yaver-feedback-react-native 0.9.3 → 0.9.6

package/dist/YaverFeedback.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.YaverFeedback = void 0;
 const react_native_1 = require("react-native");
@@ -155,6 +188,60 @@ let autoStartTimer = null;
 let reportLaunchInFlight = false;
 let crashReportInFlight = false;
 let dogfoodOnboarding = null;
+let dogfoodFlowState = { phase: 'idle' };
+const dogfoodFlowListeners = new Set();
+let dogfoodShortcutAppStateSubscription = null;
+let dogfoodActivationSubscription = null;
+let dogfoodShortcutLaunchInFlight = false;
+let lastDogfoodActivationUrl = '';
+function publishDogfoodFlow(state) {
+    dogfoodFlowState = state;
+    try {
+        config?.dogfood?.onStateChange?.(state);
+    }
+    catch { /* host callback */ }
+    dogfoodFlowListeners.forEach((listener) => {
+        try {
+            listener(state);
+        }
+        catch { /* host callbacks never break the SDK */ }
+    });
+}
+async function consumeNativeDogfoodShortcut() {
+    if (dogfoodShortcutLaunchInFlight || !config?.dogfood?.appShortcut)
+        return;
+    const native = react_native_1.NativeModules?.YaverHotReload;
+    if (typeof native?.consumeDogfoodShortcut !== 'function')
+        return;
+    try {
+        if (!(await native.consumeDogfoodShortcut()))
+            return;
+        dogfoodShortcutLaunchInFlight = true;
+        // Let FeedbackModal/AuthOverlay effects mount after a cold launch.
+        const timer = setTimeout(() => {
+            void YaverFeedback.openDogfood().finally(() => { dogfoodShortcutLaunchInFlight = false; });
+        }, 350);
+        unrefTimer(timer);
+    }
+    catch {
+        dogfoodShortcutLaunchInFlight = false;
+    }
+}
+function handleDogfoodActivationUrl(url) {
+    if (!url || url === lastDogfoodActivationUrl || !config?.dogfood)
+        return;
+    try {
+        const parsed = new URL(url);
+        if (!parsed.protocol.startsWith('yaver-dogfood-') || parsed.hostname !== 'activate')
+            return;
+    }
+    catch {
+        return;
+    }
+    lastDogfoodActivationUrl = url;
+    const timer = setTimeout(() => { void YaverFeedback.openDogfood(); }, 350);
+    unrefTimer(timer);
+}
 /** Resolve the user's relay password by validating their auth token
  *  against Convex. Used whenever we (re)build the P2PClient so a
  *  relay-routed agentUrl carries a valid X-Relay-Password — without
@@ -446,6 +533,32 @@ class YaverFeedback {
         if (config.autoLogin !== false && enabled) {
             void YaverFeedback.hydrateSession();
         }
+        if (config.dogfood?.appShortcut) {
+            void YaverFeedback.syncDogfoodAppShortcut();
+            void consumeNativeDogfoodShortcut();
+            try {
+                const { AppState } = require('react-native');
+                dogfoodShortcutAppStateSubscription?.remove();
+                dogfoodShortcutAppStateSubscription = AppState.addEventListener('change', (state) => {
+                    if (state === 'active') {
+                        void YaverFeedback.syncDogfoodAppShortcut();
+                        void consumeNativeDogfoodShortcut();
+                    }
+                });
+            }
+            catch { /* native shortcut unavailable on web/test runtimes */ }
+        }
+        if (config.dogfood) {
+            try {
+                const { Linking } = require('react-native');
+                dogfoodActivationSubscription?.remove();
+                dogfoodActivationSubscription = Linking.addEventListener('url', ({ url }) => {
+                    handleDogfoodActivationUrl(url);
+                });
+                void Linking.getInitialURL().then(handleDogfoodActivationUrl).catch(() => { });
+            }
+            catch { /* linking unavailable in non-native test runtimes */ }
+        }
         // Create P2P client if we have a URL
         if (config.agentUrl) {
             p2pAuthToken = config.authToken ?? null;
@@ -640,7 +753,7 @@ class YaverFeedback {
      * Sets config.agentUrl and creates P2PClient on success.
      */
     static async discoverAgent() {
-        if (!config || !enabled)
+        if (!config || (!enabled && !dogfoodOnboarding))
             return;
         if (config.agentUrl)
             return; // already have a URL
@@ -671,7 +784,7 @@ class YaverFeedback {
      * Returns true when a new URL was adopted.
