@oxyhq/services 26.0.1 → 26.0.4

package/android/src/main/java/so/oxy/session/OxyBackgroundSessionStore.kt

@@ -0,0 +1,179 @@
+package so.oxy.session
+
+import android.content.Context
+import android.content.SharedPreferences
+import so.oxy.storage.OxyEncryptedPrefs
+import so.oxy.storage.RecoveryPolicy
+
+/**
+ * On-device storage for the background session credential and the short access
+ * token minted from it.
+ *
+ * Its own EncryptedSharedPreferences file — it never reads or writes the app's
+ * device credential (`oxy.auth.v1` in expo-secure-store). That separation is the
+ * whole point of the design: `POST /session/device/token` rotates the device
+ * secret on every mint and the presented secret dies 60 seconds later, so
+ * background code that touched it would be a second writer to a value the JS
+ * runtime depends on, and a worker killed between the mint and the local write
+ * would sign the user out of the app. Nothing here can do that.
+ *
+ * WRITERS: JS (via [OxyBackgroundSessionModule], while the app runs) owns the
+ * credential; native (via [OxyBackgroundSession]) owns only the cached token.
+ * Neither ever rotates the credential — the server does not rotate it either.
+ */
+internal object OxyBackgroundSessionStore {
+  /**
+   * Suffix is the hosting app's package name. Oxy apps share the `so.oxy.shared`
+   * Android UID (and therefore one data directory), so a single global prefs name
+   * would let one app that leaves `backgroundSession` off wipe another app's
+   * live credential on launch. Scoping by package keeps each app's widget/sync
+   * store independent.
+   */
+  private const val PREFS_NAME_PREFIX = "oxy_background_session_"
+
+  private fun prefsName(context: Context): String = PREFS_NAME_PREFIX + context.packageName
+
+  private const val KEY_BASE_URL = "baseUrl"
+  private const val KEY_DEVICE_ID = "deviceId"
+  private const val KEY_SECRET = "secret"
+  private const val KEY_ACCOUNT_ID = "accountId"
+  private const val KEY_EXPIRES_AT = "expiresAt"
+
+  private const val KEY_TOKEN = "token"
+  private const val KEY_TOKEN_EXPIRES_AT = "tokenExpiresAt"
+  private const val KEY_TOKEN_ACCOUNT_ID = "tokenAccountId"
+
+  /** The provisioned credential. [expiresAt] is epoch millis. */
+  internal data class Credential(
+    val baseUrl: String,
+    val deviceId: String,
+    val secret: String,
+    val accountId: String,
+    val expiresAt: Long,
+  )
+
+  /** A previously minted access token. [expiresAt] is epoch millis. */
+  internal data class CachedToken(
+    val accessToken: String,
+    val expiresAt: Long,
+    val accountId: String,
+  )
+
+  /**
+   * [RecoveryPolicy.RebuildFileOnly] — this store must NEVER escalate to a
+   * UID-shared master-key reset.
+   *
+   * What it holds is disposable: the app re-provisions the credential on its next
+   * foreground, so "no credential" is a complete recovery that costs the user
+   * nothing (background refreshes render signed out until then). A master-key reset
+   * would wipe every other Oxy store sharing the alias — including the self-custody
+   * identity keypair, which is IRREPLACEABLE. Trading someone else's unrecoverable
+   * data to save data we can simply ask for again is never the right trade, so the
+   * escalation is not merely discouraged here, it is unreachable.
+   */
+  private fun prefs(context: Context): SharedPreferences =
+    OxyEncryptedPrefs.open(context, prefsName(context), RecoveryPolicy.RebuildFileOnly)
+
+  /**
+   * The stored credential, or null when absent, incomplete, or expired.
+   *
+   * An expired credential is DELETED on the way out rather than merely ignored:
+   * it can never become valid again (only JS can provision, and it will write a
+   * fresh one), so leaving it on disk would keep a dead secret at rest for as
+   * long as the app went unopened.
+   */
+  fun readCredential(context: Context): Credential? {
+    val p = prefs(context)
+    val baseUrl = p.getString(KEY_BASE_URL, null)
+    val deviceId = p.getString(KEY_DEVICE_ID, null)
+    val secret = p.getString(KEY_SECRET, null)
+    val accountId = p.getString(KEY_ACCOUNT_ID, null)
+    val expiresAt = p.getLong(KEY_EXPIRES_AT, 0L)
+    if (
+      baseUrl.isNullOrEmpty() ||
+      deviceId.isNullOrEmpty() ||
+      secret.isNullOrEmpty() ||
+      accountId.isNullOrEmpty() ||
+      expiresAt <= 0L
+    ) {
+      return null
+    }
+    if (expiresAt <= System.currentTimeMillis()) {
+      clear(context)
+      return null
+    }
+    return Credential(baseUrl, deviceId, secret, accountId, expiresAt)
+  }
+
+  /**
+   * Replace the credential.
