@oxy.so/core 1.2.1 → 1.3.1

package/src/mixins/__tests__/OxyServices.rotateKey.test.ts

@@ -175,6 +175,53 @@ describe('OxyServices.rotateKey', () => {
       expect(clearEntrySpy).toHaveBeenCalledWith('GET:/u/user-123/did.json');
     });
 
+    // The shared slot is what every cross-app reader takes first, including
+    // `deriveScopedSeed` — the FairCoin wallet Peable derives. A rotation that
+    // wrote only the primary left that wallet on the replaced key, watching
+    // addresses the rotated identity will never be paid at, with no error
+    // anywhere. Shared is written FIRST so a crash between the two writes leaves
+    // the money path on the new key and the primary stale, which fails loudly.
+    it('writes the new key to the shared slot too, before the primary', async () => {
+      const order: string[] = [];
+      jest.spyOn(RecoveryPhraseService, 'derivePendingIdentity').mockResolvedValue(pendingFixture);
+      jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue(OLD_PUBLIC);
+      jest.spyOn(SignatureService, 'sign').mockResolvedValue('sig-hex');
+      jest.spyOn(protocol, 'signMessage').mockResolvedValue('newkeyproof-hex');
+      jest.spyOn(KeyManager, 'hasSharedIdentity').mockResolvedValue(true);
+      const sharedSpy = jest
+        .spyOn(KeyManager, 'importSharedIdentity')
+        .mockImplementation(async () => { order.push('shared'); return NEW_PUBLIC; });
+      const importSpy = jest
+        .spyOn(KeyManager, 'importKeyPair')
+        .mockImplementation(async () => { order.push('primary'); return NEW_PUBLIC; });
+      makeRequestSpy
+        .mockResolvedValueOnce({ challenge: 'chal-1', expiresAt: '2999-01-01T00:00:00.000Z' })
+        .mockResolvedValueOnce({ success: true, publicKey: NEW_PUBLIC, message: 'ok' });
+
+      await oxy.rotateKey({ proof: 'device' });
+
+      expect(sharedSpy).toHaveBeenCalledWith(NEW_PRIVATE);
+      expect(importSpy).toHaveBeenCalledWith(NEW_PRIVATE, { overwrite: true });
+      expect(order).toEqual(['shared', 'primary']);
+    });
+
+    it('leaves the shared slot alone on a device that has none', async () => {
+      jest.spyOn(RecoveryPhraseService, 'derivePendingIdentity').mockResolvedValue(pendingFixture);
+      jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue(OLD_PUBLIC);
+      jest.spyOn(SignatureService, 'sign').mockResolvedValue('sig-hex');
+      jest.spyOn(protocol, 'signMessage').mockResolvedValue('newkeyproof-hex');
+      jest.spyOn(KeyManager, 'hasSharedIdentity').mockResolvedValue(false);
+      const sharedSpy = jest.spyOn(KeyManager, 'importSharedIdentity');
+      jest.spyOn(KeyManager, 'importKeyPair').mockResolvedValue(NEW_PUBLIC);
+      makeRequestSpy
+        .mockResolvedValueOnce({ challenge: 'chal-1', expiresAt: '2999-01-01T00:00:00.000Z' })
+        .mockResolvedValueOnce({ success: true, publicKey: NEW_PUBLIC, message: 'ok' });
+
+      await oxy.rotateKey({ proof: 'device' });
+
+      expect(sharedSpy).not.toHaveBeenCalled();
+    });
+
     it('throws (no network) when the device holds no identity', async () => {
       jest.spyOn(RecoveryPhraseService, 'derivePendingIdentity').mockResolvedValue(pendingFixture);
       jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue(null);

