@unisim/sdk 0.123.4 → 0.124.0

package/README.md

@@ -126,7 +126,7 @@ not configure this beyond passing `cookieDomain`:
 | --- | --- | --- |
 | Browser on `*.unisim.co.uk` | cookie scoped to the parent zone | every suite subdomain |
 | Browser on localhost / Electron | localStorage | nothing (origin-scoped) |
-| Native (Capacitor), plugin present | shared iOS Keychain group | **every suite app on the device** |
+| Native (Capacitor), plugin present | shared suite store (see below) | **every suite app on the device** |
 | Native, plugin missing | localStorage | nothing, but it does persist |
 
 ⚠️ **A Capacitor app cannot use the cookie.** It runs at `capacitor://localhost`,
@@ -137,11 +137,56 @@ in the native bundle too, so before 0.123.0 **the native builds could not
 persist a session at all**: sign in, force-quit, signed out again, nothing
 logged. `npm run test:session-storage` pins that behaviour.
 
-### Turning on the shared Keychain for a native app
+⚠️ **A shared store does not by itself give you a shared SIGN-OUT.** supabase-js
+announces a session it finds on resume, and announces nothing when it finds the
+store emptied — so an app already running keeps showing a signed-in UI after you
+sign out somewhere else. `UniversalProvider` closes that by re-reading the store
+on every resume; `npm run test:shared-signout` pins both legs.
 
-The SDK ships the native half itself (`ios/Sources/UnisimSuiteAuthPlugin`), so
-`npx cap sync ios` picks it up with no Xcode project surgery. The one thing it
-cannot do for you is the entitlement:
+### The shared store is two mechanisms behind one name
+
+`UnisimSuiteAuth` presents the same three calls on both platforms, but what is
+underneath could hardly be less alike, and the difference decides what can go
+wrong:
+
+| | iOS | Android |
+| --- | --- | --- |
+| Mechanism | one Keychain access group | a ring of ContentProviders, one per app |
+| Shared by | the OS, for apps of the same **team** | the apps themselves, gated on a `signature` permission |
+| Written on sign-in | once | to this app, then pushed to every installed peer |
+| Fails to share when | the entitlement is missing | the peer list is empty, or signatures differ |
+
+Android has no shared box to put anything in — `sharedUserId` was deprecated in
+API 29 and is unusable for anything new — so there is nowhere central to write.
+Each app therefore hosts `SuiteAuthProvider` behind
+`uk.co.unisim.suite.permission.SUITE_AUTH` (protection level `signature`, so only
+same-key apps get through), and reads and writes fan out across the installed
+peers. Sources: `android/src/main/java/uk/co/unisim/sdk/`.
+
+⚠️ **On Android the peer list is the thing that breaks.** API 30+ hides packages
+you have not declared an interest in, so the `<queries>` block in the module's
+`AndroidManifest.xml` is load-bearing: without an app listed there it is
+invisible, keeps a private session, and nothing reports a problem. **Its
+`<provider>` authorities are the single canonical list of participating suite
+apps** — the Java side keeps no second copy, it filters what the package manager
+admits to by the `.unisimsuiteauth` suffix. Adding an app to the suite means
+adding one line there. (The `<package>` list below it is a different list for a
+different job — see the switcher section.)
+
+⚠️ **Same key, in practice, means the same BUILD TYPE.** Debug builds are signed
+with `~/.android/debug.keystore` and release builds with the upload key. Install
+a mix on one phone and the platform treats them as two different vendors: access
+is refused, every app keeps its own session, and a refused peer is a normal
+enough thing to meet that nothing shouts. Test all-debug or all-release.
+
+### Turning on the shared store for a native app
+
+The SDK ships both native halves itself (`ios/Sources/UnisimSuiteAuthPlugin` and
+`android/`), so `npx cap sync` picks them up with no Xcode or Gradle surgery.
+**Android needs nothing further** — the permission, the `<queries>` list and the
+provider all arrive through manifest merging.
+
+iOS has one thing the SDK cannot do for you, the entitlement:
 
 ```
 node ../universal-platform/scripts/add-suite-keychain.mjs <path-to-app-repo>
@@ -156,11 +201,63 @@ call returns `errSecMissingEntitlement` (-34018), not just the shared ones. An
 unsigned simulator build (`CODE_SIGNING_ALLOWED=NO`) gets the same, which is
 worth knowing before you go hunting for a bug in the plugin.
