@oxy.so/core 1.8.0 → 1.9.0

package/dist/types/crypto/polyfill.d.ts

@@ -13,8 +13,23 @@
  *   2. Node — backed by the built-in `node:crypto` module (`webcrypto`, else
  *      `randomFillSync`). This is what a Node runtime WITHOUT a global WebCrypto
  *      (Node 18 script entrypoints, some embedded hosts) falls back to.
- *   3. React Native — `expo-crypto.getRandomBytes` (statically imported via the
- *      per-platform `platform/crypto` module in `@oxy.so/protocol`).
+ *   3. React Native — `expo-crypto.getRandomBytes`, through the dependency-free
+ *      `@oxy.so/protocol/random` entry.
+ *
+ * # Evaluation order — this module must import NOTHING that can capture the global
+ *
+ * `@noble/hashes` 1.x reads `globalThis.crypto` exactly once, when its
+ * `crypto.js` is evaluated, and `randomBytes` uses that captured binding for
+ * the lifetime of the app. ES imports are evaluated before the importing
+ * module's body, so every module this file imports runs BEFORE the shim below
+ * is installed. This file used to import `@oxy.so/protocol`'s root entry,
+ * which reaches `@noble/curves` → `@noble/hashes` through the envelope signer:
+ * on Hermes (no `globalThis.crypto` at startup) noble captured `undefined`
+ * before the shim existed, and every identity creation on Android failed with
+ * `crypto.getRandomValues must be defined`. Its imports are therefore limited
+ * to `buffer` and `@oxy.so/protocol/random`, both free of crypto libraries,
+ * and `index.ts` imports this file first. `__tests__/polyfillOrder.test.ts`
+ * guards both halves.
  *
  * Historically step (2) delegated to `@oxy.so/protocol`'s RN-only
  * `getRandomBytesRN`, which THROWS on Node — so any Node host lacking a global

package/dist/types/models/interfaces.d.ts

@@ -693,7 +693,12 @@ export interface AssetUploadProgress {
 export interface DeviceLinkedSession {
     sessionId: string;
     deviceId: string;
-    deviceName: string;
+    /**
+     * Not sent by `GET /session/device/sessions/:sessionId` today — every row
+     * shares one device, and the account a row belongs to is `user`. Optional so
+     * a caller cannot render it unchecked ("undefined (This device)").
+     */
+    deviceName?: string;
     isActive: boolean;
     lastActive: string;
     expiresAt: string;

