@symbiote-native/secure-store 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 A. Prokopenko
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,145 @@
+# @symbiote-native/secure-store
+
+A wrapper package for [SymbioteNative](../../README.md) that makes
+[`expo-secure-store`](https://github.com/expo/expo/tree/main/packages/expo-secure-store) —
+encrypted key-value storage in the iOS Keychain and the Android Keystore, optionally gated behind
+the device's own biometrics — usable from **every** adapter, React, Vue, and Angular, not just
+React. Built the same way as [`@symbiote-native/local-auth`](../local-auth): an
+`expo-modules-core`-based wrapper (see the `symbiote-expo-native-module` project skill for the
+full mechanism — why `expo-modules-core` is depended on directly and never the `expo`
+meta-package, why the upstream JS is hand-ported into `core/` rather than imported, and how
+autolinking picks up the native module).
+
+## Install
+
+```bash
+npm install @symbiote-native/secure-store
+```
+
+`expo-secure-store` and `expo-modules-core` come along as regular, pinned dependencies — never
+install either yourself, and never add the `expo` meta-package to this project (it bundles its
+own Metro/Babel pipeline that conflicts with this project's own).
+
+### Required one-time step: native autolinking wiring
+
+Unlike a plain RN native module, `expo-secure-store`'s native code is discovered by
+`expo-modules-autolinking` — this needs wiring into the native host app **once**, covering this
+package and every other `expo-modules-core` package with zero further changes:
+
+| Platform | Touches |
+|---|---|
+| iOS | `ios/Podfile` — add `use_expo_modules!` |
+| iOS | `AppDelegate.swift` — Expo's runtime-bootstrap hook |
+| Android | `settings.gradle` / `app/build.gradle` — resolve and include the Expo Gradle projects |
+| Android | `MainApplication.kt` — Expo's bootstrap hook, plus a native-module name map |
+
+Full mechanics live in the `symbiote-expo-native-module` skill. The per-package half of that
+table — the Gradle dependency, the module map entry, the `NSFaceIDUsageDescription` string, and
+the Android backup rules below — is generated by
+[`@symbiote-native/expo-modules-link`](../expo-modules-link) from this package's
+`native-link.json` on every install.
+
+### Android: Auto Backup must exclude the store
+
+`native-link.json` asks the linker to set two attributes on your app's `<application>` element:
+
+```xml
+android:fullBackupContent="@xml/secure_store_backup_rules"
+android:dataExtractionRules="@xml/secure_store_data_extraction_rules"
+```
+
+Both rule files ship inside `expo-secure-store` itself and merge in automatically; only the two
+attributes have to live in your own manifest. They matter: Android Auto Backup would otherwise
+upload the encrypted entries while leaving the Keystore keys that decrypt them behind, and a
+restore onto a new device would hand the app values it can no longer read. If your app already
+sets either attribute, the linker keeps yours and prints a notice — merge the rules yourself in
+that case (Expo's own [SecureStore docs](https://docs.expo.dev/versions/latest/sdk/securestore/)
+describe the rule files).
+
+## Shape
+
+```
+src/core/                 the whole API: seven keychain-accessibility constants plus the
+                          get/set/delete surface. native-module.ts resolves ExpoSecureStore
+                          through expo-modules-core's requireNativeModule.
+src/react/                @symbiote-native/secure-store/react
+src/vue/                  @symbiote-native/secure-store/vue
+src/angular/              @symbiote-native/secure-store/angular
+```
+
+All three adapter entries are plain re-exports of `core/`. Upstream ships free functions and
+constants — no per-instance state, no event stream — so there is nothing for a hook, composable,
