@oxyhq/core 17.0.0 → 17.0.3

package/dist/types/crypto/keyManager.d.ts

@@ -4,7 +4,7 @@
  * Handles secure generation, storage, and retrieval of cryptographic keys.
  * Private keys are stored securely using expo-secure-store and never leave the device.
  */
-import type { ECKeyPair } from 'elliptic';
+import { ec as EC } from 'elliptic';
 import { type IdentityMarker } from './identityMarker';
 /**
  * Thrown when an identity-mutating operation (createIdentity / importKeyPair)
@@ -536,7 +536,7 @@ export declare class KeyManager {
      * Get the elliptic curve key object from the stored private key
      * Used internally for signing operations
      */
-    static getKeyPairObject(): Promise<ECKeyPair | null>;
+    static getKeyPairObject(): Promise<EC.KeyPair | null>;
     /**
      * Derive public key from a private key (without storing)
      */

package/dist/types/mixins/OxyServices.accounts.d.ts

@@ -33,19 +33,20 @@
  * registers the switched session into the operator's device-set directly).
  */
 import type { User } from '../models/interfaces';
-import type { OrganizationCategory } from '@oxyhq/contracts';
+import type { AccountKind, OrganizationCategory } from '@oxyhq/contracts';
 import type { SessionLoginResponse } from '../models/session';
 import type { OxyServicesBase } from '../OxyServices.base';
 /**
  * Account classification, orthogonal to the federation `type`
  * (`local|federated|agent|automated`). `personal` accounts have a direct login;
- * `organization` / `project` / `bot` accounts are operated via `AccountMember`
- * and have no direct login.
+ * `organization` / `project` / `bot` / `channel` accounts are operated via
+ * `AccountMember` and have no direct login. Of those, only the first three may
+ * be acted AS — see `isActAsEligibleKind`.
+ *
+ * Single source of truth is `@oxyhq/contracts`.
  */
-export type AccountKind = 'personal' | 'organization' | 'project' | 'bot';
-/** Real-estate / team taxonomy for `kind: 'organization'` accounts. */
-export type { OrganizationCategory } from '@oxyhq/contracts';
-export { ORGANIZATION_CATEGORIES } from '@oxyhq/contracts';
+export type { AccountKind, OrganizationCategory } from '@oxyhq/contracts';
+export { ACCOUNT_KINDS, ORGANIZATION_CATEGORIES, isActAsEligibleKind } from '@oxyhq/contracts';
 /**
  * The calling user's relationship to an account node, as resolved by the API:
  * - `self` — the caller's own personal (root) account.

package/dist/types/session/accountDialogController.d.ts

@@ -434,7 +434,7 @@ export declare class AccountDialogController {
      * subscription, which re-projects the active row. Concurrent switches are
      * ignored while one is in flight.
      */
-    switchTo(accountId: string): Promise<void>;
+    switchTo(accountId: string): Promise<boolean>;
     /**
      * Start "Sign in with Oxy". Native devices with a shared identity mint a
      * session silently (`signInWithSharedIdentity`); everything else (web, or a

package/dist/types/session/accountProjection.d.ts

@@ -130,6 +130,9 @@ export interface ProjectSwitchableAccountsInput {
  * graph-only rows (in graph order). An account present as BOTH a device session
  * and a graph node is deduped into ONE device row enriched with the graph
  * metadata (relationship / kind / parent / membership).
+ *
+ * Graph nodes of a kind nobody may act as (`channel`) are omitted — see the
+ * filter below.
  */
 export declare function projectSwitchableAccounts(input: ProjectSwitchableAccountsInput): SwitchableAccount[];
 /**
@@ -138,5 +141,8 @@ export declare function projectSwitchableAccounts(input: ProjectSwitchableAccoun
  * `oxyServices.getUsersByIds(...)`; graph nodes already embed their `account`
  * document, but including their ids lets the caller pass one id set and lets the
  * projection prefer freshly-fetched profiles uniformly.
+ *
+ * Applies the SAME act-as filter as {@link projectSwitchableAccounts} to graph
+ * nodes, so this never fetches a profile for a row the projection will drop.
  */
 export declare function switchableAccountIds(state: DeviceSessionState | null, graph: AccountNode[]): string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "17.0.0",
+  "version": "17.0.3",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -115,9 +115,10 @@
   "dependencies": {
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
-    "@oxyhq/contracts": "^0.20.0",
+    "@oxyhq/contracts": "^0.21.0",
     "@oxyhq/protocol": "^0.1.6",
     "@scure/bip39": "^1.6.0",
+    "@types/elliptic": "^6.4.18",
     "buffer": "^6.0.3",
     "elliptic": "^6.6.1",
     "invariant": "^2.2.4",
@@ -154,7 +155,6 @@
   "devDependencies": {
     "@biomejs/biome": "^1.9.4",
     "@react-native-async-storage/async-storage": "^2.2.0",
-    "@types/elliptic": "^6.4.18",
     "@types/express": "^4.17.21",
     "@types/invariant": "^2.2.34",
     "@types/node": "^20.19.43",

