@oxyhq/services 28.0.0 → 29.0.0

package/lib/commonjs/ui/runtime/useRuntimeSnapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_react","require","useRuntimeSnapshot","runtime","useSyncExternalStore","subscribe","getSnapshot","useRuntimeSelector","selector","isEqual","cache","useRef","getSelection","useCallback","snapshot","cached","current","value"],"sourceRoot":"../../../../src","sources":["ui/runtime/useRuntimeSnapshot.ts"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,kBAAkBA,CAACC,OAAmB,EAAsB;EAC1E,OAAO,IAAAC,2BAAoB,EAACD,OAAO,CAACE,SAAS,EAAEF,OAAO,CAACG,WAAW,EAAEH,OAAO,CAACG,WAAW,CAAC;AAC1F;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,kBAAkBA,CAChCJ,OAAmB,EACnBK,QAA6C,EAC7CC,OAAiC,EAC9B;EACH,MAAMC,KAAK,GAAG,IAAAC,aAAM,EAAoD,IAAI,CAAC;EAE7E,MAAMC,YAAY,GAAG,IAAAC,kBAAW,EAAC,MAAS;IACxC,MAAMC,QAAQ,GAAGX,OAAO,CAACG,WAAW,CAAC,CAAC;IACtC,MAAMS,MAAM,GAAGL,KAAK,CAACM,OAAO;IAC5B,IAAID,MAAM,KAAK,IAAI,IAAIA,MAAM,CAACD,QAAQ,KAAKA,QAAQ,EAAE;MACnD,OAAOC,MAAM,CAACE,KAAK;IACrB;IACA,MAAMA,KAAK,GAAGT,QAAQ,CAACM,QAAQ,CAAC;IAChC,IAAIC,MAAM,KAAK,IAAI,IAAIN,OAAO,GAAGM,MAAM,CAACE,KAAK,EAAEA,KAAK,CAAC,KAAK,IAAI,EAAE;MAC9D;MACA;MACAP,KAAK,CAACM,OAAO,GAAG;QAAEF,QAAQ;QAAEG,KAAK,EAAEF,MAAM,CAACE;MAAM,CAAC;MACjD,OAAOF,MAAM,CAACE,KAAK;IACrB;IACAP,KAAK,CAACM,OAAO,GAAG;MAAEF,QAAQ;MAAEG;IAAM,CAAC;IACnC,OAAOA,KAAK;EACd,CAAC,EAAE,CAACd,OAAO,EAAEK,QAAQ,EAAEC,OAAO,CAAC,CAAC;EAEhC,OAAO,IAAAL,2BAAoB,EAACD,OAAO,CAACE,SAAS,EAAEO,YAAY,EAAEA,YAAY,CAAC;AAC5E","ignoreList":[]}

package/lib/commonjs/ui/server.js

@@ -28,7 +28,7 @@ Object.defineProperty(exports, "isTimeoutOrNetworkError", {
     return _errorHandlers.isTimeoutOrNetworkError;
   }
 });
-exports.useStorage = exports.useOxy = exports.useFollow = exports.useAuthStore = exports.useAuth = exports.useAccountStore = exports.toast = void 0;
+exports.useStorage = exports.useOxy = exports.useFollow = exports.useAuthStore = exports.useAuth = exports.toast = void 0;
 var _errorHandlers = require("./utils/errorHandlers.js");
 /**
  * Server-safe UI exports (noops)
@@ -70,7 +70,6 @@ const ProfileScreen = exports.ProfileScreen = noopComponent;
 
 // Stores (return empty objects)
 const useAuthStore = exports.useAuthStore = noopHook;
-const useAccountStore = exports.useAccountStore = noopHook;
 
