@oxy.so/services 13.3.0 → 13.5.0

package/README.md

@@ -121,21 +121,22 @@ bun add @oxy.so/services @oxy.so/core
 
 ### Peer Dependencies
 
-To avoid duplicate native modules and ensure smooth integration across apps, install (or ensure your app already includes) the following peer dependencies:
+The native modules `@oxy.so/services` needs on iOS and Android (Expo SDK 54 to 58;
+`package.json` has the exact ranges):
 
-- react: >=18, react-native: >=0.76
-- react-native-reanimated: >=3.16, react-native-gesture-handler: >=2.16
-- react-native-safe-area-context: ^5.4.0, react-native-svg: >=13
-- Expo projects: expo, expo-font, expo-image, expo-linear-gradient
-- Navigation (if you use the provided screens): @react-navigation/native
-
-
-Example for Expo:
 ```bash
-npm i react-native-reanimated react-native-gesture-handler react-native-safe-area-context react-native-svg \
-  expo expo-font expo-image expo-linear-gradient @react-navigation/native
+npx expo install expo-crypto expo-secure-store expo-file-system expo-image @expo/app-integrity \
+  @react-native-async-storage/async-storage @react-native-community/netinfo \
+  react-native-reanimated react-native-gesture-handler react-native-keyboard-controller \
+  react-native-safe-area-context react-native-svg
 ```
 
+Every native module above is a **required** peer: the app must list each one
+itself. Expo's autolinking skips optional peers and installs nothing an app does
+not name at its SDK's version, so an app without `expo-crypto` builds and then
+fails at launch (`Cannot find native module 'ExpoCrypto'`: no CSPRNG, no
+sign-in). `bunx @oxy.so/doctor --ci` fails an app that is missing one.
+
 ### React Native/Expo Setup
 
 For React Native and Expo projects, add the polyfill import at the very top of your entry file:

package/lib/commonjs/ui/session/nativeSecureStorage.js

@@ -16,33 +16,41 @@ function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r
  * different backings — a device credential in SecureStore and a pin in
  * AsyncStorage would resolve differently after a keystore reset.
  *
- * `expo-secure-store` is loaded via a runtime-computed dynamic import (the same
- * optional-native-module pattern `OxyProvider` uses for netinfo / keyboard
- * controller), so the web bundle never pulls it and a device without it falls
- * back to AsyncStorage rather than crashing.
+ * `expo-secure-store` is a REQUIRED peer of this package (13.5.0): without its
+ * native module the device credential would sit in plaintext AsyncStorage. It
+ * is still loaded lazily, as a direct statement of a `try` block (the shape
+ * Metro marks optional, `optionalPeerLoads.test.ts`), so a build whose native
+ * module is missing (react-native-macos, an app that has not rebuilt) degrades
+ * to AsyncStorage instead of crashing. The specifier is a LITERAL: the old
+ * `const m = 'expo-secure-store'; import(m)` never hid it from Metro (Babel
+ * evaluates the constant, so Metro resolved it anyway) and only hid it from the
+ * gates that read this source.
  */
-// Variable indirection so Metro's static analyzer never traces expo-secure-store
-// into the web bundle; the module is native-only and optional.
-const SECURE_STORE_MODULE = 'expo-secure-store';
 let secureStorePromise = null;
 
 /**
  * Resolve the `expo-secure-store` module once (memoised), or `null` when it is
  * unavailable — callers then fall back to AsyncStorage. Never throws.
  */
+async function importSecureStore() {
+  let mod;
+  try {
+    mod = await Promise.resolve().then(() => _interopRequireWildcard(require('expo-secure-store')));
+  } catch {
+    return null;
+  }
+  if (typeof mod.getItemAsync === 'function' && typeof mod.setItemAsync === 'function' && typeof mod.deleteItemAsync === 'function') {
+    return {
+      getItemAsync: mod.getItemAsync.bind(mod),
+      setItemAsync: mod.setItemAsync.bind(mod),
+      deleteItemAsync: mod.deleteItemAsync.bind(mod)
+    };
+  }
+  return null;
+}
 function loadSecureStore() {
   if (!secureStorePromise) {
-    const moduleName = SECURE_STORE_MODULE;
-    secureStorePromise = (specifier => new Promise(r => r(`${specifier}`)).then(s => _interopRequireWildcard(require(s))))(moduleName).then(mod => {
-      if (typeof mod.getItemAsync === 'function' && typeof mod.setItemAsync === 'function' && typeof mod.deleteItemAsync === 'function') {
-        return {
-          getItemAsync: mod.getItemAsync.bind(mod),
-          setItemAsync: mod.setItemAsync.bind(mod),
-          deleteItemAsync: mod.deleteItemAsync.bind(mod)
-        };
-      }
-      return null;
-    }).catch(() => null);
+    secureStorePromise = importSecureStore();
   }
   return secureStorePromise;
 }

package/lib/commonjs/ui/session/nativeSecureStorage.js.map

@@ -1 +1 @@
-{"version":3,"names":["_storageHelpers","require","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","SECURE_STORE_MODULE","secureStorePromise","loadSecureStore","moduleName","specifier","Promise","then","s","mod","getItemAsync","setItemAsync","deleteItemAsync","bind","catch","createNativeSecureKeyValueStorage","asyncStorage","getAsyncStorage","createPlatformStorage","getItem","key","secure","setItem","value","removeItem"],"sourceRoot":"../../../../src","sources":["ui/session/nativeSecureStorage.ts"],"mappings":";;;;;;AAiBA,IAAAA,eAAA,GAAAC,OAAA;AAAgE,SAAAC,wBAAAC,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAH,uBAAA,YAAAA,CAAAC,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA,KAjBhE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAIA;AACA;AACA,MAAMkB,mBAAmB,GAAG,mBAAmB;AAQ/C,IAAIC,kBAA0D,GAAG,IAAI;;AAErE;AACA;AACA;AACA;AACA,SAASC,eAAeA,CAAA,EAAoC;EAC1D,IAAI,CAACD,kBAAkB,EAAE;IACvB,MAAME,UAAU,GAAGH,mBAAmB;IACtCC,kBAAkB,GAAG,CAAAG,SAAA,QAAAC,OAAA,CAAArB,CAAA,IAAAA,CAAA,IAAAoB,SAAA,KAAAE,IAAA,CAAAC,CAAA,IAAA3B,uBAAA,CAAAD,OAAA,CAAA4B,CAAA,KAAOJ,UAAU,EACnCG,IAAI,CAAEE,GAA6B,IAAK;MACvC,IACE,OAAOA,GAAG,CAACC,YAAY,KAAK,UAAU,IACtC,OAAOD,GAAG,CAACE,YAAY,KAAK,UAAU,IACtC,OAAOF,GAAG,CAACG,eAAe,KAAK,UAAU,EACzC;QACA,OAAO;UACLF,YAAY,EAAED,GAAG,CAACC,YAAY,CAACG,IAAI,CAACJ,GAAG,CAAC;UACxCE,YAAY,EAAEF,GAAG,CAACE,YAAY,CAACE,IAAI,CAACJ,GAAG,CAAC;UACxCG,eAAe,EAAEH,GAAG,CAACG,eAAe,CAACC,IAAI,CAACJ,GAAG;QAC/C,CAAC;MACH;MACA,OAAO,IAAI;IACb,CAAC,CAAC,CACDK,KAAK,CAAC,MAAM,IAAI,CAAC;EACtB;EACA,OAAOZ,kBAAkB;AAC3B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASa,iCAAiCA,CAAA,EAA0B;EACzE,IAAIC,YAAsE,GAAG,IAAI;EACjF,MAAMC,eAAe,GAAG,MAAAA,CAAA,KAAY;IAClC,IAAI,CAACD,YAAY,EAAE;MACjBA,YAAY,GAAG,MAAM,IAAAE,qCAAqB,EAAC,CAAC;IAC9C;IACA,OAAOF,YAAY;EACrB,CAAC;EACD,OAAO;IACLG,OAAO,EAAE,MAAOC,GAAG,IAAK;MACtB,MAAMC,MAAM,GAAG,MAAMlB,eAAe,CAAC,CAAC;MACtC,IAAIkB,MAAM,EAAE;QACV,OAAOA,MAAM,CAACX,YAAY,CAACU,GAAG,CAAC;MACjC;MACA,OAAO,CAAC,MAAMH,eAAe,CAAC,CAAC,EAAEE,OAAO,CAACC,GAAG,CAAC;IAC/C,CAAC;IACDE,OAAO,EAAE,MAAAA,CAAOF,GAAG,EAAEG,KAAK,KAAK;MAC7B,MAAMF,MAAM,GAAG,MAAMlB,eAAe,CAAC,CAAC;MACtC,IAAIkB,MAAM,EAAE;QACV,MAAMA,MAAM,CAACV,YAAY,CAACS,GAAG,EAAEG,KAAK,CAAC;QACrC;MACF;MACA,MAAM,CAAC,MAAMN,eAAe,CAAC,CAAC,EAAEK,OAAO,CAACF,GAAG,EAAEG,KAAK,CAAC;IACrD,CAAC;IACDC,UAAU,EAAE,MAAOJ,GAAG,IAAK;MACzB,MAAMC,MAAM,GAAG,MAAMlB,eAAe,CAAC,CAAC;MACtC,IAAIkB,MAAM,EAAE;QACV,MAAMA,MAAM,CAACT,eAAe,CAACQ,GAAG,CAAC;QACjC;MACF;MACA,MAAM,CAAC,MAAMH,eAAe,CAAC,CAAC,EAAEO,UAAU,CAACJ,GAAG,CAAC;IACjD;EACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"names":["_storageHelpers","require","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","secureStorePromise","importSecureStore","mod","Promise","resolve","then","getItemAsync","setItemAsync","deleteItemAsync","bind","loadSecureStore","createNativeSecureKeyValueStorage","asyncStorage","getAsyncStorage","createPlatformStorage","getItem","key","secure","setItem","value","removeItem"],"sourceRoot":"../../../../src","sources":["ui/session/nativeSecureStorage.ts"],"mappings":";;;;;;AAsBA,IAAAA,eAAA,GAAAC,OAAA;AAAgE,SAAAC,wBAAAC,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAH,uBAAA,YAAAA,CAAAC,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA,KAtBhE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAUA,IAAIkB,kBAA0D,GAAG,IAAI;;AAErE;AACA;AACA;AACA;AACA,eAAeC,iBAAiBA,CAAA,EAAoC;EAClE,IAAIC,GAA6B;EACjC,IAAI;IACFA,GAAG,GAAI,MAAAC,OAAA,CAAAC,OAAA,GAAAC,IAAA,OAAAzB,uBAAA,CAAAD,OAAA,CAAa,mBAAmB,GAAyC;EAClF,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;EACA,IACE,OAAOuB,GAAG,CAACI,YAAY,KAAK,UAAU,IACtC,OAAOJ,GAAG,CAACK,YAAY,KAAK,UAAU,IACtC,OAAOL,GAAG,CAACM,eAAe,KAAK,UAAU,EACzC;IACA,OAAO;MACLF,YAAY,EAAEJ,GAAG,CAACI,YAAY,CAACG,IAAI,CAACP,GAAG,CAAC;MACxCK,YAAY,EAAEL,GAAG,CAACK,YAAY,CAACE,IAAI,CAACP,GAAG,CAAC;MACxCM,eAAe,EAAEN,GAAG,CAACM,eAAe,CAACC,IAAI,CAACP,GAAG;IAC/C,CAAC;EACH;EACA,OAAO,IAAI;AACb;AAEA,SAASQ,eAAeA,CAAA,EAAoC;EAC1D,IAAI,CAACV,kBAAkB,EAAE;IACvBA,kBAAkB,GAAGC,iBAAiB,CAAC,CAAC;EAC1C;EACA,OAAOD,kBAAkB;AAC3B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASW,iCAAiCA,CAAA,EAA0B;EACzE,IAAIC,YAAsE,GAAG,IAAI;EACjF,MAAMC,eAAe,GAAG,MAAAA,CAAA,KAAY;IAClC,IAAI,CAACD,YAAY,EAAE;MACjBA,YAAY,GAAG,MAAM,IAAAE,qCAAqB,EAAC,CAAC;IAC9C;IACA,OAAOF,YAAY;EACrB,CAAC;EACD,OAAO;IACLG,OAAO,EAAE,MAAOC,GAAG,IAAK;MACtB,MAAMC,MAAM,GAAG,MAAMP,eAAe,CAAC,CAAC;MACtC,IAAIO,MAAM,EAAE;QACV,OAAOA,MAAM,CAACX,YAAY,CAACU,GAAG,CAAC;MACjC;MACA,OAAO,CAAC,MAAMH,eAAe,CAAC,CAAC,EAAEE,OAAO,CAACC,GAAG,CAAC;IAC/C,CAAC;IACDE,OAAO,EAAE,MAAAA,CAAOF,GAAG,EAAEG,KAAK,KAAK;MAC7B,MAAMF,MAAM,GAAG,MAAMP,eAAe,CAAC,CAAC;MACtC,IAAIO,MAAM,EAAE;QACV,MAAMA,MAAM,CAACV,YAAY,CAACS,GAAG,EAAEG,KAAK,CAAC;QACrC;MACF;MACA,MAAM,CAAC,MAAMN,eAAe,CAAC,CAAC,EAAEK,OAAO,CAACF,GAAG,EAAEG,KAAK,CAAC;IACrD,CAAC;IACDC,UAAU,EAAE,MAAOJ,GAAG,IAAK;MACzB,MAAMC,MAAM,GAAG,MAAMP,eAAe,CAAC,CAAC;MACtC,IAAIO,MAAM,EAAE;QACV,MAAMA,MAAM,CAACT,eAAe,CAACQ,GAAG,CAAC;QACjC;MACF;MACA,MAAM,CAAC,MAAMH,eAAe,CAAC,CAAC,EAAEO,UAAU,CAACJ,GAAG,CAAC;IACjD;EACF,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/ui/session/sharedDeviceCredentialStore.js

