@everfur/sdk 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -4,10 +4,23 @@ All notable changes to `@everfur/sdk`.
 
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Versions are semver.
 
-This is the first release. The line is deliberately pre-1.0: the API is stable enough to build against and
+The line is deliberately pre-1.0: the API is stable enough to build against and
 is guarded by api-extractor golden reports across all eleven subpaths, but 1.0.0 is a promise about breaking
 changes that has not been earned by any production integration yet.
 
+## [0.1.1] - 2026-09-03
+
+### Fixed — privacy
+
+- **An anonymous logout left mounted surfaces on the previous visitor's session.** `logout()` from an
+  already-anonymous state compared `userRef` to `userRef`, saw null-to-null, and took its same-identity
+  path: the session id rotated but surfaces already mounted (chat, records, photo, video) kept rendering
+  against the scope they were mounted with. On a shared or kiosk device the next visitor could see the
+  previous one's conversation. Every mounted surface is now rescoped on logout regardless of whether the
+  identity appears to have changed.
+
+  Shipped in 0.1.0. Anyone on 0.1.0 should upgrade.
+
 ## [0.1.0] - 2026-08-23
 
 ### Fixed — correctness

package/dist/chat/index.cjs

@@ -456,7 +456,7 @@ var BOOTSTRAP_SNAPSHOT = Object.freeze({
   suggestedPrompts: Object.freeze([])
 });
 function useEverfurChat(opts) {
-  const { runtime, userRef, activePet } = useEverfurContext();
+  const { runtime, userRef, activePet, scopeEpoch } = useEverfurContext();
   const petRef = opts?.petRef ?? activePet ?? null;
   const conversationId = opts?.conversationId ?? null;
   const [controller, setController] = react.useState(null);
@@ -467,7 +467,7 @@ function useEverfurChat(opts) {
       setController((current) => current === acquired ? null : current);
       runtime.registry.releaseChat(acquired);
     };
-  }, [runtime, userRef, petRef, conversationId]);
+  }, [runtime, userRef, petRef, conversationId, scopeEpoch]);
   const subscribe = react.useCallback(
     (onChange) => controller ? controller.subscribe(onChange) : NOOP_UNSUBSCRIBE,
     [controller]

package/dist/chat/index.js

@@ -454,7 +454,7 @@ var BOOTSTRAP_SNAPSHOT = Object.freeze({
   suggestedPrompts: Object.freeze([])
 });
 function useEverfurChat(opts) {
-  const { runtime, userRef, activePet } = useEverfurContext();
+  const { runtime, userRef, activePet, scopeEpoch } = useEverfurContext();
   const petRef = opts?.petRef ?? activePet ?? null;
   const conversationId = opts?.conversationId ?? null;
   const [controller, setController] = useState(null);
@@ -465,7 +465,7 @@ function useEverfurChat(opts) {
       setController((current) => current === acquired ? null : current);
       runtime.registry.releaseChat(acquired);
     };
-  }, [runtime, userRef, petRef, conversationId]);
+  }, [runtime, userRef, petRef, conversationId, scopeEpoch]);
   const subscribe = useCallback(
     (onChange) => controller ? controller.subscribe(onChange) : NOOP_UNSUBSCRIBE,
     [controller]

package/dist/core/index.cjs

@@ -2878,7 +2878,7 @@ var EverfurRuntimeImpl = class {
     this.uploadTransport = cfg.uploadTransport ?? unavailableUploadTransport;
     this.imageCache = cfg.imageCache ?? noopImageCache;
     this.kv = cfg.storage ?? createInMemoryKv();
-    this.currentUser = input.user;
+    this.currentUser = input.user ?? null;
     this.identity = input.user ? createIdentityProvider(input.user.userRef, input.user.getToken) : null;
     this.activePet = input.activePet;
     this.store = failure === null ? createEntitlementStore() : createEntitlementStore(() => deniedDecisionsFor("sdk_config", userFacingError("accessDenied")));
@@ -2912,6 +2912,9 @@ var EverfurRuntimeImpl = class {
   get isDisposed() {
     return this.disposed;
   }
+  get scopeEpoch() {
+    return this.epoch;
+  }
   /**
    * Build the entitlement poller. `authFor` re-derives the device AuthContext each poll (so a token refresh /
    * re-scope is reflected), and `update` feeds the resolved decisions into the render store. The SERVER stays