package/dist/types/session/accountDialogController.d.ts

@@ -220,8 +220,19 @@ export interface SignInFlowState {
 }
 /** Immutable snapshot consumed by `useSyncExternalStore`. */
 export interface AccountDialogSnapshot {
-    /** The current view. */
+    /**
+     * The current view. Never `'accounts'` without a session: the account menu
+     * describes a signed-in account, so with no bearer the controller shows the
+     * sign-in entry (`'signin'`) in its place.
+     */
     view: AccountDialogView;
+    /**
+     * Where {@link AccountDialogController.back} leads from {@link view}, or
+     * `null` when `view` is the dialog's first view (a back there closes the
+     * dialog instead). Hosts show their back affordance from this, not from a
+     * table of their own.
+     */
+    backView: AccountDialogView | null;
     /**
      * The server-authoritative device directory — principals and the contexts
      * each may act as (ADR 0002) — or `null` before the first read.
@@ -449,8 +460,32 @@ export declare class AccountDialogController {
      * (no retry storm).
      */
     private reconcileAuth;
-    /** Set the dialog view directly. */
-    setView(view: AccountDialogView): void;
+    /**
+     * Set the dialog view directly.
+     *
+     * `'accounts'` is only honoured with a session. Signed out it lands on the
+     * sign-in entry instead — the menu it would open holds "Switch account",
+     * storage and "Sign out" for an account that does not exist.
+     */
+    setView(requested: AccountDialogView): void;
+    /**
+     * Go back one step: `signup` and `qr` return to the sign-in entry, and the
+     * entry returns to the account menu when somebody is signed in.
+     *
+     * Returns `false` — changing nothing — when the current view is the dialog's
+     * first one, so the host closes the dialog instead. Leaving an active
+     * request withdraws it; otherwise its authorize code stays approvable until
+     * it expires.
+     */
+    back(): boolean;
+    /** `'accounts'` needs a session; without one the sign-in entry stands in for it. */
+    private resolveView;
+    /**
+     * Whether an account is signed in here — the precondition of the account
+     * menu. The bearer, not the directory: the directory is bearer-read, and the
+     * menu's content (hero, storage, sign-out) is all about the bearer's account.
+     */
+    private hasSession;
     /** Switch to the "add account" view (the sign-in entry chooser). */
     add(): void;
     /** Switch to the "create account" view (passkey / Commons signup entry). */
@@ -795,6 +830,18 @@ export declare class AccountDialogController {
     /** Recompute the snapshot and notify subscribers. */
     private emit;
 }
+/**
+ * The view one step back from `view`, or `null` when `view` is the dialog's
+ * first view.
+ *
+ * The sign-in entry is `'add'` ("add another account") when somebody is signed
+ * in and `'signin'` when nobody is; `signup` and `qr` are reached FROM that
+ * entry, so they return to it. The entry itself returns to the account menu —
+ * which exists only with a session. This used to be a host-side
+ * "back = accounts" that assumed a signed-in origin, so a signed-out Back from
+ * "Create your account" opened a menu holding "Sign out" for nobody.
+ */
+export declare function backViewOf(view: AccountDialogView, hasSession: boolean): AccountDialogView | null;
 /** Factory mirroring `createSessionClient`, for ergonomic wiring by consumers. */
 export declare function createAccountDialogController(options: AccountDialogControllerOptions): AccountDialogController;
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -119,7 +119,7 @@
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
     "@oxy.so/contracts": "^1.4.0",
-    "@oxy.so/protocol": "^1.1.0",
+    "@oxy.so/protocol": "^1.1.1",
     "@scure/bip39": "^1.6.0",
     "buffer": "^6.0.3",
     "express-rate-limit": "^8.6.0",

package/src/crypto/__tests__/polyfill.test.ts

@@ -13,7 +13,7 @@
 const mockGetRandomBytesRN = jest.fn<Uint8Array, [number]>();
 const mockState = { isNodeJS: true };
 
-jest.mock('@oxy.so/protocol', () => ({
+jest.mock('@oxy.so/protocol/random', () => ({
   isNodeJS: () => mockState.isNodeJS,
   getRandomBytesRN: (byteCount: number) => mockGetRandomBytesRN(byteCount),
 }));

