@oxyhq/services 28.0.0 → 30.0.0

package/src/ui/runtime/runtimeContext.tsx

@@ -0,0 +1,111 @@
+import { createContext, useContext } from 'react';
+import type { DeviceDirectory } from '@oxyhq/contracts';
+import type { DeviceContext, User } from '@oxyhq/core';
+import type { OxyRuntime } from './createOxyRuntime';
+import type { OxyRuntimeStatus } from './types';
+import { useRuntimeSelector, useRuntimeSnapshot } from './useRuntimeSnapshot';
+
+/**
+ * The runtime reference itself, as a context value that NEVER changes identity
+ * (ADR 0004).
+ *
+ * It is deliberately a second context beside the big `OxyContextState` one.
+ * That value is rebuilt whenever any of its fifty-odd members moves — a locale,
+ * a dialog opening — and every hook reading it re-renders with it. Hooks
+ * hanging off this one subscribe to the runtime with a selector instead, so
+ * only a change to what they actually selected wakes them. Retiring the wide
+ * context is Phase 8; this is what its replacements are built on.
+ */
+const OxyRuntimeHandleContext = createContext<OxyRuntime | null>(null);
+
+export const OxyRuntimeHandleProvider = OxyRuntimeHandleContext.Provider;
+
+const RUNTIME_MISSING_MESSAGE =
+  'useOxyRuntime() was called outside <OxyProvider>. Mount <OxyProvider clientId="…"> above this component.';
+
+export class OxyRuntimeMissingError extends Error {
+  readonly code = 'oxy_runtime_missing';
+
+  constructor() {
+    super(RUNTIME_MISSING_MESSAGE);
+    this.name = 'OxyRuntimeMissingError';
+  }
+}
+
+/** The runtime this provider owns. THROWS when no `<OxyProvider>` is mounted. */
+export function useOxyRuntime(): OxyRuntime {
+  const runtime = useContext(OxyRuntimeHandleContext);
+  if (runtime === null) {
+    throw new OxyRuntimeMissingError();
+  }
+  return runtime;
+}
+
+export interface ActiveAccount {
+  /**
+   * The human whose authentication backs the session — the audit actor. Equal
+   * to {@link ActiveAccount.account} unless a delegated context is active.
+   */
+  principal: User | null;
+  /** The account the session acts AS — what a profile header renders. */
+  account: User | null;
+  /** The resolved `principal acting as account` pair, when a directory is held. */
+  context: DeviceContext | null;
+  /** Whether the actor and the subject are different accounts. */
+  isDelegated: boolean;
+  status: OxyRuntimeStatus;
+}
+
+function selectActiveAccount(snapshot: {
+  principal: User | null;
+  account: User | null;
+  activeContext: DeviceContext | null;
+  status: OxyRuntimeStatus;
+}): ActiveAccount {
+  return {
+    principal: snapshot.principal,
+    account: snapshot.account,
+    context: snapshot.activeContext,
+    isDelegated: snapshot.activeContext?.isDelegated ?? false,
+    status: snapshot.status,
+  };
+}
+
+function activeAccountsEqual(a: ActiveAccount, b: ActiveAccount): boolean {
+  return (
+    a.principal === b.principal &&
+    a.account === b.account &&
+    a.context === b.context &&
+    a.isDelegated === b.isDelegated &&
+    a.status === b.status
+  );
+}
+
+/**
+ * Who this app is running as, with the actor and the subject kept apart.
+ *
+ * Unlike `useOxy()`, this re-renders only when one of those five facts moves —
+ * a locale change, a dialog opening or a session-list refresh does not reach it.
+ */
+export function useActiveAccount(): ActiveAccount {
+  return useRuntimeSelector(useOxyRuntime(), selectActiveAccount, activeAccountsEqual);
+}
+
+const selectDirectory = (snapshot: { device: DeviceDirectory | null }): DeviceDirectory | null =>
+  snapshot.device;
+
+/**
+ * The device directory — every principal on this device and the contexts each
+ * may act as (ADR 0002).
+ *
+ * `null` until something calls `runtime.refreshDirectory()`. A client that
+ * never asks for one never pays for the round trip.
+ */
+export function useDeviceDirectory(): DeviceDirectory | null {
+  return useRuntimeSelector(useOxyRuntime(), selectDirectory);
+}
+
+/** The whole runtime snapshot. Prefer a narrower hook where one exists. */
+export function useOxySnapshot(): ReturnType<OxyRuntime['getSnapshot']> {
+  return useRuntimeSnapshot(useOxyRuntime());
+}

