@oxy.so/services 11.6.0 → 11.9.0

package/lib/typescript/module/ui/screens/FileTrashScreen.d.ts

@@ -0,0 +1,14 @@
+import type React from 'react';
+import type { BaseScreenProps } from '../types/navigation.js';
+/**
+ * The person's Trash (ADR 0043 D5): the files they moved to trash, most
+ * recently trashed first. Each can be restored — served again, back in the
+ * library — or deleted permanently, after a confirmation (and a second one when
+ * an app still uses it). An account's trash never expires, so nothing here
+ * disappears on its own; it still counts toward the account's storage.
+ */
+declare const FileTrashScreen: React.FC<BaseScreenProps & {
+    userId?: string;
+}>;
+export default FileTrashScreen;
+//# sourceMappingURL=FileTrashScreen.d.ts.map

package/lib/typescript/module/ui/screens/FileTrashScreen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FileTrashScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/FileTrashScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAS/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAqB,CAAC;AAa3D;;;;;;GAMG;AACH,QAAA,MAAM,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAoMpE,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/lib/typescript/module/ui/screens/ManageAccountScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ManageAccountScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/ManageAccountScreen.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAiB/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAqB,CAAC;AA+C3D;;;;;;;GAOG;AACH,QAAA,MAAM,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CA8nBlD,CAAC;AAYF,eAAe,mBAAmB,CAAC"}
+{"version":3,"file":"ManageAccountScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/ManageAccountScreen.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAiB/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAqB,CAAC;AA+C3D;;;;;;;GAOG;AACH,QAAA,MAAM,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAwoBlD,CAAC;AAYF,eAAe,mBAAmB,CAAC"}

package/lib/typescript/module/ui/screens/SupervisionScreen.d.ts

@@ -0,0 +1,3 @@
+import type { BaseScreenProps } from '../types/navigation.js';
+export default function SupervisionScreen(props: BaseScreenProps): import("react").JSX.Element;
+//# sourceMappingURL=SupervisionScreen.d.ts.map

package/lib/typescript/module/ui/screens/SupervisionScreen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SupervisionScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/SupervisionScreen.tsx"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAqB,CAAC;AAkjB3D,MAAM,CAAC,OAAO,UAAU,iBAAiB,CAAC,KAAK,EAAE,eAAe,+BAO/D"}

package/lib/typescript/module/ui/screens/fileManagement/trashActions.d.ts

@@ -0,0 +1,66 @@
+/**
+ * What the file manager does when the person removes, restores or deletes a
+ * file (ADR 0043 D5). Pure of React and of the UI: every call takes the asset
+ * API and the confirmation it may need, so the decisions are testable on their
+ * own and the screens only render.
+ *
+ * - "Delete" in the library MOVES TO TRASH: the file stops being served, is
+ *   kept, and can be restored from Trash. A `blocked` file (taken down after a
+ *   content claim, D10) cannot be trashed — it is already served to nobody —
+ *   so removing it is the permanent delete, which is its owner's to make.
+ * - Permanent deletion happens only from Trash (or for a blocked file). The
+ *   API refuses to delete a file an application still uses (409, with the
+ *   number of uses); the person is told and decides, and only then is the
+ *   delete forced.
+ */
+import type { FileMetadata } from '@oxy.so/core';
+/** The part of `oxyServices.assets` these actions use. */
+export interface TrashAssetsApi {
+    trash(fileId: string): Promise<unknown>;
+    restore(fileId: string): Promise<unknown>;
+    delete(fileId: string, options?: {
+        force?: boolean;
+    }): Promise<unknown>;
+}
+/** What removing a file from the library does to it. */
+export type LibraryRemoval = 'trash' | 'delete';
+/** A `blocked` file is deleted (it cannot go to trash); every other is trashed. */
+export declare function libraryRemovalFor(file: Pick<FileMetadata, 'status'>): LibraryRemoval;
+/** The HTTP status of a failed asset call, when it carries one. */
+export declare function errorStatus(error: unknown): number | undefined;
+/**
+ * How many uses an application still has of a file the API refused to delete
+ * (409, `details.summary.remainingLinks`), or `null` when the refusal is not
+ * that one.
+ */
+export declare function remainingUses(error: unknown): number | null;
+/** Outcome of {@link deletePermanently}. */
+export type PermanentDeleteOutcome = 'deleted' | 'cancelled' | 'gone';
+/**
+ * Delete a file for good. When applications still use it the API refuses;
+ * `confirmStillUsed(count)` asks the person, and only a yes forces the delete.
+ * A file already gone (404) is `gone` — the caller just refreshes. Any other
+ * failure is thrown.
+ */
+export declare function deletePermanently(assets: TrashAssetsApi, fileId: string, confirmStillUsed: (uses: number) => Promise<boolean>): Promise<PermanentDeleteOutcome>;
+/** Outcome of {@link restoreFromTrash}. */
+export type RestoreOutcome = 'restored' | 'not_in_trash' | 'gone';
+/**
+ * Bring a file back from trash. One that is no longer in trash — restored
+ * elsewhere, or blocked after a claim (409 `FILE_NOT_IN_TRASH`) — or no longer
+ * exists (404) is reported, not thrown: the trash list is just stale.
+ */
+export declare function restoreFromTrash(assets: TrashAssetsApi, fileId: string): Promise<RestoreOutcome>;
+/** Per-file outcome of removing several files from the library. */
+export interface LibraryRemovalResult {
+    trashed: string[];
+    deleted: string[];
+    failed: string[];
+}
+/**
+ * Remove several files from the library at once: each goes to trash, except a
+ * blocked one, which is deleted (asking about remaining uses as
+ * {@link deletePermanently} does). One failure never stops the others.
+ */
+export declare function removeFromLibrary(assets: TrashAssetsApi, files: ReadonlyArray<Pick<FileMetadata, 'id' | 'status' | 'filename'>>, confirmStillUsed: (uses: number, filename: string) => Promise<boolean>): Promise<LibraryRemovalResult>;
+//# sourceMappingURL=trashActions.d.ts.map