package/dist/core/index.d.cts

@@ -1,5 +1,5 @@
 export { K as KvPort } from '../cacheEpoch-DknKn3S0.cjs';
-export { C as CapabilityKind, a as CapabilityRegistry, b as CapabilityServices, c as ChatControllerRegistry, d as ChatScope, e as CreateEverfurRuntimeInput, f as CreateRuntimeOptions, E as EntitlementPoller, g as EntitlementPollerDeps, h as EntitlementSnapshot, i as EntitlementStore, j as EverfurRuntime, k as EverfurRuntimeConfig, L as LogLevel, l as LogRecord, m as LogSink, M as MIN_POLL_INTERVAL_SECONDS, N as NULL_SECURE_STORE, P as PollScheduler, R as RuntimeTheme, n as RuntimeUser, S as SecureStorePort, T as TimerHandle, o as createEntitlementPoller, p as createEverfurRuntime } from '../runtime-BgQnA594.cjs';
+export { C as CapabilityKind, a as CapabilityRegistry, b as CapabilityServices, c as ChatControllerRegistry, d as ChatScope, e as CreateEverfurRuntimeInput, f as CreateRuntimeOptions, E as EntitlementPoller, g as EntitlementPollerDeps, h as EntitlementSnapshot, i as EntitlementStore, j as EverfurRuntime, k as EverfurRuntimeConfig, L as LogLevel, l as LogRecord, m as LogSink, M as MIN_POLL_INTERVAL_SECONDS, N as NULL_SECURE_STORE, P as PollScheduler, R as RuntimeTheme, n as RuntimeUser, S as SecureStorePort, T as TimerHandle, o as createEntitlementPoller, p as createEverfurRuntime } from '../runtime-Bvr8yqXm.cjs';
 export { T as TelemetryPort, n as noopTelemetry } from '../TelemetryPort-BDNr00hu.cjs';
 import { S as SuggestedPromptCategory, C as ChatController } from '../ChatController-CpUMvvZf.cjs';
 export { a as ChatControllerDeps, b as ChatHandlers, c as ChatMessage, d as ChatSnapshot, e as ChatStatus, f as Citation, E as ErrorPolicyPort, M as MESSAGE_MAX_CHARS, g as SendOptions, T as Timers, h as createChatController, i as defaultErrorPolicy } from '../ChatController-CpUMvvZf.cjs';

package/dist/core/index.d.ts

@@ -1,5 +1,5 @@
 export { K as KvPort } from '../cacheEpoch-DknKn3S0.js';
-export { C as CapabilityKind, a as CapabilityRegistry, b as CapabilityServices, c as ChatControllerRegistry, d as ChatScope, e as CreateEverfurRuntimeInput, f as CreateRuntimeOptions, E as EntitlementPoller, g as EntitlementPollerDeps, h as EntitlementSnapshot, i as EntitlementStore, j as EverfurRuntime, k as EverfurRuntimeConfig, L as LogLevel, l as LogRecord, m as LogSink, M as MIN_POLL_INTERVAL_SECONDS, N as NULL_SECURE_STORE, P as PollScheduler, R as RuntimeTheme, n as RuntimeUser, S as SecureStorePort, T as TimerHandle, o as createEntitlementPoller, p as createEverfurRuntime } from '../runtime-CBA-LvdM.js';
+export { C as CapabilityKind, a as CapabilityRegistry, b as CapabilityServices, c as ChatControllerRegistry, d as ChatScope, e as CreateEverfurRuntimeInput, f as CreateRuntimeOptions, E as EntitlementPoller, g as EntitlementPollerDeps, h as EntitlementSnapshot, i as EntitlementStore, j as EverfurRuntime, k as EverfurRuntimeConfig, L as LogLevel, l as LogRecord, m as LogSink, M as MIN_POLL_INTERVAL_SECONDS, N as NULL_SECURE_STORE, P as PollScheduler, R as RuntimeTheme, n as RuntimeUser, S as SecureStorePort, T as TimerHandle, o as createEntitlementPoller, p as createEverfurRuntime } from '../runtime-BIYzf9cK.js';
 export { T as TelemetryPort, n as noopTelemetry } from '../TelemetryPort-BDNr00hu.js';
 import { S as SuggestedPromptCategory, C as ChatController } from '../ChatController-CKdBvPj2.js';
 export { a as ChatControllerDeps, b as ChatHandlers, c as ChatMessage, d as ChatSnapshot, e as ChatStatus, f as Citation, E as ErrorPolicyPort, M as MESSAGE_MAX_CHARS, g as SendOptions, T as Timers, h as createChatController, i as defaultErrorPolicy } from '../ChatController-CKdBvPj2.js';