package/src/ui/runtime/types.ts

@@ -0,0 +1,110 @@
+import type { DeviceDirectory, DeviceSessionState } from '@oxyhq/contracts';
+import type { ClientSession, DeviceContext, User } from '@oxyhq/core';
+
+/**
+ * The runtime's coarse verdict about this device's session.
+ *
+ * `'booting'` is NOT "signed out but we are still looking": it is the honest
+ * "undetermined" that every readiness gate in the SDK exists to express, and it
+ * ends exactly once at the first cold-boot resolution. `'error'` is reserved for
+ * a resolved boot that produced no account AND recorded a failure — a failed
+ * sign-in against a signed-out device is `'signed_out'` with an `error`, because
+ * the device really is signed out.
+ */
+export type OxyRuntimeStatus = 'booting' | 'authenticated' | 'signed_out' | 'error';
+
+/**
+ * Whether a bearer usable for private calls is planted right now.
+ *
+ * `'refreshing'` covers both halves of the gap the SDK already tracked with two
+ * separate booleans: a bearer that is present but whose readiness gate is shut
+ * (a commit in flight), and an authenticated account whose bearer has been
+ * invalidated and is being re-minted. Both mean the same thing to a caller —
+ * wait, do not treat this as signed out.
+ */
+export type OxyTokenStatus = 'missing' | 'refreshing' | 'ready' | 'error';
+
+export interface OxyRuntimeError {
+  message: string;
+  code: string;
+}
+
+/**
+ * The ONE observable state of an `OxyRuntime` (ADR 0004).
+ *
+ * Frozen and referentially stable: a new object is published only when
+ * something actually changed, so `useSyncExternalStore` can compare by identity
+ * and a selector over an unchanged field never re-renders.
+ *
+ * Every field is either a fact the runtime owns or a pure derivation of one.
+ * There is no second writable store: `sessions`, `activeSessionId`, `status`
+ * and `tokenStatus` are computed by the one snapshot builder, so two of them can
+ * never disagree about the same device.
+ */
+export interface OxyRuntimeSnapshot {
+  status: OxyRuntimeStatus;
+
+  /**
+   * The device DIRECTORY (ADR 0002) — principals and the contexts each may act
+   * as. `null` until something asks for one; the flat lane never pays for it.
+   */
+  device: DeviceDirectory | null;
+
+  /**
+   * The flat, server-authoritative device state. Kept beside {@link device}
+   * because it is what the compatibility projections below are derived from,
+   * and because the two describe the same device at the same `revision`.
+   */
+  deviceState: DeviceSessionState | null;
+
+  /** The active `principal acting as account` pair, when a directory is held. */
+  activeContext: DeviceContext | null;
+
+  /**
+   * The human whose authentication backs the session — the audit actor.
+   *
+   * Equal to {@link account} on a device with no directory and on any
+   * non-delegated context: the flat lane cannot tell the two apart, and saying
+   * so by making them the same object is more honest than leaving this `null`.
+   */
+  principal: User | null;
+
+  /** The account the session acts AS — what a profile header renders. */
+  account: User | null;
+
+  tokenStatus: OxyTokenStatus;
+
+  /**
+   * Whether the first cold boot has concluded. Monotonic: once `true` it never
+   * reverts, so a later transient signed-out state is never mistaken for
+   * "still booting".
+   */
+  authResolved: boolean;
+
+  /** A context activation / account switch is in flight. */
+  switching: boolean;
+
+  error: OxyRuntimeError | null;
+
+  // ── Compatibility projections ────────────────────────────────────────────
+  // Derived, never separately written. They exist because every app still
+  // renders the flat session list; Phase 7 moves them onto the directory.
+
+  sessions: ClientSession[];
+  activeSessionId: string | null;
+
+  /** A sign-in / sign-out operation is in flight. */
+  isLoading: boolean;
+
+  /** The local display/bookkeeping storage has resolved. */
+  storageReady: boolean;
+
+  /** A bearer is planted on the client instance right now. */
+  hasAccessToken: boolean;
+
+  /**
+   * The commit gate. Shut while a session commit is mid-flight so a consumer
+   * cannot fire a private call between the token landing and the projection.
+   */
+  tokenReady: boolean;
+}