package/lib/typescript/module/ui/screens/fileManagement/trashActions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trashActions.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/screens/fileManagement/trashActions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,0DAA0D;AAC1D,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzE;AAED,wDAAwD;AACxD,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEhD,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,GAAG,cAAc,CAEpF;AAED,mEAAmE;AACnE,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAQ9D;AAWD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAU3D;AAED,4CAA4C;AAC5C,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;AAEtE;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GACnD,OAAO,CAAC,sBAAsB,CAAC,CAYjC;AAED,2CAA2C;AAC3C,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,cAAc,GAAG,MAAM,CAAC;AAElE;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,cAAc,CAAC,CAWzB;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,GAAG,QAAQ,GAAG,UAAU,CAAC,CAAC,EACtE,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GACrE,OAAO,CAAC,oBAAoB,CAAC,CAwB/B"}

package/lib/typescript/module/ui/screens/index.d.ts

@@ -15,4 +15,5 @@ export { default as ConnectedAppsScreen } from './ConnectedAppsScreen.js';
 export { default as CreateAccountScreen } from './CreateAccountScreen.js';
 export { default as AccountMembersScreen } from './AccountMembersScreen.js';
 export { default as AccountSettingsScreen } from './AccountSettingsScreen.js';
+export { default as SupervisionScreen } from './SupervisionScreen.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/typescript/module/ui/screens/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,oBAAiB,CAAC;AAC3D,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,0BAAuB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,0BAAuB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,wBAAqB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,0BAAuB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,0BAAuB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,2BAAwB,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,4BAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,oBAAiB,CAAC;AAC3D,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,0BAAuB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,0BAAuB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,wBAAqB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,0BAAuB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,0BAAuB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,2BAAwB,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,4BAAyB,CAAC;AAE3E,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,wBAAqB,CAAC"}

package/lib/typescript/module/ui/stores/assetStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assetStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/stores/assetStore.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE1E,UAAU,UAAU;IAElB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAGpD,OAAO,EAAE;QACP,SAAS,EAAE,OAAO,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,OAAO,CAAC;KACnB,CAAC;IAGF,MAAM,EAAE;QACN,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAGF,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC;;;OAGG;IACH,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC7D,SAAS,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC;IACrC,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAGvC,iBAAiB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC3E,oBAAoB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAG/C,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,KAAK,IAAI,CAAC;IACpD,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAGzF,YAAY,EAAE,CAAC,SAAS,EAAE,OAAO,KAAK,IAAI,CAAC;IAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACvC,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;IAGzC,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,YAAY,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,WAAW,EAAE,MAAM,IAAI,CAAC;IAGxB,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;IACzC,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;IAClF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;IAChD,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAG/F,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAaD,eAAO,MAAM,aAAa,yEA0MvB,CAAC;AAGJ,eAAO,MAAM,SAAS,eAA8D,CAAC;AACrF,eAAO,MAAM,QAAQ,GAAI,SAAS,MAAM,UAAoD,CAAC;AAC7F,eAAO,MAAM,iBAAiB,2CAAuD,CAAC;AACtF,eAAO,MAAM,eAAe;eA9Qb,OAAO;aACT,OAAO;cACN,OAAO;CA4QuD,CAAC;AAC7E,eAAO,MAAM,cAAc;aAxQd,MAAM;WACR,MAAM;aACJ,MAAM;CAsQuD,CAAC;AAG3E,eAAO,MAAM,cAAc,GAAI,KAAK,MAAM,YAAwD,CAAC;AAEnG,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,EAAE,YAAY,MAAM,EAAE,UAAU,MAAM,YACL,CAAC;AAE/E,eAAO,MAAM,kBAAkB,GAAI,SAAS,MAAM,WACW,CAAC;AAE9D,eAAO,MAAM,gBAAgB,GAC3B,SAAS,MAAM,EACf,KAAK,MAAM,EACX,YAAY,MAAM,EAClB,UAAU,MAAM,YACoE,CAAC"}
+{"version":3,"file":"assetStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/stores/assetStore.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAgB1E,UAAU,UAAU;IAElB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAGpD,OAAO,EAAE;QACP,SAAS,EAAE,OAAO,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,OAAO,CAAC;KACnB,CAAC;IAGF,MAAM,EAAE;QACN,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAGF,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC;;;OAGG;IACH,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC7D,SAAS,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC;IACrC,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAGvC,iBAAiB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC3E,oBAAoB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAG/C,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,KAAK,IAAI,CAAC;IACpD,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAGzF,YAAY,EAAE,CAAC,SAAS,EAAE,OAAO,KAAK,IAAI,CAAC;IAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACvC,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;IAGzC,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,YAAY,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,WAAW,EAAE,MAAM,IAAI,CAAC;IAGxB,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;IACzC,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;IAClF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;IAChD,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAG/F,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAaD,eAAO,MAAM,aAAa,yEAuMvB,CAAC;AAGJ,eAAO,MAAM,SAAS,eAA8D,CAAC;AACrF,eAAO,MAAM,QAAQ,GAAI,SAAS,MAAM,UAAoD,CAAC;AAC7F,eAAO,MAAM,iBAAiB,2CAAuD,CAAC;AACtF,eAAO,MAAM,eAAe;eA3Qb,OAAO;aACT,OAAO;cACN,OAAO;CAyQuD,CAAC;AAC7E,eAAO,MAAM,cAAc;aArQd,MAAM;WACR,MAAM;aACJ,MAAM;CAmQuD,CAAC;AAG3E,eAAO,MAAM,cAAc,GAAI,KAAK,MAAM,YAAwD,CAAC;AAEnG,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,EAAE,YAAY,MAAM,EAAE,UAAU,MAAM,YACL,CAAC;AAE/E,eAAO,MAAM,kBAAkB,GAAI,SAAS,MAAM,WACW,CAAC;AAE9D,eAAO,MAAM,gBAAgB,GAC3B,SAAS,MAAM,EACf,KAAK,MAAM,EACX,YAAY,MAAM,EAClB,UAAU,MAAM,YACoE,CAAC"}

