react-native-ensys-camera-x 1.0.7

package/lib/module/db/migrations.js

@@ -0,0 +1,180 @@
+"use strict";
+
+/**
+ * Schema versioning & migrations for the encrypted media database.
+ *
+ * Versioning uses SQLite's built-in `PRAGMA user_version`. On every open,
+ * `runMigrations` reads the current version and applies — inside a single
+ * transaction — every migration whose target version is greater than it, in
+ * ascending order. Adding a new schema change is a matter of appending one more
+ * entry to `MIGRATIONS`; never edit or reorder existing entries.
+ */
+import { MEDIA_TABLE, MediaColumns } from "./types.js";
+
+/** A single forward migration step. */
+
+/**
+ * Ordered list of migrations. `LATEST_SCHEMA_VERSION` is derived from the last
+ * entry, so bumping the schema only requires appending a new `Migration`.
+ */
+export const MIGRATIONS = [{
+  version: 1,
+  description: 'Initial media table with type/source indexes',
+  statements: [`CREATE TABLE IF NOT EXISTS ${MEDIA_TABLE} (
+        ${MediaColumns.id}         TEXT PRIMARY KEY NOT NULL,
+        ${MediaColumns.mediaType}  TEXT NOT NULL CHECK (${MediaColumns.mediaType} IN ('image','video')),
+        ${MediaColumns.source}     TEXT NOT NULL CHECK (${MediaColumns.source} IN ('camera','gallery')),
+        ${MediaColumns.filePath}   TEXT NOT NULL,
+        ${MediaColumns.fileName}   TEXT NOT NULL,
+        ${MediaColumns.fileSize}   INTEGER,
+        ${MediaColumns.width}      INTEGER,
+        ${MediaColumns.height}     INTEGER,
+        ${MediaColumns.duration}   INTEGER,
+        ${MediaColumns.mimeType}   TEXT,
+        ${MediaColumns.createdAt}  INTEGER NOT NULL,
+        ${MediaColumns.updatedAt}  INTEGER NOT NULL
+      );`, `CREATE INDEX IF NOT EXISTS idx_media_type
+        ON ${MEDIA_TABLE} (${MediaColumns.mediaType});`, `CREATE INDEX IF NOT EXISTS idx_media_created_at
+        ON ${MEDIA_TABLE} (${MediaColumns.createdAt} DESC);`,
+  // Non-unique: speeds up delete-by-path without rejecting a re-selected
+  // file that arrives under a new id (dedup is keyed on the primary id).
+  `CREATE INDEX IF NOT EXISTS idx_media_file_path
+        ON ${MEDIA_TABLE} (${MediaColumns.filePath});`]
+}, {
+  version: 2,
+  description: 'Composite (media_type, created_at DESC) index for the filtered+ordered list query',
+  statements: [
+  // The Photos/Videos filters run `WHERE media_type = ? ORDER BY created_at DESC`
+  // (see MediaRepository.getAll). The single-column idx_media_type filters but then
+  // forces a sort of the matching rows on every query; the single-column
+  // idx_media_created_at orders but can't also filter. A composite index lets SQLite
+  // satisfy BOTH the equality filter and the ordering from one index — no separate
+  // sort step — which keeps the filtered list fast as the library grows into the
+  // thousands. Purely additive (CREATE INDEX IF NOT EXISTS): no data change, and the
+  // unfiltered "All" query keeps using idx_media_created_at.
+  `CREATE INDEX IF NOT EXISTS idx_media_type_created_at
+        ON ${MEDIA_TABLE} (${MediaColumns.mediaType}, ${MediaColumns.createdAt} DESC);`]
+}, {
+  version: 3,
+  description: 'Widen media_type to include document + audio, and reclassify legacy rows by MIME/extension',
+  // SQLite cannot ALTER a CHECK constraint in place, so the table is rebuilt.
+  // The copy step reclassifies rows the old two-kind schema was forced to store
+  // as `image`: a picked PDF/track kept its real MIME (e.g. application/pdf,
+  // audio/mpeg) even though media_type was clamped to 'image', so we recover the
+  // correct kind here from mime_type (then the file extension as a fallback).
+  statements: [
+  // 1. Park the current table out of the way (its indexes move with it).
+  `ALTER TABLE ${MEDIA_TABLE} RENAME TO ${MEDIA_TABLE}_legacy_v2;`,
+  // 2. Recreate the table with the widened media_type CHECK constraint.
+  `CREATE TABLE ${MEDIA_TABLE} (
+        ${MediaColumns.id}         TEXT PRIMARY KEY NOT NULL,
+        ${MediaColumns.mediaType}  TEXT NOT NULL CHECK (${MediaColumns.mediaType} IN ('image','video','document','audio')),
+        ${MediaColumns.source}     TEXT NOT NULL CHECK (${MediaColumns.source} IN ('camera','gallery')),
+        ${MediaColumns.filePath}   TEXT NOT NULL,
+        ${MediaColumns.fileName}   TEXT NOT NULL,
+        ${MediaColumns.fileSize}   INTEGER,
+        ${MediaColumns.width}      INTEGER,
+        ${MediaColumns.height}     INTEGER,
+        ${MediaColumns.duration}   INTEGER,
+        ${MediaColumns.mimeType}   TEXT,
+        ${MediaColumns.createdAt}  INTEGER NOT NULL,
+        ${MediaColumns.updatedAt}  INTEGER NOT NULL
+      );`,
+  // 3. Copy rows over, reclassifying media_type from mime_type / file extension.
+  `INSERT INTO ${MEDIA_TABLE} (
+        ${MediaColumns.id}, ${MediaColumns.mediaType}, ${MediaColumns.source},
+        ${MediaColumns.filePath}, ${MediaColumns.fileName}, ${MediaColumns.fileSize},
+        ${MediaColumns.width}, ${MediaColumns.height}, ${MediaColumns.duration},
+        ${MediaColumns.mimeType}, ${MediaColumns.createdAt}, ${MediaColumns.updatedAt}
+      )
+      SELECT
+        ${MediaColumns.id},
+        CASE