package/src/crypto/__tests__/polyfillOrder.test.ts

@@ -0,0 +1,114 @@
+/**
+ * The crypto polyfill must be installed before ANY `@noble/*` module evaluates.
+ *
+ * `@noble/hashes` 1.x's `crypto.js` captures `globalThis.crypto` once, at module
+ * evaluation, and `randomBytes` uses that captured binding forever. Hermes has
+ * no `globalThis.crypto` at startup, so if noble is evaluated before
+ * `./polyfill` installs the shim, every random draw throws
+ * `crypto.getRandomValues must be defined` — which is exactly how identity
+ * creation broke on Android: the polyfill imported `@oxy.so/protocol`'s root
+ * entry, whose envelope signer reaches `@noble/curves` → `@noble/hashes`, and
+ * imports are evaluated before the polyfill body.
+ *
+ * Node's resolver picks noble's `cryptoNode.js` (the `node` export condition),
+ * which never captures the global, so a plain Node run cannot see the bug. The
+ * suites below substitute the REAL `crypto.js` that Metro resolves for React
+ * Native, remove `globalThis.crypto`, and load core in a fresh module registry.
+ */
+
+import { readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+
+type RandomBytes = (length?: number) => Uint8Array;
+
+const ORIGINAL_CRYPTO_DESCRIPTOR = Object.getOwnPropertyDescriptor(globalThis, 'crypto');
+
+/** noble's browser / React Native `crypto.js`: the variant that captures the global. */
+const NOBLE_CAPTURING_CRYPTO = join(dirname(require.resolve('@noble/hashes/utils')), 'crypto.js');
+
+/** Remove `globalThis.crypto` the way a Hermes host starts: no property at all. */
+function removeHostCrypto(): void {
+  if (!Reflect.deleteProperty(globalThis, 'crypto') || 'crypto' in globalThis) {
+    Object.defineProperty(globalThis, 'crypto', {
+      value: undefined,
+      configurable: true,
+      writable: true,
+    });
+  }
+}
+
+function restoreHostCrypto(): void {
+  Reflect.deleteProperty(globalThis, 'crypto');
+  if (ORIGINAL_CRYPTO_DESCRIPTOR) {
+    Object.defineProperty(globalThis, 'crypto', ORIGINAL_CRYPTO_DESCRIPTOR);
+  }
+}
+
+/**
+ * Run `body` in a fresh module registry that resolves `@noble/hashes/crypto` as
+ * a React Native bundle does, with no host `globalThis.crypto`.
+ */
+function withReactNativeNobleAndNoHostCrypto(body: () => void): void {
+  removeHostCrypto();
+  try {
+    jest.isolateModules(() => {
+      jest.doMock('@noble/hashes/crypto', () => jest.requireActual(NOBLE_CAPTURING_CRYPTO));
+      body();
+    });
+  } finally {
+    restoreHostCrypto();
+  }
+}
+
+describe('crypto polyfill evaluation order', () => {
+  it('reproduces the capture: noble evaluated before the polyfill has no randomness', () => {
+    // Guards the harness itself — if this ever stops throwing, the substitution
+    // no longer models the capturing variant and the suites below prove nothing.
+    withReactNativeNobleAndNoHostCrypto(() => {
+      const { randomBytes } = require('@noble/hashes/utils') as { randomBytes: RandomBytes };
+      require('../polyfill');
+      expect(() => randomBytes(32)).toThrow('crypto.getRandomValues must be defined');
+    });
+  });
+
+  it('importing @oxy.so/core installs the shim before noble captures the global', () => {
+    withReactNativeNobleAndNoHostCrypto(() => {
+      require('../../index');
+      const { randomBytes } = require('@noble/hashes/utils') as { randomBytes: RandomBytes };
+
+      const bytes = randomBytes(32);
+      expect(bytes).toHaveLength(32);
+      expect(bytes.some((byte) => byte !== 0)).toBe(true);
+    });
+  });
+
+  it('generates an identity (key pair + recovery mnemonic) through core', () => {
+    withReactNativeNobleAndNoHostCrypto(() => {
+      const core = require('../../index') as typeof import('../../index');
+      const { generateMnemonic } = require('@scure/bip39') as typeof import('@scure/bip39');
+      const { wordlist } = require('@scure/bip39/wordlists/english') as {
+        wordlist: string[];
+      };
+
+      // The two random draws `RecoveryPhraseService.generateIdentityWithRecovery`
+      // and `KeyManager.generateKeyPairSync` make — the ones Commons failed on.
+      expect(generateMnemonic(wordlist, 128).split(' ')).toHaveLength(12);
+      const keyPair = core.KeyManager.generateKeyPairSync();
+      expect(keyPair.privateKey).toMatch(/^[0-9a-f]{64}$/);
+    });
+  });
+
+  it('the polyfill imports nothing that can reach a crypto library', () => {
+    const source = readFileSync(resolve(__dirname, '..', 'polyfill.ts'), 'utf8');
+    const specifiers = [...source.matchAll(/^import\s+[^'"]*?['"]([^'"]+)['"]/gm)].map(
+      (match) => match[1],
+    );
+    expect(specifiers.sort()).toEqual(['@oxy.so/protocol/random', 'buffer']);
+  });
+
+  it('the core entry imports the polyfill before anything else', () => {
+    const source = readFileSync(resolve(__dirname, '..', '..', 'index.ts'), 'utf8');
+    const firstModuleReference = source.match(/^(?:import|export)\s[^;]*?['"]([^'"]+)['"]/m);
+    expect(firstModuleReference?.[1]).toBe('./crypto/polyfill');
+  });
+});

