdentityPinStore,
+  createWebIdentityPinStore,
+  resolveIdentityPin,
+  type IdentityBinding,
+} from '@oxy.so/core';
+import { isReactNative } from '../utils/storageHelpers';
+import { createNativeSecureKeyValueStorage } from './nativeSecureStorage';
+
+/**
+ * The provider-scoped identity binding: the core {@link IdentityBinding} handed
+ * to the cold boot and the re-mint handler, plus the resolved pin the projection
+ * and `SessionClient` bind to.
+ */
+export interface IdentitySessionBinding {
+  /** Handed to `runSessionColdBoot` and `installAuthRefreshHandler`. */
+  readonly binding: IdentityBinding;
+  /**
+   * The last resolved pinned account id, read synchronously. `null` until the
+   * first resolve lands, and after a resolve that found no usable pin.
+   */
+  getPinnedAccountId(): string | null;
+  /**
+   * Resolve the pin, reusing the memo once a pinned account is known.
+   * Concurrent callers share one in-flight resolve.
+   */
+  ensurePinnedAccountId(): Promise<string | null>;
+  /**
+   * Drop the memo and re-resolve. Used after a lane that may have rewritten or
+   * cleared the pin (the cold boot, or a re-established identity session).
+   */
+  refreshPinnedAccountId(): Promise<string | null>;
+}
+
+/**
+ * Thrown by every account-graph mutation while the provider runs in
+ * `sessionMode: 'identity'`.
+ *
+ * An identity-bound app's user is the owner of the local identity key — fixed,
+ * for the lifetime of that key. Switching it is not a temporarily-unavailable
+ * operation that could be retried, it is not part of this mode's contract at
+ * all, so the surfaces reject loudly rather than resolving to a no-op that would
+ * read to the caller as a successful switch.
+ */
+export class IdentityBoundSessionError extends Error {
+  override readonly name = 'IdentityBoundSessionError';
+  readonly code = 'identity_bound_session';
+  constructor(readonly operation: string) {
+    super(
+      `"${operation}" is unavailable while the session is identity-bound (sessionMode: "identity"): this app authenticates as the owner of the local identity key and cannot switch accounts.`,
+    );
+  }
+}
+
+/**
+ * Build the identity binding for this runtime. Called ONCE per provider mount,
+ * and ONLY when `sessionMode: 'identity'` — account-mode providers never
+ * construct a pin store.
+ */
+export function createIdentitySessionBinding(): IdentitySessionBinding {
+  const pinStore = isReactNative()
+    ? createNativeIdentityPinStore(createNativeSecureKeyValueStorage())
+    : createWebIdentityPinStore();
+  const binding: IdentityBinding = { pinStore };
+
+  // Only a RESOLVED (non-null) pin is memoised. A `null` outcome is either "not
+  // pinned yet" or an indeterminate key read (locked keychain), and caching
+  // either one would leave this client permanently unpinned for the rest of the
+  // process — the exact state in which it would start following the device's
+  // mutable active account.
+  let pinnedAccountId: string | null = null;
+  let inFlight: Promise<string | null> | null = null;
+
+  const resolve = (): Promise<string | null> => {
+    if (!inFlight) {
+      inFlight = resolveIdentityPin(binding)
+        .then((pin) => {
+          pinnedAccountId = pin?.accountId ?? null;
+          return pinnedAccountId;
+        })
+        .finally(() => {
+          inFlight = null;
+        });
+    }
+    return inFlight;
+  };
+
+  return {
+    binding,
+    getPinnedAccountId: () => pinnedAccountId,
+    ensurePinnedAccountId: () =>
+      pinnedAccountId !== null ? Promise.resolve(pinnedAccountId) : resolve(),
+    refreshPinnedAccountId: () => {
+      pinnedAccountId = null;
+      return resolve();
+    },
+  };
+}

package/src/ui/session/index.ts

@@ -0,0 +1,25 @@
+/**
+ * Session-sync integration layer — intra-package use only.
+ *
+ * `@oxy.so/core` owns the platform-agnostic `SessionClient`, its host adapter,
+ * and the pure `DeviceSessionState → services` projection helpers; those are
+ * re-exported straight from core here so `OxyContext` has one import site.
+ * `@oxy.so/services` supplies only the platform pieces: the thin
+ * `createSessionClient` factory (injects socket.io-client `io` + the
+ * device-first token transport), the `AuthStateStore` factory, and — for
+ * `sessionMode: 'identity'` — the identity binding (platform pin store + the
+ * memoised pinned account id).
+ */
+export { createSessionClient } from './createSessionClient';
+export { createTokenTransport } from './tokenTransport';
+export { createPlatformAuthStateStore } from './authStore';
+export { useBackgroundSessionSync } from './useBackgroundSessionSync';
+export { createIdentitySessionBinding, IdentityBoundSessionError } from './identityBinding';
+export type { IdentitySessionBinding } from './identityBinding';
+export {
+  createSessionClientHost,
+  accountIdsOf,
+  activeSessionIdOf,
+  activeUserOf,
+  deviceStateToClientSessions,
+} from '@oxy.so/core';

