From 8c27e8eafa87baa4810896d63a569a4aec46c1ef Mon Sep 17 00:00:00 2001
From: byGalax <dennis@landmann.dev>
Date: Sat, 16 May 2026 16:41:18 +0200
Subject: [PATCH] feat(mobile): legacyDeviceVault helper for per-device key
 probing

---
 apps/mobile/lib/legacyDeviceVault.ts | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 apps/mobile/lib/legacyDeviceVault.ts

diff --git a/apps/mobile/lib/legacyDeviceVault.ts b/apps/mobile/lib/legacyDeviceVault.ts
new file mode 100644
index 0000000..81d50dc
--- /dev/null
+++ b/apps/mobile/lib/legacyDeviceVault.ts
@@ -0,0 +1,9 @@
+import { secretStore } from './secretStore';
+
+// During the migration window the orchestrator probes SecureStore for legacy
+// per-device private keys. We keep this read-only — never write — so a future
+// reset can safely wipe the new chatapp.userpriv.* slot without affecting
+// pre-existing legacy entries.
+export function legacyDeviceKey(userId: string, deviceId: string): Promise<Uint8Array | null> {
+  return secretStore.getSecret('chatapp.priv.' + userId + '.' + deviceId);
+}