package/src/crypto/polyfill.ts

@@ -13,8 +13,23 @@
  *   2. Node — backed by the built-in `node:crypto` module (`webcrypto`, else
  *      `randomFillSync`). This is what a Node runtime WITHOUT a global WebCrypto
  *      (Node 18 script entrypoints, some embedded hosts) falls back to.
- *   3. React Native — `expo-crypto.getRandomBytes` (statically imported via the
- *      per-platform `platform/crypto` module in `@oxy.so/protocol`).
+ *   3. React Native — `expo-crypto.getRandomBytes`, through the dependency-free
+ *      `@oxy.so/protocol/random` entry.
+ *
+ * # Evaluation order — this module must import NOTHING that can capture the global
+ *
+ * `@noble/hashes` 1.x reads `globalThis.crypto` exactly once, when its
+ * `crypto.js` is evaluated, and `randomBytes` uses that captured binding for
+ * the lifetime of the app. ES imports are evaluated before the importing
+ * module's body, so every module this file imports runs BEFORE the shim below
+ * is installed. This file used to import `@oxy.so/protocol`'s root entry,
+ * which reaches `@noble/curves` → `@noble/hashes` through the envelope signer:
+ * on Hermes (no `globalThis.crypto` at startup) noble captured `undefined`
+ * before the shim existed, and every identity creation on Android failed with
+ * `crypto.getRandomValues must be defined`. Its imports are therefore limited
+ * to `buffer` and `@oxy.so/protocol/random`, both free of crypto libraries,
+ * and `index.ts` imports this file first. `__tests__/polyfillOrder.test.ts`
+ * guards both halves.
  *
  * Historically step (2) delegated to `@oxy.so/protocol`'s RN-only
  * `getRandomBytesRN`, which THROWS on Node — so any Node host lacking a global
@@ -23,7 +38,7 @@
  */
 
 import { Buffer } from 'buffer';
-import { getRandomBytesRN, isNodeJS } from '@oxy.so/protocol';
+import { getRandomBytesRN, isNodeJS } from '@oxy.so/protocol/random';
 
 const getGlobalObject = (): typeof globalThis => {
   if (typeof globalThis !== 'undefined') return globalThis;
@@ -125,7 +140,7 @@ const cryptoPolyfill: CryptoLike = {
       return array;
     }
     // React Native (and any non-Node host without WebCrypto): synchronous
-    // expo-crypto via @oxy.so/protocol's RN `platform/crypto` variant.
+    // expo-crypto via @oxy.so/protocol's RN `platform/random` variant.
     const bytes = getRandomBytesRN(array.byteLength);
     const uint8View = new Uint8Array(array.buffer, array.byteOffset, array.byteLength);
     uint8View.set(bytes);

package/src/i18n/locales/en-US.json

@@ -1850,6 +1850,7 @@
       "switch": {
         "title": "Switch account",
         "count": "{{count}} accounts",
+        "countOne": "{{count}} account",
         "empty": "Accounts you own or share"
       }
     },
@@ -1970,7 +1971,8 @@
       "loading": "Loading sessions…",
       "empty": "No active sessions",
       "signOutAllOnThisDevice": "Sign out of all other devices",
-      "signOutAllSubtitle": "End {{count}} other device session(s)"
+      "signOutAllSubtitle": "End {{count}} other device session(s)",
+      "otherSession": "Another session"
     },
     "confirms": {
       "removeDeviceTitle": "Remove device",