+   *
+   * Clears any cached token in the SAME commit: a token minted for the previous
+   * credential must never survive alongside a new one, or a switch could serve
+   * the previous account's bearer for up to its remaining lifetime.
+   *
+   * `commit()` (synchronous) because the very next thing that reads this may be a
+   * WorkManager worker on another thread.
+   */
+  fun writeCredential(context: Context, credential: Credential) {
+    prefs(context).edit()
+      .putString(KEY_BASE_URL, credential.baseUrl)
+      .putString(KEY_DEVICE_ID, credential.deviceId)
+      .putString(KEY_SECRET, credential.secret)
+      .putString(KEY_ACCOUNT_ID, credential.accountId)
+      .putLong(KEY_EXPIRES_AT, credential.expiresAt)
+      .remove(KEY_TOKEN)
+      .remove(KEY_TOKEN_EXPIRES_AT)
+      .remove(KEY_TOKEN_ACCOUNT_ID)
+      .commit()
+  }
+
+  /** The account the stored credential belongs to, without touching the network. */
+  fun readAccountId(context: Context): String? = readCredential(context)?.accountId
+
+  /** Drop the credential AND any cached token. Safe to call when already empty. */
+  fun clear(context: Context) {
+    prefs(context).edit().clear().commit()
+  }
+
+  /**
+   * A cached token still worth reusing for [accountId], or null.
+   *
+   * Rejects a token minted for a DIFFERENT account (defence in depth — writing a
+   * credential already clears the cache) and one inside [reuseFloorMs] of its
+   * expiry, so a token cannot expire midway through the request it was fetched
+   * for.
+   */
+  fun readToken(context: Context, accountId: String, reuseFloorMs: Long): CachedToken? {
+    val p = prefs(context)
+    val token = p.getString(KEY_TOKEN, null)
+    val tokenAccountId = p.getString(KEY_TOKEN_ACCOUNT_ID, null)
+    val expiresAt = p.getLong(KEY_TOKEN_EXPIRES_AT, 0L)
+    if (token.isNullOrEmpty() || tokenAccountId.isNullOrEmpty() || expiresAt <= 0L) {
+      return null
+    }
+    if (tokenAccountId != accountId) {
+      return null
+    }
+    if (expiresAt - reuseFloorMs <= System.currentTimeMillis()) {
+      return null
+    }
+    return CachedToken(token, expiresAt, tokenAccountId)
+  }
+
+  /**
+   * Cache a freshly minted token so sibling workers in the same refresh cycle
+   * share one mint instead of one each (which would also burn the per-device rate
+   * limit).
+   *
+   * `apply()` rather than `commit()`: unlike the credential this is a pure
+   * optimization, and a lost write only costs one extra mint.
+   */
+  fun writeToken(context: Context, token: CachedToken) {
+    prefs(context).edit()
+      .putString(KEY_TOKEN, token.accessToken)
+      .putLong(KEY_TOKEN_EXPIRES_AT, token.expiresAt)
+      .putString(KEY_TOKEN_ACCOUNT_ID, token.accountId)
+      .apply()
+  }
+}

package/android/src/main/java/so/oxy/session/OxyBackgroundToken.kt

@@ -0,0 +1,61 @@
+package so.oxy.session
+
+/**
+ * The outcome of [OxyBackgroundSession.accessToken].
+ *
+ * Four cases rather than a nullable token, because a background caller must treat
+ * them differently and cannot tell them apart from `null`: "the user is signed
+ * out" is a final answer to render, while "the network is down" is something to
+ * retry, and conflating the two either blanks a widget that should keep its last
+ * content or retries something that will never succeed.
+ */
+sealed interface OxyBackgroundToken {
+  /**
+   * A usable bearer for [accountId], valid until [expiresAt] (epoch millis).
+   *
+   * [accountId] is the account the token was minted for, echoed by the server —
+   * NOT a local guess. Key any cached content by it and discard content
+   * belonging to a different account, so a switch can never render one account's
+   * data under another's name.
+   *
+   * [baseUrl] is the API origin the credential was provisioned against; use it
+   * for the subsequent authenticated request rather than a hardcoded host, so a
+   * staging/self-hosted app talks to its own backend.
+   */
+  data class Available(
+    val accessToken: String,
+    val expiresAt: Long,
+    val accountId: String,
+    val baseUrl: String,
+  ) : OxyBackgroundToken
+
+  /**
+   * There is no usable credential and there will not be one until the user opens
+   * the app: none was ever provisioned, it expired, or the server revoked it
+   * (sign-out, account switch, or the account left this device).
+   *
+   * FINAL for this run. Render the signed-out state and report success —
+   * retrying cannot change the answer. The local record has already been deleted.
+   */
+  data object SignedOut : OxyBackgroundToken
+
+  /**
+   * The mint could not be completed for a reason a later attempt could get past:
+   * no network, a timeout, a 5xx, a rate limit, or ANY ambiguous 401.
+   *
+   * The credential is KEPT. Retry with backoff and keep showing the last known
+   * content; do not render a signed-out state, because the user is not signed
+   * out. See [OxyBackgroundSessionApi] for why an unrecognised 401 lands here
+   * rather than in [SignedOut].