      */
     static async reconnect() {
-        if (!config || !enabled)
+        if (!config || (!enabled && !dogfoodOnboarding))
             return false;
         if (!config.authToken || !config.convexUrl)
             return false;
@@ -741,6 +854,7 @@ class YaverFeedback {
         if (config.autoStartBlackBox !== false && !BlackBox_1.BlackBox.isStreaming) {
             YaverFeedback.scheduleBlackBoxAutoStart();
         }
+        await YaverFeedback.syncDogfoodAppShortcut().catch(() => false);
     }
     /** Returns true once the SDK has a session token it can use. */
     static isAuthed() {
@@ -812,24 +926,186 @@ class YaverFeedback {
         const { DeviceEventEmitter } = require('react-native');
         DeviceEventEmitter.emit('yaverFeedback:startMachinePicker');
     }
-    /** Begin the reusable host-app Dogfood wizard. Owner OAuth and machine
-     * selection intentionally happen before installation enrollment/runtime
-     * controls because starting builds or runners is owner-level authority. */
-    static beginDogfoodOnboarding(options) {
+    /** Configure Dogfood once during host init. Hosts still decide whether and
+     * where to render an affordance; `openDogfood()` owns all flow mechanics. */
+    static configureDogfood(options) {
         dogfoodOnboarding = options;
-        if (!config)
-            YaverFeedback.init({ autoLogin: true });
-        if (!YaverFeedback.isAuthed()) {
+    }
+    /**
+     * Open Dogfood using config.dogfood + the normal app identity. Cached OAuth,
+     * machine, runner and model choices are reused. The corresponding picker is
+     * shown only when a required choice is missing.
+     */
+    static async openDogfood(overrides) {
+        if (!config && overrides?.appId) {
+            return YaverFeedback.beginDogfoodOnboarding(overrides);
+        }
+        const configured = config?.dogfood;
+        const appId = overrides?.appId || configured?.appId || config?.bundleId;
+        if (!appId) {
+            const state = { phase: 'error', error: 'Dogfood requires an appId or FeedbackConfig.bundleId.' };
+            publishDogfoodFlow(state);
+            return state;
+        }
+        dogfoodOnboarding = {
+            appId,
+            label: overrides?.label || configured?.label || config?.projectName || appId,
+            projectName: overrides?.projectName || configured?.projectName || config?.projectName,
+            framework: overrides?.framework || configured?.framework,
+            backendUrl: overrides?.backendUrl || configured?.backendUrl,
+            secureStore: overrides?.secureStore,
+        };
+        if (configured?.canShow) {
+            // This hook is presentation policy, but it still receives the complete
+            // backend-authoritative snapshot. Passing an owner-only approximation
+            // here made legitimate approved testers fail custom `access.authorized`
+            // gates even though their exact phone key was active.
+            const access = await YaverFeedback.getDogfoodAccess();
+            try {
+                if (!(await configured.canShow(access))) {
+                    const state = { phase: 'denied', appId };
+                    publishDogfoodFlow(state);
+                    return state;
+                }
+            }
+            catch (cause) {
+                const state = {
+                    phase: 'error',
+                    appId,
+                    error: cause instanceof Error ? cause.message : String(cause),
+                };
+                publishDogfoodFlow(state);
+                return state;
+            }
+        }
+        return YaverFeedback.continueDogfoodOnboarding();
+    }
+    /** Resolve the host-facing ACL snapshot without granting authority. This is
+     * the one endpoint custom Settings screens need for visibility/status UI. */
+    static async getDogfoodAccess() {
+        const configured = config?.dogfood;
+        const appId = dogfoodOnboarding?.appId || configured?.appId || config?.bundleId;
+        if (!appId)
+            throw new Error('Dogfood requires an appId or FeedbackConfig.bundleId.');
+        let installationId;
+        let deviceState = 'unknown';
+        try {
+            const device = new deviceDogfood_1.YaverDeviceDogfood({
+                appId,
+                label: dogfoodOnboarding?.label || configured?.label || config?.projectName,
+                backendUrl: dogfoodOnboarding?.backendUrl || configured?.backendUrl,
+                secureStore: dogfoodOnboarding?.secureStore,
+            });
+            installationId = (await device.enrollmentInfo()).installationId;
+            deviceState = await device.status();
+        }
+        catch {
+            // UI status must degrade to unknown; openDogfood still offers owner OAuth.
