@fayz-ai/saas 0.8.0 → 0.8.2

package/src/shell/hooks/useChat.ts

@@ -1,13 +1,311 @@
-import { useCallback } from 'react'
+import { useCallback, useMemo } from 'react'
 import { useChatStore, type ChatMessage } from '../stores/chat.store'
+import { useOrganizationStore } from '../stores/organization.store'
+// The REAL auth store — @fayz-ai/auth is what AuthProvider hydrates (and the
+// same specifier AdminShell uses). shell/stores/auth.store is a legacy shim
+// nothing fills; reading it here sent EVERY turn anonymous, which an INTERNAL
+// channel rejects with AGENT_IDENTITY_REQUIRED (documented gotcha in
+// fayz/docs/architecture/platform/agents.md — the fix had only landed in the
+// retired -qa checkout).
+import { useAuthStore } from '@fayz-ai/auth'
+import { usePluginRuntimeOptional } from '../lib/plugins'
+import { useRouter } from '../lib/router'
+import { useTranslation } from './useTranslation'
+import { useAITools } from './useAITools'
+import {
+  buildAgentToolset,
+  buildDataToolIndex,
+  executeAITool,
+  executeRpcTool,
+  type AIToolExecutionContext,
+} from '../lib/ai-tool-handlers'
+import { entityToolName, registryToolName } from '../lib/core-ai-tools'
+import { getAllEntities, useManifest, type PluginAITool } from '@fayz-ai/core'
+import { checkAccess, guardLimit } from '../../access/headless'
+import { invalidateLimit } from '../../access/limits-registry'
+import {
+  getFayzAgentClient,
+  resolveFayzAgentConnection,
+  type FayzAgentConnectionConfig,
+} from '../lib/fayz-agent'
+import type { FayzAgentToolResult } from '@fayz-ai/sdk/agent'
+
+/**
+ * Caps how many times the model may call tools before it must answer in prose.
+ * Each round is a network turn, so a runaway loop is both slow and expensive.
+ */
+const MAX_TOOL_ROUNDS = 4
 
 interface UseChatOptions {
+  /** Bring-your-own backend. Takes precedence over the Fayz agent connection. */
   apiEndpoint?: string
   systemPrompt?: string
+  /** Fayz agent overrides; defaults to the env the container injects. */
+  agent?: FayzAgentConnectionConfig | false
 }
 
