@oxy.so/services 10.0.0 → 11.0.0

package/android/build.gradle

@@ -16,6 +16,6 @@ android {
 
 dependencies {
   // Hardware-backed EncryptedSharedPreferences (MasterKey AES256_GCM) for the
-  // cross-app shared identity keypair.
+  // device-session and background-session credentials.
   implementation "androidx.security:security-crypto:1.1.0-alpha06"
 }

package/android/src/main/AndroidManifest.xml

@@ -1,10 +1,10 @@
 <manifest>
   <!--
-    Intentionally empty. The signature-protected <permission> and the
-    <provider> that hosts the shared identity are declared per-app by the
-    Commons config plugin (`withSharedIdentityProvider.js`), NOT here — only
-    Commons (the identity vault) should host the provider, and its authority is
-    the app's own ${applicationId}.identity. Reader apps add only the matching
-    <uses-permission> via `withSharedIdentityReader.js`.
+    Intentionally empty. The config plugins inject everything per app:
+    `withOxySharedPermissions` declares and requests the signature-level
+    `so.oxy.permission.IDENTITY` and `so.oxy.permission.DEVICE_SESSION` in EVERY
+    Oxy app and adds the `<queries>` for the provider authorities;
+    `withSharedDeviceSessionProvider` hosts the device-session provider in the
+    host apps (Commons, Accounts). The identity provider is Commons' own module.
   -->
 </manifest>

package/android/src/main/java/so/oxy/devicesession/OxyDeviceSessionModule.kt

@@ -10,11 +10,23 @@ import expo.modules.kotlin.modules.ModuleDefinition
 /**
  * JS bridge for the shared DeviceSession credential.
  *
- * - `read` resolves the credential this DEVICE holds, from the sibling providers
- *   first and this app's own store second (see [readShared] for why that order).
- * - `write` publishes into this app's own store only, and reports whether a
- *   read-back confirmed it.
- * - `clear` drops this app's copy.
+ * The credential lives in the HOST apps only — Commons and Accounts, prod and
+ * dev ([HOST_AUTHORITIES]) — each in its own [OxyDeviceSessionStore]. Oxy apps
+ * do not share a UID, so no app can see another's files; everything else goes
+ * through the hosts' [OxyDeviceSessionProvider]:
+ *
+ * - `read` sweeps the hosts in [HOST_AUTHORITIES] order, Commons first, and
+ *   returns the first credential it finds. A host reads ITSELF from its own
+ *   store instead of calling its own provider.
+ * - `write` publishes to EVERY installed host (itself locally, the others
+ *   through their providers). It reports success only when every installed
+ *   host either confirmed the new credential by read-back or, having refused
+ *   it, was cleared: a host left holding an OLDER credential would win the
+ *   sweep and hand every app a stale secret.
+ * - `clear` drops the credential from every reachable host.
+ *
+ * An app that is not a host keeps no copy of its own: with no host installed
+ * there is no shared credential, which the sweep reports as `absent`.
  *
  * ## `read` returns a STATUS, not a nullable value
  *
@@ -54,22 +66,22 @@ class OxyDeviceSessionModule : Module() {
       if (deviceId.isEmpty() || deviceSecret.isEmpty()) {
         return@AsyncFunction false
       }
-      OxyDeviceSessionStore.write(context, deviceId, deviceSecret)
+      publish(deviceId, deviceSecret)
     }
 
     AsyncFunction("clear") {
-      OxyDeviceSessionStore.clear(context)
+      clearShared()
     }
   }
 
+  /** This app's own provider authority; a host when it is in [HOST_AUTHORITIES]. */
+  private val selfAuthority: String
+    get() = "${context.packageName}$AUTHORITY_SUFFIX"
+
   /**
-   * Providers FIRST, this app's own store second.
-   *
-   * Under `android:sharedUserId="so.oxy.shared"` every Oxy app sees one data
-   * directory, so for a UID member the local file IS the group's file and the
-   * order changes nothing. It matters for a same-signature app OUTSIDE the UID:
-   * there the local file is a private mirror of whatever that app itself last
-   * wrote, so reading it first would shadow the group's real credential forever.
+   * The hosts in [HOST_AUTHORITIES] order; this app, if it is one, from its own
+   * store. Every app sweeps the same list in the same order, so they all adopt
+   * the same credential.
    *
    * `unavailable` is sticky across the whole sweep: if ANY source could not be
    * read and none produced a credential, the answer is `unavailable`, not
@@ -79,8 +91,9 @@ class OxyDeviceSessionModule : Module() {
   private fun readShared(): Map<String, String> {
     var unavailableReason: String? = null
 
