@oxy.so/services 10.0.0 → 11.0.0

package/android/src/main/java/so/oxy/security/OxyCallerPolicy.kt

@@ -0,0 +1,97 @@
+package so.oxy.security
+
+import android.content.Context
+import android.content.pm.PackageManager
+import android.os.Binder
+import android.os.Build
+import android.util.Log
+import java.security.MessageDigest
+
+/**
+ * Which app is calling one of this package's ContentProviders, and whether it
+ * is an Oxy app.
+ *
+ * Oxy Android apps do not share a UID, so every cross-app call crosses a real
+ * process and permission boundary. The manifest already demands a
+ * `signature`-level permission (`so.oxy.permission.DEVICE_SESSION`); inside
+ * `call()` this checks again, because a permission is necessary but not
+ * sufficient:
+ *
+ * 1. **The package is an Oxy app** listed in [OXY_PACKAGES]. The caller is taken
+ *    from `Binder.getCallingUid()`, never from anything the caller sends.
+ * 2. **It is signed with this app's certificate**: `hasSigningCertificate`
+ *    (SHA-256, API 28+), `checkSignatures` below that.
+ *
+ * Keep [OXY_PACKAGES] identical to the identity host's list in Commons
+ * (`modules/oxy-identity-host`, `OxyCallerPolicy.kt`); a test compares them.
+ */
+internal object OxyCallerPolicy {
+  private const val TAG = "OxyCallerPolicy"
+
+  val OXY_PACKAGES: Set<String> = setOf(
+    "earth.mention.app",
+    "earth.mention.app.dev",
+    "onl.alia.app",
+    "onl.alia.app.dev",
+    "com.allo.app",
+    "com.allo.app.dev",
+    "com.homiio.android",
+    "com.homiio.android.dev",
+    "so.oxy.crowdsource",
+    "so.oxy.crowdsource.dev",
+    "to.peable.app",
+    "to.peable.app.dev",
+    "so.oxy.atlas",
+    "so.oxy.atlas.dev",
+    "to.goway.app",
+    "to.goway.app.dev",
+    "so.oxy.move",
+    "so.oxy.move.dev",
+    "sh.willo.app",
+    "sh.willo.app.dev",
+    "now.moovo.app",
+    "now.moovo.app.dev",
+    "now.moovo.go",
+    "now.moovo.go.dev",
+    "now.moovo.tracker",
+    "now.moovo.tracker.dev",
+    "now.moovo.hub",
+    "now.moovo.hub.dev",
+    "so.oxy.noted",
+    "so.oxy.noted.dev",
+    "so.oxy.accounts",
+    "so.oxy.accounts.dev",
+    "so.oxy.commons",
+    "so.oxy.commons.dev",
+  )
+
+  /**
+   * The calling package when it is allow-listed and signed like this app, or
+   * null (logged with the package names and the method only, never a value).
+   */
+  fun resolveCaller(context: Context, method: String): String? {
+    val pm = context.packageManager
+    val uid = Binder.getCallingUid()
+    val packages = runCatching { pm.getPackagesForUid(uid) }.getOrNull().orEmpty()
+    val caller = packages.firstOrNull { it in OXY_PACKAGES && signedLikeSelf(context, it) }
+    if (caller == null) {
+      Log.w(TAG, "refused $method for ${packages.joinToString().ifEmpty { "uid $uid" }}")
+    }
+    return caller
+  }
+
+  private fun signedLikeSelf(context: Context, pkg: String): Boolean = runCatching {
+    val pm = context.packageManager
+    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
+      val info = pm.getPackageInfo(context.packageName, PackageManager.GET_SIGNING_CERTIFICATES)
+      val signers = info.signingInfo?.apkContentsSigners.orEmpty()
+      signers.isNotEmpty() && signers.any { signer ->
+        val digest = MessageDigest.getInstance("SHA-256").digest(signer.toByteArray())
+        pm.hasSigningCertificate(pkg, digest, PackageManager.CERT_INPUT_SHA256)
+      }
+    } else {
+      @Suppress("DEPRECATION")
+      pm.checkSignatures(pkg, context.packageName) == PackageManager.SIGNATURE_MATCH
+    }
+  }.getOrDefault(false)
+}

package/android/src/main/java/so/oxy/session/OxyBackgroundSessionStore.kt

@@ -22,13 +22,7 @@ import so.oxy.storage.RecoveryPolicy
  * Neither ever rotates the credential — the server does not rotate it either.
  */
 internal object OxyBackgroundSessionStore {
-  /**
-   * Suffix is the hosting app's package name. Oxy apps share the `so.oxy.shared`
-   * Android UID (and therefore one data directory), so a single global prefs name
-   * would let one app that leaves `backgroundSession` off wipe another app's
-   * live credential on launch. Scoping by package keeps each app's widget/sync
-   * store independent.
-   */
+  /** Suffix is the hosting app's package name, so the file says whose credential it holds. */
   private const val PREFS_NAME_PREFIX = "oxy_background_session_"
 
   private fun prefsName(context: Context): String = PREFS_NAME_PREFIX + context.packageName
@@ -61,13 +55,13 @@ internal object OxyBackgroundSessionStore {
 
