@oxy.so/core 1.11.0 → 1.12.1

package/dist/esm/mixins/OxyServices.user.js

@@ -278,8 +278,10 @@ export function OxyServicesUserMixin(Base) {
          * caller, and returns the SAME public `{ data: PublicUserProfile[] }`
          * payload (canonical `name.displayName` + `_count`) in every case — no
          * viewer-specific fields. This method picks the path automatically:
-         * - **Service-configured host (backend):** when `configureServiceAuth(apiKey,
-         *   apiSecret)` has been called, the chunk is fetched via `makeServiceRequest`
+         * - **Service host (backend):** when `configureServiceAuth(apiKey,
+         *   apiSecret)` has been called, OR the process can attest its workload
+         *   identity (ADR 0026 — an ECS task with no key pair), the chunk is fetched
+         *   via `makeServiceRequest`
          *   (attaches `Authorization: Bearer <serviceToken>`). This is the
          *   server-to-server feed/notification hydration path (e.g. Mention's
          *   `PostHydrationService`) and is unchanged.
@@ -310,10 +312,17 @@ export function OxyServicesUserMixin(Base) {
             for (let i = 0; i < uniqueIds.length; i += USERS_BY_IDS_CHUNK_SIZE) {
                 chunks.push(uniqueIds.slice(i, i + USERS_BY_IDS_CHUNK_SIZE));
             }
-            // A backend that called configureServiceAuth() uses the bearer-service
-            // path; any other caller (browser / RN with a user session) uses the
-            // user-bearer path.
-            const useServiceAuth = Boolean(this._serviceApiKey && this._serviceApiSecret);
+            // A backend uses the bearer-service path; any other caller (browser / RN
+            // with a user session) uses the user-bearer path. "A backend" means one
+            // that can get a service token at all — a key pair, OR a task role it can
+            // attest. Asking only about the key pair sent every attested backend down
+            // the user path with no bearer: an anonymous request, charged to the
+            // shared NAT address's per-IP budget and slowed by its 500ms penalty.
+            // Measured from Mention's task (2026-09-25): 520ms per anonymous chunk
+            // against 20ms with the service token, enough to put its 1.5s hydration
+            // deadline out of reach on every cache miss.
+            const useServiceAuth = Boolean(this._serviceApiKey && this._serviceApiSecret)
+                || await this._canUseWorkloadIdentity();
             // Run chunks concurrently; a single chunk failure must not sink the rest.
             const settled = await Promise.all(chunks.map(async (chunk) => {
                 try {

package/dist/esm/session/accountDialogController.js

@@ -488,6 +488,46 @@ export class AccountDialogController {
             this.activatingContextId = null;
         }, () => this.sessionClient.activateContext(contextId));
     }
+    /**
+     * A device account row was chosen — the one entry point for "use this
+     * account", whether or not anybody is signed in here.
+     *
+     * Signed in, it is a switch: the active row is already the answer
+     * (`'current'`), any other row is {@link activateContext}.
+     *
+     * Signed out, it is NOT a switch. The row is on the list because the DEVICE
+     * still holds that identity (Commons' shared identity, or a sibling app's
+     * session), not because this app does, so there is no bearer to activate a
+     * context with — and the active-row short-circuit used to read that stale
+     * "active" as "already signed in" and close the sheet on a signed-out app
+     * (OxyHQ/oxy#1375 item 20). Choosing the row is "Continue as @handle": the
+     * same {@link signInWithOxy} path as the "Continue with Oxy" button, which
+     * mints silently from the shared identity and otherwise falls back to the
+     * request. When that silent mint lands on a different pair from the one
+     * chosen (a device holding more than one person, or an organization row), the
+     * chosen row is then activated under the new bearer, so the press ends where
+     * it pointed.
+     */
+    async chooseContext(contextId) {
+        if (this.isDeviceMutationInFlight())
+            return 'busy';
+        if (this.hasSession()) {
+            if (contextId === this.snapshot.activeContext?.contextId)
+                return 'current';
+            return (await this.activateContext(contextId)) ? 'switched' : 'failed';
+        }
+        await this.signInWithOxy();
+        // Only a sign-in that finished here (the silent shared-identity mint) can be
+        // steered to the chosen row; a request still waiting on approval belongs to
+        // whoever approves it.
+        if (this.signIn.phase !== 'completed' || !this.hasSession())
+            return 'signing-in';
+        const directory = this.sessionClient.getDirectory();
+        const offered = directory?.principals.some((principal) => principal.contexts.some((context) => context.id === contextId));
+        if (!offered || resolveActiveContext(directory)?.contextId === contextId)
+            return 'signing-in';
+        return (await this.activateContext(contextId)) ? 'switched' : 'signing-in';
+    }
     /**
      * Remove ONE `principal → account` pair, and only that pair.
      *
@@ -1332,6 +1372,7 @@ export class AccountDialogController {
         return {
             view,
             backView: backViewOf(view, hasSession),
+            hasSession,
             directory,
             activeContext: resolveActiveContext(directory),
             loading: this.loading,