 // Toast (noop)
 const toast = exports.toast = Object.assign(() => {}, {

package/lib/commonjs/ui/server.js.map

@@ -1 +1 @@
-{"version":3,"names":["_errorHandlers","require","noopComponent","noopHook","noopStorageResult","storage","isReady","OxyProvider","exports","OxySignInButton","LogoIcon","LogoText","FollowButton","OxyPayButton","useOxy","useAuth","useFollow","useStorage","ProfileScreen","useAuthStore","useAccountStore","toast","Object","assign","success","error","info","warning","loading","dismiss"],"sourceRoot":"../../../src","sources":["ui/server.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoDA,IAAAA,cAAA,GAAAC,OAAA;AApDA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA,MAAMC,aAAa,GAAGA,CAAA,KAAM,IAAI;AAChC,MAAMC,QAAQ,GAAGA,CAAA,MAAO,CAAC,CAAC,CAAC;AAC3B,MAAMC,iBAAiB,GAAG;EAAEC,OAAO,EAAE,IAAI;EAAEC,OAAO,EAAE;AAAM,CAAC;;AAE3D;AACO,MAAMC,WAAW,GAAAC,OAAA,CAAAD,WAAA,GAAGL,aAAa;AACjC,MAAMO,eAAe,GAAAD,OAAA,CAAAC,eAAA,GAAGP,aAAa;AACrC,MAAMQ,QAAQ,GAAAF,OAAA,CAAAE,QAAA,GAAGR,aAAa;AAC9B,MAAMS,QAAQ,GAAAH,OAAA,CAAAG,QAAA,GAAGT,aAAa;AAC9B,MAAMU,YAAY,GAAAJ,OAAA,CAAAI,YAAA,GAAGV,aAAa;AAClC,MAAMW,YAAY,GAAAL,OAAA,CAAAK,YAAA,GAAGX,aAAa;;AAEzC;AACO,MAAMY,MAAM,GAAAN,OAAA,CAAAM,MAAA,GAAGX,QAAQ;;AAE9B;AACO,MAAMY,OAAO,GAAAP,OAAA,CAAAO,OAAA,GAAGZ,QAAQ;AACxB,MAAMa,SAAS,GAAAR,OAAA,CAAAQ,SAAA,GAAGb,QAAQ;AAC1B,MAAMc,UAAU,GAAGA,CAAA,KAAMb,iBAAiB;;AAEjD;AAAAI,OAAA,CAAAS,UAAA,GAAAA,UAAA;AACO,MAAMC,aAAa,GAAAV,OAAA,CAAAU,aAAA,GAAGhB,aAAa;;AAE1C;AACO,MAAMiB,YAAY,GAAAX,OAAA,CAAAW,YAAA,GAAGhB,QAAQ;AAC7B,MAAMiB,eAAe,GAAAZ,OAAA,CAAAY,eAAA,GAAGjB,QAAQ;;AAEvC;AACO,MAAMkB,KAAK,GAAAb,OAAA,CAAAa,KAAA,GAAGC,MAAM,CAACC,MAAM,CAC9B,MAAM,CAAC,CAAC,EACR;EACIC,OAAO,EAAEA,CAAA,KAAM,CAAC,CAAC;EACjBC,KAAK,EAAEA,CAAA,KAAM,CAAC,CAAC;EACfC,IAAI,EAAEA,CAAA,KAAM,CAAC,CAAC;EACdC,OAAO,EAAEA,CAAA,KAAM,CAAC,CAAC;EACjBC,OAAO,EAAEA,CAAA,KAAM,CAAC,CAAC;EACjBC,OAAO,EAAEA,CAAA,KAAM,CAAC;AACpB,CACJ,CAAC;;AAED","ignoreList":[]}
+{"version":3,"names":["_errorHandlers","require","noopComponent","noopHook","noopStorageResult","storage","isReady","OxyProvider","exports","OxySignInButton","LogoIcon","LogoText","FollowButton","OxyPayButton","useOxy","useAuth","useFollow","useStorage","ProfileScreen","useAuthStore","toast","Object","assign","success","error","info","warning","loading","dismiss"],"sourceRoot":"../../../src","sources":["ui/server.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,IAAAA,cAAA,GAAAC,OAAA;AAnDA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA,MAAMC,aAAa,GAAGA,CAAA,KAAM,IAAI;AAChC,MAAMC,QAAQ,GAAGA,CAAA,MAAO,CAAC,CAAC,CAAC;AAC3B,MAAMC,iBAAiB,GAAG;EAAEC,OAAO,EAAE,IAAI;EAAEC,OAAO,EAAE;AAAM,CAAC;;AAE3D;AACO,MAAMC,WAAW,GAAAC,OAAA,CAAAD,WAAA,GAAGL,aAAa;AACjC,MAAMO,eAAe,GAAAD,OAAA,CAAAC,eAAA,GAAGP,aAAa;AACrC,MAAMQ,QAAQ,GAAAF,OAAA,CAAAE,QAAA,GAAGR,aAAa;AAC9B,MAAMS,QAAQ,GAAAH,OAAA,CAAAG,QAAA,GAAGT,aAAa;AAC9B,MAAMU,YAAY,GAAAJ,OAAA,CAAAI,YAAA,GAAGV,aAAa;AAClC,MAAMW,YAAY,GAAAL,OAAA,CAAAK,YAAA,GAAGX,aAAa;;AAEzC;AACO,MAAMY,MAAM,GAAAN,OAAA,CAAAM,MAAA,GAAGX,QAAQ;;AAE9B;AACO,MAAMY,OAAO,GAAAP,OAAA,CAAAO,OAAA,GAAGZ,QAAQ;AACxB,MAAMa,SAAS,GAAAR,OAAA,CAAAQ,SAAA,GAAGb,QAAQ;AAC1B,MAAMc,UAAU,GAAGA,CAAA,KAAMb,iBAAiB;;AAEjD;AAAAI,OAAA,CAAAS,UAAA,GAAAA,UAAA;AACO,MAAMC,aAAa,GAAAV,OAAA,CAAAU,aAAA,GAAGhB,aAAa;;AAE1C;AACO,MAAMiB,YAAY,GAAAX,OAAA,CAAAW,YAAA,GAAGhB,QAAQ;;AAEpC;AACO,MAAMiB,KAAK,GAAAZ,OAAA,CAAAY,KAAA,GAAGC,MAAM,CAACC,MAAM,CAC9B,MAAM,CAAC,CAAC,EACR;EACIC,OAAO,EAAEA,CAAA,KAAM,CAAC,CAAC;EACjBC,KAAK,EAAEA,CAAA,KAAM,CAAC,CAAC;EACfC,IAAI,EAAEA,CAAA,KAAM,CAAC,CAAC;EACdC,OAAO,EAAEA,CAAA,KAAM,CAAC,CAAC;EACjBC,OAAO,EAAEA,CAAA,KAAM,CAAC,CAAC;EACjBC,OAAO,EAAEA,CAAA,KAAM,CAAC;AACpB,CACJ,CAAC;;AAED","ignoreList":[]}

package/lib/commonjs/ui/session/authStore.js

@@ -7,20 +7,28 @@ exports.createPlatformAuthStateStore = createPlatformAuthStateStore;
 var _core = require("@oxyhq/core");
 var _storageHelpers = require("../utils/storageHelpers.js");
 var _nativeSecureStorage = require("./nativeSecureStorage.js");
+var _sharedDeviceCredentialStore = require("./sharedDeviceCredentialStore.js");
 /**
  * Platform `AuthStateStore` for `@oxyhq/services`.
  *
- * The zero-cookie device model persists the durable device credential
- * (`deviceId` + `deviceSecret`) per origin (web) / per device (native), and the
- * SDK re-mints the access token from that credential on cold boot. `@oxyhq/core`
- * owns the store shape + logic (`createWebAuthStateStore` /
- * `createNativeAuthStateStore`); this module only selects the platform storage
- * seam:
+ * The device model persists the durable device credential (`deviceId` +
+ * `deviceSecret`) per origin (web) / per device (native), and the SDK re-mints
+ * the access token from that credential on cold boot. `@oxyhq/core` owns the
+ * store shape + logic (`createWebAuthStateStore` / `createNativeAuthStateStore` /
+ * `createMemoryAuthStateStore`); this module only selects the seam:
  *
+ *  - `storage: 'ephemeral'` → `createMemoryAuthStateStore()`, on EVERY platform.
  *  - web  → `createWebAuthStateStore()` (localStorage, in-memory fallback).
  *  - native → `createNativeAuthStateStore(secureKV)` for the SESSION blob over
  *    the shared `createNativeSecureKeyValueStorage()` adapter
- *    (`expo-secure-store`, AsyncStorage fallback).
+ *    (`expo-secure-store`, AsyncStorage fallback), WRAPPED so every credential
+ *    it persists is also mirrored into the device-wide shared slot.
+ *
+ * The native wrapper is how several official apps end up on ONE `DeviceSession`
+ * (and therefore one active context): whichever app proves a credential publishes
+ * it, and a later-installed sibling adopts it during cold boot instead of asking
+ * for the Commons identity key. The mirror is additive — it can neither change
+ * nor fail the app's own durable write.
  */
 