+or service to wrap, the same reason [`@symbiote-native/local-auth`](../local-auth) re-exports
+rather than wraps. Import from `@symbiote-native/secure-store` directly if you don't care which
+adapter you're on; the per-adapter subpaths exist so every wrapper package has the same import
+surface.
+
+## Use it
+
+```ts
+import * as SecureStore from '@symbiote-native/secure-store';
+
+await SecureStore.setItemAsync('session-token', token);
+const stored = await SecureStore.getItemAsync('session-token'); // string | null
+await SecureStore.deleteItemAsync('session-token');
+```
+
+Behind the device's own biometrics or passcode:
+
+```ts
+if (SecureStore.canUseBiometricAuthentication()) {
+  await SecureStore.setItemAsync('session-token', token, {
+    requireAuthentication: true,
+    authenticationPrompt: 'Unlock your saved session',
+  });
+}
+```
+
+The prompt fires at different moments per platform: Android authenticates on every operation, iOS
+only when reading or updating an entry that already exists. A simulator or emulator does not
+enforce it at all — this option can only be verified on a real device.
+
+Values are strings. JSON-encode anything else:
+
+```ts
+await SecureStore.setItemAsync('profile', JSON.stringify(profile));
+const profile = JSON.parse((await SecureStore.getItemAsync('profile')) ?? 'null');
+```
+
+## API
+
+| Export | Signature | Notes |
+|---|---|---|
+| `isAvailableAsync` | `() => Promise<boolean>` | `true` on Android and iOS. Says nothing about permissions. |
+| `getItemAsync` | `(key, options?) => Promise<string \| null>` | `null` when there is no entry, or when the key has been invalidated. |
+| `getItem` | `(key, options?) => string \| null` | Blocks the JS thread. |
+| `setItemAsync` | `(key, value, options?) => Promise<void>` | Rejects if the value cannot be stored. |
+| `setItem` | `(key, value, options?) => void` | Blocks the JS thread. |
+| `deleteItemAsync` | `(key, options?) => Promise<void>` | |
+| `canUseBiometricAuthentication` | `() => boolean` | Whether `requireAuthentication` can be used at all. |
+| `AFTER_FIRST_UNLOCK`, `AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY`, `ALWAYS`, `ALWAYS_THIS_DEVICE_ONLY`, `WHEN_PASSCODE_SET_THIS_DEVICE_ONLY`, `WHEN_UNLOCKED`, `WHEN_UNLOCKED_THIS_DEVICE_ONLY` | `IKeychainAccessibilityConstant \| undefined` | Values for `options.keychainAccessible`. iOS only — Android's native module declares none of them, so they read `undefined` there. `ALWAYS` and `ALWAYS_THIS_DEVICE_ONLY` are deprecated upstream. |
+
+`ISecureStoreOptions`: `keychainService`, `requireAuthentication`, `authenticationPrompt`,
+`keychainAccessible` (iOS), `accessGroup` (iOS).
+
+## Notes
+
+- **Keys are validated before the native call.** Alphanumerics plus `.`, `-` and `_`, non-empty —
+  anything else throws with a readable message rather than failing inside the keychain.
+- **An invalidated key is gone for good.** The system invalidates entries stored with
+  `requireAuthentication` whenever enrolled biometrics change (a new fingerprint, a re-registered
+  face). `getItemAsync` then resolves `null` — treat it as "the user must sign in again", not as
+  an error to retry.
+- **`requireAuthentication` does not combine with a shared `keychainService`.** The full behavior
+  needs a freshly generated key, so reuse of a service already holding non-authenticated entries
+  gives partial behavior. Upstream documents the same limitation.
+
+## Test it
+
+```bash
+pnpm vitest run packages/secure-store
+```
+
+The core tests fake the native module in place of `requireNativeModule`'s runtime resolution —
+`ExpoSecureStore` only exists on a device, so a headless run would otherwise throw at import.
+Real storage, biometrics, and the backup rules can only be verified on a device or emulator.