 
-`hasSharedKeychain()` and `chooseSessionStorage().kind` report which store an
+`hasSharedSuiteStore()` (and `chooseSessionStorage().kind`) report which store an
 app actually got — a build that quietly landed on `native-local` still signs in,
 it just does not carry to the other apps, and nothing about the behaviour makes
 that visible.
 
+## Opening a suite app instead of its website
+
+On a phone, a switcher row for a product you have installed opens **the app**,
+and says so with an `Installed` badge. In a browser nothing changes at all.
+
+⚠️ **An https link cannot do this, and adding associated domains would not
+help.** A WKWebView does not honour universal links for navigation that happens
+inside it, so a Capacitor app tapping `https://opensource.unisim.co.uk/pdf`
+loads the website in the webview it is already in, however the domains are
+configured. Handing off needs the platform's app-to-app channel: a custom URL
+scheme on iOS, a launch intent on Android.
+
+`SUITE_NATIVE_APPS` in `src/suiteApps.ts` is the source list — id, scheme, iOS
+bundle id, Android package. A product missing from it (Ergo Assess, Exports,
+anything web-only) keeps today's link, which is the right answer for a product
+with no app.
+
+| | iOS | Android |
+| --- | --- | --- |
+| Matches on | the app's custom URL **scheme** | the app's **package** |
+| Asked with | `canOpenURL` / `UIApplication.open` | `getLaunchIntentForPackage` |
+| Needs, per app | `CFBundleURLTypes` **and** every other app's scheme in `LSApplicationQueriesSchemes` | nothing — the SDK's manifest merges in |
+| Wrong list looks like | "not installed" | "not installed" |
+
+⚠️ **Both platforms fail the same silent way, and it is the reason this is
+tested.** An undeclared scheme or package is not an error: it is the ordinary
+answer for an app you do not have. A drifted list does not break the switcher,
+it just quietly stops offering one product on one platform. `npm run
+test:suite-apps` pins the registry against the Android manifest and against the
+switcher's own catalogue, and pins the browser case to today's behaviour.
+
+The iOS half is per app and generated, never hand-edited:
+
+```
+node ../universal-platform/scripts/add-suite-app-links.mjs <path-to-app-repo>
+```
+
+Add `--check` to fail instead of write. Then `npx cap sync ios` and **rebuild** —
+`Info.plist` is compiled into the bundle, so running the script is not shipping
+the change.
+
+⚠️ Adding a new native app means three edits, not one: the registry, the
+`<package>` list in `android/src/main/AndroidManifest.xml`, and a run of the
+script above in every app repo (they all need the new scheme in their queries
+list, not just the new app).
+
+The row stays a real `<a href>` throughout — the handoff is a click handler over
+the top, so a launch that fails still navigates and long-press/copy-link keep
+working. `openSuiteApp()` resolving `false` is the fallback signal, not an
+error. A `comingSoon` product never launches even when installed, because its
+row does not navigate either.
+
 ## Multi-tenant model
 
 This SDK is the client side of a Supabase-backed multi-tenant schema (see `universal-platform/supabase/migrations`). Every read/write is scoped to the user's active org via the `is_org_member()` helper in RLS policies. Anonymous-auth users get the same hooks; trial caps (3 people / 1 team / 2 places / 1 project) are enforced server-side by the `enforce_anonymous_trial_caps()` trigger.

package/android/build.gradle

@@ -0,0 +1,59 @@
+// The native Android half of @unisim/sdk — a Capacitor plugin module that
+// `npx cap sync android` wires into every app already depending on the SDK, the
+// same way UnisimSdk.podspec does on iOS. Nothing to publish separately and
+// nothing to version in lockstep.
+//
+// ⚠️ **Java, not Kotlin, on purpose.** A Kotlin module obliges every consuming
+// app's ROOT build.gradle to carry the kotlin-gradle-plugin on its buildscript
+// classpath, and Capacitor's Android template does not. That would be fourteen
+// generated projects to hand-edit, and one forgotten edit is a build failure
+// far from its cause. There is no Kotlin here worth that.
+//
+// Every version is read from the host app's variables.gradle when it defines
+// one (Capacitor's template always does) and falls back to the template's own
+// values otherwise, so this module never drags an app off its chosen SDK level.
