@oxyhq/core 17.0.2 → 17.1.0

package/dist/types/crypto/keyManager.d.ts

@@ -4,7 +4,7 @@
  * Handles secure generation, storage, and retrieval of cryptographic keys.
  * Private keys are stored securely using expo-secure-store and never leave the device.
  */
-import type { ECKeyPair } from 'elliptic';
+import { ec as EC } from 'elliptic';
 import { type IdentityMarker } from './identityMarker';
 /**
  * Thrown when an identity-mutating operation (createIdentity / importKeyPair)
@@ -536,7 +536,7 @@ export declare class KeyManager {
      * Get the elliptic curve key object from the stored private key
      * Used internally for signing operations
      */
-    static getKeyPairObject(): Promise<ECKeyPair | null>;
+    static getKeyPairObject(): Promise<EC.KeyPair | null>;
     /**
      * Derive public key from a private key (without storing)
      */

package/dist/types/index.d.ts

@@ -39,7 +39,7 @@ export type { CanonicalUserHandleInput, UserHandleInput } from './utils/userHand
 export { normalizeProfileLinks } from './utils/profileLinks';
 export type { ProfileLink, ProfileLinkMetadata } from './utils/profileLinks';
 export type { PublicApplication, ConnectedApp, } from './mixins/OxyServices.connectedApps';
-export type { AccountKind, OrganizationCategory, AccountRelationship, AccountRole, AccountMemberStatus, AccountMemberSource, AccountMember, AccountNode, AccountCredentialType, AccountCredentialEnvironment, AccountCredentialStatus, AccountCredential, AccountCredentialWithSecret, RotateAccountCredentialResult, ListAccountsOptions, CreateAccountInput, UpdateAccountInput, InviteAccountMemberInput, UpdateAccountMemberInput, TransferAccountOwnershipInput, CreateAccountCredentialInput, AccountSuccessResult, SwitchAccountResult, Application, ApplicationType, ApplicationStatus, ApplicationCredential, ApplicationCredentialType, ApplicationCredentialStatus, ApplicationEnvironment, CreateApplicationInput, UpdateApplicationInput, CreateApplicationCredentialInput, ApplicationCredentialWithSecret, RotateApplicationCredentialResult, ApplicationUsagePeriod, ApplicationUsageSummary, ApplicationUsageByDay, ApplicationUsageByEndpoint, ApplicationUsageStats, } from './mixins/OxyServices.accounts';
+export type { AccountKind, OrganizationCategory, AccountRelationship, AccountRole, AccountMemberStatus, AccountMemberSource, AccountMember, AccountNode, AccountCredentialType, AccountCredentialEnvironment, AccountCredentialStatus, AccountCredential, AccountCredentialWithSecret, RotateAccountCredentialResult, ListAccountsOptions, UserCreatableAccountKind, CreateAccountInput, UpdateAccountInput, ProvisionChannelInput, ProvisionChannelMemberInput, ProvisionChannelResult, InviteAccountMemberInput, UpdateAccountMemberInput, TransferAccountOwnershipInput, CreateAccountCredentialInput, AccountSuccessResult, SwitchAccountResult, Application, ApplicationType, ApplicationStatus, ApplicationCredential, ApplicationCredentialType, ApplicationCredentialStatus, ApplicationEnvironment, CreateApplicationInput, UpdateApplicationInput, CreateApplicationCredentialInput, ApplicationCredentialWithSecret, RotateApplicationCredentialResult, ApplicationUsagePeriod, ApplicationUsageSummary, ApplicationUsageByDay, ApplicationUsageByEndpoint, ApplicationUsageStats, } from './mixins/OxyServices.accounts';
 export { ORGANIZATION_CATEGORIES } from './mixins/OxyServices.accounts';
 export { buildUserDid } from './mixins/OxyServices.identity';
 export type { IdentityRecordType, UnlinkableAuthMethodType, LinkAuthMethodResult, PublishRecordResult, VerifyRecordResult, VerifyDomainResult, RemoveDomainResult, RotateKeyProof, RotateKeyOptions, RotateKeyResult, } from './mixins/OxyServices.identity';