package/build/angular/index.d.ts

@@ -0,0 +1 @@
+export * from '../core';

package/build/angular/index.js

@@ -0,0 +1,4 @@
+// @symbiote-native/secure-store/angular: the Angular entry over the framework-agnostic core.
+// Same reasoning as the React/Vue entries — no per-instance state or event stream to wrap in a
+// service, so this is a plain re-export.
+export * from '../core';

package/build/core/index.d.ts

@@ -0,0 +1,2 @@
+export { AFTER_FIRST_UNLOCK, AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY, ALWAYS, ALWAYS_THIS_DEVICE_ONLY, WHEN_PASSCODE_SET_THIS_DEVICE_ONLY, WHEN_UNLOCKED, WHEN_UNLOCKED_THIS_DEVICE_ONLY, isAvailableAsync, getItemAsync, getItem, setItemAsync, setItem, deleteItemAsync, canUseBiometricAuthentication, } from './secure-store';
+export type { IKeychainAccessibilityConstant, ISecureStoreOptions } from './types';

package/build/core/index.js

@@ -0,0 +1 @@
+export { AFTER_FIRST_UNLOCK, AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY, ALWAYS, ALWAYS_THIS_DEVICE_ONLY, WHEN_PASSCODE_SET_THIS_DEVICE_ONLY, WHEN_UNLOCKED, WHEN_UNLOCKED_THIS_DEVICE_ONLY, isAvailableAsync, getItemAsync, getItem, setItemAsync, setItem, deleteItemAsync, canUseBiometricAuthentication, } from './secure-store';

package/build/core/native-module.d.ts

@@ -0,0 +1,17 @@
+import type { IKeychainAccessibilityConstant, ISecureStoreOptions } from './types';
+export type INativeSecureStoreModule = {
+    AFTER_FIRST_UNLOCK?: IKeychainAccessibilityConstant;
+    AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY?: IKeychainAccessibilityConstant;
+    ALWAYS?: IKeychainAccessibilityConstant;
+    ALWAYS_THIS_DEVICE_ONLY?: IKeychainAccessibilityConstant;
+    WHEN_PASSCODE_SET_THIS_DEVICE_ONLY?: IKeychainAccessibilityConstant;
+    WHEN_UNLOCKED?: IKeychainAccessibilityConstant;
+    WHEN_UNLOCKED_THIS_DEVICE_ONLY?: IKeychainAccessibilityConstant;
+    getValueWithKeyAsync?(key: string, options: ISecureStoreOptions): Promise<string | null>;
+    getValueWithKeySync?(key: string, options: ISecureStoreOptions): string | null;
+    setValueWithKeyAsync?(value: string, key: string, options: ISecureStoreOptions): Promise<boolean>;
+    setValueWithKeySync?(value: string, key: string, options: ISecureStoreOptions): boolean;
+    deleteValueWithKeyAsync?(key: string, options: ISecureStoreOptions): Promise<void>;
+    canUseBiometricAuthentication?(): boolean;
+};
+export declare const expoSecureStore: INativeSecureStoreModule;

package/build/core/native-module.js

@@ -0,0 +1,3 @@
+import { requireNativeModule } from 'expo-modules-core';
+const EXPO_SECURE_STORE_MODULE_NAME = 'ExpoSecureStore';
+export const expoSecureStore = requireNativeModule(EXPO_SECURE_STORE_MODULE_NAME);