 /**
@@ -29,11 +37,39 @@ var _nativeSecureStorage = require("./nativeSecureStorage.js");
  * Native persists the SESSION blob (`deviceId` + `deviceSecret` + cached access
  * token) per-app in SecureStore; the SDK re-mints the access token from the
  * device credential on the next cold boot.
+ *
+ * ## The ephemeral check is FIRST, and the order is load-bearing
+ *
+ * It short-circuits above the `isReactNative()` branch so an ephemeral caller can
+ * never reach the native path — and therefore can never reach the shared-slot
+ * mirroring wrapper. Checked after that branch instead, an origin that has
+ * declined to persist a credential would publish one into the device-wide slot
+ * every sibling app adopts on cold boot: it would keep nothing itself while
+ * deciding which session five other apps boot into.
+ *
+ * That is unreachable today because the only ephemeral caller is a web origin, so
+ * `isReactNative()` is false there anyway. Unreachable today is exactly the kind
+ * of guarantee that stops holding when someone adds the second caller, so it is
+ * structural here rather than incidental, and
+ * `__tests__/session/authStoreEphemeral.test.ts` holds the ordering directly.
  */
-function createPlatformAuthStateStore() {
+function createPlatformAuthStateStore(options = {}) {
+  // FIRST, above every platform branch — see the docblock for why the ordering
+  // is the guarantee and not a coincidence.
+  if (options.storage === 'ephemeral') {
+    return (0, _core.createMemoryAuthStateStore)();
+  }
   if (!(0, _storageHelpers.isReactNative)()) {
     return (0, _core.createWebAuthStateStore)();
   }
-  return (0, _core.createNativeAuthStateStore)((0, _nativeSecureStorage.createNativeSecureKeyValueStorage)());
+  const local = (0, _core.createNativeAuthStateStore)((0, _nativeSecureStorage.createNativeSecureKeyValueStorage)());
+  if (options.sessionMode === 'identity') {
+    return local;
+  }
+  const shared = (0, _sharedDeviceCredentialStore.createPlatformSharedDeviceCredentialStore)();
+  return shared ? (0, _core.createSharedMirroringAuthStateStore)({
+    local,
+    shared
+  }) : local;
 }
 //# sourceMappingURL=authStore.js.map

package/lib/commonjs/ui/session/authStore.js.map

@@ -1 +1 @@
-{"version":3,"names":["_core","require","_storageHelpers","_nativeSecureStorage","createPlatformAuthStateStore","isReactNative","createWebAuthStateStore","createNativeAuthStateStore","createNativeSecureKeyValueStorage"],"sourceRoot":"../../../../src","sources":["ui/session/authStore.ts"],"mappings":";;;;;;AAeA,IAAAA,KAAA,GAAAC,OAAA;AAKA,IAAAC,eAAA,GAAAD,OAAA;AACA,IAAAE,oBAAA,GAAAF,OAAA;AArBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AASA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASG,4BAA4BA,CAAA,EAAmB;EAC7D,IAAI,CAAC,IAAAC,6BAAa,EAAC,CAAC,EAAE;IACpB,OAAO,IAAAC,6BAAuB,EAAC,CAAC;EAClC;EAEA,OAAO,IAAAC,gCAA0B,EAAC,IAAAC,sDAAiC,EAAC,CAAC,CAAC;AACxE","ignoreList":[]}
+{"version":3,"names":["_core","require","_storageHelpers","_nativeSecureStorage","_sharedDeviceCredentialStore","createPlatformAuthStateStore","options","storage","createMemoryAuthStateStore","isReactNative","createWebAuthStateStore","local","createNativeAuthStateStore","createNativeSecureKeyValueStorage","sessionMode","shared","createPlatformSharedDeviceCredentialStore","createSharedMirroringAuthStateStore"],"sourceRoot":"../../../../src","sources":["ui/session/authStore.ts"],"mappings":";;;;;;AAsBA,IAAAA,KAAA,GAAAC,OAAA;AAQA,IAAAC,eAAA,GAAAD,OAAA;AACA,IAAAE,oBAAA,GAAAF,OAAA;AACA,IAAAG,4BAAA,GAAAH,OAAA;AAhCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AA2CA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASI,4BAA4BA,CAC1CC,OAAsC,GAAG,CAAC,CAAC,EAC3B;EAChB;EACA;EACA,IAAIA,OAAO,CAACC,OAAO,KAAK,WAAW,EAAE;IACnC,OAAO,IAAAC,gCAA0B,EAAC,CAAC;EACrC;EAEA,IAAI,CAAC,IAAAC,6BAAa,EAAC,CAAC,EAAE;IACpB,OAAO,IAAAC,6BAAuB,EAAC,CAAC;EAClC;EAEA,MAAMC,KAAK,GAAG,IAAAC,gCAA0B,EAAC,IAAAC,sDAAiC,EAAC,CAAC,CAAC;EAC7E,IAAIP,OAAO,CAACQ,WAAW,KAAK,UAAU,EAAE;IACtC,OAAOH,KAAK;EACd;EACA,MAAMI,MAAM,GAAG,IAAAC,sEAAyC,EAAC,CAAC;EAC1D,OAAOD,MAAM,GAAG,IAAAE,yCAAmC,EAAC;IAAEN,KAAK;IAAEI;EAAO,CAAC,CAAC,GAAGJ,KAAK;AAChF","ignoreList":[]}