package/src/ui/runtime/useRuntimeSnapshot.ts

@@ -0,0 +1,52 @@
+import { useCallback, useRef, useSyncExternalStore } from 'react';
+import type { OxyRuntime } from './createOxyRuntime';
+import type { OxyRuntimeSnapshot } from './types';
+
+/**
+ * Subscribe to the whole runtime snapshot.
+ *
+ * The runtime publishes a frozen object only when a fact actually changed, so
+ * identity comparison is exact: a locale change, a dialog opening or an
+ * unrelated query settling does not wake anything subscribed here.
+ */
+export function useRuntimeSnapshot(runtime: OxyRuntime): OxyRuntimeSnapshot {
+  return useSyncExternalStore(runtime.subscribe, runtime.getSnapshot, runtime.getSnapshot);
+}
+
+/**
+ * Subscribe to one derived value of the runtime snapshot.
+ *
+ * The selection is cached against the snapshot it was computed from, which is
+ * what makes a selector returning a fresh object (`{user, isAuthenticated}`)
+ * safe here: `useSyncExternalStore` calls `getSnapshot` several times per
+ * commit and would otherwise see a new object every call and loop.
+ *
+ * `selector` must be stable — hoist it to module scope or wrap it in
+ * `useCallback`. An inline arrow re-subscribes on every render.
+ */
+export function useRuntimeSelector<T>(
+  runtime: OxyRuntime,
+  selector: (snapshot: OxyRuntimeSnapshot) => T,
+  isEqual?: (a: T, b: T) => boolean,
+): T {
+  const cache = useRef<{ snapshot: OxyRuntimeSnapshot; value: T } | null>(null);
+
+  const getSelection = useCallback((): T => {
+    const snapshot = runtime.getSnapshot();
+    const cached = cache.current;
+    if (cached !== null && cached.snapshot === snapshot) {
+      return cached.value;
+    }
+    const value = selector(snapshot);
+    if (cached !== null && isEqual?.(cached.value, value) === true) {
+      // Same value under the caller's equality: keep the PREVIOUS reference so a
+      // structurally-equal recomputation does not read as a change.
+      cache.current = { snapshot, value: cached.value };
+      return cached.value;
+    }
+    cache.current = { snapshot, value };
+    return value;
+  }, [runtime, selector, isEqual]);
+
+  return useSyncExternalStore(runtime.subscribe, getSelection, getSelection);
+}

package/src/ui/screens/AccountMembersScreen.tsx

@@ -218,7 +218,7 @@ const AccountMembersScreen: React.FC<BaseScreenProps> = ({ onClose, goBack, acco
   const confirmRemove = useCallback(async (member: AccountMember) => {
     const confirmed = await surfaces.confirm({
       title: t('accounts.members.removeConfirm.title') || 'Remove member',
-      message:
+      description:
         t('accounts.members.removeConfirm.description')
         || 'Remove this member from the account? They will lose all access.',
       confirmLabel: t('accounts.members.actions.remove') || 'Remove',
@@ -231,7 +231,7 @@ const AccountMembersScreen: React.FC<BaseScreenProps> = ({ onClose, goBack, acco
   const confirmTransfer = useCallback(async (member: AccountMember) => {
     const confirmed = await surfaces.confirm({
       title: t('accounts.members.transferConfirm.title') || 'Transfer ownership',
-      message:
+      description:
         t('accounts.members.transferConfirm.description')
         || 'Transfer ownership of this account to this member? You will be demoted to admin. This cannot be undone.',
       confirmLabel: t('accounts.members.actions.transfer') || 'Transfer ownership',

package/src/ui/screens/AccountSettingsScreen.tsx

@@ -120,7 +120,7 @@ const AccountSettingsScreen: React.FC<BaseScreenProps> = ({ onClose, goBack, nav
   const handleArchive = useCallback(async () => {
     const confirmed = await surfaces.confirm({
       title: t('accounts.settings.archive.confirmTitle') || 'Archive account',
-      message:
+      description:
         t('accounts.settings.archive.confirmDescription')
         || 'Archive this account? It will be deactivated and its members will lose access.',
       confirmLabel: t('accounts.settings.archive.title') || 'Archive account',