package/src/mixins/__tests__/commonsSignIn.test.ts

@@ -878,6 +878,8 @@ describe('OxyServices — "Sign in with Oxy" handoff', () => {
         'iPad',
         'fp-1',
         undefined,
+        // Planting stays the default: only a caller that asks otherwise opts out.
+        { plantTokens: undefined },
       );
       expect(result).toEqual(sessionFixture);
     });
@@ -913,6 +915,7 @@ describe('OxyServices — "Sign in with Oxy" handoff', () => {
         undefined,
         undefined,
         { retry: false },
+        { plantTokens: undefined },
       );
       expect(result).toEqual(sessionFixture);
     });

package/src/mixins/__tests__/verifyChallenge.test.ts

@@ -127,4 +127,35 @@ describe('OxyServices.verifyChallenge token planting', () => {
     expect(oxy.hasValidToken()).toBe(true);
     expect(oxy.getAccessToken()).toBe('access_claim');
   });
+
+  /**
+   * `plantTokens: false` is for a caller that must decide AFTER the response
+   * whether the session is still wanted — the account dialog, whose user may
+   * have cancelled while the request was in flight. It still gets the bearer in
+   * the response; the client just is not switched to it.
+   */
+  it('leaves the client untouched with plantTokens: false, on both paths', async () => {
+    const oxy = makeOxy();
+
+    jest.spyOn(oxy, 'makeRequest').mockImplementation(async (_method, url) => {
+      const body = {
+        sessionId: 'sess_x',
+        deviceId: 'dev_x',
+        expiresAt: new Date(Date.now() + 60_000).toISOString(),
+        user: { id: 'user_x', username: 'x' },
+      };
+      if (url === '/auth/verify') return { ...body, accessToken: 'access_verify' } as never;
+      if (url === '/auth/session/claim') return { ...body, accessToken: 'access_claim' } as never;
+      throw new Error(`unexpected request to ${url}`);
+    });
+
+    const verified = await oxy.verifyChallenge('pubkey', 'challenge', 'sig', 1, undefined, undefined, undefined, {
+      plantTokens: false,
+    });
+    const claimed = await oxy.claimSessionByToken('session-token-abc', { plantTokens: false });
+
+    expect(verified.accessToken).toBe('access_verify');
+    expect(claimed.accessToken).toBe('access_claim');
+    expect(oxy.hasValidToken()).toBe(false);
+  });
 });

package/src/models/interfaces.ts

@@ -117,7 +117,22 @@ export interface User {
   description?: string;
   phone?: string;
   address?: string;
+  /** Legacy free-text birthday, kept for backward compatibility. Prefer `dateOfBirth`. */
   birthday?: string;
+  /**
+   * The structured date of birth, `YYYY-MM-DD`. The new source of truth going
+   * forward — `birthday` above is unparsed free text with no guaranteed
+   * shape. Present only on the account's OWN profile (never on another
+   * account's public profile), same visibility as `phone`/`address`/`birthday`.
+   */
+  dateOfBirth?: string | null;
+  /**
+   * Derived, non-PII signal: whether the account holder is at least 18.
+   * `undefined` when `dateOfBirth` is unset ("unknown"), distinct from
+   * `false` ("known, not yet 18"). Never stored — computed fresh by the API
+   * on every read of the owner's own profile.
+   */
+  isAdult?: boolean;
   website?: string;
   createdAt?: string;
   updatedAt?: string;