+          WHEN ${MediaColumns.mediaType} = 'video' THEN 'video'
+          WHEN ${MediaColumns.mimeType} LIKE 'video/%' THEN 'video'
+          WHEN ${MediaColumns.mimeType} LIKE 'audio/%' THEN 'audio'
+          WHEN ${MediaColumns.mimeType} LIKE 'image/%' THEN 'image'
+          WHEN ${MediaColumns.mimeType} = 'application/pdf'
+            OR ${MediaColumns.mimeType} LIKE 'application/vnd.%'
+            OR ${MediaColumns.mimeType} LIKE 'application/msword%'
+            OR ${MediaColumns.mimeType} LIKE 'application/rtf%'
+            OR ${MediaColumns.mimeType} = 'application/epub+zip'
+            OR ${MediaColumns.mimeType} LIKE 'text/%' THEN 'document'
+          WHEN lower(${MediaColumns.fileName}) LIKE '%.mp4'
+            OR lower(${MediaColumns.fileName}) LIKE '%.mov'
+            OR lower(${MediaColumns.fileName}) LIKE '%.mkv'
+            OR lower(${MediaColumns.fileName}) LIKE '%.webm'
+            OR lower(${MediaColumns.fileName}) LIKE '%.3gp'
+            OR lower(${MediaColumns.fileName}) LIKE '%.m4v' THEN 'video'
+          WHEN lower(${MediaColumns.fileName}) LIKE '%.mp3'
+            OR lower(${MediaColumns.fileName}) LIKE '%.wav'
+            OR lower(${MediaColumns.fileName}) LIKE '%.aac'
+            OR lower(${MediaColumns.fileName}) LIKE '%.m4a'
+            OR lower(${MediaColumns.fileName}) LIKE '%.ogg'
+            OR lower(${MediaColumns.fileName}) LIKE '%.flac'
+            OR lower(${MediaColumns.fileName}) LIKE '%.opus'
+            OR lower(${MediaColumns.fileName}) LIKE '%.amr' THEN 'audio'
+          WHEN lower(${MediaColumns.fileName}) LIKE '%.pdf'
+            OR lower(${MediaColumns.fileName}) LIKE '%.doc'
+            OR lower(${MediaColumns.fileName}) LIKE '%.docx'
+            OR lower(${MediaColumns.fileName}) LIKE '%.xls'
+            OR lower(${MediaColumns.fileName}) LIKE '%.xlsx'
+            OR lower(${MediaColumns.fileName}) LIKE '%.ppt'
+            OR lower(${MediaColumns.fileName}) LIKE '%.pptx'
+            OR lower(${MediaColumns.fileName}) LIKE '%.txt'
+            OR lower(${MediaColumns.fileName}) LIKE '%.csv'
+            OR lower(${MediaColumns.fileName}) LIKE '%.rtf'
+            OR lower(${MediaColumns.fileName}) LIKE '%.odt'
+            OR lower(${MediaColumns.fileName}) LIKE '%.ods'
+            OR lower(${MediaColumns.fileName}) LIKE '%.odp'
+            OR lower(${MediaColumns.fileName}) LIKE '%.epub' THEN 'document'
+          ELSE 'image'
+        END,
+        ${MediaColumns.source}, ${MediaColumns.filePath}, ${MediaColumns.fileName},
+        ${MediaColumns.fileSize}, ${MediaColumns.width}, ${MediaColumns.height},
+        ${MediaColumns.duration}, ${MediaColumns.mimeType}, ${MediaColumns.createdAt},
+        ${MediaColumns.updatedAt}
+      FROM ${MEDIA_TABLE}_legacy_v2;`,
+  // 4. Drop the legacy table (this also drops its now-orphaned indexes,
+  //    freeing the index names for recreation below).
+  `DROP TABLE ${MEDIA_TABLE}_legacy_v2;`,
+  // 5. Recreate every index on the rebuilt table.
+  `CREATE INDEX IF NOT EXISTS idx_media_type
+        ON ${MEDIA_TABLE} (${MediaColumns.mediaType});`, `CREATE INDEX IF NOT EXISTS idx_media_created_at
+        ON ${MEDIA_TABLE} (${MediaColumns.createdAt} DESC);`, `CREATE INDEX IF NOT EXISTS idx_media_file_path
+        ON ${MEDIA_TABLE} (${MediaColumns.filePath});`, `CREATE INDEX IF NOT EXISTS idx_media_type_created_at
+        ON ${MEDIA_TABLE} (${MediaColumns.mediaType}, ${MediaColumns.createdAt} DESC);`]
+}, {
+  version: 4,
+  description: 'Add size_is_display_estimate flag: true when file_size is a compressed video’s proportional display figure, not the exact bytes on disk',
+  // Purely additive. Existing rows get NULL (read back as false), so nothing
+  // that was stored before this column re-stats differently. Only compressed
+  // videos published from the editor set it to 1 (see CameraAsset.sizeIsDisplayEstimate).
+  statements: [`ALTER TABLE ${MEDIA_TABLE} ADD COLUMN ${MediaColumns.sizeIsDisplayEstimate} INTEGER;`]
+}];
+
+/** The schema version the app expects after all migrations are applied. */
+export const LATEST_SCHEMA_VERSION = MIGRATIONS.length > 0 ? MIGRATIONS[MIGRATIONS.length - 1].version : 0;
+
+/** Minimal executor contract so migrations don't depend on the concrete manager. */
+
+/**
+ * Applies all pending migrations. Safe to call on every launch — a fully
+ * up-to-date database performs only a cheap version read and returns.
+ *
+ * @returns the schema version after migration.
+ */
+export async function runMigrations(executor) {
+  const currentVersion = await executor.getVersion();
+  if (currentVersion >= LATEST_SCHEMA_VERSION) {
+    return currentVersion;
+  }
+  const pending = MIGRATIONS.filter(m => m.version > currentVersion).sort((a, b) => a.version - b.version);
+  for (const migration of pending) {
+    // Each migration is atomic: the DDL statements and the version bump land in
+    // one transaction, or the whole step rolls back and the next launch retries.
+    await executor.runBatch([...migration.statements, `PRAGMA user_version = ${Math.floor(migration.version)};`]);
+  }
+  return LATEST_SCHEMA_VERSION;
+}
+//# sourceMappingURL=migrations.js.map