package/lib/typescript/module/ui/utils/identityCrypto.d.ts

@@ -35,6 +35,7 @@ export declare const loadIdentityCrypto: () => Promise<{
     signIdentityProof: typeof import("@oxy.so/core/crypto").signIdentityProof;
     deriveIdentityLinkCode: typeof import("@oxy.so/core/crypto").deriveIdentityLinkCode;
     solveRegistrationPow: typeof import("@oxy.so/core/crypto").solveRegistrationPow;
+    createContentHasher: typeof import("@oxy.so/core/crypto").createContentHasher;
     canonicalize: typeof import("@oxy.so/protocol").canonicalize;
     loadCommonsIdentityBridge: typeof import("@oxy.so/protocol").loadCommonsIdentityBridge;
     signMessage: typeof import("@oxy.so/protocol").signMessage;

package/lib/typescript/module/ui/utils/identityCrypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identityCrypto.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/identityCrypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAsC,CAAC"}
+{"version":3,"file":"identityCrypto.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/identityCrypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAsC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/services",
-  "version": "11.6.0",
+  "version": "11.9.0",
   "description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
@@ -111,7 +111,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "https://github.com/oxyhq/sdk",
+    "url": "git+https://github.com/OxyHQ/oxy.git",
     "directory": "packages/services"
   },
   "author": "OxyHQ",
@@ -136,33 +136,18 @@
     "copy-dts": "copyfiles -u 1 \"src/**/*.d.ts\" lib/typescript",
     "delete-debug-view": "rm -rf ./lib/commonjs/components/bottomSheetDebugView ./lib/module/components/bottomSheetDebugView ./lib/typescript/components/bottomSheetDebugView || true",
     "delete-dts.js": "find ./lib/commonjs -name '*.d.js*' -delete && find ./lib/module -name '*.d.js*' -delete",
-    "release": "rm -rf lib && bun run build && release-it",
     "prepublishOnly": "node ../../scripts/assert-bun-publish.mjs && bun run typescript && bun run test && bun run build"
   },
-  "release-it": {
-    "git": {
-      "tagName": "@oxy.so/services@${version}",
-      "tagAnnotation": "Release @oxy.so/services@${version}",
-      "commitMessage": "chore(services): release @oxy.so/services@${version}"
-    },
-    "github": {
-      "release": true,
-      "releaseName": "@oxy.so/services@${version}"
-    },
-    "npm": {
-      "publish": true
-    }
-  },
   "dependencies": {
     "@expo/config-plugins": "57.0.9",
-    "@oxy.so/contracts": "4.17.0",
+    "@oxy.so/contracts": "^4.22.0",
     "color": "^5.0.3"
   },
   "devDependencies": {
     "@commitlint/cli": "^21.2.1",
     "@commitlint/config-conventional": "^21.2.0",
     "@expo/vector-icons": "^15.0.3",
-    "@oxy.so/core": "4.13.0",
+    "@oxy.so/core": "4.18.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
     "@react-native-community/netinfo": "^12.0.1",
     "@react-native/babel-preset": "^0.86.2",
@@ -205,17 +190,17 @@
     "react-native-reanimated": "4.5.0",
     "react-native-safe-area-context": "~5.8.0",
     "react-native-svg": "15.15.5",
-    "release-it": "^19.0.6",
     "socket.io-client": "^4.8.1",
     "ts-jest": "^29.4.12",
     "typescript": "^5.9.2",
     "zustand": "^5.0.14"
   },
   "//@oxy.so/bloom": "RE-RAISE THIS FLOOR ON EVERY BREAKING BLOOM RELEASE, in the same commit as the root package.json catalog entry and the code that requires it. The breaking position is the MAJOR, so `^3.0.1` means `>=3.0.1 <4.0.0`: 3.x minors are admitted on semver's additive promise, and Bloom 4.0.0 is refused until someone raises this deliberately. The CAP is the part that is load-bearing. An earlier revision of this key recorded the opposite trade -- an uncapped `>=` floor, accepted so that intentionally-breaking Bloom 0.x minors would not be blocked -- and that trade is closed by evidence rather than by preference: an unbounded range is exactly what let `bun install` pair this package with Bloom 1.0.0 and emit no warning at all, and 1.0.0 broke it four ways (a deleted provider, a renamed confirm option, a renamed Chip fill, and two REMOVED SUBPATHS that fail at bundle time, before any typecheck runs). A floor is a claim about what was measured; a cap is the claim that nothing beyond it was. RAISED TO 3.0.1 from `^2.1.0`. Bloom 3.0.0 breaks exactly two things -- `PageHeader` defaults to `presentation=\"floating\"` and stops hiding the title under `transparent`, and `Field disabled` now reaches the control that reads the field context -- and THIS PACKAGE IMPORTS NEITHER: it renders no `PageHeader` and no `Field`, and 3.0 removes no subpath (unlike 2.0.0, which is why that floor cost code changes and this one does not). Its six `transparent` occurrences are CSS colour values, not the PageHeader prop. The cap had to move rather than widen to a union, because leaving `^2.1.0` in place is what made `bun install` resolve a SECOND, nested Bloom 2.12.4 under this package for any app on Bloom 3 -- two copies of a library whose 3.0 contracts (`control-surface`, `TopEdgeProvider`, `ScrollOffsetProvider`) are React contexts, so a provider from one copy cannot be read by a consumer from the other. Mention's `oxyRuntimeCompatibility` test is what caught it; nothing in a typecheck can. RAISED AGAIN TO 3.2.0 from `^3.0.1`, for the same class of reason the 2.x note records, only in the other direction: 3.2.0 ADDS the per-glyph icon subpaths (`@oxy.so/bloom/icons/RiAtLine`) that this package's screens now import instead of the `@oxy.so/bloom/icons` barrel, and a missing subpath fails at bundle time, in the consumer's Metro, long after this package has typechecked and shipped. `^3.0.1` would have admitted