+        }
+        const token = config?.authToken || await (0, auth_1.getToken)();
+        const account = token
+            ? await (0, auth_1.getDogfoodAccountAccess)(appId, token, installationId)
+            : { authenticated: false, ownerAuthorized: false, installationAuthorized: false };
+        const yaverAuthenticated = account.authenticated;
+        const ownerAuthorized = account.ownerAuthorized;
+        return {
+            appId,
+            yaverAuthenticated,
+            ownerAuthorized,
+            installationId,
+            deviceState,
+            authorized: yaverAuthenticated && account.installationAuthorized && deviceState === 'active',
+        };
+    }
+    /** Add/remove the platform Home Screen shortcut from backend-authoritative
+     * owner/device ACL state. Static plist shortcuts are intentionally avoided:
+     * an unauthorized install must never advertise a hidden developer action. */
+    static async syncDogfoodAppShortcut() {
+        const shortcut = config?.dogfood?.appShortcut;
+        const native = react_native_1.NativeModules?.YaverHotReload;
+        if (!shortcut || typeof native?.setDogfoodShortcut !== 'function')
+            return false;
+        const access = await YaverFeedback.getDogfoodAccess();
+        let visible = access.authorized;
+        if (visible && config?.dogfood?.canShow) {
+            try {
+                visible = await config.dogfood.canShow(access);
+            }
+            catch {
+                visible = false;
+            }
+        }
+        const label = typeof shortcut === 'object' && shortcut.label
+            ? shortcut.label
+            : `Dogfood ${config?.dogfood?.label || config?.projectName || ''}`.trim();
+        // Product contract: both a valid full Yaver account AND this phone's
+        // backend-approved app installation are required. Neither factor alone
+        // advertises the developer surface.
+        await native.setDogfoodShortcut(visible, label || 'Dogfood');
+        return visible;
+    }
+    /** Backwards-compatible entry point for existing integrations. */
+    static async beginDogfoodOnboarding(options) {
+        YaverFeedback.configureDogfood(options);
+        if (!config) {
+            YaverFeedback.init({
+                autoLogin: true,
+                enabled: true,
+                projectName: options.projectName || options.label,
+                bundleId: options.appId,
+            });
+        }
+        return YaverFeedback.continueDogfoodOnboarding();
+    }
+    /** Continue after OAuth or machine selection. Public so custom host UI can
+     * hand control back without recreating the SDK state machine. */
+    static async continueDogfoodOnboarding() {
+        const appId = dogfoodOnboarding?.appId;
+        if (!dogfoodOnboarding || !appId) {
+            const state = { phase: 'error', error: 'Dogfood is not configured.' };
+            publishDogfoodFlow(state);
+            return state;
+        }
+        await YaverFeedback.hydrateSession();
+        const token = config?.authToken || await (0, auth_1.getToken)();
+        const account = token
+            ? await (0, auth_1.getDogfoodAccountAccess)(appId, token)
+            : { authenticated: false, ownerAuthorized: false, installationAuthorized: false };
+        // A device key is a second factor for this installation, never a
+        // replacement for a real Yaver account. Narrow installation sessions and
+        // stale/invalid cached tokens both return authenticated=false here.
+        if (!account.authenticated) {
+            const state = { phase: 'auth-required', appId };
+            publishDogfoodFlow(state);
             YaverFeedback.showLogin();
-            return;
+            return state;
+        }
+        if (!config?.preferredDeviceId) {
+            const state = { phase: 'machine-required', appId };
+            publishDogfoodFlow(state);
+            YaverFeedback.showMachinePicker();
+            return state;
         }
-        YaverFeedback.showMachinePicker();
+        const state = { phase: 'opening', appId };
+        publishDogfoodFlow(state);
+        const { DeviceEventEmitter } = require('react-native');
+        DeviceEventEmitter.emit('yaverFeedback:startReport');
+        return state;
+    }
+    static getDogfoodFlowState() {
+        return dogfoodFlowState;
+    }
+    static onDogfoodFlowState(listener) {
+        dogfoodFlowListeners.add(listener);
+        listener(dogfoodFlowState);
+        return () => dogfoodFlowListeners.delete(listener);
     }
     static getDogfoodOnboarding() {
         return dogfoodOnboarding;
     }
     static clearDogfoodOnboarding() {
         dogfoodOnboarding = null;
+        publishDogfoodFlow({ phase: 'idle' });
     }
     /**
      * Update the selected remote device. Resets the cached agent URL so the
@@ -853,6 +1129,7 @@ class YaverFeedback {
         p2pClient = null;
         renderP2PClient = null;
         p2pAuthToken = null;
+        await Promise.resolve().then(() => __importStar(require('./auth'))).then(({ saveSelectedDeviceId }) => saveSelectedDeviceId(deviceId));
         await YaverFeedback.discoverAgent();
     }
     /** Resolve the currently selected remote machine from the authenticated device list. */
@@ -913,6 +1190,7 @@ class YaverFeedback {
         p2pClient = null;
         renderP2PClient = null;
         p2pAuthToken = null;
+        await YaverFeedback.syncDogfoodAppShortcut().catch(() => false);
     }
     /**
      * Manually trigger the feedback collection flow.