package/src/session/__tests__/accountDialogController.test.ts

@@ -137,6 +137,9 @@ interface OxyMock {
   denyCommonsSignIn: jest.Mock;
   claimSessionByToken: jest.Mock;
   signInWithSharedIdentity: jest.Mock;
+  /** Plant / clear the bearer — both fire `onTokensChanged`, like `OxyServices`. */
+  setTokens: jest.Mock;
+  clearTokens: jest.Mock;
   /**
    * Test helper: set the current access token and fire every registered
    * `onTokensChanged` listener (mirrors `OxyServices.setTokens`/`clearTokens`).
@@ -149,6 +152,12 @@ function makeOxy(): OxyMock {
   const tokenListeners = new Set<(token: string | null) => void>();
   // Authenticated by default (mirrors a warm start with a planted bearer).
   let currentToken: string | null = 'access-token';
+  const emitTokenChange = (token: string | null) => {
+    currentToken = token;
+    for (const listener of tokenListeners) {
+      listener(token);
+    }
+  };
   return {
     getAccessToken: jest.fn(() => currentToken),
     getBaseURL: jest.fn(() => 'http://test.invalid'),
@@ -168,12 +177,9 @@ function makeOxy(): OxyMock {
     denyCommonsSignIn: jest.fn().mockResolvedValue({ success: true }),
     claimSessionByToken: jest.fn(),
     signInWithSharedIdentity: jest.fn().mockResolvedValue(null),
-    emitTokenChange: (token: string | null) => {
-      currentToken = token;
-      for (const listener of tokenListeners) {
-        listener(token);
-      }
-    },
+    setTokens: jest.fn((token: string) => emitTokenChange(token)),
+    clearTokens: jest.fn(() => emitTokenChange(null)),
+    emitTokenChange,
   };
 }
 
@@ -494,6 +500,7 @@ describe('AccountDialogController — sign in with Oxy', () => {
     const snap = controller.getSnapshot();
     expect(snap.signIn.phase).toBe('error');
     expect(snap.signIn.error).toMatch(/clientId/);
+    expect(snap.signIn.failure).toBe('not-configured');
   });
 
   it('polls, claims, and commits when the QR flow is authorized', async () => {
@@ -526,7 +533,7 @@ describe('AccountDialogController — sign in with Oxy', () => {
       expect(oxy.pollCommonsSignIn).toHaveBeenCalledTimes(1);
 
       await jest.advanceTimersByTimeAsync(1000); // second poll → authorized → claim
-      expect(oxy.claimSessionByToken).toHaveBeenCalledWith('secret-tok');
+      expect(oxy.claimSessionByToken).toHaveBeenCalledWith('secret-tok', { plantTokens: false });
       expect(commitSession).toHaveBeenCalledWith(
         expect.objectContaining({
           sessionId: 'sess-1',
@@ -559,6 +566,7 @@ describe('AccountDialogController — sign in with Oxy', () => {
 
       expect(controller.getSnapshot().signIn.phase).toBe('error');
       expect(controller.getSnapshot().signIn.error).toMatch(/denied/i);
+      expect(controller.getSnapshot().signIn.failure).toBe('denied');
 
       // No further polls after the terminal error.
       await jest.advanceTimersByTimeAsync(5000);
@@ -618,7 +626,7 @@ describe('AccountDialogController — startPasskeyHubSignIn (b2 passkey hub popu
   it('opens the popup synchronously, then navigates it to the hub URL with the authorizeCode once the session exists', async () => {
     const popup = fakePopup();
     const openPopup = jest.fn(() => popup);
-    const { controller, oxy } = makeHarness({ openPopup, hubBaseUrl: 'https://auth.oxy.so' });
+    const { controller, oxy } = makeHarness({ openPopup, hubBaseUrl: 'https://id.oxy.so' });
     oxy.startCommonsSignIn.mockResolvedValue({
       sessionToken: 'secret-tok',
       authorizeCode: 'AUTH-CODE',
@@ -630,7 +638,7 @@ describe('AccountDialogController — startPasskeyHubSignIn (b2 passkey hub popu
     await controller.startPasskeyHubSignIn();
 
     expect(openPopup).toHaveBeenCalledTimes(1);
-    expect(popup.location.href).toBe('https://auth.oxy.so/hub-passkey?code=AUTH-CODE');
+    expect(popup.location.href).toBe('https://id.oxy.so/continue?code=AUTH-CODE');
     // Same underlying device-flow session showQr would create — the QR view
     // still renders as a fallback/alternative alongside the popup.
     const snap = controller.getSnapshot();
@@ -698,6 +706,8 @@ describe('AccountDialogController — startPasskeyHubSignIn (b2 passkey hub popu
       const snap = controller.getSnapshot();
       expect(snap.signIn.phase).toBe('error');
       expect(snap.signIn.error).toMatch(/cancelled/i);
+      // A VOLUNTARY exit — the surface must be able to tell it from a failure.
+      expect(snap.signIn.failure).toBe('cancelled');
     } finally {
       jest.useRealTimers();
     }
@@ -891,7 +901,7 @@ describe('AccountDialogController — /auth-session socket (instant QR wake)', (
     await flush();
 
