apps/desktop/src/app/DesktopApp.ts | 2 + apps/desktop/src/app/DesktopHostedAuth.test.ts | 271 ++++++ apps/desktop/src/app/DesktopHostedAuth.ts | 363 ++++++++ apps/desktop/src/app/hostedAuthHandoff.test.ts | 71 ++ apps/desktop/src/app/hostedAuthHandoff.ts | 58 ++ apps/desktop/src/ipc/DesktopIpcHandlers.ts | 12 + apps/desktop/src/ipc/channels.ts | 7 + apps/desktop/src/ipc/methods/hostedAuth.ts | 48 ++ apps/desktop/src/main.ts | 2 + apps/desktop/src/preload.ts | 6 + apps/mobile/src/App.tsx | 25 +- apps/mobile/src/connection/hub.ts | 5 + apps/mobile/src/connection/platform.ts | 6 +- apps/mobile/src/connection/storage.test.ts | 68 ++ apps/mobile/src/features/cloud/CloudAuthProvider.test.ts | 1 + apps/mobile/src/features/cloud/CloudAuthProvider.tsx | 28 +- apps/mobile/src/features/cloud/ConnectOnboardingRouteScreen.tsx | 9 +- apps/mobile/src/features/cloud/cloudAvailability.ts | 7 + apps/mobile/src/features/cloud/connectionService.test.ts | 46 + apps/mobile/src/features/cloud/connectionService.ts | 13 + apps/mobile/src/features/connection/CloudEnvironmentRows.tsx | 6 +- apps/mobile/src/features/connection/ConnectionsNewRouteScreen.tsx | 174 +++- apps/mobile/src/features/connection/ConnectionsRouteScreen.tsx | 2 + apps/mobile/src/features/connection/LocalEnvironmentList.tsx | 14 +- apps/mobile/src/features/connection/SelfHostedServerSection.tsx | 60 ++ apps/mobile/src/features/connection/pairing.test.ts | 9 + apps/mobile/src/features/connection/pairing.ts | 2 +- apps/mobile/src/features/settings/SettingsAuthRouteScreen.tsx | 11 +- apps/mobile/src/features/settings/SettingsEnvironmentsRouteScreen.tsx | 2 + apps/mobile/src/features/settings/SettingsNotificationsRouteScreen.tsx | 7 +- apps/mobile/src/features/settings/SettingsRouteScreen.tsx | 4 +- apps/mobile/src/features/threads/ThreadArrangementSheet.tsx | 42 +- apps/mobile/src/features/threads/thread-list-v2-items.tsx | 58 +- apps/mobile/src/persistence/mobile-preferences.ts | 6 + apps/mobile/src/state/server.ts | 7 + apps/mobile/src/state/session.test.ts | 7 + apps/mobile/src/state/session.ts | 15 + apps/mobile/src/state/thread-list-environments.test.ts | 41 +- apps/mobile/src/state/thread-list-environments.ts | 27 +- apps/mobile/src/state/thread-order.test.ts | 7 +- apps/mobile/src/state/thread-order.ts | 18 +- apps/server/src/archive/ArchiveAssetResponse.ts | 74 ++ apps/server/src/archive/ArchiveAssets.ts | 128 +++ apps/server/src/archive/ArchiveCatalog.ts | 356 ++++++++ apps/server/src/archive/ArchiveClient.ts | 216 +++++ apps/server/src/archive/ArchiveConnection.ts | 44 + apps/server/src/archive/ArchiveFormat.ts | 40 + apps/server/src/archive/ArchiveHttp.ts | 157 ++++ apps/server/src/archive/ArchiveObjects.ts | 127 +++ apps/server/src/archive/ArchiveObjectsHttp.test.ts | 92 ++ apps/server/src/archive/ArchiveStorage.ts | 164 ++++ apps/server/src/archive/ArchivedProjectionStore.ts | 80 ++ apps/server/src/archive/HostedArchiveConnection.ts | 33 + apps/server/src/archive/TranscriptArchive.test.ts | 1438 ++++++++++++++++++++++++++++++++ apps/server/src/archive/TranscriptArchive.ts | 778 +++++++++++++++++ apps/server/src/archive/runtimeLayer.ts | 16 + apps/server/src/assets/AssetAccess.test.ts | 6 + apps/server/src/assets/AssetAccess.ts | 205 ++++- apps/server/src/attachmentStore.ts | 38 +- apps/server/src/auth/EnvironmentAuth.test.ts | 35 + apps/server/src/auth/EnvironmentAuth.ts | 112 +++ apps/server/src/auth/HostedAuth.test.ts | 696 ++++++++++++++++ apps/server/src/auth/HostedAuth.ts | 739 ++++++++++++++++ apps/server/src/auth/HostedAuthConfig.ts | 79 ++ apps/server/src/auth/HostedAuthHttp.ts | 255 ++++++ apps/server/src/auth/SessionStore.test.ts | 103 ++- apps/server/src/auth/SessionStore.ts | 175 +++- apps/server/src/auth/http.test.ts | 55 +- apps/server/src/auth/http.ts | 22 + apps/server/src/cli/auth.ts | 33 +- apps/server/src/cli/project.ts | 9 + apps/server/src/cli/shared.ts | 