package/build/core/secure-store.d.ts

@@ -0,0 +1,83 @@
+import type { IKeychainAccessibilityConstant, ISecureStoreOptions } from './types';
+/**
+ * The item cannot be read after a restart until the device has been unlocked once. Useful for
+ * data the app needs while the phone is locked.
+ * @platform ios
+ */
+export declare const AFTER_FIRST_UNLOCK: IKeychainAccessibilityConstant | undefined;
+/**
+ * Like `AFTER_FIRST_UNLOCK`, except the entry does not migrate to a new device when restoring
+ * from a backup.
+ * @platform ios
+ */
+export declare const AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY: IKeychainAccessibilityConstant | undefined;
+/**
+ * The item can always be read, locked device or not. The least secure option.
+ * @deprecated Use a level that offers some user protection, such as `AFTER_FIRST_UNLOCK`.
+ * @platform ios
+ */
+export declare const ALWAYS: IKeychainAccessibilityConstant | undefined;
+/**
+ * Like `ALWAYS`, except the entry does not migrate to a new device when restoring from a backup.
+ * @deprecated Use a level that offers some user protection, such as
+ * `AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY`.
+ * @platform ios
+ */
+export declare const ALWAYS_THIS_DEVICE_ONLY: IKeychainAccessibilityConstant | undefined;
+/**
+ * Like `WHEN_UNLOCKED_THIS_DEVICE_ONLY`, except the user must have set a passcode to store an
+ * entry at all. Removing the passcode deletes the entry.
+ * @platform ios
+ */
+export declare const WHEN_PASSCODE_SET_THIS_DEVICE_ONLY: IKeychainAccessibilityConstant | undefined;
+/**
+ * The item can only be read while the device is unlocked.
+ * @platform ios
+ */
+export declare const WHEN_UNLOCKED: IKeychainAccessibilityConstant | undefined;
+/**
+ * Like `WHEN_UNLOCKED`, except the entry does not migrate to a new device when restoring from a
+ * backup.
+ * @platform ios
+ */
+export declare const WHEN_UNLOCKED_THIS_DEVICE_ONLY: IKeychainAccessibilityConstant | undefined;
+/**
+ * Whether the SecureStore API is usable on this device. Says nothing about app permissions.
+ * Resolves `true` on Android and iOS.
+ */
+export declare function isAvailableAsync(): Promise<boolean>;
+/**
+ * Read the value stored under `key`.
+ *
+ * Resolves `null` when there is no entry for the key, or when the key has been invalidated —
+ * the system invalidates keys stored with `requireAuthentication` whenever enrolled biometrics
+ * change (a new fingerprint, a re-registered face), and an invalidated value can never be read
+ * again. Rejects if reading itself fails.
+ */
+export declare function getItemAsync(key: string, options?: ISecureStoreOptions): Promise<string | null>;
+/**
+ * Read the value stored under `key`, synchronously.
+ *
+ * > Blocks the JavaScript thread. With `requireAuthentication` on, the app stays unresponsive
+ * > until the user authenticates.
+ */
+export declare function getItem(key: string, options?: ISecureStoreOptions): string | null;
+/**
+ * Store a key–value pair. Keys may contain alphanumeric characters, `.`, `-` and `_`.
+ * Rejects if the value cannot be stored on the device.
+ */
+export declare function setItemAsync(key: string, value: string, options?: ISecureStoreOptions): Promise<void>;
+/**
+ * Store a key–value pair, synchronously.
+ *
+ * > Blocks the JavaScript thread. With `requireAuthentication` on, the app stays unresponsive
+ * > until the user authenticates.
+ */
+export declare function setItem(key: string, value: string, options?: ISecureStoreOptions): void;
+/** Delete the value stored under `key`. Rejects if the value cannot be deleted. */
+export declare function deleteItemAsync(key: string, options?: ISecureStoreOptions): Promise<void>;
+/**
+ * Whether a value can be stored with `requireAuthentication` — `true` when the device supports
+ * biometric authentication and the enrolled method is strong enough.
+ */
+export declare function canUseBiometricAuthentication(): boolean;