@@ -1161,12 +1439,12 @@ class YaverFeedback {
     static getDogfoodStatus() {
         return (0, dogfoodPolicy_1.resolveSDKDogfood)(config?.dogfood);
     }
-    /** One-call, account-free Dogfood bootstrap for third-party apps. On first
-     * launch it creates/proves the installation key and returns pending; after
-     * owner approval the same call obtains a short-lived scoped Yaver session
-     * and enables Dogfood UX without the host app implementing OAuth. */
+    /** One-call account-bound Dogfood bootstrap for third-party apps. The host
+     * app needs no auth backend of its own: SDK OAuth supplies the full Yaver
+     * account, then this creates/proves the installation key. Owner approval
+     * binds that account + appId + phone key before a scoped session is minted. */
     static async enableDeviceDogfood(options) {
-        const client = new deviceDogfood_1.YaverDeviceDogfood(options);
+        const client = new deviceDogfood_1.YaverDeviceDogfood({ ...options, authToken: options.authToken || config?.authToken });
         let status = await client.status();
         if (status === 'unregistered' || status === 'pending' || status === 'cancelled' || status === 'revoked' || status === 'superseded') {
             const enrolled = status === 'unregistered' || status === 'pending'
@@ -1180,22 +1458,23 @@ class YaverFeedback {
             YaverFeedback.init({ autoLogin: false });
         if (config) {
             config.dogfood = {
+                ...config.dogfood,
                 enabled: status === 'active' && !!session,
                 appId: options.appId,
                 installationId: info.installationId,
                 installationStatus: status === 'active' && session ? 'active' : status === 'unregistered' ? 'pending' : status,
                 label: options.label,
             };
-            // A normal Yaver OAuth session remains authoritative for the runtime
-            // wizard. Only account-free hosts adopt the narrow installation token.
-            if (session && !config.authToken)
-                await YaverFeedback.setAuthToken(session.token);
+            // A normal full Yaver OAuth session remains authoritative for the
+            // runtime wizard. The narrow installation token is intentionally never
+            // promoted into account auth.
         }
         try {
             const { DeviceEventEmitter } = require('react-native');
             DeviceEventEmitter.emit('yaverFeedback:dogfoodChanged', { active: !!session, status });
         }
         catch { /* noop */ }
+        await YaverFeedback.syncDogfoodAppShortcut().catch(() => false);
         return { status, installationId: info.installationId, session };
     }
     /** Confirmed by the Y badge/UI before this is called. Reverts this SDK to
@@ -1705,6 +1984,11 @@ class YaverFeedback {
         // init() stacked a second one on top.
         commandUnsubscribe?.();
         commandUnsubscribe = null;
+        dogfoodShortcutAppStateSubscription?.remove();
+        dogfoodShortcutAppStateSubscription = null;
+        dogfoodActivationSubscription?.remove();
+        dogfoodActivationSubscription = null;
+        lastDogfoodActivationUrl = '';
         // Before `enabled = false` / `config = null` below, so an in-flight retry
         // can't fire against a torn-down config.
