app.communicationos-mobile

@lssm-tech/app.communicationos-mobile

Message search uses the authenticated canonical space projection and shares the same typed API boundary as web and desktop. It is not limited to the active room.

Thin Expo Router shell for CommunicationOS on iOS and Android. It consumes the shared application kit, declares SecureStore for credentials and SQLite for offline projections, and permits device, managed-cloud, or self-hosted connector placement.

Auth sessions and provider credentials are stored through a scoped, device-only SecureStore vault. Calm Signal renders only spaces supplied by the authenticated session; signed-out and no-access states never invent personal or company spaces. Native AuthOS bearer sessions are exchanged for short-lived, scope-derived CommunicationOS grants before live spaces, rooms, or messages are loaded. Signed-out users receive a native email/password and TOTP surface in English, French, or Spanish. The bearer and MFA authority remain in device-only SecureStore, and CompanyOS performs the server-secret hCircle host exchange so no tenant, workspace, or space is accepted from the device. The additive useMobileCommunicationWorkspace hook exposes reload, authorized room selection, idempotent send, pending state, and recoverable action feedback; the state-only useMobileCommunicationSession hook remains compatible. Transient send failures are persisted in the encrypted, workspace-scoped SQLite outbox. The active session retries them every five seconds with their original idempotency keys and exposes an accessible queued-message status until confirmed. Each queued payload is additionally sealed with expo-crypto AES-256-GCM in the shared v2 outbox envelope, under a per-database key held only in device-only SecureStore (separate from the SQLCipher key), with tenant, workspace, space, principal, room and idempotency key as additional data. Tampered, re-scoped or still-plaintext rows are quarantined on replay and never sent; a key that cannot load fails replay closed and leaves rows pending. When the database opens, pending sealed rows whose key was lost are quarantined as seal_key_lost before a new key is created, and plaintext v2 rows written by an earlier build are sealed in one transaction because they already carry the full owner scope; nothing is dropped. The native composer uses the platform document picker for up to five supported files, hashes and uploads them inside the active scope, replays only opaque IDs, and opens authenticated downloads through the system share sheet.

Canonical room and thread URLs render a dedicated conversation detail instead of falling back to the generic Inbox. The screen names the requested opaque room or thread, resolves thread bindings only from the authenticated workspace, and mounts messages and the composer only after the resolved room is authorized. Late route responses are fenced, 401 detail loads clear the device credential, and sends retain the active room, attachment IDs, outbox, and idempotency rules. One shared workspace generation fences selection, send, recovery, and replay. Selection merges only its conversation slice into the latest workspace, while a per-session single-flight queue serializes send and replay outbox mutations. Failed upload, authentication, and network attempts keep the native draft and selected files until a send is confirmed or durably queued.

Forms management is available at /communications/forms using the current short-lived grant. Native public forms use /f/{opaqueToken} and the shared localized renderer; answers and bearer tokens are never placed in URLs.

Support case snooze and archive controls are available only when both support.authority and support.case-lifecycle are present in the explicit EXPO_PUBLIC_SUPPORT_OS_FLAGS list. The SupportOS API independently enforces the tenant/workspace rollout gate. Native retries preserve the operation key and the original snooze deadline; archive confirmation does not claim erasure.

Support case keyword search and saved-view apply, save, and archive are available only when support.authority and support.search-views are both present in that same explicit list. Results stay on the redacted SupportOS projection, saved-view mutations retain their retry identity, and late initial-list responses cannot replace a newer search result. Saved filters not editable on mobile remain apply/archive-only instead of being silently rewritten.

Ordinary case claim and self-release are available with support.authority; the native surface never exposes administrator assignment or governed steal. Live count-only collision labels and heartbeats additionally require support.case-presence, so presence remains disabled unless both that flag and authority are enabled. Outcome-ambiguous assignment retries preserve their key, and a completion for a previously selected case cannot rewrite the current case detail revision.

Merge, split, and link review is also authority-gated. Mobile refreshes and fences both case revisions through the shared relation orchestrator, presents a separate inline confirmation, retains retry identities after ambiguous outcomes, and reconciles only redacted case projections. Relation/evidence authority and CommunicationOS content references are never rendered.

Private-note composition requires the full authority, internal-note, composer, and reconciliation flag conjunction. The body is sent only through the governed compose operation to CommunicationOS-owned encrypted storage; the SupportOS mobile list renders body-free evidence. An ambiguous retry freezes the original body, case revision, and operation key together until completion or an explicit edit.

The Expo bundle imports only the Calm Signal font weights rendered by the shell: IBM Plex Sans 400/500/600, IBM Plex Mono 500, and Newsreader 600.

Run bun dev, bun android, bun ios, bun test, or bun run typecheck here.