@@ -65,10 +65,6 @@ const IOS_DEVICE_SESSION_KEYCHAIN_SERVICE = exports.IOS_DEVICE_SESSION_KEYCHAIN_
 /** The single key holding the JSON-encoded `{deviceId, deviceSecret}` pair. */
 const SHARED_DEVICE_SESSION_STORAGE_KEY = exports.SHARED_DEVICE_SESSION_STORAGE_KEY = 'oxy_shared_device_session_v1';
 
-// Variable indirection so Metro's static analyzer never traces expo-secure-store
-// into the web bundle; the module is native-only and optional.
-const SECURE_STORE_MODULE = 'expo-secure-store';
-
 /**
  * The subset of `expo-secure-store` this module needs. Unlike the adapter in
  * `nativeSecureStorage.ts` it must pass OPTIONS — the access group and the
@@ -77,20 +73,33 @@ const SECURE_STORE_MODULE = 'expo-secure-store';
  */
 
 let keychainStorePromise = null;
+
+/**
+ * `expo-secure-store`, a required peer of this package, loaded lazily as a
+ * direct statement of a `try` block with a LITERAL specifier (see
+ * `nativeSecureStorage.ts` for why the old runtime-computed one hid nothing
+ * from Metro). A build without its native module reads `unsupported`.
+ */
+async function importKeychainGroupStore() {
+  let mod;
+  try {
+    mod = await Promise.resolve().then(() => _interopRequireWildcard(require('expo-secure-store')));
+  } catch {
+    return null;
+  }
+  if (typeof mod.getItemAsync === 'function' && typeof mod.setItemAsync === 'function' && typeof mod.deleteItemAsync === 'function' && typeof mod.WHEN_UNLOCKED_THIS_DEVICE_ONLY === 'number') {
+    return {
+      getItemAsync: mod.getItemAsync.bind(mod),
+      setItemAsync: mod.setItemAsync.bind(mod),
+      deleteItemAsync: mod.deleteItemAsync.bind(mod),
+      WHEN_UNLOCKED_THIS_DEVICE_ONLY: mod.WHEN_UNLOCKED_THIS_DEVICE_ONLY
+    };
+  }
+  return null;
+}
 function loadKeychainGroupStore() {
   if (!keychainStorePromise) {
-    const moduleName = SECURE_STORE_MODULE;
-    keychainStorePromise = (specifier => new Promise(r => r(`${specifier}`)).then(s => _interopRequireWildcard(require(s))))(moduleName).then(mod => {
-      if (typeof mod.getItemAsync === 'function' && typeof mod.setItemAsync === 'function' && typeof mod.deleteItemAsync === 'function' && typeof mod.WHEN_UNLOCKED_THIS_DEVICE_ONLY === 'number') {
-        return {
-          getItemAsync: mod.getItemAsync.bind(mod),
-          setItemAsync: mod.setItemAsync.bind(mod),
-          deleteItemAsync: mod.deleteItemAsync.bind(mod),
-          WHEN_UNLOCKED_THIS_DEVICE_ONLY: mod.WHEN_UNLOCKED_THIS_DEVICE_ONLY
-        };
-      }
-      return null;
-    }).catch(() => null);
+    keychainStorePromise = importKeychainGroupStore();
   }
   return keychainStorePromise;
 }