-    for (authority in PROVIDER_AUTHORITIES) {
-      when (val read = callProvider(authority)) {
+    for (authority in HOST_AUTHORITIES) {
+      val read = if (authority == selfAuthority) OxyDeviceSessionStore.read(context) else callProvider(authority)
+      when (read) {
         is DeviceSessionRead.Present -> return present(read)
         is DeviceSessionRead.Unavailable -> unavailableReason = unavailableReason ?: read.reason
         // Absent, or no provider there at all (not installed, refused, threw) —
@@ -89,12 +102,6 @@ class OxyDeviceSessionModule : Module() {
       }
     }
 
-    when (val local = OxyDeviceSessionStore.read(context)) {
-      is DeviceSessionRead.Present -> return present(local)
-      is DeviceSessionRead.Unavailable -> unavailableReason = unavailableReason ?: local.reason
-      is DeviceSessionRead.Absent -> Unit
-    }
-
     val reason = unavailableReason
     return if (reason != null) {
       mapOf(
@@ -106,6 +113,70 @@ class OxyDeviceSessionModule : Module() {
     }
   }
 
+  /**
+   * Write the credential to every installed host.
+   *
+   * The sweep adopts the FIRST host holding a credential, so a host that kept
+   * an older one would shadow this write for every app: they would adopt the
+   * stale secret, get a 401, sign in again, publish again, and loop. So a host
+   * that did not confirm the write is cleared, and the write counts only when
+   * at least one host confirmed it and no installed host is left holding
+   * anything else. Hosts that are not installed do not count.
+   */
+  private fun publish(deviceId: String, deviceSecret: String): Boolean {
+    var confirmed = 0
+    var stale = false
+    for (authority in HOST_AUTHORITIES) {
+      if (!isInstalled(authority)) continue
+      val ok = if (authority == selfAuthority) {
+        OxyDeviceSessionStore.write(context, deviceId, deviceSecret)
+      } else {
+        callWrite(authority, deviceId, deviceSecret)
+      }
+      if (ok) {
+        confirmed += 1
+      } else if (!clearHost(authority)) {
+        stale = true
+      }
+    }
+    return confirmed > 0 && !stale
+  }
+
+  /** Drop the credential from every installed host. Best-effort. */
+  private fun clearShared() {
+    for (authority in HOST_AUTHORITIES) {
+      if (isInstalled(authority)) clearHost(authority)
+    }
+  }
+
+  /** Whether some app on this device hosts [authority] (and we may see it). */
+  private fun isInstalled(authority: String): Boolean =
+    authority == selfAuthority ||
+      runCatching { context.packageManager.resolveContentProvider(authority, 0) != null }.getOrDefault(false)
+
+  /** One host's `write`; false when it refused, threw, or did not confirm. */
+  private fun callWrite(authority: String, deviceId: String, deviceSecret: String): Boolean = runCatching {
+    val extras = Bundle().apply {
+      putString(OxyDeviceSessionStore.KEY_DEVICE_ID, deviceId)
+      putString(OxyDeviceSessionStore.KEY_DEVICE_SECRET, deviceSecret)
+    }
+    context.contentResolver
+      .call(Uri.parse("content://$authority"), OxyDeviceSessionProvider.METHOD_WRITE, null, extras)
+      ?.getBoolean(OxyDeviceSessionProvider.KEY_OK, false) == true
+  }.getOrDefault(false)
+
+  /** Empty one host; true when it confirmed the store is empty. */
+  private fun clearHost(authority: String): Boolean =
+    if (authority == selfAuthority) {
+      OxyDeviceSessionStore.clear(context)
+    } else {
+      runCatching {
+        context.contentResolver
+          .call(Uri.parse("content://$authority"), OxyDeviceSessionProvider.METHOD_CLEAR, null, null)
+          ?.getBoolean(OxyDeviceSessionProvider.KEY_OK, false) == true
+      }.getOrDefault(false)
+    }
+
   private fun present(read: DeviceSessionRead.Present): Map<String, String> = mapOf(
     OxyDeviceSessionProvider.KEY_STATUS to OxyDeviceSessionProvider.STATUS_PRESENT,
     OxyDeviceSessionStore.KEY_DEVICE_ID to read.deviceId,
@@ -113,7 +184,7 @@ class OxyDeviceSessionModule : Module() {
   )
 
