@oxyhq/services 27.1.3 → 29.0.0

package/lib/typescript/module/ui/runtime/createOxyRuntime.d.ts

@@ -0,0 +1,144 @@
+import type { DeviceDirectory, DeviceSessionState } from '@oxyhq/contracts';
+import type { ClientSession, User } from '@oxyhq/core';
+import type { IdentitySessionBinding } from '../session/identityBinding.js';
+import type { OxyRuntimeSnapshot } from './types.js';
+/**
+ * A change of SUBJECT — the account the session acts as.
+ *
+ * `previous === null` is an initial sign-in (nothing account-scoped is cached
+ * yet); `next === null` is a sign-out; both non-null and different is a switch,
+ * the only case that must invalidate a warm cache.
+ */
+export interface SubjectTransition {
+    previous: string | null;
+    next: string | null;
+}
+/**
+ * The three seams the runtime reads, declared STRUCTURALLY rather than as the
+ * concrete `OxyServices` / `SessionClient` / `SessionClientHost` types.
+ *
+ * The real classes satisfy them, so nothing changes at the call site — but a
+ * test can hand the runtime three plain objects instead of casting a stub
+ * through `unknown`, which is how a stub silently drifts from the interface it
+ * pretends to implement.
+ */
+export interface RuntimeClient {
+    getAccessToken(): string | null;
+    getUsersByIds(ids: string[]): Promise<User[]>;
+}
+export interface RuntimeSessionClient {
+    getState(): DeviceSessionState | null;
+    getDirectory(): DeviceDirectory | null;
+    subscribe(listener: (state: DeviceSessionState | null) => void): () => void;
+    refreshDirectory(): Promise<void>;
+    activateContext(contextId: string): Promise<void>;
+    signOutContext(contextId: string): Promise<void>;
+    signOutPrincipal(principalId: string): Promise<void>;
+}
+export interface RuntimeSessionHost {
+    setCurrentAccountId(accountId: string | null): void;
+}
+export interface OxyRuntimeConfig {
+    oxyServices: RuntimeClient;
+    sessionClient: RuntimeSessionClient;
+    sessionClientHost: RuntimeSessionHost;
+    /** `null` for every account-mode runtime; the pin binding in identity mode. */
+    identity: IdentitySessionBinding | null;
+    /**
+     * Reset account-scoped caches. Called BETWEEN the bearer commit and the
+     * snapshot publish, which is the whole point of routing every fact change
+     * through one transition (ADR 0002's ordering invariant): a consumer woken by
+     * a switch must never read a cache entry belonging to the previous subject.
+     */
+    onSubjectChange?: (transition: SubjectTransition) => void;
+    /**
+     * The device reports zero accounts. Local UI teardown only — the durable
+     * device credential is the caller's decision, gated on a `request`-origin
+     * verdict.
+     */
+    onDeviceEmpty: () => Promise<void>;
+    /** Persist the projected session-id list (display/bookkeeping storage). */
+    onSessionsProjected?: (sessionIds: string[]) => void;
+    /**
+     * Identity mode only: the pinned account is unknown or has left this device's
+     * session set, so the session must be re-derived from the local identity key.
+     * Projecting anything here would mean projecting somebody else's account.
+     */
+    onIdentityUnbound?: (binding: IdentitySessionBinding, revision: number) => void;
+    logger: (message: string, error?: unknown) => void;
+}
+/**
+ * The headless session runtime (ADR 0004).
+ *
+ * It owns the session facts and the ORDER in which they become visible. React
+ * is an adapter: the provider hands components this object and they subscribe
+ * with selectors, so an unrelated change (a locale, a dialog opening) cannot
+ * rebuild an auth consumer's view.
+ */
+export interface OxyRuntime {
+    getSnapshot(): OxyRuntimeSnapshot;
+    subscribe(listener: () => void): () => void;
+    /** Begin projecting `SessionClient` transitions. Returns the disposer. */
+    start(): () => void;
+    /**
+     * Project the client's current device state onto the snapshot. Idempotent and
+     * revision-guarded: a projection whose profile fetch was overtaken by a
+     * fresher state discards itself rather than publishing a stale subject.
+     */
+    reconcileFromClient(): Promise<void>;
+    /** Read the device directory and publish it (opts this runtime into ADR 0002). */
+    refreshDirectory(): Promise<void>;
+    /**
+     * Make one `principal acting as account` context active (ADR 0002).
+     *
+     * `contextId`, never an account id: on a device holding two people the same
+     * organization is reachable through both, and an account id cannot name which
+     * route to take.
+     */
+    activateContext(contextId: string): Promise<void>;
+    /**
+     * Remove ONE `principal → account` pair. The same account reached through a
+     * second person is a different session with a different audit actor, and it
+     * stays.
+     *
+     * Context ids are NOT stable across a removal: the server offers the pair
+     * again under a NEW id on the next directory read, so nothing may cache one
+     * across this call.
+     */
+    signOutContext(contextId: string): Promise<void>;
+    /** Remove ONE PERSON and every context they reach, and nobody else's. */
+    signOutPrincipal(principalId: string): Promise<void>;
+    /**
+     * Run several fact changes as ONE transition.
+     *
+     * A session commit sets the optimistic session mirror, the active session id
+     * and the account. Left as three transitions those are three publishes, and
+     * — worse — the account is compared against a different baseline each time,
+     * so an account-scoped cache reset could run against a half-applied session.
+     * Batched, subscribers are woken once, after all of it, with the reset having
+     * run exactly once in between.
+     */
+    batch(mutate: () => void): void;
+    setAccount(user: User): void;
+    setLoading(loading: boolean): void;
+    setError(error: string | null): void;
+    setStorageReady(ready: boolean): void;
+    setTokenReady(ready: boolean): void;
+    setHasAccessToken(has: boolean): void;
+    setSwitching(switching: boolean): void;
+    markAuthResolved(): void;
+    /**
+     * Merge an optimistic local session mirror so the UI moves before the server
+     * round-trip. The authoritative projection overwrites it a moment later; both
+     * write the SAME field, so there is still exactly one owner.
+     */
+    mergeSessions(incoming: ClientSession[], options?: {
+        merge?: boolean;
+        preserveSessionIds?: string[];
+    }): void;
+    setActiveSessionId(sessionId: string | null): void;
+    /** Local teardown: drop the session projection without touching the server. */
+    clearSession(): void;
+}
+export declare function createOxyRuntime(config: OxyRuntimeConfig): OxyRuntime;
+//# sourceMappingURL=createOxyRuntime.d.ts.map

