snapback4-expo 0.4.28 → 0.4.29

package/README.md

@@ -106,3 +106,13 @@ recorded simulator, with project and device leases held through cleanup.
 For durable offline media, use the local client's `uploadAndPlace` or `useUpload`
 (re-exported here). `saveAsset(client, id, name?)` presents the iOS save/share sheet
 from authorized or retained bytes. See [the shared upload contract](../snapback4/OFFLINE-UPLOADS.md).
+
+### Persist account sessions
+
+Install with `npx expo install expo-secure-store`, import `* as SecureStore` from
+`expo-secure-store`, then import `secureStoreSessionStore` from `snapback4-expo`.
+Pass `sessionStore: secureStoreSessionStore(SecureStore)` to `createApp`.
+The adapter encodes complete UTF-16 keys injectively; distinct backend and
+read/full session keys stay distinct. Storage failures propagate. This adds no
+Swift code. Rebuild the app after installing SecureStore; see
+[Expo SecureStore](https://docs.expo.dev/versions/latest/sdk/securestore/).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "snapback4-expo",
-  "version": "0.4.28",
+  "version": "0.4.29",
   "type": "module",
   "description": "Snapback 4's native module for Expo: the device in Rust (the partition in its own SQLite, the stream applied, the outbox kept, queries and predictions answered) behind one JSON call, and the opener `snapback4/native` takes.",
   "main": "src/index.ts",

package/src/index.ts

@@ -72,3 +72,5 @@ export function saveAsset(client: Pick<Client, "asset">, id: string, name?: stri
 }
 export { uploadAndPlace, type UploadIntent, type UploadAndPlaceOptions } from "snapback4/local";
 export { useUpload } from "snapback4/react";
+
+export { secureStoreSessionStore, type SecureStoreLike } from "./session-store";

package/src/session-store.ts

@@ -0,0 +1,19 @@
+import type { SessionStore } from "snapback4/auth";
+
+/** Pass the expo-secure-store module; no native module is loaded by this adapter. */
+export interface SecureStoreLike {
+  getItemAsync(key: string): Promise<string | null>;
+  setItemAsync(key: string, value: string): Promise<void>;
+  deleteItemAsync(key: string): Promise<void>;
+}
+
+// Fixed-width UTF-16 units preserve every JS key, including lone surrogates.
+// @ref LLP 3000.013#6.9 — backend and read/full session keys must never collide.
+export function secureStoreSessionStore(secureStore: SecureStoreLike): SessionStore {
+  const key = (value: string) => "snapback4.session." + Array.from({ length: value.length }, (_, i) => value.charCodeAt(i).toString(16).padStart(4, "0")).join("");
+  return {
+    get: value => secureStore.getItemAsync(key(value)),
+    set: (value, session) => secureStore.setItemAsync(key(value), session),
+    delete: value => secureStore.deleteItemAsync(key(value)),
+  };
+}