 export function useChat(options?: UseChatOptions) {
   const store = useChatStore()
+  const runtime = usePluginRuntimeOptional()
+  const router = useRouter()
+  const { t } = useTranslation()
+  const { tools, activePluginId } = useAITools()
+  const currentOrg = useOrganizationStore((s) => s.currentOrg)
+  const members = useOrganizationStore((s) => s.members)
+  const user = useAuthStore((s) => s.user)
+
+  // The project's Fayz agent, resolved from the env the container injects. An
+  // app-supplied apiEndpoint wins — that is an explicit opt-out.
+  const connection = useMemo(
+    () => (options?.apiEndpoint ? null : resolveFayzAgentConnection(options?.agent)),
+    [options?.apiEndpoint, options?.agent],
+  )
+
+  // The assistant is only "real" when something backs it. Without a backend we
+  // never fake a canned demo reply — the panel disables free-text input and, if
+  // a suggestion chip is clicked anyway, we answer with a clear notice.
+  const isConfigured = !!connection || !!options?.apiEndpoint
+
+  /**
+   * Run the agent turn loop against the project's Fayz agent.
+   *
+   * This is the follow-up the transport-only version of this hook described:
+   * the tool catalog plugins declare (useAITools) is already JSON-Schema shaped,
+   * so it forwards verbatim. Execution stays *client-plane* — the browser runs
+   * each call against the session that is already open and hands results back —
+   * because that is the only side that can touch the running UI (navigateTo) or
+   * the tenant's own data session, and it keeps Fayz free of app credentials.
+   * Server-plane tools (AgentTool grants) execute inside Fayz and never surface
+   * here.
+   */
+  const manifest = useManifest()
+  const serverPlane = manifest?.agent?.executionPlane === 'server'
+
+  /**
+   * Client-plane guard around a persist tool, mirroring the broker's
+   * server-plane order: role→plan (checkAccess) → cap (guardLimit) → human
+   * confirmation → execute → invalidate the consumed limit. A denial comes
+   * back to the model as the structured AgentDenial, so the paywall/permission
+   * explanation happens IN the conversation — never a silent failure
+   * (docs/ENTITLEMENTS.md § agentes).
+   */
+  const executeGuarded = useCallback(
+    async (
+      call: { id: string; name: string; arguments: Record<string, unknown> },
+      def: PluginAITool | undefined,
+      toolContext: AIToolExecutionContext,
+    ): Promise<string> => {
+      if (def?.mode === 'persist') {
+        if (def.permission) {
+          const access = checkAccess(def.permission.feature, def.permission.action)
+          if (!access.allowed) return JSON.stringify(access)
+        }
+        if (def.limitKey) {
+          const limit = await guardLimit(def.limitKey)
+          if (!limit.allowed) return JSON.stringify(limit)
+        }
+        if (def.requiresConfirmation !== false) {
+          const approved = await useChatStore.getState().requestConfirmation({
+            id: call.id,
+            toolName: call.name,
+            title: def.description,
+            params: call.arguments,
+            plane: 'client',
+          })
+          if (!approved) {
+            return JSON.stringify({ ok: false, cancelled: true, reason: 'user_declined' })
+          }
+        }
+      }
+      const exec = def?.execution
+      const rpcName = exec && exec.plane === 'server' && exec.kind === 'rpc' ? exec.rpc : null
+      const result = rpcName
+        ? await executeRpcTool(rpcName, call.arguments, useAuthStore.getState().user?.id)
+        : await executeAITool(call.name, call.arguments, toolContext)
+      if (def?.mode === 'persist' && def.limitKey && result.ok) invalidateLimit(def.limitKey)
+      return result.content
+    },
+    [],
+  )
+
+  const runFayzAgentTurn = useCallback(
+    async (content: string, activeConnection: NonNullable<typeof connection>) => {
+      const dataTools = buildDataToolIndex({
+        registries: runtime?.registries ?? new Map(),
+        entities: getAllEntities(),
+        registryToolName,
+        entityToolName,
+        queryEntities: runtime?.activePlugins.flatMap((p) => p.queryEntities ?? []) ?? [],
+      })
+      const toolContext: AIToolExecutionContext = {
+        currentOrg,
+        members,
+        currentPath: runtime?.context.currentPath ?? '/',
+        routes: (runtime?.navigation ?? []).map((n) => ({ path: n.route, label: n.label })),
+        navigate: router.navigate,
+        dataTools,
+      }
+      // Server-plane flip (manifest agent.executionPlane): data/RPC tools stop
+      // shipping from the surface — the broker executes them from the synced
+      // contract; only genuinely client-plane tools still go up per request.
+      const clientTools = serverPlane
+        ? tools.filter((t) => t.execution?.plane !== 'server')
+        : tools
+      const toolset = buildAgentToolset(clientTools, { dataTools, activePluginId })
+      const toolByName = new Map(tools.map((t) => [t.name, t]))
+
+      const client = getFayzAgentClient(activeConnection)
+      // Small models are bad at weekday math — "próxima segunda" booked a
+      // Friday. Hand them the next 7 dates, solved.
+      const upcoming = Array.from({ length: 7 }, (_, i) => {
+        const d = new Date(Date.now() + (i + 1) * 86400e3)
+        return `${d.toLocaleDateString('pt-BR', { weekday: 'long' })}=${d.toISOString().slice(0, 10)}`
+      }).join(', ')
+      // Identical repeated calls burn rounds without new information — cut the
+      // loop with an explicit steering result instead of re-executing.
+      const seenCalls = new Map<string, string>()
+      // Goto buttons: refs surface from write results (always) and from
+      // single-match reads — the records the reply is ABOUT.
+      const collectRecordLinks = (content: string) => {
+        try {
+          const parsed = JSON.parse(content) as Record<string, unknown>
+          const links: Array<{ id: string; label: string; archetype?: string; kind?: string }> = []
+          const pushRef = (ref: unknown, fallbackLabel?: unknown) => {
+            if (!ref || typeof ref !== 'object') return
+            const r = ref as { id?: string; label?: string; archetype?: string }
+            if (!r.id) return
+            const [archetype, kind] = (r.archetype ?? '').split(':')
+            links.push({
+              id: r.id,