package/src/i18n/locales/es-ES.json

@@ -1850,6 +1850,7 @@
       "switch": {
         "title": "Cambiar de cuenta",
         "count": "{{count}} cuentas",
+        "countOne": "{{count}} cuenta",
         "empty": "Cuentas que posees o compartes"
       }
     },
@@ -1970,7 +1971,8 @@
       "loading": "Cargando sesiones…",
       "empty": "No hay sesiones activas",
       "signOutAllOnThisDevice": "Cerrar sesión en los demás dispositivos",
-      "signOutAllSubtitle": "Finalizar {{count}} sesión(es) de otros dispositivos"
+      "signOutAllSubtitle": "Finalizar {{count}} sesión(es) de otros dispositivos",
+      "otherSession": "Otra sesión"
     },
     "confirms": {
       "removeDeviceTitle": "Eliminar dispositivo",

package/src/index.ts

@@ -17,7 +17,10 @@
  * If a symbol does not appear here, it is NOT part of the public API.
  */
 
-// Ensure crypto polyfills are loaded before anything else
+// Ensure crypto polyfills are loaded before anything else. This MUST stay the
+// first import: `@noble/hashes` captures `globalThis.crypto` when it is
+// evaluated, so the shim has to exist before any module below reaches it (see
+// the evaluation-order note in `./crypto/polyfill`).
 import './crypto/polyfill';
 
 // ---------------------------------------------------------------------------

package/src/models/interfaces.ts

@@ -801,7 +801,12 @@ export interface AssetUploadProgress {
 export interface DeviceLinkedSession {
   sessionId: string;
   deviceId: string;
-  deviceName: string;
+  /**
+   * Not sent by `GET /session/device/sessions/:sessionId` today — every row
+   * shares one device, and the account a row belongs to is `user`. Optional so
+   * a caller cannot render it unchecked ("undefined (This device)").
+   */
+  deviceName?: string;
   isActive: boolean;
   lastActive: string;
   expiresAt: string;

package/src/session/__tests__/accountDialogController.test.ts

@@ -241,6 +241,111 @@ function makeHarness(
 const directoryReads = (urls: string[]): number =>
   urls.filter((url) => url === '/session/device/directory').length;
 