   /**
-   * Call one sibling provider. `null` means "nothing to learn from this one" —
+   * Call one host's `read`. `null` means "nothing to learn from this one" —
    * the app is not installed, package visibility hid it, the permission was
    * refused, or the call threw. A provider that answered but could not read its
    * own store returns [DeviceSessionRead.Unavailable], which the sweep keeps.
@@ -144,35 +215,29 @@ class OxyDeviceSessionModule : Module() {
         DeviceSessionRead.Unavailable(
           bundle.getString(OxyDeviceSessionProvider.KEY_REASON) ?: "PeerUnavailable",
         )
-      // An older sibling that predates this protocol. It said something we do not
+      // A status this build does not know. It said something we do not
       // understand, so we have learned nothing — never read that as "absent".
       else -> DeviceSessionRead.Unavailable("UnrecognisedProviderStatus")
     }
   }.getOrNull()
 
   companion object {
+    private const val AUTHORITY_SUFFIX = ".devicesession"
+
     /**
-     * Sibling authorities to sweep, in order. Each official Oxy Android app hosts
-     * the provider at `${applicationId}.devicesession` via the
-     * `withSharedDeviceSession` config plugin, and both the prod and `.dev`
-     * variants are listed so a developer build can join a device too.
+     * The hosts, in sweep order: Commons, then Accounts, each prod before dev.
+     * Each hosts [OxyDeviceSessionProvider] at `${applicationId}.devicesession`
+     * through the `withSharedDeviceSessionProvider` config plugin.
      *
-     * MAINTAINED LIST, and the constraint on it is specific: every entry must be
-     * an app inside the `so.oxy.shared` UID. UID members all serve ONE file, so
-     * the sweep is deterministic no matter which of them answers first. Adding an
-     * app that is same-signature but NOT in the UID would put a second,
-     * independent copy of "the shared credential" into the sweep and make the
-     * winner depend on list order.
-     *
-     * The same authorities must also be added to the `<queries>` block in
-     * `withSharedDeviceSession.js`, or Android 11+ package-visibility filtering
-     * hides them from `ContentResolver.call` and the sweep silently finds nothing.
+     * The same authorities must be in the `<queries>` of
+     * `withOxySharedPermissions.js`, or Android 11+ package visibility hides
+     * them from `ContentResolver.call` and the sweep silently finds nothing.
      */
-    private val PROVIDER_AUTHORITIES = listOf(
-      "so.oxy.accounts.devicesession",
-      "so.oxy.accounts.dev.devicesession",
+    private val HOST_AUTHORITIES = listOf(
       "so.oxy.commons.devicesession",
       "so.oxy.commons.dev.devicesession",
+      "so.oxy.accounts.devicesession",
+      "so.oxy.accounts.dev.devicesession",
     )
   }
 }

package/android/src/main/java/so/oxy/devicesession/OxyDeviceSessionProvider.kt

@@ -2,29 +2,37 @@ package so.oxy.devicesession
 
 import android.content.ContentProvider
 import android.content.ContentValues
-import android.content.Context
-import android.content.pm.PackageManager
 import android.database.Cursor
 import android.net.Uri
 import android.os.Bundle
+import so.oxy.security.OxyCallerPolicy
 
