@oxyhq/services 27.1.3 → 29.0.0

package/src/ui/runtime/runtimeContext.tsx

@@ -0,0 +1,111 @@
+import { createContext, useContext } from 'react';
+import type { DeviceDirectory } from '@oxyhq/contracts';
+import type { DeviceContext, User } from '@oxyhq/core';
+import type { OxyRuntime } from './createOxyRuntime';
+import type { OxyRuntimeStatus } from './types';
+import { useRuntimeSelector, useRuntimeSnapshot } from './useRuntimeSnapshot';
+
+/**
+ * The runtime reference itself, as a context value that NEVER changes identity
+ * (ADR 0004).
+ *
+ * It is deliberately a second context beside the big `OxyContextState` one.
+ * That value is rebuilt whenever any of its fifty-odd members moves — a locale,
+ * a dialog opening — and every hook reading it re-renders with it. Hooks
+ * hanging off this one subscribe to the runtime with a selector instead, so
+ * only a change to what they actually selected wakes them. Retiring the wide
+ * context is Phase 8; this is what its replacements are built on.
+ */
+const OxyRuntimeHandleContext = createContext<OxyRuntime | null>(null);
+
+export const OxyRuntimeHandleProvider = OxyRuntimeHandleContext.Provider;
+
+const RUNTIME_MISSING_MESSAGE =
+  'useOxyRuntime() was called outside <OxyProvider>. Mount <OxyProvider clientId="…"> above this component.';
+
+export class OxyRuntimeMissingError extends Error {
+  readonly code = 'oxy_runtime_missing';
+
+  constructor() {
+    super(RUNTIME_MISSING_MESSAGE);
+    this.name = 'OxyRuntimeMissingError';
+  }
+}
+
+/** The runtime this provider owns. THROWS when no `<OxyProvider>` is mounted. */
+export function useOxyRuntime(): OxyRuntime {
+  const runtime = useContext(OxyRuntimeHandleContext);
+  if (runtime === null) {
+    throw new OxyRuntimeMissingError();
+  }
+  return runtime;
+}
+
+export interface ActiveAccount {
+  /**
+   * The human whose authentication backs the session — the audit actor. Equal
+   * to {@link ActiveAccount.account} unless a delegated context is active.
+   */
+  principal: User | null;
+  /** The account the session acts AS — what a profile header renders. */
+  account: User | null;
+  /** The resolved `principal acting as account` pair, when a directory is held. */
+  context: DeviceContext | null;
+  /** Whether the actor and the subject are different accounts. */
+  isDelegated: boolean;
+  status: OxyRuntimeStatus;
+}
+
+function selectActiveAccount(snapshot: {
+  principal: User | null;
+  account: User | null;
+  activeContext: DeviceContext | null;
+  status: OxyRuntimeStatus;
+}): ActiveAccount {
+  return {
+    principal: snapshot.principal,
+    account: snapshot.account,
+    context: snapshot.activeContext,
+    isDelegated: snapshot.activeContext?.isDelegated ?? false,
+    status: snapshot.status,
+  };
+}
+
+function activeAccountsEqual(a: ActiveAccount, b: ActiveAccount): boolean {
+  return (
+    a.principal === b.principal &&
+    a.account === b.account &&
+    a.context === b.context &&
+    a.isDelegated === b.isDelegated &&
+    a.status === b.status
+  );
+}
+
+/**
+ * Who this app is running as, with the actor and the subject kept apart.
+ *
+ * Unlike `useOxy()`, this re-renders only when one of those five facts moves —
+ * a locale change, a dialog opening or a session-list refresh does not reach it.
+ */
+export function useActiveAccount(): ActiveAccount {
+  return useRuntimeSelector(useOxyRuntime(), selectActiveAccount, activeAccountsEqual);
+}
+
+const selectDirectory = (snapshot: { device: DeviceDirectory | null }): DeviceDirectory | null =>
+  snapshot.device;
+
+/**
+ * The device directory — every principal on this device and the contexts each
+ * may act as (ADR 0002).
+ *
+ * `null` until something calls `runtime.refreshDirectory()`. A client that
+ * never asks for one never pays for the round trip.
+ */
+export function useDeviceDirectory(): DeviceDirectory | null {
+  return useRuntimeSelector(useOxyRuntime(), selectDirectory);
+}
+
+/** The whole runtime snapshot. Prefer a narrower hook where one exists. */
+export function useOxySnapshot(): ReturnType<OxyRuntime['getSnapshot']> {
+  return useRuntimeSnapshot(useOxyRuntime());
+}