+
+ext {
+    androidxAppCompatVersion = project.hasProperty('androidxAppCompatVersion') ? rootProject.ext.androidxAppCompatVersion : '1.7.0'
+}
+
+buildscript {
+    repositories {
+        google()
+        mavenCentral()
+    }
+    dependencies {
+        classpath 'com.android.tools.build:gradle:8.7.2'
+    }
+}
+
+apply plugin: 'com.android.library'
+
+android {
+    namespace "uk.co.unisim.sdk"
+    compileSdk project.hasProperty('compileSdkVersion') ? rootProject.ext.compileSdkVersion : 35
+    defaultConfig {
+        minSdkVersion project.hasProperty('minSdkVersion') ? rootProject.ext.minSdkVersion : 23
+        targetSdkVersion project.hasProperty('targetSdkVersion') ? rootProject.ext.targetSdkVersion : 35
+        versionCode 1
+        versionName "1.0"
+    }
+    lintOptions {
+        abortOnError false
+    }
+    compileOptions {
+        sourceCompatibility JavaVersion.VERSION_17
+        targetCompatibility JavaVersion.VERSION_17
+    }
+}
+
+repositories {
+    google()
+    mavenCentral()
+}
+
+dependencies {
+    implementation fileTree(dir: 'libs', include: ['*.jar'])
+    implementation project(':capacitor-android')
+    implementation "androidx.appcompat:appcompat:$androidxAppCompatVersion"
+}

package/android/src/main/AndroidManifest.xml

@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+    Merged into every suite app that depends on @unisim/sdk. Three things live
+    here, and each one is load-bearing:
+
+    1. The PERMISSION, at protection level `signature`. This is what makes the
+       shared session store safe: the platform will only let a caller through if
+       it is signed with the same key. Every suite app declares it, which is
+       fine precisely because they share a signing key — two apps declaring the
+       same permission name under DIFFERENT keys is an install failure
+       (INSTALL_FAILED_DUPLICATE_PERMISSION), and that is the protection
+       working, not a bug to route around.
+
+    2. The QUERIES block, which is really TWO lists for two different jobs. On
+       API 30+ a package this app has not declared an interest in simply does
+       not exist as far as the package manager is concerned, and BOTH failures
+       are silent — nothing throws, the answer just comes back empty.
+
+       2a. The PROVIDER authorities: who this app shares a SESSION with.
+       Without this list SuiteAuthStore.peerAuthorities() returns empty, every
+       app keeps a private session, and NOTHING REPORTS A PROBLEM — sign-in
+       just quietly stops travelling.
+
+       ⚠️ This is the one canonical list of participating suite apps. The Java
+       side does not keep a second copy; it filters what the package manager
+       admits to by the `.unisimsuiteauth` suffix. Adding an app to the suite
+       means adding one line HERE and nowhere else.
+
+       Two Capacitor apps are deliberately absent, and neither is an oversight:
+       Universal AI and Universal Family both run their own Supabase client on
+       their own storage key by an explicit decision recorded in their source,
+       so they have no shared session to take part in.
+
+       2b. The PACKAGE list: who the suite switcher can OPEN, via
+       UnisimSuiteAuthPlugin.installedApps/openApp. Deliberately a separate
+       list, because it answers a different question and gets a different
+       answer: Universal AI is here and not in 2a — being outside the shared
+       session says nothing about whether the switcher should offer to open it.
+       Universal Family is in neither, for the third reason again: it has no row
+       in the switcher to open. `<package>` (not `<provider>`) because
+       getLaunchIntentForPackage needs the package itself visible, which a
+       provider query only grants for the app hosting that provider.
+
+       ⚠️ Mirrors SUITE_NATIVE_APPS in `src/suiteApps.ts`, which cannot be
+       imported into a manifest. `tests/suite-apps.mjs` fails if the two drift.
+
+    3. The PROVIDER, whose authority is built from ${applicationId} so each app
+       ends up with its own. They cannot share one authority — two apps claiming
+       the same one cannot be installed side by side.