package/lib/commonjs/ui/session/sharedDeviceCredentialStore.js

@@ -0,0 +1,306 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.SHARED_DEVICE_SESSION_STORAGE_KEY = exports.IOS_KEYCHAIN_ACCESS_GROUP = exports.IOS_DEVICE_SESSION_KEYCHAIN_SERVICE = void 0;
+exports.createPlatformSharedDeviceCredentialStore = createPlatformSharedDeviceCredentialStore;
+var _reactNative = require("react-native");
+var _expoModulesCore = require("expo-modules-core");
+var _core = require("@oxyhq/core");
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); } /**
+ * The platform half of the shared native DeviceSession credential.
+ *
+ * `@oxyhq/core` owns the rules (`sharedDeviceCredential.ts`: when to adopt, when
+ * to publish, and above all that an unreadable slot is never an empty one). This
+ * module owns only where the bytes live, which is genuinely different per
+ * platform:
+ *
+ *  - **iOS** — one `expo-secure-store` item in the approved Keychain Access Group
+ *    `group.so.oxy.shared`, under its OWN `keychainService`
+ *    ({@link IOS_DEVICE_SESSION_KEYCHAIN_SERVICE}). Every identity slot uses a
+ *    different service (`oxy_identity`, `oxy_identity_backup`,
+ *    `oxy_identity_mnemonic`) and the legacy cross-app identity keypair uses the
+ *    same group with NO service at all — so this item cannot alias any of them.
+ *    That separation is the point of the whole phase: the group-shared identity
+ *    key and the group-shared device-session credential are different secrets
+ *    with different blast radii and must not be conflated.
+ *  - **Android** — the signature-protected `OxyDeviceSession` broker (its own
+ *    EncryptedSharedPreferences file, its own ContentProvider, its own
+ *    `signature`-level permission). It carries a session credential; it can NOT
+ *    reach the identity keypair, which lives in a different file behind a
+ *    different provider.
+ *  - **web / anything else** — no shared slot. Each origin is its own device by
+ *    design, so the factory returns `null` and the cold boot simply omits the
+ *    lane.
+ *
+ * ## What is written here, and what is not
+ *
+ * Only `{deviceId, deviceSecret}`. No access token, no account id, no user id,
+ * and never any identity key material.
+ *
+ * ## Accessibility
+ *
+ * `WHEN_UNLOCKED_THIS_DEVICE_ONLY`: a device credential must not travel to
+ * another handset in an iCloud/encrypted backup restore — the restored device is
+ * a different device and has to establish its own session. It also keeps the item
+ * out of reach while the phone is locked, which is why a read can legitimately
+ * fail and why the `unavailable` verdict exists at all.
+ */
+/**
+ * The iOS Keychain Access Group every official Oxy app declares in its
+ * entitlements. Shared with the identity slots — the group is the app-group
+ * boundary, not the secret's identity.
+ */
+const IOS_KEYCHAIN_ACCESS_GROUP = exports.IOS_KEYCHAIN_ACCESS_GROUP = 'group.so.oxy.shared';
+
+/**
+ * The iOS `keychainService` for the DEVICE SESSION credential. Deliberately
+ * distinct from every identity and recovery service; do not reuse one of those
+ * here, and do not drop it (an item written with no service shares the legacy
+ * identity slot's namespace inside the group).
+ */
+const IOS_DEVICE_SESSION_KEYCHAIN_SERVICE = exports.IOS_DEVICE_SESSION_KEYCHAIN_SERVICE = 'oxy_device_session';
+
+/** The single key holding the JSON-encoded `{deviceId, deviceSecret}` pair. */
+const SHARED_DEVICE_SESSION_STORAGE_KEY = exports.SHARED_DEVICE_SESSION_STORAGE_KEY = 'oxy_shared_device_session_v1';
+
+// Variable indirection so Metro's static analyzer never traces expo-secure-store
+// into the web bundle; the module is native-only and optional.
+const SECURE_STORE_MODULE = 'expo-secure-store';
+
+/**
+ * The subset of `expo-secure-store` this module needs. Unlike the adapter in
+ * `nativeSecureStorage.ts` it must pass OPTIONS — the access group and the
+ * dedicated service are the entire mechanism here, so an options-less wrapper
+ * would silently write a package-private item that no sibling app can see.
+ */
+
+let keychainStorePromise = null;
+function loadKeychainGroupStore() {
+  if (!keychainStorePromise) {
+    const moduleName = SECURE_STORE_MODULE;
+    keychainStorePromise = (specifier => new Promise(r => r(`${specifier}`)).then(s => _interopRequireWildcard(require(s))))(moduleName).then(mod => {
+      if (typeof mod.getItemAsync === 'function' && typeof mod.setItemAsync === 'function' && typeof mod.deleteItemAsync === 'function' && typeof mod.WHEN_UNLOCKED_THIS_DEVICE_ONLY === 'number') {
+        return {
+          getItemAsync: mod.getItemAsync.bind(mod),
+          setItemAsync: mod.setItemAsync.bind(mod),
+          deleteItemAsync: mod.deleteItemAsync.bind(mod),
+          WHEN_UNLOCKED_THIS_DEVICE_ONLY: mod.WHEN_UNLOCKED_THIS_DEVICE_ONLY
+        };
+      }
+      return null;
+    }).catch(() => null);
+  }
+  return keychainStorePromise;
+}
+
+/** Parse the stored JSON into a credential, or `null` for anything malformed. */
+function parseStoredCredential(raw) {
+  if (!raw) {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== 'object') {
+    return null;
+  }
+  const candidate = parsed;
+  if (typeof candidate.deviceId !== 'string' || candidate.deviceId.length === 0 || typeof candidate.deviceSecret !== 'string' || candidate.deviceSecret.length === 0) {
+    return null;
+  }
+  return {
+    deviceId: candidate.deviceId,
+    deviceSecret: candidate.deviceSecret
+  };
+}
+
+/**
+ * The iOS store: one keychain item in the shared access group.
+ *
+ * A THROWN read is `unavailable`, a `null` read is `absent`. That mapping is the
+ * whole safety contract — `expo-secure-store` returns `null` for a genuinely
+ * missing item and throws when the keychain itself refuses, and collapsing the
+ * two is what would let a locked phone look like a device that never had a