   /**
    * [RecoveryPolicy.RebuildFileOnly] — this store must NEVER escalate to a
-   * UID-shared master-key reset.
+   * master-key reset.
    *
    * What it holds is disposable: the app re-provisions the credential on its next
    * foreground, so "no credential" is a complete recovery that costs the user
    * nothing (background refreshes render signed out until then). A master-key reset
-   * would wipe every other Oxy store sharing the alias — including the self-custody
-   * identity keypair, which is IRREPLACEABLE. Trading someone else's unrecoverable
+   * would wipe every other encrypted store of this app sharing the alias — in
+   * Commons, including the identity signer store. Trading someone else's unrecoverable
    * data to save data we can simply ask for again is never the right trade, so the
    * escalation is not merely discouraged here, it is unreachable.
    */

package/android/src/main/java/so/oxy/storage/OxyEncryptedPrefs.kt

@@ -18,11 +18,11 @@ import java.security.GeneralSecurityException
  *
  * It used to have a second value, `RegenerateSharedMasterKey`, which deleted the
  * androidx master key (`_androidx_security_master_key_`) when a rebuild failed.
- * That key is ONE Keystore entry for the whole `so.oxy.shared` UID and wraps the
- * keyset of every Oxy prefs file in every Oxy app, so deleting it let one app
- * make every sibling's encrypted prefs unreadable. It was removed for
- * OxyHQ/oxy#1388 and must not come back: no store in any Oxy app deletes a
- * UID-shared key.
+ * That key is ONE Keystore entry for the whole app and wraps the keyset of every
+ * encrypted prefs file in it, so deleting it to heal one file made every other
+ * file unreadable (when Oxy apps still shared a UID, every OTHER app's files
+ * too). It was removed for OxyHQ/oxy#1388 and must not come back: no store
+ * deletes a Keystore entry.
  */
 internal enum class RecoveryPolicy {
   /**
@@ -37,9 +37,9 @@ internal enum class RecoveryPolicy {
  * The ONE way this package opens a hardware-backed [EncryptedSharedPreferences]
  * file.
  *
- * Two stores are built on it — the cross-app identity keypair
- * (`so.oxy.identity.OxyIdentityStore`) and the background session credential
- * (`so.oxy.session.OxyBackgroundSessionStore`) — and both need the same two
+ * The stores built on it — the device session credential
+ * (`so.oxy.devicesession.OxyDeviceSessionStore`) and the background session
+ * credential (`so.oxy.session.OxyBackgroundSessionStore`) — all need the same two
  * non-obvious properties below. They are implemented once here rather than per
  * store: a second copy would be a copy of exactly the reasoning that is easiest
  * to get wrong, and the failure mode of getting it wrong is silent (every read
@@ -67,9 +67,9 @@ internal enum class RecoveryPolicy {
  * ## Keyset self-heal (CRITICAL)
  *
  * The androidx master key that wraps each file's Tink keyset lives under the
- * UID-scoped default alias [MasterKey.DEFAULT_MASTER_KEY_ALIAS] — ONE entry for
- * the whole `so.oxy.shared` UID. When a NEW package joins that shared UID, that
- * master key can be rotated/regenerated, leaving keysets already written on disk
+ * default alias [MasterKey.DEFAULT_MASTER_KEY_ALIAS] — ONE entry for the whole
+ * app. When that master key is regenerated (a Keystore invalidation, a restore
+ * from a device-to-device transfer), keysets already written on disk stay
  * wrapped under the OLD key. `create()` then fails GCM verification
  * (`AEADBadTag` -> `GeneralSecurityException`, or an unreadable keyset ->
  * `IOException`) on EVERY read/write, and `EncryptedSharedPreferences` never
@@ -81,14 +81,13 @@ internal enum class RecoveryPolicy {
  * keysets. If a fresh keyset still cannot be built, the failure propagates and
  * the `runCatching {}` at every call site degrades to "absent".
  *
- * The master key itself is NEVER deleted here. It is shared by the whole UID, so
- * deleting it would make every other Oxy app's prefs file unreadable (and each
- * would then wipe itself on its next open). When the master key is gone — the
- * Keystore of the UID was wiped because some Oxy app's storage was cleared —
- * androidx creates a new one on the next `MasterKey.Builder.build()` and each
+ * The master key itself is NEVER deleted here. It is shared by every file of the
+ * app, so deleting it would make every other one unreadable (and each would then
+ * wipe itself on its next open). When the master key is gone — the app's
+ * Keystore was wiped with its storage — androidx creates a new one on the next `MasterKey.Builder.build()` and each
  * file heals itself through the file-only rebuild above. What was IN those
  * files is lost with the Keystore either way; for the self-custody identity,
- * the keystore-independent device backup brings it back (docs/identity/device-backup.md).
+ * Commons' keystore-independent device backup brings it back (docs/identity/device-backup.md).
  *
  * None of this touches the app's device session, which lives in expo-secure-store
  * under a DISTINCT prefs file ("SecureStore") and DISTINCT keystore aliases
@@ -164,7 +163,7 @@ internal object OxyEncryptedPrefs {
     Log.w(
       TAG,
       "'$prefsName' is still unreadable after a file reset ($recovery). Giving up " +
-        "without touching the UID-shared master key; its owner re-creates it.",
+        "without touching the app-wide master key; its owner re-creates it.",
       cause
     )
     throw cause