+              label: String(r.label ?? fallbackLabel ?? 'registro'),
+              ...(archetype ? { archetype } : {}),
+              ...(kind ? { kind } : {}),
+            })
+          }
+          pushRef(parsed.ref, (parsed.record as Record<string, unknown> | undefined)?.name)
+          pushRef(
+            (parsed.record as Record<string, unknown> | undefined)?.ref,
+            (parsed.record as Record<string, unknown> | undefined)?.client_name ??
+              (parsed.record as Record<string, unknown> | undefined)?.service_name,
+          )
+          const singleFrom = (rows: unknown) => {
+            if (Array.isArray(rows) && rows.length === 1) {
+              const row = rows[0] as Record<string, unknown>
+              pushRef(row.ref, row.name)
+            }
+          }
+          singleFrom(parsed.records)
+          for (const m of Array.isArray(parsed.matches) ? parsed.matches : []) {
+            singleFrom((m as Record<string, unknown>).records)
+          }
+          if (links.length) useChatStore.getState().appendLinksToLastAssistant(links)
+        } catch {
+          /* non-JSON tool result — nothing to link */
+        }
+      }
+      let toolResults: FayzAgentToolResult[] | undefined
+      let confirmAction: { id: string; approved: boolean } | undefined
+      let message: string | undefined = content
+
+      for (let round = 0; round <= MAX_TOOL_ROUNDS; round++) {
+        const response = await client.chat({
+          message,
+          toolResults,
+          confirmAction,
+          // Attribution: an INTERNAL channel rejects turns with no identity, and
+          // without this every conversation lands in the owner's dashboard as
+          // "Anonymous" even though a signed-in user sent it.
+          externalUserId: user?.id,
+          externalUserName: user?.fullName || user?.email,
+          conversationId: useChatStore.getState().conversationId ?? undefined,
+          tools: toolset,
+          context: {
+            // Temporal grounding. Without an explicit clock the model resolves
+            // "tomorrow" against its training cutoff — it booked an appointment
+            // in 2023 before this was sent. The browser is the only side that
+            // knows the user's actual zone.
+            // Weekday spelled out: small models booked "próxima segunda" on a
+            // Friday because nothing said what weekday `now` is.
+            now: `${new Date().toISOString()} (${new Date().toLocaleDateString('pt-BR', { weekday: 'long' })})`,
+            timeZone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+            locale: typeof navigator !== 'undefined' ? navigator.language : undefined,
+            currentPath: toolContext.currentPath,
+            // What this app actually contains. Derived from the live navigation
+            // rather than written into each agent, so an assistant knows its own
+            // product on day one in any vertical — and can answer "where do I
+            // add a professional?" instead of guessing at a generic answer.
+            pages: toolContext.routes.map((r) => r.label ?? r.path).join(', '),
+            upcomingDates: upcoming,
+            toolHints:
+              'When an id (client, service, record) was already returned by a tool earlier in THIS conversation, REUSE that id directly — do not search for it again.',
+            timeNote:
+              'Datetimes in tool results are UTC unless the field is *_local. The business timezone is the timeZone above — ALWAYS convert to it before telling the user a time.',
+            businessName: currentOrg?.name,
+            userName: user?.fullName || user?.email,
+            ...(options?.systemPrompt ? { appGuidance: options.systemPrompt } : {}),
+          },
+        })
+        store.setConversationId(response.conversationId)
+
+        if (response.content) store.updateLastAssistant(response.content)
+
+        // Server-parked write: the broker executed nothing and is waiting for a
+        // human decision. Surface the card, send the decision back, continue.
+        if (response.pendingAction) {
+          const approved = await useChatStore.getState().requestConfirmation({
+            id: response.pendingAction.id,
+            toolName: response.pendingAction.toolName,
+            title: response.pendingAction.title ?? response.pendingAction.toolName,
+            params: response.pendingAction.params ?? {},
+            plane: 'server',
+          })
+          confirmAction = { id: response.pendingAction.id, approved }
+          message = undefined
+          toolResults = undefined
+          continue
+        }
+        confirmAction = undefined
+
+        if (response.toolCalls.length === 0) return
+
+        // Last allowed round still asked for tools — stop looping and let
+        // whatever prose came back stand.
+        if (round === MAX_TOOL_ROUNDS) {
+          if (!response.content) {
+            store.updateLastAssistant('That took too many steps. Could you narrow the question?')
+          }
+          return
+        }
+
+        // Live activity: surface WHICH tools are running while they run — the
+        // agent's work should be visible, not a silent pause.
+        useChatStore.getState().setActiveTools(response.toolCalls.map((c) => c.name))
+        try {
+          toolResults = await Promise.all(
+            response.toolCalls.map(async (call) => ({
+              toolCallId: call.id,
+              content: await executeGuarded(call, toolByName.get(call.name), toolContext),
+            })),
+          )
+          // Persistent, expandable trace: name + args + (truncated) result per
+          // call, attached to the reply being built.
+          useChatStore.getState().appendToolCallsToLastAssistant(
+            response.toolCalls.map((call, i) => ({
+              name: call.name,
+              args: Object.keys(call.arguments ?? {}).length
+                ? JSON.stringify(call.arguments, null, 1)
+                : '',
+              result: (toolResults?.[i]?.content ?? '').slice(0, 2000),
+            })),
+          )
+        } finally {
+          useChatStore.getState().setActiveTools([])
+        }
+        message = undefined
+      }
+    },
+    [store, tools, serverPlane, executeGuarded, activePluginId, runtime, router, currentOrg, members, user, options?.systemPrompt],
+  )
 