package/src/ui/screens/AccountVerificationScreen.tsx

@@ -54,7 +54,7 @@ const AccountVerificationScreen: React.FC<BaseScreenProps> = ({
             // returns; there is no negative action.
             await surfaces.confirm({
                 title: t('accountVerification.successTitle') || 'Request Submitted',
-                message:
+                description:
                     t('accountVerification.successMessage') || `Your verification request has been submitted. Request ID: ${result.requestId}`,
                 confirmLabel: t('accountVerification.ok') || 'OK',
                 hideCancel: true,

package/src/ui/screens/ChangeAvatarScreen.tsx

@@ -282,7 +282,7 @@ const ChangeAvatarScreen: React.FC<BaseScreenProps> = ({ navigate, dismiss }) =>
     const removeCurrentPhoto = useCallback(async () => {
         const confirmed = await bloomSurfaces.confirm({
             title: t('changeAvatar.remove.confirmTitle'),
-            message: t('changeAvatar.remove.confirmMessage'),
+            description: t('changeAvatar.remove.confirmMessage'),
             confirmLabel: t('changeAvatar.remove.confirmLabel'),
             cancelLabel: t('common.cancel'),
             destructive: true,

package/src/ui/screens/ConnectedAppsScreen.tsx

@@ -65,7 +65,7 @@ const ConnectedAppsScreen: React.FC<BaseScreenProps> = ({ onClose, goBack }) =>
         async (app: ConnectedApp) => {
             const confirmed = await surfaces.confirm({
                 title: t('connectedApps.confirm.title') || 'Revoke access',
-                message:
+                description:
                     t('connectedApps.confirm.message', { name: app.name })
                     || `Revoke ${app.name}'s access to your Oxy account?`,
                 confirmLabel: t('common.revoke') || 'Revoke',

package/src/ui/screens/FileManagementScreen.tsx

@@ -447,7 +447,7 @@ const FileManagementScreen: React.FC<FileManagementScreenProps> = ({
     const confirmFileDelete = useCallback(async (fileId: string, filename: string) => {
         const confirmed = await surfaces.confirm({
             title: t('fileManagement.deleteFile') || 'Delete File',
-            message: t('fileManagement.confirms.deleteFile', { filename }),
+            description: t('fileManagement.confirms.deleteFile', { filename }),
             confirmLabel: t('fileManagement.confirm') || 'Delete',
             cancelLabel: t('common.cancel') || 'Cancel',
             destructive: true,
@@ -484,7 +484,7 @@ const FileManagementScreen: React.FC<FileManagementScreenProps> = ({
 
         const confirmed = await surfaces.confirm({
             title: t('fileManagement.deleteFiles') || 'Delete Files',
-            message: t('fileManagement.confirms.deleteFiles', { count: selectedIds.size }),
+            description: t('fileManagement.confirms.deleteFiles', { count: selectedIds.size }),
             confirmLabel: t('fileManagement.confirm') || 'Delete',
             cancelLabel: t('common.cancel') || 'Cancel',
             destructive: true,

package/src/ui/screens/HistoryViewScreen.tsx

@@ -43,7 +43,7 @@ const HistoryViewScreen: React.FC<BaseScreenProps> = ({ onClose, goBack }) => {
     const handleDeleteLast15Minutes = useCallback(async () => {
         const confirmed = await surfaces.confirm({
             title: t('history.deleteLast15Minutes.title') || 'Delete Last 15 Minutes',
-            message: t('history.deleteLast15Minutes.confirm') || 'Delete last 15 minutes of history?',
+            description: t('history.deleteLast15Minutes.confirm') || 'Delete last 15 minutes of history?',
             confirmLabel: t('common.actions.delete') || 'Delete',
             cancelLabel: t('common.cancel') || 'Cancel',
             destructive: true,
@@ -64,7 +64,7 @@ const HistoryViewScreen: React.FC<BaseScreenProps> = ({ onClose, goBack }) => {
     const handleClearAll = useCallback(async () => {
         const confirmed = await surfaces.confirm({
             title: t('history.clearAll.title') || 'Clear All History',
-            message: t('history.clearAll.confirm') || 'Clear all history? This cannot be undone.',
+            description: t('history.clearAll.confirm') || 'Clear all history? This cannot be undone.',
             confirmLabel: t('history.clearAll.title') || 'Clear All',
             cancelLabel: t('common.cancel') || 'Cancel',
             destructive: true,