package/build/core/secure-store.js

@@ -0,0 +1,137 @@
+import { UnavailabilityError } from 'expo-modules-core';
+import { expoSecureStore } from './native-module';
+const NATIVE_MODULE_NAME = 'expo-secure-store';
+// Alphanumerics plus ".", "-" and "_": the same set the native side validates against, so an
+// invalid key fails here with a readable message instead of deep inside the keychain call.
+const VALID_KEY_PATTERN = /^[\w.-]+$/;
+/**
+ * The item cannot be read after a restart until the device has been unlocked once. Useful for
+ * data the app needs while the phone is locked.
+ * @platform ios
+ */
+export const AFTER_FIRST_UNLOCK = expoSecureStore.AFTER_FIRST_UNLOCK;
+/**
+ * Like `AFTER_FIRST_UNLOCK`, except the entry does not migrate to a new device when restoring
+ * from a backup.
+ * @platform ios
+ */
+export const AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY = expoSecureStore.AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY;
+/**
+ * The item can always be read, locked device or not. The least secure option.
+ * @deprecated Use a level that offers some user protection, such as `AFTER_FIRST_UNLOCK`.
+ * @platform ios
+ */
+export const ALWAYS = expoSecureStore.ALWAYS;
+/**
+ * Like `ALWAYS`, except the entry does not migrate to a new device when restoring from a backup.
+ * @deprecated Use a level that offers some user protection, such as
+ * `AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY`.
+ * @platform ios
+ */
+export const ALWAYS_THIS_DEVICE_ONLY = expoSecureStore.ALWAYS_THIS_DEVICE_ONLY;
+/**
+ * Like `WHEN_UNLOCKED_THIS_DEVICE_ONLY`, except the user must have set a passcode to store an
+ * entry at all. Removing the passcode deletes the entry.
+ * @platform ios
+ */
+export const WHEN_PASSCODE_SET_THIS_DEVICE_ONLY = expoSecureStore.WHEN_PASSCODE_SET_THIS_DEVICE_ONLY;
+/**
+ * The item can only be read while the device is unlocked.
+ * @platform ios
+ */
+export const WHEN_UNLOCKED = expoSecureStore.WHEN_UNLOCKED;
+/**
+ * Like `WHEN_UNLOCKED`, except the entry does not migrate to a new device when restoring from a
+ * backup.
+ * @platform ios
+ */
+export const WHEN_UNLOCKED_THIS_DEVICE_ONLY = expoSecureStore.WHEN_UNLOCKED_THIS_DEVICE_ONLY;
+/**
+ * Whether the SecureStore API is usable on this device. Says nothing about app permissions.
+ * Resolves `true` on Android and iOS.
+ */
+export async function isAvailableAsync() {
+    return !!expoSecureStore.getValueWithKeyAsync;
+}
+/**
+ * Read the value stored under `key`.
+ *
+ * Resolves `null` when there is no entry for the key, or when the key has been invalidated —
+ * the system invalidates keys stored with `requireAuthentication` whenever enrolled biometrics
+ * change (a new fingerprint, a re-registered face), and an invalidated value can never be read
+ * again. Rejects if reading itself fails.
+ */
+export async function getItemAsync(key, options = {}) {
+    ensureValidKey(key);
+    if (!expoSecureStore.getValueWithKeyAsync) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'getItemAsync');
+    }
+    return expoSecureStore.getValueWithKeyAsync(key, options);
+}
+/**
+ * Read the value stored under `key`, synchronously.
+ *
+ * > Blocks the JavaScript thread. With `requireAuthentication` on, the app stays unresponsive
+ * > until the user authenticates.
+ */
+export function getItem(key, options = {}) {
+    ensureValidKey(key);
+    if (!expoSecureStore.getValueWithKeySync) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'getItem');
+    }
+    return expoSecureStore.getValueWithKeySync(key, options);
+}
+/**
+ * Store a key–value pair. Keys may contain alphanumeric characters, `.`, `-` and `_`.
+ * Rejects if the value cannot be stored on the device.
+ */
+export async function setItemAsync(key, value, options = {}) {
+    ensureValidKey(key);
+    ensureValidValue(value);
+    if (!expoSecureStore.setValueWithKeyAsync) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'setItemAsync');
+    }
+    await expoSecureStore.setValueWithKeyAsync(value, key, options);
+}
+/**
+ * Store a key–value pair, synchronously.
+ *
+ * > Blocks the JavaScript thread. With `requireAuthentication` on, the app stays unresponsive
+ * > until the user authenticates.
+ */
+export function setItem(key, value, options = {}) {
+    ensureValidKey(key);
+    ensureValidValue(value);
+    if (!expoSecureStore.setValueWithKeySync) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'setItem');
+    }
+    expoSecureStore.setValueWithKeySync(value, key, options);
+}
+/** Delete the value stored under `key`. Rejects if the value cannot be deleted. */
+export async function deleteItemAsync(key, options = {}) {
+    ensureValidKey(key);
+    if (!expoSecureStore.deleteValueWithKeyAsync) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'deleteItemAsync');
+    }
+    await expoSecureStore.deleteValueWithKeyAsync(key, options);
+}
+/**
+ * Whether a value can be stored with `requireAuthentication` — `true` when the device supports
+ * biometric authentication and the enrolled method is strong enough.
+ */
+export function canUseBiometricAuthentication() {
+    if (!expoSecureStore.canUseBiometricAuthentication) {
+        throw new UnavailabilityError(NATIVE_MODULE_NAME, 'canUseBiometricAuthentication');
+    }
+    return expoSecureStore.canUseBiometricAuthentication();
+}
+function ensureValidKey(key) {
+    if (typeof key !== 'string' || !VALID_KEY_PATTERN.test(key)) {
+        throw new Error('Invalid key provided to SecureStore. Keys must not be empty and contain only alphanumeric characters, ".", "-", and "_".');
+    }
+}
+function ensureValidValue(value) {
+    if (typeof value !== 'string') {
+        throw new Error('Invalid value provided to SecureStore. Values must be strings; consider JSON-encoding your values if they are serializable.');
+    }
+}