package/ios/OxyIdentityModule.swift

@@ -1,33 +1,32 @@
 import ExpoModulesCore
 
 /**
- * iOS no-op implementation of the shared Oxy identity bridge.
+ * iOS stub of the Commons identity bridge.
  *
- * On Apple platforms the cross-app identity share is handled directly by
- * `@oxy.so/core`'s `KeyManager` via the Keychain Access Group
- * (`group.so.oxy.shared`) — there is no ContentProvider equivalent to wrap. So
- * every function here resolves to `nil` / no-op, which makes the JS
- * `loadSharedIdentityBridge()` seam a pass-through on iOS: `KeyManager`'s iOS
- * branches keep using `expo-secure-store` with the keychain group untouched.
+ * On Apple platforms the Oxy identity is shared through the Keychain Access
+ * Group `group.so.oxy.shared`, which `@oxy.so/core`'s `KeyManager` reads
+ * directly; there is no Commons provider to call. Every function resolves `nil`,
+ * so `loadCommonsIdentityBridge()` answers "Commons could not help" and
+ * `KeyManager`'s iOS branches keep using the keychain group.
  */
 public class OxyIdentityModule: Module {
   public func definition() -> ModuleDefinition {
     Name("OxyIdentity")
 
-    AsyncFunction("getShared") { () -> [String: String]? in
+    AsyncFunction("describe") { () -> [String: String]? in
       return nil
     }
 
-    AsyncFunction("putShared") { (_ privateKey: String, _ publicKey: String) in
-      // No-op on iOS: the keychain-access-group path in KeyManager owns writes.
+    AsyncFunction("proveIdentity") { (_ challenge: String) -> [String: String]? in
+      return nil
     }
 
-    AsyncFunction("hasShared") { () -> Bool in
-      return false
+    AsyncFunction("deriveScopedSeed") { (_ info: String) -> String? in
+      return nil
     }
 
-    AsyncFunction("clearShared") { () in
-      // No-op on iOS.
+    AsyncFunction("signSocialReceive") { (_ index: Int, _ digest: String) -> [String: String]? in
+      return nil
     }
   }
 }

package/lib/commonjs/ui/boot/runProviderColdBoot.js

@@ -70,8 +70,8 @@ async function detectOfflineHint() {
  *
  * Ordered pipeline:
  * 1. Complete an OAuth authorization-code return already on the URL (web)
- * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key, or the
- *    primary-identity-key lane in `sessionMode: 'identity'`)
+ * 2. `runSessionColdBoot` — device-secret mint (+ the native Commons-proof lane,
+ *    or the primary-identity-key lane in `sessionMode: 'identity'`)
  *
  * Step 1 is ACCOUNT-MODE ONLY: it commits whichever account the IdP resolves,
  * which for an identity-bound client is somebody else's account by construction.