package/lib/typescript/module/ui/runtime/createOxyRuntime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createOxyRuntime.d.ts","sourceRoot":"","sources":["../../../../../src/ui/runtime/createOxyRuntime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,aAAa,CAAC;AAYtE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA4B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAoC,MAAM,YAAS,CAAC;AAEpF;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,IAAI,kBAAkB,GAAG,IAAI,CAAC;IACtC,YAAY,IAAI,eAAe,GAAG,IAAI,CAAC;IACvC,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5E,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,kBAAkB;IACjC,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;CACrD;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,aAAa,CAAC;IAC3B,aAAa,EAAE,oBAAoB,CAAC;IACpC,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAExC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAE1D;;;;OAIG;IACH,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnC,2EAA2E;IAC3E,mBAAmB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;IAErD;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAEhF,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACpD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,IAAI,kBAAkB,CAAC;IAClC,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IAE5C,0EAA0E;IAC1E,KAAK,IAAI,MAAM,IAAI,CAAC;IAEpB;;;;OAIG;IACH,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC,kFAAkF;IAClF,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAElC;;;;;;OAMG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;;OAQG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD,yEAAyE;IACzE,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErD;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAEhC,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IACrC,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACtC,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACpC,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC;IACtC,YAAY,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,gBAAgB,IAAI,IAAI,CAAC;IAEzB;;;;OAIG;IACH,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7G,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAEnD,+EAA+E;IAC/E,YAAY,IAAI,IAAI,CAAC;CACtB;AA2DD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAyYrE"}

package/lib/typescript/module/ui/runtime/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The headless session runtime (ADR 0004).
+ *
+ * `createOxyRuntime` owns the session facts and the order in which they become
+ * visible; `useRuntimeSnapshot` / `useRuntimeSelector` are the React adapter
+ * over it. Nothing here imports React except the adapter, and nothing in the
+ * runtime reads React state — which is what lets the provider hold ONE stable
+ * reference and stop rebuilding a 58-field context value on every keystroke.
+ */
+export { createOxyRuntime } from './createOxyRuntime.js';
+export type { OxyRuntime, OxyRuntimeConfig, RuntimeClient, RuntimeSessionClient, RuntimeSessionHost, SubjectTransition, } from './createOxyRuntime.js';
+export { useRuntimeSnapshot, useRuntimeSelector } from './useRuntimeSnapshot.js';
+export { OxyRuntimeHandleProvider, OxyRuntimeMissingError, useActiveAccount, useDeviceDirectory, useOxyRuntime, useOxySnapshot, } from './runtimeContext.js';
+export type { ActiveAccount } from './runtimeContext.js';
+export type { OxyRuntimeError, OxyRuntimeSnapshot, OxyRuntimeStatus, OxyTokenStatus, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/typescript/module/ui/runtime/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/ui/runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAoB,CAAC;AACtD,YAAY,EACV,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,uBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,yBAAsB,CAAC;AAC9E,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,cAAc,GACf,MAAM,qBAAkB,CAAC;AAC1B,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAkB,CAAC;AACtD,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,MAAM,YAAS,CAAC"}