package/dist/types/mixins/OxyServices.accounts.d.ts

@@ -33,19 +33,20 @@
  * registers the switched session into the operator's device-set directly).
  */
 import type { User } from '../models/interfaces';
-import type { OrganizationCategory } from '@oxyhq/contracts';
+import type { AccountKind, OrganizationCategory } from '@oxyhq/contracts';
 import type { SessionLoginResponse } from '../models/session';
 import type { OxyServicesBase } from '../OxyServices.base';
 /**
  * Account classification, orthogonal to the federation `type`
  * (`local|federated|agent|automated`). `personal` accounts have a direct login;
- * `organization` / `project` / `bot` accounts are operated via `AccountMember`
- * and have no direct login.
+ * `organization` / `project` / `bot` / `channel` accounts are operated via
+ * `AccountMember` and have no direct login. Of those, only the first three may
+ * be acted AS — see `isActAsEligibleKind`.
+ *
+ * Single source of truth is `@oxyhq/contracts`.
  */
-export type AccountKind = 'personal' | 'organization' | 'project' | 'bot';
-/** Real-estate / team taxonomy for `kind: 'organization'` accounts. */
-export type { OrganizationCategory } from '@oxyhq/contracts';
-export { ORGANIZATION_CATEGORIES } from '@oxyhq/contracts';
+export type { AccountKind, OrganizationCategory } from '@oxyhq/contracts';
+export { ACCOUNT_KINDS, ORGANIZATION_CATEGORIES, isActAsEligibleKind } from '@oxyhq/contracts';
 /**
  * The calling user's relationship to an account node, as resolved by the API:
  * - `self` — the caller's own personal (root) account.
@@ -130,10 +131,12 @@ export interface ListAccountsOptions {
      */
     tree?: boolean;
 }
+/** Kinds a signed-in user may create via `POST /accounts`. Channels are service-provisioned only. */
+export type UserCreatableAccountKind = 'organization' | 'project' | 'bot';
 /** Input accepted by `createAccount`. */
 export interface CreateAccountInput {
-    /** Classification of the new account. `personal` accounts are not created here. */
-    kind: AccountKind;
+    /** Classification of the new account. `personal` and `channel` are not creatable here. */
+    kind: UserCreatableAccountKind;
     /**
      * Parent account `_id` to nest the new account under. Omitted → the API roots
      * it under the caller's personal account.
@@ -141,9 +144,16 @@ export interface CreateAccountInput {
     parentAccountId?: string;
     /** Unique handle for the account (shares the `User.username` unique index). */
     username: string;
+    /**
+     * A managed account (organization / project / bot / channel) has a TITLE, not
+     * a given-and-family name, so it sets `displayName` — the explicit
+     * `name_display` column — and leaves `first`/`last` unset. Splitting a title
+     * on whitespace into `first`/`last` is what this replaced.
+     */
     name?: {
         first?: string;
         last?: string;
+        displayName?: string;
     };
     bio?: string;
     avatar?: string;
@@ -153,15 +163,47 @@ export interface CreateAccountInput {
 /** Input accepted by `updateAccount`. Tree placement changes go through `/move`. */
 export interface UpdateAccountInput {
     username?: string;
+    /**
+     * Same shape as `CreateAccountInput['name']`. On update, an EMPTY STRING in
+     * `displayName` clears the explicit name and falls back to the composed
+     * `first`/`last`; omitting the key leaves the stored value untouched. The two
+     * are not interchangeable.
+     */
     name?: {
         first?: string;
         last?: string;
+        displayName?: string;
     };
     bio?: string | null;
     avatar?: string | null;
     /** Clears the category when `null`; only valid on `kind: 'organization'`. */
     organizationCategory?: OrganizationCategory | null;
 }
+/** Input accepted by `provisionChannelAccount` (service token + `accounts:provision`). */
+export interface ProvisionChannelInput {
+    /** Personal account `_id` whose tree owns the new channel. */
+    ownerUserId: string;
+    username: string;
+    name?: {
+        first?: string;
+        last?: string;
+        displayName?: string;
+    };
+    bio?: string;
+    description?: string;
+    avatar?: string;
+}
+/** Input accepted by `provisionChannelMember` (service token + `accounts:provision`). */
+export interface ProvisionChannelMemberInput {
+    memberUserId: string;
+    role: Exclude<AccountRole, 'owner'>;
+    inherit?: boolean;
+}
+/** Result of `provisionChannelAccount`. */
+export interface ProvisionChannelResult {
+    account: User;
+    membership: AccountMember;
+}
 /** Input accepted by `inviteAccountMember`. The owner role cannot be invited. */
 export interface InviteAccountMemberInput {
     /**
@@ -429,6 +471,11 @@ export interface SwitchAccountResult extends SessionLoginResponse {
 }
 export declare function OxyServicesAccountsMixin<T extends typeof OxyServicesBase>(Base: T): {
     new (...args: any[]): {
+        /**
+         * Inherited from the auth mixin at runtime. Declared here so service-scoped
+         * account provisioning methods can call it with correct typing.
+         */
+        makeServiceRequest: <R = unknown>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: unknown, userId?: string) => Promise<R>;
         /**
          * List the accounts the caller can access: their own personal (root)
          * account, accounts they own, and accounts shared with them (including
@@ -482,6 +529,23 @@ export declare function OxyServicesAccountsMixin<T extends typeof OxyServicesBas
          * @param data - Account configuration: kind, optional parent, and profile.
          */
         createAccount(data: CreateAccountInput): Promise<AccountNode>;
+        /**
+         * Mint a `channel` account under `ownerUserId` via service auth
+         * (`accounts:provision` scope). Requires `configureServiceAuth` first.
+         */
+        provisionChannelAccount(data: ProvisionChannelInput): Promise<ProvisionChannelResult>;
+        /**
+         * Grant membership on a channel account via service auth
+         * (`accounts:provision` scope).
+         */
+        provisionChannelMember(channelAccountId: string, data: ProvisionChannelMemberInput): Promise<{
+            member: AccountMember;
+        }>;
+        /**
+         * Revoke membership on a channel account via service auth
+         * (`accounts:provision` scope).
+         */
+        revokeChannelMember(channelAccountId: string, memberUserId: string): Promise<AccountSuccessResult>;
         /**
          * Update an account's mutable profile fields. Tree placement changes
          * (reparenting) go through the dedicated move endpoint, not here.