+   */
+  data class Transient(val cause: Exception) : OxyBackgroundToken
+
+  /**
+   * The server answered, but not in a shape this build can read.
+   *
+   * The credential is KEPT (nothing proves it is bad) but retrying is pointless:
+   * the same body would come back. Log it and stop; this means the wire contract
+   * moved and the app needs updating.
+   */
+  data class Malformed(val cause: Exception) : OxyBackgroundToken
+}

package/android/src/main/java/so/oxy/storage/OxyEncryptedPrefs.kt

@@ -0,0 +1,241 @@
+package so.oxy.storage
+
+import android.content.Context
+import android.content.SharedPreferences
+import android.util.Log
+import androidx.security.crypto.EncryptedSharedPreferences
+import androidx.security.crypto.MasterKey
+import java.io.IOException
+import java.security.GeneralSecurityException
+import java.security.KeyStore
+
+/**
+ * How far [OxyEncryptedPrefs.open] may go to recover a file whose keyset it
+ * cannot read.
+ *
+ * This exists because the callers do NOT have the same stakes, and the last-resort
+ * recovery is UID-wide rather than file-local. Every store must therefore state
+ * what it is worth: the choice belongs to the data's owner, not to the helper.
+ */
+internal enum class RecoveryPolicy {
+  /**
+   * Wipe and rebuild only this file. If that still fails, GIVE UP — propagate the
+   * failure and touch nothing shared.
+   *
+   * The right policy for any store holding DISPOSABLE data, i.e. data some other
+   * authority can re-create. "No data" is then a complete, cost-free recovery, and
+   * paying for it with a UID-wide key reset would be trading someone else's
+   * irreplaceable data for something we can simply ask for again.
+   */
+  RebuildFileOnly,
+
+  /**
+   * Wipe and rebuild this file, and if that still fails, regenerate the UID-shared
+   * master key and rebuild again.
+   *
+   * Only defensible for a store whose loss is ALREADY catastrophic, because the
+   * reset invalidates every other Oxy prefs file wrapped by that key (see
+   * [OxyEncryptedPrefs]). Do not choose this to make a store more robust — it makes
+   * every OTHER store less so.
+   */
+  RegenerateSharedMasterKey,
+}
+
+/**
+ * The ONE way this package opens a hardware-backed [EncryptedSharedPreferences]
+ * file.
+ *
+ * Two stores are built on it — the cross-app identity keypair
+ * (`so.oxy.identity.OxyIdentityStore`) and the background session credential
+ * (`so.oxy.session.OxyBackgroundSessionStore`) — and both need the same two
+ * non-obvious properties below. They are implemented once here rather than per
+ * store: a second copy would be a copy of exactly the reasoning that is easiest
+ * to get wrong, and the failure mode of getting it wrong is silent (every read
+ * degrades to "absent" with no exception at the call site).
+ *
+ * What is NOT shared is how much each caller may destroy to save itself. That is
+ * [RecoveryPolicy], and it is a required argument precisely so the difference
+ * cannot be inherited by accident.
+ *
+ * ## One memoized instance per file (CRITICAL)
+ *
+ * `EncryptedSharedPreferences.create()` must be called AT MOST ONCE per file per
+ * process. It is NOT safe to re-instantiate: when a second instance is created
+ * for the same file while another is live (e.g. a JS write thread and a Binder
+ * thread, or a WorkManager worker and the app's main thread), Tink's keyset load
+ * races and the next decrypt throws `AEADBadTagException` — which silently turned
+ * every cross-app read into "no shared identity". So instances are created once,
+ * lazily, under a lock, keyed by file name on the process-global application
+ * context, and reused for every subsequent read/write.
+ *
+ * The cache is keyed by file name ALONE, which is correct because each file has
+ * exactly one owning store and therefore exactly one policy. Two callers opening
+ * the same file with different policies would be a bug in the callers, not
+ * something this cache should try to reconcile.
+ *
+ * ## Keyset self-heal (CRITICAL)
+ *
+ * The androidx master key that wraps each file's Tink keyset lives under the
+ * UID-scoped default alias [MasterKey.DEFAULT_MASTER_KEY_ALIAS] — ONE entry for
+ * the whole `so.oxy.shared` UID. When a NEW package joins that shared UID, that
+ * master key can be rotated/regenerated, leaving keysets already written on disk
+ * wrapped under the OLD key. `create()` then fails GCM verification
+ * (`AEADBadTag` -> `GeneralSecurityException`, or an unreadable keyset ->
+ * `IOException`) on EVERY read/write, and `EncryptedSharedPreferences` never
+ * self-heals — the slot stays permanently dead.
+ *
+ * Recovery is bounded and has no retry loop:
+ *   1. ALWAYS: delete only the affected file (the stale wrapped keyset) and rebuild
+ *      against the current master key. This heals the common rotation case without
+ *      touching the master key, so other files keep their keysets.