package/lib/commonjs/ui/session/tokenLossRecovery.js

@@ -29,7 +29,7 @@ var _core = require("@oxy.so/core");
  *    this loop in a sign-out — so a real revocation still signs out.
  *  - No credential, but a key-based lane can still re-establish (the native
  *    shared identity, or an identity-bound client's own key) → try that a few
- *    times, as the cold boot's shared-key step would, then sign out.
+ *    times, as the cold boot's Commons-proof step would, then sign out.
  *  - Neither → the session is over. Sign out now, as before.
  *
  * Framework-free and clock-injectable so the policy is unit tested without a

package/lib/module/ui/boot/runProviderColdBoot.js

@@ -64,8 +64,8 @@ async function detectOfflineHint() {
  *
  * Ordered pipeline:
  * 1. Complete an OAuth authorization-code return already on the URL (web)
- * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key, or the
- *    primary-identity-key lane in `sessionMode: 'identity'`)
+ * 2. `runSessionColdBoot` — device-secret mint (+ the native Commons-proof lane,
+ *    or the primary-identity-key lane in `sessionMode: 'identity'`)
  *
  * Step 1 is ACCOUNT-MODE ONLY: it commits whichever account the IdP resolves,
  * which for an identity-bound client is somebody else's account by construction.

package/lib/module/ui/session/tokenLossRecovery.js

@@ -23,7 +23,7 @@
  *    this loop in a sign-out — so a real revocation still signs out.
  *  - No credential, but a key-based lane can still re-establish (the native
  *    shared identity, or an identity-bound client's own key) → try that a few
- *    times, as the cold boot's shared-key step would, then sign out.
+ *    times, as the cold boot's Commons-proof step would, then sign out.
  *  - Neither → the session is over. Sign out now, as before.
  *
  * Framework-free and clock-injectable so the policy is unit tested without a

package/lib/typescript/commonjs/ui/boot/runProviderColdBoot.d.ts

@@ -44,8 +44,8 @@ export interface RunProviderColdBootOptions {
  *
  * Ordered pipeline:
  * 1. Complete an OAuth authorization-code return already on the URL (web)
- * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key, or the
- *    primary-identity-key lane in `sessionMode: 'identity'`)
+ * 2. `runSessionColdBoot` — device-secret mint (+ the native Commons-proof lane,
+ *    or the primary-identity-key lane in `sessionMode: 'identity'`)
  *
  * Step 1 is ACCOUNT-MODE ONLY: it commits whichever account the IdP resolves,
  * which for an identity-bound client is somebody else's account by construction.