+ * session.
+ */
+function createKeychainGroupCredentialStore() {
+  const readOptions = {
+    keychainService: IOS_DEVICE_SESSION_KEYCHAIN_SERVICE,
+    keychainAccessGroup: IOS_KEYCHAIN_ACCESS_GROUP
+  };
+  return {
+    read: async () => {
+      const store = await loadKeychainGroupStore();
+      if (!store) {
+        return {
+          state: 'unsupported'
+        };
+      }
+      let raw;
+      try {
+        raw = await store.getItemAsync(SHARED_DEVICE_SESSION_STORAGE_KEY, readOptions);
+      } catch (error) {
+        return {
+          state: 'unavailable',
+          cause: error
+        };
+      }
+      if (raw === null) {
+        return {
+          state: 'absent'
+        };
+      }
+      const credential = parseStoredCredential(raw);
+      if (!credential) {
+        // Something IS stored and we cannot read it. Reporting `absent` would
+        // authorise overwriting whatever a newer build put there.
+        return {
+          state: 'unavailable',
+          cause: new Error('shared device session item is present but not parseable')
+        };
+      }
+      return {
+        state: 'present',
+        credential
+      };
+    },
+    publish: async credential => {
+      const store = await loadKeychainGroupStore();
+      if (!store) {
+        return false;
+      }
+      const value = JSON.stringify(credential);
+      try {
+        await store.setItemAsync(SHARED_DEVICE_SESSION_STORAGE_KEY, value, {
+          ...readOptions,
+          keychainAccessible: store.WHEN_UNLOCKED_THIS_DEVICE_ONLY
+        });
+        // Read-back verify. A keychain write can resolve without the item having
+        // landed under the access group (a missing entitlement is the usual
+        // cause), and a phantom credential would send a fresh install into a mint
+        // that can never succeed.
+        return (await store.getItemAsync(SHARED_DEVICE_SESSION_STORAGE_KEY, readOptions)) === value;
+      } catch {
+        return false;
+      }
+    },
+    clear: async () => {
+      const store = await loadKeychainGroupStore();
+      if (!store) {
+        return;
+      }
+      try {
+        await store.deleteItemAsync(SHARED_DEVICE_SESSION_STORAGE_KEY, readOptions);
+      } catch {
+        // Best-effort: the slot is a join point, not a source of truth.
+      }
+    }
+  };
+}
+
+/**
+ * The Android broker's JS surface. `read` returns an UNTRUSTED payload that
+ * {@link normalizeSharedDeviceSessionRead} narrows; `write` reports whether the
+ * native read-back confirmed the bytes.
+ */
+
+let brokerModule;
+
+/**
+ * Resolve the `OxyDeviceSession` broker, or `null` when it is not autolinked.
+ *
+ * `requireOptionalNativeModule` (a static import Metro always resolves) rather
+ * than a dynamic `import(moduleName)`: the latter compiles to `require(variable)`
+ * in the CJS build, which Metro cannot resolve inside a consuming app — it
+ * silently returns `null` there, which is exactly how the cross-app identity
+ * bridge broke once. Same reasoning as `backgroundSession.ts` next door.
+ */
+function loadBrokerModule() {
+  if (brokerModule === undefined) {
+    const native = (0, _expoModulesCore.requireOptionalNativeModule)('OxyDeviceSession');
+    brokerModule = native && typeof native.read === 'function' && typeof native.write === 'function' && typeof native.clear === 'function' ? {
+      read: native.read.bind(native),
+      write: native.write.bind(native),
+      clear: native.clear.bind(native)
+    } : null;
+  }
+  return brokerModule;
+}
+
+/**
+ * The Android store: the signature-protected `OxyDeviceSession` broker.
+ *
+ * The broker already answers with an explicit status, so the only work here is
+ * narrowing an UNTRUSTED payload — `normalizeSharedDeviceSessionRead` resolves
+ * anything it does not recognise to `unavailable`, never `absent`.
+ */
+function createBrokerCredentialStore() {
+  return {
+    read: async () => {
+      const broker = loadBrokerModule();
+      if (!broker) {
+        return {
+          state: 'unsupported'
+        };
+      }
+      try {
+        return (0, _core.normalizeSharedDeviceSessionRead)(await broker.read());
+      } catch (error) {
+        return {
+          state: 'unavailable',
+          cause: error
+        };
+      }
+    },
+    publish: async credential => {
+      const broker = loadBrokerModule();
+      if (!broker) {
+        return false;
+      }
+      try {
+        // The broker read-back-verifies natively and returns the verdict.
+        return await broker.write(credential.deviceId, credential.deviceSecret);
+      } catch {
+        return false;
+      }
+    },
+    clear: async () => {
+      const broker = loadBrokerModule();
+      if (!broker) {
+        return;
+      }
+      try {
+        await broker.clear();
+      } catch {
+        // Best-effort — see the iOS store.
+      }
+    }
+  };
+}
+
+/**
+ * The shared DeviceSession credential slot for this runtime, or `null` when
+ * there is none.
+ *
+ * The branch is on the PLATFORM, not on which module happens to load, because
+ * `expo-secure-store` loads perfectly well on Android — it would just quietly
+ * ignore `keychainAccessGroup` and read a package-private item, which looks
+ * exactly like an empty shared slot. This is the same iOS-vs-Android split
+ * `KeyManager` makes for the shared identity, for the same reason.
+ *
+ * Any other native platform gets the broker, which answers `unsupported` when
+ * the module is not linked — so the lane is simply off, which is the safe
+ * direction.
+ */
+function createPlatformSharedDeviceCredentialStore() {
+  if (_reactNative.Platform.OS === 'web') {
+    return null;
+  }
+  return _reactNative.Platform.OS === 'ios' ? createKeychainGroupCredentialStore() : createBrokerCredentialStore();
+}
+//# sourceMappingURL=sharedDeviceCredentialStore.js.map