package/build/core/types.d.ts

@@ -0,0 +1,43 @@
+/**
+ * An iOS [`kSecAttrAccessible`](https://developer.apple.com/documentation/security/ksecattraccessible/)
+ * value, as exposed by the native module. Opaque on purpose — pass one of the constants this
+ * package exports rather than a literal.
+ */
+export type IKeychainAccessibilityConstant = number;
+export type ISecureStoreOptions = {
+    /**
+     * - Android: equivalent of the public/private key pair `Alias`.
+     * - iOS: the item's service, equivalent to [`kSecAttrService`](https://developer.apple.com/documentation/security/ksecattrservice/).
+     *
+     * An item stored with a `keychainService` needs the same one to be read back.
+     */
+    keychainService?: string;
+    /**
+     * Require the device's own authentication (biometrics or passcode) to reach the stored value.
+     * - Android: [`setUserAuthenticationRequired(true)`](https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder#setUserAuthenticationRequired(boolean)).
+     * - iOS: [`biometryCurrentSet`](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/2937192-biometrycurrentset).
+     *
+     * The two platforms prompt at different moments: Android authenticates on every operation,
+     * iOS only when reading or updating an existing value, never when creating one. The full
+     * behavior needs a freshly generated key, so it does not combine with a `keychainService`
+     * already used for non-authenticated entries.
+     *
+     * > Emulators and simulators do not enforce the prompt when retrieving a secret — testing this
+     * > option means testing on a real device.
+     */
+    requireAuthentication?: boolean;
+    /** Message shown to the user in the prompt raised by `requireAuthentication`. */
+    authenticationPrompt?: string;
+    /**
+     * When the stored entry is accessible, via iOS's `kSecAttrAccessible` property.
+     * @default WHEN_UNLOCKED
+     * @platform ios
+     */
+    keychainAccessible?: IKeychainAccessibilityConstant;
+    /**
+     * The [access group](https://developer.apple.com/documentation/security/sharing-access-to-keychain-items-among-a-collection-of-apps)
+     * the stored entry belongs to.
+     * @platform ios
+     */
+    accessGroup?: string;
+};

package/build/core/types.js

@@ -0,0 +1 @@
+export {};

package/build/react/index.d.ts

@@ -0,0 +1 @@
+export * from '../core';

package/build/react/index.js

@@ -0,0 +1,5 @@
+// @symbiote-native/secure-store/react: the React entry over the framework-agnostic core.
+// Upstream ships free functions and seven constants, no per-instance state and no event stream
+// — there is nothing for a hook to wrap, so this is a plain re-export, the same shape
+// packages/local-auth's React entry has for the same reason.
+export * from '../core';

package/build/vue/index.d.ts

@@ -0,0 +1 @@
+export * from '../core';

package/build/vue/index.js

@@ -0,0 +1,4 @@
+// @symbiote-native/secure-store/vue: the Vue entry over the framework-agnostic core. Same
+// reasoning as the React entry — no per-instance state or event stream to wire onto Vue's
+// reactivity, so this is a plain re-export.
+export * from '../core';

package/build-ngc/angular/index.d.ts

@@ -0,0 +1 @@
+export * from '../core';

package/build-ngc/angular/index.js

@@ -0,0 +1,5 @@
+// @symbiote-native/secure-store/angular: the Angular entry over the framework-agnostic core.
+// Same reasoning as the React/Vue entries — no per-instance state or event stream to wrap in a
+// service, so this is a plain re-export.
+export * from '../core';
+//# sourceMappingURL=index.js.map