     expect(oxy.pollCommonsSignIn).toHaveBeenCalledWith('secret-tok');
-    expect(oxy.claimSessionByToken).toHaveBeenCalledWith('secret-tok');
+    expect(oxy.claimSessionByToken).toHaveBeenCalledWith('secret-tok', { plantTokens: false });
     expect(commitSession).toHaveBeenCalled();
     expect(controller.getSnapshot().view).toBe('accounts');
     expect(sock.disconnected).toBe(true); // torn down on completion
@@ -1307,11 +1317,13 @@ describe('AccountDialogController — automatic delivery selection (#691 phase 5
       'qrPayload',
       'expiresAt',
       'error',
+      'failure',
       'route',
       'routeFailed',
       'pushSentAt',
       'openedAt',
       'progress',
+      'attempt',
     ]);
     // Only the PUBLIC handles are exposed.
     expect(snap.signIn.authorizeCode).toBe('AUTH-CODE');
@@ -1560,11 +1572,13 @@ describe('AccountDialogController — cancellation converges (#691 phase 5)', ()
         qrPayload: null,
         expiresAt: null,
         error: null,
+        failure: null,
         route: null,
         routeFailed: false,
         pushSentAt: null,
         openedAt: null,
         progress: 'idle',
+        attempt: expect.any(Number),
       });
       await jest.advanceTimersByTimeAsync(10_000);
       expect(oxy.pollCommonsSignIn).not.toHaveBeenCalled();
@@ -1959,6 +1973,389 @@ describe('AccountDialogController — the directory (ADR 0002)', () => {
   });
 });
 