package/dist/core/index.js

@@ -2876,7 +2876,7 @@ var EverfurRuntimeImpl = class {
     this.uploadTransport = cfg.uploadTransport ?? unavailableUploadTransport;
     this.imageCache = cfg.imageCache ?? noopImageCache;
     this.kv = cfg.storage ?? createInMemoryKv();
-    this.currentUser = input.user;
+    this.currentUser = input.user ?? null;
     this.identity = input.user ? createIdentityProvider(input.user.userRef, input.user.getToken) : null;
     this.activePet = input.activePet;
     this.store = failure === null ? createEntitlementStore() : createEntitlementStore(() => deniedDecisionsFor("sdk_config", userFacingError("accessDenied")));
@@ -2910,6 +2910,9 @@ var EverfurRuntimeImpl = class {
   get isDisposed() {
     return this.disposed;
   }
+  get scopeEpoch() {
+    return this.epoch;
+  }
   /**
    * Build the entitlement poller. `authFor` re-derives the device AuthContext each poll (so a token refresh /
    * re-scope is reflected), and `update` feeds the resolved decisions into the render store. The SERVER stays

package/dist/index.cjs

@@ -3230,7 +3230,7 @@ var EverfurRuntimeImpl = class {
     this.uploadTransport = cfg.uploadTransport ?? unavailableUploadTransport;
     this.imageCache = cfg.imageCache ?? noopImageCache;
     this.kv = cfg.storage ?? createInMemoryKv();
-    this.currentUser = input.user;
+    this.currentUser = input.user ?? null;
     this.identity = input.user ? createIdentityProvider(input.user.userRef, input.user.getToken) : null;
     this.activePet = input.activePet;
     this.store = failure === null ? createEntitlementStore() : createEntitlementStore(() => deniedDecisionsFor("sdk_config", userFacingError("accessDenied")));
@@ -3264,6 +3264,9 @@ var EverfurRuntimeImpl = class {
   get isDisposed() {
     return this.disposed;
   }
+  get scopeEpoch() {
+    return this.epoch;
+  }
   /**
    * Build the entitlement poller. `authFor` re-derives the device AuthContext each poll (so a token refresh /
    * re-scope is reflected), and `update` feeds the resolved decisions into the render store. The SERVER stays
@@ -3626,7 +3629,7 @@ function EverfurProvider(props) {
   const configKey = `${config?.publishableKey ?? ""}|${config?.apiBaseUrl ?? ""}|${config?.contractVersion ?? ""}`;
   const runtimeRef = react.useRef(null);
   const supersededRef = react.useRef(null);
-  const [, scheduleRender] = react.useReducer((n) => n + 1, 0);
+  const [renderTick, scheduleRender] = react.useReducer((n) => n + 1, 0);
   const imperativeUserRef = react.useRef(null);
   const lastPropUserRef = react.useRef(void 0);
   const propUserRefKey = user?.userRef ?? null;
@@ -3718,9 +3721,12 @@ function EverfurProvider(props) {
       runtime,
       handle,
       userRef: userRefKey,
-      activePet: effectivePet
+      activePet: effectivePet,
+      scopeEpoch: runtime.scopeEpoch
     }),
-    [runtime, handle, userRefKey, effectivePet]
+    // renderTick is in the deps precisely BECAUSE it is not in the body: an imperative verb bumps it,
+    // which re-reads runtime.scopeEpoch above. Without it the epoch is captured once and frozen.
+    [runtime, handle, userRefKey, effectivePet, renderTick]
   );
   return react.createElement(
     EverfurContext.Provider,
@@ -3854,7 +3860,7 @@ var BOOTSTRAP_SNAPSHOT = Object.freeze({
   suggestedPrompts: Object.freeze([])
 });
 function useEverfurChat(opts) {
-  const { runtime, userRef: userRef2, activePet } = useEverfurContext();
+  const { runtime, userRef: userRef2, activePet, scopeEpoch } = useEverfurContext();
   const petRef2 = opts?.petRef ?? activePet ?? null;
   const conversationId2 = opts?.conversationId ?? null;
   const [controller, setController] = react.useState(null);
@@ -3865,7 +3871,7 @@ function useEverfurChat(opts) {
       setController((current) => current === acquired ? null : current);
       runtime.registry.releaseChat(acquired);
     };
-  }, [runtime, userRef2, petRef2, conversationId2]);
+  }, [runtime, userRef2, petRef2, conversationId2, scopeEpoch]);
   const subscribe = react.useCallback(
     (onChange) => controller ? controller.subscribe(onChange) : NOOP_UNSUBSCRIBE,
     [controller]