package/lib/typescript/module/ui/runtime/runtimeContext.d.ts

@@ -0,0 +1,43 @@
+import type { DeviceDirectory } from '@oxyhq/contracts';
+import type { DeviceContext, User } from '@oxyhq/core';
+import type { OxyRuntime } from './createOxyRuntime.js';
+import type { OxyRuntimeStatus } from './types.js';
+export declare const OxyRuntimeHandleProvider: import("react").Provider<OxyRuntime | null>;
+export declare class OxyRuntimeMissingError extends Error {
+    readonly code = "oxy_runtime_missing";
+    constructor();
+}
+/** The runtime this provider owns. THROWS when no `<OxyProvider>` is mounted. */
+export declare function useOxyRuntime(): OxyRuntime;
+export interface ActiveAccount {
+    /**
+     * The human whose authentication backs the session — the audit actor. Equal
+     * to {@link ActiveAccount.account} unless a delegated context is active.
+     */
+    principal: User | null;
+    /** The account the session acts AS — what a profile header renders. */
+    account: User | null;
+    /** The resolved `principal acting as account` pair, when a directory is held. */
+    context: DeviceContext | null;
+    /** Whether the actor and the subject are different accounts. */
+    isDelegated: boolean;
+    status: OxyRuntimeStatus;
+}
+/**
+ * Who this app is running as, with the actor and the subject kept apart.
+ *
+ * Unlike `useOxy()`, this re-renders only when one of those five facts moves —
+ * a locale change, a dialog opening or a session-list refresh does not reach it.
+ */
+export declare function useActiveAccount(): ActiveAccount;
+/**
+ * The device directory — every principal on this device and the contexts each
+ * may act as (ADR 0002).
+ *
+ * `null` until something calls `runtime.refreshDirectory()`. A client that
+ * never asks for one never pays for the round trip.
+ */
+export declare function useDeviceDirectory(): DeviceDirectory | null;
+/** The whole runtime snapshot. Prefer a narrower hook where one exists. */
+export declare function useOxySnapshot(): ReturnType<OxyRuntime['getSnapshot']>;
+//# sourceMappingURL=runtimeContext.d.ts.map

package/lib/typescript/module/ui/runtime/runtimeContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/runtime/runtimeContext.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAS,CAAC;AAgBhD,eAAO,MAAM,wBAAwB,6CAAmC,CAAC;AAKzE,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,yBAAyB;;CAMvC;AAED,iFAAiF;AACjF,wBAAgB,aAAa,IAAI,UAAU,CAM1C;AAED,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,uEAAuE;IACvE,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,iFAAiF;IACjF,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;IAC9B,gEAAgE;IAChE,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AA2BD;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAEhD;AAKD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,eAAe,GAAG,IAAI,CAE3D;AAED,2EAA2E;AAC3E,wBAAgB,cAAc,IAAI,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAEtE"}