+/** A promise whose settlement the test controls — a slow network, on demand. */
+function deferred<T>(): {
+  promise: Promise<T>;
+  resolve: (value: T) => void;
+  reject: (error: unknown) => void;
+} {
+  let resolve: (value: T) => void = () => undefined;
+  let reject: (error: unknown) => void = () => undefined;
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+}
+
+const CLAIMED_SESSION = {
+  accessToken: 'access-claimed',
+  sessionId: 'sess-claimed',
+  deviceId: 'device-1',
+  expiresAt: '2030-01-01T00:00:00Z',
+  user: user('b1'),
+};
+
+describe('AccountDialogController — an abandoned attempt stays abandoned', () => {
+  it('withdraws a request that is created only after the user closed the dialog, and wires nothing up', async () => {
+    jest.useFakeTimers();
+    try {
+      const { controller, oxy } = makeHarness();
+      const created = deferred<typeof DELIVERY_HANDLE & { expiresAt: number }>();
+      oxy.startCommonsSignIn.mockReturnValue(created.promise);
+
+      const running = controller.showQr();
+      expect(controller.getSnapshot().signIn.phase).toBe('starting');
+      // Closed on a slow connection: there is no authorize code to withdraw yet.
+      controller.cancelSignIn();
+      expect(oxy.denyCommonsSignIn).not.toHaveBeenCalled();
+
+      created.resolve({ ...DELIVERY_HANDLE, expiresAt: Date.now() + 600_000 });
+      await running;
+
+      // The late request is withdrawn the moment it exists, and nothing revives:
+      // no waiting surface, no delivery, no poll.
+      expect(oxy.denyCommonsSignIn).toHaveBeenCalledWith('AUTH-CODE');
+      expect(controller.getSnapshot().signIn.phase).toBe('idle');
+      expect(controller.getSnapshot().signIn.authorizeCode).toBeNull();
+      expect(oxy.deliverCommonsSignIn).not.toHaveBeenCalled();
+      await jest.advanceTimersByTimeAsync(10_000);
+      expect(oxy.pollCommonsSignIn).not.toHaveBeenCalled();
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+
+  it('lets a newer attempt win over a slower earlier one', async () => {
+    const { controller, oxy } = makeHarness();
+    const first = deferred<unknown>();
+    oxy.startCommonsSignIn
+      .mockReturnValueOnce(first.promise)
+      .mockResolvedValueOnce({
+        sessionToken: 'tok-2',
+        authorizeCode: 'CODE-2',
+        qrPayload: 'oxycommons://approve?code=CODE-2',
+        expiresAt: Date.now() + 600_000,
+        status: 'pending',
+      });
+
+    const slow = controller.showQr();
+    await controller.showQr();
+    first.resolve({
+      sessionToken: 'tok-1',
+      authorizeCode: 'CODE-1',
+      qrPayload: 'oxycommons://approve?code=CODE-1',
+      expiresAt: Date.now() + 600_000,
+      status: 'pending',
+    });
+    await slow;
+
+    expect(controller.getSnapshot().signIn.authorizeCode).toBe('CODE-2');
+    expect(oxy.denyCommonsSignIn).toHaveBeenCalledWith('CODE-1');
+    expect(oxy.denyCommonsSignIn).not.toHaveBeenCalledWith('CODE-2');
+    controller.cancelSignIn();
+  });
+
+  it('never installs a shared-identity session that was minted after the user cancelled', async () => {
+    const { controller, oxy, commitSession, onSignedIn } = makeHarness();
+    const minted = deferred<SessionLoginResponse>();
+    oxy.signInWithSharedIdentity.mockReturnValue(minted.promise);
+
+    const running = controller.signInWithOxy();
+    // Minted without planting: the controller decides whether to install it.
+    expect(oxy.signInWithSharedIdentity).toHaveBeenCalledWith({ plantTokens: false });
+    controller.cancelSignIn();
+    minted.resolve({
+      sessionId: 'sess-shared',
+      deviceId: 'device-1',
+      expiresAt: '2030-01-01T00:00:00Z',
+      accessToken: 'access-shared',
+      user: { id: 'a1', username: 'user_a1' },
+    });
+    await running;
+
+    expect(oxy.setTokens).not.toHaveBeenCalled();
+    expect(commitSession).not.toHaveBeenCalled();
+    expect(onSignedIn).not.toHaveBeenCalled();
+    // …and the abandoned attempt does not fall through to a QR request either.
+    expect(oxy.startCommonsSignIn).not.toHaveBeenCalled();
+    expect(controller.getSnapshot().signIn.phase).toBe('idle');