+describe('AccountDialogController — back, and the menu needs a session', () => {
+  /** A harness with no bearer — nobody is signed in on this device. */
+  function signedOut(): Harness {
+    const harness = makeHarness();
+    harness.oxy.emitTokenChange(null);
+    return harness;
+  }
+
+  it('signed out, Back from "Create your account" returns to the sign-in entry, not the account menu', () => {
+    // The Android QA repro (OxyHQ/oxy#1375 item 1): Sign In → "New to Oxy?
+    // Create one" → ‹. The host's back used to be a hard-coded
+    // `setView('accounts')`, which opened "Switch account … Sign out" for nobody.
+    const { controller } = signedOut();
+    controller.setView('signin');
+    controller.startSignup();
+    expect(controller.getSnapshot().backView).toBe('signin');
+
+    expect(controller.back()).toBe(true);
+
+    expect(controller.getSnapshot().view).toBe('signin');
+  });
+
+  it('signed out, the sign-in entry is the first view: back reports nothing to go back to', () => {
+    const { controller } = signedOut();
+    controller.setView('signin');
+    const before = controller.getSnapshot();
+    expect(before.backView).toBeNull();
+
+    expect(controller.back()).toBe(false);
+
+    expect(controller.getSnapshot()).toBe(before);
+  });
+
+  it('signed out, the account menu is never the view — it resolves to the sign-in entry', async () => {
+    const { controller } = signedOut();
+    // A controller is constructed on `accounts`; started with no bearer, it
+    // shows the entry.
+    controller.start();
+    await flush();
+    expect(controller.getSnapshot().view).toBe('signin');
+
+    controller.setView('qr');
+    controller.setView('accounts');
+    expect(controller.getSnapshot().view).toBe('signin');
+
+    controller.add();
+    expect(controller.getSnapshot().backView).toBeNull();
+    expect(controller.back()).toBe(false);
+    expect(controller.getSnapshot().view).toBe('add');
+    controller.destroy();
+  });
+
+  it('signed out, Back from the QR request withdraws it and returns to the entry', async () => {
+    const { controller, oxy } = signedOut();
+    oxy.startCommonsSignIn.mockResolvedValue({
+      sessionToken: 'secret-tok',
+      authorizeCode: 'AUTH-CODE',
+      qrPayload: 'oxycommons://approve?v=1&code=AUTH-CODE',
+      expiresAt: Date.now() + 300_000,
+      status: 'pending',
+    });
+    controller.setView('signin');
+    await controller.showQr();
+    expect(controller.getSnapshot().view).toBe('qr');
+    expect(controller.getSnapshot().signIn.phase).toBe('waiting');
+
+    expect(controller.back()).toBe(true);
+
+    const snap = controller.getSnapshot();
+    expect(snap.view).toBe('signin');
+    expect(snap.signIn.phase).toBe('idle');
+    expect(oxy.denyCommonsSignIn).toHaveBeenCalledWith('AUTH-CODE');
+  });
+
+  it('signed in, back walks signup → add → accounts, and the menu is the first view', () => {
+    const { controller } = makeHarness();
+    controller.add();
+    controller.startSignup();
+    expect(controller.getSnapshot().backView).toBe('add');
+
+    expect(controller.back()).toBe(true);
+    expect(controller.getSnapshot().view).toBe('add');
+    expect(controller.getSnapshot().backView).toBe('accounts');
+
+    expect(controller.back()).toBe(true);
+    expect(controller.getSnapshot().view).toBe('accounts');
+    expect(controller.getSnapshot().backView).toBeNull();
+
+    expect(controller.back()).toBe(false);
+    expect(controller.getSnapshot().view).toBe('accounts');
+  });
+
+  it('signing out while the account menu is open leaves the menu for the sign-in entry', async () => {
+    const { controller, oxy } = makeHarness();
+    controller.start();
+    await flush();
+    expect(controller.getSnapshot().view).toBe('accounts');
+
+    oxy.emitTokenChange(null);
+
+    expect(controller.getSnapshot().view).toBe('signin');
+    controller.destroy();
+  });
+});
+
 describe('AccountDialogController — initial + views', () => {
   it('starts on the accounts view with an empty list and idle sign-in', () => {
     const { controller } = makeHarness();

package/src/session/__tests__/accountDialogShape.test.ts

@@ -64,6 +64,7 @@ const oxyServices = {
 const SNAPSHOT_KEYS = [
   'activatingContextId',
   'activeContext',
+  'backView',
   'commonsAvailability',
   'directory',
   'error',

package/src/session/accountDialogController.ts

@@ -297,8 +297,19 @@ function deriveSignInProgress(facts: SignInFlowFacts): SignInProgress {
 
 /** Immutable snapshot consumed by `useSyncExternalStore`. */
 export interface AccountDialogSnapshot {
-  /** The current view. */
+  /**
+   * The current view. Never `'accounts'` without a session: the account menu
+   * describes a signed-in account, so with no bearer the controller shows the
+   * sign-in entry (`'signin'`) in its place.
+   */
   view: AccountDialogView;
+  /**
+   * Where {@link AccountDialogController.back} leads from {@link view}, or
+   * `null` when `view` is the dialog's first view (a back there closes the
+   * dialog instead). Hosts show their back affordance from this, not from a
+   * table of their own.
+   */
+  backView: AccountDialogView | null;
   /**
    * The server-authoritative device directory — principals and the contexts
    * each may act as (ADR 0002) — or `null` before the first read.
@@ -695,9 +706,11 @@ export class AccountDialogController {
     }
     // Signed out. The directory is bearer-read and `SessionClient` drops the one
     // it holds when the device empties, so there is nothing to clear here — only
-    // the in-flight bookkeeping, which no longer describes anything.
+    // the in-flight bookkeeping, which no longer describes anything. The account
+    // menu described the account that just left, so it gives way to the entry.
     this.error = null;
     this.loading = false;
+    this.view = this.resolveView(this.view);
     this.emit();
   }
 