   const sendMessage = useCallback(
     async (content: string) => {
@@ -19,6 +317,17 @@ export function useChat(options?: UseChatOptions) {
       }
       store.addMessage(userMsg)
 
+      if (!isConfigured) {
+        // Honest non-configured state — no fake "demo response".
+        store.addMessage({
+          id: `msg-${Date.now() + 1}`,
+          role: 'assistant',
+          content: t('chat.notConfigured'),
+          timestamp: new Date().toISOString(),
+        })
+        return
+      }
+
       const assistantMsg: ChatMessage = {
         id: `msg-${Date.now() + 1}`,
         role: 'assistant',
@@ -28,24 +337,18 @@ export function useChat(options?: UseChatOptions) {
       store.addMessage(assistantMsg)
       store.setStreaming(true)
 
-      if (!options?.apiEndpoint) {
-        // Mock response if no endpoint configured
-        setTimeout(() => {
-          store.updateLastAssistant(
-            "I'm your AI assistant. This is a demo response — connect an API endpoint to enable real conversations."
-          )
-          store.setStreaming(false)
-        }, 800)
-        return
-      }
-
       try {
-        const response = await fetch(options.apiEndpoint, {
+        if (connection) {
+          await runFayzAgentTurn(content, connection)
+          return
+        }
+
+        const response = await fetch(options!.apiEndpoint!, {
           method: 'POST',
           headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify({
             messages: [
-              ...(options.systemPrompt
+              ...(options?.systemPrompt
                 ? [{ role: 'system', content: options.systemPrompt }]
                 : []),
               ...store.messages.map((m) => ({ role: m.role, content: m.content })),
@@ -56,7 +359,6 @@ export function useChat(options?: UseChatOptions) {
 
         if (!response.ok) {
           store.updateLastAssistant('Sorry, something went wrong. Please try again.')
-          store.setStreaming(false)
           return
         }
 
@@ -69,16 +371,79 @@ export function useChat(options?: UseChatOptions) {
         store.setStreaming(false)
       }
     },
-    [store, options?.apiEndpoint, options?.systemPrompt]
+    [
+      store,
+      isConfigured,
+      connection,
+      runFayzAgentTurn,
+      options?.apiEndpoint,
+      options?.systemPrompt,
+      t,
+    ],
   )
 