 /**
- * Cross-process READ surface for the shared DeviceSession credential, declared
- * per-app by the `withSharedDeviceSession` config plugin at authority
- * `${applicationId}.devicesession` behind a `signature`-level permission.
+ * The device's shared DeviceSession credential, hosted by the HOST apps
+ * (Commons and Accounts, prod and dev) at `${applicationId}.devicesession`,
+ * declared by the `withSharedDeviceSessionProvider` config plugin behind the
+ * `signature`-level `so.oxy.permission.DEVICE_SESSION`.
  *
- * The signature check below is belt-and-suspenders on top of that permission:
- * even if the manifest gate were ever misconfigured, a differently-signed caller
- * still gets nothing. Same-signature is the whole trust boundary — an
- * incorrectly-signed app cannot read this slot, and there is no other way in.
+ * Oxy apps do not share a UID, so each app's files are its own: the credential
+ * lives ONCE per host, in the host's own [OxyDeviceSessionStore], and every
+ * other app reads and writes it through this provider
+ * ([OxyDeviceSessionModule] sweeps and fans out across the hosts).
  *
- * READ-ONLY across the process boundary, deliberately. A caller may join the
- * device's session; it may not seed or overwrite another app's. Writes happen
- * only in-process via [OxyDeviceSessionModule], against this app's own store.
+ * | method  | extras                     | answer                                   |
+ * |---------|----------------------------|------------------------------------------|
+ * | `read`  | –                          | `status` (+ `deviceId`, `deviceSecret`)  |
+ * | `write` | `deviceId`, `deviceSecret` | `ok`: whether a read-back confirmed it   |
+ * | `clear` | –                          | `ok`: whether a read-back found it empty |
  *
- * What crosses the boundary is a session credential — never the identity
- * keypair, which lives behind `so.oxy.identity.OxyIdentityProvider` under a
- * different permission. That separation is the point.
+ * The manifest permission is necessary but not sufficient: inside `call()`,
+ * [OxyCallerPolicy] takes the caller from the Binder (never from the request)
+ * and requires an allow-listed Oxy package signed with this app's certificate.
+ * Anything else gets `null`.
+ *
+ * What crosses the boundary is a session credential — ordinary, rotatable and
+ * server-revocable — and nothing else. The identity key is not in this app's
+ * reach at all: Commons holds it, and answers for it through a different
+ * provider, under a different permission. That separation is the point.
  *
  * All standard CRUD operations are no-ops; this provider exists solely for the
  * `call()` channel.
@@ -33,11 +41,27 @@ class OxyDeviceSessionProvider : ContentProvider() {
   override fun onCreate(): Boolean = true
 
   override fun call(method: String, arg: String?, extras: Bundle?): Bundle? {
-    if (method != METHOD_READ) return null
     val ctx = context ?: return null
-    if (!callerSignatureMatches(ctx)) return null
+    if (method != METHOD_READ && method != METHOD_WRITE && method != METHOD_CLEAR) return null
+    OxyCallerPolicy.resolveCaller(ctx, "devicesession.$method") ?: return null
 
-    return when (val read = OxyDeviceSessionStore.read(ctx)) {
+    return when (method) {
+      METHOD_READ -> readBundle(OxyDeviceSessionStore.read(ctx))
+      METHOD_WRITE -> {
+        val deviceId = extras?.getString(OxyDeviceSessionStore.KEY_DEVICE_ID)
+        val deviceSecret = extras?.getString(OxyDeviceSessionStore.KEY_DEVICE_SECRET)
+        val ok = !deviceId.isNullOrEmpty() && !deviceSecret.isNullOrEmpty() &&
+          OxyDeviceSessionStore.write(ctx, deviceId, deviceSecret)
+        Bundle().apply { putBoolean(KEY_OK, ok) }
+      }
+      else -> {
+        Bundle().apply { putBoolean(KEY_OK, OxyDeviceSessionStore.clear(ctx)) }
+      }
+    }
+  }
+
+  private fun readBundle(read: DeviceSessionRead): Bundle =
+    when (read) {
       is DeviceSessionRead.Present -> Bundle().apply {
         putString(KEY_STATUS, STATUS_PRESENT)
         putString(OxyDeviceSessionStore.KEY_DEVICE_ID, read.deviceId)
@@ -52,20 +76,6 @@ class OxyDeviceSessionProvider : ContentProvider() {
         putString(KEY_REASON, read.reason)
       }
     }
-  }
-
-  /**
-   * True when the calling package shares this app's signing certificate. Uses
-   * `checkSignatures` (deprecated but still the simplest correct cross-package
-   * signature comparison; returns SIGNATURE_MATCH only for same-cert apps).
-   */
-  private fun callerSignatureMatches(ctx: Context): Boolean {
-    val caller = callingPackage ?: return false
-    return runCatching {
-      @Suppress("DEPRECATION")
-      ctx.packageManager.checkSignatures(caller, ctx.packageName) == PackageManager.SIGNATURE_MATCH
-    }.getOrDefault(false)
-  }
 
   override fun query(
     uri: Uri,
@@ -90,6 +100,9 @@ class OxyDeviceSessionProvider : ContentProvider() {
 