         YaverFeedback.cancelBlackBoxAutoStart();

package/dist/__tests__/NativeDogfoodShortcut.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/NativeDogfoodShortcut.test.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = require("fs");
+const path_1 = require("path");
+const plugin = require('../../app.plugin.js');
+describe('native Dogfood shortcut contract', () => {
+    it('patches cold and warm iOS shortcut delivery idempotently', () => {
+        const source = `
+public class AppDelegate: ExpoAppDelegate {
+  public override func application(
+    _ application: UIApplication,
+    didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]? = nil
+  ) -> Bool {
+    setupYaverHotReload()
+    return true
+  }
+}
+`;
+        const once = plugin.__test.patchDogfoodAppShortcut(source);
+        expect(once).toContain('launchOptions?[.shortcutItem]');
+        expect(once).toContain('performActionFor shortcutItem');
+        expect(once).toContain('markDogfoodShortcutPending()');
+        expect(plugin.__test.patchDogfoodAppShortcut(once)).toBe(once);
+    });
+    it('uses dynamic native shortcuts on both platforms', () => {
+        const ios = (0, fs_1.readFileSync)((0, path_1.join)(__dirname, '../../ios/YaverHotReload.swift'), 'utf8');
+        const android = (0, fs_1.readFileSync)((0, path_1.join)(__dirname, '../../android/src/main/java/io/yaver/feedback/YaverHotReloadModule.java'), 'utf8');
+        expect(ios).toContain('UIApplication.shared.shortcutItems');
+        expect(ios).toContain('setDogfoodShortcut');
+        expect(android).toContain('ShortcutManager');
+        expect(android).toContain('addDynamicShortcuts');
+        expect(android).toContain('consumeDogfoodShortcut');
+    });
+});

package/dist/__tests__/ReportIdentity.test.js

@@ -9,8 +9,6 @@ const mockReactNative = {
     NativeModules: {},
 };
 const mockExpoModule = { default: {} };
-jest.mock('react-native', () => mockReactNative);
-jest.mock('expo-constants', () => mockExpoModule, { virtual: true });
 /** Mirrors mobile/app.json in the Talos repo — the SDK's first external consumer. */
 const EXPO_CONFIG = {
     name: 'Talos',
@@ -25,8 +23,13 @@ function mockExpoConstants(expoConfig, extra = {}) {
 function loadResolve() {
     let resolve;
     jest.isolateModules(() => {
+        // Configure the mocks inside the isolated registry. Top-level virtual
+        // mocks are sticky across Jest's worker registry and lost to the real
+        // expo-constants package after a clean npm ci, making this suite depend on
+        // file order. doMock is non-hoisted and binds these exact mutable objects
+        // immediately before P2PClient is evaluated.
         jest.doMock('react-native', () => mockReactNative);
-        jest.doMock('expo-constants', () => mockExpoModule, { virtual: true });
+        jest.doMock('expo-constants', () => mockExpoModule);
         resolve = require('../P2PClient').resolveReportIdentity;
     });
     return resolve;

package/dist/__tests__/ShakeDetectorWeb.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/ShakeDetectorWeb.test.js

@@ -0,0 +1,27 @@
+"use strict";
+// Browsers cannot provide a native shake gesture. expo-sensors still exports
+// an Accelerometer facade there, and older SDK builds attempted to subscribe
+// to it, crashing the host React tree through NativeEventEmitter.
+Object.defineProperty(exports, "__esModule", { value: true });
+const sensorAddListener = jest.fn(() => ({ remove: jest.fn() }));
+const devEventAddListener = jest.fn(() => ({ remove: jest.fn() }));
+jest.mock('react-native', () => ({
+    Platform: { OS: 'web' },
+    NativeModules: {},
+    DeviceEventEmitter: { addListener: devEventAddListener },
+}));
+jest.mock('expo-sensors', () => ({
+    Accelerometer: {
+        setUpdateInterval: jest.fn(),
+        addListener: sensorAddListener,
+    },
+}), { virtual: true });
+const ShakeDetector_1 = require("../ShakeDetector");
+it('keeps explicit SDK controls alive without touching the native sensor on web', () => {
+    const detector = new ShakeDetector_1.ShakeDetector();
+    expect(() => detector.start(jest.fn())).not.toThrow();
+    expect(sensorAddListener).not.toHaveBeenCalled();
+    // The ordinary DeviceEventEmitter lane remains harmless and removable.
