@oxy.so/core 1.8.1 → 1.9.1

package/dist/types/HttpService.d.ts

@@ -141,6 +141,27 @@ export declare class HttpService {
      * it, and there is exactly one timestamp to reason about.
      */
     private lastRefreshWasRateLimited;
+    /**
+     * The access token the last SUCCESSFUL refresh handed back while it was still
+     * inside the refresh lead window, or `null`.
+     *
+     * The device mint (`POST /session/device/token`) answers with the session's
+     * STORED access token for as long as that token has not expired — it only
+     * mints a new one once the old one is past `exp`. A client that re-mints
+     * {@link TOKEN_REFRESH_LEAD_SECONDS} before `exp` therefore gets the SAME
+     * token back, and because that counts as a success (no cooldown), every
+     * following request re-ran the preflight and minted again: one mint per
+     * request for the last minute of every token, which exhausted the server's
+     * 30/min mint budget. The 429 that followed imposed a 60s cooldown that
+     * straddled the token's real expiry, so the next request went out with no
+     * bearer, drew a 401, found the refresh cooling down, and signed the user out.
+     *
+     * Remembering the answer ends that: while the current token IS this value and
+     * has not yet expired, the server has already said it has nothing fresher, so
+     * the preflight sends the still-valid token instead of asking again. Once the
+     * token crosses `exp` the preflight asks once more and the server rotates.
+     */
+    private noFresherTokenThan;
     private authRefreshHandler;
     private accessTokenProvider;
     private deviceSecretMintInFlight;
@@ -309,6 +330,13 @@ export declare class HttpService {
      * Public because the handler lives in `session/refresh.ts`, not on this class.
      */
     noteRefreshRateLimited(): void;
+    /**
+     * Whether the server has already answered a refresh of the CURRENT access
+     * token with that same, still-valid token — i.e. it has nothing fresher to
+     * give until the token's `exp`. The proactive scheduler reads this so it waits
+     * for expiry instead of re-asking at its 1s floor.
+     */
+    isAwaitingCurrentTokenExpiry(): boolean;
     /**
      * Whether the CURRENT stored access token is already past its `exp`. Drives
      * the shorter post-failure refresh cooldown ({@link EXPIRED_TOKEN_REFRESH_COOLDOWN_MS}):

package/dist/types/models/interfaces.d.ts

@@ -693,7 +693,12 @@ export interface AssetUploadProgress {
 export interface DeviceLinkedSession {
     sessionId: string;
     deviceId: string;
-    deviceName: string;
+    /**
+     * Not sent by `GET /session/device/sessions/:sessionId` today — every row
+     * shares one device, and the account a row belongs to is `user`. Optional so
+     * a caller cannot render it unchecked ("undefined (This device)").
+     */
+    deviceName?: string;
     isActive: boolean;
     lastActive: string;
     expiresAt: string;