+  /** Refresh the signed-in user's thread list (history drawer). */
+  const loadConversations = useCallback(async () => {
+    if (!connection) return
+    try {
+      const rows = await getFayzAgentClient(connection).listConversations(user?.id)
+      useChatStore.getState().setConversations(rows)
+    } catch {
+      // History is an enhancement — a failed load never breaks the chat.
+    }
+  }, [connection, user?.id])
+
+  /** Resume a past thread: hydrate its transcript + continue under its id. */
+  const resumeConversation = useCallback(
+    async (conversationId: string) => {
+      if (!connection) return
+      try {
+        const detail = await getFayzAgentClient(connection).getConversation(conversationId, user?.id)
+        const messages: ChatMessage[] = detail.messages
+          .filter((m) => m.role === 'USER' || m.role === 'ASSISTANT' || m.role === 'user' || m.role === 'assistant')
+          .map((m) => ({
+            id: m.id,
+            role: m.role.toLowerCase() === 'user' ? ('user' as const) : ('assistant' as const),
+            content: m.content,
+            timestamp: m.createdAt,
+          }))
+        const s = useChatStore.getState()
+        s.setMessages(messages)
+        s.setConversationId(detail.id)
+      } catch {
+        // Thread gone (archived / another device cleaned it) — start fresh.
+        useChatStore.getState().reset()
+      }
+    },
+    [connection, user?.id],
+  )
+
+  /** Fresh thread: clear the transcript, next turn creates a new conversation. */
+  const startNewConversation = useCallback(() => {
+    store.reset()
+  }, [store])
+
   return {
     messages: store.messages,
     isOpen: store.isOpen,
     isStreaming: store.isStreaming,
+    /** True when a real backend is wired — the project's Fayz agent or a custom endpoint. */
+    isConfigured,
     sendMessage,
     toggleOpen: store.toggleOpen,
     setOpen: store.setOpen,
     reset: store.reset,
+    /** Write awaiting human confirmation (render the ConfirmActionCard; the
+     *  composer should stay disabled while set). */
+    pendingAction: store.pendingAction,
+    /** Card decision: true executes/approves, false declines. */
+    resolvePendingAction: store.resolvePendingAction,
+    /** Tool names executing right now (live activity chips). */
+    activeTools: store.activeTools,
+    /** History drawer data + actions. */
+    conversations: store.conversations,
+    loadConversations,
+    resumeConversation,
+    startNewConversation,
   }
 }

package/src/shell/hooks/useSystemPermission.ts

@@ -0,0 +1,23 @@
+import { useCallback } from 'react'
+import type { SystemPermission } from '@fayz-ai/core'
+import { usePermissionsStore } from '../../permissions'
+
+// ---------------------------------------------------------------------------
+// useSystemPermission — native replacement for the org-management (system)
+// permission check that used to live in the legacy shell/hooks/usePermission.
+// Mirrors the owner bypass in permissions/context.tsx: a null profile (owner /
+// no RBAC loaded) and the `owner` role pass through, so the owner is never
+// blocked. Grants-based feature checks stay with usePermission(Optional).
+// ---------------------------------------------------------------------------
+
+export function useSystemPermission(): (perm: SystemPermission) => boolean {
+  const currentProfile = usePermissionsStore((s) => s.currentProfile)
+  return useCallback(
+    (perm: SystemPermission) => {
+      if (!currentProfile) return true
+      if (currentProfile.id === 'owner' || currentProfile.name?.toLowerCase() === 'owner') return true
+      return currentProfile.systemPermissions?.includes(perm) ?? false
+    },
+    [currentProfile],
+  )
+}