package/lib/typescript/module/ui/runtime/types.d.ts

@@ -0,0 +1,89 @@
+import type { DeviceDirectory, DeviceSessionState } from '@oxyhq/contracts';
+import type { ClientSession, DeviceContext, User } from '@oxyhq/core';
+/**
+ * The runtime's coarse verdict about this device's session.
+ *
+ * `'booting'` is NOT "signed out but we are still looking": it is the honest
+ * "undetermined" that every readiness gate in the SDK exists to express, and it
+ * ends exactly once at the first cold-boot resolution. `'error'` is reserved for
+ * a resolved boot that produced no account AND recorded a failure — a failed
+ * sign-in against a signed-out device is `'signed_out'` with an `error`, because
+ * the device really is signed out.
+ */
+export type OxyRuntimeStatus = 'booting' | 'authenticated' | 'signed_out' | 'error';
+/**
+ * Whether a bearer usable for private calls is planted right now.
+ *
+ * `'refreshing'` covers both halves of the gap the SDK already tracked with two
+ * separate booleans: a bearer that is present but whose readiness gate is shut
+ * (a commit in flight), and an authenticated account whose bearer has been
+ * invalidated and is being re-minted. Both mean the same thing to a caller —
+ * wait, do not treat this as signed out.
+ */
+export type OxyTokenStatus = 'missing' | 'refreshing' | 'ready' | 'error';
+export interface OxyRuntimeError {
+    message: string;
+    code: string;
+}
+/**
+ * The ONE observable state of an `OxyRuntime` (ADR 0004).
+ *
+ * Frozen and referentially stable: a new object is published only when
+ * something actually changed, so `useSyncExternalStore` can compare by identity
+ * and a selector over an unchanged field never re-renders.
+ *
+ * Every field is either a fact the runtime owns or a pure derivation of one.
+ * There is no second writable store: `sessions`, `activeSessionId`, `status`
+ * and `tokenStatus` are computed by the one snapshot builder, so two of them can
+ * never disagree about the same device.
+ */
+export interface OxyRuntimeSnapshot {
+    status: OxyRuntimeStatus;
+    /**
+     * The device DIRECTORY (ADR 0002) — principals and the contexts each may act
+     * as. `null` until something asks for one; the flat lane never pays for it.
+     */
+    device: DeviceDirectory | null;
+    /**
+     * The flat, server-authoritative device state. Kept beside {@link device}
+     * because it is what the compatibility projections below are derived from,
+     * and because the two describe the same device at the same `revision`.
+     */
+    deviceState: DeviceSessionState | null;
+    /** The active `principal acting as account` pair, when a directory is held. */
+    activeContext: DeviceContext | null;
+    /**
+     * The human whose authentication backs the session — the audit actor.
+     *
+     * Equal to {@link account} on a device with no directory and on any
+     * non-delegated context: the flat lane cannot tell the two apart, and saying
+     * so by making them the same object is more honest than leaving this `null`.
+     */
+    principal: User | null;
+    /** The account the session acts AS — what a profile header renders. */
+    account: User | null;
+    tokenStatus: OxyTokenStatus;
+    /**
+     * Whether the first cold boot has concluded. Monotonic: once `true` it never
+     * reverts, so a later transient signed-out state is never mistaken for
+     * "still booting".
+     */
+    authResolved: boolean;
+    /** A context activation / account switch is in flight. */
+    switching: boolean;
+    error: OxyRuntimeError | null;
+    sessions: ClientSession[];
+    activeSessionId: string | null;
+    /** A sign-in / sign-out operation is in flight. */
+    isLoading: boolean;
+    /** The local display/bookkeeping storage has resolved. */
+    storageReady: boolean;
+    /** A bearer is planted on the client instance right now. */
+    hasAccessToken: boolean;
+    /**
+     * The commit gate. Shut while a session commit is mid-flight so a consumer
+     * cannot fire a private call between the token landing and the projection.
+     */
+    tokenReady: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/lib/typescript/module/ui/runtime/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/ui/runtime/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,eAAe,GAAG,YAAY,GAAG,OAAO,CAAC;AAEpF;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,YAAY,GAAG,OAAO,GAAG,OAAO,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,gBAAgB,CAAC;IAEzB;;;OAGG;IACH,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IAE/B;;;;OAIG;IACH,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAEvC,+EAA+E;IAC/E,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IAEpC;;;;;;OAMG;IACH,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IAEvB,uEAAuE;IACvE,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IAErB,WAAW,EAAE,cAAc,CAAC;IAE5B;;;;OAIG;IACH,YAAY,EAAE,OAAO,CAAC;IAEtB,0DAA0D;IAC1D,SAAS,EAAE,OAAO,CAAC;IAEnB,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAM9B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAE/B,mDAAmD;IACnD,SAAS,EAAE,OAAO,CAAC;IAEnB,0DAA0D;IAC1D,YAAY,EAAE,OAAO,CAAC;IAEtB,4DAA4D;IAC5D,cAAc,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,UAAU,EAAE,OAAO,CAAC;CACrB"}

package/lib/typescript/module/ui/runtime/useRuntimeSnapshot.d.ts

@@ -0,0 +1,23 @@
+import type { OxyRuntime } from './createOxyRuntime.js';
+import type { OxyRuntimeSnapshot } from './types.js';
+/**
+ * Subscribe to the whole runtime snapshot.
+ *
+ * The runtime publishes a frozen object only when a fact actually changed, so
+ * identity comparison is exact: a locale change, a dialog opening or an
+ * unrelated query settling does not wake anything subscribed here.
+ */
+export declare function useRuntimeSnapshot(runtime: OxyRuntime): OxyRuntimeSnapshot;
+/**
+ * Subscribe to one derived value of the runtime snapshot.
+ *
+ * The selection is cached against the snapshot it was computed from, which is
+ * what makes a selector returning a fresh object (`{user, isAuthenticated}`)
+ * safe here: `useSyncExternalStore` calls `getSnapshot` several times per
+ * commit and would otherwise see a new object every call and loop.
+ *
+ * `selector` must be stable — hoist it to module scope or wrap it in
+ * `useCallback`. An inline arrow re-subscribes on every render.
+ */
+export declare function useRuntimeSelector<T>(runtime: OxyRuntime, selector: (snapshot: OxyRuntimeSnapshot) => T, isEqual?: (a: T, b: T) => boolean): T;
+//# sourceMappingURL=useRuntimeSnapshot.d.ts.map

package/lib/typescript/module/ui/runtime/useRuntimeSnapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useRuntimeSnapshot.d.ts","sourceRoot":"","sources":["../../../../../src/ui/runtime/useRuntimeSnapshot.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAS,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,UAAU,GAAG,kBAAkB,CAE1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,OAAO,EAAE,UAAU,EACnB,QAAQ,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,CAAC,EAC7C,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,OAAO,GAChC,CAAC,CAqBH"}

package/lib/typescript/module/ui/screens/AccountMembersScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AccountMembersScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/AccountMembersScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAkB/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAqB,CAAC;AAkB3D;;;;GAIG;AACH,QAAA,MAAM,oBAAoB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAgbnD,CAAC;AAEF,eAAe,oBAAoB,CAAC"}
+{"version":3,"file":"AccountMembersScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/AccountMembersScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAkB/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAqB,CAAC;AAkB3D;;;;GAIG;AACH,QAAA,MAAM,oBAAoB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAibnD,CAAC;AAEF,eAAe,oBAAoB,CAAC"}