+-->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <permission
+        android:name="uk.co.unisim.suite.permission.SUITE_AUTH"
+        android:label="Universal Suite shared sign-in"
+        android:protectionLevel="signature" />
+
+    <uses-permission android:name="uk.co.unisim.suite.permission.SUITE_AUTH" />
+
+    <queries>
+        <provider
+            android:authorities="uk.co.unisim.coshhassess.unisimsuiteauth;uk.co.unisim.cyberassess.unisimsuiteauth;uk.co.unisim.fireassess.unisimsuiteauth;uk.co.unisim.riskassess.unisimsuiteauth;uk.co.unisim.wfhassess.unisimsuiteauth;uk.co.unisim.blackbook.unisimsuiteauth;uk.co.unisim.compress.unisimsuiteauth;uk.co.unisim.converter.unisimsuiteauth;uk.co.unisim.images.unisimsuiteauth;uk.co.unisim.pdf.unisimsuiteauth;uk.co.unisim.polling.unisimsuiteauth;uk.co.unisim.qr.unisimsuiteauth" />
+
+        <package android:name="uk.co.unisim.cyberassess" />
+        <package android:name="uk.co.unisim.wfhassess" />
+        <package android:name="uk.co.unisim.fireassess" />
+        <package android:name="uk.co.unisim.coshhassess" />
+        <package android:name="uk.co.unisim.riskassess" />
+        <package android:name="uk.co.unisim.pdf" />
+        <package android:name="uk.co.unisim.images" />
+        <package android:name="uk.co.unisim.qr" />
+        <package android:name="uk.co.unisim.compress" />
+        <package android:name="uk.co.unisim.converter" />
+        <package android:name="uk.co.unisim.polling" />
+        <package android:name="uk.co.unisim.blackbook" />
+        <package android:name="uk.co.unisim.ai" />
+    </queries>
+
+    <application>
+        <provider
+            android:name="uk.co.unisim.sdk.SuiteAuthProvider"
+            android:authorities="${applicationId}.unisimsuiteauth"
+            android:exported="true"
+            android:grantUriPermissions="false"
+            android:permission="uk.co.unisim.suite.permission.SUITE_AUTH" />
+    </application>
+
+</manifest>

package/android/src/main/java/uk/co/unisim/sdk/SuiteAuthProvider.java

@@ -0,0 +1,107 @@
+package uk.co.unisim.sdk;
+
+import android.content.ContentProvider;
+import android.content.ContentValues;
+import android.content.Context;
+import android.database.Cursor;
+import android.net.Uri;
+import android.os.Bundle;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
+
+/**
+ * This app's window into its own session store, opened only to the other suite
+ * apps.
+ *
+ * <p>Declared in this module's manifest with
+ * {@code android:authorities="${applicationId}.unisimsuiteauth"} and
+ * {@code android:permission="uk.co.unisim.suite.permission.SUITE_AUTH"}, a
+ * permission whose protection level is {@code signature} — so the only callers
+ * the platform will let through are apps signed with the same key. That is the
+ * Android analogue of the iOS Keychain group's "same team" rule, and it is
+ * enforced by the OS rather than by anything here.
+ *
+ * <p>⚠️ <b>Same key means the same BUILD TYPE, in practice.</b> A debug build is
+ * signed with {@code ~/.android/debug.keystore} and a release build with the
+ * upload key; install a mix on one phone and they are, to the platform, apps
+ * from two different vendors. Access is refused, each app keeps its own session,
+ * and — because a refused peer is a normal thing to meet — nothing shouts about
+ * it. Test the suite all-debug or all-release, never half of each.
+ *
+ * <p>This deliberately uses {@link #call} rather than the table-shaped
+ * query/insert/delete surface. There is no table here: it is three operations on
+ * one key, and modelling that as a {@link Cursor} would mean inventing a schema
+ * for both sides to agree about.
+ */
+public class SuiteAuthProvider extends ContentProvider {
+
+    @Override
+    public boolean onCreate() {
+        return true;
+    }
+
+    @Nullable
+    @Override
+    public Bundle call(@NonNull String method, @Nullable String arg, @Nullable Bundle extras) {
+        Context ctx = getContext();
+        if (ctx == null || arg == null) return null;
+
+        switch (method) {
+            case SuiteAuthStore.METHOD_GET: {
+                Bundle out = new Bundle();
+                // Deliberately the LOCAL read, not SuiteAuthStore.read(): a peer
+                // asking us must get our own answer. Fanning out from inside a
+                // fan-out is how three apps with nothing stored spend a round of
+                // IPC asking each other the same question.