+ *   2. ONLY under [RecoveryPolicy.RegenerateSharedMasterKey]: if a fresh keyset
+ *      still cannot be built the master key itself is unusable, so delete its
+ *      keystore alias to force a new one, wipe the file again, and rebuild.
+ *
+ * Stage 2 is UID-WIDE COLLATERAL: regenerating the shared master key makes every
+ * OTHER Oxy prefs file wrapped by it unreadable, so each of those heals itself via
+ * stage 1 on its next open — meaning it DELETES their contents. For a store whose
+ * data is re-creatable that is survivable; for the self-custody identity keypair it
+ * is not, which is the whole reason a disposable store must never reach stage 2.
+ * Under [RecoveryPolicy.RebuildFileOnly] the failure simply propagates, and the
+ * `runCatching {}` at every call site degrades to "absent".
+ *
+ * None of this touches the app's device session, which lives in expo-secure-store
+ * under a DISTINCT prefs file ("SecureStore") and DISTINCT keystore aliases
+ * ("key_v1"-derived), not the androidx master key.
+ */
+internal object OxyEncryptedPrefs {
+  private const val TAG = "OxyEncryptedPrefs"
+  private const val ANDROID_KEYSTORE = "AndroidKeyStore"
+
+  /** Memoized instances, keyed by prefs file name. Guarded by [lock]. */
+  private val instances = mutableMapOf<String, SharedPreferences>()
+  private val lock = Any()
+
+  /**
+   * The process-wide instance for [prefsName], creating (and recovering) it on
+   * first use. [recovery] states how much this caller may destroy to get a working
+   * file — see [RecoveryPolicy]; there is no default, on purpose.
+   *
+   * Throws when the file cannot be built within the chosen policy; callers wrap in
+   * `runCatching {}` and degrade to "absent".
+   */
+  fun open(context: Context, prefsName: String, recovery: RecoveryPolicy): SharedPreferences {
+    synchronized(lock) {
+      instances[prefsName]?.let { return it }
+      val appContext = context.applicationContext
+      return openOrHeal(appContext, prefsName, recovery).also { instances[prefsName] = it }
+    }
+  }
+
+  private fun openOrHeal(
+    appContext: Context,
+    prefsName: String,
+    recovery: RecoveryPolicy,
+  ): SharedPreferences {
+    return try {
+      build(appContext, prefsName)
+    } catch (corrupt: GeneralSecurityException) {
+      healKeyset(appContext, prefsName, recovery, corrupt)
+    } catch (corrupt: IOException) {
+      healKeyset(appContext, prefsName, recovery, corrupt)
+    }
+  }
+
+  /**
+   * Stage 1: wipe ONLY this file (which holds the stale wrapped keyset) and
+   * rebuild against the current master key. Where it goes next is the caller's
+   * policy, not this function's decision.
+   */
+  private fun healKeyset(
+    appContext: Context,
+    prefsName: String,
+    recovery: RecoveryPolicy,
+    cause: Exception,
+  ): SharedPreferences {
+    Log.w(
+      TAG,
+      "keyset for '$prefsName' unreadable (rotated master key); cleared and regenerated: ${cause.message}",
+      cause
+    )
+    appContext.deleteSharedPreferences(prefsName)
+    return try {
+      build(appContext, prefsName)
+    } catch (stillCorrupt: GeneralSecurityException) {
+      escalateOrGiveUp(appContext, prefsName, recovery, stillCorrupt)
+    } catch (stillCorrupt: IOException) {
+      escalateOrGiveUp(appContext, prefsName, recovery, stillCorrupt)
+    }
+  }
+
+  /**
+   * The stage-1-failed fork, and the one place the severity difference between
+   * callers is decided.
+   *
+   * [RecoveryPolicy.RebuildFileOnly] rethrows: this file stays unavailable, which
+   * its owner can recover from, and no shared key is touched. Anything else would
+   * let a disposable store destroy an irreplaceable one.
+   */
+  private fun escalateOrGiveUp(
+    appContext: Context,
+    prefsName: String,
+    recovery: RecoveryPolicy,
+    cause: Exception,
+  ): SharedPreferences {
+    if (recovery == RecoveryPolicy.RebuildFileOnly) {
+      Log.w(
+        TAG,
+        "'$prefsName' is still unreadable after a file reset. Giving up rather than " +
+          "regenerating the UID-shared master key, which would wipe every other Oxy " +
+          "store including the self-custody identity. Its owner re-creates it instead.",
+        cause
+      )
+      throw cause
+    }
+    return regenerateMasterKeyAndRebuild(appContext, prefsName, cause)
+  }
+
+  /**
+   * Stage 2, reachable ONLY via [RecoveryPolicy.RegenerateSharedMasterKey]: the
+   * androidx master key itself is unusable, so delete its keystore alias to force a
+   * fresh one, wipe the now-stale file again, and rebuild.