package/dist/index.d.cts

@@ -7,8 +7,8 @@ export { T as TokenProvider } from './identity-Brl-lDd6.cjs';
 import { b as CapabilityName, C as CapabilityDecision } from './resolve-Dq_4_agU.cjs';
 export { a as CapabilityDisabled, c as DisabledLevel } from './resolve-Dq_4_agU.cjs';
 import { K as KvPort, I as ImageCachePort } from './cacheEpoch-DknKn3S0.cjs';
-import { S as SecureStorePort, m as LogSink, U as UploadPort, q as UploadTransport, j as EverfurRuntime } from './runtime-BgQnA594.cjs';
-export { L as LogLevel, l as LogRecord, r as PresignedPolicy, s as UploadPolicyWire } from './runtime-BgQnA594.cjs';
+import { S as SecureStorePort, m as LogSink, U as UploadPort, q as UploadTransport, j as EverfurRuntime } from './runtime-Bvr8yqXm.cjs';
+export { L as LogLevel, l as LogRecord, r as PresignedPolicy, s as UploadPolicyWire } from './runtime-Bvr8yqXm.cjs';
 import { T as TelemetryPort } from './TelemetryPort-BDNr00hu.cjs';
 import { C as CameraPort } from './CameraPort-Cv31Pz7g.cjs';
 export { a as CaptureOptions, M as MediaSource } from './CameraPort-Cv31Pz7g.cjs';

package/dist/index.d.ts

@@ -7,8 +7,8 @@ export { T as TokenProvider } from './identity-DK9zORrG.js';
 import { b as CapabilityName, C as CapabilityDecision } from './resolve-Dq_4_agU.js';
 export { a as CapabilityDisabled, c as DisabledLevel } from './resolve-Dq_4_agU.js';
 import { K as KvPort, I as ImageCachePort } from './cacheEpoch-DknKn3S0.js';
-import { S as SecureStorePort, m as LogSink, U as UploadPort, q as UploadTransport, j as EverfurRuntime } from './runtime-CBA-LvdM.js';
-export { L as LogLevel, l as LogRecord, r as PresignedPolicy, s as UploadPolicyWire } from './runtime-CBA-LvdM.js';
+import { S as SecureStorePort, m as LogSink, U as UploadPort, q as UploadTransport, j as EverfurRuntime } from './runtime-BIYzf9cK.js';
+export { L as LogLevel, l as LogRecord, r as PresignedPolicy, s as UploadPolicyWire } from './runtime-BIYzf9cK.js';
 import { T as TelemetryPort } from './TelemetryPort-BDNr00hu.js';
 import { C as CameraPort } from './CameraPort-Cv31Pz7g.js';
 export { a as CaptureOptions, M as MediaSource } from './CameraPort-Cv31Pz7g.js';