package/dist/types/models/interfaces.d.ts

@@ -1,4 +1,4 @@
-import type { OrganizationCategory, UserNameResponse, UserRelationship, ThemePreference } from '@oxyhq/contracts';
+import type { AccountKind, OrganizationCategory, UserNameResponse, UserRelationship, ThemePreference } from '@oxyhq/contracts';
 export interface OxyConfig {
     baseURL: string;
     cloudURL?: string;
@@ -118,6 +118,22 @@ export interface User {
         following?: number;
     };
     accountExpiresAfterInactivityDays?: number | null;
+    /**
+     * Account-graph classification — WHAT this account is.
+     *
+     * ORTHOGONAL to `type` below, and easy to confuse with it: `type` says where
+     * the account lives and how it is driven (`local` / `federated` / `agent` /
+     * `automated`), `kind` says what it IS (`personal` / `organization` /
+     * `project` / `bot` / `channel`). A federated channel is `type: 'federated'`
+     * AND `kind: 'channel'`; neither value substitutes for the other.
+     *
+     * This is what a consumer rendering authored content reads to tell a
+     * channel's post from a person's — a channel is the author, so there is no
+     * second identity to carry alongside the user.
+     *
+     * Absent should be read as `personal` (the column's default), not as unknown.
+     */
+    kind?: AccountKind;
     type?: 'local' | 'federated' | 'agent' | 'automated';
     isFederated?: boolean;
     /** Allow sharing this user's content on the fediverse. Defaults to true. */

package/dist/types/session/accountDialogController.d.ts

@@ -434,7 +434,7 @@ export declare class AccountDialogController {
      * subscription, which re-projects the active row. Concurrent switches are
      * ignored while one is in flight.
      */
-    switchTo(accountId: string): Promise<void>;
+    switchTo(accountId: string): Promise<boolean>;
     /**
      * Start "Sign in with Oxy". Native devices with a shared identity mint a
      * session silently (`signInWithSharedIdentity`); everything else (web, or a