Bloom 3.0.1 and 3.1.0, neither of which has those subpaths, so the floor is the only thing standing between a consumer and a red build. Nothing else about 3.1.0 or 3.2.0 is required here; the cap stays at the major. RAISED TO ^4.2.0: FollowButton now delegates its visuals to Bloom media-header FollowButton with loading, textStyle and large size; the new shared UI contracts require one Bloom4 context across Services and its consumer. RAISED TO ^4.31.0: the sign-in and account screens type one-time codes into `InputOtp` with `type=\"alphanumeric\"` (the long sign-in code and backup codes), which 4.31.0 adds; older 4.x drops the letters. RAISED TO ^4.35.0: every password field passes `revealable` to `TextFieldInput` (the eye button, 4.35.0); older 4.x drops the prop silently and the password cannot be shown. The provider also mounts `@oxy.so/bloom/locale` (4.32.0+). RAISED TO ^5.1.0 (services 9.0.0, a major because consumers must move to Bloom 5 with it): Bloom 5.0.0 types `Card`'s `style` without radius, border width or `overflow` (geometry goes through `radius`/`border`/`clipContent`) and stops clipping a Card's children by default, so `BenefitList`'s `overflow: 'visible'` became both a type error and unnecessary; it is removed. The cap MOVES rather than widening to a `^4 || ^5` union, for the reason the 3.0.1 note records: a union lets an app resolve a second, nested Bloom copy and split the React contexts. The floor is 5.1.0 because that is the version measured here (every package builds and tests against it); 5.0.0 was not measured. RAISED TO ^6.0.0 (services 10.0.0, a major because consumers must move to Bloom 6 with it, and because this package's own `FollowButton`/`FollowTargetButton` `size` moves with Bloom's vocabulary): Bloom 6.0.0 removes the duplicate spellings its 5.x types still admitted, and this package used four of them. The control `size` narrows to `xs|sm|md|lg`, so every `small`/`medium`/`large` handed to a Bloom control became `sm`/`md`/`lg`, and the Follow buttons' public `size` became `sm|md|lg` because it is passed straight through to Bloom's media-header `FollowButton`. `Switch` is controlled by `checked`/`onCheckedChange`, not `value`/`onValueChange`. `Button` has no `variant`: each call site names `appearance` and `tone` (the pair the 5.x recipe resolved the variant to, so nothing repaints), `LinkButton`'s colour is `linkTone`, and `PeableButton` renders `InverseButton`. `Card` takes `appearance=\"outline\"` for `variant=\"outlined\"`. The deprecated spellings Bloom 6 still accepts (`isInvalid`, Chip `color`/`variant`) are not breaks and are left alone. The cap MOVES rather than widening to a `^5 || ^6` union, for the reason the 3.0.1 note records: a union lets an app resolve a second, nested Bloom copy and split the React contexts. The floor is 6.0.0 because that is the version measured when this raise was made; the workspace catalog has since moved to ^6.2.0, which adds only the `cover-header` subpath this package does not import, so the floor stays. MAINTENANCE 6.2.1: floor >=6.2.1 and cap <6.3.0 deliberately admit only the reviewed patch line with native Back/X completion and SVG paint/resize fixes. Known 6.4.0 lacks these fixes; the exact root catalog pin prevents a caret from selecting it. A broader minor range requires forward-port and consumer acceptance. VERIFIED 7.1.2: the additional >=7.1.2 <7.2.0 line contains the reviewed native fixes. Services build/types and the website real browser provider/theme tests pass with one byte-verified Bloom copy at both the root and Services importer. The root catalog remains pinned to 6.2.1; consumers explicitly choose one supported line. Versions 6.3.x, 6.4.x and 7.1.0/7.1.1 remain excluded. VERIFIED 7.7.0: admit the progressive media-preview release as another explicit line, so consumers selecting it share one Bloom provider/theme/font context with Services. Existing supported lines and the workspace catalog stay unchanged; unreviewed 7.2-7.6 and 7.8+ remain excluded. VERIFIED 7.13.1: admit the accessible bottom-sheet dialog release so consumers selecting this line share Bloom surface, theme and overlay contexts with Services. Stable Services 11.1.1 validates the unchanged 11.1.0 source against 7.13.1 with 1040 tests, types and packed exports; the existing catalog and other supported peer lines stay unchanged. VERIFIED 7.14.0: the additive outlined Stepper release is covered by Services build, types and 1040 tests against the published package on the 11.1 maintenance branch. VERIFIED 7.15.0: additive Button focus, hover and keyboard events; the stable maintenance line passes types and all 1040 tests against the official package, preserving the existing peer lines. VERIFIED 7.16.1: the stable 11.1 maintenance line passes types and all 1040 tests against the official Accordion, rating and Dialog release; packed exports are verified. Preserve every existing peer line. VERIFIED 7.17.0: Services 11.1.5 maintenance types, 1040 tests, fresh build and packed exports pass against the official additive Carousel/Search and dialog-focus release. Preserve the existing catalog and peer lines on main. VERIFIED 7.18/7.19: the 11.1 maintenance line passed types and 1040 tests separately against both official releases; this main line passed types and all 1042 tests against 7.19.0 after building its workspace dependencies. The root catalog remains 6.2.1; apps choose one admitted line. VERIFIED 7.20.0: additive viewport observation, opt-in Meter/RatingBar reveal and Dialog minimum side gutter; Services types and all 1042 tests pass against the release candidate tarball. Existing peer lines and the workspace catalog remain unchanged. VERIFIED 7.21.0: configurable Dialog/BottomSheet