package/lib/typescript/module/ui/screens/CreateAccountScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CreateAccountScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/CreateAccountScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAM/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAqB,CAAC;AAmG3D;;;;;GAKG;AACH,QAAA,MAAM,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAkVlD,CAAC;AAEF,eAAe,mBAAmB,CAAC"}
+{"version":3,"file":"CreateAccountScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/CreateAccountScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAM/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAqB,CAAC;AAsF3D;;;;;GAKG;AACH,QAAA,MAAM,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAkVlD,CAAC;AAEF,eAAe,mBAAmB,CAAC"}

package/lib/typescript/module/ui/screens/trust/TrustLeaderboardScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TrustLeaderboardScreen.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/screens/trust/TrustLeaderboardScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAgB/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAAwB,CAAC;AAa9D,QAAA,MAAM,sBAAsB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAuJrD,CAAC;AA0CF,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"TrustLeaderboardScreen.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/screens/trust/TrustLeaderboardScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAgB/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAAwB,CAAC;AAY9D,QAAA,MAAM,sBAAsB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAuJrD,CAAC;AA0CF,eAAe,sBAAsB,CAAC"}

package/lib/typescript/module/ui/screens/trust/TrustRulesScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TrustRulesScreen.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/screens/trust/TrustRulesScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAO/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAAwB,CAAC;AAiB9D,QAAA,MAAM,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAqF/C,CAAC;AAEF,eAAe,gBAAgB,CAAC"}
+{"version":3,"file":"TrustRulesScreen.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/screens/trust/TrustRulesScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAQ/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAAwB,CAAC;AAiB9D,QAAA,MAAM,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAqF/C,CAAC;AAEF,eAAe,gBAAgB,CAAC"}

package/lib/typescript/module/ui/server.d.ts

@@ -22,7 +22,6 @@ export declare const useStorage: () => {
 };
 export declare const ProfileScreen: () => null;
 export declare const useAuthStore: () => {};
-export declare const useAccountStore: () => {};
 export declare const toast: (() => void) & {
     success: () => void;
     error: () => void;

package/lib/typescript/module/ui/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../src/ui/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,eAAO,MAAM,WAAW,YAAgB,CAAC;AACzC,eAAO,MAAM,eAAe,YAAgB,CAAC;AAC7C,eAAO,MAAM,QAAQ,YAAgB,CAAC;AACtC,eAAO,MAAM,QAAQ,YAAgB,CAAC;AACtC,eAAO,MAAM,YAAY,YAAgB,CAAC;AAC1C,eAAO,MAAM,YAAY,YAAgB,CAAC;AAG1C,eAAO,MAAM,MAAM,UAAW,CAAC;AAG/B,eAAO,MAAM,OAAO,UAAW,CAAC;AAChC,eAAO,MAAM,SAAS,UAAW,CAAC;AAClC,eAAO,MAAM,UAAU;;;CAA0B,CAAC;AAGlD,eAAO,MAAM,aAAa,YAAgB,CAAC;AAG3C,eAAO,MAAM,YAAY,UAAW,CAAC;AACrC,eAAO,MAAM,eAAe,UAAW,CAAC;AAGxC,eAAO,MAAM,KAAK;;;;;;;CAUjB,CAAC;AAGF,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GACtB,MAAM,0BAAuB,CAAC;AAC/B,YAAY,EAAE,sBAAsB,EAAE,MAAM,0BAAuB,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../src/ui/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,eAAO,MAAM,WAAW,YAAgB,CAAC;AACzC,eAAO,MAAM,eAAe,YAAgB,CAAC;AAC7C,eAAO,MAAM,QAAQ,YAAgB,CAAC;AACtC,eAAO,MAAM,QAAQ,YAAgB,CAAC;AACtC,eAAO,MAAM,YAAY,YAAgB,CAAC;AAC1C,eAAO,MAAM,YAAY,YAAgB,CAAC;AAG1C,eAAO,MAAM,MAAM,UAAW,CAAC;AAG/B,eAAO,MAAM,OAAO,UAAW,CAAC;AAChC,eAAO,MAAM,SAAS,UAAW,CAAC;AAClC,eAAO,MAAM,UAAU;;;CAA0B,CAAC;AAGlD,eAAO,MAAM,aAAa,YAAgB,CAAC;AAG3C,eAAO,MAAM,YAAY,UAAW,CAAC;AAGrC,eAAO,MAAM,KAAK;;;;;;;CAUjB,CAAC;AAGF,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GACtB,MAAM,0BAAuB,CAAC;AAC/B,YAAY,EAAE,sBAAsB,EAAE,MAAM,0BAAuB,CAAC"}