+   *
+   * See the UID-wide collateral note in [OxyEncryptedPrefs] — this is destructive
+   * to every other store sharing the alias. The alias is used ONLY by androidx
+   * EncryptedSharedPreferences, so it never touches expo-secure-store's aliases. A
+   * throw here propagates to the call-site `runCatching {}`.
+   */
+  private fun regenerateMasterKeyAndRebuild(
+    appContext: Context,
+    prefsName: String,
+    cause: Exception
+  ): SharedPreferences {
+    Log.w(
+      TAG,
+      "keyset for '$prefsName' still unreadable after reset; deleting master key " +
+        "'${MasterKey.DEFAULT_MASTER_KEY_ALIAS}' and regenerating: ${cause.message}",
+      cause
+    )
+    KeyStore.getInstance(ANDROID_KEYSTORE).apply {
+      load(null)
+      if (containsAlias(MasterKey.DEFAULT_MASTER_KEY_ALIAS)) {
+        deleteEntry(MasterKey.DEFAULT_MASTER_KEY_ALIAS)
+      }
+    }
+    appContext.deleteSharedPreferences(prefsName)
+    return build(appContext, prefsName)
+  }
+
+  private fun build(appContext: Context, prefsName: String): SharedPreferences {
+    val masterKey = MasterKey.Builder(appContext)
+      .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
+      .build()
+    return EncryptedSharedPreferences.create(
+      appContext,
+      prefsName,
+      masterKey,
+      EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
+      EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
+    )
+  }
+}

package/expo-module.config.json

@@ -4,6 +4,9 @@
     "modules": ["OxyIdentityModule"]
   },
   "android": {
-    "modules": ["so.oxy.identity.OxyIdentityModule"]
+    "modules": [
+      "so.oxy.identity.OxyIdentityModule",
+      "so.oxy.session.OxyBackgroundSessionModule"
+    ]
   }
 }

package/lib/commonjs/index.js

@@ -183,30 +183,12 @@ Object.defineProperty(exports, "extractErrorMessage", {
     return _errorHandlers.extractErrorMessage;
   }
 });
-Object.defineProperty(exports, "getExpoPushToken", {
-  enumerable: true,
-  get: function () {
-    return _deviceNotifications.getExpoPushToken;
-  }
-});
 Object.defineProperty(exports, "handleAuthError", {
   enumerable: true,
   get: function () {
     return _errorHandlers.handleAuthError;
   }
 });
-Object.defineProperty(exports, "hasNotificationPermission", {
-  enumerable: true,
-  get: function () {
-    return _deviceNotifications.hasNotificationPermission;
-  }
-});
-Object.defineProperty(exports, "installForegroundNotificationHandler", {
-  enumerable: true,
-  get: function () {
-    return _deviceNotifications.installForegroundNotificationHandler;
-  }
-});
 Object.defineProperty(exports, "invalidateAccountQueries", {
   enumerable: true,
   get: function () {
@@ -297,24 +279,12 @@ Object.defineProperty(exports, "openOAuthPopup", {
     return _oauthPopup.openOAuthPopup;
   }
 });
-Object.defineProperty(exports, "pushTokenPlatform", {
-  enumerable: true,
-  get: function () {
-    return _deviceNotifications.pushTokenPlatform;
-  }
-});
 Object.defineProperty(exports, "queryKeys", {
   enumerable: true,
   get: function () {
     return _queryKeys.queryKeys;
   }
 });
-Object.defineProperty(exports, "requestNotificationPermission", {
-  enumerable: true,
-  get: function () {
-    return _deviceNotifications.requestNotificationPermission;
-  }
-});
 Object.defineProperty(exports, "setOxyAssetInstance", {
   enumerable: true,
   get: function () {
@@ -333,18 +303,6 @@ Object.defineProperty(exports, "subscribeToAccountDialog", {
     return _accountDialogManager.subscribeToAccountDialog;
   }
 });
-Object.defineProperty(exports, "subscribeToNotificationResponses", {
-  enumerable: true,
-  get: function () {
-    return _deviceNotifications.subscribeToNotificationResponses;
-  }
-});
-Object.defineProperty(exports, "takeLaunchNotificationData", {
-  enumerable: true,
-  get: function () {
-    return _deviceNotifications.takeLaunchNotificationData;
-  }
-});
 Object.defineProperty(exports, "upsertCachedUser", {
   enumerable: true,
   get: function () {
@@ -752,7 +710,6 @@ var _useOnlineStatus = require("./ui/hooks/useOnlineStatus.js");
 var _useOxyEvent = require("./ui/hooks/useOxyEvent.js");
 var _errorHandlers = require("./ui/utils/errorHandlers.js");
 var _useFileFiltering = require("./ui/hooks/useFileFiltering.js");
-var _deviceNotifications = require("./notifications/deviceNotifications.js");
 var _OxySignInButton = _interopRequireDefault(require("./ui/components/OxySignInButton.js"));
 var _oauthPopup = require("./ui/oauth/oauthPopup.js");
 var _OxyAuthPrompt = require("./ui/components/OxyAuthPrompt.js");
@@ -860,13 +817,25 @@ function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e
 // ---------------------------------------------------------------------------
 
 // ---------------------------------------------------------------------------
-// Device notifications (the ONE `expo-notifications` adapter)
+// Device notifications — DELIBERATELY NOT EXPORTED HERE
 // ---------------------------------------------------------------------------
-// The Expo-side half of push: permission, platform tag, and the EXPO push token
-// `@oxyhq/core`'s `registerPushToken` accepts (never a raw APNs/FCM token).