package/lib/commonjs/ui/session/sharedDeviceCredentialStore.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_reactNative","require","_expoModulesCore","_core","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","IOS_KEYCHAIN_ACCESS_GROUP","exports","IOS_DEVICE_SESSION_KEYCHAIN_SERVICE","SHARED_DEVICE_SESSION_STORAGE_KEY","SECURE_STORE_MODULE","keychainStorePromise","loadKeychainGroupStore","moduleName","specifier","Promise","then","s","mod","getItemAsync","setItemAsync","deleteItemAsync","WHEN_UNLOCKED_THIS_DEVICE_ONLY","bind","catch","parseStoredCredential","raw","parsed","JSON","parse","candidate","deviceId","length","deviceSecret","createKeychainGroupCredentialStore","readOptions","keychainService","keychainAccessGroup","read","store","state","error","cause","credential","Error","publish","value","stringify","keychainAccessible","clear","brokerModule","loadBrokerModule","undefined","native","requireOptionalNativeModule","write","createBrokerCredentialStore","broker","normalizeSharedDeviceSessionRead","createPlatformSharedDeviceCredentialStore","Platform","OS"],"sourceRoot":"../../../../src","sources":["ui/session/sharedDeviceCredentialStore.ts"],"mappings":";;;;;;;AAuCA,IAAAA,YAAA,GAAAC,OAAA;AACA,IAAAC,gBAAA,GAAAD,OAAA;AACA,IAAAE,KAAA,GAAAF,OAAA;AAKqB,SAAAG,wBAAAC,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAH,uBAAA,YAAAA,CAAAC,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA,KA9CrB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAUA;AACA;AACA;AACA;AACA;AACO,MAAMkB,yBAAyB,GAAAC,OAAA,CAAAD,yBAAA,GAAG,qBAAqB;;AAE9D;AACA;AACA;AACA;AACA;AACA;AACO,MAAME,mCAAmC,GAAAD,OAAA,CAAAC,mCAAA,GAAG,oBAAoB;;AAEvE;AACO,MAAMC,iCAAiC,GAAAF,OAAA,CAAAE,iCAAA,GAAG,8BAA8B;;AAE/E;AACA;AACA,MAAMC,mBAAmB,GAAG,mBAAmB;;AAE/C;AACA;AACA;AACA;AACA;AACA;;AAQA,IAAIC,oBAA+D,GAAG,IAAI;AAE1E,SAASC,sBAAsBA,CAAA,EAAuC;EACpE,IAAI,CAACD,oBAAoB,EAAE;IACzB,MAAME,UAAU,GAAGH,mBAAmB;IACtCC,oBAAoB,GAAG,CAAAG,SAAA,QAAAC,OAAA,CAAAzB,CAAA,IAAAA,CAAA,IAAAwB,SAAA,KAAAE,IAAA,CAAAC,CAAA,IAAA/B,uBAAA,CAAAH,OAAA,CAAAkC,CAAA,KAAOJ,UAAU,EACrCG,IAAI,CAAEE,GAAgC,IAAK;MAC1C,IACE,OAAOA,GAAG,CAACC,YAAY,KAAK,UAAU,IACtC,OAAOD,GAAG,CAACE,YAAY,KAAK,UAAU,IACtC,OAAOF,GAAG,CAACG,eAAe,KAAK,UAAU,IACzC,OAAOH,GAAG,CAACI,8BAA8B,KAAK,QAAQ,EACtD;QACA,OAAO;UACLH,YAAY,EAAED,GAAG,CAACC,YAAY,CAACI,IAAI,CAACL,GAAG,CAAC;UACxCE,YAAY,EAAEF,GAAG,CAACE,YAAY,CAACG,IAAI,CAACL,GAAG,CAAC;UACxCG,eAAe,EAAEH,GAAG,CAACG,eAAe,CAACE,IAAI,CAACL,GAAG,CAAC;UAC9CI,8BAA8B,EAAEJ,GAAG,CAACI;QACtC,CAAC;MACH;MACA,OAAO,IAAI;IACb,CAAC,CAAC,CACDE,KAAK,CAAC,MAAM,IAAI,CAAC;EACtB;EACA,OAAOb,oBAAoB;AAC7B;;AAEA;AACA,SAASc,qBAAqBA,CAACC,GAAkB,EAAiC;EAChF,IAAI,CAACA,GAAG,EAAE;IACR,OAAO,IAAI;EACb;EACA,IAAIC,MAAe;EACnB,IAAI;IACFA,MAAM,GAAGC,IAAI,CAACC,KAAK,CAACH,GAAG,CAAC;EAC1B,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;EACA,IAAI,CAACC,MAAM,IAAI,OAAOA,MAAM,KAAK,QAAQ,EAAE;IACzC,OAAO,IAAI;EACb;EACA,MAAMG,SAAS,GAAGH,MAAiC;EACnD,IACE,OAAOG,SAAS,CAACC,QAAQ,KAAK,QAAQ,IACtCD,SAAS,CAACC,QAAQ,CAACC,MAAM,KAAK,CAAC,IAC/B,OAAOF,SAAS,CAACG,YAAY,KAAK,QAAQ,IAC1CH,SAAS,CAACG,YAAY,CAACD,MAAM,KAAK,CAAC,EACnC;IACA,OAAO,IAAI;EACb;EACA,OAAO;IAAED,QAAQ,EAAED,SAAS,CAACC,QAAQ;IAAEE,YAAY,EAAEH,SAAS,CAACG;EAAa,CAAC;AAC/E;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