package/src/ui/screens/ManageAccountScreen.tsx

@@ -141,7 +141,7 @@ const ManageAccountScreen: React.FC<BaseScreenProps> = ({
         }
         const confirmed = await surfaces.confirm({
             title: t('common.actions.signOut') || 'Sign out',
-            message: t('common.confirms.signOut') || 'Are you sure you want to sign out?',
+            description: t('common.confirms.signOut') || 'Are you sure you want to sign out?',
             confirmLabel: t('common.actions.signOut') || 'Sign out',
             cancelLabel: t('common.cancel') || 'Cancel',
             destructive: true,
@@ -168,7 +168,7 @@ const ManageAccountScreen: React.FC<BaseScreenProps> = ({
         }
         const confirmed = await surfaces.confirm({
             title: t('manageAccount.confirms.removeDeviceTitle') || 'Remove device',
-            message:
+            description:
                 t('manageAccount.confirms.removeDevice', { name: device.deviceName })
                 || `Sign out from "${device.deviceName}"?`,
             confirmLabel: t('common.remove') || 'Remove',
@@ -203,7 +203,7 @@ const ManageAccountScreen: React.FC<BaseScreenProps> = ({
         ).length;
         const confirmed = await surfaces.confirm({
             title: t('manageAccount.confirms.signOutAllDevicesTitle') || 'Sign out of all other devices',
-            message:
+            description:
                 t('manageAccount.confirms.signOutAllDevices', { count: otherDeviceCount })
                 || `End ${otherDeviceCount} other device session(s)? This won't sign you out here.`,
             confirmLabel: t('common.actions.signOut') || 'Sign out',

package/src/ui/screens/PremiumSubscriptionScreen.tsx

@@ -441,7 +441,7 @@ const PremiumSubscriptionScreen: React.FC<BaseScreenProps> = ({
     const handleCancelSubscription = useCallback(async () => {
         const confirmed = await surfaces.confirm({
             title: t('premium.confirms.cancelSubTitle') || 'Cancel Subscription',
-            message: t('premium.confirms.cancelSub') || 'Are you sure you want to cancel your subscription? You will lose access to premium features at the end of your current billing period.',
+            description: t('premium.confirms.cancelSub') || 'Are you sure you want to cancel your subscription? You will lose access to premium features at the end of your current billing period.',
             confirmLabel: t('premium.actions.cancelSubBtn') || 'Cancel Subscription',
             cancelLabel: t('common.cancel') || 'Cancel',
             destructive: true,
@@ -532,7 +532,7 @@ const PremiumSubscriptionScreen: React.FC<BaseScreenProps> = ({
         const feature = individualFeatures.find(f => f.id === featureId);
         const confirmed = await surfaces.confirm({
             title: t('premium.confirms.unsubscribeFeatureTitle') || 'Unsubscribe from Feature',
-            message: feature
+            description: feature
                 ? (t('premium.confirms.unsubscribeFeature', { name: feature.name }) ?? `Are you sure you want to unsubscribe from ${feature.name}?`)
                 : '',
             confirmLabel: t('premium.actions.unsubscribe') || 'Unsubscribe',

package/src/ui/screens/trust/TrustCenterScreen.tsx

@@ -89,7 +89,7 @@ const TrustCenterScreen: React.FC<BaseScreenProps> = ({
                     </Text>
                     {resolvedTrustTierLabel ? (
                         <Chip
-                            variant="soft"
+                            variant="subtle"
                             color="primary"
                             startIcon={
                                 <Ionicons
@@ -217,7 +217,7 @@ const TrustCenterScreen: React.FC<BaseScreenProps> = ({
                                 }
                                 rightElement={
                                     <Chip
-                                        variant="soft"
+                                        variant="subtle"
                                         size="small"
                                         color={entry.points > 0 ? 'success' : 'error'}
                                     >

package/src/ui/screens/trust/TrustLeaderboardScreen.tsx

@@ -104,7 +104,7 @@ const TrustLeaderboardScreen: React.FC<BaseScreenProps> = ({ navigate }) => {
                             {displayName}
                         </Text>
                         <View style={styles.tierRow} className="mt-space-4">
-                            <Chip size="small" variant="soft" color={isPodium ? 'primary' : 'default'}>
+                            <Chip size="small" variant="subtle" color={isPodium ? 'primary' : 'default'}>
                                 {trustTierLabel(locale, item.trustTier)}
                             </Chip>
                         </View>

package/src/ui/screens/trust/TrustRulesScreen.tsx

@@ -92,7 +92,7 @@ const TrustRulesScreen: React.FC<BaseScreenProps> = () => {
                                         showChevron={false}
                                         rightElement={
                                             <Chip
-                                                variant="soft"
+                                                variant="subtle"
                                                 size="small"
                                                 color={rule.points > 0 ? 'success' : rule.points < 0 ? 'error' : 'default'}
                                             >

package/src/ui/server.ts

@@ -34,7 +34,6 @@ export const ProfileScreen = noopComponent;
 