package/lib/commonjs/ui/session/sharedDeviceCredentialStore.js.map

@@ -1 +1 @@
-{"version":3,"names":["_reactNative","require","_expoModulesCore","_session","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","IOS_KEYCHAIN_ACCESS_GROUP","exports","IOS_DEVICE_SESSION_KEYCHAIN_SERVICE","SHARED_DEVICE_SESSION_STORAGE_KEY","SECURE_STORE_MODULE","keychainStorePromise","loadKeychainGroupStore","moduleName","specifier","Promise","then","s","mod","getItemAsync","setItemAsync","deleteItemAsync","WHEN_UNLOCKED_THIS_DEVICE_ONLY","bind","catch","parseStoredCredential","raw","parsed","JSON","parse","candidate","deviceId","length","deviceSecret","createKeychainGroupCredentialStore","readOptions","keychainService","keychainAccessGroup","read","store","state","error","cause","credential","Error","publish","value","stringify","keychainAccessible","clear","brokerModule","loadBrokerModule","undefined","native","requireOptionalNativeModule","write","createBrokerCredentialStore","broker","normalizeSharedDeviceSessionRead","createPlatformSharedDeviceCredentialStore","Platform","OS"],"sourceRoot":"../../../../src","sources":["ui/session/sharedDeviceCredentialStore.ts"],"mappings":";;;;;;;AAuCA,IAAAA,YAAA,GAAAC,OAAA;AACA,IAAAC,gBAAA,GAAAD,OAAA;AACA,IAAAE,QAAA,GAAAF,OAAA;AAK8B,SAAAG,wBAAAC,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAH,uBAAA,YAAAA,CAAAC,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA,KA9C9B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAUA;AACA;AACA;AACA;AACA;AACO,MAAMkB,yBAAyB,GAAAC,OAAA,CAAAD,yBAAA,GAAG,qBAAqB;;AAE9D;AACA;AACA;AACA;AACA;AACA;AACO,MAAME,mCAAmC,GAAAD,OAAA,CAAAC,mCAAA,GAAG,oBAAoB;;AAEvE;AACO,MAAMC,iCAAiC,GAAAF,OAAA,CAAAE,iCAAA,GAAG,8BAA8B;;AAE/E;AACA;AACA,MAAMC,mBAAmB,GAAG,mBAAmB;;AAE/C;AACA;AACA;AACA;AACA;AACA;;AAQA,IAAIC,oBAA+D,GAAG,IAAI;AAE1E,SAASC,sBAAsBA,CAAA,EAAuC;EACpE,IAAI,CAACD,oBAAoB,EAAE;IACzB,MAAME,UAAU,GAAGH,mBAAmB;IACtCC,oBAAoB,GAAG,CAAAG,SAAA,QAAAC,OAAA,CAAAzB,CAAA,IAAAA,CAAA,IAAAwB,SAAA,KAAAE,IAAA,CAAAC,CAAA,IAAA/B,uBAAA,CAAAH,OAAA,CAAAkC,CAAA,KAAOJ,UAAU,EACrCG,IAAI,CAAEE,GAAgC,IAAK;MAC1C,IACE,OAAOA,GAAG,CAACC,YAAY,KAAK,UAAU,IACtC,OAAOD,GAAG,CAACE,YAAY,KAAK,UAAU,IACtC,OAAOF,GAAG,CAACG,eAAe,KAAK,UAAU,IACzC,OAAOH,GAAG,CAACI,8BAA8B,KAAK,QAAQ,EACtD;QACA,OAAO;UACLH,YAAY,EAAED,GAAG,CAACC,YAAY,CAACI,IAAI,CAACL,GAAG,CAAC;UACxCE,YAAY,EAAEF,GAAG,CAACE,YAAY,CAACG,IAAI,CAACL,GAAG,CAAC;UACxCG,eAAe,EAAEH,GAAG,CAACG,eAAe,CAACE,IAAI,CAACL,GAAG,CAAC;UAC9CI,8BAA8B,EAAEJ,GAAG,CAACI;QACtC,CAAC;MACH;MACA,OAAO,IAAI;IACb,CAAC,CAAC,CACDE,KAAK,CAAC,MAAM,IAAI,CAAC;EACtB;EACA,OAAOb,oBAAoB;AAC7B;;AAEA;AACA,SAASc,qBAAqBA,CAACC,GAAkB,EAAiC;EAChF,IAAI,CAACA,GAAG,EAAE;IACR,OAAO,IAAI;EACb;EACA,IAAIC,MAAe;EACnB,IAAI;IACFA,MAAM,GAAGC,IAAI,CAACC,KAAK,CAACH,GAAG,CAAC;EAC1B,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;EACA,IAAI,CAACC,MAAM,IAAI,OAAOA,MAAM,KAAK,QAAQ,EAAE;IACzC,OAAO,IAAI;EACb;EACA,MAAMG,SAAS,GAAGH,MAAiC;EACnD,IACE,OAAOG,SAAS,CAACC,QAAQ,KAAK,QAAQ,IACtCD,SAAS,CAACC,QAAQ,CAACC,MAAM,KAAK,CAAC,IAC/B,OAAOF,SAAS,CAACG,YAAY,KAAK,QAAQ,IAC1CH,SAAS,CAACG,YAAY,CAACD,MAAM,KAAK,CAAC,EACnC;IACA,OAAO,IAAI;EACb;EACA,OAAO;IAAED,QAAQ,EAAED,SAAS,CAACC,QAAQ;IAAEE,YAAY,EAAEH,SAAS,CAACG;EAAa,CAAC;AAC/E;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,kCAAkCA,CAAA,EAAgC;EACzE,MAAMC,WAAW,GAAG;IAClBC,eAAe,EAAE5B,mCAAmC;IACpD6B,mBAAmB,EAAE/B;EACvB,CAAC;EAED,OAAO;IACLgC,IAAI,EAAE,MAAAA,CAAA,KAAiD;MACrD,MAAMC,KAAK,GAAG,MAAM3B,sBAAsB,CAAC,CAAC;MAC5C,IAAI,CAAC2B,KAAK,EAAE;QACV,OAAO;UAAEC,KAAK,EAAE;QAAc,CAAC;MACjC;MACA,IAAId,GAAkB;MACtB,IAAI;QACFA,GAAG,GAAG,MAAMa,KAAK,CAACpB,YAAY,CAACV,iCAAiC,EAAE0B,WAAW,CAAC;MAChF,CAAC,CAAC,OAAOM,KAAK,EAAE;QACd,OAAO;UAAED,KAAK,EAAE,aAAa;UAAEE,KAAK,EAAED;QAAM,CAAC;MAC/C;MACA,IAAIf,GAAG,KAAK,IAAI,EAAE;QAChB,OAAO;UAAEc,KAAK,EAAE;QAAS,CAAC;MAC5B;MACA,MAAMG,UAAU,GAAGlB,qBAAqB,CAACC,GAAG,CAAC;MAC7C,IAAI,CAACiB,UAAU,EAAE;QACf;QACA;QACA,OAAO;UACLH,KAAK,EAAE,aAAa;UACpBE,KAAK,EAAE,IAAIE,KAAK,CAAC,yDAAyD;QAC5E,CAAC;MACH;MACA,OAAO;QAAEJ,KAAK,EAAE,SAAS;QAAEG;MAAW,CAAC;IACzC,CAAC;IAEDE,OAAO,EAAE,MAAOF,UAAU,IAAuB;MAC/C,MAAMJ,KAAK,GAAG,MAAM3B,sBAAsB,CAAC,CAAC;MAC5C,IAAI,CAAC2B,KAAK,EAAE;QACV,OAAO,KAAK;MACd;MACA,MAAMO,KAAK,GAAGlB,IAAI,CAACmB,SAAS,CAACJ,UAAU,CAAC;MACxC,IAAI;QACF,MAAMJ,KAAK,CAACnB,YAAY,CAACX,iCAAiC,EAAEqC,KAAK,EAAE;UACjE,GAAGX,WAAW;UACda,kBAAkB,EAAET,KAAK,CAACjB;QAC5B,CAAC,CAAC;QACF;QACA;QACA;QACA;QACA,OAAO,CAAC,MAAMiB,KAAK,CAACpB,YAAY,CAACV,iCAAiC,EAAE0B,WAAW,CAAC,MAAMW,KAAK;MAC7F,CAAC,CAAC,MAAM;QACN,OAAO,KAAK;MACd;IACF,CAAC;IAEDG,KAAK,EAAE,MAAAA,CAAA,KAA2B;MAChC,MAAMV,KAAK,GAAG,MAAM3B,sBAAsB,CAAC,CAAC;MAC5C,IAAI,CAAC2B,KAAK,EAAE;QACV;MACF;MACA,IAAI;QACF,MAAMA,KAAK,CAAClB,eAAe,CAACZ,iCAAiC,EAAE0B,WAAW,CAAC;MAC7E,CAAC,CAAC,MAAM;QACN;MAAA;IAEJ;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;;AAOA,IAAIe,YAA6D;;AAEjE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,gBAAgBA,CAAA,EAAwC;EAC/D,IAAID,YAAY,KAAKE,SAAS,EAAE;IAC9B,MAAMC,MAAM,GACV,IAAAC,4CAA2B,EAAwC,kBAAkB,CAAC;IACxFJ,YAAY,GACVG,MAAM,IACN,OAAOA,MAAM,CAACf,IAAI,KAAK,UAAU,IACjC,OAAOe,MAAM,CAACE,KAAK,KAAK,UAAU,IAClC,OAAOF,MAAM,CAACJ,KAAK,KAAK,UAAU,GAC9B;MACEX,IAAI,EAAEe,MAAM,CAACf,IAAI,CAACf,IAAI,CAAC8B,MAAM,CAAC;MAC9BE,KAAK,EAAEF,MAAM,CAACE,KAAK,CAAChC,IAAI,CAAC8B,MAAM,CAAC;MAChCJ,KAAK,EAAEI,MAAM,CAACJ,KAAK,CAAC1B,IAAI,CAAC8B,MAAM;IACjC,CAAC,GACD,IAAI;EACZ;EACA,OAAOH,YAAY;AACrB;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASM,2BAA2BA,CAAA,EAAgC;EAClE,OAAO;IACLlB,IAAI,EAAE,MAAAA,CAAA,KAAiD;MACrD,MAAMmB,MAAM,GAAGN,gBAAgB,CAAC,CAAC;MACjC,IAAI,CAACM,MAAM,EAAE;QACX,OAAO;UAAEjB,KAAK,EAAE;QAAc,CAAC;MACjC;MACA,IAAI;QACF,OAAO,IAAAkB,yCAAgC,EAAC,MAAMD,MAAM,CAACnB,IAAI,CAAC,CAAC,CAAC;MAC9D,CAAC,CAAC,OAAOG,KAAK,EAAE;QACd,OAAO;UAAED,KAAK,EAAE,aAAa;UAAEE,KAAK,EAAED;QAAM,CAAC;MAC/C;IACF,CAAC;IAEDI,OAAO,EAAE,MAAOF,UAAU,IAAuB;MAC/C,MAAMc,MAAM,GAAGN,gBAAgB,CAAC,CAAC;MACjC,IAAI,CAACM,MAAM,EAAE;QACX,OAAO,KAAK;MACd;MACA,IAAI;QACF;QACA,OAAO,MAAMA,MAAM,CAACF,KAAK,CAACZ,UAAU,CAACZ,QAAQ,EAAEY,UAAU,CAACV,YAAY,CAAC;MACzE,CAAC,CAAC,MAAM;QACN,OAAO,KAAK;MACd;IACF,CAAC;IAEDgB,KAAK,EAAE,MAAAA,CAAA,KAA2B;MAChC,MAAMQ,MAAM,GAAGN,gBAAgB,CAAC,CAAC;MACjC,IAAI,CAACM,MAAM,EAAE;QACX;MACF;MACA,IAAI;QACF,MAAMA,MAAM,CAACR,KAAK,CAAC,CAAC;MACtB,CAAC,CAAC,MAAM;QACN;MAAA;IAEJ;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASU,yCAAyCA,CAAA,EAAuC;EAC9F,IAAIC,qBAAQ,CAACC,EAAE,KAAK,KAAK,EAAE;IACzB,OAAO,IAAI;EACb;EACA,OAAOD,qBAAQ,CAACC,EAAE,KAAK,KAAK,GACxB3B,kCAAkC,CAAC,CAAC,GACpCsB,2BAA2B,CAAC,CAAC;AACnC","ignoreList":[]}
+{"version":3,"names":["_reactNative","require","_expoModulesCore","_session","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","IOS_KEYCHAIN_ACCESS_GROUP","exports","IOS_DEVICE_SESSION_KEYCHAIN_SERVICE","SHARED_DEVICE_SESSION_STORAGE_KEY","keychainStorePromise","importKeychainGroupStore","mod","Promise","resolve","then","getItemAsync","setItemAsync","deleteItemAsync","WHEN_UNLOCKED_THIS_DEVICE_ONLY","bind","loadKeychainGroupStore","parseStoredCredential","raw","parsed","JSON","parse","candidate","deviceId","length","deviceSecret","createKeychainGroupCredentialStore","readOptions","keychainService","keychainAccessGroup","read","store","state","error","cause","credential","Error","publish","value","stringify","keychainAccessible","clear","brokerModule","loadBrokerModule","undefined","native","requireOptionalNativeModule","write","createBrokerCredentialStore","broker","normalizeSharedDeviceSessionRead","createPlatformSharedDeviceCredentialStore","Platform","OS"],"sourceRoot":"../../../../src","sources":["ui/session/sharedDeviceCredentialStore.ts"],"mappings":";;;;;;;AAuCA,IAAAA,YAAA,GAAAC,OAAA;AACA,IAAAC,gBAAA,GAAAD,OAAA;AACA,IAAAE,QAAA,GAAAF,OAAA;AAK8B,SAAAG,wBAAAC,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAH,uBAAA,YAAAA,CAAAC,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA,KA9C9B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAUA;AACA;AACA;AACA;AACA;AACO,MAAMkB,yBAAyB,GAAAC,OAAA,CAAAD,yBAAA,GAAG,qBAAqB;;AAE9D;AACA;AACA;AACA;AACA;AACA;AACO,MAAME,mCAAmC,GAAAD,OAAA,CAAAC,mCAAA,GAAG,oBAAoB;;AAEvE;AACO,MAAMC,iCAAiC,GAAAF,OAAA,CAAAE,iCAAA,GAAG,8BAA8B;;AAE/E;AACA;AACA;AACA;AACA;AACA;;AAQA,IAAIC,oBAA+D,GAAG,IAAI;;AAE1E;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,wBAAwBA,CAAA,EAAuC;EAC5E,IAAIC,GAAgC;EACpC,IAAI;IACFA,GAAG,GAAI,MAAAC,OAAA,CAAAC,OAAA,GAAAC,IAAA,OAAA7B,uBAAA,CAAAH,OAAA,CAAa,mBAAmB,GAA4C;EACrF,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;EACA,IACE,OAAO6B,GAAG,CAACI,YAAY,KAAK,UAAU,IACtC,OAAOJ,GAAG,CAACK,YAAY,KAAK,UAAU,IACtC,OAAOL,GAAG,CAACM,eAAe,KAAK,UAAU,IACzC,OAAON,GAAG,CAACO,8BAA8B,KAAK,QAAQ,EACtD;IACA,OAAO;MACLH,YAAY,EAAEJ,GAAG,CAACI,YAAY,CAACI,IAAI,CAACR,GAAG,CAAC;MACxCK,YAAY,EAAEL,GAAG,CAACK,YAAY,CAACG,IAAI,CAACR,GAAG,CAAC;MACxCM,eAAe,EAAEN,GAAG,CAACM,eAAe,CAACE,IAAI,CAACR,GAAG,CAAC;MAC9CO,8BAA8B,EAAEP,GAAG,CAACO;IACtC,CAAC;EACH;EACA,OAAO,IAAI;AACb;AAEA,SAASE,sBAAsBA,CAAA,EAAuC;EACpE,IAAI,CAACX,oBAAoB,EAAE;IACzBA,oBAAoB,GAAGC,wBAAwB,CAAC,CAAC;EACnD;EACA,OAAOD,oBAAoB;AAC7B;;AAEA;AACA,SAASY,qBAAqBA,CAACC,GAAkB,EAAiC;EAChF,IAAI,CAACA,GAAG,EAAE;IACR,OAAO,IAAI;EACb;EACA,IAAIC,MAAe;EACnB,IAAI;IACFA,MAAM,GAAGC,IAAI,CAACC,KAAK,CAACH,GAAG,CAAC;EAC1B,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;EACA,IAAI,CAACC,MAAM,IAAI,OAAOA,MAAM,KAAK,QAAQ,EAAE;IACzC,OAAO,IAAI;EACb;EACA,MAAMG,SAAS,GAAGH,MAAiC;EACnD,IACE,OAAOG,SAAS,CAACC,QAAQ,KAAK,QAAQ,IACtCD,SAAS,CAACC,QAAQ,CAACC,MAAM,KAAK,CAAC,IAC/B,OAAOF,SAAS,CAACG,YAAY,KAAK,QAAQ,IAC1CH,SAAS,CAACG,YAAY,CAACD,MAAM,KAAK,CAAC,EACnC;IACA,OAAO,IAAI;EACb;EACA,OAAO;IAAED,QAAQ,EAAED,SAAS,CAACC,QAAQ;IAAEE,YAAY,EAAEH,SAAS,CAACG;EAAa,CAAC;AAC/E;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,kCAAkCA,CAAA,EAAgC;EACzE,MAAMC,WAAW,GAAG;IAClBC,eAAe,EAAEzB,mCAAmC;IACpD0B,mBAAmB,EAAE5B;EACvB,CAAC;EAED,OAAO;IACL6B,IAAI,EAAE,MAAAA,CAAA,KAAiD;MACrD,MAAMC,KAAK,GAAG,MAAMf,sBAAsB,CAAC,CAAC;MAC5C,IAAI,CAACe,KAAK,EAAE;QACV,OAAO;UAAEC,KAAK,EAAE;QAAc,CAAC;MACjC;MACA,IAAId,GAAkB;MACtB,IAAI;QACFA,GAAG,GAAG,MAAMa,KAAK,CAACpB,YAAY,CAACP,iCAAiC,EAAEuB,WAAW,CAAC;MAChF,CAAC,CAAC,OAAOM,KAAK,EAAE;QACd,OAAO;UAAED,KAAK,EAAE,aAAa;UAAEE,KAAK,EAAED;QAAM,CAAC;MAC/C;MACA,IAAIf,GAAG,KAAK,IAAI,EAAE;QAChB,OAAO;UAAEc,KAAK,EAAE;QAAS,CAAC;MAC5B;MACA,MAAMG,UAAU,GAAGlB,qBAAqB,CAACC,GAAG,CAAC;MAC7C,IAAI,CAACiB,UAAU,EAAE;QACf;QACA;QACA,OAAO;UACLH,KAAK,EAAE,aAAa;UACpBE,KAAK,EAAE,IAAIE,KAAK,CAAC,yDAAyD;QAC5E,CAAC;MACH;MACA,OAAO;QAAEJ,KAAK,EAAE,SAAS;QAAEG;MAAW,CAAC;IACzC,CAAC;IAEDE,OAAO,EAAE,MAAOF,UAAU,IAAuB;MAC/C,MAAMJ,KAAK,GAAG,MAAMf,sBAAsB,CAAC,CAAC;MAC5C,IAAI,CAACe,KAAK,EAAE;QACV,OAAO,KAAK;MACd;MACA,MAAMO,KAAK,GAAGlB,IAAI,CAACmB,SAAS,CAACJ,UAAU,CAAC;MACxC,IAAI;QACF,MAAMJ,KAAK,CAACnB,YAAY,CAACR,iCAAiC,EAAEkC,KAAK,EAAE;UACjE,GAAGX,WAAW;UACda,kBAAkB,EAAET,KAAK,CAACjB;QAC5B,CAAC,CAAC;QACF;QACA;QACA;QACA;QACA,OAAO,CAAC,MAAMiB,KAAK,CAACpB,YAAY,CAACP,iCAAiC,EAAEuB,WAAW,CAAC,MAAMW,KAAK;MAC7F,CAAC,CAAC,MAAM;QACN,OAAO,KAAK;MACd;IACF,CAAC;IAEDG,KAAK,EAAE,MAAAA,CAAA,KAA2B;MAChC,MAAMV,KAAK,GAAG,MAAMf,sBAAsB,CAAC,CAAC;MAC5C,IAAI,CAACe,KAAK,EAAE;QACV;MACF;MACA,IAAI;QACF,MAAMA,KAAK,CAAClB,eAAe,CAACT,iCAAiC,EAAEuB,WAAW,CAAC;MAC7E,CAAC,CAAC,MAAM;QACN;MAAA;IAEJ;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;;AAOA,IAAIe,YAA6D;;AAEjE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,gBAAgBA,CAAA,EAAwC;EAC/D,IAAID,YAAY,KAAKE,SAAS,EAAE;IAC9B,MAAMC,MAAM,GACV,IAAAC,4CAA2B,EAAwC,kBAAkB,CAAC;IACxFJ,YAAY,GACVG,MAAM,IACN,OAAOA,MAAM,CAACf,IAAI,KAAK,UAAU,IACjC,OAAOe,MAAM,CAACE,KAAK,KAAK,UAAU,IAClC,OAAOF,MAAM,CAACJ,KAAK,KAAK,UAAU,GAC9B;MACEX,IAAI,EAAEe,MAAM,CAACf,IAAI,CAACf,IAAI,CAAC8B,MAAM,CAAC;MAC9BE,KAAK,EAAEF,MAAM,CAACE,KAAK,CAAChC,IAAI,CAAC8B,MAAM,CAAC;MAChCJ,KAAK,EAAEI,MAAM,CAACJ,KAAK,CAAC1B,IAAI,CAAC8B,MAAM;IACjC,CAAC,GACD,IAAI;EACZ;EACA,OAAOH,YAAY;AACrB;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASM,2BAA2BA,CAAA,EAAgC;EAClE,OAAO;IACLlB,IAAI,EAAE,MAAAA,CAAA,KAAiD;MACrD,MAAMmB,MAAM,GAAGN,gBAAgB,CAAC,CAAC;MACjC,IAAI,CAACM,MAAM,EAAE;QACX,OAAO;UAAEjB,KAAK,EAAE;QAAc,CAAC;MACjC;MACA,IAAI;QACF,OAAO,IAAAkB,yCAAgC,EAAC,MAAMD,MAAM,CAACnB,IAAI,CAAC,CAAC,CAAC;MAC9D,CAAC,CAAC,OAAOG,KAAK,EAAE;QACd,OAAO;UAAED,KAAK,EAAE,aAAa;UAAEE,KAAK,EAAED;QAAM,CAAC;MAC/C;IACF,CAAC;IAEDI,OAAO,EAAE,MAAOF,UAAU,IAAuB;MAC/C,MAAMc,MAAM,GAAGN,gBAAgB,CAAC,CAAC;MACjC,IAAI,CAACM,MAAM,EAAE;QACX,OAAO,KAAK;MACd;MACA,IAAI;QACF;QACA,OAAO,MAAMA,MAAM,CAACF,KAAK,CAACZ,UAAU,CAACZ,QAAQ,EAAEY,UAAU,CAACV,YAAY,CAAC;MACzE,CAAC,CAAC,MAAM;QACN,OAAO,KAAK;MACd;IACF,CAAC;IAEDgB,KAAK,EAAE,MAAAA,CAAA,KAA2B;MAChC,MAAMQ,MAAM,GAAGN,gBAAgB,CAAC,CAAC;MACjC,IAAI,CAACM,MAAM,EAAE;QACX;MACF;MACA,IAAI;QACF,MAAMA,MAAM,CAACR,KAAK,CAAC,CAAC;MACtB,CAAC,CAAC,MAAM;QACN;MAAA;IAEJ;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASU,yCAAyCA,CAAA,EAAuC;EAC9F,IAAIC,qBAAQ,CAACC,EAAE,KAAK,KAAK,EAAE;IACzB,OAAO,IAAI;EACb;EACA,OAAOD,qBAAQ,CAACC,EAAE,KAAK,KAAK,GACxB3B,kCAAkC,CAAC,CAAC,GACpCsB,2BAA2B,CAAC,CAAC;AACnC","ignoreList":[]}

package/lib/module/ui/session/nativeSecureStorage.js

@@ -11,36 +11,43 @@
  * different backings — a device credential in SecureStore and a pin in
  * AsyncStorage would resolve differently after a keystore reset.
  *
- * `expo-secure-store` is loaded via a runtime-computed dynamic import (the same
- * optional-native-module pattern `OxyProvider` uses for netinfo / keyboard
- * controller), so the web bundle never pulls it and a device without it falls
- * back to AsyncStorage rather than crashing.
+ * `expo-secure-store` is a REQUIRED peer of this package (13.5.0): without its
+ * native module the device credential would sit in plaintext AsyncStorage. It
+ * is still loaded lazily, as a direct statement of a `try` block (the shape
+ * Metro marks optional, `optionalPeerLoads.test.ts`), so a build whose native
+ * module is missing (react-native-macos, an app that has not rebuilt) degrades
+ * to AsyncStorage instead of crashing. The specifier is a LITERAL: the old
+ * `const m = 'expo-secure-store'; import(m)` never hid it from Metro (Babel
+ * evaluates the constant, so Metro resolved it anyway) and only hid it from the
+ * gates that read this source.
  */
 
 import { createPlatformStorage } from "../utils/storageHelpers.js";
-
-// Variable indirection so Metro's static analyzer never traces expo-secure-store
-// into the web bundle; the module is native-only and optional.
-const SECURE_STORE_MODULE = 'expo-secure-store';
 let secureStorePromise = null;
 