package/lib/typescript/module/ui/boot/runProviderColdBoot.d.ts

@@ -44,8 +44,8 @@ export interface RunProviderColdBootOptions {
  *
  * Ordered pipeline:
  * 1. Complete an OAuth authorization-code return already on the URL (web)
- * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key, or the
- *    primary-identity-key lane in `sessionMode: 'identity'`)
+ * 2. `runSessionColdBoot` — device-secret mint (+ the native Commons-proof lane,
+ *    or the primary-identity-key lane in `sessionMode: 'identity'`)
  *
  * Step 1 is ACCOUNT-MODE ONLY: it commits whichever account the IdP resolves,
  * which for an identity-bound client is somebody else's account by construction.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/services",
-  "version": "10.0.0",
+  "version": "11.0.0",
   "description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
@@ -155,7 +155,7 @@
   },
   "dependencies": {
     "@expo/config-plugins": "57.0.9",
-    "@oxy.so/contracts": "^4.3.0",
+    "@oxy.so/contracts": "^4.4.0",
     "color": "^4.2.3"
   },
   "devDependencies": {
@@ -163,7 +163,7 @@
     "@commitlint/cli": "^21.2.1",
     "@commitlint/config-conventional": "^21.2.0",
     "@expo/vector-icons": "^15.0.3",
-    "@oxy.so/core": "3.2.0",
+    "@oxy.so/core": "4.0.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
     "@react-native-community/netinfo": "^12.0.1",
     "@react-native/babel-preset": "^0.86.2",
@@ -178,7 +178,7 @@
     "@types/jest": "^30.0.0",
     "@types/node": "^20.19.43",
     "@types/react": "*",
-    "@oxy.so/bloom": "^6.0.0",
+    "@oxy.so/bloom": "^6.2.0",
     "copyfiles": "^2.4.1",
     "expo-clipboard": "~57.0.2",
     "expo-constants": "~57.0.5",
@@ -212,11 +212,11 @@
     "typescript": "^5.9.2",
     "zustand": "^5.0.14"
   },
-  "//@oxy.so/bloom": "Bloom peer tracks the measured major: ^6.0.0 includes canonical appearance/tone/size props and shared Surface. Keep its upper bound and the root catalog in sync to prevent duplicate context instances. Services 10 removes FollowButton small/medium/large aliases in favor of sm/md/lg.",
+  "//@oxy.so/bloom": "RE-RAISE THIS FLOOR ON EVERY BREAKING BLOOM RELEASE, in the same commit as the root package.json catalog entry and the code that requires it. The breaking position is the MAJOR, so `^3.0.1` means `>=3.0.1 <4.0.0`: 3.x minors are admitted on semver's additive promise, and Bloom 4.0.0 is refused until someone raises this deliberately. The CAP is the part that is load-bearing. An earlier revision of this key recorded the opposite trade -- an uncapped `>=` floor, accepted so that intentionally-breaking Bloom 0.x minors would not be blocked -- and that trade is closed by evidence rather than by preference: an unbounded range is exactly what let `bun install` pair this package with Bloom 1.0.0 and emit no warning at all, and 1.0.0 broke it four ways (a deleted provider, a renamed confirm option, a renamed Chip fill, and two REMOVED SUBPATHS that fail at bundle time, before any typecheck runs). A floor is a claim about what was measured; a cap is the claim that nothing beyond it was. RAISED TO 3.0.1 from `^2.1.0`. Bloom 3.0.0 breaks exactly two things -- `PageHeader` defaults to `presentation=\"floating\"` and stops hiding the title under `transparent`, and `Field disabled` now reaches the control that reads the field context -- and THIS PACKAGE IMPORTS NEITHER: it renders no `PageHeader` and no `Field`, and 3.0 removes no subpath (unlike 2.0.0, which is why that floor cost code changes and this one does not). Its six `transparent` occurrences are CSS colour values, not the PageHeader prop. The cap had to move rather than widen to a union, because leaving `^2.1.0` in place is what made `bun install` resolve a SECOND, nested Bloom 2.12.4 under this package for any app on Bloom 3 -- two copies of a library whose 3.0 contracts (`control-surface`, `TopEdgeProvider`, `ScrollOffsetProvider`) are React contexts, so a provider from one copy cannot be read by a consumer from the other. Mention's `oxyRuntimeCompatibility` test is what caught it; nothing in a typecheck can. RAISED AGAIN TO 3.2.0 from `^3.0.1`, for the same class of reason the 2.x note records, only in the other direction: 3.2.0 ADDS the per-glyph icon subpaths (`@oxy.so/bloom/icons/RiAtLine`) that this package's screens now import instead of the `@oxy.so/bloom/icons` barrel, and a missing subpath fails at bundle time, in the consumer's Metro, long after this package has typechecked and shipped. `^3.0.1` would have admitted Bloom 3.0.1 and 3.1.0, neither of which has those subpaths, so the floor is the only thing standing between a consumer and a red build. Nothing else about 3.1.0 or 3.2.0 is required here; the cap stays at the major. RAISED TO ^4.2.0: FollowButton now delegates its visuals to Bloom media-header FollowButton with loading, textStyle and large size; the new shared UI contracts require one Bloom4 context across Services and its consumer. RAISED TO ^4.31.0: the sign-in and account screens type one-time codes into `InputOtp` with `type=\"alphanumeric\"` (the long sign-in code and backup codes), which 4.31.0 adds; older 4.x drops the letters. RAISED TO ^4.35.0: every password field passes `revealable` to `TextFieldInput` (the eye button, 4.35.0); older 4.x drops the prop silently and the password cannot be shown. The provider also mounts `@oxy.so/bloom/locale` (4.32.0+). RAISED TO ^5.1.0 (services 9.0.0, a major because consumers must move to Bloom 5 with it): Bloom 5.0.0 types `Card`'s `style` without radius, border width or `overflow` (geometry goes through `radius`/`border`/`clipContent`) and stops clipping a Card's children by default, so `BenefitList`'s `overflow: 'visible'` became both a type error and unnecessary; it is removed. The cap MOVES rather than widening to a `^4 || ^5` union, for the reason the 3.0.1 note records: a union lets an app resolve a second, nested Bloom copy and split the React contexts. The floor is 5.1.0 because that is the version measured here (every package builds and tests against it); 5.0.0 was not measured. RAISED TO ^6.0.0 (services 10.0.0, a major because consumers must move to Bloom 6 with it, and because this package's own `FollowButton`/`FollowTargetButton` `size` moves with Bloom's vocabulary): Bloom 6.0.0 removes the duplicate spellings its 5.x types still admitted, and this package used four of them. The control `size` narrows to `xs|sm|md|lg`, so every `small`/`medium`/`large` handed to a Bloom control became `sm`/`md`/`lg`, and the Follow buttons' public `size` became `sm|md|lg` because it is passed straight through to Bloom's media-header `FollowButton`. `Switch` is controlled by `checked`/`onCheckedChange`, not `value`/`onValueChange`. `Button` has no `variant`: each call site names `appearance` and `tone` (the pair the 5.x recipe resolved the variant to, so nothing repaints), `LinkButton`'s colour is `linkTone`, and `PeableButton` renders `InverseButton`. `Card` takes `appearance=\"outline\"` for `variant=\"outlined\"`. The deprecated spellings Bloom 6 still accepts (`isInvalid`, Chip `color`/`variant`) are not breaks and are left alone. The cap MOVES rather than widening to a `^5 || ^6` union, for the reason the 3.0.1 note records: a union lets an app resolve a second, nested Bloom copy and split the React contexts. The floor is 6.0.0 because that is the version measured when this raise was made; the workspace catalog has since moved to ^6.2.0, which adds only the `cover-header` subpath this package does not import, so the floor stays.",
   "peerDependencies": {
     "@expo/vector-icons": "^15.0.3",
     "@oxy.so/bloom": "^6.0.0",
-    "@oxy.so/core": "^3.2.0",
+    "@oxy.so/core": "^4.0.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
     "@react-native-community/netinfo": ">=11.4.1",
     "@tanstack/query-async-storage-persister": "^5.101",

