public class HealthStore

Whether samples of type can be deleted. Both platforms restrict deletion to data this app wrote. Whether this store can de-duplicate overlapping sources when it aggregates.

False everywhere by default, and the honest answer for most stores: the shared rollup computes every metric from raw samples, so a phone and a watch that both recorded one walk contribute it twice.

HealthKit’s statistics engine does de-duplicate, which is a real capability this API refused to expose while it levelled the two platforms down to the behaviour of the weaker one. A store that overrides this to true honours AggregateQuery.setDeduplicateSources(boolean); one that does not rejects the request rather than quietly ignoring it, so an app can tell the difference between “de-duplicated” and “counted twice” instead of comparing totals and guessing.

Presents the platform authorization UI for the requested access.

Resolving true means the flow completed, not that access was granted. On iOS the sheet completes identically whether the user enabled every switch or none of them, and HealthKit will not say which. Treat true as “the user has now been asked”.

Only Android distinguishes an explicit dismissal, which fails with HealthError.USER_CANCELED.

This app’s read authorization for type.

Returns HealthAuthorizationStatus.UNKNOWN on iOS in every case. HealthKit deliberately refuses to disclose read authorization, because an app that could tell the difference between “denied” and “no data” could infer that a user is hiding a pregnancy or a prescription. Android answers truthfully, because its read permissions are ordinary runtime grants.

The Android port does not paper over the difference by pretending iOS behaves the same way, and neither should your UI: never tell a user “you denied access” on the strength of this. Say “no data available” and offer Health.openHealthSettings().

See hasAnyData(HealthDataType,HealthTimeRange) for the only honest probe.

Whether presenting the authorization sheet would show the user anything – see HealthRequestStatus. Useful for deciding whether to show your own explainer screen first.

Answers HealthRequestStatus.UNKNOWN on both phones in this release. Neither port implements the query yet – HealthKit’s getRequestStatusForAuthorization and a Health Connect grant comparison are what would answer it – so the documented SHOULD_REQUEST and UNNECESSARY answers never arrive there and an explainer gated on them would never show. Show the explainer on your own terms until this reports something else, and treat UNKNOWN as “ask anyway”: requesting authorization that is already granted is harmless on both platforms.

Runs a bounded query and reports whether any sample came back.

This measures data presence, not permission, and the name says so on purpose. On iOS a false means “denied, or genuinely no data” and the two are indistinguishable – that is a platform privacy guarantee, not a gap in this API.

Note also that on iOS your own writes remain readable to you even when read access was denied, so true does not prove you can see other apps’ data.

Reads samples, following paging until the query’s limit is reached or the data runs out.

Results are normalized: values arrive in the query’s unit or the type’s canonical unit, and series are flattened unless SampleQuery.setFlattenSeries(boolean) says otherwise.

Fails resource with HealthError.TIMEOUT if the platform never answers.

getOperationTimeout() was settable and documented and nothing ever armed a timer, so a native call that lost its callback left the operation pending forever – which is precisely the case the setting exists for.

Summarizes data into time buckets.

Returns one AggregateResult per bucket, in chronological order, including buckets that held no data – those come back empty rather than being omitted, so a chart can render a gap where a gap belongs. Read the double-counting warning on AggregateQuery before trusting a cross-platform total.

Aggregates raw samples into the query’s buckets.

This is the one implementation of the arithmetic. Ports that have a native aggregation API can override doAggregate and use it; ports that do not get this for free, which is what stops a total computed on iOS from disagreeing with the same total computed on Android because two implementations rounded differently.

Computes the bucket boundaries for a query, as n+1 timestamps bounding n buckets.

Exposed to ports because both platforms want the boundaries up front, and because getting daylight-saving right exactly once is better than getting it wrong twice.

Writes several samples, chunking to getMaxWriteBatchSize().

Rejects before touching the platform: types this app cannot write, instantaneous samples of interval-only types such as HealthDataType.STEPS, and quantities whose unit measures the wrong dimension. Catching these here turns what would be an opaque platform exception into a message that names the offending sample.

Subscribes with a listener that survives the app being killed.

backgroundListenerClass must be a public top-level class with a public no-argument constructor implementing HealthBackgroundListener – see that interface for the full contract.

Drains pending changes for every active subscription, resolving with the number of batches delivered.