 /**
  * Resolve the `expo-secure-store` module once (memoised), or `null` when it is
  * unavailable — callers then fall back to AsyncStorage. Never throws.
  */
+async function importSecureStore() {
+  let mod;
+  try {
+    mod = await import('expo-secure-store');
+  } catch {
+    return null;
+  }
+  if (typeof mod.getItemAsync === 'function' && typeof mod.setItemAsync === 'function' && typeof mod.deleteItemAsync === 'function') {
+    return {
+      getItemAsync: mod.getItemAsync.bind(mod),
+      setItemAsync: mod.setItemAsync.bind(mod),
+      deleteItemAsync: mod.deleteItemAsync.bind(mod)
+    };
+  }
+  return null;
+}
 function loadSecureStore() {
   if (!secureStorePromise) {
-    const moduleName = SECURE_STORE_MODULE;
-    secureStorePromise = import(moduleName).then(mod => {
-      if (typeof mod.getItemAsync === 'function' && typeof mod.setItemAsync === 'function' && typeof mod.deleteItemAsync === 'function') {
-        return {
-          getItemAsync: mod.getItemAsync.bind(mod),
-          setItemAsync: mod.setItemAsync.bind(mod),
-          deleteItemAsync: mod.deleteItemAsync.bind(mod)
-        };
-      }
-      return null;
-    }).catch(() => null);
+    secureStorePromise = importSecureStore();
   }
   return secureStorePromise;
 }

package/lib/module/ui/session/nativeSecureStorage.js.map

@@ -1 +1 @@
-{"version":3,"names":["createPlatformStorage","SECURE_STORE_MODULE","secureStorePromise","loadSecureStore","moduleName","then","mod","getItemAsync","setItemAsync","deleteItemAsync","bind","catch","createNativeSecureKeyValueStorage","asyncStorage","getAsyncStorage","getItem","key","secure","setItem","value","removeItem"],"sourceRoot":"../../../../src","sources":["ui/session/nativeSecureStorage.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,qBAAqB,QAAQ,4BAAyB;;AAE/D;AACA;AACA,MAAMC,mBAAmB,GAAG,mBAAmB;AAQ/C,IAAIC,kBAA0D,GAAG,IAAI;;AAErE;AACA;AACA;AACA;AACA,SAASC,eAAeA,CAAA,EAAoC;EAC1D,IAAI,CAACD,kBAAkB,EAAE;IACvB,MAAME,UAAU,GAAGH,mBAAmB;IACtCC,kBAAkB,GAAG,MAAM,CAACE,UAAU,CAAC,CACpCC,IAAI,CAAEC,GAA6B,IAAK;MACvC,IACE,OAAOA,GAAG,CAACC,YAAY,KAAK,UAAU,IACtC,OAAOD,GAAG,CAACE,YAAY,KAAK,UAAU,IACtC,OAAOF,GAAG,CAACG,eAAe,KAAK,UAAU,EACzC;QACA,OAAO;UACLF,YAAY,EAAED,GAAG,CAACC,YAAY,CAACG,IAAI,CAACJ,GAAG,CAAC;UACxCE,YAAY,EAAEF,GAAG,CAACE,YAAY,CAACE,IAAI,CAACJ,GAAG,CAAC;UACxCG,eAAe,EAAEH,GAAG,CAACG,eAAe,CAACC,IAAI,CAACJ,GAAG;QAC/C,CAAC;MACH;MACA,OAAO,IAAI;IACb,CAAC,CAAC,CACDK,KAAK,CAAC,MAAM,IAAI,CAAC;EACtB;EACA,OAAOT,kBAAkB;AAC3B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASU,iCAAiCA,CAAA,EAA0B;EACzE,IAAIC,YAAsE,GAAG,IAAI;EACjF,MAAMC,eAAe,GAAG,MAAAA,CAAA,KAAY;IAClC,IAAI,CAACD,YAAY,EAAE;MACjBA,YAAY,GAAG,MAAMb,qBAAqB,CAAC,CAAC;IAC9C;IACA,OAAOa,YAAY;EACrB,CAAC;EACD,OAAO;IACLE,OAAO,EAAE,MAAOC,GAAG,IAAK;MACtB,MAAMC,MAAM,GAAG,MAAMd,eAAe,CAAC,CAAC;MACtC,IAAIc,MAAM,EAAE;QACV,OAAOA,MAAM,CAACV,YAAY,CAACS,GAAG,CAAC;MACjC;MACA,OAAO,CAAC,MAAMF,eAAe,CAAC,CAAC,EAAEC,OAAO,CAACC,GAAG,CAAC;IAC/C,CAAC;IACDE,OAAO,EAAE,MAAAA,CAAOF,GAAG,EAAEG,KAAK,KAAK;MAC7B,MAAMF,MAAM,GAAG,MAAMd,eAAe,CAAC,CAAC;MACtC,IAAIc,MAAM,EAAE;QACV,MAAMA,MAAM,CAACT,YAAY,CAACQ,GAAG,EAAEG,KAAK,CAAC;QACrC;MACF;MACA,MAAM,CAAC,MAAML,eAAe,CAAC,CAAC,EAAEI,OAAO,CAACF,GAAG,EAAEG,KAAK,CAAC;IACrD,CAAC;IACDC,UAAU,EAAE,MAAOJ,GAAG,IAAK;MACzB,MAAMC,MAAM,GAAG,MAAMd,eAAe,CAAC,CAAC;MACtC,IAAIc,MAAM,EAAE;QACV,MAAMA,MAAM,CAACR,eAAe,CAACO,GAAG,CAAC;QACjC;MACF;MACA,MAAM,CAAC,MAAMF,eAAe,CAAC,CAAC,EAAEM,UAAU,CAACJ,GAAG,CAAC;IACjD;EACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"names":["createPlatformStorage","secureStorePromise","importSecureStore","mod","getItemAsync","setItemAsync","deleteItemAsync","bind","loadSecureStore","createNativeSecureKeyValueStorage","asyncStorage","getAsyncStorage","getItem","key","secure","setItem","value","removeItem"],"sourceRoot":"../../../../src","sources":["ui/session/nativeSecureStorage.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,qBAAqB,QAAQ,4BAAyB;AAQ/D,IAAIC,kBAA0D,GAAG,IAAI;;AAErE;AACA;AACA;AACA;AACA,eAAeC,iBAAiBA,CAAA,EAAoC;EAClE,IAAIC,GAA6B;EACjC,IAAI;IACFA,GAAG,GAAI,MAAM,MAAM,CAAC,mBAAmB,CAAyC;EAClF,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;EACA,IACE,OAAOA,GAAG,CAACC,YAAY,KAAK,UAAU,IACtC,OAAOD,GAAG,CAACE,YAAY,KAAK,UAAU,IACtC,OAAOF,GAAG,CAACG,eAAe,KAAK,UAAU,EACzC;IACA,OAAO;MACLF,YAAY,EAAED,GAAG,CAACC,YAAY,CAACG,IAAI,CAACJ,GAAG,CAAC;MACxCE,YAAY,EAAEF,GAAG,CAACE,YAAY,CAACE,IAAI,CAACJ,GAAG,CAAC;MACxCG,eAAe,EAAEH,GAAG,CAACG,eAAe,CAACC,IAAI,CAACJ,GAAG;IAC/C,CAAC;EACH;EACA,OAAO,IAAI;AACb;AAEA,SAASK,eAAeA,CAAA,EAAoC;EAC1D,IAAI,CAACP,kBAAkB,EAAE;IACvBA,kBAAkB,GAAGC,iBAAiB,CAAC,CAAC;EAC1C;EACA,OAAOD,kBAAkB;AAC3B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASQ,iCAAiCA,CAAA,EAA0B;EACzE,IAAIC,YAAsE,GAAG,IAAI;EACjF,MAAMC,eAAe,GAAG,MAAAA,CAAA,KAAY;IAClC,IAAI,CAACD,YAAY,EAAE;MACjBA,YAAY,GAAG,MAAMV,qBAAqB,CAAC,CAAC;IAC9C;IACA,OAAOU,YAAY;EACrB,CAAC;EACD,OAAO;IACLE,OAAO,EAAE,MAAOC,GAAG,IAAK;MACtB,MAAMC,MAAM,GAAG,MAAMN,eAAe,CAAC,CAAC;MACtC,IAAIM,MAAM,EAAE;QACV,OAAOA,MAAM,CAACV,YAAY,CAACS,GAAG,CAAC;MACjC;MACA,OAAO,CAAC,MAAMF,eAAe,CAAC,CAAC,EAAEC,OAAO,CAACC,GAAG,CAAC;IAC/C,CAAC;IACDE,OAAO,EAAE,MAAAA,CAAOF,GAAG,EAAEG,KAAK,KAAK;MAC7B,MAAMF,MAAM,GAAG,MAAMN,eAAe,CAAC,CAAC;MACtC,IAAIM,MAAM,EAAE;QACV,MAAMA,MAAM,CAACT,YAAY,CAACQ,GAAG,EAAEG,KAAK,CAAC;QACrC;MACF;MACA,MAAM,CAAC,MAAML,eAAe,CAAC,CAAC,EAAEI,OAAO,CAACF,GAAG,EAAEG,KAAK,CAAC;IACrD,CAAC;IACDC,UAAU,EAAE,MAAOJ,GAAG,IAAK;MACzB,MAAMC,MAAM,GAAG,MAAMN,eAAe,CAAC,CAAC;MACtC,IAAIM,MAAM,EAAE;QACV,MAAMA,MAAM,CAACR,eAAe,CAACO,GAAG,CAAC;QACjC;MACF;MACA,MAAM,CAAC,MAAMF,eAAe,CAAC,CAAC,EAAEM,UAAU,CAACJ,GAAG,CAAC;IACjD;EACF,CAAC;AACH","ignoreList":[]}

package/lib/module/ui/session/sharedDeviceCredentialStore.js

@@ -61,10 +61,6 @@ export const IOS_DEVICE_SESSION_KEYCHAIN_SERVICE = 'oxy_device_session';
 /** The single key holding the JSON-encoded `{deviceId, deviceSecret}` pair. */
 export const SHARED_DEVICE_SESSION_STORAGE_KEY = 'oxy_shared_device_session_v1';
 
