@oxy.so/core 1.11.0 → 1.12.1

package/dist/types/index.d.ts

@@ -130,7 +130,7 @@ export { isSwitchTargetAccount, canSwitchIntoAccount, } from './session/accountS
 export { resolveAccountDelegationAccess } from './session/accountDelegationAccess';
 export type { AccountDelegationAccess, AccountDelegationNode, } from './session/accountDelegationAccess';
 export { AccountDialogController, createAccountDialogController, } from './session/accountDialogController';
-export type { AccountDialogControllerOptions, AccountDialogSnapshot, AccountDialogView, CommonsAvailability, PopupWindowHandle, SignInFailureReason, SignInFlowPhase, SignInFlowState, SignInProgress, } from './session/accountDialogController';
+export type { AccountDialogControllerOptions, AccountDialogSnapshot, AccountDialogView, CommonsAvailability, ContextChoiceOutcome, PopupWindowHandle, SignInFailureReason, SignInFlowPhase, SignInFlowState, SignInProgress, } from './session/accountDialogController';
 export { createWebAuthStateStore, createNativeAuthStateStore, createMemoryAuthStateStore, AUTH_STATE_STORAGE_KEY, } from './session/authStateStore';
 export type { PersistedAuthState, AuthStateStore, NativeKeyValueStorage, } from './session/authStateStore';
 export { createSharedMirroringAuthStateStore, decideSharedDeviceJoin, decideSharedDevicePublish, normalizeSharedDeviceSessionRead, publishProvenDeviceCredential, readLocalDeviceCredential, } from './session/sharedDeviceCredential';

package/dist/types/mixins/OxyServices.user.d.ts

@@ -97,6 +97,13 @@ export declare function OxyServicesUserMixin<T extends typeof OxyServicesBase>(B
          */
         _serviceApiKey: string | null;
         _serviceApiSecret: string | null;
+        /**
+         * Whether this process can mint a service token by attesting what it is
+         * (ADR 0026), defined on the auth mixin. A host with no key pair that CAN
+         * attest is a first-party backend exactly like one with a key pair, and
+         * `getUsersByIds` must treat it as one.
+         */
+        _canUseWorkloadIdentity: () => Promise<boolean>;
         /**
          * Get profile by username.
          *
@@ -229,8 +236,10 @@ export declare function OxyServicesUserMixin<T extends typeof OxyServicesBase>(B
          * caller, and returns the SAME public `{ data: PublicUserProfile[] }`
          * payload (canonical `name.displayName` + `_count`) in every case — no
          * viewer-specific fields. This method picks the path automatically:
-         * - **Service-configured host (backend):** when `configureServiceAuth(apiKey,
-         *   apiSecret)` has been called, the chunk is fetched via `makeServiceRequest`
+         * - **Service host (backend):** when `configureServiceAuth(apiKey,
+         *   apiSecret)` has been called, OR the process can attest its workload
+         *   identity (ADR 0026 — an ECS task with no key pair), the chunk is fetched
+         *   via `makeServiceRequest`
          *   (attaches `Authorization: Bearer <serviceToken>`). This is the
          *   server-to-server feed/notification hydration path (e.g. Mention's
          *   `PostHydrationService`) and is unchanged.