package/lib/module/db/migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["MEDIA_TABLE","MediaColumns","MIGRATIONS","version","description","statements","id","mediaType","source","filePath","fileName","fileSize","width","height","duration","mimeType","createdAt","updatedAt","sizeIsDisplayEstimate","LATEST_SCHEMA_VERSION","length","runMigrations","executor","currentVersion","getVersion","pending","filter","m","sort","a","b","migration","runBatch","Math","floor"],"sourceRoot":"..\\..\\..\\src","sources":["db/migrations.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,WAAW,EAAEC,YAAY,QAAQ,YAAS;;AAEnD;;AAUA;AACA;AACA;AACA;AACA,OAAO,MAAMC,UAAuB,GAAG,CACrC;EACEC,OAAO,EAAE,CAAC;EACVC,WAAW,EAAE,8CAA8C;EAC3DC,UAAU,EAAE,CACV,8BAA8BL,WAAW;AAC/C,UAAUC,YAAY,CAACK,EAAE;AACzB,UAAUL,YAAY,CAACM,SAAS,0BAA0BN,YAAY,CAACM,SAAS;AAChF,UAAUN,YAAY,CAACO,MAAM,6BAA6BP,YAAY,CAACO,MAAM;AAC7E,UAAUP,YAAY,CAACQ,QAAQ;AAC/B,UAAUR,YAAY,CAACS,QAAQ;AAC/B,UAAUT,YAAY,CAACU,QAAQ;AAC/B,UAAUV,YAAY,CAACW,KAAK;AAC5B,UAAUX,YAAY,CAACY,MAAM;AAC7B,UAAUZ,YAAY,CAACa,QAAQ;AAC/B,UAAUb,YAAY,CAACc,QAAQ;AAC/B,UAAUd,YAAY,CAACe,SAAS;AAChC,UAAUf,YAAY,CAACgB,SAAS;AAChC,SAAS,EACH;AACN,aAAajB,WAAW,KAAKC,YAAY,CAACM,SAAS,IAAI,EACjD;AACN,aAAaP,WAAW,KAAKC,YAAY,CAACe,SAAS,SAAS;EACtD;EACA;EACA;AACN,aAAahB,WAAW,KAAKC,YAAY,CAACQ,QAAQ,IAAI;AAEpD,CAAC,EACD;EACEN,OAAO,EAAE,CAAC;EACVC,WAAW,EACT,mFAAmF;EACrFC,UAAU,EAAE;EACV;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;AACN,aAAaL,WAAW,KAAKC,YAAY,CAACM,SAAS,KAAKN,YAAY,CAACe,SAAS,SAAS;AAErF,CAAC,EACD;EACEb,OAAO,EAAE,CAAC;EACVC,WAAW,EACT,4FAA4F;EAC9F;EACA;EACA;EACA;EACA;EACAC,UAAU,EAAE;EACV;EACA,eAAeL,WAAW,cAAcA,WAAW,aAAa;EAChE;EACA,gBAAgBA,WAAW;AACjC,UAAUC,YAAY,CAACK,EAAE;AACzB,UAAUL,YAAY,CAACM,SAAS,0BAA0BN,YAAY,CAACM,SAAS;AAChF,UAAUN,YAAY,CAACO,MAAM,6BAA6BP,YAAY,CAACO,MAAM;AAC7E,UAAUP,YAAY,CAACQ,QAAQ;AAC/B,UAAUR,YAAY,CAACS,QAAQ;AAC/B,UAAUT,YAAY,CAACU,QAAQ;AAC/B,UAAUV,YAAY,CAACW,KAAK;AAC5B,UAAUX,YAAY,CAACY,MAAM;AAC7B,UAAUZ,YAAY,CAACa,QAAQ;AAC/B,UAAUb,YAAY,CAACc,QAAQ;AAC/B,UAAUd,YAAY,CAACe,SAAS;AAChC,UAAUf,YAAY,CAACgB,SAAS;AAChC,SAAS;EACH;EACA,eAAejB,WAAW;AAChC,UAAUC,YAAY,CAACK,EAAE,KAAKL,YAAY,CAACM,SAAS,KAAKN,YAAY,CAACO,MAAM;AAC5E,UAAUP,YAAY,CAACQ,QAAQ,KAAKR,YAAY,CAACS,QAAQ,KAAKT,YAAY,CAACU,QAAQ;AACnF,UAAUV,YAAY,CAACW,KAAK,KAAKX,YAAY,CAACY,MAAM,KAAKZ,YAAY,CAACa,QAAQ;AAC9E,UAAUb,YAAY,CAACc,QAAQ,KAAKd,YAAY,CAACe,SAAS,KAAKf,YAAY,CAACgB,SAAS;AACrF;AACA;AACA,UAAUhB,YAAY,CAACK,EAAE;AACzB;AACA,iBAAiBL,YAAY,CAACM,SAAS;AACvC,iBAAiBN,YAAY,CAACc,QAAQ;AACtC,iBAAiBd,YAAY,CAACc,QAAQ;AACtC,iBAAiBd,YAAY,CAACc,QAAQ;AACtC,iBAAiBd,YAAY,CAACc,QAAQ;AACtC,iBAAiBd,YAAY,CAACc,QAAQ;AACtC,iBAAiBd,YAAY,CAACc,QAAQ;AACtC,iBAAiBd,YAAY,CAACc,QAAQ;AACtC,iBAAiBd,YAAY,CAACc,QAAQ;AACtC,iBAAiBd,YAAY,CAACc,QAAQ;AACtC,uBAAuBd,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C,uBAAuBT,YAAY,CAACS,QAAQ;AAC5C;AACA;AACA,UAAUT,YAAY,CAACO,MAAM,KAAKP,YAAY,CAACQ,QAAQ,KAAKR,YAAY,CAACS,QAAQ;AACjF,UAAUT,YAAY,CAACU,QAAQ,KAAKV,YAAY,CAACW,KAAK,KAAKX,YAAY,CAACY,MAAM;AAC9E,UAAUZ,YAAY,CAACa,QAAQ,KAAKb,YAAY,CAACc,QAAQ,KAAKd,YAAY,CAACe,SAAS;AACpF,UAAUf,YAAY,CAACgB,SAAS;AAChC,aAAajB,WAAW,aAAa;EAC/B;EACA;EACA,cAAcA,WAAW,aAAa;EACtC;EACA;AACN,aAAaA,WAAW,KAAKC,YAAY,CAACM,SAAS,IAAI,EACjD;AACN,aAAaP,WAAW,KAAKC,YAAY,CAACe,SAAS,SAAS,EACtD;AACN,aAAahB,WAAW,KAAKC,YAAY,CAACQ,QAAQ,IAAI,EAChD;AACN,aAAaT,WAAW,KAAKC,YAAY,CAACM,SAAS,KAAKN,YAAY,CAACe,SAAS,SAAS;AAErF,CAAC,EACD;EACEb,OAAO,EAAE,CAAC;EACVC,WAAW,EACT,yIAAyI;EAC3I;EACA;EACA;EACAC,UAAU,EAAE,CACV,eAAeL,WAAW,eAAeC,YAAY,CAACiB,qBAAqB,WAAW;AAE1F,CAAC,CACF;;AAED;AACA,OAAO,MAAMC,qBAAqB,GAChCjB,UAAU,CAACkB,MAAM,GAAG,CAAC,GAAGlB,UAAU,CAACA,UAAU,CAACkB,MAAM,GAAG,CAAC,CAAC,CAAEjB,OAAO,GAAG,CAAC;;AAExE;;AAQA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAekB,aAAaA,CACjCC,QAA2B,EACV;EACjB,MAAMC,cAAc,GAAG,MAAMD,QAAQ,CAACE,UAAU,CAAC,CAAC;EAElD,IAAID,cAAc,IAAIJ,qBAAqB,EAAE;IAC3C,OAAOI,cAAc;EACvB;EAEA,MAAME,OAAO,GAAGvB,UAAU,CAACwB,MAAM,CAAEC,CAAC,IAAKA,CAAC,CAACxB,OAAO,GAAGoB,cAAc,CAAC,CAACK,IAAI,CACvE,CAACC,CAAC,EAAEC,CAAC,KAAKD,CAAC,CAAC1B,OAAO,GAAG2B,CAAC,CAAC3B,OAC1B,CAAC;EAED,KAAK,MAAM4B,SAAS,IAAIN,OAAO,EAAE;IAC/B;IACA;IACA,MAAMH,QAAQ,CAACU,QAAQ,CAAC,CACtB,GAAGD,SAAS,CAAC1B,UAAU,EACvB,yBAAyB4B,IAAI,CAACC,KAAK,CAACH,SAAS,CAAC5B,OAAO,CAAC,GAAG,CAC1D,CAAC;EACJ;EAEA,OAAOgB,qBAAqB;AAC9B","ignoreList":[]}