package/src/ui/runtime/types.ts

@@ -0,0 +1,110 @@
+import type { DeviceDirectory, DeviceSessionState } from '@oxyhq/contracts';
+import type { ClientSession, DeviceContext, User } from '@oxyhq/core';
+
+/**
+ * The runtime's coarse verdict about this device's session.
+ *
+ * `'booting'` is NOT "signed out but we are still looking": it is the honest
+ * "undetermined" that every readiness gate in the SDK exists to express, and it
+ * ends exactly once at the first cold-boot resolution. `'error'` is reserved for
+ * a resolved boot that produced no account AND recorded a failure — a failed
+ * sign-in against a signed-out device is `'signed_out'` with an `error`, because
+ * the device really is signed out.
+ */
+export type OxyRuntimeStatus = 'booting' | 'authenticated' | 'signed_out' | 'error';
+
+/**
+ * Whether a bearer usable for private calls is planted right now.
+ *
+ * `'refreshing'` covers both halves of the gap the SDK already tracked with two
+ * separate booleans: a bearer that is present but whose readiness gate is shut
+ * (a commit in flight), and an authenticated account whose bearer has been
+ * invalidated and is being re-minted. Both mean the same thing to a caller —
+ * wait, do not treat this as signed out.
+ */
+export type OxyTokenStatus = 'missing' | 'refreshing' | 'ready' | 'error';
+
+export interface OxyRuntimeError {
+  message: string;
+  code: string;
+}
+
+/**
+ * The ONE observable state of an `OxyRuntime` (ADR 0004).
+ *
+ * Frozen and referentially stable: a new object is published only when
+ * something actually changed, so `useSyncExternalStore` can compare by identity
+ * and a selector over an unchanged field never re-renders.
+ *
+ * Every field is either a fact the runtime owns or a pure derivation of one.
+ * There is no second writable store: `sessions`, `activeSessionId`, `status`
+ * and `tokenStatus` are computed by the one snapshot builder, so two of them can
+ * never disagree about the same device.
+ */
+export interface OxyRuntimeSnapshot {
+  status: OxyRuntimeStatus;
+
+  /**
+   * The device DIRECTORY (ADR 0002) — principals and the contexts each may act
+   * as. `null` until something asks for one; the flat lane never pays for it.
+   */
+  device: DeviceDirectory | null;
+
+  /**
+   * The flat, server-authoritative device state. Kept beside {@link device}
+   * because it is what the compatibility projections below are derived from,
+   * and because the two describe the same device at the same `revision`.
+   */
+  deviceState: DeviceSessionState | null;
+
+  /** The active `principal acting as account` pair, when a directory is held. */
+  activeContext: DeviceContext | null;
+
+  /**
+   * The human whose authentication backs the session — the audit actor.
+   *
+   * Equal to {@link account} on a device with no directory and on any
+   * non-delegated context: the flat lane cannot tell the two apart, and saying
+   * so by making them the same object is more honest than leaving this `null`.
+   */
+  principal: User | null;
+
+  /** The account the session acts AS — what a profile header renders. */
+  account: User | null;
+
+  tokenStatus: OxyTokenStatus;
+
+  /**
+   * Whether the first cold boot has concluded. Monotonic: once `true` it never
+   * reverts, so a later transient signed-out state is never mistaken for
+   * "still booting".
+   */
+  authResolved: boolean;
+
+  /** A context activation / account switch is in flight. */
+  switching: boolean;
+
+  error: OxyRuntimeError | null;
+
+  // ── Compatibility projections ────────────────────────────────────────────
+  // Derived, never separately written. They exist because every app still
+  // renders the flat session list; Phase 7 moves them onto the directory.
+
+  sessions: ClientSession[];
+  activeSessionId: string | null;
+
+  /** A sign-in / sign-out operation is in flight. */
+  isLoading: boolean;
+
+  /** The local display/bookkeeping storage has resolved. */
+  storageReady: boolean;
+
+  /** A bearer is planted on the client instance right now. */
+  hasAccessToken: boolean;
+
+  /**
+   * The commit gate. Shut while a session commit is mid-flight so a consumer
+   * cannot fire a private call between the token landing and the projection.
+   */
+  tokenReady: boolean;
+}