package/dist/types/session/accountDialogController.d.ts

@@ -220,8 +220,19 @@ export interface SignInFlowState {
 }
 /** Immutable snapshot consumed by `useSyncExternalStore`. */
 export interface AccountDialogSnapshot {
-    /** The current view. */
+    /**
+     * The current view. Never `'accounts'` without a session: the account menu
+     * describes a signed-in account, so with no bearer the controller shows the
+     * sign-in entry (`'signin'`) in its place.
+     */
     view: AccountDialogView;
+    /**
+     * Where {@link AccountDialogController.back} leads from {@link view}, or
+     * `null` when `view` is the dialog's first view (a back there closes the
+     * dialog instead). Hosts show their back affordance from this, not from a
+     * table of their own.
+     */
+    backView: AccountDialogView | null;
     /**
      * The server-authoritative device directory — principals and the contexts
      * each may act as (ADR 0002) — or `null` before the first read.
@@ -449,8 +460,32 @@ export declare class AccountDialogController {
      * (no retry storm).
      */
     private reconcileAuth;
-    /** Set the dialog view directly. */
-    setView(view: AccountDialogView): void;
+    /**
+     * Set the dialog view directly.
+     *
+     * `'accounts'` is only honoured with a session. Signed out it lands on the
+     * sign-in entry instead — the menu it would open holds "Switch account",
+     * storage and "Sign out" for an account that does not exist.
+     */
+    setView(requested: AccountDialogView): void;
+    /**
+     * Go back one step: `signup` and `qr` return to the sign-in entry, and the
+     * entry returns to the account menu when somebody is signed in.
+     *
+     * Returns `false` — changing nothing — when the current view is the dialog's
+     * first one, so the host closes the dialog instead. Leaving an active
+     * request withdraws it; otherwise its authorize code stays approvable until
+     * it expires.
+     */
+    back(): boolean;
+    /** `'accounts'` needs a session; without one the sign-in entry stands in for it. */
+    private resolveView;
+    /**
+     * Whether an account is signed in here — the precondition of the account
+     * menu. The bearer, not the directory: the directory is bearer-read, and the
+     * menu's content (hero, storage, sign-out) is all about the bearer's account.
+     */
+    private hasSession;
     /** Switch to the "add account" view (the sign-in entry chooser). */
     add(): void;
     /** Switch to the "create account" view (passkey / Commons signup entry). */
@@ -795,6 +830,18 @@ export declare class AccountDialogController {
     /** Recompute the snapshot and notify subscribers. */
     private emit;
 }
+/**
+ * The view one step back from `view`, or `null` when `view` is the dialog's
+ * first view.
+ *
+ * The sign-in entry is `'add'` ("add another account") when somebody is signed
+ * in and `'signin'` when nobody is; `signup` and `qr` are reached FROM that
+ * entry, so they return to it. The entry itself returns to the account menu —
+ * which exists only with a session. This used to be a host-side
+ * "back = accounts" that assumed a signed-in origin, so a signed-out Back from
+ * "Create your account" opened a menu holding "Sign out" for nobody.
+ */
+export declare function backViewOf(view: AccountDialogView, hasSession: boolean): AccountDialogView | null;
 /** Factory mirroring `createSessionClient`, for ergonomic wiring by consumers. */
 export declare function createAccountDialogController(options: AccountDialogControllerOptions): AccountDialogController;
 export {};

package/dist/types/session/refresh.d.ts

@@ -33,6 +33,20 @@ import { type IdentityBinding } from './identitySession';
  * window — the scheduler just fires it during idle/background.
  */
 export declare const TOKEN_REFRESH_LEAD_MS = 60000;
+/**
+ * How long past `exp` to re-mint when a successful refresh handed back a token
+ * that is STILL inside the lead window.
+ *
+ * The device mint returns the session's stored access token until that token
+ * has actually expired, so asking again before `exp` only returns the same
+ * token. Re-arming from expiry in that state computed a negative delay, hit the
+ * {@link MIN_SCHEDULE_DELAY_MS} floor and re-minted once a second for the last
+ * minute of every token — 30+ mints, the server's whole per-minute budget, and
+ * the 429 that followed straddled the real expiry. Waiting until just past
+ * `exp` asks exactly once more, when the server will rotate. The margin covers
+ * the server's strict `exp < now` comparison and a little clock skew.
+ */
+export declare const REMINT_AFTER_EXPIRY_MS = 2000;
 export interface RefreshDeps {
     oxy: OxyServices;
     store: AuthStateStore;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "1.8.1",
+  "version": "1.9.1",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/HttpService.ts

@@ -240,6 +240,24 @@ const RATE_LIMITED_REFRESH_COOLDOWN_MS = 60_000;
  */
 const TOKEN_REFRESH_LEAD_SECONDS = 60;
 