package/build-ngc/angular/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/angular/index.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,+FAA+F;AAC/F,yCAAyC;AACzC,cAAc,SAAS,CAAC"}

package/build-ngc/core/index.d.ts

@@ -0,0 +1,2 @@
+export { AFTER_FIRST_UNLOCK, AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY, ALWAYS, ALWAYS_THIS_DEVICE_ONLY, WHEN_PASSCODE_SET_THIS_DEVICE_ONLY, WHEN_UNLOCKED, WHEN_UNLOCKED_THIS_DEVICE_ONLY, isAvailableAsync, getItemAsync, getItem, setItemAsync, setItem, deleteItemAsync, canUseBiometricAuthentication, } from './secure-store';
+export type { IKeychainAccessibilityConstant, ISecureStoreOptions } from './types';

package/build-ngc/core/index.js

@@ -0,0 +1,2 @@
+export { AFTER_FIRST_UNLOCK, AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY, ALWAYS, ALWAYS_THIS_DEVICE_ONLY, WHEN_PASSCODE_SET_THIS_DEVICE_ONLY, WHEN_UNLOCKED, WHEN_UNLOCKED_THIS_DEVICE_ONLY, isAvailableAsync, getItemAsync, getItem, setItemAsync, setItem, deleteItemAsync, canUseBiometricAuthentication, } from './secure-store';
+//# sourceMappingURL=index.js.map

package/build-ngc/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,mCAAmC,EACnC,MAAM,EACN,uBAAuB,EACvB,kCAAkC,EAClC,aAAa,EACb,8BAA8B,EAC9B,gBAAgB,EAChB,YAAY,EACZ,OAAO,EACP,YAAY,EACZ,OAAO,EACP,eAAe,EACf,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC"}

package/build-ngc/core/native-module.d.ts

@@ -0,0 +1,17 @@
+import type { IKeychainAccessibilityConstant, ISecureStoreOptions } from './types';
+export type INativeSecureStoreModule = {
+    AFTER_FIRST_UNLOCK?: IKeychainAccessibilityConstant;
+    AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY?: IKeychainAccessibilityConstant;
+    ALWAYS?: IKeychainAccessibilityConstant;
+    ALWAYS_THIS_DEVICE_ONLY?: IKeychainAccessibilityConstant;
+    WHEN_PASSCODE_SET_THIS_DEVICE_ONLY?: IKeychainAccessibilityConstant;
+    WHEN_UNLOCKED?: IKeychainAccessibilityConstant;
+    WHEN_UNLOCKED_THIS_DEVICE_ONLY?: IKeychainAccessibilityConstant;
+    getValueWithKeyAsync?(key: string, options: ISecureStoreOptions): Promise<string | null>;
+    getValueWithKeySync?(key: string, options: ISecureStoreOptions): string | null;
+    setValueWithKeyAsync?(value: string, key: string, options: ISecureStoreOptions): Promise<boolean>;
+    setValueWithKeySync?(value: string, key: string, options: ISecureStoreOptions): boolean;
+    deleteValueWithKeyAsync?(key: string, options: ISecureStoreOptions): Promise<void>;
+    canUseBiometricAuthentication?(): boolean;
+};
+export declare const expoSecureStore: INativeSecureStoreModule;

package/build-ngc/core/native-module.js

@@ -0,0 +1,4 @@
+import { requireNativeModule } from 'expo-modules-core';
+const EXPO_SECURE_STORE_MODULE_NAME = 'ExpoSecureStore';
+export const expoSecureStore = requireNativeModule(EXPO_SECURE_STORE_MODULE_NAME);
+//# sourceMappingURL=native-module.js.map

package/build-ngc/core/native-module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-module.js","sourceRoot":"","sources":["../../src/core/native-module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAGxD,MAAM,6BAA6B,GAAG,iBAAiB,CAAC;AAyBxD,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAChD,6BAA6B,CAC9B,CAAC"}