+    expect(devEventAddListener).toHaveBeenCalledTimes(1);
+    expect(() => detector.stop()).not.toThrow();
+});

package/dist/__tests__/YaverFeedback.test.js

@@ -10,6 +10,13 @@ jest.mock('react-native', () => ({
         addListener: jest.fn(() => ({ remove: jest.fn() })),
     },
     Platform: { OS: 'ios' },
+    NativeModules: {
+        YaverHotReload: {
+            setDogfoodShortcut: jest.fn(async () => true),
+            consumeDogfoodShortcut: jest.fn(async () => false),
+        },
+    },
+    AppState: { addEventListener: jest.fn(() => ({ remove: jest.fn() })) },
 }));
 // Mock Discovery
 jest.mock('../Discovery', () => ({
@@ -22,6 +29,12 @@ jest.mock('../auth', () => ({
     setStrictNativeAuth: jest.fn(),
     getToken: jest.fn(async () => null),
     getSelectedDeviceId: jest.fn(async () => null),
+    getDogfoodAccountAccess: jest.fn(async (_appId, token) => ({
+        authenticated: token === 'owner-token',
+        ownerAuthorized: token === 'owner-token',
+        installationAuthorized: token === 'owner-token',
+    })),
+    saveSelectedDeviceId: jest.fn(async () => { }),
     clearToken: jest.fn(async () => { }),
     clearSelectedDeviceId: jest.fn(async () => { }),
     listReachableDevices: jest.fn(async () => ({
@@ -46,20 +59,100 @@ beforeEach(() => {
     // YaverFeedback uses module-level variables (config, enabled, p2pClient).
     // We reset them by calling init with a known state or relying on isInitialized checks.
     // For a clean slate, we re-init with enabled=false then verify.
+    jest.restoreAllMocks();
     jest.clearAllMocks();
 });
 describe('YaverFeedback', () => {
     describe('Dogfood onboarding', () => {
-        it('starts with Yaver OAuth when the host has no session', () => {
+        it('starts with Yaver OAuth when the host has no session', async () => {
             YaverFeedback_1.YaverFeedback.init({ enabled: true });
-            YaverFeedback_1.YaverFeedback.beginDogfoodOnboarding({ appId: 'io.example.app', label: 'Example' });
+            await YaverFeedback_1.YaverFeedback.beginDogfoodOnboarding({ appId: 'io.example.app', label: 'Example' });
             expect(react_native_1.DeviceEventEmitter.emit).toHaveBeenCalledWith('yaverFeedback:startLogin');
         });
-        it('asks for a machine after an existing OAuth session', () => {
+        it('asks for a machine after an existing OAuth session', async () => {
             YaverFeedback_1.YaverFeedback.init({ enabled: true, authToken: 'owner-token' });
-            YaverFeedback_1.YaverFeedback.beginDogfoodOnboarding({ appId: 'io.example.app', label: 'Example' });
+            await YaverFeedback_1.YaverFeedback.beginDogfoodOnboarding({ appId: 'io.example.app', label: 'Example' });
             expect(react_native_1.DeviceEventEmitter.emit).toHaveBeenCalledWith('yaverFeedback:startMachinePicker');
         });
+        it('reuses the configured app identity and selected machine', async () => {
+            YaverFeedback_1.YaverFeedback.init({
+                enabled: true,
+                authToken: 'owner-token',
+                preferredDeviceId: 'device-1',
+                projectName: 'Example',
+                bundleId: 'io.example.app',
+                dogfood: { framework: 'expo' },
+            });
+            const state = await YaverFeedback_1.YaverFeedback.openDogfood();
+            expect(state).toEqual({ phase: 'opening', appId: 'io.example.app' });
+            expect(react_native_1.DeviceEventEmitter.emit).toHaveBeenCalledWith('yaverFeedback:startReport');
+            expect(react_native_1.DeviceEventEmitter.emit).not.toHaveBeenCalledWith('yaverFeedback:startMachinePicker');
+        });
+        it('publishes flow state for custom host UI', async () => {
+            YaverFeedback_1.YaverFeedback.init({ enabled: true });
+            const states = [];
+            const unsubscribe = YaverFeedback_1.YaverFeedback.onDogfoodFlowState((state) => states.push(state.phase));
+            await YaverFeedback_1.YaverFeedback.beginDogfoodOnboarding({ appId: 'io.example.app' });
+            unsubscribe();
+            expect(states[states.length - 1]).toBe('auth-required');
+        });
+        it('lets a host ACL hide its affordance without opening auth UI', async () => {
+            YaverFeedback_1.YaverFeedback.init({
+                enabled: true,
+                bundleId: 'io.example.app',
+                dogfood: { canShow: () => false },
+            });