-// Variable indirection so Metro's static analyzer never traces expo-secure-store
-// into the web bundle; the module is native-only and optional.
-const SECURE_STORE_MODULE = 'expo-secure-store';
-
 /**
  * The subset of `expo-secure-store` this module needs. Unlike the adapter in
  * `nativeSecureStorage.ts` it must pass OPTIONS — the access group and the
@@ -73,20 +69,33 @@ const SECURE_STORE_MODULE = 'expo-secure-store';
  */
 
 let keychainStorePromise = null;
+
+/**
+ * `expo-secure-store`, a required peer of this package, loaded lazily as a
+ * direct statement of a `try` block with a LITERAL specifier (see
+ * `nativeSecureStorage.ts` for why the old runtime-computed one hid nothing
+ * from Metro). A build without its native module reads `unsupported`.
+ */
+async function importKeychainGroupStore() {
+  let mod;
+  try {
+    mod = await import('expo-secure-store');
+  } catch {
+    return null;
+  }
+  if (typeof mod.getItemAsync === 'function' && typeof mod.setItemAsync === 'function' && typeof mod.deleteItemAsync === 'function' && typeof mod.WHEN_UNLOCKED_THIS_DEVICE_ONLY === 'number') {
+    return {
+      getItemAsync: mod.getItemAsync.bind(mod),
+      setItemAsync: mod.setItemAsync.bind(mod),
+      deleteItemAsync: mod.deleteItemAsync.bind(mod),
+      WHEN_UNLOCKED_THIS_DEVICE_ONLY: mod.WHEN_UNLOCKED_THIS_DEVICE_ONLY
+    };
+  }
+  return null;
+}
 function loadKeychainGroupStore() {
   if (!keychainStorePromise) {
-    const moduleName = SECURE_STORE_MODULE;
-    keychainStorePromise = import(moduleName).then(mod => {
-      if (typeof mod.getItemAsync === 'function' && typeof mod.setItemAsync === 'function' && typeof mod.deleteItemAsync === 'function' && typeof mod.WHEN_UNLOCKED_THIS_DEVICE_ONLY === 'number') {
-        return {
-          getItemAsync: mod.getItemAsync.bind(mod),
-          setItemAsync: mod.setItemAsync.bind(mod),
-          deleteItemAsync: mod.deleteItemAsync.bind(mod),
-          WHEN_UNLOCKED_THIS_DEVICE_ONLY: mod.WHEN_UNLOCKED_THIS_DEVICE_ONLY
-        };
-      }
-      return null;
-    }).catch(() => null);
+    keychainStorePromise = importKeychainGroupStore();
   }
   return keychainStorePromise;
 }

package/lib/module/ui/session/sharedDeviceCredentialStore.js.map

@@ -1 +1 @@
-{"version":3,"names":["Platform","requireOptionalNativeModule","normalizeSharedDeviceSessionRead","IOS_KEYCHAIN_ACCESS_GROUP","IOS_DEVICE_SESSION_KEYCHAIN_SERVICE","SHARED_DEVICE_SESSION_STORAGE_KEY","SECURE_STORE_MODULE","keychainStorePromise","loadKeychainGroupStore","moduleName","then","mod","getItemAsync","setItemAsync","deleteItemAsync","WHEN_UNLOCKED_THIS_DEVICE_ONLY","bind","catch","parseStoredCredential","raw","parsed","JSON","parse","candidate","deviceId","length","deviceSecret","createKeychainGroupCredentialStore","readOptions","keychainService","keychainAccessGroup","read","store","state","error","cause","credential","Error","publish","value","stringify","keychainAccessible","clear","brokerModule","loadBrokerModule","undefined","native","write","createBrokerCredentialStore","broker","createPlatformSharedDeviceCredentialStore","OS"],"sourceRoot":"../../../../src","sources":["ui/session/sharedDeviceCredentialStore.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,QAAQ,QAAQ,cAAc;AACvC,SAASC,2BAA2B,QAAQ,mBAAmB;AAC/D,SACEC,gCAAgC,QAI3B,sBAAsB;;AAE7B;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,yBAAyB,GAAG,qBAAqB;;AAE9D;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,mCAAmC,GAAG,oBAAoB;;AAEvE;AACA,OAAO,MAAMC,iCAAiC,GAAG,8BAA8B;;AAE/E;AACA;AACA,MAAMC,mBAAmB,GAAG,mBAAmB;;AAE/C;AACA;AACA;AACA;AACA;AACA;;AAQA,IAAIC,oBAA+D,GAAG,IAAI;AAE1E,SAASC,sBAAsBA,CAAA,EAAuC;EACpE,IAAI,CAACD,oBAAoB,EAAE;IACzB,MAAME,UAAU,GAAGH,mBAAmB;IACtCC,oBAAoB,GAAG,MAAM,CAACE,UAAU,CAAC,CACtCC,IAAI,CAAEC,GAAgC,IAAK;MAC1C,IACE,OAAOA,GAAG,CAACC,YAAY,KAAK,UAAU,IACtC,OAAOD,GAAG,CAACE,YAAY,KAAK,UAAU,IACtC,OAAOF,GAAG,CAACG,eAAe,KAAK,UAAU,IACzC,OAAOH,GAAG,CAACI,8BAA8B,KAAK,QAAQ,EACtD;QACA,OAAO;UACLH,YAAY,EAAED,GAAG,CAACC,YAAY,CAACI,IAAI,CAACL,GAAG,CAAC;UACxCE,YAAY,EAAEF,GAAG,CAACE,YAAY,CAACG,IAAI,CAACL,GAAG,CAAC;UACxCG,eAAe,EAAEH,GAAG,CAACG,eAAe,CAACE,IAAI,CAACL,GAAG,CAAC;UAC9CI,8BAA8B,EAAEJ,GAAG,CAACI;QACtC,CAAC;MACH;MACA,OAAO,IAAI;IACb,CAAC,CAAC,CACDE,KAAK,CAAC,MAAM,IAAI,CAAC;EACtB;EACA,OAAOV,oBAAoB;AAC7B;;AAEA;AACA,SAASW,qBAAqBA,CAACC,GAAkB,EAAiC;EAChF,IAAI,CAACA,GAAG,EAAE;IACR,OAAO,IAAI;EACb;EACA,IAAIC,MAAe;EACnB,IAAI;IACFA,MAAM,GAAGC,IAAI,CAACC,KAAK,CAACH,GAAG,CAAC;EAC1B,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;EACA,IAAI,CAACC,MAAM,IAAI,OAAOA,MAAM,KAAK,QAAQ,EAAE;IACzC,OAAO,IAAI;EACb;EACA,MAAMG,SAAS,GAAGH,MAAiC;EACnD,IACE,OAAOG,SAAS,CAACC,QAAQ,KAAK,QAAQ,IACtCD,SAAS,CAACC,QAAQ,CAACC,MAAM,KAAK,CAAC,IAC/B,OAAOF,SAAS,CAACG,YAAY,KAAK,QAAQ,IAC1CH,SAAS,CAACG,YAAY,CAACD,MAAM,KAAK,CAAC,EACnC;IACA,OAAO,IAAI;EACb;EACA,OAAO;IAAED,QAAQ,EAAED,SAAS,CAACC,QAAQ;IAAEE,YAAY,EAAEH,SAAS,CAACG;EAAa,CAAC;AAC/E;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,kCAAkCA,CAAA,EAAgC;EACzE,MAAMC,WAAW,GAAG;IAClBC,eAAe,EAAEzB,mCAAmC;IACpD0B,mBAAmB,EAAE3B;EACvB,CAAC;EAED,OAAO;IACL4B,IAAI,EAAE,MAAAA,CAAA,KAAiD;MACrD,MAAMC,KAAK,GAAG,MAAMxB,sBAAsB,CAAC,CAAC;MAC5C,IAAI,CAACwB,KAAK,EAAE;QACV,OAAO;UAAEC,KAAK,EAAE;QAAc,CAAC;MACjC;MACA,IAAId,GAAkB;MACtB,IAAI;QACFA,GAAG,GAAG,MAAMa,KAAK,CAACpB,YAAY,CAACP,iCAAiC,EAAEuB,WAAW,CAAC;MAChF,CAAC,CAAC,OAAOM,KAAK,EAAE;QACd,OAAO;UAAED,KAAK,EAAE,aAAa;UAAEE,KAAK,EAAED;QAAM,CAAC;MAC/C;MACA,IAAIf,GAAG,KAAK,IAAI,EAAE;QAChB,OAAO;UAAEc,KAAK,EAAE;QAAS,CAAC;MAC5B;MACA,MAAMG,UAAU,GAAGlB,qBAAqB,CAACC,GAAG,CAAC;MAC7C,IAAI,CAACiB,UAAU,EAAE;QACf;QACA;QACA,OAAO;UACLH,KAAK,EAAE,aAAa;UACpBE,KAAK,EAAE,IAAIE,KAAK,CAAC,yDAAyD;QAC5E,CAAC;MACH;MACA,OAAO;QAAEJ,KAAK,EAAE,SAAS;QAAEG;MAAW,CAAC;IACzC,CAAC;IAEDE,OAAO,EAAE,MAAOF,UAAU,IAAuB;MAC/C,MAAMJ,KAAK,GAAG,MAAMxB,sBAAsB,CAAC,CAAC;MAC5C,IAAI,CAACwB,KAAK,EAAE;QACV,OAAO,KAAK;MACd;MACA,MAAMO,KAAK,GAAGlB,IAAI,CAACmB,SAAS,CAACJ,UAAU,CAAC;MACxC,IAAI;QACF,MAAMJ,KAAK,CAACnB,YAAY,CAACR,iCAAiC,EAAEkC,KAAK,EAAE;UACjE,GAAGX,WAAW;UACda,kBAAkB,EAAET,KAAK,CAACjB;QAC5B,CAAC,CAAC;QACF;QACA;QACA;QACA;QACA,OAAO,CAAC,MAAMiB,KAAK,CAACpB,YAAY,CAACP,iCAAiC,EAAEuB,WAAW,CAAC,MAAMW,KAAK;MAC7F,CAAC,CAAC,MAAM;QACN,OAAO,KAAK;MACd;IACF,CAAC;IAEDG,KAAK,EAAE,MAAAA,CAAA,KAA2B;MAChC,MAAMV,KAAK,GAAG,MAAMxB,sBAAsB,CAAC,CAAC;MAC5C,IAAI,CAACwB,KAAK,EAAE;QACV;MACF;MACA,IAAI;QACF,MAAMA,KAAK,CAAClB,eAAe,CAACT,iCAAiC,EAAEuB,WAAW,CAAC;MAC7E,CAAC,CAAC,MAAM;QACN;MAAA;IAEJ;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;;AAOA,IAAIe,YAA6D;;AAEjE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,gBAAgBA,CAAA,EAAwC;EAC/D,IAAID,YAAY,KAAKE,SAAS,EAAE;IAC9B,MAAMC,MAAM,GACV7C,2BAA2B,CAAwC,kBAAkB,CAAC;IACxF0C,YAAY,GACVG,MAAM,IACN,OAAOA,MAAM,CAACf,IAAI,KAAK,UAAU,IACjC,OAAOe,MAAM,CAACC,KAAK,KAAK,UAAU,IAClC,OAAOD,MAAM,CAACJ,KAAK,KAAK,UAAU,GAC9B;MACEX,IAAI,EAAEe,MAAM,CAACf,IAAI,CAACf,IAAI,CAAC8B,MAAM,CAAC;MAC9BC,KAAK,EAAED,MAAM,CAACC,KAAK,CAAC/B,IAAI,CAAC8B,MAAM,CAAC;MAChCJ,KAAK,EAAEI,MAAM,CAACJ,KAAK,CAAC1B,IAAI,CAAC8B,MAAM;IACjC,CAAC,GACD,IAAI;EACZ;EACA,OAAOH,YAAY;AACrB;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASK,2BAA2BA,CAAA,EAAgC;EAClE,OAAO;IACLjB,IAAI,EAAE,MAAAA,CAAA,KAAiD;MACrD,MAAMkB,MAAM,GAAGL,gBAAgB,CAAC,CAAC;MACjC,IAAI,CAACK,MAAM,EAAE;QACX,OAAO;UAAEhB,KAAK,EAAE;QAAc,CAAC;MACjC;MACA,IAAI;QACF,OAAO/B,gCAAgC,CAAC,MAAM+C,MAAM,CAAClB,IAAI,CAAC,CAAC,CAAC;MAC9D,CAAC,CAAC,OAAOG,KAAK,EAAE;QACd,OAAO;UAAED,KAAK,EAAE,aAAa;UAAEE,KAAK,EAAED;QAAM,CAAC;MAC/C;IACF,CAAC;IAEDI,OAAO,EAAE,MAAOF,UAAU,IAAuB;MAC/C,MAAMa,MAAM,GAAGL,gBAAgB,CAAC,CAAC;MACjC,IAAI,CAACK,MAAM,EAAE;QACX,OAAO,KAAK;MACd;MACA,IAAI;QACF;QACA,OAAO,MAAMA,MAAM,CAACF,KAAK,CAACX,UAAU,CAACZ,QAAQ,EAAEY,UAAU,CAACV,YAAY,CAAC;MACzE,CAAC,CAAC,MAAM;QACN,OAAO,KAAK;MACd;IACF,CAAC;IAEDgB,KAAK,EAAE,MAAAA,CAAA,KAA2B;MAChC,MAAMO,MAAM,GAAGL,gBAAgB,CAAC,CAAC;MACjC,IAAI,CAACK,MAAM,EAAE;QACX;MACF;MACA,IAAI;QACF,MAAMA,MAAM,CAACP,KAAK,CAAC,CAAC;MACtB,CAAC,CAAC,MAAM;QACN;MAAA;IAEJ;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASQ,yCAAyCA,CAAA,EAAuC;EAC9F,IAAIlD,QAAQ,CAACmD,EAAE,KAAK,KAAK,EAAE;IACzB,OAAO,IAAI;EACb;EACA,OAAOnD,QAAQ,CAACmD,EAAE,KAAK,KAAK,GACxBxB,kCAAkC,CAAC,CAAC,GACpCqB,2BAA2B,CAAC,CAAC;AACnC","ignoreList":[]}
+{"version":3,"names":["Platform","requireOptionalNativeModule","normalizeSharedDeviceSessionRead","IOS_KEYCHAIN_ACCESS_GROUP","IOS_DEVICE_SESSION_KEYCHAIN_SERVICE","SHARED_DEVICE_SESSION_STORAGE_KEY","keychainStorePromise","importKeychainGroupStore","mod","getItemAsync","setItemAsync","deleteItemAsync","WHEN_UNLOCKED_THIS_DEVICE_ONLY","bind","loadKeychainGroupStore","parseStoredCredential","raw","parsed","JSON","parse","candidate","deviceId","length","deviceSecret","createKeychainGroupCredentialStore","readOptions","keychainService","keychainAccessGroup","read","store","state","error","cause","credential","Error","publish","value","stringify","keychainAccessible","clear","brokerModule","loadBrokerModule","undefined","native","write","createBrokerCredentialStore","broker","createPlatformSharedDeviceCredentialStore","OS"],"sourceRoot":"../../../../src","sources":["ui/session/sharedDeviceCredentialStore.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,QAAQ,QAAQ,cAAc;AACvC,SAASC,2BAA2B,QAAQ,mBAAmB;AAC/D,SACEC,gCAAgC,QAI3B,sBAAsB;;AAE7B;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,yBAAyB,GAAG,qBAAqB;;AAE9D;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,mCAAmC,GAAG,oBAAoB;;AAEvE;AACA,OAAO,MAAMC,iCAAiC,GAAG,8BAA8B;;AAE/E;AACA;AACA;AACA;AACA;AACA;;AAQA,IAAIC,oBAA+D,GAAG,IAAI;;AAE1E;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,wBAAwBA,CAAA,EAAuC;EAC5E,IAAIC,GAAgC;EACpC,IAAI;IACFA,GAAG,GAAI,MAAM,MAAM,CAAC,mBAAmB,CAA4C;EACrF,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;EACA,IACE,OAAOA,GAAG,CAACC,YAAY,KAAK,UAAU,IACtC,OAAOD,GAAG,CAACE,YAAY,KAAK,UAAU,IACtC,OAAOF,GAAG,CAACG,eAAe,KAAK,UAAU,IACzC,OAAOH,GAAG,CAACI,8BAA8B,KAAK,QAAQ,EACtD;IACA,OAAO;MACLH,YAAY,EAAED,GAAG,CAACC,YAAY,CAACI,IAAI,CAACL,GAAG,CAAC;MACxCE,YAAY,EAAEF,GAAG,CAACE,YAAY,CAACG,IAAI,CAACL,GAAG,CAAC;MACxCG,eAAe,EAAEH,GAAG,CAACG,eAAe,CAACE,IAAI,CAACL,GAAG,CAAC;MAC9CI,8BAA8B,EAAEJ,GAAG,CAACI;IACtC,CAAC;EACH;EACA,OAAO,IAAI;AACb;AAEA,SAASE,sBAAsBA,CAAA,EAAuC;EACpE,IAAI,CAACR,oBAAoB,EAAE;IACzBA,oBAAoB,GAAGC,wBAAwB,CAAC,CAAC;EACnD;EACA,OAAOD,oBAAoB;AAC7B;;AAEA;AACA,SAASS,qBAAqBA,CAACC,GAAkB,EAAiC;EAChF,IAAI,CAACA,GAAG,EAAE;IACR,OAAO,IAAI;EACb;EACA,IAAIC,MAAe;EACnB,IAAI;IACFA,MAAM,GAAGC,IAAI,CAACC,KAAK,CAACH,GAAG,CAAC;EAC1B,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;EACA,IAAI,CAACC,MAAM,IAAI,OAAOA,MAAM,KAAK,QAAQ,EAAE;IACzC,OAAO,IAAI;EACb;EACA,MAAMG,SAAS,GAAGH,MAAiC;EACnD,IACE,OAAOG,SAAS,CAACC,QAAQ,KAAK,QAAQ,IACtCD,SAAS,CAACC,QAAQ,CAACC,MAAM,KAAK,CAAC,IAC/B,OAAOF,SAAS,CAACG,YAAY,KAAK,QAAQ,IAC1CH,SAAS,CAACG,YAAY,CAACD,MAAM,KAAK,CAAC,EACnC;IACA,OAAO,IAAI;EACb;EACA,OAAO;IAAED,QAAQ,EAAED,SAAS,CAACC,QAAQ;IAAEE,YAAY,EAAEH,SAAS,CAACG;EAAa,CAAC;AAC/E;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,kCAAkCA,CAAA,EAAgC;EACzE,MAAMC,WAAW,GAAG;IAClBC,eAAe,EAAEtB,mCAAmC;IACpDuB,mBAAmB,EAAExB;EACvB,CAAC;EAED,OAAO;IACLyB,IAAI,EAAE,MAAAA,CAAA,KAAiD;MACrD,MAAMC,KAAK,GAAG,MAAMf,sBAAsB,CAAC,CAAC;MAC5C,IAAI,CAACe,KAAK,EAAE;QACV,OAAO;UAAEC,KAAK,EAAE;QAAc,CAAC;MACjC;MACA,IAAId,GAAkB;MACtB,IAAI;QACFA,GAAG,GAAG,MAAMa,KAAK,CAACpB,YAAY,CAACJ,iCAAiC,EAAEoB,WAAW,CAAC;MAChF,CAAC,CAAC,OAAOM,KAAK,EAAE;QACd,OAAO;UAAED,KAAK,EAAE,aAAa;UAAEE,KAAK,EAAED;QAAM,CAAC;MAC/C;MACA,IAAIf,GAAG,KAAK,IAAI,EAAE;QAChB,OAAO;UAAEc,KAAK,EAAE;QAAS,CAAC;MAC5B;MACA,MAAMG,UAAU,GAAGlB,qBAAqB,CAACC,GAAG,CAAC;MAC7C,IAAI,CAACiB,UAAU,EAAE;QACf;QACA;QACA,OAAO;UACLH,KAAK,EAAE,aAAa;UACpBE,KAAK,EAAE,IAAIE,KAAK,CAAC,yDAAyD;QAC5E,CAAC;MACH;MACA,OAAO;QAAEJ,KAAK,EAAE,SAAS;QAAEG;MAAW,CAAC;IACzC,CAAC;IAEDE,OAAO,EAAE,MAAOF,UAAU,IAAuB;MAC/C,MAAMJ,KAAK,GAAG,MAAMf,sBAAsB,CAAC,CAAC;MAC5C,IAAI,CAACe,KAAK,EAAE;QACV,OAAO,KAAK;MACd;MACA,MAAMO,KAAK,GAAGlB,IAAI,CAACmB,SAAS,CAACJ,UAAU,CAAC;MACxC,IAAI;QACF,MAAMJ,KAAK,CAACnB,YAAY,CAACL,iCAAiC,EAAE+B,KAAK,EAAE;UACjE,GAAGX,WAAW;UACda,kBAAkB,EAAET,KAAK,CAACjB;QAC5B,CAAC,CAAC;QACF;QACA;QACA;QACA;QACA,OAAO,CAAC,MAAMiB,KAAK,CAACpB,YAAY,CAACJ,iCAAiC,EAAEoB,WAAW,CAAC,MAAMW,KAAK;MAC7F,CAAC,CAAC,MAAM;QACN,OAAO,KAAK;MACd;IACF,CAAC;IAEDG,KAAK,EAAE,MAAAA,CAAA,KAA2B;MAChC,MAAMV,KAAK,GAAG,MAAMf,sBAAsB,CAAC,CAAC;MAC5C,IAAI,CAACe,KAAK,EAAE;QACV;MACF;MACA,IAAI;QACF,MAAMA,KAAK,CAAClB,eAAe,CAACN,iCAAiC,EAAEoB,WAAW,CAAC;MAC7E,CAAC,CAAC,MAAM;QACN;MAAA;IAEJ;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;;AAOA,IAAIe,YAA6D;;AAEjE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,gBAAgBA,CAAA,EAAwC;EAC/D,IAAID,YAAY,KAAKE,SAAS,EAAE;IAC9B,MAAMC,MAAM,GACV1C,2BAA2B,CAAwC,kBAAkB,CAAC;IACxFuC,YAAY,GACVG,MAAM,IACN,OAAOA,MAAM,CAACf,IAAI,KAAK,UAAU,IACjC,OAAOe,MAAM,CAACC,KAAK,KAAK,UAAU,IAClC,OAAOD,MAAM,CAACJ,KAAK,KAAK,UAAU,GAC9B;MACEX,IAAI,EAAEe,MAAM,CAACf,IAAI,CAACf,IAAI,CAAC8B,MAAM,CAAC;MAC9BC,KAAK,EAAED,MAAM,CAACC,KAAK,CAAC/B,IAAI,CAAC8B,MAAM,CAAC;MAChCJ,KAAK,EAAEI,MAAM,CAACJ,KAAK,CAAC1B,IAAI,CAAC8B,MAAM;IACjC,CAAC,GACD,IAAI;EACZ;EACA,OAAOH,YAAY;AACrB;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASK,2BAA2BA,CAAA,EAAgC;EAClE,OAAO;IACLjB,IAAI,EAAE,MAAAA,CAAA,KAAiD;MACrD,MAAMkB,MAAM,GAAGL,gBAAgB,CAAC,CAAC;MACjC,IAAI,CAACK,MAAM,EAAE;QACX,OAAO;UAAEhB,KAAK,EAAE;QAAc,CAAC;MACjC;MACA,IAAI;QACF,OAAO5B,gCAAgC,CAAC,MAAM4C,MAAM,CAAClB,IAAI,CAAC,CAAC,CAAC;MAC9D,CAAC,CAAC,OAAOG,KAAK,EAAE;QACd,OAAO;UAAED,KAAK,EAAE,aAAa;UAAEE,KAAK,EAAED;QAAM,CAAC;MAC/C;IACF,CAAC;IAEDI,OAAO,EAAE,MAAOF,UAAU,IAAuB;MAC/C,MAAMa,MAAM,GAAGL,gBAAgB,CAAC,CAAC;MACjC,IAAI,CAACK,MAAM,EAAE;QACX,OAAO,KAAK;MACd;MACA,IAAI;QACF;QACA,OAAO,MAAMA,MAAM,CAACF,KAAK,CAACX,UAAU,CAACZ,QAAQ,EAAEY,UAAU,CAACV,YAAY,CAAC;MACzE,CAAC,CAAC,MAAM;QACN,OAAO,KAAK;MACd;IACF,CAAC;IAEDgB,KAAK,EAAE,MAAAA,CAAA,KAA2B;MAChC,MAAMO,MAAM,GAAGL,gBAAgB,CAAC,CAAC;MACjC,IAAI,CAACK,MAAM,EAAE;QACX;MACF;MACA,IAAI;QACF,MAAMA,MAAM,CAACP,KAAK,CAAC,CAAC;MACtB,CAAC,CAAC,MAAM;QACN;MAAA;IAEJ;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASQ,yCAAyCA,CAAA,EAAuC;EAC9F,IAAI/C,QAAQ,CAACgD,EAAE,KAAK,KAAK,EAAE;IACzB,OAAO,IAAI;EACb;EACA,OAAOhD,QAAQ,CAACgD,EAAE,KAAK,KAAK,GACxBxB,kCAAkC,CAAC,CAAC,GACpCqB,2BAA2B,CAAC,CAAC;AACnC","ignoreList":[]}