,kCAAkCA,CAAA,EAAgC;EACzE,MAAMC,WAAW,GAAG;IAClBC,eAAe,EAAE5B,mCAAmC;IACpD6B,mBAAmB,EAAE/B;EACvB,CAAC;EAED,OAAO;IACLgC,IAAI,EAAE,MAAAA,CAAA,KAAiD;MACrD,MAAMC,KAAK,GAAG,MAAM3B,sBAAsB,CAAC,CAAC;MAC5C,IAAI,CAAC2B,KAAK,EAAE;QACV,OAAO;UAAEC,KAAK,EAAE;QAAc,CAAC;MACjC;MACA,IAAId,GAAkB;MACtB,IAAI;QACFA,GAAG,GAAG,MAAMa,KAAK,CAACpB,YAAY,CAACV,iCAAiC,EAAE0B,WAAW,CAAC;MAChF,CAAC,CAAC,OAAOM,KAAK,EAAE;QACd,OAAO;UAAED,KAAK,EAAE,aAAa;UAAEE,KAAK,EAAED;QAAM,CAAC;MAC/C;MACA,IAAIf,GAAG,KAAK,IAAI,EAAE;QAChB,OAAO;UAAEc,KAAK,EAAE;QAAS,CAAC;MAC5B;MACA,MAAMG,UAAU,GAAGlB,qBAAqB,CAACC,GAAG,CAAC;MAC7C,IAAI,CAACiB,UAAU,EAAE;QACf;QACA;QACA,OAAO;UACLH,KAAK,EAAE,aAAa;UACpBE,KAAK,EAAE,IAAIE,KAAK,CAAC,yDAAyD;QAC5E,CAAC;MACH;MACA,OAAO;QAAEJ,KAAK,EAAE,SAAS;QAAEG;MAAW,CAAC;IACzC,CAAC;IAEDE,OAAO,EAAE,MAAOF,UAAU,IAAuB;MAC/C,MAAMJ,KAAK,GAAG,MAAM3B,sBAAsB,CAAC,CAAC;MAC5C,IAAI,CAAC2B,KAAK,EAAE;QACV,OAAO,KAAK;MACd;MACA,MAAMO,KAAK,GAAGlB,IAAI,CAACmB,SAAS,CAACJ,UAAU,CAAC;MACxC,IAAI;QACF,MAAMJ,KAAK,CAACnB,YAAY,CAACX,iCAAiC,EAAEqC,KAAK,EAAE;UACjE,GAAGX,WAAW;UACda,kBAAkB,EAAET,KAAK,CAACjB;QAC5B,CAAC,CAAC;QACF;QACA;QACA;QACA;QACA,OAAO,CAAC,MAAMiB,KAAK,CAACpB,YAAY,CAACV,iCAAiC,EAAE0B,WAAW,CAAC,MAAMW,KAAK;MAC7F,CAAC,CAAC,MAAM;QACN,OAAO,KAAK;MACd;IACF,CAAC;IAEDG,KAAK,EAAE,MAAAA,CAAA,KAA2B;MAChC,MAAMV,KAAK,GAAG,MAAM3B,sBAAsB,CAAC,CAAC;MAC5C,IAAI,CAAC2B,KAAK,EAAE;QACV;MACF;MACA,IAAI;QACF,MAAMA,KAAK,CAAClB,eAAe,CAACZ,iCAAiC,EAAE0B,WAAW,CAAC;MAC7E,CAAC,CAAC,MAAM;QACN;MAAA;IAEJ;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;;AAOA,IAAIe,YAA6D;;AAEjE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,gBAAgBA,CAAA,EAAwC;EAC/D,IAAID,YAAY,KAAKE,SAAS,EAAE;IAC9B,MAAMC,MAAM,GAAG,IAAAC,4CAA2B,EAAwC,kBAAkB,CAAC;IACrGJ,YAAY,GACVG,MAAM,IAAI,OAAOA,MAAM,CAACf,IAAI,KAAK,UAAU,IAAI,OAAOe,MAAM,CAACE,KAAK,KAAK,UAAU,IAAI,OAAOF,MAAM,CAACJ,KAAK,KAAK,UAAU,GACnH;MACEX,IAAI,EAAEe,MAAM,CAACf,IAAI,CAACf,IAAI,CAAC8B,MAAM,CAAC;MAC9BE,KAAK,EAAEF,MAAM,CAACE,KAAK,CAAChC,IAAI,CAAC8B,MAAM,CAAC;MAChCJ,KAAK,EAAEI,MAAM,CAACJ,KAAK,CAAC1B,IAAI,CAAC8B,MAAM;IACjC,CAAC,GACD,IAAI;EACZ;EACA,OAAOH,YAAY;AACrB;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASM,2BAA2BA,CAAA,EAAgC;EAClE,OAAO;IACLlB,IAAI,EAAE,MAAAA,CAAA,KAAiD;MACrD,MAAMmB,MAAM,GAAGN,gBAAgB,CAAC,CAAC;MACjC,IAAI,CAACM,MAAM,EAAE;QACX,OAAO;UAAEjB,KAAK,EAAE;QAAc,CAAC;MACjC;MACA,IAAI;QACF,OAAO,IAAAkB,sCAAgC,EAAC,MAAMD,MAAM,CAACnB,IAAI,CAAC,CAAC,CAAC;MAC9D,CAAC,CAAC,OAAOG,KAAK,EAAE;QACd,OAAO;UAAED,KAAK,EAAE,aAAa;UAAEE,KAAK,EAAED;QAAM,CAAC;MAC/C;IACF,CAAC;IAEDI,OAAO,EAAE,MAAOF,UAAU,IAAuB;MAC/C,MAAMc,MAAM,GAAGN,gBAAgB,CAAC,CAAC;MACjC,IAAI,CAACM,MAAM,EAAE;QACX,OAAO,KAAK;MACd;MACA,IAAI;QACF;QACA,OAAO,MAAMA,MAAM,CAACF,KAAK,CAACZ,UAAU,CAACZ,QAAQ,EAAEY,UAAU,CAACV,YAAY,CAAC;MACzE,CAAC,CAAC,MAAM;QACN,OAAO,KAAK;MACd;IACF,CAAC;IAEDgB,KAAK,EAAE,MAAAA,CAAA,KAA2B;MAChC,MAAMQ,MAAM,GAAGN,gBAAgB,CAAC,CAAC;MACjC,IAAI,CAACM,MAAM,EAAE;QACX;MACF;MACA,IAAI;QACF,MAAMA,MAAM,CAACR,KAAK,CAAC,CAAC;MACtB,CAAC,CAAC,MAAM;QACN;MAAA;IAEJ;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASU,yCAAyCA,CAAA,EAAuC;EAC9F,IAAIC,qBAAQ,CAACC,EAAE,KAAK,KAAK,EAAE;IACzB,OAAO,IAAI;EACb;EACA,OAAOD,qBAAQ,CAACC,EAAE,KAAK,KAAK,GAAG3B,kCAAkC,CAAC,CAAC,GAAGsB,2BAA2B,CAAC,CAAC;AACrG","ignoreList":[]}