package/dist/types/session/accountProjection.d.ts

@@ -130,6 +130,9 @@ export interface ProjectSwitchableAccountsInput {
  * graph-only rows (in graph order). An account present as BOTH a device session
  * and a graph node is deduped into ONE device row enriched with the graph
  * metadata (relationship / kind / parent / membership).
+ *
+ * Graph nodes of a kind nobody may act as (`channel`) are omitted — see the
+ * filter below.
  */
 export declare function projectSwitchableAccounts(input: ProjectSwitchableAccountsInput): SwitchableAccount[];
 /**
@@ -138,5 +141,8 @@ export declare function projectSwitchableAccounts(input: ProjectSwitchableAccoun
  * `oxyServices.getUsersByIds(...)`; graph nodes already embed their `account`
  * document, but including their ids lets the caller pass one id set and lets the
  * projection prefer freshly-fetched profiles uniformly.
+ *
+ * Applies the SAME act-as filter as {@link projectSwitchableAccounts} to graph
+ * nodes, so this never fetches a profile for a row the projection will drop.
  */
 export declare function switchableAccountIds(state: DeviceSessionState | null, graph: AccountNode[]): string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "17.0.2",
+  "version": "17.1.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -115,9 +115,10 @@
   "dependencies": {
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
-    "@oxyhq/contracts": "^0.21.0",
+    "@oxyhq/contracts": "^0.22.0",
     "@oxyhq/protocol": "^0.1.6",
     "@scure/bip39": "^1.6.0",
+    "@types/elliptic": "^6.4.18",
     "buffer": "^6.0.3",
     "elliptic": "^6.6.1",
     "invariant": "^2.2.4",
@@ -154,7 +155,6 @@
   "devDependencies": {
     "@biomejs/biome": "^1.9.4",
     "@react-native-async-storage/async-storage": "^2.2.0",
-    "@types/elliptic": "^6.4.18",
     "@types/express": "^4.17.21",
     "@types/invariant": "^2.2.34",
     "@types/node": "^20.19.43",

package/src/crypto/keyManager.ts

@@ -6,7 +6,6 @@
  */
 
 import { ec as EC } from 'elliptic';
-import type { ECKeyPair } from 'elliptic';
 import { isWeb, isIOS, isAndroid } from '../utils/platform';
 import { type ExpoCryptoLike, type ExpoSecureStoreLike, isReactNative, isNodeJS, loadAsyncStorage, loadExpoCrypto, loadNodeCrypto, loadSecureStore, loadSharedIdentityBridge } from '@oxyhq/protocol';
 import { isDev, logger } from '../logger';
@@ -2490,7 +2489,7 @@ export class KeyManager {
    * Get the elliptic curve key object from the stored private key
    * Used internally for signing operations
    */
-  static async getKeyPairObject(): Promise<ECKeyPair | null> {
+  static async getKeyPairObject(): Promise<EC.KeyPair | null> {
     if (isWebPlatform()) {
       return null; // Identity storage is only available on native platforms
     }

package/src/i18n/locales/en-US.json

@@ -54,6 +54,12 @@
     "status": {
       "accountSwitched": "Now using {{name}}",
       "signingIn": "Signing in…"
+    },
+    "errors": {
+      "notConfigured": "Sign-in isn't available",
+      "notConfiguredDescription": "{{app}} isn't set up for sign-in yet. Contact the app's developer.",
+      "failed": "Couldn't start sign-in",
+      "failedDescription": "Something went wrong. Please try again."
     }
   },
   "signup": {

package/src/i18n/locales/es-ES.json

@@ -54,6 +54,12 @@
     "status": {
       "accountSwitched": "Ahora usando {{name}}",
       "signingIn": "Iniciando sesión…"
+    },
+    "errors": {
+      "notConfigured": "El inicio de sesión no está disponible",
+      "notConfiguredDescription": "{{app}} todavía no está configurada para iniciar sesión. Contacta con quien desarrolla la app.",
+      "failed": "No se pudo iniciar sesión",
+      "failedDescription": "Algo ha ido mal. Inténtalo de nuevo."
     }
   },
   "signup": {

package/src/index.ts

@@ -136,8 +136,12 @@ export type {
     AccountCredentialWithSecret,
     RotateAccountCredentialResult,
     ListAccountsOptions,
+    UserCreatableAccountKind,
     CreateAccountInput,
     UpdateAccountInput,
+    ProvisionChannelInput,
+    ProvisionChannelMemberInput,
+    ProvisionChannelResult,
     InviteAccountMemberInput,
     UpdateAccountMemberInput,
     TransferAccountOwnershipInput,