-// Native-only by construction — every entry point resolves its null/no-op result
-// from `Platform.OS` before `expo-notifications` is ever imported, and both
-// `expo-notifications` and `expo-constants` are OPTIONAL peers.
+// The `expo-notifications` adapter lives behind its own entry point:
+//
+//     import { getExpoPushToken } from '@oxyhq/services/notifications';
+//
+// It is the one module in this package whose dependencies (`expo-notifications`
+// and `expo-constants`) are optional peers that an app which does not use push
+// genuinely never installs. Re-exporting it from THIS barrel is what made that
+// optionality a lie: a barrel export puts the module in the import graph of
+// every consumer, and `tsc` must resolve the specifier of an `import()` even
+// when the call is lazy and wrapped in try/catch — so every consumer without
+// `expo-notifications` failed with TS2307 (plus TS7006 cascades) whether or not
+// it had ever heard of push. Behind a subpath the module is only ever pulled in
+// by an app that asked for it, which is what "optional peer" is supposed to
+// mean.
+//
+// Do NOT re-add these exports here. `__tests__/notifications/barrelIsolation.test.ts`
+// fails if you do.
 
 // ---------------------------------------------------------------------------
 // UI components

package/lib/commonjs/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["_core","require","_reactNative","_OxyProvider","_interopRequireDefault","_OxyContext","_useAuth","_identityBinding","_authStore","_accountStore","_assetStore","_useAssets","_useFileDownloadUrl","_useFollow","_useStorage","_useAccountQueries","_useServicesQueries","_useSecurityQueries","_useAuthMethods","_usePaymentQueries","_useAccountMutations","_useServicesMutations","_mutationFactory","_mutationKeys","_queryKeys","_userCache","_useMutationStatus","_useOnlineStatus","_useOxyEvent","_errorHandlers","_useFileFiltering","_deviceNotifications","_OxySignInButton","_oauthPopup","_OxyAuthPrompt","_OxyOAuthCallback","_OxyConsentScreen","_RequireOxyAuth","_FollowButton","_OxyPayButton","_LogoIcon","_LogoText","_ProfileButton","_OxyAuthChooser","_OxySignInRequestSurface","_useSwitchableAccounts","_ProfileScreen","_ManageAccountScreen","_NotificationsScreen","_PreferencesScreen","_ConnectedAppsScreen","_CreateAccountScreen","_AccountMembersScreen","_AccountSettingsScreen","_bottomSheetManager","_useSurfaceHeader","_SurfaceHeaderAction","_accountDialogManager","e","__esModule","default","setPlatformOS","Platform","OS"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AAMA,IAAAE,YAAA,GAAAC,sBAAA,CAAAH,OAAA;AACA,IAAAI,WAAA,GAAAJ,OAAA;AAEA,IAAAK,QAAA,GAAAL,OAAA;AAKA,IAAAM,gBAAA,GAAAN,OAAA;AAKA,IAAAO,UAAA,GAAAP,OAAA;AACA,IAAAQ,aAAA,GAAAR,OAAA;AACA,IAAAS,WAAA,GAAAT,OAAA;AAgBA,IAAAU,UAAA,GAAAV,OAAA;AACA,IAAAW,mBAAA,GAAAX,OAAA;AACA,IAAAY,UAAA,GAAAZ,OAAA;AACA,IAAAa,WAAA,GAAAb,OAAA;AAMA,IAAAc,kBAAA,GAAAd,OAAA;AAUA,IAAAe,mBAAA,GAAAf,OAAA;AAQA,IAAAgB,mBAAA,GAAAhB,OAAA;AAKA,IAAAiB,eAAA,GAAAjB,OAAA;AACA,IAAAkB,kBAAA,GAAAlB,OAAA;AAyBA,IAAAmB,oBAAA,GAAAnB,OAAA;AAUA,IAAAoB,qBAAA,GAAApB,OAAA;AAOA,IAAAqB,gBAAA,GAAArB,OAAA;AAUA,IAAAsB,aAAA,GAAAtB,OAAA;AAQA,IAAAuB,UAAA,GAAAvB,OAAA;AAmBA,IAAAwB,UAAA,GAAAxB,OAAA;AAIA,IAAAyB,kBAAA,GAAAzB,OAAA;AAEA,IAAA0B,gBAAA,GAAA1B,OAAA;AACA,IAAA2B,YAAA,GAAA3B,OAAA;AAKA,IAAA4B,cAAA,GAAA5B,OAAA;AAWA,IAAA6B,iBAAA,GAAA7B,OAAA;AAWA,IAAA8B,oBAAA,GAAA9B,OAAA;AAkBA,IAAA+B,gBAAA,GAAA5B,sBAAA,CAAAH,OAAA;AAOA,IAAAgC,WAAA,GAAAhC,OAAA;AAUA,IAAAiC,cAAA,GAAAjC,OAAA;AAEA,IAAAkC,iBAAA,GAAAlC,OAAA;AAEA,IAAAmC,iBAAA,GAAAnC,OAAA;AAYA,IAAAoC,eAAA,GAAApC,OAAA;AAGA,IAAAqC,aAAA,GAAAlC,sBAAA,CAAAH,OAAA;AAEA,IAAAsC,aAAA,GAAAnC,sBAAA,CAAAH,OAAA;AACA,IAAAuC,SAAA,GAAAvC,OAAA;AACA,IAAAwC,SAAA,GAAAxC,OAAA;AAKA,IAAAyC,cAAA,GAAAtC,sBAAA,CAAAH,OAAA;AAQA,IAAA0C,eAAA,GAAAvC,sBAAA,CAAAH,OAAA;AAWA,IAAA2C,wBAAA,GAAA3C,OAAA;AAUA,IAAA4C,sBAAA,GAAA5C,OAAA;AAIA,IAAA6C,cAAA,GAAA1C,sBAAA,CAAAH,OAAA;AACA,IAAA8C,oBAAA,GAAA3C,sBAAA,CAAAH,OAAA;AACA,IAAA+C,oBAAA,GAAA5C,sBAAA,CAAAH,OAAA;AACA,IAAAgD,kBAAA,GAAA7C,sBAAA,CAAAH,OAAA;AACA,IAAAiD,oBAAA,GAAA9C,sBAAA,CAAAH,OAAA;AAGA,IAAAkD,oBAAA,GAAA/C,sBAAA,CAAAH,OAAA;AACA,IAAAmD,qBAAA,GAAAhD,sBAAA,CAAAH,OAAA;AACA,IAAAoD,sBAAA,GAAAjD,sBAAA,CAAAH,OAAA;AAKA,IAAAqD,mBAAA,GAAArD,OAAA;AAMA,IAAAsD,iBAAA,GAAAtD,OAAA;AACA,IAAAuD,oBAAA,GAAAvD,OAAA;AAMA,IAAAwD,qBAAA,GAAAxD,OAAA;AAI8C,SAAAG,uBAAAsD,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAjV9C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;;AAIA,IAAAG,mBAAa,EAACC,qBAAQ,CAACC,EAAgB,CAAC;;AAExC;AACA;AACA;;AAMA;AACA;AACA;;AAGA;AACA;AACA;;AAgBA;AACA;AACA;;AAOA;AACA;AACA;;AAgCA;;AAeA;AACA;AACA;;AA2BA;;AAGA;AACA;AACA;AACA;AACA;AACA;;AAeA;AACA;AACA;AACA;AACA;;AAIA;;AAMA;AACA;AACA;;AASA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAYA;AACA;AACA;;AAQA;AACA;AACA;AACA;;AAsBA;AACA;AACA;AACA;AACA;;AAUA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAKA;AACA;AACA;AACA;AACA;AACA;;AAIA;;AAOA;;AAKA;AACA;AACA;;AAIA;AACA;AACA;;AAIA;AACA;AACA;AACA","ignoreList":[]}
+{"version":3,"names":["_core","require","_reactNative","_OxyProvider","_interopRequireDefault","_OxyContext","_useAuth","_identityBinding","_authStore","_accountStore","_assetStore","_useAssets","_useFileDownloadUrl","_useFollow","_useStorage","_useAccountQueries","_useServicesQueries","_useSecurityQueries","_useAuthMethods","_usePaymentQueries","_useAccountMutations","_useServicesMutations","_mutationFactory","_mutationKeys","_queryKeys","_userCache","_useMutationStatus","_useOnlineStatus","_useOxyEvent","_errorHandlers","_useFileFiltering","_OxySignInButton","_oauthPopup","_OxyAuthPrompt","_OxyOAuthCallback","_OxyConsentScreen","_RequireOxyAuth","_FollowButton","_OxyPayButton","_LogoIcon","_LogoText