package/lib/commonjs/ui/stores/authStore.js

@@ -3,68 +3,167 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
+exports.bindAuthStoreToRuntime = bindAuthStoreToRuntime;
 exports.useAuthStore = void 0;
-var _zustand = require("zustand");
-var _core = require("@oxyhq/core");
-const log = (0, _core.createLogger)('AuthStore');
-const useAuthStore = exports.useAuthStore = (0, _zustand.create)((set, get) => ({
+var _react = require("react");
+/**
+ * The signed-in user, as a zustand-shaped read/write surface.
+ *
+ * It used to BE a zustand store, and that made it a second owner of the
+ * session: the provider wrote `user`/`isAuthenticated` here, `SessionClient`
+ * wrote the same facts into its device state, and nothing reconciled them —
+ * when they disagreed, which one was right was not answerable. It is now a
+ * projection of the ONE `OxyRuntime` (ADR 0004): reads come off the runtime
+ * snapshot and writes go into the runtime, so there is nothing left to drift.
+ *
+ * The zustand SHAPE is kept deliberately — `useAuthStore(selector)`,
+ * `.getState()`, `.setState()`, `.subscribe()` — because a dozen call sites
+ * across this package and the Commons app read the user out of band, from
+ * mutation success handlers and cache helpers that are not inside a render.
+ * Rewriting them is Phase 8's cut, not this one's.
+ *
+ * `fetchUser` and `lastUserFetch` are GONE rather than projected: they were a
+ * five-minute profile cache with zero readers anywhere in the monorepo, and the
+ * Query cache has owned that job since long before this change.
+ */
+
+/** The subset of `AuthState` a caller may push back in through `setState`. */
+
+let boundRuntime = null;
+let unbindRuntime = null;
+const listeners = new Set();
+const loginSuccess = user => {
+  boundRuntime?.setAccount(user);
+};
+const loginFailure = error => {
+  boundRuntime?.batch(() => {
+    boundRuntime?.setLoading(false);
+    boundRuntime?.setError(error);
+  });
+};
+const logout = () => {
+  boundRuntime?.clearSession();
+};
+const setUser = user => {
+  boundRuntime?.setAccount(user);
+};
+const SIGNED_OUT = Object.freeze({
   user: null,
   isAuthenticated: false,
   isLoading: false,
   error: null,
-  lastUserFetch: null,
-  loginSuccess: user => set({
-    isLoading: false,
-    isAuthenticated: true,
-    user: (0, _core.normalizeUserIdentity)(user),
-    lastUserFetch: Date.now()
-  }),
-  loginFailure: error => set({
-    isLoading: false,
-    error
-  }),
-  logout: () => set({
-    user: null,
-    isAuthenticated: false,
-    lastUserFetch: null
-  }),
-  setUser: user => set({
-    user: (0, _core.normalizeUserIdentity)(user),
-    lastUserFetch: Date.now()
-  }),
-  fetchUser: async (oxyServices, forceRefresh = false) => {
-    const state = get();
-    const now = Date.now();
-    const cacheAge = state.lastUserFetch ? now - state.lastUserFetch : Number.POSITIVE_INFINITY;
-    const cacheValid = cacheAge < 5 * 60 * 1000; // 5 minutes cache
+  loginSuccess,
+  loginFailure,
+  logout,
+  setUser
+});
+let state = SIGNED_OUT;
+function project(runtime) {
+  if (runtime === null) {
+    return SIGNED_OUT;
+  }
+  const snapshot = runtime.getSnapshot();
+  return Object.freeze({
+    user: snapshot.account,
+    isAuthenticated: snapshot.account !== null,
+    isLoading: snapshot.isLoading,
+    error: snapshot.error?.message ?? null,
+    loginSuccess,
+    loginFailure,
+    logout,
+    setUser
+  });
+}
+function republish() {
+  const next = project(boundRuntime);
+  if (next.user === state.user && next.isAuthenticated === state.isAuthenticated && next.isLoading === state.isLoading && next.error === state.error) {
+    return;
+  }
+  state = next;
+  for (const listener of [...listeners]) {
+    listener();
+  }
+}
 
-    // Use cached data if available and not forcing refresh
-    if (!forceRefresh && state.user && cacheValid) {
-      log.info('Using cached user data', {
-        cacheAge
-      });
+/**
+ * Point this surface at the provider's runtime. Called once by
+ * `OxyRuntimeProvider`; the returned function detaches it again on unmount.
+ *
+ * With nothing bound, reads answer signed-out and writes are dropped. That is
+ * the honest answer for the two places it happens — the SSR shim, and a unit
+ * test poking the store with no provider mounted — and it is why binding is an
+ * explicit call rather than a lazily-created default runtime, which is exactly
+ * the fabricated-forever-loading runtime ADR 0004 deleted.
+ */
+function bindAuthStoreToRuntime(runtime) {
+  unbindRuntime?.();
+  boundRuntime = runtime;
+  unbindRuntime = runtime.subscribe(republish);
+  republish();
+  return () => {
+    if (boundRuntime !== runtime) {
       return;
     }
-    set({
-      isLoading: true,
-      error: null
-    });
-    try {
-      const user = (0, _core.normalizeUserIdentity)(await oxyServices.getCurrentUser());
-      set({
-        user,
-        isLoading: false,
-        isAuthenticated: true,
-        lastUserFetch: now
-      });
-    } catch (error) {
-      const errorMessage = error instanceof Error ? error.message : 'Failed to fetch user';
-      log.error('Error fetching user', error);
-      set({
-        error: errorMessage,
-        isLoading: false
-      });
+    unbindRuntime?.();
+    unbindRuntime = null;
+    boundRuntime = null;
+    republish();
+  };
+}
+const getState = () => state;
+const setState = patch => {
+  boundRuntime?.batch(() => {
+    if (patch.isLoading !== undefined) {
+      boundRuntime?.setLoading(patch.isLoading);
     }
-  }
-}));
+    if (patch.error !== undefined) {
+      boundRuntime?.setError(patch.error);
+    }
+    if (patch.user !== undefined) {
+      if (patch.user === null) {
+        boundRuntime?.clearSession();
+      } else {
+        boundRuntime?.setAccount(patch.user);
+      }
+    }
+  });
+};
+const subscribe = listener => {
+  listeners.add(listener);
+  return () => {
+    listeners.delete(listener);
+  };
+};
+function useAuthStoreHook(selector) {
+  // The selection is cached against the state object it came from, so a
+  // selector returning a fresh object cannot make `useSyncExternalStore` see a
+  // new value on every call and loop.
+  const cache = (0, _react.useRef)(null);
+  const getSelection = (0, _react.useCallback)(() => {
+    const cached = cache.current;
+    if (cached !== null && cached.state === state) {
+      return cached.value;
+    }
+    const value = selector(state);
+    cache.current = {
+      state,
+      value
+    };
+    return value;
+  }, [selector]);
+  return (0, _react.useSyncExternalStore)(subscribe, getSelection, getSelection);
+}
+
+/**
+ * Read the signed-in user. Zustand-shaped, projected from the runtime.
+ *
+ * A selector that builds an object must be wrapped in `useShallow` (as every
+ * call site here already does) — otherwise a structurally-equal result reads as
+ * a change on every publish.
+ */
+const useAuthStore = exports.useAuthStore = Object.assign(useAuthStoreHook, {
+  getState,
+  setState,
+  subscribe
+});
 //# sourceMappingURL=authStore.js.map