package/lib/typescript/commonjs/ui/session/nativeSecureStorage.d.ts

@@ -9,10 +9,15 @@
  * different backings — a device credential in SecureStore and a pin in
  * AsyncStorage would resolve differently after a keystore reset.
  *
- * `expo-secure-store` is loaded via a runtime-computed dynamic import (the same
- * optional-native-module pattern `OxyProvider` uses for netinfo / keyboard
- * controller), so the web bundle never pulls it and a device without it falls
- * back to AsyncStorage rather than crashing.
+ * `expo-secure-store` is a REQUIRED peer of this package (13.5.0): without its
+ * native module the device credential would sit in plaintext AsyncStorage. It
+ * is still loaded lazily, as a direct statement of a `try` block (the shape
+ * Metro marks optional, `optionalPeerLoads.test.ts`), so a build whose native
+ * module is missing (react-native-macos, an app that has not rebuilt) degrades
+ * to AsyncStorage instead of crashing. The specifier is a LITERAL: the old
+ * `const m = 'expo-secure-store'; import(m)` never hid it from Metro (Babel
+ * evaluates the constant, so Metro resolved it anyway) and only hid it from the
+ * gates that read this source.
  */
 import type { NativeKeyValueStorage } from '@oxy.so/core/session';
 /**

package/lib/typescript/commonjs/ui/session/nativeSecureStorage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nativeSecureStorage.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/nativeSecureStorage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AA0ClE;;;;;GAKG;AACH,wBAAgB,iCAAiC,IAAI,qBAAqB,CAiCzE"}
+{"version":3,"file":"nativeSecureStorage.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/nativeSecureStorage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AA2ClE;;;;;GAKG;AACH,wBAAgB,iCAAiC,IAAI,qBAAqB,CAiCzE"}

package/lib/typescript/commonjs/ui/session/sharedDeviceCredentialStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sharedDeviceCredentialStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/sharedDeviceCredentialStore.ts"],"names":[],"mappings":"AAyCA,OAAO,EAIL,KAAK,2BAA2B,EACjC,MAAM,sBAAsB,CAAC;AAE9B;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,uBAAuB,CAAC;AAExE,+EAA+E;AAC/E,eAAO,MAAM,iCAAiC,iCAAiC,CAAC;AA8OhF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yCAAyC,IAAI,2BAA2B,GAAG,IAAI,CAO9F"}
+{"version":3,"file":"sharedDeviceCredentialStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/sharedDeviceCredentialStore.ts"],"names":[],"mappings":"AAyCA,OAAO,EAIL,KAAK,2BAA2B,EACjC,MAAM,sBAAsB,CAAC;AAE9B;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,uBAAuB,CAAC;AAExE,+EAA+E;AAC/E,eAAO,MAAM,iCAAiC,iCAAiC,CAAC;AAqPhF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yCAAyC,IAAI,2BAA2B,GAAG,IAAI,CAO9F"}

package/lib/typescript/module/ui/session/nativeSecureStorage.d.ts

@@ -9,10 +9,15 @@
  * different backings — a device credential in SecureStore and a pin in
  * AsyncStorage would resolve differently after a keystore reset.
  *
- * `expo-secure-store` is loaded via a runtime-computed dynamic import (the same
- * optional-native-module pattern `OxyProvider` uses for netinfo / keyboard
- * controller), so the web bundle never pulls it and a device without it falls
- * back to AsyncStorage rather than crashing.
+ * `expo-secure-store` is a REQUIRED peer of this package (13.5.0): without its
+ * native module the device credential would sit in plaintext AsyncStorage. It
+ * is still loaded lazily, as a direct statement of a `try` block (the shape
+ * Metro marks optional, `optionalPeerLoads.test.ts`), so a build whose native
+ * module is missing (react-native-macos, an app that has not rebuilt) degrades
+ * to AsyncStorage instead of crashing. The specifier is a LITERAL: the old
+ * `const m = 'expo-secure-store'; import(m)` never hid it from Metro (Babel
+ * evaluates the constant, so Metro resolved it anyway) and only hid it from the
+ * gates that read this source.
  */
 import type { NativeKeyValueStorage } from '@oxy.so/core/session';
 /**