   companion object {
     const val METHOD_READ = "read"
+    const val METHOD_WRITE = "write"
+    const val METHOD_CLEAR = "clear"
+    const val KEY_OK = "ok"
     const val KEY_STATUS = "status"
     const val KEY_REASON = "reason"
     const val STATUS_PRESENT = "present"

package/android/src/main/java/so/oxy/devicesession/OxyDeviceSessionStore.kt

@@ -24,44 +24,36 @@ internal sealed interface DeviceSessionRead {
 
 /**
  * The cross-app DeviceSession credential — `deviceId` + `deviceSecret`, and
- * nothing else.
+ * nothing else — in a HOST app's own data directory.
  *
- * This is NOT the identity keypair. `so.oxy.identity.OxyIdentityStore` holds the
- * self-custody private key that signs identity approvals and cannot be
- * re-created; this file holds an ordinary session credential the server can
- * revoke and any signed-in app can re-publish. They are separate files behind
- * separate providers with separate permissions precisely so an app that only
- * needs a session is never handed the key.
+ * This is NOT the identity keypair. Commons holds the self-custody private key
+ * that signs identity approvals and cannot be re-created, in its own module and
+ * behind its own provider; this file holds an ordinary session credential the
+ * server can revoke and any signed-in app can re-publish. They are separate
+ * files behind separate providers with separate permissions precisely so an app
+ * that only needs a session is never near the key.
  *
- * Under `android:sharedUserId="so.oxy.shared"` every Oxy app sees ONE data
- * directory, so this file is literally shared between them — that is the primary
- * transport, and [OxyDeviceSessionProvider] extends the same bytes to a
- * same-signature app outside the UID.
+ * Every Oxy app has its own UID and its own data directory, so only the hosts
+ * (Commons and Accounts) keep this file; [OxyDeviceSessionProvider] is how every
+ * other app reads and writes it.
  */
 internal object OxyDeviceSessionStore {
-  /**
-   * Global (not package-suffixed) on purpose — the opposite choice from
-   * `oxy_background_session`, and for the opposite reason. That store is
-   * per-app precisely so one app cannot touch another's widget credential. This
-   * one EXISTS to be one value shared by every app in the UID; scoping it per
-   * package would give each app its own copy and defeat the whole point.
-   */
+  /** One file per host; the other apps reach it through the host's provider. */
   const val PREFS_NAME = "oxy_shared_device_session"
   const val KEY_DEVICE_ID = "deviceId"
   const val KEY_DEVICE_SECRET = "deviceSecret"
 
   /**
    * [RecoveryPolicy.RebuildFileOnly] — this store must NEVER escalate to a
-   * UID-shared master-key reset.
+   * master-key reset.
    *
    * What it holds is DERIVED: every signed-in app re-publishes the credential
    * from its own durable copy, so losing this file costs at most one interactive
    * sign-in on a device that has no other Oxy app installed. A master-key reset
-   * would wipe every other Oxy store sharing the alias — including the
-   * self-custody identity keypair, which is IRREPLACEABLE. Trading someone's
-   * unrecoverable identity to save a credential we can simply re-publish is never
-   * the right trade, so the escalation is not merely discouraged here, it is
-   * unreachable.
+   * would wipe every other encrypted store of this app sharing the alias — in
+   * Commons, that includes the identity signer store. Trading an identity copy to
+   * save a credential we can simply re-publish is never the right trade, so the
+   * escalation is not merely discouraged here, it is unreachable.
    *
    * Consequence worth stating: a stage-1 heal WIPES this file. That surfaces as
    * `Absent`, which is honest — after the wipe the slot really is empty, and the
@@ -109,7 +101,10 @@ internal object OxyDeviceSessionStore {
     }.getOrDefault(false)
 
   /** Drop the shared credential. Best-effort; safe to call when already empty. */
-  fun clear(context: Context) {
-    runCatching { prefs(context).edit().clear().commit() }
-  }
+  fun clear(context: Context): Boolean =
+    runCatching {
+      val p = prefs(context)
+      p.edit().clear().commit()
+      p.getString(KEY_DEVICE_ID, null) == null && p.getString(KEY_DEVICE_SECRET, null) == null
+    }.getOrDefault(false)
 }

package/android/src/main/java/so/oxy/identity/OxyIdentityModule.kt

@@ -8,18 +8,32 @@ import expo.modules.kotlin.modules.Module
 import expo.modules.kotlin.modules.ModuleDefinition
 