package/dist/types/session/accountDialogController.d.ts

@@ -233,6 +233,16 @@ export interface AccountDialogSnapshot {
      * table of their own.
      */
     backView: AccountDialogView | null;
+    /**
+     * Whether THIS client is signed in: a bearer is planted.
+     *
+     * Not the same question as "does the directory list anyone". The directory is
+     * the DEVICE's, and a device can go on listing a shared identity (Commons, or a
+     * sibling app) after this app signed out. A host names its sign-in entry, and
+     * whether a listed account reads as the current one, from this — never from
+     * the directory's size.
+     */
+    hasSession: boolean;
     /**
      * The server-authoritative device directory — principals and the contexts
      * each may act as (ADR 0002) — or `null` before the first read.
@@ -259,6 +269,20 @@ export interface AccountDialogSnapshot {
     /** Whether Commons is installed on this device. See {@link CommonsAvailability}. */
     commonsAvailability: CommonsAvailability;
 }
+/**
+ * What {@link AccountDialogController.chooseContext} did with a chosen row.
+ *
+ * - `'current'` — the row is already the active account; nothing to do.
+ * - `'switched'` — the switch to the row happened (signed in; or signed out,
+ *   after the silent sign-in landed on a different pair and the chosen one was
+ *   then activated).
+ * - `'signing-in'` — signed out: the row started "Continue with Oxy", and the
+ *   sign-in flow (its own view, its own completion) owns what happens next —
+ *   including closing the dialog, through `onSignedIn`.
+ * - `'failed'` — the switch was attempted and failed (the reason is `error`).
+ * - `'busy'` — another device mutation is in flight; the press was dropped.
+ */
+export type ContextChoiceOutcome = 'current' | 'switched' | 'signing-in' | 'failed' | 'busy';
 /** Construction options for {@link AccountDialogController}. */
 export interface AccountDialogControllerOptions {
     /** The API client. Source of graph accounts, profiles, and the sign-in methods. */
@@ -525,6 +549,27 @@ export declare class AccountDialogController {
      * device mutation is in flight ({@link isDeviceMutationInFlight}).
      */
     activateContext(contextId: string): Promise<boolean>;
+    /**
+     * A device account row was chosen — the one entry point for "use this
+     * account", whether or not anybody is signed in here.
+     *
+     * Signed in, it is a switch: the active row is already the answer
+     * (`'current'`), any other row is {@link activateContext}.
+     *
+     * Signed out, it is NOT a switch. The row is on the list because the DEVICE
+     * still holds that identity (Commons' shared identity, or a sibling app's
+     * session), not because this app does, so there is no bearer to activate a
+     * context with — and the active-row short-circuit used to read that stale
+     * "active" as "already signed in" and close the sheet on a signed-out app
+     * (OxyHQ/oxy#1375 item 20). Choosing the row is "Continue as @handle": the
+     * same {@link signInWithOxy} path as the "Continue with Oxy" button, which
+     * mints silently from the shared identity and otherwise falls back to the
+     * request. When that silent mint lands on a different pair from the one
+     * chosen (a device holding more than one person, or an organization row), the
+     * chosen row is then activated under the new bearer, so the press ends where
+     * it pointed.
+     */
+    chooseContext(contextId: string): Promise<ContextChoiceOutcome>;
     /**
      * Remove ONE `principal → account` pair, and only that pair.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "1.11.0",
+  "version": "1.12.1",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/index.ts

@@ -819,6 +819,7 @@ export type {
     AccountDialogSnapshot,
     AccountDialogView,
     CommonsAvailability,
+    ContextChoiceOutcome,
     PopupWindowHandle,
     SignInFailureReason,
     SignInFlowPhase,

package/src/mixins/OxyServices.user.ts

@@ -155,6 +155,14 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
     declare _serviceApiKey: string | null;
     declare _serviceApiSecret: string | null;
 
+    /**
+     * Whether this process can mint a service token by attesting what it is
+     * (ADR 0026), defined on the auth mixin. A host with no key pair that CAN
+     * attest is a first-party backend exactly like one with a key pair, and
+     * `getUsersByIds` must treat it as one.
+     */
+    declare _canUseWorkloadIdentity: () => Promise<boolean>;
+
     /**
      * Get profile by username.
      *
@@ -464,8 +472,10 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
      * caller, and returns the SAME public `{ data: PublicUserProfile[] }`
      * payload (canonical `name.displayName` + `_count`) in every case — no
      * viewer-specific fields. This method picks the path automatically:
-     * - **Service-configured host (backend):** when `configureServiceAuth(apiKey,
-     *   apiSecret)` has been called, the chunk is fetched via `makeServiceRequest`
+     * - **Service host (backend):** when `configureServiceAuth(apiKey,
+     *   apiSecret)` has been called, OR the process can attest its workload
+     *   identity (ADR 0026 — an ECS task with no key pair), the chunk is fetched
+     *   via `makeServiceRequest`
      *   (attaches `Authorization: Bearer <serviceToken>`). This is the
      *   server-to-server feed/notification hydration path (e.g. Mention's
      *   `PostHydrationService`) and is unchanged.
@@ -500,10 +510,17 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
         chunks.push(uniqueIds.slice(i, i + USERS_BY_IDS_CHUNK_SIZE));
       }
 