package/src/crypto/keyManager.ts

@@ -6,7 +6,6 @@
  */
 
 import { ec as EC } from 'elliptic';
-import type { ECKeyPair } from 'elliptic';
 import { isWeb, isIOS, isAndroid } from '../utils/platform';
 import { type ExpoCryptoLike, type ExpoSecureStoreLike, isReactNative, isNodeJS, loadAsyncStorage, loadExpoCrypto, loadNodeCrypto, loadSecureStore, loadSharedIdentityBridge } from '@oxyhq/protocol';
 import { isDev, logger } from '../logger';
@@ -2490,7 +2489,7 @@ export class KeyManager {
    * Get the elliptic curve key object from the stored private key
    * Used internally for signing operations
    */
-  static async getKeyPairObject(): Promise<ECKeyPair | null> {
+  static async getKeyPairObject(): Promise<EC.KeyPair | null> {
     if (isWebPlatform()) {
       return null; // Identity storage is only available on native platforms
     }

package/src/i18n/locales/en-US.json

@@ -54,6 +54,12 @@
     "status": {
       "accountSwitched": "Now using {{name}}",
       "signingIn": "Signing in…"
+    },
+    "errors": {
+      "notConfigured": "Sign-in isn't available",
+      "notConfiguredDescription": "{{app}} isn't set up for sign-in yet. Contact the app's developer.",
+      "failed": "Couldn't start sign-in",
+      "failedDescription": "Something went wrong. Please try again."
     }
   },
   "signup": {

package/src/i18n/locales/es-ES.json

@@ -54,6 +54,12 @@
     "status": {
       "accountSwitched": "Ahora usando {{name}}",
       "signingIn": "Iniciando sesión…"
+    },
+    "errors": {
+      "notConfigured": "El inicio de sesión no está disponible",
+      "notConfiguredDescription": "{{app}} todavía no está configurada para iniciar sesión. Contacta con quien desarrolla la app.",
+      "failed": "No se pudo iniciar sesión",
+      "failedDescription": "Algo ha ido mal. Inténtalo de nuevo."
     }
   },
   "signup": {

package/src/mixins/OxyServices.accounts.ts

@@ -33,7 +33,7 @@
  * registers the switched session into the operator's device-set directly).
  */
 import type { User } from '../models/interfaces';
-import type { OrganizationCategory } from '@oxyhq/contracts';
+import type { AccountKind, OrganizationCategory } from '@oxyhq/contracts';
 import type { SessionLoginResponse } from '../models/session';
 import type { OxyServicesBase } from '../OxyServices.base';
 import { normalizeUserIdentity } from '../utils/userIdentity';
@@ -46,14 +46,14 @@ import { CACHE_TIMES } from './mixinHelpers';
 /**
  * Account classification, orthogonal to the federation `type`
  * (`local|federated|agent|automated`). `personal` accounts have a direct login;
- * `organization` / `project` / `bot` accounts are operated via `AccountMember`
- * and have no direct login.
+ * `organization` / `project` / `bot` / `channel` accounts are operated via
+ * `AccountMember` and have no direct login. Of those, only the first three may
+ * be acted AS — see `isActAsEligibleKind`.
+ *
+ * Single source of truth is `@oxyhq/contracts`.
  */
-export type AccountKind = 'personal' | 'organization' | 'project' | 'bot';
-
-/** Real-estate / team taxonomy for `kind: 'organization'` accounts. */
-export type { OrganizationCategory } from '@oxyhq/contracts';
-export { ORGANIZATION_CATEGORIES } from '@oxyhq/contracts';
+export type { AccountKind, OrganizationCategory } from '@oxyhq/contracts';
+export { ACCOUNT_KINDS, ORGANIZATION_CATEGORIES, isActAsEligibleKind } from '@oxyhq/contracts';
 