@@ -705,8 +718,15 @@ export class AccountDialogController {
   // View actions
   // =========================================================================
 
-  /** Set the dialog view directly. */
-  setView(view: AccountDialogView): void {
+  /**
+   * Set the dialog view directly.
+   *
+   * `'accounts'` is only honoured with a session. Signed out it lands on the
+   * sign-in entry instead — the menu it would open holds "Switch account",
+   * storage and "Sign out" for an account that does not exist.
+   */
+  setView(requested: AccountDialogView): void {
+    const view = this.resolveView(requested);
     if (this.view === view) return;
     this.view = view;
     // A `'completed'` flow owns no timers, socket, popup, or token — it is only
@@ -719,6 +739,39 @@ export class AccountDialogController {
     this.emit();
   }
 
+  /**
+   * Go back one step: `signup` and `qr` return to the sign-in entry, and the
+   * entry returns to the account menu when somebody is signed in.
+   *
+   * Returns `false` — changing nothing — when the current view is the dialog's
+   * first one, so the host closes the dialog instead. Leaving an active
+   * request withdraws it; otherwise its authorize code stays approvable until
+   * it expires.
+   */
+  back(): boolean {
+    const target = backViewOf(this.view, this.hasSession());
+    if (target === null) return false;
+    if (this.signIn.phase === 'starting' || this.signIn.phase === 'waiting') {
+      this.cancelSignIn();
+    }
+    this.setView(target);
+    return true;
+  }
+
+  /** `'accounts'` needs a session; without one the sign-in entry stands in for it. */
+  private resolveView(view: AccountDialogView): AccountDialogView {
+    return view === 'accounts' && !this.hasSession() ? 'signin' : view;
+  }
+
+  /**
+   * Whether an account is signed in here — the precondition of the account
+   * menu. The bearer, not the directory: the directory is bearer-read, and the
+   * menu's content (hero, storage, sign-out) is all about the bearer's account.
+   */
+  private hasSession(): boolean {
+    return this.isAuthenticated();
+  }
+
   /** Switch to the "add account" view (the sign-in entry chooser). */
   add(): void {
     this.setView('add');
@@ -1720,8 +1773,13 @@ export class AccountDialogController {
 
   private computeSnapshot(): AccountDialogSnapshot {
     const directory = this.sessionClient.getDirectory();
+    const hasSession = this.hasSession();
+    // Resolved here as well as in `setView`: the controller is constructed on
+    // `'accounts'` before anyone knows whether a bearer exists.
+    const view = this.resolveView(this.view);
     return {
-      view: this.view,
+      view,
+      backView: backViewOf(view, hasSession),
       directory,
       activeContext: resolveActiveContext(directory),
       loading: this.loading,
@@ -1747,6 +1805,30 @@ export class AccountDialogController {
   }
 }
 
+/**
+ * The view one step back from `view`, or `null` when `view` is the dialog's
+ * first view.
+ *
+ * The sign-in entry is `'add'` ("add another account") when somebody is signed
+ * in and `'signin'` when nobody is; `signup` and `qr` are reached FROM that
+ * entry, so they return to it. The entry itself returns to the account menu —
+ * which exists only with a session. This used to be a host-side
+ * "back = accounts" that assumed a signed-in origin, so a signed-out Back from
+ * "Create your account" opened a menu holding "Sign out" for nobody.
+ */
+export function backViewOf(view: AccountDialogView, hasSession: boolean): AccountDialogView | null {
+  switch (view) {
+    case 'signup':
+    case 'qr':
+      return hasSession ? 'add' : 'signin';
+    case 'add':
+      return hasSession ? 'accounts' : null;
+    case 'signin':
+    case 'accounts':
+      return null;
+  }
+}
+
 /** Factory mirroring `createSessionClient`, for ergonomic wiring by consumers. */
 export function createAccountDialogController(
   options: AccountDialogControllerOptions,