package/lib/typescript/module/ui/session/authStore.d.ts

@@ -1,25 +1,76 @@
 /**
  * Platform `AuthStateStore` for `@oxyhq/services`.
  *
- * The zero-cookie device model persists the durable device credential
- * (`deviceId` + `deviceSecret`) per origin (web) / per device (native), and the
- * SDK re-mints the access token from that credential on cold boot. `@oxyhq/core`
- * owns the store shape + logic (`createWebAuthStateStore` /
- * `createNativeAuthStateStore`); this module only selects the platform storage
- * seam:
+ * The device model persists the durable device credential (`deviceId` +
+ * `deviceSecret`) per origin (web) / per device (native), and the SDK re-mints
+ * the access token from that credential on cold boot. `@oxyhq/core` owns the
+ * store shape + logic (`createWebAuthStateStore` / `createNativeAuthStateStore` /
+ * `createMemoryAuthStateStore`); this module only selects the seam:
  *
+ *  - `storage: 'ephemeral'` → `createMemoryAuthStateStore()`, on EVERY platform.
  *  - web  → `createWebAuthStateStore()` (localStorage, in-memory fallback).
  *  - native → `createNativeAuthStateStore(secureKV)` for the SESSION blob over
  *    the shared `createNativeSecureKeyValueStorage()` adapter
- *    (`expo-secure-store`, AsyncStorage fallback).
+ *    (`expo-secure-store`, AsyncStorage fallback), WRAPPED so every credential
+ *    it persists is also mirrored into the device-wide shared slot.
+ *
+ * The native wrapper is how several official apps end up on ONE `DeviceSession`
+ * (and therefore one active context): whichever app proves a credential publishes
+ * it, and a later-installed sibling adopts it during cold boot instead of asking
+ * for the Commons identity key. The mirror is additive — it can neither change
+ * nor fail the app's own durable write.
  */
-import { type AuthStateStore } from '@oxyhq/core';
+import { type AuthStateStore, type SessionMode } from '@oxyhq/core';
+export interface PlatformAuthStateStoreOptions {
+    /**
+     * Who owns the session this provider resolves. Only `'account'` mirrors into
+     * the device-wide shared slot.
+     *
+     * `'identity'` (the vault) is deliberately excluded, which keeps its storage
+     * behaviour byte-for-byte what it is today. The vault's credential is a
+     * perfectly valid device credential, so publishing it would arguably be
+     * correct — but it would also let every ordinary app on the device join the
+     * vault's device session as a side effect of the vault persisting a token, and
+     * "a background write changes which session five other apps boot into" is not
+     * a decision a storage seam gets to make.
+     */
+    sessionMode?: SessionMode;
+    /**
+     * Whether this origin/app may persist a durable device credential AT ALL.
+     *
+     * `'ephemeral'` stores nothing durable and mirrors nothing: the session lives
+     * in memory for the lifetime of the page and is gone on reload. Its one caller
+     * is `auth.oxy.so` with the browser hub enabled (issue #937 Phase 5, ADR 0003),
+     * where the durable credential for the browser profile is the server-side
+     * DeviceSession behind the `__Host-oxy-device` handle.
+     *
+     * See `OxyProviderProps.deviceCredentialStorage` for why the answer to "let the
+     * hub be authoritative" is to stop persisting the other credential rather than
+     * to consult it second.
+     */
+    storage?: 'persistent' | 'ephemeral';
+}
 /**
  * Build the platform {@link AuthStateStore} for this runtime.
  *
  * Native persists the SESSION blob (`deviceId` + `deviceSecret` + cached access
  * token) per-app in SecureStore; the SDK re-mints the access token from the
  * device credential on the next cold boot.
+ *
+ * ## The ephemeral check is FIRST, and the order is load-bearing
+ *
+ * It short-circuits above the `isReactNative()` branch so an ephemeral caller can
+ * never reach the native path — and therefore can never reach the shared-slot
+ * mirroring wrapper. Checked after that branch instead, an origin that has
+ * declined to persist a credential would publish one into the device-wide slot
+ * every sibling app adopts on cold boot: it would keep nothing itself while
+ * deciding which session five other apps boot into.
+ *
+ * That is unreachable today because the only ephemeral caller is a web origin, so
+ * `isReactNative()` is false there anyway. Unreachable today is exactly the kind
+ * of guarantee that stops holding when someone adds the second caller, so it is
+ * structural here rather than incidental, and
+ * `__tests__/session/authStoreEphemeral.test.ts` holds the ordering directly.
  */
-export declare function createPlatformAuthStateStore(): AuthStateStore;
+export declare function createPlatformAuthStateStore(options?: PlatformAuthStateStoreOptions): AuthStateStore;
 //# sourceMappingURL=authStore.d.ts.map