package/src/ui/runtime/useRuntimeSnapshot.ts

@@ -0,0 +1,52 @@
+import { useCallback, useRef, useSyncExternalStore } from 'react';
+import type { OxyRuntime } from './createOxyRuntime';
+import type { OxyRuntimeSnapshot } from './types';
+
+/**
+ * Subscribe to the whole runtime snapshot.
+ *
+ * The runtime publishes a frozen object only when a fact actually changed, so
+ * identity comparison is exact: a locale change, a dialog opening or an
+ * unrelated query settling does not wake anything subscribed here.
+ */
+export function useRuntimeSnapshot(runtime: OxyRuntime): OxyRuntimeSnapshot {
+  return useSyncExternalStore(runtime.subscribe, runtime.getSnapshot, runtime.getSnapshot);
+}
+
+/**
+ * Subscribe to one derived value of the runtime snapshot.
+ *
+ * The selection is cached against the snapshot it was computed from, which is
+ * what makes a selector returning a fresh object (`{user, isAuthenticated}`)
+ * safe here: `useSyncExternalStore` calls `getSnapshot` several times per
+ * commit and would otherwise see a new object every call and loop.
+ *
+ * `selector` must be stable — hoist it to module scope or wrap it in
+ * `useCallback`. An inline arrow re-subscribes on every render.
+ */
+export function useRuntimeSelector<T>(
+  runtime: OxyRuntime,
+  selector: (snapshot: OxyRuntimeSnapshot) => T,
+  isEqual?: (a: T, b: T) => boolean,
+): T {
+  const cache = useRef<{ snapshot: OxyRuntimeSnapshot; value: T } | null>(null);
+
+  const getSelection = useCallback((): T => {
+    const snapshot = runtime.getSnapshot();
+    const cached = cache.current;
+    if (cached !== null && cached.snapshot === snapshot) {
+      return cached.value;
+    }
+    const value = selector(snapshot);
+    if (cached !== null && isEqual?.(cached.value, value) === true) {
+      // Same value under the caller's equality: keep the PREVIOUS reference so a
+      // structurally-equal recomputation does not read as a change.
+      cache.current = { snapshot, value: cached.value };
+      return cached.value;
+    }
+    cache.current = { snapshot, value };
+    return value;
+  }, [runtime, selector, isEqual]);
+
+  return useSyncExternalStore(runtime.subscribe, getSelection, getSelection);
+}

package/src/ui/screens/AccountMembersScreen.tsx

@@ -15,7 +15,7 @@ import { Button } from '@oxyhq/bloom/button';
 import { TextField, TextFieldInput } from '@oxyhq/bloom/text-field';
 import { Divider } from '@oxyhq/bloom/divider';
 import type { AccountMember, AccountRole } from '@oxyhq/core';
-import { getNormalizedUserHandle } from '@oxyhq/core';
+import { accountRoleLabel, getNormalizedUserHandle } from '@oxyhq/core';
 import type { BaseScreenProps } from '../types/navigation';
 import { useOxy } from '../context/OxyContext';
 import { useI18n } from '../hooks/useI18n';
@@ -42,7 +42,7 @@ const isUserNotFound = (error: unknown): boolean => {
 const AccountMembersScreen: React.FC<BaseScreenProps> = ({ onClose, goBack, accountId }) => {
   const bloomTheme = useTheme();
   const colors = bloomTheme.colors;
-  const { t } = useI18n();
+  const { t, locale } = useI18n();
 
   useSurfaceHeader({
     title: t('accounts.members.title') || 'Members',
@@ -53,9 +53,10 @@ const AccountMembersScreen: React.FC<BaseScreenProps> = ({ onClose, goBack, acco
 
   const id = typeof accountId === 'string' ? accountId : '';
 
-  const roleLabel = useCallback((role: AccountRole): string => {
-    return t(`accounts.roles.${role}.label`) || role.charAt(0).toUpperCase() + role.slice(1);
-  }, [t]);
+  const roleLabel = useCallback(
+    (role: AccountRole): string => accountRoleLabel(locale, role),
+    [locale],
+  );
 