package/src/ui/session/nativeSecureStorage.ts

@@ -0,0 +1,98 @@
+/**
+ * The native secure key/value seam every durable `@oxy.so/core` store in this
+ * package is built on.
+ *
+ * `@oxy.so/core` owns the store LOGIC (`createNativeAuthStateStore` for the
+ * zero-cookie device credential, `createNativeIdentityPinStore` for the identity
+ * pin) and takes its persistence as an injected `NativeKeyValueStorage`. This
+ * module supplies that injection ONCE, so those stores can never drift onto
+ * different backings — a device credential in SecureStore and a pin in
+ * AsyncStorage would resolve differently after a keystore reset.
+ *
+ * `expo-secure-store` is loaded via a runtime-computed dynamic import (the same
+ * optional-native-module pattern `OxyProvider` uses for netinfo / keyboard
+ * controller), so the web bundle never pulls it and a device without it falls
+ * back to AsyncStorage rather than crashing.
+ */
+import type { NativeKeyValueStorage } from '@oxy.so/core';
+import { createPlatformStorage } from '../utils/storageHelpers';
+
+// Variable indirection so Metro's static analyzer never traces expo-secure-store
+// into the web bundle; the module is native-only and optional.
+const SECURE_STORE_MODULE = 'expo-secure-store';
+
+interface SecureStoreLike {
+  getItemAsync(key: string): Promise<string | null>;
+  setItemAsync(key: string, value: string): Promise<void>;
+  deleteItemAsync(key: string): Promise<void>;
+}
+
+let secureStorePromise: Promise<SecureStoreLike | null> | null = null;
+
+/**
+ * Resolve the `expo-secure-store` module once (memoised), or `null` when it is
+ * unavailable — callers then fall back to AsyncStorage. Never throws.
+ */
+function loadSecureStore(): Promise<SecureStoreLike | null> {
+  if (!secureStorePromise) {
+    const moduleName = SECURE_STORE_MODULE;
+    secureStorePromise = import(moduleName)
+      .then((mod: Partial<SecureStoreLike>) => {
+        if (
+          typeof mod.getItemAsync === 'function' &&
+          typeof mod.setItemAsync === 'function' &&
+          typeof mod.deleteItemAsync === 'function'
+        ) {
+          return {
+            getItemAsync: mod.getItemAsync.bind(mod),
+            setItemAsync: mod.setItemAsync.bind(mod),
+            deleteItemAsync: mod.deleteItemAsync.bind(mod),
+          } satisfies SecureStoreLike;
+        }
+        return null;
+      })
+      .catch(() => null);
+  }
+  return secureStorePromise;
+}
+
+/**
+ * A native `NativeKeyValueStorage` that prefers `expo-secure-store` (encrypted
+ * at rest) and falls back to AsyncStorage when SecureStore is not installed.
+ * The SecureStore module is resolved lazily on first access so construction
+ * stays synchronous.
+ */
+export function createNativeSecureKeyValueStorage(): NativeKeyValueStorage {
+  let asyncStorage: Awaited<ReturnType<typeof createPlatformStorage>> | null = null;
+  const getAsyncStorage = async () => {
+    if (!asyncStorage) {
+      asyncStorage = await createPlatformStorage();
+    }
+    return asyncStorage;
+  };
+  return {
+    getItem: async (key) => {
+      const secure = await loadSecureStore();
+      if (secure) {
+        return secure.getItemAsync(key);
+      }
+      return (await getAsyncStorage()).getItem(key);
+    },
+    setItem: async (key, value) => {
+      const secure = await loadSecureStore();
+      if (secure) {
+        await secure.setItemAsync(key, value);
+        return;
+      }
+      await (await getAsyncStorage()).setItem(key, value);
+    },
+    removeItem: async (key) => {
+      const secure = await loadSecureStore();
+      if (secure) {
+        await secure.deleteItemAsync(key);
+        return;
+      }
+      await (await getAsyncStorage()).removeItem(key);
+    },
+  };
+}