+  });
+
+  it('never installs a session whose claim returned after the user cancelled', async () => {
+    jest.useFakeTimers();
+    try {
+      const { controller, oxy, commitSession, onSignedIn } = makeHarness();
+      oxy.startCommonsSignIn.mockResolvedValue({ ...DELIVERY_HANDLE, expiresAt: Date.now() + 600_000 });
+      oxy.pollCommonsSignIn.mockResolvedValue({ authorized: true, sessionId: 'sess-claimed', status: 'authorized' });
+      const claim = deferred<typeof CLAIMED_SESSION>();
+      oxy.claimSessionByToken.mockReturnValue(claim.promise);
+
+      await controller.showQr();
+      await jest.advanceTimersByTimeAsync(1000); // poll → authorized → claim in flight
+      expect(controller.getSnapshot().signIn.phase).toBe('authorized');
+
+      controller.cancelSignIn();
+      claim.resolve(CLAIMED_SESSION);
+      await jest.advanceTimersByTimeAsync(0);
+
+      expect(oxy.setTokens).not.toHaveBeenCalled();
+      expect(commitSession).not.toHaveBeenCalled();
+      expect(onSignedIn).not.toHaveBeenCalled();
+      expect(controller.getSnapshot().signIn.phase).toBe('idle');
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+
+  it('plants the claimed bearer at the install point, immediately before the commit', async () => {
+    jest.useFakeTimers();
+    try {
+      const { controller, oxy, commitSession } = makeHarness();
+      oxy.startCommonsSignIn.mockResolvedValue({ ...DELIVERY_HANDLE, expiresAt: Date.now() + 600_000 });
+      oxy.pollCommonsSignIn.mockResolvedValue({ authorized: true, sessionId: 'sess-claimed', status: 'authorized' });
+      oxy.claimSessionByToken.mockResolvedValue(CLAIMED_SESSION);
+
+      await controller.showQr();
+      await jest.advanceTimersByTimeAsync(1000);
+
+      expect(oxy.setTokens).toHaveBeenCalledWith('access-claimed');
+      expect(oxy.setTokens.mock.invocationCallOrder[0]).toBeLessThan(
+        commitSession.mock.invocationCallOrder[0],
+      );
+      expect(controller.getSnapshot().signIn.phase).toBe('completed');
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+
+  it('restores the previous bearer when the commit fails, and fails the attempt', async () => {
+    jest.useFakeTimers();
+    try {
+      const { controller, oxy, commitSession, onSignedIn } = makeHarness();
+      commitSession.mockRejectedValue(new Error('persist failed'));
+      oxy.startCommonsSignIn.mockResolvedValue({ ...DELIVERY_HANDLE, expiresAt: Date.now() + 600_000 });
+      oxy.pollCommonsSignIn.mockResolvedValue({ authorized: true, sessionId: 'sess-claimed', status: 'authorized' });
+      oxy.claimSessionByToken.mockResolvedValue(CLAIMED_SESSION);
+
+      await controller.showQr();
+      await jest.advanceTimersByTimeAsync(1000);
+
+      // Requests must not keep going out as an account the device never took.
+      expect(oxy.getAccessToken()).toBe('access-token');
+      expect(onSignedIn).not.toHaveBeenCalled();
+      expect(controller.getSnapshot().signIn.phase).toBe('error');
+      expect(controller.getSnapshot().signIn.failure).toBe('unknown');
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+
+  it('falls through to the QR handoff when a shared-identity session cannot be committed', async () => {
+    const { controller, oxy, commitSession } = makeHarness();
+    const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
+    commitSession.mockRejectedValue(new Error('persist failed'));
+    oxy.signInWithSharedIdentity.mockResolvedValue({
+      sessionId: 'sess-shared',
+      deviceId: 'device-1',
+      expiresAt: '2030-01-01T00:00:00Z',
+      accessToken: 'access-shared',
+      user: { id: 'a1', username: 'user_a1' },
+    });
+    oxy.startCommonsSignIn.mockResolvedValue({ ...DELIVERY_HANDLE, expiresAt: Date.now() + 600_000 });
+
+    await controller.signInWithOxy();
+
+    expect(oxy.getAccessToken()).toBe('access-token');
+    expect(controller.getSnapshot().signIn.phase).toBe('waiting');
+    controller.cancelSignIn();
+    warnSpy.mockRestore();
+  });
+
+  it('classifies an unreachable server as a network failure', async () => {