+/**
+ * Whether `token` is a JWT that is still valid but already inside the refresh
+ * lead window. `false` for an expired, opaque or no-`exp` token.
+ */
+function isInsideRefreshLeadWindow(token: string): boolean {
+  try {
+    const decoded = jwtDecode<JwtPayload>(token);
+    if (typeof decoded.exp !== 'number') {
+      return false;
+    }
+    const now = Math.floor(Date.now() / 1000);
+    // `<=`: the proactive scheduler fires at exactly `exp - lead`.
+    return decoded.exp > now && decoded.exp - now <= TOKEN_REFRESH_LEAD_SECONDS;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Soft ceiling on the number of live entries in the identity-scoped GET
  * response cache. Crossing it does NOT evict anything (the {@link TTLCache}
@@ -390,6 +408,27 @@ export class HttpService {
    * it, and there is exactly one timestamp to reason about.
    */
   private lastRefreshWasRateLimited = false;
+  /**
+   * The access token the last SUCCESSFUL refresh handed back while it was still
+   * inside the refresh lead window, or `null`.
+   *
+   * The device mint (`POST /session/device/token`) answers with the session's
+   * STORED access token for as long as that token has not expired — it only
+   * mints a new one once the old one is past `exp`. A client that re-mints
+   * {@link TOKEN_REFRESH_LEAD_SECONDS} before `exp` therefore gets the SAME
+   * token back, and because that counts as a success (no cooldown), every
+   * following request re-ran the preflight and minted again: one mint per
+   * request for the last minute of every token, which exhausted the server's
+   * 30/min mint budget. The 429 that followed imposed a 60s cooldown that
+   * straddled the token's real expiry, so the next request went out with no
+   * bearer, drew a 401, found the refresh cooling down, and signed the user out.
+   *
+   * Remembering the answer ends that: while the current token IS this value and
+   * has not yet expired, the server has already said it has nothing fresher, so
+   * the preflight sends the still-valid token instead of asking again. Once the
+   * token crosses `exp` the preflight asks once more and the server rotates.
+   */
+  private noFresherTokenThan: string | null = null;
   private authRefreshHandler: AuthRefreshHandler | null = null;
   private accessTokenProvider: AccessTokenProvider | null = null;
   private deviceSecretMintInFlight: Promise<DeviceSecretMintOutcome> | null = null;
@@ -1324,6 +1363,12 @@ export class HttpService {
 
       // If the token expires within the refresh lead window, refresh it.
       if (decoded.exp && decoded.exp - currentTime < TOKEN_REFRESH_LEAD_SECONDS) {
+        // The server already answered this token's refresh with this very token:
+        // it has nothing fresher until `exp`. Use it rather than asking again
+        // (see `noFresherTokenThan`).
+        if (decoded.exp > currentTime && accessToken === this.noFresherTokenThan) {
+          return `Bearer ${accessToken}`;
+        }
         const refreshed = await this.refreshAccessToken('preflight');
         if (refreshed) return `Bearer ${refreshed}`;
         if (decoded.exp > currentTime) {
@@ -1378,6 +1423,7 @@ export class HttpService {
             this.tokenStore.setTokens(newToken);
             this.notifyTokenChange();
           }
+          this.noFresherTokenThan = isInsideRefreshLeadWindow(newToken) ? newToken : null;
           // A success clears the failure timestamp so the next refresh is never
           // throttled by a stale cooldown.
           this.lastRefreshFailureAt = 0;
@@ -1414,6 +1460,17 @@ export class HttpService {
     this.lastRefreshWasRateLimited = true;
   }
 
+  /**
+   * Whether the server has already answered a refresh of the CURRENT access
+   * token with that same, still-valid token — i.e. it has nothing fresher to
+   * give until the token's `exp`. The proactive scheduler reads this so it waits
+   * for expiry instead of re-asking at its 1s floor.
+   */
+  isAwaitingCurrentTokenExpiry(): boolean {
+    const token = this.tokenStore.getAccessToken();
+    return token !== null && token === this.noFresherTokenThan && isInsideRefreshLeadWindow(token);
+  }
+
   /**
    * Whether the CURRENT stored access token is already past its `exp`. Drives
    * the shorter post-failure refresh cooldown ({@link EXPIRED_TOKEN_REFRESH_COOLDOWN_MS}):

