<!-- source-hash: 733d42822ee9220c6eefe2050f96cda5 -->
Provides the `ChatIdentitySurface` capability bag (`authTier`, `source`, `attachmentsEnabled`, `user`) for the current chat session, enabling client UI elements to gate on identity tiers without requiring a chat message first.

## Key Components

| Export | Type | Description |
|---|---|---|
| `ChatIdentityResponse` | Interface | Wire-shape mirroring the hub's `/api/auth/identity` response |
| `ChatIdentitySurface` | Interface | Extends `ChatIdentityResponse` with `isLoading`; never throws |
| `ChatIdentityProvider` | Component | Optional context provider that resolves identity once for an entire React subtree |
| `useChatIdentity` | Hook | Returns the `ChatIdentitySurface` bag; reads from a parent provider when present, otherwise self-fetches |

## Usage Example

**Standalone (self-fetching):**

```typescript
import { useChatIdentity } from './use-chat-identity'

function AttachmentButton() {
  const { isLoading, attachmentsEnabled, user } = useChatIdentity()

  if (isLoading) return <Skeleton />
  if (!attachmentsEnabled) return null
  return <button>Attach file</button>
}
```

**Shared provider for independent React subtrees:**

```typescript
import { ChatIdentityProvider, useChatIdentity } from './use-chat-identity'

// Mount once inside ChatRuntimeContext.Provider, near your embed root.
// Pass enabled={false} to defer fetching until the chat drawer opens.
function AppShell({ children }: { children: ReactNode }) {
  return (
    <ChatIdentityProvider enabled={drawerOpen}>
      {children}
    </ChatIdentityProvider>
  )
}

// Any descendant — even in a separate router outlet — shares the
// single resolution instead of issuing its own request.
function TicketCenterAuthed() {
  const { user } = useChatIdentity()
  return <span>{user?.firstName ?? ''}</span>
}
```

## Behavior Notes

- **No client-side cache.** Uses plain `useState`/`useEffect`; refetches on credential rotation (`proxyEmail` change) and never persists stale identity.
- **Always safe to render.** Failures and non-OK responses fall back to `ANON_DEFAULTS` (`authTier: 'anon'`, `attachmentsEnabled: false`, `user: null`).
- **`attachmentsEnabled` is server-computed.** Consumers must not derive it from `authTier` + `source` themselves.
- Endpoint URL is read from `useRequiredChatRuntime().endpoints.identityUrl`, allowing reverse-proxy overrides per embed.