+    const { controller, oxy } = makeHarness();
+    oxy.startCommonsSignIn.mockRejectedValue(
+      Object.assign(new Error('Network error - failed to connect to server'), { code: 'NETWORK_ERROR', status: 0 }),
+    );
+
+    await controller.showQr();
+
+    expect(controller.getSnapshot().signIn.phase).toBe('error');
+    expect(controller.getSnapshot().signIn.failure).toBe('network');
+  });
+
+  it('moves the attempt identity on every new attempt, and keeps it on the failure it belongs to', async () => {
+    const { controller, oxy } = makeHarness({ clientId: null });
+    oxy.startCommonsSignIn.mockResolvedValue({ ...DELIVERY_HANDLE, expiresAt: Date.now() + 600_000 });
+
+    await controller.showQr();
+    const firstFailure = controller.getSnapshot().signIn.attempt;
+    await controller.showQr();
+
+    // Same message, different attempt — a surface can tell a repeat of the
+    // failure it already reported from a new one.
+    expect(controller.getSnapshot().signIn.failure).toBe('not-configured');
+    expect(controller.getSnapshot().signIn.attempt).not.toBe(firstFailure);
+  });
+});
+
+describe('AccountDialogController — "Try again" repeats the user\'s choice', () => {
+  it('reopens the passkey hub after a failed hub attempt', async () => {
+    // A real window stays closed once closed, so every open is a fresh one.
+    let popup = fakePopup();
+    const openPopup = jest.fn(() => {
+      popup = fakePopup();
+      return popup;
+    });
+    const { controller, oxy } = makeHarness({ openPopup });
+    oxy.startCommonsSignIn.mockRejectedValue(new Error('boom'));
+
+    await controller.startPasskeyHubSignIn();
+    expect(controller.getSnapshot().signIn.phase).toBe('error');
+
+    oxy.startCommonsSignIn.mockResolvedValue({ ...DELIVERY_HANDLE, expiresAt: Date.now() + 600_000 });
+    const retry = controller.retrySignIn();
+    // Opened synchronously, inside the press — before any await.
+    expect(openPopup).toHaveBeenCalledTimes(2);
+    await retry;
+
+    expect(oxy.deliverCommonsSignIn).not.toHaveBeenCalled();
+    expect(popup.location.href).toContain('/continue?code=AUTH-CODE');
+    controller.cancelSignIn();
+  });
+
+  it('retries "Sign in with Oxy" (never the hub) after a failed Oxy attempt', async () => {
+    const openPopup = jest.fn(() => fakePopup());
+    const { controller, oxy } = makeHarness({ openPopup });
+    oxy.startCommonsSignIn.mockRejectedValueOnce(new Error('boom'));
+
+    await controller.signInWithOxy();
+    expect(controller.getSnapshot().signIn.phase).toBe('error');
+
+    oxy.startCommonsSignIn.mockResolvedValue({ ...DELIVERY_HANDLE, expiresAt: Date.now() + 600_000 });
+    await controller.retrySignIn();
+
+    expect(openPopup).not.toHaveBeenCalled();
+    expect(oxy.signInWithSharedIdentity).toHaveBeenCalledTimes(2);
+    expect(controller.getSnapshot().signIn.phase).toBe('waiting');
+    controller.cancelSignIn();
+  });
+
+  it('closes a hub popup that was opened for an attempt the user cancelled while its request was created', async () => {
+    const popup = fakePopup();
+    const { controller, oxy } = makeHarness({ openPopup: () => popup });
+    const created = deferred<unknown>();
+    oxy.startCommonsSignIn.mockReturnValue(created.promise);
+
+    const running = controller.startPasskeyHubSignIn();
+    controller.cancelSignIn();
+    // Closed at once, not left blank until the slow request returns.
+    expect(popup.close).toHaveBeenCalled();
+
+    created.resolve({ ...DELIVERY_HANDLE, expiresAt: Date.now() + 600_000 });
+    await running;
+    expect(popup.location.href).toBe('');
+  });
+});
+
+describe('AccountDialogController — device mutations report their own outcome', () => {
+  function directoryClient() {
+    const sc = new TestSessionClient(host().host);
+    const controller = createAccountDialogController({
+      oxyServices: makeOxy() as unknown as OxyServices,
+      sessionClient: sc,
+      clientId: 'oxy_dk_test',
+      commitSession: jest.fn().mockResolvedValue(undefined),
+    });
+    return { controller, sc };
+  }
+
+  it('reports a switch that happened as a switch, even when the re-read after it fails', async () => {