 /**
- * JS bridge for the cross-app shared Oxy identity.
+ * JS bridge to the Oxy identity Commons holds: the client half only.
  *
- * - `putShared` persists the keypair into THIS app's own hardware-backed
- *   EncryptedSharedPreferences (only Commons calls this).
- * - `getShared` resolves the keypair from the LOCAL store first (Commons reading
- *   itself), then from the Commons ContentProvider — prod authority, then the
- *   dev-variant authority. The `signature` permission on the provider means only
- *   apps signed with the shared Oxy release key can resolve it.
- * - `hasShared` / `clearShared` are the check + local teardown helpers.
+ * Commons is the ONLY Oxy app that holds the identity private key. Its identity
+ * host (a ContentProvider inside Commons, at `${applicationId}.identity`) answers
+ * other Oxy apps with the public key, challenge proofs and derived values —
+ * never the key, the way apps get tokens from `AccountManager`. This module
+ * calls it: the prod authority first, then the dev variant's.
  *
- * Every failure resolves to null / no-op so the JS layer degrades to the app's
- * normal interactive sign-in path.
+ * The call crosses a process boundary between two UIDs, so it needs the
+ * `signature`-level `so.oxy.permission.IDENTITY` (every Oxy app declares and
+ * requests it through `withOxySharedPermissions`) and a `<queries>` entry for the
+ * authority (same plugin). Commons then checks the caller's package and
+ * certificate itself.
+ *
+ * | JS function                        | Commons method      | resolves                              |
+ * |------------------------------------|---------------------|---------------------------------------|
+ * | `describe()`                       | `describe`          | `{ v, publicKey }`                    |
+ * | `proveIdentity(challenge)`         | `proveIdentity`     | `{ publicKey, signature, timestamp }` |
+ * | `deriveScopedSeed(info)`           | `deriveScopedSeed`  | seed hex                              |
+ * | `signSocialReceive(index, digest)` | `signSocialReceive` | `{ signature, publicKey }`            |
+ *
+ * Every failure — Commons not installed, no identity, the caller refused, an
+ * exception — resolves `null`, and the JS side (`@oxy.so/protocol`'s
+ * `loadCommonsIdentityBridge`) narrows whatever does come back. Plain scalars in,
+ * plain `Map`s out; see `so.oxy.session.OxyBackgroundSessionModule` on why this
+ * package never uses an Expo `Record`.
  */
 class OxyIdentityModule : Module() {
   private val context: Context
@@ -28,57 +42,89 @@ class OxyIdentityModule : Module() {
   override fun definition() = ModuleDefinition {
     Name("OxyIdentity")
 
-    AsyncFunction("getShared") {
-      readShared()
+    AsyncFunction("describe") {
+      ask(METHOD_DESCRIBE, null) { bundle ->
+        val publicKey = bundle.getString(KEY_PUBLIC_KEY)
+        if (publicKey.isNullOrEmpty()) null
+        else mapOf(KEY_VERSION to bundle.getInt(KEY_VERSION), KEY_PUBLIC_KEY to publicKey)
+      }
     }
 
-    AsyncFunction("putShared") { privateKey: String, publicKey: String ->
-      OxyIdentityStore.write(context, privateKey, publicKey)
+    AsyncFunction("proveIdentity") { challenge: String ->
+      ask(METHOD_PROVE_IDENTITY, Bundle().apply { putString(KEY_CHALLENGE, challenge) }) { bundle ->
+        val publicKey = bundle.getString(KEY_PUBLIC_KEY)
+        val signature = bundle.getString(KEY_SIGNATURE)
+        val timestamp = bundle.getLong(KEY_TIMESTAMP, 0L)
+        if (publicKey.isNullOrEmpty() || signature.isNullOrEmpty() || timestamp <= 0L) null
+        else mapOf(
+          KEY_PUBLIC_KEY to publicKey,
+          KEY_SIGNATURE to signature,
+          // A JS number: epoch milliseconds are exact in a double.
+          KEY_TIMESTAMP to timestamp.toDouble(),
+        )
+      }
     }
 