+                out.putString(SuiteAuthStore.EXTRA_VALUE, SuiteAuthStore.readLocal(ctx, arg));
+                return out;
+            }
+            case SuiteAuthStore.METHOD_SET: {
+                if (extras == null) return null;
+                String value = extras.getString(SuiteAuthStore.EXTRA_VALUE);
+                if (value == null) return null;
+                SuiteAuthStore.writeLocal(ctx, arg, value);
+                return Bundle.EMPTY;
+            }
+            case SuiteAuthStore.METHOD_REMOVE: {
+                SuiteAuthStore.deleteLocal(ctx, arg);
+                return Bundle.EMPTY;
+            }
+            default:
+                return null;
+        }
+    }
+
+    // ── The table surface, unused ────────────────────────────────────────────
+
+    @Nullable
+    @Override
+    public Cursor query(@NonNull Uri uri, @Nullable String[] projection, @Nullable String selection,
+                        @Nullable String[] selectionArgs, @Nullable String sortOrder) {
+        return null;
+    }
+
+    @Nullable
+    @Override
+    public String getType(@NonNull Uri uri) {
+        return null;
+    }
+
+    @Nullable
+    @Override
+    public Uri insert(@NonNull Uri uri, @Nullable ContentValues values) {
+        return null;
+    }
+
+    @Override
+    public int delete(@NonNull Uri uri, @Nullable String selection, @Nullable String[] selectionArgs) {
+        return 0;
+    }
+
+    @Override
+    public int update(@NonNull Uri uri, @Nullable ContentValues values, @Nullable String selection,
+                      @Nullable String[] selectionArgs) {
+        return 0;
+    }
+}

package/android/src/main/java/uk/co/unisim/sdk/SuiteAuthStore.java

@@ -0,0 +1,179 @@
+package uk.co.unisim.sdk;
+
+import android.content.ContentProviderClient;
+import android.content.ContentResolver;
+import android.content.Context;
+import android.content.SharedPreferences;
+import android.content.pm.PackageInfo;
+import android.content.pm.PackageManager;
+import android.content.pm.ProviderInfo;
+import android.net.Uri;
+import android.os.Bundle;
+import android.util.Log;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * The suite's shared session store on Android.
+ *
+ * <p>iOS gets this for free: a Keychain access group is one box that every app
+ * signed by the same team opens. <b>Android has no such box.</b> The old answer,
+ * {@code android:sharedUserId}, was deprecated in API 29 and cannot be used by
+ * anything new. So the shared store here is not a place — it is an agreement
+ * between peers:
+ *
+ * <ul>
+ *   <li>every suite app hosts a {@link SuiteAuthProvider}, guarded by a
+ *       {@code signature}-level permission, so only apps signed with the same
+ *       key can reach it;</li>
+ *   <li>a <b>write</b> goes to this app's own prefs and is pushed out to every
+ *       installed peer;</li>
+ *   <li>a <b>read</b> answers from this app's own prefs, and only asks the peers
+ *       when it has nothing — which is what makes a freshly-installed app pick
+ *       up a session that was created before it existed;</li>
+ *   <li>a <b>delete</b> goes everywhere, because that is sign-out.</li>
+ * </ul>
+ *
+ * <p>⚠️ <b>The fan-out is the whole mechanism, and the delete leg is the half
+ * that is easy to forget.</b> Writing to peers but deleting only locally gives
+ * you a suite where signing IN travels and signing OUT does not — which is
+ * exactly the bug the web and iOS sides already had for a different reason (see
+ * the resume resync in {@code provider.tsx}). Both legs, or neither.
+ *
+ * <p>⚠️ <b>Peer visibility is not automatic on API 30+.</b> {@code
+ * getInstalledPackages} only returns packages this app is allowed to see, so the
+ * {@code <queries>} block in this module's manifest is load-bearing: without it
+ * the peer list comes back empty, every app keeps its own session, and nothing
+ * anywhere reports a problem. That manifest list is the ONE canonical list of
+ * suite apps — this class derives the peers from what it can actually see rather
+ * than carrying a second copy to drift out of step.
+ */
+final class SuiteAuthStore {
+
+    private static final String TAG = "UnisimSuiteAuth";
+
+    /** Prefs file, private to each app; only ever reached across apps via the provider. */
+    private static final String PREFS = "unisim_suite_auth";
+
+    /**
+     * Every suite provider's authority is its applicationId plus this. It is also
+     * how a peer is recognised — see {@link #peerAuthorities}.