backdrop and transition preserve defaults; this main line passes types and all 1042 tests against the byte-verified release candidate. Existing supported peer lines and the workspace catalog remain unchanged. VERIFIED 7.22.0: controlled Collapsible and rich RadioGroup composition preserve Services compatibility; maintenance Services types and all 1040 tests pass against the release candidate, with unchanged 11.1.0 runtime source. Mercaria validates the composed purchase panels in eight browser scenarios and all four client typechecks. VERIFIED 7.27.0: exact ColorScope roles, local mode and portal propagation preserve Services defaults. This main line passes types and all 114 suites / 1042 tests against the official 7.27.0 package with a single Bloom resolution. Stable 11.1.13 maintenance also passes types and all 113 suites / 1040 tests. Preserve the existing main catalog and earlier admitted peer lines. VERIFIED 7.28.0: types and all 114 suites / 1042 tests pass with the official CSS 3.1.0-rc.0 / NativeWind 5.0.0-rc.0 compiler pair. Maintenance also verifies Expo 56.0.23 and RN 0.85.3; no runtime source or framework peer changes are required. VERIFIED 7.29.0: TypeScript and all 114 suites / 1042 tests pass with the paired NativeWind 5.0.0-rc.0 and react-native-css 3.1.0-rc.0. Optional gallery lifecycle callback preserves existing surface behavior; runtime source unchanged. VERIFIED 7.30.0: TypeScript and all 114 suites / 1042 tests pass against the video-overlay release candidate with one Bloom runtime; existing framework catalog and runtime source stay unchanged. VERIFIED 7.31.0: TypeScript and all 114 suites / 1042 tests pass against the official 7.31.0 package with one Bloom runtime. It adds the `video-view` subpath (expo-video's VideoView with `playsInline` on, so web video plays inline on iPhone Safari) and routes MediaSurface through it; this package imports neither, and runtime source and framework catalog stay unchanged. VERIFIED 7.32.0 AND 7.33.0 (11.2.0-oxy-one.4): each official package installed as the one Bloom resolution; types and all 115 suites / 1050 tests pass against both (and against the 6.2.1 catalog). 7.32.0 adds the shared agent-avatar renderer and Clippo; 7.33.0 adds the lean `settings-modal/modal` and `settings-modal/fields` entries. Both are additive (no subpath removed, no peer or dependency changed) and this package imports neither family. The cap moves to <7.34.0 so a 7.33 patch (7.33.1 restores web TextField side padding) needs no services release. The root catalog stays 6.2.1. Same verification and fix as maintenance 11.1.18. VERIFIED 8.0.0 (11.2.0-oxy-one.4): types and all 115 suites / 1050 tests pass with 8.0.0 as the one Bloom resolution. Its only break is that `LinkPreviewCard` leaves the root barrel for `@oxy.so/bloom/link-preview` (its cover now loads through `expo-image`, which the root barrel must not link); this package imports neither. The 8.0 line is admitted beside 7.x, so an app moves to Bloom 8 without a services major. VERIFIED 8.1.1 AND 9.0.0 (11.2.0-oxy-one.5): each installed as the one Bloom resolution (8.1.1 from the registry, 9.0.0 from the packed release candidate); types and all 115 suites / 1050 tests pass against both, and against the 6.2.1 catalog. 8.1.x adds the unified agent-avatar renderer and changes nothing this package imports. 9.0.0 removes the `small` / `medium` / `large` spellings from control sizes (Chip, Badge, Sidebar, Rating and others), renames `AlertDialog` / `Command` `visible` + `onClose` to `open` + `onOpenChange`, replaces the composer's `listening` with `voiceState`, and swaps the glass material for blur and tint; this package used one of those, Chip `size=\"small\"` (three screens), now `sm`, which every admitted line accepts. The 8.1 minor joins the 8.0 line (one 8.x range) and the 9.0 line is admitted beside the earlier ones. The root catalog stays 6.2.1. VERIFIED 10.0.0 (11.2.0-oxy-one.7): installed from the registry as the one Bloom resolution; types and all 115 suites / 1050 tests pass. 10.0.0 makes an avatar one flat `AvatarCharacter` and removes `AvatarConfig` with its constants from `@oxy.so/bloom/agent-avatar`; this package imports nothing from that family, so nothing here changes. The 10.0 line is admitted beside the earlier ones. The root catalog stays 6.2.1.",
+  "//@oxy.so/core": "The core peer is the root catalog's `^4.18.0` (>=4.18.0 <5.0.0), and contracts is a `workspace:^` dependency (packed as ^<its version>). Both were EXACT pins: core since the Oxy One prerelease (4.5.0-oxy-one.0, which a caret range could not admit) and contracts by `workspace:*`; the reason left with the prerelease, and an exact pin made every core or contracts minor a peer conflict or a second nested copy in each app until services was republished. The FLOOR is the core this package is built and tested against and needs (4.18.0: `assets.list({ status: 'trash' })`, `FileMetadata.trashedAt`, `AssetLiveStatus`); raise it, in the same commit, to the first core a change here requires. The CAP is the major: core 4.x minors are admitted on semver's additive promise, and core 5.0.0 is refused until it is measured here, because a second core copy splits the one OxyServices instance and session an app shares with this package.",
   "peerDependencies": {
     "@expo/vector-icons": "^15.0.3",
     "@oxy.so/bloom": ">=6.2.1 <6.3.0 || >=7.1.2 <7.2.0 || >=7.7.0 <7.8.0 || >=7.13.1 <7.34.0 || >=8.0.0 <8.2.0 || >=9.0.0 <9.1.0 || >=10.0.0",
-    "@oxy.so/core": "4.13.0",
+    "@oxy.so/core": "^4.18.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
     "@react-native-community/netinfo": ">=11.4.1 <13.0.0",
     "@tanstack/query-async-storage-persister": "^5.101",