package/plugins/withOxySharedPermissions.js

@@ -0,0 +1,89 @@
+/**
+ * Config plugin: withOxySharedPermissions (EVERY Oxy Android app).
+ *
+ * Oxy Android apps do not share a UID. They share the Oxy identity and the
+ * device session with Commons (and Accounts) through signature-protected
+ * ContentProvider `call()` IPC, the way apps use `AccountManager`. Crossing a UID
+ * needs two `signature`-level permissions:
+ *
+ *  - `so.oxy.permission.IDENTITY` — Commons' identity host
+ *    (`so.oxy.commons[.dev].identity`): public key, challenge proofs, scoped
+ *    derivations. Never the private key.
+ *  - `so.oxy.permission.DEVICE_SESSION` — the device-session hosts
+ *    (`so.oxy.commons[.dev].devicesession`, `so.oxy.accounts[.dev].devicesession`).
+ *
+ * This plugin makes the app both DECLARE and REQUEST both, and adds `<queries>`
+ * for every host authority:
+ *
+ *  - Declared by every app, not only by the hosts: a signature permission is
+ *    granted when the requesting app is installed, if the declaring app is
+ *    already there. With every app declaring it, install order never matters.
+ *    Android accepts the same declaration from several packages signed with one
+ *    certificate, and rejects it from a differently-signed one
+ *    (`INSTALL_FAILED_DUPLICATE_PERMISSION`), which is the protection we want.
+ *    Every declaration must be identical, which is why this ONE plugin owns
+ *    them; the provider plugins do not declare anything.
+ *  - `<queries>`: Android 11+ package visibility hides a provider the app has
+ *    not declared an interest in, and `ContentResolver.call` then silently finds
+ *    nothing.
+ *
+ * `signature` is the whole trust boundary at the manifest level; each provider
+ * also checks the calling package and its certificate itself.
+ */
+const { withAndroidManifest } = require('@expo/config-plugins');
+
+const IDENTITY_PERMISSION = 'so.oxy.permission.IDENTITY';
+const DEVICE_SESSION_PERMISSION = 'so.oxy.permission.DEVICE_SESSION';
+const PERMISSIONS = [IDENTITY_PERMISSION, DEVICE_SESSION_PERMISSION];
+
+/**
+ * Every host authority an Oxy app calls. Keep in step with `COMMONS_AUTHORITIES`
+ * in `OxyIdentityModule.kt` and `HOST_AUTHORITIES` in `OxyDeviceSessionModule.kt`
+ * (a test compares them).
+ */
+const HOST_AUTHORITIES = [
+  'so.oxy.commons.identity',
+  'so.oxy.commons.dev.identity',
+  'so.oxy.commons.devicesession',
+  'so.oxy.commons.dev.devicesession',
+  'so.oxy.accounts.devicesession',
+  'so.oxy.accounts.dev.devicesession',
+];
+
+function withOxySharedPermissions(config) {
+  return withAndroidManifest(config, (modConfig) => {
+    const manifest = modConfig.modResults.manifest;
+
+    manifest.permission = manifest.permission ?? [];
+    manifest['uses-permission'] = manifest['uses-permission'] ?? [];
+    for (const name of PERMISSIONS) {
+      if (!manifest.permission.some((p) => p.$['android:name'] === name)) {
+        manifest.permission.push({
+          $: { 'android:name': name, 'android:protectionLevel': 'signature' },
+        });
+      }
+      if (!manifest['uses-permission'].some((p) => p.$['android:name'] === name)) {
+        manifest['uses-permission'].push({ $: { 'android:name': name } });
+      }
+    }
+
+    manifest.queries = manifest.queries ?? [];
+    if (manifest.queries.length === 0) {
+      manifest.queries.push({});
+    }
+    const queries = manifest.queries[0];
+    queries.provider = queries.provider ?? [];
+    for (const authority of HOST_AUTHORITIES) {
+      if (!queries.provider.some((p) => p.$['android:authorities'] === authority)) {
+        queries.provider.push({ $: { 'android:authorities': authority } });
+      }
+    }
+
+    return modConfig;
+  });
+}
+
+module.exports = withOxySharedPermissions;
+module.exports.IDENTITY_PERMISSION = IDENTITY_PERMISSION;
+module.exports.DEVICE_SESSION_PERMISSION = DEVICE_SESSION_PERMISSION;
+module.exports.HOST_AUTHORITIES = HOST_AUTHORITIES;