package/build-ngc/core/secure-store.d.ts

@@ -0,0 +1,83 @@
+import type { IKeychainAccessibilityConstant, ISecureStoreOptions } from './types';
+/**
+ * The item cannot be read after a restart until the device has been unlocked once. Useful for
+ * data the app needs while the phone is locked.
+ * @platform ios
+ */
+export declare const AFTER_FIRST_UNLOCK: IKeychainAccessibilityConstant | undefined;
+/**
+ * Like `AFTER_FIRST_UNLOCK`, except the entry does not migrate to a new device when restoring
+ * from a backup.
+ * @platform ios
+ */
+export declare const AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY: IKeychainAccessibilityConstant | undefined;
+/**
+ * The item can always be read, locked device or not. The least secure option.
+ * @deprecated Use a level that offers some user protection, such as `AFTER_FIRST_UNLOCK`.
+ * @platform ios
+ */
+export declare const ALWAYS: IKeychainAccessibilityConstant | undefined;
+/**
+ * Like `ALWAYS`, except the entry does not migrate to a new device when restoring from a backup.
+ * @deprecated Use a level that offers some user protection, such as
+ * `AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY`.
+ * @platform ios
+ */
+export declare const ALWAYS_THIS_DEVICE_ONLY: IKeychainAccessibilityConstant | undefined;
+/**
+ * Like `WHEN_UNLOCKED_THIS_DEVICE_ONLY`, except the user must have set a passcode to store an
+ * entry at all. Removing the passcode deletes the entry.
+ * @platform ios
+ */
+export declare const WHEN_PASSCODE_SET_THIS_DEVICE_ONLY: IKeychainAccessibilityConstant | undefined;
+/**
+ * The item can only be read while the device is unlocked.
+ * @platform ios
+ */
+export declare const WHEN_UNLOCKED: IKeychainAccessibilityConstant | undefined;
+/**
+ * Like `WHEN_UNLOCKED`, except the entry does not migrate to a new device when restoring from a
+ * backup.
+ * @platform ios
+ */
+export declare const WHEN_UNLOCKED_THIS_DEVICE_ONLY: IKeychainAccessibilityConstant | undefined;
+/**
+ * Whether the SecureStore API is usable on this device. Says nothing about app permissions.
+ * Resolves `true` on Android and iOS.
+ */
+export declare function isAvailableAsync(): Promise<boolean>;
+/**
+ * Read the value stored under `key`.
+ *
+ * Resolves `null` when there is no entry for the key, or when the key has been invalidated —
+ * the system invalidates keys stored with `requireAuthentication` whenever enrolled biometrics
+ * change (a new fingerprint, a re-registered face), and an invalidated value can never be read
+ * again. Rejects if reading itself fails.
+ */
+export declare function getItemAsync(key: string, options?: ISecureStoreOptions): Promise<string | null>;
+/**
+ * Read the value stored under `key`, synchronously.
+ *
+ * > Blocks the JavaScript thread. With `requireAuthentication` on, the app stays unresponsive
+ * > until the user authenticates.
+ */
+export declare function getItem(key: string, options?: ISecureStoreOptions): string | null;
+/**
+ * Store a key–value pair. Keys may contain alphanumeric characters, `.`, `-` and `_`.
+ * Rejects if the value cannot be stored on the device.
+ */
+export declare function setItemAsync(key: string, value: string, options?: ISecureStoreOptions): Promise<void>;
+/**
+ * Store a key–value pair, synchronously.
+ *
+ * > Blocks the JavaScript thread. With `requireAuthentication` on, the app stays unresponsive
+ * > until the user authenticates.
+ */
+export declare function setItem(key: string, value: string, options?: ISecureStoreOptions): void;
+/** Delete the value stored under `key`. Rejects if the value cannot be deleted. */
+export declare function deleteItemAsync(key: string, options?: ISecureStoreOptions): Promise<void>;
+/**
+ * Whether a value can be stored with `requireAuthentication` — `true` when the device supports
+ * biometric authentication and the enrolled method is strong enough.
+ */
+export declare function canUseBiometricAuthentication(): boolean;