package/dist/index.js

@@ -3224,7 +3224,7 @@ var EverfurRuntimeImpl = class {
     this.uploadTransport = cfg.uploadTransport ?? unavailableUploadTransport;
     this.imageCache = cfg.imageCache ?? noopImageCache;
     this.kv = cfg.storage ?? createInMemoryKv();
-    this.currentUser = input.user;
+    this.currentUser = input.user ?? null;
     this.identity = input.user ? createIdentityProvider(input.user.userRef, input.user.getToken) : null;
     this.activePet = input.activePet;
     this.store = failure === null ? createEntitlementStore() : createEntitlementStore(() => deniedDecisionsFor("sdk_config", userFacingError("accessDenied")));
@@ -3258,6 +3258,9 @@ var EverfurRuntimeImpl = class {
   get isDisposed() {
     return this.disposed;
   }
+  get scopeEpoch() {
+    return this.epoch;
+  }
   /**
    * Build the entitlement poller. `authFor` re-derives the device AuthContext each poll (so a token refresh /
    * re-scope is reflected), and `update` feeds the resolved decisions into the render store. The SERVER stays
@@ -3620,7 +3623,7 @@ function EverfurProvider(props) {
   const configKey = `${config?.publishableKey ?? ""}|${config?.apiBaseUrl ?? ""}|${config?.contractVersion ?? ""}`;
   const runtimeRef = useRef(null);
   const supersededRef = useRef(null);
-  const [, scheduleRender] = useReducer((n) => n + 1, 0);
+  const [renderTick, scheduleRender] = useReducer((n) => n + 1, 0);
   const imperativeUserRef = useRef(null);
   const lastPropUserRef = useRef(void 0);
   const propUserRefKey = user?.userRef ?? null;
@@ -3712,9 +3715,12 @@ function EverfurProvider(props) {
       runtime,
       handle,
       userRef: userRefKey,
-      activePet: effectivePet
+      activePet: effectivePet,
+      scopeEpoch: runtime.scopeEpoch
     }),
-    [runtime, handle, userRefKey, effectivePet]
+    // renderTick is in the deps precisely BECAUSE it is not in the body: an imperative verb bumps it,
+    // which re-reads runtime.scopeEpoch above. Without it the epoch is captured once and frozen.
+    [runtime, handle, userRefKey, effectivePet, renderTick]
   );
   return createElement(
     EverfurContext.Provider,
@@ -3848,7 +3854,7 @@ var BOOTSTRAP_SNAPSHOT = Object.freeze({
   suggestedPrompts: Object.freeze([])
 });
 function useEverfurChat(opts) {
-  const { runtime, userRef: userRef2, activePet } = useEverfurContext();
+  const { runtime, userRef: userRef2, activePet, scopeEpoch } = useEverfurContext();
   const petRef2 = opts?.petRef ?? activePet ?? null;
   const conversationId2 = opts?.conversationId ?? null;
   const [controller, setController] = useState(null);
@@ -3859,7 +3865,7 @@ function useEverfurChat(opts) {
       setController((current) => current === acquired ? null : current);
       runtime.registry.releaseChat(acquired);
     };
-  }, [runtime, userRef2, petRef2, conversationId2]);
+  }, [runtime, userRef2, petRef2, conversationId2, scopeEpoch]);
   const subscribe = useCallback(
     (onChange) => controller ? controller.subscribe(onChange) : NOOP_UNSUBSCRIBE,
     [controller]

package/dist/photo/index.cjs

@@ -1532,7 +1532,7 @@ var BOOTSTRAP_SNAPSHOT = Object.freeze({
 var NOOP_UNSUBSCRIBE = () => {
 };
 function usePhotoCheckup(opts) {
-  const { runtime, userRef } = useEverfurContext();
+  const { runtime, userRef, scopeEpoch } = useEverfurContext();
   const petRef = opts.petRef;
   const [controller, setController] = react.useState(null);
   react.useEffect(() => {
@@ -1554,7 +1554,7 @@ function usePhotoCheckup(opts) {
       setController((current) => current === acquired ? null : current);
       runtime.registry.release(acquired);
     };
-  }, [runtime, userRef, petRef]);
+  }, [runtime, userRef, petRef, scopeEpoch]);
   const subscribe = react.useCallback(
     (onChange) => controller ? controller.subscribe(onChange) : NOOP_UNSUBSCRIBE,
     [controller]