-      // A backend that called configureServiceAuth() uses the bearer-service
-      // path; any other caller (browser / RN with a user session) uses the
-      // user-bearer path.
-      const useServiceAuth = Boolean(this._serviceApiKey && this._serviceApiSecret);
+      // A backend uses the bearer-service path; any other caller (browser / RN
+      // with a user session) uses the user-bearer path. "A backend" means one
+      // that can get a service token at all — a key pair, OR a task role it can
+      // attest. Asking only about the key pair sent every attested backend down
+      // the user path with no bearer: an anonymous request, charged to the
+      // shared NAT address's per-IP budget and slowed by its 500ms penalty.
+      // Measured from Mention's task (2026-09-25): 520ms per anonymous chunk
+      // against 20ms with the service token, enough to put its 1.5s hydration
+      // deadline out of reach on every cache miss.
+      const useServiceAuth = Boolean(this._serviceApiKey && this._serviceApiSecret)
+        || await this._canUseWorkloadIdentity();
 
       // Run chunks concurrently; a single chunk failure must not sink the rest.
       const settled = await Promise.all(

package/src/mixins/__tests__/getUsersByIds.test.ts

@@ -110,6 +110,33 @@ describe('OxyServices.getUsersByIds — dual-mode auth', () => {
     });
   });
 
+  describe('with an attestable workload identity and no key pair (ADR 0026 backend)', () => {
+    it('uses makeServiceRequest — an attested backend is still a backend', async () => {
+      jest
+        .spyOn(oxy as unknown as { _canUseWorkloadIdentity: () => Promise<boolean> }, '_canUseWorkloadIdentity')
+        .mockResolvedValue(true);
+      makeServiceRequestSpy.mockResolvedValueOnce([makeRawUser('a')]);
+
+      const result = await oxy.getUsersByIds(['a']);
+
+      expect(makeRequestSpy).not.toHaveBeenCalled();
+      expect(makeServiceRequestSpy).toHaveBeenCalledWith('POST', '/users/by-ids', { ids: ['a'] });
+      expect(result).toHaveLength(1);
+    });
+
+    it('stays on the user path when the host cannot attest', async () => {
+      jest
+        .spyOn(oxy as unknown as { _canUseWorkloadIdentity: () => Promise<boolean> }, '_canUseWorkloadIdentity')
+        .mockResolvedValue(false);
+      makeRequestSpy.mockResolvedValueOnce([makeRawUser('a')]);
+
+      await oxy.getUsersByIds(['a']);
+
+      expect(makeServiceRequestSpy).not.toHaveBeenCalled();
+      expect(makeRequestSpy).toHaveBeenCalledWith('POST', '/users/by-ids', { ids: ['a'] }, { cache: false });
+    });
+  });
+
   describe('chunking + resilience (applies to both modes)', () => {
     it('chunks at 100 ids per request on the user path and flattens results', async () => {
       const ids = Array.from({ length: 250 }, (_, i) => `id-${i}`);