package/plugins/withSharedDeviceSessionProvider.js

@@ -1,86 +1,39 @@
 /**
- * Config plugin: withSharedDeviceSessionProvider (UID-member hub apps).
+ * Config plugin: withSharedDeviceSessionProvider (the device-session HOSTS:
+ * Commons and Accounts, prod and dev).
  *
- * The shared DeviceSession credential is how several official Oxy apps end up on
+ * The shared DeviceSession credential is how the official Oxy apps end up on
  * ONE `DeviceSession` — and therefore one globally active account context —
- * WITHOUT any of them reading Commons's private identity key. This plugin wires
- * the Android side of `@oxy.so/services`:
+ * without any of them touching the identity key. Oxy apps do not share a UID,
+ * so the credential lives in the hosts' own storage, and this plugin declares
+ * the provider every other app reads and writes it through:
+ * `OxyDeviceSessionProvider` at `${applicationId}.devicesession` (AGP
+ * substitutes `${applicationId}` at build), guarded by the `signature`-level
+ * `so.oxy.permission.DEVICE_SESSION`.
  *
- *  - Defines a `signature`-level permission
- *    `so.oxy.shared.permission.READ_DEVICE_SESSION`. `signature` means only apps
- *    signed with the SAME certificate (the shared Oxy release keystore) can hold
- *    it — the trust boundary is the signing key, not the deprecated `sharedUserId`.
- *  - Requests that same permission so this app can also read cross-authority.
- *  - Declares `OxyDeviceSessionProvider` at authority
- *    `${applicationId}.devicesession` (AGP substitutes `${applicationId}` at
- *    build), guarded by that permission. The provider is READ-only across the
- *    process boundary: a sibling may join the device session, never overwrite it.
- *  - Adds `<queries>` entries so Android 11+ package-visibility filtering never
- *    hides the sibling providers from the resolver.
+ * It declares NO permission itself: every Oxy app, host or not, declares and
+ * requests both Oxy permissions through `withOxySharedPermissions`, so the
+ * declarations stay identical. Apply that plugin too.
  *
- * WHICH APPS USE THIS PLUGIN: exactly the apps listed in `PROVIDER_AUTHORITIES`
- * below, which must be apps inside the `so.oxy.shared` UID. UID members share one
- * data directory, so they all serve the SAME file and the sweep in
- * `OxyDeviceSessionModule` is deterministic whichever one answers. An app that is
- * same-signature but outside that UID must use `withSharedDeviceSessionReader`
- * instead — hosting from there would publish a second, independent copy of "the
- * shared credential" and make the winner depend on list order.
- *
- * Keep this list identical to `PROVIDER_AUTHORITIES` in
- * `android/src/main/java/so/oxy/devicesession/OxyDeviceSessionModule.kt`.
- *
- * This is deliberately a SEPARATE permission and a SEPARATE provider from
- * `withSharedIdentityProvider`. Two secrets with different blast radii: the
- * identity key is self-custody and irreplaceable, the device credential is
- * server-revocable and re-publishable. An app that only needs a session gets only
- * the second one.
+ * WHICH APPS USE THIS PLUGIN: exactly the apps whose authorities are listed in
+ * `HOST_AUTHORITIES` of `OxyDeviceSessionModule.kt` (a test compares them).
  */
 const { withAndroidManifest } = require('@expo/config-plugins');
 
-const READ_DEVICE_SESSION_PERMISSION = 'so.oxy.shared.permission.READ_DEVICE_SESSION';
+const DEVICE_SESSION_PERMISSION = 'so.oxy.permission.DEVICE_SESSION';
 const PROVIDER_CLASS = 'so.oxy.devicesession.OxyDeviceSessionProvider';
-const PROVIDER_AUTHORITIES = [
-  'so.oxy.accounts.devicesession',
-  'so.oxy.accounts.dev.devicesession',
+
+/** The authorities this plugin can end up hosting, one per host app. */
+const HOST_AUTHORITIES = [
   'so.oxy.commons.devicesession',
   'so.oxy.commons.dev.devicesession',
+  'so.oxy.accounts.devicesession',
+  'so.oxy.accounts.dev.devicesession',
 ];
 