package/src/shell/hooks/useTenantPluginSettings.ts

@@ -0,0 +1,127 @@
+import { useCallback, useMemo, useRef } from 'react'
+import { useOrganizationStore, useOrgAdapterOptional } from '../../org'
+import { usePluginPrefs } from './usePluginPrefs'
+
+// ---------------------------------------------------------------------------
+// useTenantPluginSettings — PER-TENANT plugin settings, persisted server-side
+//
+// Unlike usePluginPrefs (per-browser localStorage), this hook stores each
+// plugin's settings under the current organization so they follow the tenant
+// across devices/sessions:
+//
+//   tenants.settings = { ..., plugins: { [pluginId]: { key: value, ... } } }
+//
+// Reads come from the native org store (`currentOrg.settings.plugins[pluginId]`)
+// merged over `defaults`. Writes optimistically patch the store and then
+// persist via `adapter.updateOrg(orgId, { settings })` (lightly debounced so a
+// burst of toggles collapses into one network round-trip).
+//
+// When no org adapter is mounted (standalone / mock-less demo), it transparently
+// falls back to `usePluginPrefs` (localStorage) with the SAME api, so the caller
+// never has to branch.
+//
+// NOTE (follow-up): persisting + re-hydrating these values is the contract here.
+// Actually *consuming* them to change plugin behaviour is a separate follow-up —
+// today most of these keys are inert flags that only round-trip through storage.
+// ---------------------------------------------------------------------------
+
+export interface TenantPluginSettings<T extends Record<string, unknown>> {
+  /** Get a single setting value (falls back to the provided default). */
+  get<K extends keyof T>(key: K): T[K]
+  /** Set a single setting value — optimistic + debounced persistence. */
+  set<K extends keyof T>(key: K, value: T[K]): void
+  /** Get all settings merged over defaults. */
+  getAll(): T
+  /** Whether values are persisted per-tenant (true) or per-browser fallback (false). */
+  isTenantScoped: boolean
+}
+
+/** Extract this plugin's settings blob from an org's settings, merged over defaults. */
+function readForPlugin<T extends Record<string, unknown>>(
+  settings: unknown,
+  pluginId: string,
+  defaults: T,
+): T {
+  const root = settings && typeof settings === 'object' ? (settings as Record<string, unknown>) : {}
+  const plugins = root.plugins && typeof root.plugins === 'object' ? (root.plugins as Record<string, unknown>) : {}
+  const forPlugin = plugins[pluginId]
+  const merged = forPlugin && typeof forPlugin === 'object' ? (forPlugin as Partial<T>) : {}
+  return { ...defaults, ...merged }
+}
+
+const DEBOUNCE_MS = 400
+
+export function useTenantPluginSettings<T extends Record<string, unknown>>(
+  pluginId: string,
+  defaults: T,
+): TenantPluginSettings<T> {
+  const currentOrg = useOrganizationStore((s) => s.currentOrg)
+  const setCurrentOrg = useOrganizationStore((s) => s.setCurrentOrg)
+  const adapter = useOrgAdapterOptional()
+
+  // Always mounted (hooks can't be conditional). Used as the fallback store when
+  // there's no org adapter to persist against.
+  const localPrefs = usePluginPrefs<T>(pluginId, defaults)
+
+  const isTenantScoped = !!(adapter && currentOrg)
+
+  const stored = useMemo(
+    () => readForPlugin(currentOrg?.settings, pluginId, defaults),
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [currentOrg?.settings, pluginId],
+  )
+
+  const timerRef = useRef<ReturnType<typeof setTimeout> | null>(null)
+
+  const scheduleWrite = useCallback(
+    (orgId: string, settings: Record<string, unknown>) => {
+      if (!adapter) return
+      if (timerRef.current) clearTimeout(timerRef.current)
+      timerRef.current = setTimeout(() => {
+        adapter
+          .updateOrg(orgId, { settings })
+          .then((updated) => setCurrentOrg(updated))
+          .catch(() => {
+            /* keep the optimistic value; a later save or refresh reconciles */
+          })
+      }, DEBOUNCE_MS)
+    },
+    [adapter, setCurrentOrg],
+  )
+
+  const set = useCallback(
+    <K extends keyof T>(key: K, value: T[K]): void => {
+      const org = useOrganizationStore.getState().currentOrg
+      if (!adapter || !org) {
+        localPrefs.set(key, value)
+        return
+      }
+      // Read the freshest org from the store so rapid successive sets accumulate
+      // instead of clobbering each other via a stale closure.
+      const settings = (org.settings ?? {}) as Record<string, unknown>
+      const plugins = (settings.plugins ?? {}) as Record<string, unknown>
+      const nextForPlugin = { ...readForPlugin(settings, pluginId, defaults), [key]: value }
+      const nextSettings = { ...settings, plugins: { ...plugins, [pluginId]: nextForPlugin } }
+      // Optimistic: reflect immediately so the toggle updates without a round-trip.
+      setCurrentOrg({ ...org, settings: nextSettings })
+      scheduleWrite(org.id, nextSettings)
+    },
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [adapter, pluginId, setCurrentOrg, scheduleWrite, localPrefs],
+  )
+
+  const get = useCallback(
+    <K extends keyof T>(key: K): T[K] => (isTenantScoped ? stored[key] : localPrefs.get(key)),
+    [isTenantScoped, stored, localPrefs],
+  )
+
+  const getAll = useCallback(
+    (): T => (isTenantScoped ? stored : localPrefs.getAll()),
+    [isTenantScoped, stored, localPrefs],
+  )
+
+  return useMemo(
+    () => ({ get, set, getAll, isTenantScoped }),
+    [get, set, getAll, isTenantScoped],
+  )
+}