package/lib/module/db/react-native-sqlcipher.d.js

@@ -0,0 +1,2 @@
+"use strict";
+//# sourceMappingURL=react-native-sqlcipher.d.js.map

package/lib/module/db/react-native-sqlcipher.d.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sourceRoot":"..\\..\\..\\src","sources":["db/react-native-sqlcipher.d.ts"],"mappings":"","ignoreList":[]}

package/lib/module/db/secureKey.js

@@ -0,0 +1,87 @@
+"use strict";
+
+/**
+ * Encryption-key provisioning for the SQLCipher database.
+ *
+ * Strategy (most secure first):
+ *   1. Native `SecureKeyModule` (Android) — generates a cryptographically random
+ *      256-bit key on first launch and persists it in `EncryptedSharedPreferences`,
+ *      which is sealed by a master key held in the Android Keystore. The raw key
+ *      material therefore never lives in the JS bundle or in plaintext on disk.
+ *   2. Fallback — a locally derived key used only when the native module is
+ *      unavailable (web, iOS without the native helper, or an older build). This
+ *      keeps the app functional but is NOT hardware-backed; see the warning below.
+ *
+ * The resolved key is cached in-memory for the process lifetime so the native
+ * bridge is hit at most once.
+ */
+import { NativeModules, Platform } from 'react-native';
+
+/** Shape of the optional native key module. */
+
+const nativeKeyModule = NativeModules.SecureKeyModule;
+let cachedKey = null;
+
+/**
+ * Deterministic fallback key. Used ONLY when no native Keystore-backed module is
+ * present. It is intentionally derived (not a bare literal) but, because it is
+ * reconstructable from the bundle, it does not provide hardware-backed secrecy.
+ * On Android the native module supersedes this path.
+ */
+function deriveFallbackKey() {
+  // A stable, app-scoped seed combined into a 64-hex-char (256-bit) string.
+  const seed = `rncc.media.${Platform.OS}.v1.9f3ac21e-secure-media-store`;
+  let h1 = 0x811c9dc5;
+  let h2 = 0xc2b2ae35;
+  for (let i = 0; i < seed.length; i++) {
+    const c = seed.charCodeAt(i);
+    h1 = Math.imul(h1 ^ c, 0x01000193) >>> 0;
+    h2 = Math.imul(h2 ^ c, 0x85ebca77) >>> 0;
+  }
+  // Expand the two 32-bit hashes into 64 hex chars deterministically.
+  let out = '';
+  let a = h1 >>> 0;
+  let b = h2 >>> 0;
+  for (let i = 0; i < 8; i++) {
+    a = Math.imul(a, 0x9e3779b1) + 0x7f4a7c15 >>> 0;
+    b = Math.imul(b, 0x85ebca6b) + 0xc2b2ae35 >>> 0;
+    out += a.toString(16).padStart(8, '0');
+    out += b.toString(16).padStart(8, '0');
+  }
+  return out.slice(0, 64);
+}
+
+/**
+ * Resolve the SQLCipher passphrase, preferring the hardware-backed native key.
+ * The result is memoized for the lifetime of the JS runtime.
+ */
+export async function getDatabaseKey() {
+  if (cachedKey) return cachedKey;
+  if (nativeKeyModule?.getOrCreateDatabaseKey) {
+    try {
+      const key = await nativeKeyModule.getOrCreateDatabaseKey();
+      if (key && key.length >= 16) {
+        cachedKey = key;
+        return cachedKey;
+      }
+      console.warn('[SecureKey] Native module returned an unusable key; using fallback.');
+    } catch (error) {
+      console.warn('[SecureKey] Native key retrieval failed; using fallback.', error);
+    }
+  } else if (Platform.OS === 'android') {