Your app decides when this happens. Nothing here hooks the application lifecycle, so call it when you come to the foreground, and from your background-fetch handler – Health Connect never wakes the app on its own, and this release registers no HKObserverQuery either, so nothing else will notice new data while your app is closed. HealthSubscription.isPushDelivery() answers false everywhere for the same reason.

Overlapping calls are coalesced: a drain started while one is already running does not read the same change window a second time, it resolves alongside the one in flight.

Delivers a batch to whichever listener the subscription registered, on the EDT.

The cursor is persisted only after the listener returns. That ordering means a crash inside a listener costs one redelivered batch rather than losing the data permanently – the opposite ordering would advance past data the app never actually processed.

Installs the build-generated factory that constructs background listeners after a process relaunch.

Called by code the build server injects into app startup, in the same way the Android port’s native bridges are registered. There is deliberately no reflective fallback – see HealthBackgroundListenerFactory for why resolving a class by name is the wrong mechanism on these targets.

Seeds a subscription’s starting cursor in memory and on disk, for a port that establishes one at registration – the Health Connect baseline token, say.

Both halves are needed. Persisting alone looked correct and did nothing: the next drain still found a null anchor on the handle, took a fresh cursor, and skipped exactly the window the seed existed to cover.

The seed is dropped, not applied, in two cases, because the cursor it carries comes from a platform call that started earlier and may land arbitrarily late:

• the handle is no longer the registered one. It was stopped, or replaced by a new subscription reusing the id. Applying it would restore a cursor unsubscribe() promised to discard, or hand a fresh subscription a cursor issued for a different set of types.
• the handle already has a cursor. Something has advanced past this seed – a drain that ran while it was in flight, or a restored cursor from a previous launch – and rewinding to it would re-deliver changes the app has already been told about.

Returns whether the seed was applied, so a port can tell a dropped seed from an accepted one.

Drops a subscription’s cursor, in memory and on disk.

For a cursor the platform has rejected outright – a Health Connect change token that has aged out, say. Clearing only the persisted copy is not enough: the drains read the live handle, so the next one would resend the very token that just failed and keep failing identically forever.

Re-registers every subscription persisted by a previous launch.

This is what makes a subscription survive the process being killed: without it, an app relaunched into the background has no idea it was ever watching anything.

It runs on its own, the first time anything touches subscriptions – see ensureSubscriptionsRestored. It used to be documented as something ports had to call from their constructor, which no port did, so persisted subscriptions were silently never restored on any platform. A constructor could not have called it safely anyway: it dispatches to doSubscribe, which a subclass has not finished initialising at that point.

Sets the authorization safety timeout in milliseconds.

Separate from the operation timeout because this one is waiting on a person rather than on a platform call, so it is far longer by default. It also bounds how long a queued authorization can wait: the screen is released when the active flow settles, and this is what guarantees that happens.

Computes bucketed aggregates. boundaries holds n+1 timestamps bounding n buckets, already daylight-saving correct.

Unlike the rest of the port SPI this does not default to NOT_SUPPORTED. Neither HealthKit nor Health Connect gives us an aggregation we can use directly for every metric this API exposes, so the default reads the raw samples and runs the shared arithmetic in aggregateSamples. A port only overrides this when its native aggregation is genuinely better – and if it does, it owes the same answers.

The fallback aggregation: read every requested type over the query’s range, then bucket the samples locally.

Reads one type at a time because HealthKit accepts only one type per query, and it is the narrower contract of the two.

Reports whether the authorization sheet would show anything.

No mobile port overrides this yet, so both phones answer UNKNOWN; the public method says so. HealthKit answers it through getRequestStatusForAuthorization, and Health Connect through comparing the granted permission set against the requested one – each of which is a real piece of work rather than a mapping.

Registers a platform observer for subscription, resuming from HealthSubscription.getAnchor() when a cursor was persisted. Called on registration and again on restoreSubscriptions().

The live handle is passed rather than the bare anchor because a port that establishes a starting cursor asynchronously has to be able to tell, when its answer arrives, whether the registration it answers for is still the current one – see seedAnchor(HealthSubscription,HealthAnchor).

Tears down the platform observer belonging to subscription.

The handle, not the id: another registration under the same id can land between the removal and this call, and a teardown that works by id alone then dismantles the replacement’s platform state. A port must key its own bookkeeping on this instance so it tears down the generation that was actually cancelled.