package/src/assets/fonts/icons/manifest.json

@@ -5,8 +5,8 @@
     "ionicons": {
       "fontFamily": "OxyServicesIonicons",
       "file": "src/assets/fonts/icons/OxyServicesIonicons.ttf",
-      "bytes": 43004,
-      "sha256": "367d1eb46c64097ace34b793d7fbff9257c0da191d8cab73329cfe8999e95611",
+      "bytes": 43160,
+      "sha256": "c062679623ae08f1fb0231729c1f9efae97044e35ffe51f7c0544f866cb2f959",
       "names": [
         "add",
         "add-circle-outline",
@@ -18,6 +18,7 @@
         "arrow-back",
         "arrow-down",
         "arrow-forward",
+        "arrow-undo",
         "arrow-up",
         "at",
         "briefcase-outline",
@@ -151,8 +152,8 @@
     "materialCommunityIcons": {
       "fontFamily": "OxyServicesMaterialCommunityIcons",
       "file": "src/assets/fonts/icons/OxyServicesMaterialCommunityIcons.ttf",
-      "bytes": 28852,
-      "sha256": "844252d83e5510b012333218db9e16cc997164360d1ab4f24148c3ca384ab740",
+      "bytes": 29224,
+      "sha256": "c7fdc975626c395ee2b1d0c462ae8dab6f800935bb64739d2d07ea4a30da51d0",
       "names": [
         "account",
         "account-circle",
@@ -213,6 +214,7 @@
         "code-tags",
         "cog",
         "cog-outline",
+        "contacts",
         "contain",
         "content-copy",
         "controller",
@@ -220,6 +222,7 @@
         "credit-card",
         "cube-outline",
         "database-outline",
+        "decimal",
         "delete",
         "delete-outline",
         "devices",
@@ -349,5 +352,5 @@
     }
   },
   "glyphMapsFile": "src/ui/icons/subsetGlyphMaps.ts",
-  "glyphMapsSha256": "25d2d86d08ea7238dfe49210cf98754ffcc60fefbe5b8ad812e13c2d3239948f"
+  "glyphMapsSha256": "1f2e6005461383abb6c5443981341e8ae716110eb6de6590f8a3caa4cfe614b0"
 }

package/src/ui/components/fileManagement/FileViewer.tsx

@@ -18,7 +18,10 @@ interface FileViewerProps {
   onToggleDetails: () => void;
   onClose: () => void;
   onDownload: (fileId: string, filename: string) => void;
+  /** Removes the file from the library: to trash, or for good if it is blocked. */
   onDelete: (fileId: string, filename: string) => void;
+  /** The remove button's label — "Move to trash", or "Delete" for a blocked file. */
+  deleteLabel: string;
   isOwner: boolean;
 }
 
@@ -55,6 +58,7 @@ export const FileViewer: React.FC<FileViewerProps> = ({
   onClose,
   onDownload,
   onDelete,
+  deleteLabel,
   isOwner,
 }) => {
   const { colors } = useTheme();
@@ -395,7 +399,7 @@ export const FileViewer: React.FC<FileViewerProps> = ({
                     onDelete(file.id, file.filename);
                   }}
                 >
-                  Delete
+                  {deleteLabel}
                 </Button>
               </View>
             )}

package/src/ui/components/supervision/PersonPicker.tsx

@@ -0,0 +1,67 @@
+import { useState } from 'react';
+import { View } from 'react-native';
+import { useQuery } from '@tanstack/react-query';
+import { Button } from '@oxy.so/bloom/button';
+import { Text } from '@oxy.so/bloom/typography';
+import type { SafetyPerson } from '@oxy.so/contracts';
+import { useOxy } from '../../context/OxyContext';
+import { useI18n } from '../../hooks/useI18n';
+import { AccountFlowField, AccountFlowNote } from '../signIn/accountFlowParts';
+export function PersonPicker({
+  onSelect,
+  exclude = [],
+}: {
+  onSelect: (person: SafetyPerson) => void;
+  exclude?: string[];
+}) {
+  const { oxyServices, user } = useOxy(),
+    { t } = useI18n();
+  const [text, setText] = useState(''),
+    [query, setQuery] = useState('');
+  const results = useQuery({
+    queryKey: ['oxy', 'safety', 'people', user?.id, query],
+    queryFn: () => oxyServices.safety.people({ query }),
+    enabled: query.length >= 2,
+    staleTime: 0,
+    gcTime: 0,
+    retry: false,
+  });
+  return (
+    <View style={{ gap: 12 }}>
+      <AccountFlowNote>{t('supervision.exactHandleHint')}</AccountFlowNote>
+      <AccountFlowField
+        label={t('supervision.searchLabel')}
+        value={text}
+        onChange={setText}
+        onSubmit={() => setQuery(text.trim().replace(/^@/, ''))}
+        error={null}
+        testID="supervision-person-query"
+      />
+      <Button
+        onPress={() => setQuery(text.trim().replace(/^@/, ''))}
+        disabled={text.trim().length < 2}
+        loading={results.isFetching}
+      >
+        {t('supervision.search')}
+      </Button>
+      {results.isError ? (
+        <AccountFlowNote>{t('supervision.loadError')}</AccountFlowNote>
+      ) : (
+        results.data?.items
+          .filter((person) => !exclude.includes(person.accountId))
+          .map((person) => (
+            <Button
+              key={person.accountId}
+              appearance="plain"
+              onPress={() => onSelect(person)}
+              testID={`supervision-person-${person.accountId}`}
+            >
+              {person.displayName ?? person.username ?? t('supervision.account')}{' '}
+              {person.username ? `@${person.username}` : ''}
+            </Button>
+          ))
+      )}
+      {results.data?.items.length === 0 ? <Text>{t('supervision.noPeople')}</Text> : null}
+    </View>
+  );
+}