   const accountQuery = useQuery({
     queryKey: ['accounts', 'detail', id],

package/src/ui/screens/CreateAccountScreen.tsx

@@ -3,7 +3,7 @@ import { useState, useCallback, useRef, useEffect } from 'react';
 import { View, ActivityIndicator } from 'react-native';
 import Ionicons from '@expo/vector-icons/Ionicons';
 import type { AccountCategoryId, AccountKind, CreateAccountInput } from '@oxyhq/core';
-import { DISPLAY_NAME_INVALID_MESSAGE, isValidDisplayName, MAX_ACCOUNT_CATEGORIES, MAX_DISPLAY_NAME_LENGTH, SELECTABLE_ACCOUNT_CATEGORY_IDS } from '@oxyhq/core';
+import { accountCategoryLabel, DISPLAY_NAME_INVALID_MESSAGE, isValidDisplayName, MAX_ACCOUNT_CATEGORIES, MAX_DISPLAY_NAME_LENGTH, SELECTABLE_ACCOUNT_CATEGORY_IDS } from '@oxyhq/core';
 import type { BaseScreenProps } from '../types/navigation';
 import { useI18n } from '../hooks/useI18n';
 import { useSurfaceHeader } from '../hooks/useSurfaceHeader';
@@ -83,19 +83,6 @@ const kindDescription = (
   }
 };
 
-/**
- * The visible label for a category id.
- *
- * A lookup, deliberately not a `switch` with a `default`: a `default` would let
- * an id with no translation render as some OTHER category's label, silently and
- * only in the languages that are missing it. Falling back to the raw id is ugly
- * and correct — it is visibly wrong, and it names the missing key.
- */
-const accountCategoryLabel = (
-  t: (key: string, vars?: Record<string, string | number>) => string,
-  category: AccountCategoryId,
-): string => t(`accounts.accountCategory.${category}`) || category;
-
 /**
  * Only the SELECTABLE ids are offered. The full `ACCOUNT_CATEGORY_IDS` still
  * contains withdrawn ones so that accounts already carrying them keep working —
@@ -116,7 +103,7 @@ const CreateAccountScreen: React.FC<BaseScreenProps> = ({
 }) => {
   const bloomTheme = useTheme();
   const { oxyServices, createAccount, switchToAccount } = useOxy();
-  const { t } = useI18n();
+  const { t, locale } = useI18n();
 
   useSurfaceHeader({
     title: t('accounts.create.title') || 'Create account',
@@ -337,7 +324,7 @@ const CreateAccountScreen: React.FC<BaseScreenProps> = ({
           {ACCOUNT_CATEGORY_OPTIONS.map((option) => {
             const position = accountCategories.indexOf(option);
             const selected = position >= 0;
-            const label = accountCategoryLabel(t, option);
+            const label = accountCategoryLabel(locale, option);
             return (
               <SettingsListItem
                 key={option}

package/src/ui/screens/trust/TrustCenterScreen.tsx

@@ -13,7 +13,7 @@ import { Loading } from '@oxyhq/bloom/loading';
 import { useI18n } from '../../hooks/useI18n';
 import { useSurfaceHeader } from '../../hooks/useSurfaceHeader';
 import { useOxy } from '../../context/OxyContext';
-import { getTrustTierLabel } from './trustTier';
+import { trustTierLabel } from '@oxyhq/core';
 
 const TrustCenterScreen: React.FC<BaseScreenProps> = ({
     navigate,
@@ -21,7 +21,7 @@ const TrustCenterScreen: React.FC<BaseScreenProps> = ({
     // Reputation/trust is the ACTIVE account's standing (the org/project/bot
     // when switched, else the personal user).
     const { user, oxyServices, isAuthenticated } = useOxy();
-    const { t } = useI18n();
+    const { t, locale } = useI18n();
     const [reputationTotal, setReputationTotal] = useState<number | null>(null);
     const [trustTier, setTrustTier] = useState<TrustTier | null>(null);
     const [transactions, setTransactions] = useState<ReputationTransaction[]>([]);
@@ -53,9 +53,9 @@ const TrustCenterScreen: React.FC<BaseScreenProps> = ({
             .finally(() => setIsLoading(false));
     }, [user, oxyServices, t]);
 
-    const trustTierLabel = useMemo(
-        () => (trustTier ? getTrustTierLabel(trustTier, t) : null),
-        [trustTier, t],
+    const resolvedTrustTierLabel = useMemo(
+        () => (trustTier ? trustTierLabel(locale, trustTier) : null),
+        [trustTier, locale],
     );
 