package/src/session/__tests__/accountDialogController.test.ts

@@ -2469,3 +2469,176 @@ it('createAccountDialogController returns an AccountDialogController instance',
 // Ensure the exported type surface is reachable at compile time for binders.
 const _typecheck: MinimalUserData | null = null;
 void _typecheck;
+
+describe('AccountDialogController — choosing a device account row (OxyHQ/oxy#1375 items 20 and 21)', () => {
+  /**
+   * The device's directory as Commons leaves it: `qa` on the device and active,
+   * plus (when `withOrg`) an organization `qa` also operates.
+   */
+  const deviceDirectory = (activeContextId: string | null, withOrg = false) => ({
+    deviceId: 'device-1',
+    revision: 4,
+    activeContextId,
+    updatedAt: 1_720_000_000_000,
+    principals: [
+      {
+        id: 'p-qa',
+        userId: 'qa',
+        authuser: 0,
+        user: { id: 'qa', username: 'qatest0925' },
+        contexts: [
+          {
+            id: 'ctx-qa',
+            accountId: 'qa',
+            kind: 'personal' as const,
+            relationship: 'self' as const,
+            account: { id: 'qa', username: 'qatest0925' },
+            onDevice: true,
+            available: true,
+            active: activeContextId === 'ctx-qa',
+            lastUsedAt: null,
+          },
+          ...(withOrg
+            ? [
+                {
+                  id: 'ctx-qa-org',
+                  accountId: 'org',
+                  kind: 'organization' as const,
+                  relationship: 'owner' as const,
+                  account: { id: 'org', username: 'oxy' },
+                  onDevice: true,
+                  available: true,
+                  active: activeContextId === 'ctx-qa-org',
+                  lastUsedAt: null,
+                },
+              ]
+            : []),
+        ],
+      },
+    ],
+  });
+
+  const sharedSession: SessionLoginResponse = {
+    sessionId: 'sess-shared',
+    deviceId: 'device-1',
+    expiresAt: '2030-01-01T00:00:00Z',
+    accessToken: 'access-shared',
+    user: { id: 'qa', username: 'qatest0925', name: { displayName: 'QA' } },
+  };
+
+  /**
+   * A device that still lists `qa` (Commons holds the shared identity) while
+   * THIS app holds no bearer — Mention after "Sign out".
+   */
+  async function signedOutDevice(options: { withOrg?: boolean } = {}) {
+    const oxy = makeOxy();
+    const urls: string[] = [];
+    const sc = new TestSessionClient({
+      makeRequest: jest.fn(async (_method: string, url: string) => {
+        urls.push(url);
+        if (url === '/session/device/directory') return deviceDirectory('ctx-qa', options.withOrg);
+        if (url === '/session/device/activate') {
+          return { directory: { ...deviceDirectory('ctx-qa-org', true), revision: 5 }, activeToken: null };
+        }
+        return undefined;
+      }),
+      getBaseURL: () => 'http://test.invalid',
+      getAccessToken: () => oxy.getAccessToken(),
+      getDeviceCredential: () => null,
+      onTokensChanged: () => () => undefined,
+      setTokens: jest.fn(),
+      getCurrentAccountId: () => null,
+    });
+    // The directory this client read while it was still signed in.
+    await sc.refreshDirectory();
+    oxy.emitTokenChange(null);
+    const commitSession = jest.fn().mockResolvedValue(undefined);
+    const onSignedIn = jest.fn();
+    const controller = createAccountDialogController({
+      oxyServices: oxy as unknown as OxyServices,
+      sessionClient: sc,
+      clientId: 'oxy_dk_test',
+      commitSession,
+      onSignedIn,
+    });
+    controller.start();
+    await flush();
+    urls.length = 0;
+    return { controller, oxy, sc, urls, commitSession, onSignedIn };