package/src/__tests__/nearExpiryMintStorm.test.ts

@@ -0,0 +1,165 @@
+/**
+ * The near-expiry mint storm that signed a busy app out (OxyHQ/Mention#1140).
+ *
+ * What the server does: `POST /session/device/token` answers with the session's
+ * STORED access token for as long as that token has not expired, and mints a
+ * new one only once it is past `exp`. The mint is budgeted at 30/min per device.
+ *
+ * What the client did with that: the scheduler and the request-time preflight
+ * both re-mint 60s before `exp`. The server handed the same token back, which
+ * counted as a success (no cooldown), so the scheduler re-armed at its 1s floor
+ * and every request re-ran the preflight: ~30 mints in the token's last minute,
+ * then a 429, whose 60s cooldown straddled the real expiry. The next request
+ * carried no bearer, drew a 401, found the refresh cooling down, and the
+ * HttpService cleared the token — which the provider reads as a sign-out.
+ *
+ * Production logs for the device showed exactly this: a burst of ~30 mints at
+ * ~1.4s intervals every ~16 minutes, a single mint ~78s later (the scheduler's
+ * 5+10+20+40s backoff through the 60s rate-limit cooldown), and a sign-out on
+ * the one cycle where the app was in active use across the expiry.
+ *
+ * This suite simulates that server against the real HttpService, refresh
+ * scheduler and 401 lane.
+ */
+import { OxyServices } from '../OxyServices';
+import { startTokenRefreshScheduler } from '../session/refresh';
+
+const TOKEN_TTL_SECONDS = 15 * 60;
+const MINT_BUDGET_PER_MINUTE = 30;
+
+function createJwt(payload: Record<string, unknown>): string {
+  const encode = (value: unknown): string => Buffer.from(JSON.stringify(value)).toString('base64url');
+  return `${encode({ alg: 'HS256', typ: 'JWT' })}.${encode(payload)}.signature`;
+}
+
+function expOf(token: string): number {
+  const [, payload] = token.split('.');
+  return (JSON.parse(Buffer.from(payload, 'base64url').toString()) as { exp: number }).exp;
+}
+
+/**
+ * The device mint as the server implements it, including its rate limiter.
+ *
+ * `rotateWithinSeconds` is how close to `exp` the stored token may be before the
+ * server rotates instead of handing it back: `0` is the server as it was (it
+ * rotated only a token already past `exp`), a positive value is the fixed one.
+ */
+function createMintServer(rotateWithinSeconds: number): {
+  mint: () => { status: 200; token: string } | { status: 429 };
+  storedToken: () => string;
+  mints: number[];
+  rateLimited: number;
+} {
+  let serial = 0;
+  const issue = (): string => {
+    serial += 1;
+    return createJwt({ userId: 'u', jti: `t${serial}`, exp: Math.floor(Date.now() / 1000) + TOKEN_TTL_SECONDS });
+  };
+  let stored = issue();
+  const mints: number[] = [];
+  const state = { rateLimited: 0 };
+  return {
+    mint: () => {
+      const now = Date.now();
+      if (mints.filter((at) => now - at < 60_000).length >= MINT_BUDGET_PER_MINUTE) {
+        state.rateLimited += 1;
+        return { status: 429 };
+      }
+      mints.push(now);
+      // `getAccessToken`: hand back the stored token unless it has expired.
+      if (expOf(stored) - Math.floor(now / 1000) < (rotateWithinSeconds > 0 ? rotateWithinSeconds : 0)) {
+        stored = issue();
+      }
+      return { status: 200, token: stored };
+    },
+    storedToken: () => stored,
+    mints,
+    get rateLimited() {
+      return state.rateLimited;
+    },
+  };
+}
+
+describe('a busy app across an access token expiry', () => {
+  const originalFetch = globalThis.fetch;
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+    jest.useRealTimers();
+  });
+
+  async function runBusyApp(rotateWithinSeconds: number): Promise<{
+    tokenEvents: Array<string | null>;
+    finalToken: string | null;
+    server: ReturnType<typeof createMintServer>;
+  }> {
+    jest.useFakeTimers({ now: new Date('2026-09-25T13:48:00Z') });
+    const server = createMintServer(rotateWithinSeconds);
+
+    // The app's own API: 401 without a live bearer, as any resource server does.
+    globalThis.fetch = (async (_input: unknown, init?: RequestInit) => {
+      const headers = (init?.headers ?? {}) as Record<string, string>;
+      const bearer = headers.Authorization ?? headers.authorization;
+      const token = bearer?.startsWith('Bearer ') ? bearer.slice(7) : null;
+      if (!token || expOf(token) <= Math.floor(Date.now() / 1000)) {
+        return new Response(JSON.stringify({ error: 'Unauthorized' }), {
+          status: 401,
+          headers: { 'content-type': 'application/json' },
+        });
+      }
+      return new Response(JSON.stringify({ data: { ok: true } }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      });
+    }) as typeof fetch;
+
+    const oxy = new OxyServices({ baseURL: 'https://api.mention.earth', enableCache: false, enableRetry: false });
+    oxy.setTokens(server.storedToken());
+    oxy.httpService.setAuthRefreshHandler(async (reason) => {
+      const answer = server.mint();
+      if (answer.status === 429) {
+        // What `refreshDeviceSecretArm` does with a 429.
+        oxy.httpService.noteRefreshRateLimited();
+        return null;
+      }
+      oxy.setTokens(answer.token);
+      return answer.token;
+    });
+
+    const tokenEvents: Array<string | null> = [];
+    oxy.onTokensChanged((token) => tokenEvents.push(token));
+    const scheduler = startTokenRefreshScheduler(oxy);
+
+    // Twenty minutes of an app in use: a request every 700ms, straight across
+    // the first token's expiry at 14:03:00.
+    for (let elapsed = 0; elapsed < 20 * 60_000; elapsed += 700) {
+      await oxy.httpService.get('/feed').catch(() => undefined);
+      await jest.advanceTimersByTimeAsync(700);
+    }
+    scheduler.dispose();
+    return { tokenEvents, finalToken: oxy.getAccessToken(), server };
+  }
+
+  it('against the server that hands back an unexpired token: never cleared, never rate limited', async () => {
+    const { tokenEvents, finalToken, server } = await runBusyApp(0);
+
+    // Before the fix: ~30 mints of the same token, a 429, then the token was
+    // cleared (a run of `null` events) and the app was signed out.
+    expect(tokenEvents).not.toContain(null);
+    expect(finalToken).not.toBeNull();
+    expect(server.rateLimited).toBe(0);
+    // One rotation. The server still hands the expired token back for the
+    // second it expires in (it compares `exp < now`), which costs a few mints in
+    // that one second — nowhere near the budget.
+    expect(server.mints.length).toBeLessThan(MINT_BUDGET_PER_MINUTE / 3);
+  });
+
+  it('against the server that rotates a token near expiry: one mint per rotation', async () => {
+    const { tokenEvents, finalToken, server } = await runBusyApp(120);
+
+    expect(tokenEvents).not.toContain(null);
+    expect(finalToken).not.toBeNull();
+    expect(server.rateLimited).toBe(0);
+    expect(server.mints).toHaveLength(1);
+  });
+});