","_ProfileButton","_OxyAuthChooser","_OxySignInRequestSurface","_useSwitchableAccounts","_ProfileScreen","_ManageAccountScreen","_NotificationsScreen","_PreferencesScreen","_ConnectedAppsScreen","_CreateAccountScreen","_AccountMembersScreen","_AccountSettingsScreen","_bottomSheetManager","_useSurfaceHeader","_SurfaceHeaderAction","_accountDialogManager","e","__esModule","default","setPlatformOS","Platform","OS"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AAMA,IAAAE,YAAA,GAAAC,sBAAA,CAAAH,OAAA;AACA,IAAAI,WAAA,GAAAJ,OAAA;AAEA,IAAAK,QAAA,GAAAL,OAAA;AAKA,IAAAM,gBAAA,GAAAN,OAAA;AAKA,IAAAO,UAAA,GAAAP,OAAA;AACA,IAAAQ,aAAA,GAAAR,OAAA;AACA,IAAAS,WAAA,GAAAT,OAAA;AAgBA,IAAAU,UAAA,GAAAV,OAAA;AACA,IAAAW,mBAAA,GAAAX,OAAA;AACA,IAAAY,UAAA,GAAAZ,OAAA;AACA,IAAAa,WAAA,GAAAb,OAAA;AAMA,IAAAc,kBAAA,GAAAd,OAAA;AAUA,IAAAe,mBAAA,GAAAf,OAAA;AAQA,IAAAgB,mBAAA,GAAAhB,OAAA;AAKA,IAAAiB,eAAA,GAAAjB,OAAA;AACA,IAAAkB,kBAAA,GAAAlB,OAAA;AAyBA,IAAAmB,oBAAA,GAAAnB,OAAA;AAUA,IAAAoB,qBAAA,GAAApB,OAAA;AAOA,IAAAqB,gBAAA,GAAArB,OAAA;AAUA,IAAAsB,aAAA,GAAAtB,OAAA;AAQA,IAAAuB,UAAA,GAAAvB,OAAA;AAmBA,IAAAwB,UAAA,GAAAxB,OAAA;AAIA,IAAAyB,kBAAA,GAAAzB,OAAA;AAEA,IAAA0B,gBAAA,GAAA1B,OAAA;AACA,IAAA2B,YAAA,GAAA3B,OAAA;AAKA,IAAA4B,cAAA,GAAA5B,OAAA;AAWA,IAAA6B,iBAAA,GAAA7B,OAAA;AA+BA,IAAA8B,gBAAA,GAAA3B,sBAAA,CAAAH,OAAA;AAOA,IAAA+B,WAAA,GAAA/B,OAAA;AAUA,IAAAgC,cAAA,GAAAhC,OAAA;AAEA,IAAAiC,iBAAA,GAAAjC,OAAA;AAEA,IAAAkC,iBAAA,GAAAlC,OAAA;AAYA,IAAAmC,eAAA,GAAAnC,OAAA;AAGA,IAAAoC,aAAA,GAAAjC,sBAAA,CAAAH,OAAA;AAEA,IAAAqC,aAAA,GAAAlC,sBAAA,CAAAH,OAAA;AACA,IAAAsC,SAAA,GAAAtC,OAAA;AACA,IAAAuC,SAAA,GAAAvC,OAAA;AAKA,IAAAwC,cAAA,GAAArC,sBAAA,CAAAH,OAAA;AASA,IAAAyC,eAAA,GAAAtC,sBAAA,CAAAH,OAAA;AAWA,IAAA0C,wBAAA,GAAA1C,OAAA;AAUA,IAAA2C,sBAAA,GAAA3C,OAAA;AAIA,IAAA4C,cAAA,GAAAzC,sBAAA,CAAAH,OAAA;AACA,IAAA6C,oBAAA,GAAA1C,sBAAA,CAAAH,OAAA;AACA,IAAA8C,oBAAA,GAAA3C,sBAAA,CAAAH,OAAA;AACA,IAAA+C,kBAAA,GAAA5C,sBAAA,CAAAH,OAAA;AACA,IAAAgD,oBAAA,GAAA7C,sBAAA,CAAAH,OAAA;AAGA,IAAAiD,oBAAA,GAAA9C,sBAAA,CAAAH,OAAA;AACA,IAAAkD,qBAAA,GAAA/C,sBAAA,CAAAH,OAAA;AACA,IAAAmD,sBAAA,GAAAhD,sBAAA,CAAAH,OAAA;AAKA,IAAAoD,mBAAA,GAAApD,OAAA;AAMA,IAAAqD,iBAAA,GAAArD,OAAA;AACA,IAAAsD,oBAAA,GAAAtD,OAAA;AAMA,IAAAuD,qBAAA,GAAAvD,OAAA;AAI8C,SAAAG,uBAAAqD,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AApV9C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;;AAIA,IAAAG,mBAAa,EAACC,qBAAQ,CAACC,EAAgB,CAAC;;AAExC;AACA;AACA;;AAMA;AACA;AACA;;AAGA;AACA;AACA;;AAgBA;AACA;AACA;;AAOA;AACA;AACA;;AAgCA;;AAeA;AACA;AACA;;AA2BA;;AAGA;AACA;AACA;AACA;AACA;AACA;;AAeA;AACA;AACA;AACA;AACA;;AAIA;;AAMA;AACA;AACA;;AASA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;;AAQA;AACA;AACA;AACA;;AAsBA;AACA;AACA;AACA;AACA;;AAUA;AACA;AACA;;AAKA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAKA;AACA;AACA;AACA;AACA;AACA;;AAIA;;AAOA;;AAKA;AACA;AACA;;AAIA;AACA;AACA;;AAIA;AACA;AACA;AACA","ignoreList":[]}