+  }
+
+  it('publishes that this client is signed out while the device still lists an active account', async () => {
+    const { controller } = await signedOutDevice();
+    const snap = controller.getSnapshot();
+    expect(snap.hasSession).toBe(false);
+    // The precondition of the bug: the row the sheet renders reads as "active".
+    expect(snap.activeContext?.contextId).toBe('ctx-qa');
+    controller.destroy();
+  });
+
+  it('signed out, choosing the listed account signs in through the shared identity, like "Continue with Oxy"', async () => {
+    const { controller, oxy, urls, commitSession, onSignedIn } = await signedOutDevice();
+    oxy.signInWithSharedIdentity.mockResolvedValue(sharedSession);
+
+    // It used to short-circuit on "already the active row" and report success,
+    // closing the sheet on an app that was still signed out.
+    expect(await controller.chooseContext('ctx-qa')).toBe('signing-in');
+
+    expect(oxy.signInWithSharedIdentity).toHaveBeenCalledWith({ plantTokens: false });
+    expect(commitSession).toHaveBeenCalledWith(expect.objectContaining({ sessionId: 'sess-shared' }));
+    expect(onSignedIn).toHaveBeenCalledWith(expect.objectContaining({ id: 'qa' }));
+    expect(controller.getSnapshot().hasSession).toBe(true);
+    expect(controller.getSnapshot().signIn.phase).toBe('completed');
+    // The silent mint already landed on the chosen pair: no switch on top.
+    expect(urls).not.toContain('/session/device/activate');
+    controller.destroy();
+  });
+
+  it('signed out with no shared identity, choosing the account starts the same request "Continue with Oxy" does', async () => {
+    const { controller, oxy, onSignedIn } = await signedOutDevice();
+    oxy.signInWithSharedIdentity.mockResolvedValue(null);
+    oxy.startCommonsSignIn.mockResolvedValue({
+      sessionToken: 'secret-tok',
+      authorizeCode: 'AUTH-CODE',
+      qrPayload: 'oxycommons://approve?v=1&code=AUTH-CODE',
+      expiresAt: Date.now() + 300_000,
+      status: 'pending',
+    });
+
+    expect(await controller.chooseContext('ctx-qa')).toBe('signing-in');
+
+    expect(oxy.startCommonsSignIn).toHaveBeenCalledWith({ clientId: 'oxy_dk_test' });
+    expect(controller.getSnapshot().view).toBe('qr');
+    expect(controller.getSnapshot().signIn.phase).toBe('waiting');
+    expect(onSignedIn).not.toHaveBeenCalled();
+    controller.destroy();
+  });
+
+  it('signed out, choosing an organization row signs in and then activates that row', async () => {
+    const { controller, oxy, urls } = await signedOutDevice({ withOrg: true });
+    oxy.signInWithSharedIdentity.mockResolvedValue(sharedSession);
+
+    expect(await controller.chooseContext('ctx-qa-org')).toBe('switched');
+
+    expect(oxy.signInWithSharedIdentity).toHaveBeenCalledTimes(1);
+    expect(urls).toContain('/session/device/activate');
+    expect(controller.getSnapshot().activeContext?.contextId).toBe('ctx-qa-org');
+    controller.destroy();
+  });
+
+  it('signed in, the active row is "current" and any other row is a switch', async () => {
+    const { controller, oxy, urls } = await signedOutDevice({ withOrg: true });
+    oxy.emitTokenChange('access-token');
+    await flush();
+    urls.length = 0;
+    expect(controller.getSnapshot().hasSession).toBe(true);
+
+    expect(await controller.chooseContext('ctx-qa')).toBe('current');
+    expect(urls).not.toContain('/session/device/activate');
+
+    expect(await controller.chooseContext('ctx-qa-org')).toBe('switched');
+    expect(urls).toContain('/session/device/activate');
+    expect(oxy.signInWithSharedIdentity).not.toHaveBeenCalled();
+    controller.destroy();
+  });
+});