package/src/i18n/locales/en-US.json

@@ -1850,6 +1850,7 @@
       "switch": {
         "title": "Switch account",
         "count": "{{count}} accounts",
+        "countOne": "{{count}} account",
         "empty": "Accounts you own or share"
       }
     },
@@ -1970,7 +1971,8 @@
       "loading": "Loading sessions…",
       "empty": "No active sessions",
       "signOutAllOnThisDevice": "Sign out of all other devices",
-      "signOutAllSubtitle": "End {{count}} other device session(s)"
+      "signOutAllSubtitle": "End {{count}} other device session(s)",
+      "otherSession": "Another session"
     },
     "confirms": {
       "removeDeviceTitle": "Remove device",

package/src/i18n/locales/es-ES.json

@@ -1850,6 +1850,7 @@
       "switch": {
         "title": "Cambiar de cuenta",
         "count": "{{count}} cuentas",
+        "countOne": "{{count}} cuenta",
         "empty": "Cuentas que posees o compartes"
       }
     },
@@ -1970,7 +1971,8 @@
       "loading": "Cargando sesiones…",
       "empty": "No hay sesiones activas",
       "signOutAllOnThisDevice": "Cerrar sesión en los demás dispositivos",
-      "signOutAllSubtitle": "Finalizar {{count}} sesión(es) de otros dispositivos"
+      "signOutAllSubtitle": "Finalizar {{count}} sesión(es) de otros dispositivos",
+      "otherSession": "Otra sesión"
     },
     "confirms": {
       "removeDeviceTitle": "Eliminar dispositivo",

package/src/models/interfaces.ts

@@ -801,7 +801,12 @@ export interface AssetUploadProgress {
 export interface DeviceLinkedSession {
   sessionId: string;
   deviceId: string;
-  deviceName: string;
+  /**
+   * Not sent by `GET /session/device/sessions/:sessionId` today — every row
+   * shares one device, and the account a row belongs to is `user`. Optional so
+   * a caller cannot render it unchecked ("undefined (This device)").
+   */
+  deviceName?: string;
   isActive: boolean;
   lastActive: string;
   expiresAt: string;

package/src/session/__tests__/accountDialogController.test.ts

@@ -241,6 +241,111 @@ function makeHarness(
 const directoryReads = (urls: string[]): number =>
   urls.filter((url) => url === '/session/device/directory').length;
 