package/lib/typescript/module/ui/session/authStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/authStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AAIrB;;;;;;GAMG;AACH,wBAAgB,4BAA4B,IAAI,cAAc,CAM7D"}
+{"version":3,"file":"authStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/authStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAKL,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AAKrB,MAAM,WAAW,6BAA6B;IAC5C;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,YAAY,GAAG,WAAW,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,GAAE,6BAAkC,GAC1C,cAAc,CAiBhB"}

package/lib/typescript/module/ui/session/sharedDeviceCredentialStore.d.ts

@@ -0,0 +1,32 @@
+import { type SharedDeviceCredentialStore } from '@oxyhq/core';
+/**
+ * The iOS Keychain Access Group every official Oxy app declares in its
+ * entitlements. Shared with the identity slots — the group is the app-group
+ * boundary, not the secret's identity.
+ */
+export declare const IOS_KEYCHAIN_ACCESS_GROUP = "group.so.oxy.shared";
+/**
+ * The iOS `keychainService` for the DEVICE SESSION credential. Deliberately
+ * distinct from every identity and recovery service; do not reuse one of those
+ * here, and do not drop it (an item written with no service shares the legacy
+ * identity slot's namespace inside the group).
+ */
+export declare const IOS_DEVICE_SESSION_KEYCHAIN_SERVICE = "oxy_device_session";
+/** The single key holding the JSON-encoded `{deviceId, deviceSecret}` pair. */
+export declare const SHARED_DEVICE_SESSION_STORAGE_KEY = "oxy_shared_device_session_v1";
+/**
+ * The shared DeviceSession credential slot for this runtime, or `null` when
+ * there is none.
+ *
+ * The branch is on the PLATFORM, not on which module happens to load, because
+ * `expo-secure-store` loads perfectly well on Android — it would just quietly
+ * ignore `keychainAccessGroup` and read a package-private item, which looks
+ * exactly like an empty shared slot. This is the same iOS-vs-Android split
+ * `KeyManager` makes for the shared identity, for the same reason.
+ *
+ * Any other native platform gets the broker, which answers `unsupported` when
+ * the module is not linked — so the lane is simply off, which is the safe
+ * direction.
+ */
+export declare function createPlatformSharedDeviceCredentialStore(): SharedDeviceCredentialStore | null;
+//# sourceMappingURL=sharedDeviceCredentialStore.d.ts.map

package/lib/typescript/module/ui/session/sharedDeviceCredentialStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharedDeviceCredentialStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/sharedDeviceCredentialStore.ts"],"names":[],"mappings":"AAyCA,OAAO,EAIL,KAAK,2BAA2B,EACjC,MAAM,aAAa,CAAC;AAErB;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,uBAAuB,CAAC;AAExE,+EAA+E;AAC/E,eAAO,MAAM,iCAAiC,iCAAiC,CAAC;AA0OhF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yCAAyC,IAAI,2BAA2B,GAAG,IAAI,CAK9F"}

package/lib/typescript/module/ui/stores/authStore.d.ts

@@ -1,17 +1,61 @@
 import type { User } from '@oxyhq/core';
+import type { OxyRuntime } from '../runtime/index.js';
+/**
+ * The signed-in user, as a zustand-shaped read/write surface.
+ *
+ * It used to BE a zustand store, and that made it a second owner of the
+ * session: the provider wrote `user`/`isAuthenticated` here, `SessionClient`
+ * wrote the same facts into its device state, and nothing reconciled them —
+ * when they disagreed, which one was right was not answerable. It is now a
+ * projection of the ONE `OxyRuntime` (ADR 0004): reads come off the runtime
+ * snapshot and writes go into the runtime, so there is nothing left to drift.
+ *
+ * The zustand SHAPE is kept deliberately — `useAuthStore(selector)`,
+ * `.getState()`, `.setState()`, `.subscribe()` — because a dozen call sites
+ * across this package and the Commons app read the user out of band, from
+ * mutation success handlers and cache helpers that are not inside a render.
+ * Rewriting them is Phase 8's cut, not this one's.
+ *
+ * `fetchUser` and `lastUserFetch` are GONE rather than projected: they were a
+ * five-minute profile cache with zero readers anywhere in the monorepo, and the
+ * Query cache has owned that job since long before this change.
+ */
 export interface AuthState {
     user: User | null;
     isAuthenticated: boolean;
     isLoading: boolean;
     error: string | null;
-    lastUserFetch: number | null;
     loginSuccess: (user: User) => void;
     loginFailure: (error: string) => void;
     logout: () => void;
-    fetchUser: (oxyServices: {
-        getCurrentUser: () => Promise<User>;
-    }, forceRefresh?: boolean) => Promise<void>;
+    /** Replace the signed-in profile after a write (a rename, a new avatar). */
     setUser: (user: User) => void;
 }
-export declare const useAuthStore: import("zustand").UseBoundStore<import("zustand").StoreApi<AuthState>>;
+/** The subset of `AuthState` a caller may push back in through `setState`. */
+export type AuthStatePatch = Partial<Pick<AuthState, 'user' | 'isLoading' | 'error'>>;
+/**
+ * Point this surface at the provider's runtime. Called once by
+ * `OxyRuntimeProvider`; the returned function detaches it again on unmount.
+ *
+ * With nothing bound, reads answer signed-out and writes are dropped. That is
+ * the honest answer for the two places it happens — the SSR shim, and a unit
+ * test poking the store with no provider mounted — and it is why binding is an
+ * explicit call rather than a lazily-created default runtime, which is exactly
+ * the fabricated-forever-loading runtime ADR 0004 deleted.
+ */
+export declare function bindAuthStoreToRuntime(runtime: OxyRuntime): () => void;
+declare function useAuthStoreHook<T>(selector: (state: AuthState) => T): T;
+/**
+ * Read the signed-in user. Zustand-shaped, projected from the runtime.
+ *
+ * A selector that builds an object must be wrapped in `useShallow` (as every
+ * call site here already does) — otherwise a structurally-equal result reads as
+ * a change on every publish.
+ */
+export declare const useAuthStore: typeof useAuthStoreHook & {
+    getState: () => AuthState;
+    setState: (patch: AuthStatePatch) => void;
+    subscribe: (listener: () => void) => (() => void);
+};
+export {};
 //# sourceMappingURL=authStore.d.ts.map