     const title = t('trust.center.title') || 'Trust Center';
@@ -87,7 +87,7 @@ const TrustCenterScreen: React.FC<BaseScreenProps> = ({
                     <Text className="text-text-tertiary text-base mt-space-2 mb-space-12">
                         {t('trust.center.balance') || 'Reputation Balance'}
                     </Text>
-                    {trustTierLabel ? (
+                    {resolvedTrustTierLabel ? (
                         <Chip
                             variant="soft"
                             color="primary"
@@ -99,7 +99,7 @@ const TrustCenterScreen: React.FC<BaseScreenProps> = ({
                                 />
                             }
                         >
-                            {trustTierLabel}
+                            {resolvedTrustTierLabel}
                         </Chip>
                     ) : null}
                     <Text

package/src/ui/screens/trust/TrustLeaderboardScreen.tsx

@@ -8,7 +8,7 @@ import {
     TouchableOpacity,
 } from 'react-native';
 import type { ReputationLeaderboardEntry } from '@oxyhq/contracts';
-import { getNormalizedUserHandle, logger } from '@oxyhq/core';
+import { getNormalizedUserHandle, logger, trustTierLabel } from '@oxyhq/core';
 import { useTheme } from '@oxyhq/bloom/theme';
 import { H6, Text } from '@oxyhq/bloom/typography';
 import { Chip } from '@oxyhq/bloom/chip';
@@ -19,7 +19,6 @@ import { Avatar } from '@oxyhq/bloom/avatar';
 import { useI18n } from '../../hooks/useI18n';
 import { useSurfaceHeader } from '../../hooks/useSurfaceHeader';
 import { useOxy } from '../../context/OxyContext';
-import { getTrustTierLabel } from './trustTier';
 
 const AVATAR_SIZE = 40;
 const EMPTY_ICON_SIZE = 64;
@@ -29,7 +28,7 @@ const PODIUM_RANK = 3;
 
 const TrustLeaderboardScreen: React.FC<BaseScreenProps> = ({ navigate }) => {
     const { oxyServices, user: currentUser } = useOxy();
-    const { t } = useI18n();
+    const { t, locale } = useI18n();
     const bloomTheme = useTheme();
 
     const [leaderboard, setLeaderboard] = useState<ReputationLeaderboardEntry[]>([]);
@@ -106,7 +105,7 @@ const TrustLeaderboardScreen: React.FC<BaseScreenProps> = ({ navigate }) => {
                         </Text>
                         <View style={styles.tierRow} className="mt-space-4">
                             <Chip size="small" variant="soft" color={isPodium ? 'primary' : 'default'}>
-                                {getTrustTierLabel(item.trustTier, t)}
+                                {trustTierLabel(locale, item.trustTier)}
                             </Chip>
                         </View>
                     </View>
@@ -116,7 +115,7 @@ const TrustLeaderboardScreen: React.FC<BaseScreenProps> = ({ navigate }) => {
                 </TouchableOpacity>
             );
         },
-        [oxyServices, currentUserId, handleEntryPress, t],
+        [oxyServices, currentUserId, handleEntryPress, locale],
     );
 
     const keyExtractor = useCallback(

package/src/ui/screens/trust/TrustRewardsScreen.tsx

@@ -26,7 +26,7 @@ interface Achievement {
 }
 
 /**
- * Per-achievement identity tints. Like the trust-tier palette in `trustTier.ts`,
+ * Per-achievement identity tints. Like the trust-tier palette in `trustTierLabels`,
  * these are data, not theme surfaces — they brand each badge regardless of theme.
  */
 const ACHIEVEMENT_TINT = {

package/src/ui/screens/trust/TrustRulesScreen.tsx

@@ -4,6 +4,7 @@ import { View, Text } from 'react-native';
 import { SettingsListGroup, SettingsListItem } from '@oxyhq/bloom/settings-list';
 import { Chip } from '@oxyhq/bloom/chip';
 import { useTheme } from '@oxyhq/bloom/theme';
+import { reputationCategoryLabel } from '@oxyhq/core';
 import type { ReputationRule, ReputationCategory } from '@oxyhq/contracts';
 import type { BaseScreenProps } from '../../types/navigation';
 import { useSurfaceHeader } from '../../hooks/useSurfaceHeader';
@@ -24,7 +25,7 @@ const CATEGORY_ORDER: ReputationCategory[] = [
 
 const TrustRulesScreen: React.FC<BaseScreenProps> = () => {
     const { oxyServices } = useOxy();
-    const { t } = useI18n();
+    const { t, locale } = useI18n();
 
     useSurfaceHeader({
         title: t('trust.rules.title') || 'Trust Rules',
@@ -82,7 +83,7 @@ const TrustRulesScreen: React.FC<BaseScreenProps> = () => {
                         {groupedRules.map(({ category, items }) => (
                             <SettingsListGroup
                                 key={category}
-                                title={t(`trust.rules.categories.${category}`) || category}
+                                title={reputationCategoryLabel(locale, category)}
                             >
                                 {items.map((rule) => (
                                     <SettingsListItem

package/src/ui/server.ts

@@ -34,7 +34,6 @@ export const ProfileScreen = noopComponent;
 