package/src/mixins/OxyServices.accounts.ts

@@ -33,7 +33,7 @@
  * registers the switched session into the operator's device-set directly).
  */
 import type { User } from '../models/interfaces';
-import type { OrganizationCategory } from '@oxyhq/contracts';
+import type { AccountKind, OrganizationCategory } from '@oxyhq/contracts';
 import type { SessionLoginResponse } from '../models/session';
 import type { OxyServicesBase } from '../OxyServices.base';
 import { normalizeUserIdentity } from '../utils/userIdentity';
@@ -46,14 +46,14 @@ import { CACHE_TIMES } from './mixinHelpers';
 /**
  * Account classification, orthogonal to the federation `type`
  * (`local|federated|agent|automated`). `personal` accounts have a direct login;
- * `organization` / `project` / `bot` accounts are operated via `AccountMember`
- * and have no direct login.
+ * `organization` / `project` / `bot` / `channel` accounts are operated via
+ * `AccountMember` and have no direct login. Of those, only the first three may
+ * be acted AS — see `isActAsEligibleKind`.
+ *
+ * Single source of truth is `@oxyhq/contracts`.
  */
-export type AccountKind = 'personal' | 'organization' | 'project' | 'bot';
-
-/** Real-estate / team taxonomy for `kind: 'organization'` accounts. */
-export type { OrganizationCategory } from '@oxyhq/contracts';
-export { ORGANIZATION_CATEGORIES } from '@oxyhq/contracts';
+export type { AccountKind, OrganizationCategory } from '@oxyhq/contracts';
+export { ACCOUNT_KINDS, ORGANIZATION_CATEGORIES, isActAsEligibleKind } from '@oxyhq/contracts';
 
 /**
  * The calling user's relationship to an account node, as resolved by the API:
@@ -146,10 +146,13 @@ export interface ListAccountsOptions {
   tree?: boolean;
 }
 
+/** Kinds a signed-in user may create via `POST /accounts`. Channels are service-provisioned only. */
+export type UserCreatableAccountKind = 'organization' | 'project' | 'bot';
+
 /** Input accepted by `createAccount`. */
 export interface CreateAccountInput {
-  /** Classification of the new account. `personal` accounts are not created here. */
-  kind: AccountKind;
+  /** Classification of the new account. `personal` and `channel` are not creatable here. */
+  kind: UserCreatableAccountKind;
   /**
    * Parent account `_id` to nest the new account under. Omitted → the API roots
    * it under the caller's personal account.
@@ -157,7 +160,13 @@ export interface CreateAccountInput {
   parentAccountId?: string;
   /** Unique handle for the account (shares the `User.username` unique index). */
   username: string;
-  name?: { first?: string; last?: string };
+  /**
+   * A managed account (organization / project / bot / channel) has a TITLE, not
+   * a given-and-family name, so it sets `displayName` — the explicit
+   * `name_display` column — and leaves `first`/`last` unset. Splitting a title
+   * on whitespace into `first`/`last` is what this replaced.
+   */
+  name?: { first?: string; last?: string; displayName?: string };
   bio?: string;
   avatar?: string;
   /** Meaningful only when `kind` is `organization`. */
@@ -167,13 +176,43 @@ export interface CreateAccountInput {
 /** Input accepted by `updateAccount`. Tree placement changes go through `/move`. */
 export interface UpdateAccountInput {
   username?: string;
-  name?: { first?: string; last?: string };
+  /**
+   * Same shape as `CreateAccountInput['name']`. On update, an EMPTY STRING in
+   * `displayName` clears the explicit name and falls back to the composed
+   * `first`/`last`; omitting the key leaves the stored value untouched. The two
+   * are not interchangeable.
+   */
+  name?: { first?: string; last?: string; displayName?: string };
   bio?: string | null;
   avatar?: string | null;
   /** Clears the category when `null`; only valid on `kind: 'organization'`. */
   organizationCategory?: OrganizationCategory | null;
 }
 