-module.exports = function withSharedDeviceSessionProvider(config) {
+function withSharedDeviceSessionProvider(config) {
   return withAndroidManifest(config, (modConfig) => {
     const manifest = modConfig.modResults.manifest;
-
-    // 1. Define the signature-level permission.
-    manifest['permission'] = manifest['permission'] ?? [];
-    if (!manifest['permission'].some((p) => p.$['android:name'] === READ_DEVICE_SESSION_PERMISSION)) {
-      manifest['permission'].push({
-        $: {
-          'android:name': READ_DEVICE_SESSION_PERMISSION,
-          'android:protectionLevel': 'signature',
-        },
-      });
-    }
-
-    // 2. Request it (a hub app reads its siblings too — prod ⇆ dev variant).
-    manifest['uses-permission'] = manifest['uses-permission'] ?? [];
-    if (!manifest['uses-permission'].some((p) => p.$['android:name'] === READ_DEVICE_SESSION_PERMISSION)) {
-      manifest['uses-permission'].push({ $: { 'android:name': READ_DEVICE_SESSION_PERMISSION } });
-    }
-
-    // 3. Make the sibling provider authorities visible under package filtering.
-    manifest['queries'] = manifest['queries'] ?? [];
-    if (manifest['queries'].length === 0) {
-      manifest['queries'].push({});
-    }
-    const queries = manifest['queries'][0];
-    queries.provider = queries.provider ?? [];
-    for (const authority of PROVIDER_AUTHORITIES) {
-      if (!queries.provider.some((p) => p.$['android:authorities'] === authority)) {
-        queries.provider.push({ $: { 'android:authorities': authority } });
-      }
-    }
-
-    // 4. Host the provider.
     const app = manifest.application?.[0];
     if (!app) {
       throw new Error('withSharedDeviceSessionProvider: AndroidManifest has no <application>');
@@ -92,11 +45,13 @@ module.exports = function withSharedDeviceSessionProvider(config) {
           'android:name': PROVIDER_CLASS,
           'android:authorities': '${applicationId}.devicesession',
           'android:exported': 'true',
-          'android:permission': READ_DEVICE_SESSION_PERMISSION,
+          'android:permission': DEVICE_SESSION_PERMISSION,
         },
       });
     }
-
     return modConfig;
   });
-};
+}
+
+module.exports = withSharedDeviceSessionProvider;
+module.exports.HOST_AUTHORITIES = HOST_AUTHORITIES;

package/src/ui/boot/runProviderColdBoot.ts

@@ -91,8 +91,8 @@ export interface RunProviderColdBootOptions {
  *
  * Ordered pipeline:
  * 1. Complete an OAuth authorization-code return already on the URL (web)
- * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key, or the
- *    primary-identity-key lane in `sessionMode: 'identity'`)
+ * 2. `runSessionColdBoot` — device-secret mint (+ the native Commons-proof lane,
+ *    or the primary-identity-key lane in `sessionMode: 'identity'`)
  *
  * Step 1 is ACCOUNT-MODE ONLY: it commits whichever account the IdP resolves,
  * which for an identity-bound client is somebody else's account by construction.

package/src/ui/session/__tests__/tokenLossRecovery.test.ts

@@ -102,7 +102,7 @@ describe('token loss recovery', () => {
   });
 
   it('re-establishes through the shared identity when the credential is gone, like the cold boot does', async () => {
-    const h = harness([null, 'from-shared-key']);
+    const h = harness([null, 'from-commons-proof']);
     h.state.credential = false;
     h.state.keyed = true;
     const recovery = createTokenLossRecovery(h.deps);
@@ -111,7 +111,7 @@ describe('token loss recovery', () => {
     await runToCompletion(recovery);
 
     expect(h.signOutLocally).not.toHaveBeenCalled();
-    expect(h.state.token).toBe('from-shared-key');
+    expect(h.state.token).toBe('from-commons-proof');
   });
 
   it('gives the key-based lane a bounded number of tries, then signs out', async () => {

package/src/ui/session/tokenLossRecovery.ts

@@ -21,7 +21,7 @@
  *    this loop in a sign-out — so a real revocation still signs out.
  *  - No credential, but a key-based lane can still re-establish (the native
  *    shared identity, or an identity-bound client's own key) → try that a few
- *    times, as the cold boot's shared-key step would, then sign out.
+ *    times, as the cold boot's Commons-proof step would, then sign out.
  *  - Neither → the session is over. Sign out now, as before.
  *
  * Framework-free and clock-injectable so the policy is unit tested without a