 /**
  * The calling user's relationship to an account node, as resolved by the API:

package/src/server/__tests__/userInvalidation.test.ts

@@ -112,7 +112,13 @@ describe('@oxyhq/core/server createOxyUserInvalidationHandler', () => {
     createOxyUserInvalidationHandler({ oxy: evictor })(validMessage);
 
     expect(entries).toEqual(['GET:/users/user-1']);
-    expect(prefixes).toEqual(['GET:/profiles/username/', 'GET:/profiles/resolve']);
+    expect(prefixes).toEqual([
+      'GET:/session/user/',
+      'GET:/users/me',
+      'GET:/auth/lookup/',
+      'GET:/profiles/username/',
+      'GET:/profiles/resolve',
+    ]);
   });
 
   it('hands the parsed event to app-specific eviction', () => {
@@ -203,6 +209,12 @@ describe('@oxyhq/core/server evictOxyIdentityCache', () => {
     evictOxyIdentityCache(evictor, 'abc123');
 
     expect(entries).toEqual(['GET:/users/abc123']);
-    expect(prefixes).toEqual(['GET:/profiles/username/', 'GET:/profiles/resolve']);
+    expect(prefixes).toEqual([
+      'GET:/session/user/',
+      'GET:/users/me',
+      'GET:/auth/lookup/',
+      'GET:/profiles/username/',
+      'GET:/profiles/resolve',
+    ]);
   });
 });

package/src/server/userInvalidation.ts

@@ -215,6 +215,12 @@ export function createOxyUserInvalidationHandler(
  * wrong data.
  */
 export function evictOxyIdentityCache(oxy: OxyIdentityCacheEvictor, userId: string): void {
+  // Match the sweep the user mixin runs after a local profile write — session-
+  // bound and /users/me entries are keyed without the user id, so they must be
+  // prefix-swept on cross-service invalidation too.
+  oxy.clearCacheByPrefix('GET:/session/user/');
+  oxy.clearCacheByPrefix('GET:/users/me');
+  oxy.clearCacheByPrefix('GET:/auth/lookup/');
   oxy.clearCacheEntry(`GET:/users/${userId}`);
   oxy.clearCacheByPrefix('GET:/profiles/username/');
   oxy.clearCacheByPrefix('GET:/profiles/resolve');

package/src/session/__tests__/accountDialogController.test.ts

@@ -472,7 +472,7 @@ describe('AccountDialogController — switchTo (uniform switch)', () => {
     sc.set(state([{ accountId: 'a1', sessionId: 's1' }], 'a1'));
     oxy.switchToAccount.mockRejectedValue(new Error('Cannot switch into a personal account'));
 
-    await expect(controller.switchTo('org1')).resolves.toBeUndefined();
+    await expect(controller.switchTo('org1')).resolves.toBe(false);
 
     const snap = controller.getSnapshot();
     expect(snap.error).toBe('Cannot switch into a personal account');
@@ -517,6 +517,18 @@ describe('AccountDialogController — switchTo (uniform switch)', () => {
     release();
     await first;
   });
+
+  it('returns true when the switch succeeds even if the post-switch refresh fails', async () => {
+    const { controller, oxy, sc } = makeHarness();
+    sc.set(state([{ accountId: 'a1', sessionId: 's1' }, { accountId: 'a2', sessionId: 's2' }], 'a1'));
+    jest.spyOn(sc, 'switchAccount').mockResolvedValue(undefined);
+    oxy.listAccounts.mockRejectedValue(new Error('network down'));
+
+    await expect(controller.switchTo('a2')).resolves.toBe(true);
+
+    expect(controller.getSnapshot().error).toBe('network down');
+    expect(controller.getSnapshot().switchingAccountId).toBeNull();
+  });
 });
 
 describe('AccountDialogController — sign in with Oxy', () => {

package/src/session/__tests__/accountProjection.test.ts

@@ -115,6 +115,29 @@ describe('projectSwitchableAccounts', () => {
     expect(org.parentAccountId).toBe('a1');
   });
 