+describe('AccountDialogController — back, and the menu needs a session', () => {
+  /** A harness with no bearer — nobody is signed in on this device. */
+  function signedOut(): Harness {
+    const harness = makeHarness();
+    harness.oxy.emitTokenChange(null);
+    return harness;
+  }
+
+  it('signed out, Back from "Create your account" returns to the sign-in entry, not the account menu', () => {
+    // The Android QA repro (OxyHQ/oxy#1375 item 1): Sign In → "New to Oxy?
+    // Create one" → ‹. The host's back used to be a hard-coded
+    // `setView('accounts')`, which opened "Switch account … Sign out" for nobody.
+    const { controller } = signedOut();
+    controller.setView('signin');
+    controller.startSignup();
+    expect(controller.getSnapshot().backView).toBe('signin');
+
+    expect(controller.back()).toBe(true);
+
+    expect(controller.getSnapshot().view).toBe('signin');
+  });
+
+  it('signed out, the sign-in entry is the first view: back reports nothing to go back to', () => {
+    const { controller } = signedOut();
+    controller.setView('signin');
+    const before = controller.getSnapshot();
+    expect(before.backView).toBeNull();
+
+    expect(controller.back()).toBe(false);
+
+    expect(controller.getSnapshot()).toBe(before);
+  });
+
+  it('signed out, the account menu is never the view — it resolves to the sign-in entry', async () => {
+    const { controller } = signedOut();
+    // A controller is constructed on `accounts`; started with no bearer, it
+    // shows the entry.
+    controller.start();
+    await flush();
+    expect(controller.getSnapshot().view).toBe('signin');
+
+    controller.setView('qr');
+    controller.setView('accounts');
+    expect(controller.getSnapshot().view).toBe('signin');
+
+    controller.add();
+    expect(controller.getSnapshot().backView).toBeNull();
+    expect(controller.back()).toBe(false);
+    expect(controller.getSnapshot().view).toBe('add');
+    controller.destroy();
+  });
+
+  it('signed out, Back from the QR request withdraws it and returns to the entry', async () => {
+    const { controller, oxy } = signedOut();
+    oxy.startCommonsSignIn.mockResolvedValue({
+      sessionToken: 'secret-tok',
+      authorizeCode: 'AUTH-CODE',
+      qrPayload: 'oxycommons://approve?v=1&code=AUTH-CODE',
+      expiresAt: Date.now() + 300_000,
+      status: 'pending',
+    });
+    controller.setView('signin');
+    await controller.showQr();
+    expect(controller.getSnapshot().view).toBe('qr');
+    expect(controller.getSnapshot().signIn.phase).toBe('waiting');
+
+    expect(controller.back()).toBe(true);
+
+    const snap = controller.getSnapshot();
+    expect(snap.view).toBe('signin');
+    expect(snap.signIn.phase).toBe('idle');
+    expect(oxy.denyCommonsSignIn).toHaveBeenCalledWith('AUTH-CODE');
+  });
+
+  it('signed in, back walks signup → add → accounts, and the menu is the first view', () => {
+    const { controller } = makeHarness();
+    controller.add();
+    controller.startSignup();
+    expect(controller.getSnapshot().backView).toBe('add');
+
+    expect(controller.back()).toBe(true);
+    expect(controller.getSnapshot().view).toBe('add');
+    expect(controller.getSnapshot().backView).toBe('accounts');
+
+    expect(controller.back()).toBe(true);
+    expect(controller.getSnapshot().view).toBe('accounts');
+    expect(controller.getSnapshot().backView).toBeNull();
+
+    expect(controller.back()).toBe(false);
+    expect(controller.getSnapshot().view).toBe('accounts');
+  });
+
+  it('signing out while the account menu is open leaves the menu for the sign-in entry', async () => {
+    const { controller, oxy } = makeHarness();
+    controller.start();
+    await flush();
+    expect(controller.getSnapshot().view).toBe('accounts');
+
+    oxy.emitTokenChange(null);
+
+    expect(controller.getSnapshot().view).toBe('signin');
+    controller.destroy();
+  });
+});
+
 describe('AccountDialogController — initial + views', () => {
   it('starts on the accounts view with an empty list and idle sign-in', () => {
     const { controller } = makeHarness();

package/src/session/__tests__/accountDialogShape.test.ts

@@ -64,6 +64,7 @@ const oxyServices = {
 const SNAPSHOT_KEYS = [
   'activatingContextId',
   'activeContext',
+  'backView',
   'commonsAvailability',
   'directory',
   'error',