createTokenStorage — @gj-kit/expo-auth

@gj-kit/expo-auth/storage에서 공개하는 function입니다. package version 0.1.1의 release declaration을 그대로 표시합니다.

검증된 import 예제

import { createTokenStorage } from '@gj-kit/expo-auth/storage';

시그니처, 매개변수, 반환 타입

/**
 * Platform-neutral token storage factory (design §3.8). The implementation is selected by the
 * `./storage` exports condition fork (§2.2·§2.3) — one public name, one branch-invariant
 * signature, one app-side assembly file, no `Platform.OS` branching in the consumer (§1
 * invariant 2):
 *
 * **Native branch** (Expo iOS/Android — the only graph that contains expo-secure-store):
 * - `'durable'`: two SecureStore keys — `{keyPrefix}.accessToken` / `{keyPrefix}.refreshToken`
 *   (split to dodge the Android ~2KB value-size warning, §7-4).
 * - `'session'`: removed from SecureStore and kept in factory memory only. Process exit =
 *   signed out (§7-5).
 * - In-memory cache (H10): allowed only here — a single native process has no external
 *   writer, so the cache cannot violate the §3.1 freshness clause.
 *
 * **node/browser branch** (peer-free, DOM-lib-free — §2.4):
 * - `'durable'`: localStorage. `'session'`: sessionStorage (tab-scoped). ⚠ Web storage is NOT
 *   a security boundary — any XSS on the origin can read the tokens (§7-12).
 * - `getTokens` is always a read-through (no cache) and prefers sessionStorage, and the
 *   persistence mode is derived from where a complete pair actually lives (H14).
 * - Missing localStorage/sessionStorage (SSR): memory-only fallback, no throw (§2.4).
 */
declare function createTokenStorage(options: TokenStorageOptions): TokenStorage;

이 선언은 매개변수, optionality, 제네릭, 반환값, 공개 union/type 계약의 정본입니다. 호출 전 필요한 환경·권한·오류 경계는 패키지 Golden path와 이 subpath의 import 조건을 함께 확인하세요.

Release context

• 패키지: @gj-kit/expo-auth
• 버전: 0.1.1
• 공개 entry: ./storage
• 소스: GitHub

구현 주석

Platform-neutral token storage factory (design §3.8). The implementation is selected by the ./storage exports condition fork (§2.2·§2.3) — one public name, one branch-invariant signature, one app-side assembly file, no Platform.OS branching in the consumer (§1 invariant 2):

Native branch (Expo iOS/Android — the only graph that contains expo-secure-store):

• 'durable': two SecureStore keys — {keyPrefix}.accessToken / {keyPrefix}.refreshToken (split to dodge the Android ~2KB value-size warning, §7-4).
• 'session': removed from SecureStore and kept in factory memory only. Process exit = signed out (§7-5).
• In-memory cache (H10): allowed only here — a single native process has no external writer, so the cache cannot violate the §3.1 freshness clause.

node/browser branch (peer-free, DOM-lib-free — §2.4):

• 'durable': localStorage. 'session': sessionStorage (tab-scoped). ⚠ Web storage is NOT a security boundary — any XSS on the origin can read the tokens (§7-12).
• getTokens is always a read-through (no cache) and prefers sessionStorage, and the persistence mode is derived from where a complete pair actually lives (H14).
• Missing localStorage/sessionStorage (SSR): memory-only fallback, no throw (§2.4).