+  /**
+   * A channel is a content identity nobody acts as, so it must never be offered
+   * as a switch target. It reaches the projection through the GRAPH lane, not
+   * the device lane — a channel has no credentials and so can never be a device
+   * session, which is exactly why "no-login accounts can't appear here by
+   * construction" is false: `listAccounts()` contributes credential-less
+   * accounts on purpose (that is how an org first becomes switchable).
+   */
+  it('omits a graph-only channel account from the switcher', () => {
+    const rows = projectSwitchableAccounts({
+      state: state([{ accountId: 'a1', sessionId: 's1' }], 'a1'),
+      graph: [
+        graphNode('org1', { kind: 'organization' }),
+        graphNode('chan1', { kind: 'channel' }),
+      ],
+      profilesById: mapOf(user('a1')),
+      resolveAvatarUrl: noAvatar,
+    });
+
+    expect(rows.map((r) => r.accountId)).toEqual(['a1', 'org1']);
+    expect(rows.some((r) => r.kind === 'channel')).toBe(false);
+  });
+
   it('dedups an account present as BOTH device session and graph node into ONE enriched row', () => {
     const rows = projectSwitchableAccounts({
       state: state([{ accountId: 'a1', sessionId: 's1', authuser: 0 }], 'a1'),
@@ -208,4 +231,12 @@ describe('switchableAccountIds', () => {
   it('returns [] for null state and empty graph', () => {
     expect(switchableAccountIds(null, [])).toEqual([]);
   });
+
+  it('omits a graph-only channel, so no profile is fetched for a dropped row', () => {
+    const ids = switchableAccountIds(null, [
+      graphNode('org1', { kind: 'organization' }),
+      graphNode('chan1', { kind: 'channel' }),
+    ]);
+    expect(ids).toEqual(['org1']);
+  });
 });

package/src/session/accountDialogController.ts

@@ -783,8 +783,8 @@ export class AccountDialogController {
    * subscription, which re-projects the active row. Concurrent switches are
    * ignored while one is in flight.
    */
-  async switchTo(accountId: string): Promise<void> {
-    if (this.switchingAccountId) return;
+  async switchTo(accountId: string): Promise<boolean> {
+    if (this.switchingAccountId) return false;
     this.switchingAccountId = accountId;
     this.error = null;
     this.emit();
@@ -815,8 +815,10 @@ export class AccountDialogController {
       }
       // Re-project + refetch immediately; the subscription also fires.
       await this.refresh();
+      return true;
     } catch (error) {
       this.error = errorMessage(error);
+      return false;
     } finally {
       this.switchingAccountId = null;
       this.emit();

package/src/session/accountProjection.ts

@@ -18,6 +18,7 @@
  */
 
 import type { DeviceSessionState } from '@oxyhq/contracts';
+import { isActAsEligibleKind } from '@oxyhq/contracts';
 import type { User } from '../models/interfaces';
 import type {
   AccountNode,
@@ -142,6 +143,9 @@ export interface ProjectSwitchableAccountsInput {
  * graph-only rows (in graph order). An account present as BOTH a device session
  * and a graph node is deduped into ONE device row enriched with the graph
  * metadata (relationship / kind / parent / membership).
+ *
+ * Graph nodes of a kind nobody may act as (`channel`) are omitted — see the
+ * filter below.
  */
 export function projectSwitchableAccounts(input: ProjectSwitchableAccountsInput): SwitchableAccount[] {
   const { state, graph, profilesById, activeUser, locale, resolveAvatarUrl } = input;
@@ -227,6 +231,17 @@ export function projectSwitchableAccounts(input: ProjectSwitchableAccountsInput)
       continue;
     }
     // Graph-only account (owned org / shared, not yet a device session).
+    //
+    // This lane is why a no-login account is NOT kept out of the switcher "by
+    // construction": the graph contributes accounts that have no device session
+    // and no credentials at all, which is exactly how an org first becomes
+    // switchable. So a kind that must never be switched into has to be filtered
+    // HERE, and `isActAsEligibleKind` is the same predicate the server enforces
+    // on `POST /accounts/:id/switch` — offering a row the server would 403 is a
+    // dead button.
+    if (!isActAsEligibleKind(node.kind)) {
+      continue;
+    }
     remember(toRow(node.account, {
       relationship: node.relationship,
       kind: node.kind,
@@ -247,6 +262,9 @@ export function projectSwitchableAccounts(input: ProjectSwitchableAccountsInput)
  * `oxyServices.getUsersByIds(...)`; graph nodes already embed their `account`
  * document, but including their ids lets the caller pass one id set and lets the
  * projection prefer freshly-fetched profiles uniformly.
+ *
+ * Applies the SAME act-as filter as {@link projectSwitchableAccounts} to graph
+ * nodes, so this never fetches a profile for a row the projection will drop.
  */
 export function switchableAccountIds(
   state: DeviceSessionState | null,
@@ -259,7 +277,7 @@ export function switchableAccountIds(
     }
   }
   for (const node of graph) {
-    if (node.accountId) {
+    if (node.accountId && isActAsEligibleKind(node.kind)) {
       ids.add(node.accountId);
     }
   }