package/lib/typescript/module/ui/session/nativeSecureStorage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nativeSecureStorage.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/nativeSecureStorage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AA0ClE;;;;;GAKG;AACH,wBAAgB,iCAAiC,IAAI,qBAAqB,CAiCzE"}
+{"version":3,"file":"nativeSecureStorage.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/nativeSecureStorage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AA2ClE;;;;;GAKG;AACH,wBAAgB,iCAAiC,IAAI,qBAAqB,CAiCzE"}

package/lib/typescript/module/ui/session/sharedDeviceCredentialStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sharedDeviceCredentialStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/sharedDeviceCredentialStore.ts"],"names":[],"mappings":"AAyCA,OAAO,EAIL,KAAK,2BAA2B,EACjC,MAAM,sBAAsB,CAAC;AAE9B;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,uBAAuB,CAAC;AAExE,+EAA+E;AAC/E,eAAO,MAAM,iCAAiC,iCAAiC,CAAC;AA8OhF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yCAAyC,IAAI,2BAA2B,GAAG,IAAI,CAO9F"}
+{"version":3,"file":"sharedDeviceCredentialStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/sharedDeviceCredentialStore.ts"],"names":[],"mappings":"AAyCA,OAAO,EAIL,KAAK,2BAA2B,EACjC,MAAM,sBAAsB,CAAC;AAE9B;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,uBAAuB,CAAC;AAExE,+EAA+E;AAC/E,eAAO,MAAM,iCAAiC,iCAAiC,CAAC;AAqPhF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yCAAyC,IAAI,2BAA2B,GAAG,IAAI,CAO9F"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/services",
-  "version": "13.3.0",
+  "version": "13.5.0",
   "description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
@@ -178,6 +178,7 @@
     "copyfiles": "^2.4.1",
     "expo-clipboard": "~58.0.4",
     "expo-constants": "~58.0.13",
+    "expo-crypto": "~58.0.7",
     "expo-file-system": "~58.0.11",
     "expo-haptics": "~58.0.7",
     "expo-image": "~58.0.17",
@@ -227,6 +228,7 @@
     "expo": ">=54.0.0 <59.0.0",
     "expo-clipboard": ">=8.0.0 <59.0.0",
     "expo-constants": ">=18.0.0 <59.0.0",
+    "expo-crypto": ">=15.0.0 <59.0.0",
     "expo-document-picker": ">=14.0.0 <59.0.0",
     "expo-file-system": ">=19.0.0 <59.0.0",
     "expo-haptics": ">=15.0.0 <59.0.0",
@@ -236,6 +238,7 @@
     "expo-linear-gradient": ">=15.0.0 <59.0.0",
     "expo-modules-core": "<59.0.0",
     "expo-notifications": ">=0.32.0 <59.0.0",
+    "expo-secure-store": ">=15.0.0 <59.0.0",
     "expo-web-browser": ">=15.0.0 <59.0.0",
     "nativewind": ">=5.0.0-preview.3 <6.0.0",
     "react-native-css": "^3.0.6 || 3.1.0-rc.0",
@@ -263,9 +266,6 @@
     "@types/react": {
       "optional": true
     },
-    "react-native-keyboard-controller": {
-      "optional": true
-    },
     "expo": {
       "optional": true
     },

package/plugins/withOxyReleaseSigning.js

@@ -0,0 +1,277 @@
+/**
+ * Config plugin: withOxyReleaseSigning (EVERY Oxy Android app, through
+ * `withOxySharedPermissions`; listed on its own only by an app that declares no
+ * Oxy permission).
+ *
+ * An app that declares the Oxy signature permissions (`so.oxy.permission.IDENTITY`,
+ * `DEVICE_SESSION`) is only safe to install when it carries the ONE Oxy ecosystem
+ * certificate. Signed with anything else it takes ownership of both permissions,
+ * after which Android refuses to install every correctly signed Oxy app next to it
+ * (`INSTALL_FAILED_DUPLICATE_PERMISSION`), and Commons refuses it as a caller
+ * anyway. That is why the plugin that declares the permissions applies this one:
+ * an app cannot get the permissions without the signing rule.
+ *
+ * It edits `android/app/build.gradle` in three places:
+ *
+ * 1. Before `android {`: resolve the keystore from Gradle properties (set in
+ *    `~/.gradle/gradle.properties`, with `-P`, or as `ORG_GRADLE_PROJECT_<name>`
+ *    environment variables; never in the repo):
+ *      - `OXY_UPLOAD_STORE_FILE`: the keystore (`~/` is expanded).
+ *      - `OXY_UPLOAD_STORE_PASSWORD`, or `OXY_UPLOAD_STORE_PASSWORD_FILE`: a file
+ *        holding it (trimmed).
+ *      - `OXY_UPLOAD_KEY_ALIAS`: `oxy` for the ecosystem key.
+ *      - `OXY_UPLOAD_KEY_PASSWORD` / `OXY_UPLOAD_KEY_PASSWORD_FILE`: optional,
+ *        defaults to the store password (a PKCS12 keystore has one password).
+ * 2. `signingConfigs.release` from those, and the `release` buildType signed by
+ *    it ALWAYS (the `debug` buildType only with `OXY_UPLOAD_SIGN_DEBUG`, below).
+ *    Expo's template signs release with the debug key; nothing here falls back
+ *    to it.
+ * 3. `oxyVerifyReleaseSigning`, a task every release variant's `pre…ReleaseBuild`
+ *    and `validateSigning…Release` depend on. It opens the release buildType's
+ *    EFFECTIVE signing config and fails the build unless the key's certificate
+ *    SHA-256 is the ecosystem one, so it holds however the keystore arrived
+ *    (these properties, EAS's injected `credentials.json`, anything else) and it
+ *    refuses a debug key, a per-app key and a wrong alias alike. Debug builds
+ *    never run it.
+ *
+ * Opt-in for debug: `OXY_UPLOAD_SIGN_DEBUG=true` signs the debug buildType with
+ * the same key and runs the same guard before every debug variant, so a dev
+ * client can sit next to real Oxy apps and be granted the permissions (Willo's
+ * `withOxyDebugSigning` did this with `OXY_DEBUG_*`). Without it debug keeps
+ * Expo's debug key and is never checked.
+ *
+ * There is deliberately no opt-out for release: no CI job builds an Android
+ * release without the key, and a release signed with anything else must not
+ * exist. An app that declares no Oxy permission (Authenticator) lists this
+ * plugin directly to get the same release signing.
+ *
+ * `android/` is generated by `expo prebuild`, so these edits live here or they
+ * are lost on the next prebuild.
+ */
+// The app's own Expo SDK copy, never one this package ships (Expo's guidance for library plugins).
+const { withAppBuildGradle } = require('expo/config-plugins');
+
+/** SHA-256 of the Oxy ecosystem release certificate (alias `oxy`), lowercase hex. */
+const ECOSYSTEM_CERT_SHA256 = 'b8ab3746466ce4569d7a6a0ffa1eed91bc375174d503613987ca09cb33d6a58d';
+
+const MARKER = '@generated oxy-release-signing';
+const PLUGIN = '[@oxy.so/services withOxyReleaseSigning]';
+
+/** Gradle property names holding the release signing material. */
+const PROPERTIES = {
+  storeFile: 'OXY_UPLOAD_STORE_FILE',
+  storePassword: 'OXY_UPLOAD_STORE_PASSWORD',
+  keyAlias: 'OXY_UPLOAD_KEY_ALIAS',
+  keyPassword: 'OXY_UPLOAD_KEY_PASSWORD',
+  signDebug: 'OXY_UPLOAD_SIGN_DEBUG',
+};
+
+/** Resolves the OXY_UPLOAD_* properties; inserted before `android {`. */
+const RESOLVE_PROPERTIES = `// ${MARKER}: the Oxy ecosystem release key (@oxy.so/services
+// withOxyReleaseSigning). Edit the plugin, never this file.
+def oxyHomePath = { String path -> path.startsWith('~/') ? System.getProperty('user.home') + path.substring(1) : path }
+def oxySigningProblems = []
+def oxySigningSecret = { String name ->
+    def value = findProperty(name)
+    if (value != null) return value.toString()
+    def path = findProperty(name + '_FILE')
+    if (path == null) return null
+    def secretFile = file(oxyHomePath(path.toString()))
+    if (!secretFile.isFile()) {
+        oxySigningProblems << (name + '_FILE names ' + secretFile + ', which is not a file')
+        return null
+    }
+    return secretFile.getText('UTF-8').trim()
+}
+def oxyStoreFilePath = findProperty('${PROPERTIES.storeFile}')
+def oxyStoreFile = oxyStoreFilePath == null ? null : file(oxyHomePath(oxyStoreFilePath.toString()))
+def oxyStorePassword = oxySigningSecret('${PROPERTIES.storePassword}')
+def oxyKeyAlias = findProperty('${PROPERTIES.keyAlias}')?.toString()
+def oxyKeyPassword = oxySigningSecret('${PROPERTIES.keyPassword}') ?: oxyStorePassword
+if (oxyStoreFile == null) oxySigningProblems << '${PROPERTIES.storeFile} is not set'
+if (oxyStorePassword == null && findProperty('${PROPERTIES.storePassword}_FILE') == null) oxySigningProblems << '${PROPERTIES.storePassword} (or ${PROPERTIES.storePassword}_FILE) is not set'
+if (oxyKeyAlias == null) oxySigningProblems << '${PROPERTIES.keyAlias} is not set'
+def oxyUploadSigning = oxyStoreFile != null && oxyStorePassword != null && oxyKeyAlias != null
+// Opt-in: sign debug with the ecosystem key too (a dev client next to real Oxy apps),
+// and then refuse a debug build without it exactly like a release.
+def oxySignDebug = (findProperty('${PROPERTIES.signDebug}') ?: 'false').toString().toBoolean()
+def oxySignedBuildTypes = oxySignDebug ? ['release', 'debug'] : ['release']
+
+`;
+
+const RELEASE_SIGNING_CONFIG = `        release {
+            // ${MARKER}: the Oxy ecosystem key from the OXY_UPLOAD_* properties.
+            // Without them it stays empty and oxyVerifyReleaseSigning fails the build.
+            if (oxyUploadSigning) {
+                storeFile oxyStoreFile
+                storePassword oxyStorePassword
+                keyAlias oxyKeyAlias
+                keyPassword oxyKeyPassword
+            }
+        }
+`;
+
+const RELEASE_SIGNING_LINE = 'signingConfig signingConfigs.release';
+const DEBUG_SIGNING_LINE = 'signingConfig signingConfigs.debug';
+const OPT_IN_DEBUG_SIGNING_LINE =
+  'signingConfig oxySignDebug ? signingConfigs.release : signingConfigs.debug';
+
+/** The fail-closed guard; appended to the file. */
+const VERIFY_TASK = String.raw`
+// ${MARKER}: every release build must carry the Oxy ecosystem certificate.
+// Signed with anything else, the app declares so.oxy.permission.IDENTITY and
+// DEVICE_SESSION under the wrong certificate: Android then refuses to install the
+// correctly signed Oxy apps next to it (INSTALL_FAILED_DUPLICATE_PERMISSION), and
+// Commons refuses it. This checks the release buildType's EFFECTIVE signing config.
+def oxyVerifyReleaseSigning = tasks.register('oxyVerifyReleaseSigning') {
+    group = 'verification'
+    description = 'Fails unless release (and, with OXY_UPLOAD_SIGN_DEBUG, debug) is signed with the Oxy ecosystem certificate.'
+    notCompatibleWithConfigurationCache('reads the android extension when it runs')
+    doLast {
+        def expected = '${ECOSYSTEM_CERT_SHA256}'
+        def fail = { String reason ->
+            throw new GradleException([
+                'Oxy release signing: ' + reason,
+                '',
+                'Every Oxy Android release is signed with the ONE ecosystem key (certificate SHA-256 ' + expected + ').',
+                'Provide it as Gradle properties, in ~/.gradle/gradle.properties, as -P<name>=<value>,',
+                'or as ORG_GRADLE_PROJECT_<name> environment variables:',
+                '  ${PROPERTIES.storeFile}=~/.config/oxy/oxy-ecosystem-release.keystore',
+                '  ${PROPERTIES.storePassword}_FILE=~/.config/oxy/oxy-ecosystem-release-keystore.pass (or ${PROPERTIES.storePassword})',
+                '  ${PROPERTIES.keyAlias}=oxy',
+                '  ${PROPERTIES.keyPassword}[_FILE] only when the key password differs from the store password',
+                'Debug builds need none of this unless ${PROPERTIES.signDebug}=true.',
+            ].join('\n'))
+        }
+        oxySignedBuildTypes.each { buildType ->
+            def config = android.buildTypes.getByName(buildType).signingConfig
+            if (config == null || config.storeFile == null) {
+                fail('the ' + buildType + ' build has no keystore' + (oxySigningProblems ? ': ' + oxySigningProblems.join('; ') : '') + '.')
+            }
+            def keyStore = null
+            try {
+                keyStore = java.security.KeyStore.getInstance(config.storeFile, config.storePassword?.toCharArray())
+            } catch (Exception e) {
+                fail('could not open ' + config.storeFile + ' (' + e.getClass().getSimpleName() + ': ' + e.getMessage() + ').')
+            }
+            def certificate = keyStore.getCertificate(config.keyAlias)
+            if (certificate == null) {
+                fail(config.storeFile.toString() + ' has no certificate under the alias "' + config.keyAlias + '".')
+            }
+            def actual = java.security.MessageDigest.getInstance('SHA-256').digest(certificate.getEncoded()).encodeHex().toString()
+            if (actual != expected) {
+                fail('the ' + buildType + ' build is signed by "' + config.name + '" (' + config.storeFile + ', alias ' + config.keyAlias + '), certificate SHA-256 ' + actual + ', not the Oxy ecosystem one.')
+            }
+        }
+    }
+}
+tasks.configureEach { task ->
+    if (task.name ==~ (oxySignDebug ? /pre\w*(Release|Debug)Build|validateSigning\w*(Release|Debug)/ : /pre\w*ReleaseBuild|validateSigning\w*Release/)) {
+        task.dependsOn(oxyVerifyReleaseSigning)
+    }
+}
+`;
+
+function fail(message) {
+  throw new Error(`${PLUGIN} ${message}`);
+}
+
+/**
+ * Apply the edits to the text of a Groovy `android/app/build.gradle`.
+ * Idempotent; refuses a file another plugin already gave a release signing config.
+ *
+ * @param {string} contents
+ * @returns {string}
+ */
+function applyReleaseSigning(contents) {
+  if (contents.includes(MARKER)) return contents;
+
+  if (contents.includes('OXY_UPLOAD_')) {
+    fail(
+      'app/build.gradle already has an OXY_UPLOAD_* signing config written by another plugin: ' +
+        "`@oxy.so/app-preset/plugin/withOxyAndroidRelease` (app-preset 4 or earlier) or an app's " +
+        "own copy (such as Mention's plugins/withAndroidReleaseBuild.js). Remove it from the app " +
+        'config: withOxySharedPermissions signs every Oxy release.',
+    );
+  }
+
+  if (contents.includes('OXY_DEBUG_')) {
+    fail(
+      "app/build.gradle already has an OXY_DEBUG_* debug signing config (such as Willo's " +
+        'plugins/withOxyDebugSigning.js). Remove that plugin and set the Gradle property ' +
+        `${PROPERTIES.signDebug}=true to sign debug builds with the ecosystem key.`,
+    );
+  }
+
+  const androidBlock = /^android \{$/m;
+  if (!androidBlock.test(contents)) {
+    fail(
+      'Could not find the top-level `android {` block in app/build.gradle. The Expo template changed: update this plugin.',
+    );
+  }
+  let next = contents.replace(androidBlock, `${RESOLVE_PROPERTIES}android {`);
+
+  // Declare signingConfigs.release immediately after the generated debug entry.
+  const debugSigningBlock =
+    /(signingConfigs\s*\{\s*\n\s*debug\s*\{[\s\S]*?\n\s{8}\}\n)(\s*release\s*\{)?/;
+  const debugMatch = next.match(debugSigningBlock);
+  if (!debugMatch) {
+    fail(
+      'Could not find the generated signingConfigs.debug block in app/build.gradle. The Expo template changed: update this plugin.',
+    );
+  }
+  if (debugMatch[2]) {
+    fail(
+      'app/build.gradle already declares signingConfigs.release. Remove the plugin that writes it: withOxySharedPermissions signs every Oxy release.',
+    );
+  }
+  next = next.replace(debugSigningBlock, `$1${RELEASE_SIGNING_CONFIG}`);
+
+  // Point the release buildType at it. The debug buildType has its own
+  // `signingConfig signingConfigs.debug`, so only the line inside `release {` is replaced.
+  const buildTypes = next.indexOf('buildTypes {');
+  const releaseBuildType = buildTypes === -1 ? -1 : next.indexOf('release {', buildTypes);
+  if (releaseBuildType === -1) {
+    fail('Could not find the release buildType in app/build.gradle.');
+  }
+  const releaseBody = next.slice(releaseBuildType);
+  const signingLine = releaseBody.match(/signingConfig [^\n]+/);
+  const closing = releaseBody.indexOf('\n        }');
+  if (
+    !signingLine ||
+    signingLine.index === undefined ||
+    (closing !== -1 && signingLine.index > closing)
+  ) {
+    fail('Could not find the signingConfig line of the release buildType in app/build.gradle.');
+  }
+  const at = releaseBuildType + signingLine.index;
+  next = next.slice(0, at) + RELEASE_SIGNING_LINE + next.slice(at + signingLine[0].length);
+
+  // The debug buildType keeps Expo's debug key unless OXY_UPLOAD_SIGN_DEBUG asks.
+  const debugBuildType = next.indexOf('debug {', next.indexOf('buildTypes {'));
+  const debugLine = debugBuildType === -1 ? -1 : next.indexOf(DEBUG_SIGNING_LINE, debugBuildType);
+  if (debugLine === -1 || debugLine > next.indexOf('release {', next.indexOf('buildTypes {'))) {
+    fail('Could not find the signingConfig line of the debug buildType in app/build.gradle.');
+  }
+  next =
+    next.slice(0, debugLine) +
+    OPT_IN_DEBUG_SIGNING_LINE +
+    next.slice(debugLine + DEBUG_SIGNING_LINE.length);
+
+  return `${next.replace(/\n*$/, '\n')}${VERIFY_TASK}`;
+}
+
+function withOxyReleaseSigning(config) {
+  return withAppBuildGradle(config, (modConfig) => {
+    if (modConfig.modResults.language !== 'groovy') {
+      fail(`Expected a Groovy app/build.gradle, got ${modConfig.modResults.language}.`);
+    }
+    modConfig.modResults.contents = applyReleaseSigning(modConfig.modResults.contents);
+    return modConfig;
+  });
+}
+
+module.exports = withOxyReleaseSigning;
+module.exports.applyReleaseSigning = applyReleaseSigning;
+module.exports.ECOSYSTEM_CERT_SHA256 = ECOSYSTEM_CERT_SHA256;
+module.exports.PROPERTIES = PROPERTIES;