 // Stores (return empty objects)
 export const useAuthStore = noopHook;
-export const useAccountStore = noopHook;
 
 // Toast (noop)
 export const toast = Object.assign(

package/src/ui/session/__tests__/authStore.test.ts

@@ -0,0 +1,90 @@
+/**
+ * Which apps mirror their device credential into the device-wide shared slot.
+ *
+ * The mirror is what makes a later-installed official app able to JOIN this
+ * device's session instead of asking for the Commons identity key. It runs on
+ * native, in `'account'` mode only — the identity vault is excluded so that a
+ * background persist inside the vault can never change which session five other
+ * apps boot into.
+ */
+import type { AuthStateStore } from '@oxyhq/core';
+
+const CRED_STATE = { sessionId: 'sess-1', userId: 'user-1', deviceId: 'dev-1', deviceSecret: 'ds-1' };
+
+/** Track every credential handed to the shared slot by the store under test. */
+function makeSharedSpy() {
+  const published: { deviceId: string; deviceSecret: string }[] = [];
+  return {
+    published,
+    store: {
+      read: async () => ({ state: 'absent' as const }),
+      publish: async (credential: { deviceId: string; deviceSecret: string }) => {
+        published.push(credential);
+        return true;
+      },
+      clear: async () => undefined,
+    },
+  };
+}
+
+/**
+ * Build the platform store with the native seams stubbed. `jest.resetModules()`
+ * + `require` rather than `jest.isolateModules` for the same reason as
+ * `sharedDeviceCredentialStore.test.ts`: a factory registered inside an isolate
+ * leaked into the next one.
+ */
+function loadAuthStore(
+  os: 'ios' | 'android' | 'web',
+  sessionMode: 'account' | 'identity',
+  shared: ReturnType<typeof makeSharedSpy>,
+): AuthStateStore {
+  jest.resetModules();
+  jest.doMock('../sharedDeviceCredentialStore', () => ({
+    createPlatformSharedDeviceCredentialStore: () => (os === 'web' ? null : shared.store),
+  }));
+  const rn = require('react-native') as { Platform: { OS: string } };
+  rn.Platform.OS = os;
+  // `authStore` selects web-vs-native with `isReactNative()`, which reads
+  // `navigator.product` — NOT `Platform.OS`. Setting only the latter leaves it on
+  // the web branch, where nothing mirrors and every case passes for the wrong
+  // reason.
+  Object.defineProperty(globalThis.navigator, 'product', {
+    value: os === 'web' ? 'Gecko' : 'ReactNative',
+    configurable: true,
+  });
+  const mod = require('../authStore') as typeof import('../authStore');
+  return mod.createPlatformAuthStateStore({ sessionMode });
+}
+
+afterEach(() => {
+  jest.dontMock('../sharedDeviceCredentialStore');
+  Object.defineProperty(globalThis.navigator, 'product', { value: 'Gecko', configurable: true });
+  jest.resetModules();
+});
+
+describe('createPlatformAuthStateStore', () => {
+  test('an ordinary native app publishes its credential to the shared slot', async () => {
+    const shared = makeSharedSpy();
+    const store = loadAuthStore('android', 'account', shared);
+    await store.save(CRED_STATE);
+    expect(shared.published).toEqual([{ deviceId: 'dev-1', deviceSecret: 'ds-1' }]);
+  });
+
+  test('the identity vault does NOT publish', async () => {
+    // The vault's credential is a perfectly valid device credential, so this is a
+    // deliberate abstention, not an impossibility: publishing it would let every
+    // ordinary app on the device join the vault's session as a side effect of the
+    // vault persisting a token.
+    const shared = makeSharedSpy();
+    const store = loadAuthStore('android', 'identity', shared);
+    await store.save(CRED_STATE);
+    expect(shared.published).toEqual([]);
+  });
+
+  test('web has no shared slot to publish into', async () => {
+    const shared = makeSharedSpy();
+    const store = loadAuthStore('web', 'account', shared);
+    await store.save(CRED_STATE);
+    expect(shared.published).toEqual([]);
+  });
+});