package/dist/photo/index.js

@@ -1530,7 +1530,7 @@ var BOOTSTRAP_SNAPSHOT = Object.freeze({
 var NOOP_UNSUBSCRIBE = () => {
 };
 function usePhotoCheckup(opts) {
-  const { runtime, userRef } = useEverfurContext();
+  const { runtime, userRef, scopeEpoch } = useEverfurContext();
   const petRef = opts.petRef;
   const [controller, setController] = useState(null);
   useEffect(() => {
@@ -1552,7 +1552,7 @@ function usePhotoCheckup(opts) {
       setController((current) => current === acquired ? null : current);
       runtime.registry.release(acquired);
     };
-  }, [runtime, userRef, petRef]);
+  }, [runtime, userRef, petRef, scopeEpoch]);
   const subscribe = useCallback(
     (onChange) => controller ? controller.subscribe(onChange) : NOOP_UNSUBSCRIBE,
     [controller]

package/dist/records/index.cjs

@@ -1561,7 +1561,7 @@ var POLL_INTERVAL_MS = 4e3;
 var MAX_POLLS = 30;
 function useEverfurRecords(opts) {
   const { petRef } = opts;
-  const { runtime, userRef } = useEverfurContext();
+  const { runtime, userRef, scopeEpoch } = useEverfurContext();
   const [controller, setController] = react.useState(opts.controller ?? null);
   const [snap, setSnap] = react.useState(INITIAL);
   const generation = react.useRef(0);
@@ -1594,7 +1594,7 @@ function useEverfurRecords(opts) {
       runtime.registry.release(acquired);
       setController((current) => current === acquired ? null : current);
     };
-  }, [runtime, userRef, petRef, opts.controller]);
+  }, [runtime, userRef, petRef, opts.controller, scopeEpoch]);
   const patch = react.useCallback((partial) => {
     setSnap((current) => ({ ...current, ...partial }));
   }, []);

package/dist/records/index.js

@@ -1559,7 +1559,7 @@ var POLL_INTERVAL_MS = 4e3;
 var MAX_POLLS = 30;
 function useEverfurRecords(opts) {
   const { petRef } = opts;
-  const { runtime, userRef } = useEverfurContext();
+  const { runtime, userRef, scopeEpoch } = useEverfurContext();
   const [controller, setController] = useState(opts.controller ?? null);
   const [snap, setSnap] = useState(INITIAL);
   const generation = useRef(0);
@@ -1592,7 +1592,7 @@ function useEverfurRecords(opts) {
       runtime.registry.release(acquired);
       setController((current) => current === acquired ? null : current);
     };
-  }, [runtime, userRef, petRef, opts.controller]);
+  }, [runtime, userRef, petRef, opts.controller, scopeEpoch]);
   const patch = useCallback((partial) => {
     setSnap((current) => ({ ...current, ...partial }));
   }, []);

package/dist/{runtime-CBA-LvdM.d.ts → runtime-BIYzf9cK.d.ts}

@@ -277,6 +277,19 @@ interface EverfurRuntime {
      * dead runtime.
      */
     readonly isDisposed: boolean;
+    /**
+     * Bumped by every re-scope. React surfaces put this in their acquire-effect deps so an imperative
+     * verb that changes no identity STRING still re-acquires.
+     *
+     * WHY THIS EXISTS. `logout()` on an already-anonymous runtime rotates the session id and re-scopes,
+     * but nothing a React effect watches changes: `userRef` is null on both sides, so the context memo
+     * republishes the same object and the effect never re-runs. The mounted surface kept serving the
+     * PREVIOUS anonymous visitor's scope, because the captured AuthContext holds the OLD session id and
+     * the widget plane derives anonymous identity as `anon-{session_id}`. On a shared device that is one
+     * visitor reading the last one's conversation. The epoch is the only thing that changes in that
+     * transition, so it is the only honest dep.
+     */
+    readonly scopeEpoch: number;
     readonly entitlements: EntitlementStore;
     /** null => logout: drops the cached bearer and re-scopes every open capability. */
     setUser(user: RuntimeUser | null): void;