package/src/ui/components/supervision/presentation.ts

@@ -0,0 +1,17 @@
+/** Format integer authorization evidence without rounding it through a floating-point division. */
+export function formatApprovalAmount(minor: number, currency: string, locale: string): string {
+  const digits =
+    new Intl.NumberFormat(locale, { style: 'currency', currency }).resolvedOptions()
+      .maximumFractionDigits ?? 2;
+  const value = BigInt(minor),
+    absolute = value < 0n ? -value : value,
+    scale = 10n ** BigInt(digits);
+  const whole = new Intl.NumberFormat(locale, { maximumFractionDigits: 0 }).format(
+    absolute / scale,
+  );
+  const decimal =
+    new Intl.NumberFormat(locale).formatToParts(1.1).find((part) => part.type === 'decimal')
+      ?.value ?? '.';
+  const fraction = digits ? `${decimal}${(absolute % scale).toString().padStart(digits, '0')}` : '';
+  return `${value < 0n ? '-' : ''}${whole}${fraction} ${currency}`;
+}

package/src/ui/hooks/queries/__tests__/fileQueries.test.ts

@@ -0,0 +1,70 @@
+/**
+ * The file library's page mapping and cache helpers for the Trash view (ADR
+ * 0043 D5): a trashed file keeps its `trashedAt`, and the library and the
+ * trash are separate cache entries under one `files` root.
+ */
+import { QueryClient } from '@tanstack/react-query';
+import { queryKeys } from '../queryKeys';
+import {
+  mapRawFileToMetadata,
+  removeFileFromCache,
+  toUserFilesPage,
+  type UserFilesInfinite,
+} from '../useFileQueries';
+
+jest.mock('../../../context/OxyContext', () => ({ useOxy: () => ({}) }));
+
+const page = (ids: string[]): UserFilesInfinite => ({
+  pages: [
+    {
+      files: ids.map((id) => mapRawFileToMetadata({ id, originalName: `${id}.png` })),
+      total: ids.length,
+      hasMore: false,
+      nextOffset: 40,
+    },
+  ],
+  pageParams: [0],
+});
+
+describe('mapRawFileToMetadata', () => {
+  it('keeps the status and when the file went to trash', () => {
+    const file = mapRawFileToMetadata({
+      id: 'f',
+      originalName: 'f.png',
+      status: 'trash',
+      trashedAt: '2026-10-16T10:00:00.000Z',
+    });
+    expect(file).toMatchObject({ status: 'trash', trashedAt: '2026-10-16T10:00:00.000Z' });
+    expect(mapRawFileToMetadata({ id: 'g', trashedAt: null })).not.toHaveProperty('trashedAt');
+  });
+});
+
+describe('toUserFilesPage', () => {
+  it('maps a page and where the next one starts', () => {
+    const mapped = toUserFilesPage({ files: [{ id: 'a' }], total: 41, hasMore: true }, 0);
+    expect(mapped).toMatchObject({ total: 41, hasMore: true, nextOffset: 40 });
+    expect(mapped.files.map((file) => file.id)).toEqual(['a']);
+  });
+});
+
+describe('the trash cache', () => {
+  it('is its own entry under files.all, and removal targets the list it names', () => {
+    expect(queryKeys.files.trash('u').slice(0, 1)).toEqual([...queryKeys.files.all]);
+    expect(queryKeys.files.trash('u')).not.toEqual(queryKeys.files.list('u'));
+
+    const client = new QueryClient();
+    client.setQueryData(queryKeys.files.list('u'), page(['a', 'b']));
+    client.setQueryData(queryKeys.files.trash('u'), page(['b', 't']));
+
+    removeFileFromCache(client, 'u', 'b', 'trash');
+    const ids = (key: readonly unknown[]) =>
+      client
+        .getQueryData<UserFilesInfinite>(key)
+        ?.pages.flatMap((p) => p.files.map((file) => file.id));
+    expect(ids(queryKeys.files.trash('u'))).toEqual(['t']);
+    expect(ids(queryKeys.files.list('u'))).toEqual(['a', 'b']);
+
+    removeFileFromCache(client, 'u', 'a');
+    expect(ids(queryKeys.files.list('u'))).toEqual(['b']);
+  });
+});

package/src/ui/hooks/queries/queryKeys.ts

@@ -113,6 +113,8 @@ export const queryKeys = {
   files: {
     all: ['files'] as const,
     list: (ownerId?: string) => [...queryKeys.files.all, 'list', ownerId || 'anonymous'] as const,
+    /** The owner's trash (ADR 0043 D5) — under `files.all`, so one invalidation covers both. */
+    trash: (ownerId?: string) => [...queryKeys.files.all, 'trash', ownerId || 'anonymous'] as const,
   },
 