package/plugins/withOxySharedPermissions.js

@@ -29,9 +29,16 @@
  *
  * `signature` is the whole trust boundary at the manifest level; each provider
  * also checks the calling package and its certificate itself.
+ *
+ * Declaring these permissions is only safe under the ONE Oxy ecosystem
+ * certificate, so this plugin also applies `withOxyReleaseSigning`: every
+ * release build is signed with the ecosystem key from the `OXY_UPLOAD_*` Gradle
+ * properties and FAILS unless its certificate is the ecosystem one. Apps list
+ * neither that plugin nor any signing plugin of their own.
  */
 // The app's own Expo SDK copy, never one this package ships (Expo's guidance for library plugins).
 const { withAndroidManifest } = require('expo/config-plugins');
+const withOxyReleaseSigning = require('./withOxyReleaseSigning');
 
 const IDENTITY_PERMISSION = 'so.oxy.permission.IDENTITY';
 const DEVICE_SESSION_PERMISSION = 'so.oxy.permission.DEVICE_SESSION';
@@ -52,7 +59,7 @@ const HOST_AUTHORITIES = [
 ];
 
 function withOxySharedPermissions(config) {
-  return withAndroidManifest(config, (modConfig) => {
+  return withAndroidManifest(withOxyReleaseSigning(config), (modConfig) => {
     const manifest = modConfig.modResults.manifest;
 
     manifest.permission = manifest.permission ?? [];

package/src/ui/session/nativeSecureStorage.ts

@@ -9,18 +9,19 @@
  * different backings — a device credential in SecureStore and a pin in
  * AsyncStorage would resolve differently after a keystore reset.
  *
- * `expo-secure-store` is loaded via a runtime-computed dynamic import (the same
- * optional-native-module pattern `OxyProvider` uses for netinfo / keyboard
- * controller), so the web bundle never pulls it and a device without it falls
- * back to AsyncStorage rather than crashing.
+ * `expo-secure-store` is a REQUIRED peer of this package (13.5.0): without its
+ * native module the device credential would sit in plaintext AsyncStorage. It
+ * is still loaded lazily, as a direct statement of a `try` block (the shape
+ * Metro marks optional, `optionalPeerLoads.test.ts`), so a build whose native
+ * module is missing (react-native-macos, an app that has not rebuilt) degrades
+ * to AsyncStorage instead of crashing. The specifier is a LITERAL: the old
+ * `const m = 'expo-secure-store'; import(m)` never hid it from Metro (Babel
+ * evaluates the constant, so Metro resolved it anyway) and only hid it from the
+ * gates that read this source.
  */
 import type { NativeKeyValueStorage } from '@oxy.so/core/session';
 import { createPlatformStorage } from '../utils/storageHelpers';
 
-// Variable indirection so Metro's static analyzer never traces expo-secure-store
-// into the web bundle; the module is native-only and optional.
-const SECURE_STORE_MODULE = 'expo-secure-store';
-
 interface SecureStoreLike {
   getItemAsync(key: string): Promise<string | null>;
   setItemAsync(key: string, value: string): Promise<void>;
@@ -33,25 +34,30 @@ let secureStorePromise: Promise<SecureStoreLike | null> | null = null;
  * Resolve the `expo-secure-store` module once (memoised), or `null` when it is
  * unavailable — callers then fall back to AsyncStorage. Never throws.
  */
+async function importSecureStore(): Promise<SecureStoreLike | null> {
+  let mod: Partial<SecureStoreLike>;
+  try {
+    mod = (await import('expo-secure-store')) as unknown as Partial<SecureStoreLike>;
+  } catch {
+    return null;
+  }
+  if (
+    typeof mod.getItemAsync === 'function' &&
+    typeof mod.setItemAsync === 'function' &&
+    typeof mod.deleteItemAsync === 'function'
+  ) {
+    return {
+      getItemAsync: mod.getItemAsync.bind(mod),
+      setItemAsync: mod.setItemAsync.bind(mod),
+      deleteItemAsync: mod.deleteItemAsync.bind(mod),
+    } satisfies SecureStoreLike;
+  }
+  return null;
+}
+
 function loadSecureStore(): Promise<SecureStoreLike | null> {
   if (!secureStorePromise) {
-    const moduleName = SECURE_STORE_MODULE;
-    secureStorePromise = import(moduleName)
-      .then((mod: Partial<SecureStoreLike>) => {
-        if (
-          typeof mod.getItemAsync === 'function' &&
-          typeof mod.setItemAsync === 'function' &&
-          typeof mod.deleteItemAsync === 'function'
-        ) {
-          return {
-            getItemAsync: mod.getItemAsync.bind(mod),
-            setItemAsync: mod.setItemAsync.bind(mod),
-            deleteItemAsync: mod.deleteItemAsync.bind(mod),
-          } satisfies SecureStoreLike;
-        }
-        return null;
-      })
-      .catch(() => null);
+    secureStorePromise = importSecureStore();
   }
   return secureStorePromise;
 }

package/src/ui/session/sharedDeviceCredentialStore.ts

@@ -64,10 +64,6 @@ export const IOS_DEVICE_SESSION_KEYCHAIN_SERVICE = 'oxy_device_session';
 /** The single key holding the JSON-encoded `{deviceId, deviceSecret}` pair. */
 export const SHARED_DEVICE_SESSION_STORAGE_KEY = 'oxy_shared_device_session_v1';
 
-// Variable indirection so Metro's static analyzer never traces expo-secure-store
-// into the web bundle; the module is native-only and optional.
-const SECURE_STORE_MODULE = 'expo-secure-store';
-
 /**
  * The subset of `expo-secure-store` this module needs. Unlike the adapter in
  * `nativeSecureStorage.ts` it must pass OPTIONS — the access group and the
@@ -83,27 +79,38 @@ interface KeychainGroupStore {
 
 let keychainStorePromise: Promise<KeychainGroupStore | null> | null = null;
 
+/**
+ * `expo-secure-store`, a required peer of this package, loaded lazily as a
+ * direct statement of a `try` block with a LITERAL specifier (see
+ * `nativeSecureStorage.ts` for why the old runtime-computed one hid nothing
+ * from Metro). A build without its native module reads `unsupported`.
+ */
+async function importKeychainGroupStore(): Promise<KeychainGroupStore | null> {
+  let mod: Partial<KeychainGroupStore>;
+  try {
+    mod = (await import('expo-secure-store')) as unknown as Partial<KeychainGroupStore>;
+  } catch {
+    return null;
+  }
+  if (
+    typeof mod.getItemAsync === 'function' &&
+    typeof mod.setItemAsync === 'function' &&
+    typeof mod.deleteItemAsync === 'function' &&
+    typeof mod.WHEN_UNLOCKED_THIS_DEVICE_ONLY === 'number'
+  ) {
+    return {
+      getItemAsync: mod.getItemAsync.bind(mod),
+      setItemAsync: mod.setItemAsync.bind(mod),
+      deleteItemAsync: mod.deleteItemAsync.bind(mod),
+      WHEN_UNLOCKED_THIS_DEVICE_ONLY: mod.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
+    } satisfies KeychainGroupStore;
+  }
+  return null;
+}
+
 function loadKeychainGroupStore(): Promise<KeychainGroupStore | null> {
   if (!keychainStorePromise) {
-    const moduleName = SECURE_STORE_MODULE;
-    keychainStorePromise = import(moduleName)
-      .then((mod: Partial<KeychainGroupStore>) => {
-        if (
-          typeof mod.getItemAsync === 'function' &&
-          typeof mod.setItemAsync === 'function' &&
-          typeof mod.deleteItemAsync === 'function' &&
-          typeof mod.WHEN_UNLOCKED_THIS_DEVICE_ONLY === 'number'
-        ) {
-          return {
-            getItemAsync: mod.getItemAsync.bind(mod),
-            setItemAsync: mod.setItemAsync.bind(mod),
-            deleteItemAsync: mod.deleteItemAsync.bind(mod),
-            WHEN_UNLOCKED_THIS_DEVICE_ONLY: mod.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
-          } satisfies KeychainGroupStore;
-        }
-        return null;
-      })
-      .catch(() => null);
+    keychainStorePromise = importKeychainGroupStore();
   }
   return keychainStorePromise;
 }