+    console.warn('[SecureKey] SecureKeyModule not linked. Rebuild the Android app to enable ' + 'Keystore-backed encryption; using derived fallback key for now.');
+  }
+  cachedKey = deriveFallbackKey();
+  return cachedKey;
+}
+
+/** True when the hardware-backed native key module is available. */
+export function isHardwareBackedKeyAvailable() {
+  return Boolean(nativeKeyModule?.getOrCreateDatabaseKey);
+}
+
+/** Test/hot-reload helper: clears the in-memory key cache. */
+export function __resetDatabaseKeyCache() {
+  cachedKey = null;
+}
+//# sourceMappingURL=secureKey.js.map

package/lib/module/db/secureKey.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["NativeModules","Platform","nativeKeyModule","SecureKeyModule","cachedKey","deriveFallbackKey","seed","OS","h1","h2","i","length","c","charCodeAt","Math","imul","out","a","b","toString","padStart","slice","getDatabaseKey","getOrCreateDatabaseKey","key","console","warn","error","isHardwareBackedKeyAvailable","Boolean","__resetDatabaseKeyCache"],"sourceRoot":"..\\..\\..\\src","sources":["db/secureKey.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,aAAa,EAAEC,QAAQ,QAAQ,cAAc;;AAEtD;;AAKA,MAAMC,eAAkD,GACtDF,aAAa,CACbG,eAAe;AAEjB,IAAIC,SAAwB,GAAG,IAAI;;AAEnC;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,iBAAiBA,CAAA,EAAW;EACnC;EACA,MAAMC,IAAI,GAAG,cAAcL,QAAQ,CAACM,EAAE,iCAAiC;EACvE,IAAIC,EAAE,GAAG,UAAU;EACnB,IAAIC,EAAE,GAAG,UAAU;EACnB,KAAK,IAAIC,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGJ,IAAI,CAACK,MAAM,EAAED,CAAC,EAAE,EAAE;IACpC,MAAME,CAAC,GAAGN,IAAI,CAACO,UAAU,CAACH,CAAC,CAAC;IAC5BF,EAAE,GAAGM,IAAI,CAACC,IAAI,CAACP,EAAE,GAAGI,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC;IACxCH,EAAE,GAAGK,IAAI,CAACC,IAAI,CAACN,EAAE,GAAGG,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC;EAC1C;EACA;EACA,IAAII,GAAG,GAAG,EAAE;EACZ,IAAIC,CAAC,GAAGT,EAAE,KAAK,CAAC;EAChB,IAAIU,CAAC,GAAGT,EAAE,KAAK,CAAC;EAChB,KAAK,IAAIC,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAG,CAAC,EAAEA,CAAC,EAAE,EAAE;IAC1BO,CAAC,GAAIH,IAAI,CAACC,IAAI,CAACE,CAAC,EAAE,UAAU,CAAC,GAAG,UAAU,KAAM,CAAC;IACjDC,CAAC,GAAIJ,IAAI,CAACC,IAAI,CAACG,CAAC,EAAE,UAAU,CAAC,GAAG,UAAU,KAAM,CAAC;IACjDF,GAAG,IAAIC,CAAC,CAACE,QAAQ,CAAC,EAAE,CAAC,CAACC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC;IACtCJ,GAAG,IAAIE,CAAC,CAACC,QAAQ,CAAC,EAAE,CAAC,CAACC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC;EACxC;EACA,OAAOJ,GAAG,CAACK,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AACzB;;AAEA;AACA;AACA;AACA;AACA,OAAO,eAAeC,cAAcA,CAAA,EAAoB;EACtD,IAAIlB,SAAS,EAAE,OAAOA,SAAS;EAE/B,IAAIF,eAAe,EAAEqB,sBAAsB,EAAE;IAC3C,IAAI;MACF,MAAMC,GAAG,GAAG,MAAMtB,eAAe,CAACqB,sBAAsB,CAAC,CAAC;MAC1D,IAAIC,GAAG,IAAIA,GAAG,CAACb,MAAM,IAAI,EAAE,EAAE;QAC3BP,SAAS,GAAGoB,GAAG;QACf,OAAOpB,SAAS;MAClB;MACAqB,OAAO,CAACC,IAAI,CACV,qEACF,CAAC;IACH,CAAC,CAAC,OAAOC,KAAK,EAAE;MACdF,OAAO,CAACC,IAAI,CACV,0DAA0D,EAC1DC,KACF,CAAC;IACH;EACF,CAAC,MAAM,IAAI1B,QAAQ,CAACM,EAAE,KAAK,SAAS,EAAE;IACpCkB,OAAO,CAACC,IAAI,CACV,4EAA4E,GAC1E,iEACJ,CAAC;EACH;EAEAtB,SAAS,GAAGC,iBAAiB,CAAC,CAAC;EAC/B,OAAOD,SAAS;AAClB;;AAEA;AACA,OAAO,SAASwB,4BAA4BA,CAAA,EAAY;EACtD,OAAOC,OAAO,CAAC3B,eAAe,EAAEqB,sBAAsB,CAAC;AACzD;;AAEA;AACA,OAAO,SAASO,uBAAuBA,CAAA,EAAS;EAC9C1B,SAAS,GAAG,IAAI;AAClB","ignoreList":[]}