116 ++- apps/server/src/environment/Hub.test.ts | 326 ++++++++ apps/server/src/environment/Hub.ts | 417 +++++++++ apps/server/src/environment/HubHttp.ts | 89 ++ apps/server/src/environment/HubInbox.test.ts | 536 ++++++++++++ apps/server/src/environment/HubInbox.testkit.ts | 43 + apps/server/src/environment/HubInbox.ts | 661 +++++++++++++++ apps/server/src/environment/HubInboxHttp.test.ts | 126 +++ apps/server/src/environment/HubInboxHttp.ts | 128 +++ apps/server/src/environment/HubProxy.auth.test.ts | 127 +++ apps/server/src/environment/HubProxy.stream.test.ts | 116 +++ apps/server/src/environment/HubProxy.test.ts | 324 +++++++ apps/server/src/environment/HubProxy.ts | 232 ++++++ apps/server/src/environment/OutboundHub.test.ts | 242 ++++++ apps/server/src/environment/OutboundHub.ts | 295 +++++++ apps/server/src/environment/OutboundSocket.test.ts | 114 +++ apps/server/src/environment/OutboundSocket.ts | 83 ++ apps/server/src/environment/OutboundSource.ts | 169 ++++ apps/server/src/environment/SharedServer.ts | 46 + apps/server/src/environment/SourceConnection.test.ts | 132 +++ apps/server/src/environment/SourceConnection.ts | 115 +++ apps/server/src/environment/SourceConnectionHttp.ts | 95 +++ apps/server/src/http.ts | 151 +++- apps/server/src/orchestration-v2/ProjectionMaintenance.ts | 15 +- apps/server/src/orchestration-v2/ProjectionStore.ts | 7 + apps/server/src/orchestration-v2/runtimeLayer.ts | 28 +- apps/server/src/persistence/AuthSessions.ts | 34 +- apps/server/src/persistence/Migrations.ts | 10 + apps/server/src/persistence/Migrations/063_TranscriptArchives.ts | 26 + apps/server/src/persistence/Migrations/064_AuthSessionDelegation.ts | 7 + apps/server/src/persistence/Migrations/065_HubInbox.ts | 23 + apps/server/src/persistence/Migrations/066_HostedAuthDevices.ts | 26 + apps/server/src/persistence/Migrations/067_ArchiveCatalogAndSync.ts | 10 + apps/server/src/persistence/OrchestrationEventStore.ts | 7 +- apps/server/src/provider/SharedAccountClient.ts | 40 +- apps/server/src/server.ts | 167 ++-- apps/server/src/storageCleanup.test.ts | 88 +- apps/server/src/storageCleanup.ts | 10 + apps/web/src/AppRoot.tsx | 2 + apps/web/src/cloud/CloudAuthBoundary.test.tsx | 105 +++ apps/web/src/cloud/CloudAuthBoundary.tsx | 29 + apps/web/src/cloud/CloudAuthentication.tsx | 40 + apps/web/src/cloud/activation.ts | 55 ++ apps/web/src/cloud/managedAuth.tsx | 3 + apps/web/src/components/ChatView.tsx | 39 +- apps/web/src/components/Sidebar.tsx | 120 +-- apps/web/src/components/auth/PairingRouteSurface.tsx | 59 +- apps/web/src/components/clerk/BrowserManagedAuthShell.tsx | 9 +- apps/web/src/components/clerk/ElectronManagedAuthShell.tsx | 10 +- apps/web/src/components/clerk/T3ConnectSidebarSignIn.tsx | 25 +- apps/web/src/components/cloud/ConnectCliAuthSurface.tsx | 19 +- apps/web/src/components/cloud/ConnectOnboardingDialog.tsx | 14 +- apps/web/src/components/onboarding/WelcomeWizard.import.test.tsx | 1 + apps/web/src/components/onboarding/WelcomeWizard.terminal.test.tsx | 1 + apps/web/src/components/onboarding/WelcomeWizard.test.tsx | 1 + apps/web/src/components/onboarding/WelcomeWizard.tsx | 86 +- apps/web/src/components/settings/ConnectionsSettings.tsx | 109 ++- apps/web/src/components/settings/SelfHostedServer.test.tsx | 88 ++ apps/web/src/components/settings/SelfHostedServer.tsx | 568 +++++++++++++ apps/web/src/components/settings/pairingUrls.test.ts | 6 + apps/web/src/components/settings/pairingUrls.ts | 4 +- apps/web/src/components/settings/settingsSearch.ts | 4 +- apps/web/src/components/threadActionMenu.logic.test.ts | 19 +- apps/web/src/components/threadActionMenu.logic.ts | 34 +- apps/web/src/connection/hostedAuth.test.ts | 201 +++++ apps/web/src/connection/hostedAuth.ts | 112 +++ apps/web/src/connection/hub.ts | 5 + apps/web/src/connection/platform.ts | 19 +- apps/web/src/connection/storage.test.ts | 63 ++ apps/web/src/environments/primary/bootstrap.test.ts | 25 + apps/web/src/environments/primary/target.ts | 28 +- apps/web/src/hooks/useThreadActionMenu.ts | 8 +- apps/web/src/main.tsx | 39 +- apps/web/src/routes/__root.tsx | 2 + apps/web/src/routes/_chat.index.tsx | 6 +- apps/web/src/state/entities.ts | 32 +- apps/web/src/state/server.ts | 6 + apps/web/src/state/session.ts | 15 + apps/web/src/state/use-orchestration-command.test.ts | 19 +- apps/web/src/state/use-orchestration-command.ts | 12 +- apps/web/test/environmentHttpTest.ts | 1 + apps/web/vite.config.ts | 4 +- compose.sso.yaml | 12 + docs/operations/development.md | 82 +- docs/user/shared-server.md | 30 +- packages/client-runtime/package.json | 4 + packages/client-runtime/src/authorization/remote.test.ts | 57 ++ packages/client-runtime/src/authorization/remote.ts | 12 +- packages/client-runtime/src/connection/catalog.ts | 22 +- packages/client-runtime/src/connection/hub.test.ts | 575 +++++++++++++ packages/client-runtime/src/connection/hub.ts | 580 +++++++++++++ packages/client-runtime/src/connection/index.ts | 1 + packages/client-runtime/src/connection/layer.ts | 15 + packages/client-runtime/src/connection/onboarding.test.ts | 36 +- packages/client-runtime/src/connection/onboarding.ts | 3 +- packages/client-runtime/src/connection/presentation.test.ts | 16 + packages/client-runtime/src/connection/presentation.ts | 8 +- packages/client-runtime/src/connection/registry.test.ts | 17 +- packages/client-runtime/src/connection/registry.ts | 21 +- packages/client-runtime/src/connection/resolver.test.ts | 30 + packages/client-runtime/src/connection/resolver.ts | 72 +- packages/client-runtime/src/connection/routes.test.ts | 13 + packages/client-runtime/src/connection/routes.ts | 21 +- packages/client-runtime/src/environment/endpoint.test.ts | 29 +- packages/client-runtime/src/environment/endpoint.ts | 8 - packages/client-runtime/src/operations/commands.ts | 25 +- packages/client-runtime/src/platform/capabilities.ts | 9 + packages/client-runtime/src/platform/persistence.ts | 5 +- packages/client-runtime/src/rpc/http.ts | 15 +- packages/client-runtime/src/state/archiveAssetHttp.ts | 41 + packages/client-runtime/src/state/archiveThreadHttp.ts | 38 + packages/client-runtime/src/state/assets.test.ts | 129 +++ packages/client-runtime/src/state/assets.ts | 93 ++- packages/client-runtime/src/state/attachments.ts | 7 + packages/client-runtime/src/state/environmentHttpAuth.test.ts | 26 + packages/client-runtime/src/state/environmentHttpAuth.ts | 8 +- packages/client-runtime/src/state/hub-capabilities.test.ts | 125 +++ packages/client-runtime/src/state/hub.ts | 173 ++++ packages/client-runtime/src/state/hubSignedUrl.test.ts | 234 ++++++ packages/client-runtime/src/state/hubSignedUrl.ts | 50 ++ packages/client-runtime/src/state/orchestration.ts | 38 +- packages/client-runtime/src/state/runtime.ts | 12 + packages/client-runtime/src/state/shell.ts | 22 +- packages/client-runtime/src/state/threadCommands.test.ts | 42 + packages/client-runtime/src/state/threads-sync.test.ts | 73 +- packages/client-runtime/src/state/threads.ts | 53 +- packages/client-runtime/src/webhookAddress.test.ts | 6 + packages/client-runtime/src/webhookAddress.ts | 3 +- packages/contracts/src/auth.ts | 17 + packages/contracts/src/desktopHostedAuth.ts | 15 + packages/contracts/src/environmentHttp.ts | 13 + packages/contracts/src/hostedAuth.ts | 70 ++ packages/contracts/src/hub.ts | 116 +++ packages/contracts/src/index.ts | 6 + packages/contracts/src/ipc.ts | 6 + packages/contracts/src/outbound.ts | 32 + packages/contracts/src/transcriptArchive.ts | 76 ++ packages/shared/package.json | 4 + packages/shared/src/advertisedEndpoint.ts | 16 +- packages/shared/src/devProxy.ts | 10 +- packages/shared/src/hostedServerUrl.ts | 14 + packages/shared/src/remote.test.ts | 19 + packages/shared/src/remote.ts | 43 +- 214 files changed, 17689 insertions(+), 759 deletions(-)