package/src/types/color.d.ts

@@ -1,20 +0,0 @@
-declare module 'color' {
-  interface Color {
-    (color: string | Color | undefined, model?: string): Color;
-    rgb(): Color;
-    rgba(): Color;
-    alpha(): number;
-    alpha(val: number): Color;
-    fade(val: number): Color;
-    lighten(val: number): Color;
-    darken(val: number): Color;
-    string(): string;
-    hex(): string;
-    toString(): string;
-  }
-
-  function color(color: string | Color | undefined, model?: string): Color;
-  export default color;
-}
-
-

package/src/types/elliptic.d.ts

@@ -1,70 +0,0 @@
-declare module 'elliptic' {
-  export interface BN {
-    toArray(endian?: 'be' | 'le', length?: number): number[];
-    toString(base?: number): string;
-  }
-
-  export interface KeyPair {
-    getPrivate(enc?: 'hex' | 'array' | 'bn'): string | number[] | any;
-    getPublic(): Point;
-    getPublic(enc: 'hex'): string;
-    getPublic(enc: 'array'): number[];
-    getPublic(compressed: boolean, enc?: 'hex'): string;
-    getPublic(compressed: boolean, enc?: 'array'): number[];
-    sign(msg: string | number[]): Signature;
-    verify(msg: string | number[], signature: Signature | string | { r: string | number[]; s: string | number[] }): boolean;
-    /** ECDH: derive the shared point's x-coordinate against another party's public point. */
-    derive(pub: Point): BN;
-  }
-
-  export interface Signature {
-    r: any;
-    s: any;
-    recoveryParam: number | null;
-    toDER(enc?: 'hex'): string;
-    toCompact(enc?: 'hex', param?: number): string;
-  }
-
-  export interface Curve {
-    n: any;
-    red: any;
-    g: Point;
-    decodePoint(bytes: string | number[], enc?: string): Point;
-  }
-
-  export interface Point {
-    x: any;
-    y: any;
-    inf: boolean;
-    getX(): any;
-    getY(): any;
-    encode(enc?: string, compressed?: boolean): string | number[];
-    add(p: Point): Point;
-    mul(k: any): Point;
-    eq(p: Point): boolean;
-  }
-
-  export class EC {
-    constructor(curve: string | Curve);
-    keyFromPrivate(priv: string | number[], enc?: string): KeyPair;
-    keyFromPublic(pub: string | number[] | Point, enc?: string): KeyPair;
-    genKeyPair(opts?: { entropy?: string | number[]; pers?: string | number[] }): KeyPair;
-    keyPair(opts?: { priv?: string | number[]; pub?: string | number[] | Point; privEnc?: string; pubEnc?: string }): KeyPair;
-    curve: Curve;
-    n: any;
-    nh: any;
-    g: Point;
-  }
-
-  export type ECKeyPair = KeyPair;
-
-  // ec can be called as a function or used as a constructor
-  export interface ECConstructor {
-    new (curve: string | Curve): EC;
-    (curve: string | Curve): EC;
-  }
-  
-  export const ec: ECConstructor;
-}
-
-