 // Stores (return empty objects)
 export const useAuthStore = noopHook;
-export const useAccountStore = noopHook;
 
 // Toast (noop)
 export const toast = Object.assign(

package/src/ui/session/__tests__/authStore.test.ts

@@ -0,0 +1,90 @@
+/**
+ * Which apps mirror their device credential into the device-wide shared slot.
+ *
+ * The mirror is what makes a later-installed official app able to JOIN this
+ * device's session instead of asking for the Commons identity key. It runs on
+ * native, in `'account'` mode only — the identity vault is excluded so that a
+ * background persist inside the vault can never change which session five other
+ * apps boot into.
+ */
+import type { AuthStateStore } from '@oxyhq/core';
+
+const CRED_STATE = { sessionId: 'sess-1', userId: 'user-1', deviceId: 'dev-1', deviceSecret: 'ds-1' };
+
+/** Track every credential handed to the shared slot by the store under test. */
+function makeSharedSpy() {
+  const published: { deviceId: string; deviceSecret: string }[] = [];
+  return {
+    published,
+    store: {
+      read: async () => ({ state: 'absent' as const }),
+      publish: async (credential: { deviceId: string; deviceSecret: string }) => {
+        published.push(credential);
+        return true;
+      },
+      clear: async () => undefined,
+    },
+  };
+}
+
+/**
+ * Build the platform store with the native seams stubbed. `jest.resetModules()`
+ * + `require` rather than `jest.isolateModules` for the same reason as
+ * `sharedDeviceCredentialStore.test.ts`: a factory registered inside an isolate
+ * leaked into the next one.
+ */
+function loadAuthStore(
+  os: 'ios' | 'android' | 'web',
+  sessionMode: 'account' | 'identity',
+  shared: ReturnType<typeof makeSharedSpy>,
+): AuthStateStore {
+  jest.resetModules();
+  jest.doMock('../sharedDeviceCredentialStore', () => ({
+    createPlatformSharedDeviceCredentialStore: () => (os === 'web' ? null : shared.store),
+  }));
+  const rn = require('react-native') as { Platform: { OS: string } };
+  rn.Platform.OS = os;
+  // `authStore` selects web-vs-native with `isReactNative()`, which reads
+  // `navigator.product` — NOT `Platform.OS`. Setting only the latter leaves it on
+  // the web branch, where nothing mirrors and every case passes for the wrong
+  // reason.
+  Object.defineProperty(globalThis.navigator, 'product', {
+    value: os === 'web' ? 'Gecko' : 'ReactNative',
+    configurable: true,
+  });
+  const mod = require('../authStore') as typeof import('../authStore');
+  return mod.createPlatformAuthStateStore({ sessionMode });
+}
+
+afterEach(() => {
+  jest.dontMock('../sharedDeviceCredentialStore');
+  Object.defineProperty(globalThis.navigator, 'product', { value: 'Gecko', configurable: true });
+  jest.resetModules();
+});
+
+describe('createPlatformAuthStateStore', () => {
+  test('an ordinary native app publishes its credential to the shared slot', async () => {
+    const shared = makeSharedSpy();
+    const store = loadAuthStore('android', 'account', shared);
+    await store.save(CRED_STATE);
+    expect(shared.published).toEqual([{ deviceId: 'dev-1', deviceSecret: 'ds-1' }]);
+  });
+
+  test('the identity vault does NOT publish', async () => {
+    // The vault's credential is a perfectly valid device credential, so this is a
+    // deliberate abstention, not an impossibility: publishing it would let every
+    // ordinary app on the device join the vault's session as a side effect of the
+    // vault persisting a token.
+    const shared = makeSharedSpy();
+    const store = loadAuthStore('android', 'identity', shared);
+    await store.save(CRED_STATE);
+    expect(shared.published).toEqual([]);
+  });
+
+  test('web has no shared slot to publish into', async () => {
+    const shared = makeSharedSpy();
+    const store = loadAuthStore('web', 'account', shared);
+    await store.save(CRED_STATE);
+    expect(shared.published).toEqual([]);
+  });
+});