package/lib/module/db/types.js

@@ -0,0 +1,57 @@
+"use strict";
+
+/**
+ * Strongly-typed media models for the encrypted SQLCipher database.
+ *
+ * These types describe the *persistence* shape of a media item — the exact
+ * columns stored in the `media` table — independently of the UI-facing
+ * `CameraAsset` type. Mapping between the two lives in `MediaMapper.ts`, keeping
+ * a clean separation between the database schema and the rest of the app.
+ */
+
+/**
+ * Persisted media kind. Photos are normalized to `image`; documents and audio
+ * are first-class kinds so a picked PDF/track is never mis-stored as an image.
+ */
+
+/** Where a media item originated. */
+
+/**
+ * A single row of the `media` table — the canonical, strongly-typed record.
+ *
+ * `null` is used (never `undefined`) for absent optional columns so the shape
+ * maps 1:1 onto SQL rows.
+ */
+
+/**
+ * Fields required to insert a new media record. Timestamps are optional on
+ * input — the repository fills `createdAt`/`updatedAt` when omitted.
+ */
+
+/** Filter used when querying the media list. */
+
+/**
+ * Aggregate counts computed directly from the database via `COUNT(*)`.
+ * Backs the filter-card counters (All / Photos / Videos / Documents / Audio).
+ */
+
+/** Options for ordered/paged queries against the media table. */
+
+/** Table + column name constants — single source of truth for SQL strings. */
+export const MEDIA_TABLE = 'media';
+export const MediaColumns = {
+  id: 'id',
+  mediaType: 'media_type',
+  source: 'source',
+  filePath: 'file_path',
+  fileName: 'file_name',
+  fileSize: 'file_size',
+  width: 'width',
+  height: 'height',
+  duration: 'duration',
+  mimeType: 'mime_type',
+  createdAt: 'created_at',
+  updatedAt: 'updated_at',
+  sizeIsDisplayEstimate: 'size_is_display_estimate'
+};
+//# sourceMappingURL=types.js.map

package/lib/module/db/types.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["MEDIA_TABLE","MediaColumns","id","mediaType","source","filePath","fileName","fileSize","width","height","duration","mimeType","createdAt","updatedAt","sizeIsDisplayEstimate"],"sourceRoot":"..\\..\\..\\src","sources":["db/types.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;;AAGA;;AAGA;AACA;AACA;AACA;AACA;AACA;;AAmCA;AACA;AACA;AACA;;AAkBA;;AAGA;AACA;AACA;AACA;;AASA;;AAWA;AACA,OAAO,MAAMA,WAAW,GAAG,OAAO;AAElC,OAAO,MAAMC,YAAY,GAAG;EAC1BC,EAAE,EAAE,IAAI;EACRC,SAAS,EAAE,YAAY;EACvBC,MAAM,EAAE,QAAQ;EAChBC,QAAQ,EAAE,WAAW;EACrBC,QAAQ,EAAE,WAAW;EACrBC,QAAQ,EAAE,WAAW;EACrBC,KAAK,EAAE,OAAO;EACdC,MAAM,EAAE,QAAQ;EAChBC,QAAQ,EAAE,UAAU;EACpBC,QAAQ,EAAE,WAAW;EACrBC,SAAS,EAAE,YAAY;EACvBC,SAAS,EAAE,YAAY;EACvBC,qBAAqB,EAAE;AACzB,CAAU","ignoreList":[]}