package/dist/{runtime-BgQnA594.d.cts → runtime-Bvr8yqXm.d.cts}

@@ -277,6 +277,19 @@ interface EverfurRuntime {
      * dead runtime.
      */
     readonly isDisposed: boolean;
+    /**
+     * Bumped by every re-scope. React surfaces put this in their acquire-effect deps so an imperative
+     * verb that changes no identity STRING still re-acquires.
+     *
+     * WHY THIS EXISTS. `logout()` on an already-anonymous runtime rotates the session id and re-scopes,
+     * but nothing a React effect watches changes: `userRef` is null on both sides, so the context memo
+     * republishes the same object and the effect never re-runs. The mounted surface kept serving the
+     * PREVIOUS anonymous visitor's scope, because the captured AuthContext holds the OLD session id and
+     * the widget plane derives anonymous identity as `anon-{session_id}`. On a shared device that is one
+     * visitor reading the last one's conversation. The epoch is the only thing that changes in that
+     * transition, so it is the only honest dep.
+     */
+    readonly scopeEpoch: number;
     readonly entitlements: EntitlementStore;
     /** null => logout: drops the cached bearer and re-scopes every open capability. */
     setUser(user: RuntimeUser | null): void;

package/dist/testing/rn/index.d.cts

@@ -1,4 +1,4 @@
-import { h as EntitlementSnapshot } from '../../runtime-BgQnA594.cjs';
+import { h as EntitlementSnapshot } from '../../runtime-Bvr8yqXm.cjs';
 export { C as ClientBranding } from '../../petsRepository-BEGb97M9.cjs';
 export { a as CapabilityDisabled, c as DisabledLevel, E as EntitlementDecision } from '../../resolve-Dq_4_agU.cjs';
 import { ReactNode } from 'react';

package/dist/testing/rn/index.d.ts

@@ -1,4 +1,4 @@
-import { h as EntitlementSnapshot } from '../../runtime-CBA-LvdM.js';
+import { h as EntitlementSnapshot } from '../../runtime-BIYzf9cK.js';
 export { C as ClientBranding } from '../../petsRepository-Bu18r2kK.js';
 export { a as CapabilityDisabled, c as DisabledLevel, E as EntitlementDecision } from '../../resolve-Dq_4_agU.js';
 import { ReactNode } from 'react';

package/dist/video/index.cjs

@@ -1513,7 +1513,7 @@ var BOOTSTRAP_SNAPSHOT = Object.freeze({
 var NOOP_UNSUBSCRIBE = () => {
 };
 function useEverfurVideo(opts) {
-  const { runtime, userRef, activePet } = useEverfurContext();
+  const { runtime, userRef, activePet, scopeEpoch } = useEverfurContext();
   const petRef = opts?.petRef ?? activePet ?? null;
   const [controller, setController] = react.useState(null);
   react.useEffect(() => {
@@ -1536,7 +1536,7 @@ function useEverfurVideo(opts) {
       setController((current) => current === acquired ? null : current);
       runtime.registry.release(acquired);
     };
-  }, [runtime, userRef, petRef]);
+  }, [runtime, userRef, petRef, scopeEpoch]);
   const subscribe = react.useCallback(
     (onChange) => controller ? controller.subscribe(onChange) : NOOP_UNSUBSCRIBE,
     [controller]

package/dist/video/index.js

@@ -1511,7 +1511,7 @@ var BOOTSTRAP_SNAPSHOT = Object.freeze({
 var NOOP_UNSUBSCRIBE = () => {
 };
 function useEverfurVideo(opts) {
-  const { runtime, userRef, activePet } = useEverfurContext();
+  const { runtime, userRef, activePet, scopeEpoch } = useEverfurContext();
   const petRef = opts?.petRef ?? activePet ?? null;
   const [controller, setController] = useState(null);
   useEffect(() => {
@@ -1534,7 +1534,7 @@ function useEverfurVideo(opts) {
       setController((current) => current === acquired ? null : current);
       runtime.registry.release(acquired);
     };
-  }, [runtime, userRef, petRef]);
+  }, [runtime, userRef, petRef, scopeEpoch]);
   const subscribe = useCallback(
     (onChange) => controller ? controller.subscribe(onChange) : NOOP_UNSUBSCRIBE,
     [controller]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everfur/sdk",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Embed Everfur veterinary chat, health records, and pet-state surfaces in your React Native app.",
   "license": "MIT",
   "repository": {