   // Connected apps (OAuth grants the user has authorized)

package/src/ui/hooks/queries/useFileQueries.ts

@@ -27,6 +27,12 @@ export interface RawUserFile {
   createdAt?: string;
   metadata?: Record<string, unknown>;
   variants?: unknown[];
+  /** Whether any application uses the file (ADR 0043 D5). */
+  inUse?: boolean;
+  /** `blocked`: taken down after a content claim (ADR 0043 D10). */
+  status?: string;
+  /** When the owner moved it to trash (ADR 0043 D5). */
+  trashedAt?: string | null;
 }
 
 /** One page of the infinite file list. */
@@ -48,31 +54,52 @@ export function mapRawFileToMetadata(raw: RawUserFile): FileMetadata {
     length: raw.size ?? 0,
     chunkSize: 0,
     uploadDate: raw.createdAt ?? '',
+    ...(typeof raw.inUse === 'boolean' ? { inUse: raw.inUse } : {}),
+    ...(raw.status === 'active' || raw.status === 'trash' || raw.status === 'blocked'
+      ? { status: raw.status }
+      : {}),
+    ...(typeof raw.trashedAt === 'string' ? { trashedAt: raw.trashedAt } : {}),
     metadata: raw.metadata ?? {},
     variants: (raw.variants ?? []) as FileMetadata['variants'],
   };
 }
 
+/** Which of the owner's files a page lists: the library, or the trash (ADR 0043 D5). */
+export type UserFilesListing = 'library' | 'trash';
+
+/** Map one `oxyServices.assets.list` response onto a page. */
+export function toUserFilesPage(
+  response: { files?: unknown[]; total?: number; hasMore?: boolean },
+  offset: number,
+): UserFilesPage {
+  const files = ((response.files ?? []) as RawUserFile[]).map(mapRawFileToMetadata);
+  return {
+    files,
+    total: response.total ?? offset + files.length,
+    hasMore: Boolean(response.hasMore),
+    nextOffset: offset + FILES_PAGE_SIZE,
+  };
+}
+
 /**
- * Infinite-paginated list of the owner's files. Fires on mount and whenever
- * `ownerId` changes (a new key); `staleTime: 0` reloads on every open. The
- * rendered list is `data.pages.flatMap(p => p.files)`.
+ * Infinite-paginated list of the owner's files: the LIBRARY (active files, and
+ * blocked ones shown as removed after a claim) or, with `listing: 'trash'`,
+ * what the owner moved to trash, most recently trashed first. Fires on mount
+ * and whenever `ownerId` changes (a new key); `staleTime: 0` reloads on every
+ * open. The rendered list is `data.pages.flatMap(p => p.files)`.
  */
-export const useUserFilesInfinite = (ownerId?: string) => {
+export const useUserFilesInfinite = (ownerId?: string, listing: UserFilesListing = 'library') => {
   const { oxyServices } = useOxy();
   return useInfiniteQuery<UserFilesPage, Error>({
-    queryKey: queryKeys.files.list(ownerId),
+    queryKey: listing === 'trash' ? queryKeys.files.trash(ownerId) : queryKeys.files.list(ownerId),
     queryFn: async ({ pageParam }) => {
       const offset = typeof pageParam === 'number' ? pageParam : 0;
-      const response = await oxyServices.assets.list({ limit: FILES_PAGE_SIZE, offset });
-      const raw = (response.files ?? []) as RawUserFile[];
-      const files = raw.map(mapRawFileToMetadata);
-      return {
-        files,
-        total: response.total ?? offset + files.length,
-        hasMore: Boolean(response.hasMore),
-        nextOffset: offset + FILES_PAGE_SIZE,
-      };
+      const response = await oxyServices.assets.list({
+        limit: FILES_PAGE_SIZE,
+        offset,
+        ...(listing === 'trash' ? { status: 'trash' as const } : {}),
+      });
+      return toUserFilesPage(response, offset);
     },
     initialPageParam: 0,
     getNextPageParam: (lastPage) => (lastPage.hasMore ? lastPage.nextOffset : undefined),
@@ -114,13 +141,15 @@ export function prependFileToCache(
   });
 }
 
-/** Remove a file (by id) from every page. */
+/** Remove a file (by id) from every page of the library, or of the trash. */
 export function removeFileFromCache(
   queryClient: QueryClient,
   ownerId: string | undefined,
   fileId: string,
+  listing: UserFilesListing = 'library',
 ): void {
-  queryClient.setQueryData<UserFilesInfinite>(fileListKey(ownerId), (data) =>
+  const key = listing === 'trash' ? queryKeys.files.trash(ownerId) : fileListKey(ownerId);
+  queryClient.setQueryData<UserFilesInfinite>(key, (data) =>
     data ? mapPages(data, (files) => files.filter((f) => f.id !== fileId)) : data,
   );
 }

package/src/ui/hooks/queries/useSupervision.ts

@@ -0,0 +1,25 @@
+import { useQuery } from '@tanstack/react-query';
+import { useOxy } from '../../context/OxyContext';
+export const supervisionQueryKeys = {
+  all: ['oxy', 'safety', 'supervision'] as const,
+  account: (id: string, sessionId: string) =>
+    ['oxy', 'safety', 'supervision', id, sessionId] as const,
+};
+/** Advisory UI state only. Every read/write still requires the live server policy. */
+export function useSupervision() {
+  const { oxyServices, user, isAuthenticated, activeSessionId } = useOxy();
+  const result = useQuery({
+    queryKey: supervisionQueryKeys.account(user?.id ?? '', activeSessionId ?? ''),
+    queryFn: () => oxyServices.safety.supervisionState(),
+    enabled: isAuthenticated && !!activeSessionId && user?.kind === 'personal',
+    staleTime: 0,
+    gcTime: 0,
+    refetchOnWindowFocus: 'always',
+    refetchOnMount: 'always',
+    retry: false,
+  });
+  return {
+    ...result,
+    data: result.isFetchedAfterMount && !result.isError ? result.data : undefined,
+  };
+}