+            const state = await YaverFeedback_1.YaverFeedback.openDogfood();
+            expect(state).toEqual({ phase: 'denied', appId: 'io.example.app' });
+            expect(react_native_1.DeviceEventEmitter.emit).not.toHaveBeenCalledWith('yaverFeedback:startLogin');
+        });
+        it('adds the app shortcut only for a signed-in and approved phone', async () => {
+            YaverFeedback_1.YaverFeedback.init({ bundleId: 'io.example.app', dogfood: {} });
+            YaverFeedback_1.YaverFeedback.getConfig().dogfood.appShortcut = { label: 'Dogfood Example' };
+            jest.spyOn(YaverFeedback_1.YaverFeedback, 'getDogfoodAccess').mockResolvedValueOnce({
+                appId: 'io.example.app',
+                yaverAuthenticated: true,
+                ownerAuthorized: false,
+                installationId: 'phone-1',
+                deviceState: 'active',
+                authorized: true,
+            });
+            await YaverFeedback_1.YaverFeedback.syncDogfoodAppShortcut();
+            expect(react_native_1.NativeModules.YaverHotReload.setDogfoodShortcut)
+                .toHaveBeenCalledWith(true, 'Dogfood Example');
+        });
+        it('removes the shortcut when the phone is approved but Yaver is signed out', async () => {
+            YaverFeedback_1.YaverFeedback.init({ bundleId: 'io.example.app', dogfood: {} });
+            YaverFeedback_1.YaverFeedback.getConfig().dogfood.appShortcut = true;
+            jest.spyOn(YaverFeedback_1.YaverFeedback, 'getDogfoodAccess').mockResolvedValueOnce({
+                appId: 'io.example.app',
+                yaverAuthenticated: false,
+                ownerAuthorized: false,
+                installationId: 'phone-1',
+                deviceState: 'active',
+                authorized: false,
+            });
+            await YaverFeedback_1.YaverFeedback.syncDogfoodAppShortcut();
+            expect(react_native_1.NativeModules.YaverHotReload.setDogfoodShortcut)
+                .toHaveBeenCalledWith(false, 'Dogfood');
+        });
+        it('applies the host presentation ACL after backend device authorization', async () => {
+            YaverFeedback_1.YaverFeedback.init({
+                bundleId: 'io.example.app',
+                dogfood: { appShortcut: true, canShow: async () => false },
+            });
+            jest.spyOn(YaverFeedback_1.YaverFeedback, 'getDogfoodAccess').mockResolvedValueOnce({
+                appId: 'io.example.app',
+                yaverAuthenticated: true,
+                ownerAuthorized: false,
+                installationId: 'phone-1',
+                deviceState: 'active',
+                authorized: true,
+            });
+            await YaverFeedback_1.YaverFeedback.syncDogfoodAppShortcut();
+            expect(react_native_1.NativeModules.YaverHotReload.setDogfoodShortcut)
+                .toHaveBeenCalledWith(false, 'Dogfood');
+        });
     });
     describe('init()', () => {
         it('sets config correctly with defaults', () => {

package/dist/__tests__/deviceDogfood.test.js

@@ -26,7 +26,7 @@ describe('YaverDeviceDogfood', () => {
     afterEach(() => { jest.restoreAllMocks(); });
     test('keeps identity stable and proves possession rather than trusting the UUID', async () => {
         const store = new MemorySecureStore();
-        const client = new deviceDogfood_1.YaverDeviceDogfood({ appId: 'io.example.test', secureStore: store, backendUrl: 'https://dogfood.test' });
+        const client = new deviceDogfood_1.YaverDeviceDogfood({ appId: 'io.example.test', authToken: 'full-yaver-token', secureStore: store, backendUrl: 'https://dogfood.test' });
         const first = await client.enrollmentInfo();
         const second = await client.enrollmentInfo();
         expect(second).toEqual(first);
@@ -49,7 +49,7 @@ describe('YaverDeviceDogfood', () => {
     });
     test('re-register rotates key and installation while preserving only the logical slot', async () => {
         const store = new MemorySecureStore();
-        const client = new deviceDogfood_1.YaverDeviceDogfood({ appId: 'io.example.test', secureStore: store, backendUrl: 'https://dogfood.test' });
+        const client = new deviceDogfood_1.YaverDeviceDogfood({ appId: 'io.example.test', authToken: 'full-yaver-token', secureStore: store, backendUrl: 'https://dogfood.test' });
         const before = await client.enrollmentInfo();
         jest.spyOn(globalThis, 'fetch').mockImplementation(async (input) => {
             if (String(input).endsWith('/dogfood/enroll/start'))