+     */
+    static final String AUTHORITY_SUFFIX = ".unisimsuiteauth";
+
+    static final String METHOD_GET = "get";
+    static final String METHOD_SET = "set";
+    static final String METHOD_REMOVE = "remove";
+    static final String EXTRA_VALUE = "value";
+
+    private SuiteAuthStore() {}
+
+    // ── This app's own copy ──────────────────────────────────────────────────
+
+    private static SharedPreferences prefs(Context ctx) {
+        return ctx.getSharedPreferences(PREFS, Context.MODE_PRIVATE);
+    }
+
+    static String readLocal(Context ctx, String key) {
+        return prefs(ctx).getString(key, null);
+    }
+
+    static void writeLocal(Context ctx, String key, String value) {
+        prefs(ctx).edit().putString(key, value).apply();
+    }
+
+    static void deleteLocal(Context ctx, String key) {
+        prefs(ctx).edit().remove(key).apply();
+    }
+
+    // ── The peers ────────────────────────────────────────────────────────────
+
+    static String ownAuthority(Context ctx) {
+        return ctx.getPackageName() + AUTHORITY_SUFFIX;
+    }
+
+    /**
+     * Every OTHER installed suite app that hosts a provider we can talk to.
+     *
+     * <p>Derived from what the package manager will admit to, which the manifest
+     * {@code <queries>} block is what makes non-empty on API 30+.
+     */
+    static List<String> peerAuthorities(Context ctx) {
+        List<String> out = new ArrayList<>();
+        String mine = ownAuthority(ctx);
+        PackageManager pm = ctx.getPackageManager();
+        List<PackageInfo> installed;
+        try {
+            installed = pm.getInstalledPackages(PackageManager.GET_PROVIDERS);
+        } catch (Exception e) {
+            Log.w(TAG, "could not enumerate packages; session will be app-local", e);
+            return out;
+        }
+        for (PackageInfo info : installed) {
+            if (info.providers == null) continue;
+            for (ProviderInfo provider : info.providers) {
+                if (provider.authority == null) continue;
+                if (!provider.authority.endsWith(AUTHORITY_SUFFIX)) continue;
+                if (provider.authority.equals(mine)) continue;
+                out.add(provider.authority);
+            }
+        }
+        return out;
+    }
+
+    private static Bundle callPeer(Context ctx, String authority, String method, String key, Bundle extras) {
+        Uri uri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT).authority(authority).build();
+        ContentProviderClient client = null;
+        try {
+            client = ctx.getContentResolver().acquireUnstableContentProviderClient(uri);
+            if (client == null) return null;
+            return client.call(method, key, extras);
+        } catch (Exception e) {
+            // A peer that is mid-update, force-stopped, or signed with a different
+            // key is a normal thing to meet. It must degrade to "that one didn't
+            // answer", never take the caller down.
+            Log.w(TAG, "peer " + authority + " did not answer " + method, e);
+            return null;
+        } finally {
+            if (client != null) client.close();
+        }
+    }
+
+    // ── The three operations, as the suite sees them ─────────────────────────
+
+    static String read(Context ctx, String key) {
+        String local = readLocal(ctx, key);
+        if (local != null) return local;
+
+        // Nothing of our own: this app may have been installed after the user
+        // signed in elsewhere. Ask around, and keep the first real answer so the
+        // next read is local.
+        for (String authority : peerAuthorities(ctx)) {
+            Bundle result = callPeer(ctx, authority, METHOD_GET, key, null);
+            if (result == null) continue;
+            String value = result.getString(EXTRA_VALUE);
+            if (value != null) {
+                writeLocal(ctx, key, value);
+                return value;
+            }
+        }
+        return null;
+    }
+
+    static void write(Context ctx, String key, String value) {
+        writeLocal(ctx, key, value);
+        Bundle extras = new Bundle();
+        extras.putString(EXTRA_VALUE, value);
+        for (String authority : peerAuthorities(ctx)) {
+            callPeer(ctx, authority, METHOD_SET, key, extras);
+        }
+    }
+
+    static void delete(Context ctx, String key) {
+        deleteLocal(ctx, key);
+        for (String authority : peerAuthorities(ctx)) {
+            callPeer(ctx, authority, METHOD_REMOVE, key, null);
+        }
+    }
+}