+/** Input accepted by `provisionChannelAccount` (service token + `accounts:provision`). */
+export interface ProvisionChannelInput {
+  /** Personal account `_id` whose tree owns the new channel. */
+  ownerUserId: string;
+  username: string;
+  name?: { first?: string; last?: string; displayName?: string };
+  bio?: string;
+  description?: string;
+  avatar?: string;
+}
+
+/** Input accepted by `provisionChannelMember` (service token + `accounts:provision`). */
+export interface ProvisionChannelMemberInput {
+  memberUserId: string;
+  role: Exclude<AccountRole, 'owner'>;
+  inherit?: boolean;
+}
+
+/** Result of `provisionChannelAccount`. */
+export interface ProvisionChannelResult {
+  account: User;
+  membership: AccountMember;
+}
+
 /** Input accepted by `inviteAccountMember`. The owner role cannot be invited. */
 export interface InviteAccountMemberInput {
   /**
@@ -482,6 +521,17 @@ export function OxyServicesAccountsMixin<T extends typeof OxyServicesBase>(Base:
       super(...(args as [any]));
     }
 
+    /**
+     * Inherited from the auth mixin at runtime. Declared here so service-scoped
+     * account provisioning methods can call it with correct typing.
+     */
+    declare makeServiceRequest: <R = unknown>(
+      method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE',
+      url: string,
+      data?: unknown,
+      userId?: string,
+    ) => Promise<R>;
+
     // =========================================================================
     // Accounts
     // =========================================================================
@@ -620,6 +670,59 @@ export function OxyServicesAccountsMixin<T extends typeof OxyServicesBase>(Base:
       }
     }
 
+    /**
+     * Mint a `channel` account under `ownerUserId` via service auth
+     * (`accounts:provision` scope). Requires `configureServiceAuth` first.
+     */
+    async provisionChannelAccount(data: ProvisionChannelInput): Promise<ProvisionChannelResult> {
+      try {
+        return await this.makeServiceRequest<ProvisionChannelResult>(
+          'POST',
+          '/accounts/service/channels',
+          data,
+        );
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
+
+    /**
+     * Grant membership on a channel account via service auth
+     * (`accounts:provision` scope).
+     */
+    async provisionChannelMember(
+      channelAccountId: string,
+      data: ProvisionChannelMemberInput,
+    ): Promise<{ member: AccountMember }> {
+      try {
+        return await this.makeServiceRequest<{ member: AccountMember }>(
+          'POST',
+          `/accounts/service/channels/${encodeURIComponent(channelAccountId)}/members`,
+          data,
+        );
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
+
+    /**
+     * Revoke membership on a channel account via service auth
+     * (`accounts:provision` scope).
+     */
+    async revokeChannelMember(
+      channelAccountId: string,
+      memberUserId: string,
+    ): Promise<AccountSuccessResult> {
+      try {
+        return await this.makeServiceRequest<AccountSuccessResult>(
+          'DELETE',
+          `/accounts/service/channels/${encodeURIComponent(channelAccountId)}/members/${encodeURIComponent(memberUserId)}`,
+        );
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
+
     /**
      * Update an account's mutable profile fields. Tree placement changes
      * (reparenting) go through the dedicated move endpoint, not here.

package/src/models/interfaces.ts

@@ -1,4 +1,5 @@
 import type {
+  AccountKind,
   OrganizationCategory,
   UserNameResponse,
   UserRelationship,
@@ -134,6 +135,22 @@ export interface User {
     following?: number;
   };
   accountExpiresAfterInactivityDays?: number | null; // Days of inactivity before account expires (null = never expire)
+  /**
+   * Account-graph classification — WHAT this account is.
+   *
+   * ORTHOGONAL to `type` below, and easy to confuse with it: `type` says where
+   * the account lives and how it is driven (`local` / `federated` / `agent` /
+   * `automated`), `kind` says what it IS (`personal` / `organization` /
+   * `project` / `bot` / `channel`). A federated channel is `type: 'federated'`
+   * AND `kind: 'channel'`; neither value substitutes for the other.
+   *
+   * This is what a consumer rendering authored content reads to tell a
+   * channel's post from a person's — a channel is the author, so there is no
+   * second identity to carry alongside the user.
+   *
+   * Absent should be read as `personal` (the column's default), not as unknown.
+   */
+  kind?: AccountKind;
   // User type and external account support
   type?: 'local' | 'federated' | 'agent' | 'automated';
   isFederated?: boolean;

package/src/session/__tests__/accountDialogController.test.ts

@@ -472,7 +472,7 @@ describe('AccountDialogController — switchTo (uniform switch)', () => {
     sc.set(state([{ accountId: 'a1', sessionId: 's1' }], 'a1'));
     oxy.switchToAccount.mockRejectedValue(new Error('Cannot switch into a personal account'));
 