package/lib/typescript/module/ui/stores/authStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/stores/authStore.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAIxC,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IACnC,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,SAAS,EAAE,CAAC,WAAW,EAAE;QAAE,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,EAAE,YAAY,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3G,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;CAC/B;AAED,eAAO,MAAM,YAAY,wEA0CtB,CAAC"}
+{"version":3,"file":"authStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/stores/authStore.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAY,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAErB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IACnC,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,4EAA4E;IAC5E,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;CAC/B;AAED,8EAA8E;AAC9E,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;AAuEtF;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,IAAI,CActE;AA6BD,iBAAS,gBAAgB,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,CAAC,GAAG,CAAC,CAejE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,YAAY;oBAnDJ,SAAS;sBAEL,cAAc,KAAG,IAAI;0BAkBjB,MAAM,IAAI,KAAG,CAAC,MAAM,IAAI,CAAC;CAmCpD,CAAC"}

package/lib/typescript/module/ui/stores/followTargetStore.d.ts

@@ -21,7 +21,7 @@
  * three separate answers, and a UI that keeps only the last one cannot explain
  * why a follow the user can see in their list does nothing in this app.
  */
-import type { FollowApplicationMode, FollowStatus } from '@oxyhq/contracts';
+import type { FollowApplicationMode, FollowRecord, FollowStatus } from '@oxyhq/contracts';
 /** The status of one target, or `undefined` when it has never been read. */
 type StatusMap = Record<string, FollowStatus | undefined>;
 interface FollowTargetState {
@@ -65,6 +65,13 @@ export declare function isFollowedGlobally(status: FollowStatus): boolean;
  * that as authoritative would leave disable/unfollow as no-ops forever.
  */
 export declare function isCompleteFollowStatus(status: FollowStatus): boolean;
+/** Convert one list row into the status shape the follow-target store expects. */
+export declare function followRecordToStatus(record: FollowRecord): FollowStatus;
+/**
+ * Bulk-convert a follow list page into a status map keyed by target id — the
+ * input shape for `useFollowTargetStore.getState().seed(...)`.
+ */
+export declare function followRecordsToStatusMap(records: FollowRecord[]): Record<string, FollowStatus>;
 /**
  * Apply a mode change to a cached status without a round trip.
  *

package/lib/typescript/module/ui/stores/followTargetStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"followTargetStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/stores/followTargetStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAE5E,4EAA4E;AAC5E,KAAK,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,CAAC,CAAC;AAE1D,UAAU,iBAAiB;IACzB,QAAQ,EAAE,SAAS,CAAC;IACpB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAE3C,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;IAC5D;;;;OAIG;IACH,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,IAAI,CAAC;IACtD,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACzD,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;IAChE,uEAAuE;IACvE,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,YAInC,CAAC;AAEF,eAAO,MAAM,oBAAoB,gFAoB9B,CAAC;AAEJ;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAEhE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAGpE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,qBAAqB,GAC1B,YAAY,CAad"}
+{"version":3,"file":"followTargetStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/stores/followTargetStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAE1F,4EAA4E;AAC5E,KAAK,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,CAAC,CAAC;AAE1D,UAAU,iBAAiB;IACzB,QAAQ,EAAE,SAAS,CAAC;IACpB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAE3C,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;IAC5D;;;;OAIG;IACH,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,IAAI,CAAC;IACtD,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACzD,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;IAChE,uEAAuE;IACvE,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,YAInC,CAAC;AAEF,eAAO,MAAM,oBAAoB,gFAoB9B,CAAC;AAEJ;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAEhE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAGpE;AAED,kFAAkF;AAClF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAQvE;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAM9F;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,qBAAqB,GAC1B,YAAY,CAad"}