package/src/session/__tests__/accountDialogShape.test.ts

@@ -68,6 +68,7 @@ const SNAPSHOT_KEYS = [
   'commonsAvailability',
   'directory',
   'error',
+  'hasSession',
   'loading',
   'removingContextId',
   'removingPrincipalId',

package/src/session/accountDialogController.ts

@@ -310,6 +310,16 @@ export interface AccountDialogSnapshot {
    * table of their own.
    */
   backView: AccountDialogView | null;
+  /**
+   * Whether THIS client is signed in: a bearer is planted.
+   *
+   * Not the same question as "does the directory list anyone". The directory is
+   * the DEVICE's, and a device can go on listing a shared identity (Commons, or a
+   * sibling app) after this app signed out. A host names its sign-in entry, and
+   * whether a listed account reads as the current one, from this — never from
+   * the directory's size.
+   */
+  hasSession: boolean;
   /**
    * The server-authoritative device directory — principals and the contexts
    * each may act as (ADR 0002) — or `null` before the first read.
@@ -337,6 +347,21 @@ export interface AccountDialogSnapshot {
   commonsAvailability: CommonsAvailability;
 }
 
+/**
+ * What {@link AccountDialogController.chooseContext} did with a chosen row.
+ *
+ * - `'current'` — the row is already the active account; nothing to do.
+ * - `'switched'` — the switch to the row happened (signed in; or signed out,
+ *   after the silent sign-in landed on a different pair and the chosen one was
+ *   then activated).
+ * - `'signing-in'` — signed out: the row started "Continue with Oxy", and the
+ *   sign-in flow (its own view, its own completion) owns what happens next —
+ *   including closing the dialog, through `onSignedIn`.
+ * - `'failed'` — the switch was attempted and failed (the reason is `error`).
+ * - `'busy'` — another device mutation is in flight; the press was dropped.
+ */
+export type ContextChoiceOutcome = 'current' | 'switched' | 'signing-in' | 'failed' | 'busy';
+
 /** Construction options for {@link AccountDialogController}. */
 export interface AccountDialogControllerOptions {
   /** The API client. Source of graph accounts, profiles, and the sign-in methods. */
@@ -880,6 +905,45 @@ export class AccountDialogController {
     );
   }
 
+  /**
+   * A device account row was chosen — the one entry point for "use this
+   * account", whether or not anybody is signed in here.
+   *
+   * Signed in, it is a switch: the active row is already the answer
+   * (`'current'`), any other row is {@link activateContext}.
+   *
+   * Signed out, it is NOT a switch. The row is on the list because the DEVICE
+   * still holds that identity (Commons' shared identity, or a sibling app's
+   * session), not because this app does, so there is no bearer to activate a
+   * context with — and the active-row short-circuit used to read that stale
+   * "active" as "already signed in" and close the sheet on a signed-out app
+   * (OxyHQ/oxy#1375 item 20). Choosing the row is "Continue as @handle": the
+   * same {@link signInWithOxy} path as the "Continue with Oxy" button, which
+   * mints silently from the shared identity and otherwise falls back to the
+   * request. When that silent mint lands on a different pair from the one
+   * chosen (a device holding more than one person, or an organization row), the
+   * chosen row is then activated under the new bearer, so the press ends where
+   * it pointed.
+   */
+  async chooseContext(contextId: string): Promise<ContextChoiceOutcome> {
+    if (this.isDeviceMutationInFlight()) return 'busy';
+    if (this.hasSession()) {
+      if (contextId === this.snapshot.activeContext?.contextId) return 'current';
+      return (await this.activateContext(contextId)) ? 'switched' : 'failed';
+    }
+    await this.signInWithOxy();
+    // Only a sign-in that finished here (the silent shared-identity mint) can be
+    // steered to the chosen row; a request still waiting on approval belongs to
+    // whoever approves it.
+    if (this.signIn.phase !== 'completed' || !this.hasSession()) return 'signing-in';
+    const directory = this.sessionClient.getDirectory();
+    const offered = directory?.principals.some((principal) =>
+      principal.contexts.some((context) => context.id === contextId),
+    );
+    if (!offered || resolveActiveContext(directory)?.contextId === contextId) return 'signing-in';
+    return (await this.activateContext(contextId)) ? 'switched' : 'signing-in';
+  }
+
   /**
    * Remove ONE `principal → account` pair, and only that pair.
    *
@@ -1780,6 +1844,7 @@ export class AccountDialogController {
     return {
       view,
       backView: backViewOf(view, hasSession),
+      hasSession,
       directory,
       activeContext: resolveActiveContext(directory),
       loading: this.loading,