-    await expect(controller.switchTo('org1')).resolves.toBeUndefined();
+    await expect(controller.switchTo('org1')).resolves.toBe(false);
 
     const snap = controller.getSnapshot();
     expect(snap.error).toBe('Cannot switch into a personal account');
@@ -517,6 +517,18 @@ describe('AccountDialogController — switchTo (uniform switch)', () => {
     release();
     await first;
   });
+
+  it('returns true when the switch succeeds even if the post-switch refresh fails', async () => {
+    const { controller, oxy, sc } = makeHarness();
+    sc.set(state([{ accountId: 'a1', sessionId: 's1' }, { accountId: 'a2', sessionId: 's2' }], 'a1'));
+    jest.spyOn(sc, 'switchAccount').mockResolvedValue(undefined);
+    oxy.listAccounts.mockRejectedValue(new Error('network down'));
+
+    await expect(controller.switchTo('a2')).resolves.toBe(true);
+
+    expect(controller.getSnapshot().error).toBe('network down');
+    expect(controller.getSnapshot().switchingAccountId).toBeNull();
+  });
 });
 
 describe('AccountDialogController — sign in with Oxy', () => {

package/src/session/__tests__/accountProjection.test.ts

@@ -115,6 +115,29 @@ describe('projectSwitchableAccounts', () => {
     expect(org.parentAccountId).toBe('a1');
   });
 
+  /**
+   * A channel is a content identity nobody acts as, so it must never be offered
+   * as a switch target. It reaches the projection through the GRAPH lane, not
+   * the device lane — a channel has no credentials and so can never be a device
+   * session, which is exactly why "no-login accounts can't appear here by
+   * construction" is false: `listAccounts()` contributes credential-less
+   * accounts on purpose (that is how an org first becomes switchable).
+   */
+  it('omits a graph-only channel account from the switcher', () => {
+    const rows = projectSwitchableAccounts({
+      state: state([{ accountId: 'a1', sessionId: 's1' }], 'a1'),
+      graph: [
+        graphNode('org1', { kind: 'organization' }),
+        graphNode('chan1', { kind: 'channel' }),
+      ],
+      profilesById: mapOf(user('a1')),
+      resolveAvatarUrl: noAvatar,
+    });
+
+    expect(rows.map((r) => r.accountId)).toEqual(['a1', 'org1']);
+    expect(rows.some((r) => r.kind === 'channel')).toBe(false);
+  });
+
   it('dedups an account present as BOTH device session and graph node into ONE enriched row', () => {
     const rows = projectSwitchableAccounts({
       state: state([{ accountId: 'a1', sessionId: 's1', authuser: 0 }], 'a1'),
@@ -208,4 +231,12 @@ describe('switchableAccountIds', () => {
   it('returns [] for null state and empty graph', () => {
     expect(switchableAccountIds(null, [])).toEqual([]);
   });
+
+  it('omits a graph-only channel, so no profile is fetched for a dropped row', () => {
+    const ids = switchableAccountIds(null, [
+      graphNode('org1', { kind: 'organization' }),
+      graphNode('chan1', { kind: 'channel' }),
+    ]);
+    expect(ids).toEqual(['org1']);
+  });
 });

package/src/session/accountDialogController.ts

@@ -783,8 +783,8 @@ export class AccountDialogController {
    * subscription, which re-projects the active row. Concurrent switches are
    * ignored while one is in flight.
    */
-  async switchTo(accountId: string): Promise<void> {
-    if (this.switchingAccountId) return;
+  async switchTo(accountId: string): Promise<boolean> {
+    if (this.switchingAccountId) return false;
     this.switchingAccountId = accountId;
     this.error = null;
     this.emit();
@@ -815,8 +815,10 @@ export class AccountDialogController {
       }
       // Re-project + refetch immediately; the subscription also fires.
       await this.refresh();
+      return true;
     } catch (error) {
       this.error = errorMessage(error);
+      return false;
     } finally {
       this.switchingAccountId = null;
       this.emit();