[AAv2] Integrate on-device APIs (#9564)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

src/ageAssurance/types.ts

@@ -1,7 +1,24 @@
+import type * as AgeRange from 'expo-age-range'
 import {type computeAgeAssuranceRegionAccess} from '@atproto/api'
 
 import {logger} from '#/ageAssurance/logger'
 
+/**
+ * Native on-device age signals, keyed by the region (a `country[-region]`
+ * string, see `createRegionKey`) they were captured in. We keep one entry per
+ * region so multiple regions with differing criteria can each retain their own
+ * grant.
+ *
+ * Device assurance can't be verified server-side (the OS gives us no signed
+ * attestation, only age bounds), so we persist it client-side only and bind it
+ * to its capture region via the key. A grant captured in TX is only ever read
+ * back for TX — it can't silently unlock another region. See
+ * `getAgeAssuranceDataFromDeviceSignals`.
+ */
+export type AgeAssuranceDeviceSignals = {
+  [regionKey: string]: AgeRange.AgeRangeResponse
+}
+
 export enum AgeAssuranceAccess {
   Unknown = 'unknown',
   None = 'none',
@@ -34,9 +51,12 @@ export type AgeAssuranceFlags = {
   adultContentDisabled: boolean
   chatDisabled: boolean
   groupChatDisabled: boolean
+  hasDeclaredAge: boolean
   isDeclaredUnderAdultAge: boolean
   isOverRegionMinAccessAge: boolean
   isOverAppMinAccessAge: boolean
+  allowsDeviceVerification: boolean
+  hasSharedDeviceSignals: boolean
 }
 
 export function parseStatusFromString(raw: string) {