package/lib/module/db/useMediaDatabase.js

@@ -0,0 +1,123 @@
+"use strict";
+
+/**
+ * useMediaDatabase — the clean bridge between the Media Library UI and the
+ * encrypted SQLCipher store.
+ *
+ * The screen renders `CameraAsset`s and never touches SQL: it consumes this
+ * hook's state (`assets`, `counts`, `loading`) and calls its actions
+ * (`addAssets`, `removeById`, `refresh`). Every mutation writes to SQLCipher
+ * first, then refreshes derived state from the database so the list and the
+ * filter-card counters always stay in sync with persistence.
+ */
+import { useCallback, useEffect, useRef, useState } from 'react';
+// Imported from the TurboModule directly, NOT from '../index': index re-exports this
+// hook, so going through it would close an import cycle.
+import CustomCamera from '../NativeCustomCamera';
+import { initializeMediaDatabase } from "./DatabaseManager.js";
+import { getMediaRepository } from "./MediaRepository.js";
+import { recordToAsset } from "./MediaMapper.js";
+const EMPTY_COUNTS = {
+  all: 0,
+  image: 0,
+  video: 0,
+  document: 0,
+  audio: 0
+};
+/**
+ * @param autoInit when true (default) the hook opens the DB and loads on mount.
+ */
+export function useMediaDatabase(autoInit = true) {
+  const [assets, setAssets] = useState([]);
+  const [counts, setCounts] = useState(EMPTY_COUNTS);
+  const [loading, setLoading] = useState(autoInit);
+  const [error, setError] = useState(null);
+  const mountedRef = useRef(true);
+  const repo = getMediaRepository();
+
+  /** Reloads the full list and counts from SQLCipher. */
+  const refresh = useCallback(async () => {
+    const [records, freshCounts] = await Promise.all([repo.getAll(), repo.getCounts()]);
+    if (!mountedRef.current) return;
+    setAssets(records.map(recordToAsset));
+    setCounts(freshCounts);
+  }, [repo]);
+  useEffect(() => {
+    mountedRef.current = true;
+    if (!autoInit) return;
+    (async () => {
+      try {
+        await initializeMediaDatabase();
+        await refresh();
+      } catch (err) {
+        if (mountedRef.current) {
+          setError(err instanceof Error ? err : new Error(String(err)));
+        }
+        // Keep the app usable even if the encrypted DB can't open (e.g. web).
+        console.warn('[useMediaDatabase] initialization failed:', err);
+      } finally {
+        if (mountedRef.current) setLoading(false);
+      }
+    })();
+    return () => {
+      mountedRef.current = false;
+    };
+  }, [autoInit, refresh]);
+  const addAssets = useCallback(async (incoming, source) => {
+    if (!incoming || incoming.length === 0) return [];
+    // The repository persists ONLY assets confirmed in the Documents directory
+    // and auto-detects the origin when `source` is omitted. It returns just the
+    // records actually written (cache-only/publish-failed assets are skipped).
+    const records = await repo.insertAssets(incoming, source);
+    // Re-read from the DB so the list + counters reflect exactly what was
+    // persisted — the single source of truth.
+    await refresh();
+    return records.map(recordToAsset);
+  }, [repo, refresh]);
+  const removeById = useCallback(async id => {
+    await repo.deleteById(id);
+    await refresh();
+  }, [repo, refresh]);
+  const removeMany = useCallback(async ids => {
+    await repo.deleteMany(ids);
+    await refresh();
+  }, [repo, refresh]);
+  const secureRemoveById = useCallback(async id => {
+    const record = await repo.getById(id);
+    if (!record) return null;
+
+    // The FILE goes first. Deleting the row first would strand the media on disk
+    // with nothing left pointing at it — unreachable from the UI, but fully
+    // intact and recoverable, which is the opposite of what a delete promises.
+    let report = null;
+    try {
+      report = await CustomCamera.secureDeleteMedia(record.filePath, {
+        assetId: record.id,
+        fileName: record.fileName
+      });
+    } catch (err) {
+      // Swallowed deliberately: the row is still removed below so the item does
+      // not linger in the library, and the null report tells the caller the
+      // secure-erase guarantee was NOT met.
+      console.warn('[useMediaDatabase] secure erase failed for', id, err);
+    }
+    if (report && !report.fullySecure) {
+      console.warn('[useMediaDatabase] media removed without a verified secure erase:', JSON.stringify(report));
+    }
+    await repo.deleteById(id);
+    await refresh();
+    return report;
+  }, [repo, refresh]);
+  return {
+    assets,
+    counts,
+    loading,
+    error,
+    addAssets,
+    removeById,
+    removeMany,
+    secureRemoveById,
+    refresh
+  };
+}
+//# sourceMappingURL=useMediaDatabase.js.map