-    AsyncFunction("hasShared") {
-      readShared() != null
+    AsyncFunction("deriveScopedSeed") { info: String ->
+      ask(METHOD_DERIVE_SCOPED_SEED, Bundle().apply { putString(KEY_INFO, info) }) { bundle ->
+        bundle.getString(KEY_SEED)?.takeIf { it.isNotEmpty() }
+      }
     }
 
-    AsyncFunction("clearShared") {
-      OxyIdentityStore.clear(context)
+    AsyncFunction("signSocialReceive") { index: Int, digest: String ->
+      val extras = Bundle().apply {
+        putInt(KEY_INDEX, index)
+        putString(KEY_DIGEST, digest)
+      }
+      ask(METHOD_SIGN_SOCIAL_RECEIVE, extras) { bundle ->
+        val signature = bundle.getString(KEY_SIGNATURE)
+        val publicKey = bundle.getString(KEY_PUBLIC_KEY)
+        if (signature.isNullOrEmpty() || publicKey.isNullOrEmpty()) null
+        else mapOf(KEY_SIGNATURE to signature, KEY_PUBLIC_KEY to publicKey)
+      }
     }
   }
 
   /**
-   * Local EncryptedSharedPreferences first, then the Commons provider (prod
-   * authority, then dev). Returns null on any failure.
+   * Call [method] on the first Commons authority that answers, and read the
+   * answer with [read]. An authority that is absent, refuses, or throws is
+   * skipped; nothing answering is `null`.
    */
-  private fun readShared(): Map<String, String>? {
-    runCatching { OxyIdentityStore.read(context) }.getOrNull()?.let { (priv, pub) ->
-      return mapOf("privateKey" to priv, "publicKey" to pub)
-    }
-
-    for (authority in PROVIDER_AUTHORITIES) {
-      val result = runCatching { callProvider(authority) }.getOrNull()
-      if (result != null) return result
+  private fun <T> ask(method: String, extras: Bundle?, read: (Bundle) -> T?): T? {
+    for (authority in COMMONS_AUTHORITIES) {
+      val bundle = runCatching {
+        context.contentResolver.call(Uri.parse("content://$authority"), method, null, extras)
+      }.getOrNull() ?: continue
+      val value = runCatching { read(bundle) }.getOrNull()
+      if (value != null) return value
     }
     return null
   }
 
-  private fun callProvider(authority: String): Map<String, String>? {
-    val uri = Uri.parse("content://$authority")
-    val bundle: Bundle = context.contentResolver.call(uri, METHOD_GET_SHARED, null, null)
-      ?: return null
-    val priv = bundle.getString(OxyIdentityStore.KEY_PRIVATE) ?: return null
-    val pub = bundle.getString(OxyIdentityStore.KEY_PUBLIC) ?: return null
-    if (priv.isEmpty() || pub.isEmpty()) return null
-    return mapOf("privateKey" to priv, "publicKey" to pub)
-  }
-
   companion object {
-    private const val METHOD_GET_SHARED = "getShared"
+    private const val METHOD_DESCRIBE = "describe"
+    private const val METHOD_PROVE_IDENTITY = "proveIdentity"
+    private const val METHOD_DERIVE_SCOPED_SEED = "deriveScopedSeed"
+    private const val METHOD_SIGN_SOCIAL_RECEIVE = "signSocialReceive"
+
+    private const val KEY_VERSION = "v"
+    private const val KEY_PUBLIC_KEY = "publicKey"
+    private const val KEY_CHALLENGE = "challenge"
+    private const val KEY_SIGNATURE = "signature"
+    private const val KEY_TIMESTAMP = "timestamp"
+    private const val KEY_INFO = "info"
+    private const val KEY_SEED = "seed"
+    private const val KEY_INDEX = "index"
+    private const val KEY_DIGEST = "digest"
 
-    // Commons hosts the provider at "${applicationId}.identity". Try the prod
-    // app id first, then the dev variant ("so.oxy.commons.dev").
-    private val PROVIDER_AUTHORITIES = listOf(
+    /**
+     * Commons hosts its identity at "${applicationId}.identity": the prod app
+     * first, then the dev variant. Keep in step with `withOxySharedPermissions`'
+     * `<queries>`, or Android 11+ package visibility hides the provider.
+     */
+    private val COMMONS_AUTHORITIES = listOf(
       "so.oxy.commons.identity",
-      "so.oxy.commons.dev.identity"
+      "so.oxy.commons.dev.identity",
     )
   }
 }