+    const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
+    const { controller, sc } = directoryClient();
+    jest.spyOn(sc, 'activateContext').mockResolvedValue(undefined);
+    jest.spyOn(sc, 'refreshDirectory').mockRejectedValue(new Error('directory boom'));
+
+    // The subject DID change. Calling that a failed switch would invite the user
+    // to repeat it — and skip the cache reset a switch requires.
+    expect(await controller.activateContext('ctx-b')).toBe(true);
+    // The re-read's failure is still reported, as the directory's.
+    expect(controller.getSnapshot().error).toBe('directory boom');
+    expect(controller.getSnapshot().activatingContextId).toBeNull();
+    warnSpy.mockRestore();
+  });
+
+  it('never lets an older refresh failure overwrite a newer successful read', async () => {
+    const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
+    const { controller, sc } = directoryClient();
+    const older = deferred<void>();
+    jest
+      .spyOn(sc, 'refreshDirectory')
+      .mockReturnValueOnce(older.promise)
+      .mockResolvedValueOnce(undefined);
+
+    const first = controller.refresh();
+    expect(await controller.refresh()).toBe(true);
+    older.reject(new Error('stale boom'));
+    expect(await first).toBe(false);
+
+    expect(controller.getSnapshot().error).toBeNull();
+    expect(controller.getSnapshot().loading).toBe(false);
+    warnSpy.mockRestore();
+  });
+
+  it('refuses a removal while a switch is in flight, and a switch while a removal is', async () => {
+    const { controller, sc } = directoryClient();
+    const switching = deferred<void>();
+    jest.spyOn(sc, 'activateContext').mockReturnValue(switching.promise);
+    const removeContext = jest.spyOn(sc, 'signOutContext').mockResolvedValue(undefined);
+    const removePrincipal = jest.spyOn(sc, 'signOutPrincipal').mockResolvedValue(undefined);
+    jest.spyOn(sc, 'refreshDirectory').mockResolvedValue(undefined);
+
+    const activation = controller.activateContext('ctx-b');
+    expect(controller.isDeviceMutationInFlight()).toBe(true);
+    // Refused, not queued: nothing destructive may fire later, after the switch.
+    expect(await controller.signOutContext('ctx-a')).toBe(false);
+    expect(await controller.signOutPrincipal('p-a')).toBe(false);
+    expect(removeContext).not.toHaveBeenCalled();
+    expect(removePrincipal).not.toHaveBeenCalled();
+
+    switching.resolve();
+    expect(await activation).toBe(true);
+    expect(controller.isDeviceMutationInFlight()).toBe(false);
+
+    const removing = deferred<void>();
+    removeContext.mockReturnValue(removing.promise);
+    const removal = controller.signOutContext('ctx-a');
+    expect(await controller.activateContext('ctx-c')).toBe(false);
+    removing.resolve();
+    expect(await removal).toBe(true);
+    await flush();
+    expect(removeContext).toHaveBeenCalledTimes(1);
+  });
+
+  it('runs a host operation under the same gate, and releases it when the operation rejects', async () => {
+    const { controller, sc } = directoryClient();
+    const signingOut = deferred<string>();
+    const activate = jest.spyOn(sc, 'activateContext').mockResolvedValue(undefined);
+    jest.spyOn(sc, 'refreshDirectory').mockResolvedValue(undefined);
+
+    const exclusive = controller.runDeviceMutation(() => signingOut.promise);
+    expect(await controller.activateContext('ctx-b')).toBe(false);
+    expect(await controller.runDeviceMutation(async () => 'second')).toEqual({ ran: false });
+    expect(activate).not.toHaveBeenCalled();
+    signingOut.resolve('done');
+    expect(await exclusive).toEqual({ ran: true, value: 'done' });
+
+    await expect(
+      controller.runDeviceMutation(async () => {
+        throw new Error('boom');
+      }),
+    ).rejects.toThrow('boom');
+    expect(controller.isDeviceMutationInFlight()).toBe(false);
+  });
+});
+
 it('createAccountDialogController returns an AccountDialogController instance', () => {
   const { controller } = makeHarness();
   expect(controller).toBeInstanceOf(AccountDialogController);