package/lib/module/db/useMediaDatabase.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["useCallback","useEffect","useRef","useState","CustomCamera","initializeMediaDatabase","getMediaRepository","recordToAsset","EMPTY_COUNTS","all","image","video","document","audio","useMediaDatabase","autoInit","assets","setAssets","counts","setCounts","loading","setLoading","error","setError","mountedRef","repo","refresh","records","freshCounts","Promise","getAll","getCounts","current","map","err","Error","String","console","warn","addAssets","incoming","source","length","insertAssets","removeById","id","deleteById","removeMany","ids","deleteMany","secureRemoveById","record","getById","report","secureDeleteMedia","filePath","assetId","fileName","fullySecure","JSON","stringify"],"sourceRoot":"..\\..\\..\\src","sources":["db/useMediaDatabase.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,WAAW,EAAEC,SAAS,EAAEC,MAAM,EAAEC,QAAQ,QAAQ,OAAO;AAEhE;AACA;AACA,OAAOC,YAAY,MAAM,uBAAuB;AAChD,SAASC,uBAAuB,QAAQ,sBAAmB;AAC3D,SAASC,kBAAkB,QAAQ,sBAAmB;AACtD,SAASC,aAAa,QAAQ,kBAAe;AAG7C,MAAMC,YAAyB,GAAG;EAChCC,GAAG,EAAE,CAAC;EACNC,KAAK,EAAE,CAAC;EACRC,KAAK,EAAE,CAAC;EACRC,QAAQ,EAAE,CAAC;EACXC,KAAK,EAAE;AACT,CAAC;AAwCD;AACA;AACA;AACA,OAAO,SAASC,gBAAgBA,CAACC,QAAQ,GAAG,IAAI,EAA0B;EACxE,MAAM,CAACC,MAAM,EAAEC,SAAS,CAAC,GAAGd,QAAQ,CAAgB,EAAE,CAAC;EACvD,MAAM,CAACe,MAAM,EAAEC,SAAS,CAAC,GAAGhB,QAAQ,CAAcK,YAAY,CAAC;EAC/D,MAAM,CAACY,OAAO,EAAEC,UAAU,CAAC,GAAGlB,QAAQ,CAAUY,QAAQ,CAAC;EACzD,MAAM,CAACO,KAAK,EAAEC,QAAQ,CAAC,GAAGpB,QAAQ,CAAe,IAAI,CAAC;EACtD,MAAMqB,UAAU,GAAGtB,MAAM,CAAC,IAAI,CAAC;EAE/B,MAAMuB,IAAI,GAAGnB,kBAAkB,CAAC,CAAC;;EAEjC;EACA,MAAMoB,OAAO,GAAG1B,WAAW,CAAC,YAAY;IACtC,MAAM,CAAC2B,OAAO,EAAEC,WAAW,CAAC,GAAG,MAAMC,OAAO,CAACpB,GAAG,CAAC,CAC/CgB,IAAI,CAACK,MAAM,CAAC,CAAC,EACbL,IAAI,CAACM,SAAS,CAAC,CAAC,CACjB,CAAC;IACF,IAAI,CAACP,UAAU,CAACQ,OAAO,EAAE;IACzBf,SAAS,CAACU,OAAO,CAACM,GAAG,CAAC1B,aAAa,CAAC,CAAC;IACrCY,SAAS,CAACS,WAAW,CAAC;EACxB,CAAC,EAAE,CAACH,IAAI,CAAC,CAAC;EAEVxB,SAAS,CAAC,MAAM;IACduB,UAAU,CAACQ,OAAO,GAAG,IAAI;IACzB,IAAI,CAACjB,QAAQ,EAAE;IAEf,CAAC,YAAY;MACX,IAAI;QACF,MAAMV,uBAAuB,CAAC,CAAC;QAC/B,MAAMqB,OAAO,CAAC,CAAC;MACjB,CAAC,CAAC,OAAOQ,GAAG,EAAE;QACZ,IAAIV,UAAU,CAACQ,OAAO,EAAE;UACtBT,QAAQ,CAACW,GAAG,YAAYC,KAAK,GAAGD,GAAG,GAAG,IAAIC,KAAK,CAACC,MAAM,CAACF,GAAG,CAAC,CAAC,CAAC;QAC/D;QACA;QACAG,OAAO,CAACC,IAAI,CAAC,2CAA2C,EAAEJ,GAAG,CAAC;MAChE,CAAC,SAAS;QACR,IAAIV,UAAU,CAACQ,OAAO,EAAEX,UAAU,CAAC,KAAK,CAAC;MAC3C;IACF,CAAC,EAAE,CAAC;IAEJ,OAAO,MAAM;MACXG,UAAU,CAACQ,OAAO,GAAG,KAAK;IAC5B,CAAC;EACH,CAAC,EAAE,CAACjB,QAAQ,EAAEW,OAAO,CAAC,CAAC;EAEvB,MAAMa,SAAS,GAAGvC,WAAW,CAC3B,OAAOwC,QAAuB,EAAEC,MAAoB,KAAK;IACvD,IAAI,CAACD,QAAQ,IAAIA,QAAQ,CAACE,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE;IACjD;IACA;IACA;IACA,MAAMf,OAAO,GAAG,MAAMF,IAAI,CAACkB,YAAY,CAACH,QAAQ,EAAEC,MAAM,CAAC;IACzD;IACA;IACA,MAAMf,OAAO,CAAC,CAAC;IACf,OAAOC,OAAO,CAACM,GAAG,CAAC1B,aAAa,CAAC;EACnC,CAAC,EACD,CAACkB,IAAI,EAAEC,OAAO,CAChB,CAAC;EAED,MAAMkB,UAAU,GAAG5C,WAAW,CAC5B,MAAO6C,EAAU,IAAK;IACpB,MAAMpB,IAAI,CAACqB,UAAU,CAACD,EAAE,CAAC;IACzB,MAAMnB,OAAO,CAAC,CAAC;EACjB,CAAC,EACD,CAACD,IAAI,EAAEC,OAAO,CAChB,CAAC;EAED,MAAMqB,UAAU,GAAG/C,WAAW,CAC5B,MAAOgD,GAAa,IAAK;IACvB,MAAMvB,IAAI,CAACwB,UAAU,CAACD,GAAG,CAAC;IAC1B,MAAMtB,OAAO,CAAC,CAAC;EACjB,CAAC,EACD,CAACD,IAAI,EAAEC,OAAO,CAChB,CAAC;EAED,MAAMwB,gBAAgB,GAAGlD,WAAW,CAClC,MAAO6C,EAAU,IAAyC;IACxD,MAAMM,MAAM,GAAG,MAAM1B,IAAI,CAAC2B,OAAO,CAACP,EAAE,CAAC;IACrC,IAAI,CAACM,MAAM,EAAE,OAAO,IAAI;;IAExB;IACA;IACA;IACA,IAAIE,MAAiC,GAAG,IAAI;IAC5C,IAAI;MACFA,MAAM,GAAI,MAAMjD,YAAY,CAACkD,iBAAiB,CAACH,MAAM,CAACI,QAAQ,EAAE;QAC9DC,OAAO,EAAEL,MAAM,CAACN,EAAE;QAClBY,QAAQ,EAAEN,MAAM,CAACM;MACnB,CAAC,CAAwB;IAC3B,CAAC,CAAC,OAAOvB,GAAG,EAAE;MACZ;MACA;MACA;MACAG,OAAO,CAACC,IAAI,CAAC,4CAA4C,EAAEO,EAAE,EAAEX,GAAG,CAAC;IACrE;IAEA,IAAImB,MAAM,IAAI,CAACA,MAAM,CAACK,WAAW,EAAE;MACjCrB,OAAO,CAACC,IAAI,CACV,mEAAmE,EACnEqB,IAAI,CAACC,SAAS,CAACP,MAAM,CACvB,CAAC;IACH;IAEA,MAAM5B,IAAI,CAACqB,UAAU,CAACD,EAAE,CAAC;IACzB,MAAMnB,OAAO,CAAC,CAAC;IACf,OAAO2B,MAAM;EACf,CAAC,EACD,CAAC5B,IAAI,EAAEC,OAAO,CAChB,CAAC;EAED,OAAO;IACLV,MAAM;IACNE,MAAM;IACNE,OAAO;IACPE,KAAK;IACLiB,SAAS;IACTK,UAAU;IACVG,UAAU;IACVG,gBAAgB;IAChBxB;EACF,CAAC;AACH","ignoreList":[]}