@oxyhq/core 20.0.0 → 21.0.0

package/src/session/accountDialogController.ts

@@ -9,15 +9,16 @@
  * replaces.
  *
  * The controller owns:
- *   - the unified account list (via {@link projectSwitchableAccounts}), fetched
- *     from `SessionClient` state ∪ `oxyServices.listAccounts()` and hydrated
- *     with `oxyServices.getUsersByIds()`;
+ *   - the device DIRECTORY (ADR 0002) — the server-authoritative read model of
+ *     who is on this device and what each of them may act as, read through
+ *     `SessionClient.refreshDirectory()`. It is not assembled here: the client
+ *     holds one caller's account graph and cannot enumerate another principal's,
+ *     so switchability is the server's answer and the controller only reads it;
  *   - the dialog `view` state machine (`accounts` | `signin` | `qr` | `add` |
  *     `signup`);
- *   - `switchTo` (the uniform switch: `SessionClient.switchAccount` for an
- *     account already on the device, `oxyServices.switchToAccount` to mint on
- *     first entry into a graph account — reusing the existing SDK primitives, no
- *     new switch path);
+ *   - `activateContext` (the ADR 0002 switch, keyed on the `principal acting as
+ *     account` pair) and the two removals an account id cannot name —
+ *     `signOutContext` and `signOutPrincipal`;
  *   - the "Sign in with Oxy" device flow (same-device shared-keychain via
  *     `oxyServices.signInWithSharedIdentity`, else the cross-device QR handoff
  *     via `startCommonsSignIn` → poll → `claimSessionByToken`);
@@ -55,6 +56,7 @@
  * teardown), never an `open` / `close` / `visible`.
  */
 
+import type { DeviceDirectory } from '@oxyhq/contracts';
 import type { OxyServices } from '../OxyServices';
 import type { SessionLoginResponse, MinimalUserData } from '../models/session';
 import type { User } from '../models/interfaces';
@@ -63,12 +65,7 @@ import { extractErrorStatus } from '../utils/errorUtils';
 import { CENTRAL_IDP_APEX } from '../utils/authWebUrl';
 import type { SessionClient } from './SessionClient';
 import type { MinimalSocket, SocketIOFactory } from './socketLoader';
-import {
-  projectSwitchableAccounts,
-  switchableAccountIds,
-  type SwitchableAccount,
-} from './accountProjection';
-import type { AccountNode } from '../mixins/OxyServices.accounts';
+import { resolveActiveContext, type DeviceContext } from './deviceDirectory';
 import type { CommonsSignInHandle } from '../mixins/OxyServices.auth';
 import {
   pushTargetsFromDelivery,
@@ -262,16 +259,27 @@ function deriveSignInProgress(facts: SignInFlowFacts): SignInProgress {
 export interface AccountDialogSnapshot {
   /** The current view. */
   view: AccountDialogView;
-  /** The unified, deduped account list (device sign-ins ∪ graph accounts). */
-  accounts: SwitchableAccount[];
-  /** The currently-active account id, or `null` when signed out. */
-  activeAccountId: string | null;
-  /** `true` while the initial account-list fetch is in flight with no data yet. */
+  /**
+   * The server-authoritative device directory — principals and the contexts
+   * each may act as (ADR 0002) — or `null` before the first read.
+   *
+   * The ONE read model a switcher renders. The flat list this replaced was
+   * keyed by account id, so on a device holding two people it could show one
+   * route to a shared organization and never both.
+   */
+  directory: DeviceDirectory | null;
+  /** The active `principal acting as account` pair, actor and subject apart. */
+  activeContext: DeviceContext | null;
+  /** `true` while the first directory read is in flight with nothing to show. */
   loading: boolean;
-  /** A human-readable account-list error, or `null`. */
+  /** A human-readable directory error, or `null`. */
   error: string | null;
-  /** The `accountId` of an in-flight switch, or `null`. */
-  switchingAccountId: string | null;
+  /** The `contextId` of an in-flight activation, or `null`. */
+  activatingContextId: string | null;
+  /** The `contextId` of an in-flight context removal, or `null`. */
+  removingContextId: string | null;
+  /** The `principalId` of an in-flight principal removal, or `null`. */
+  removingPrincipalId: string | null;
   /** The "Sign in with Oxy" device-flow state. */
   signIn: SignInFlowState;
   /** Whether Commons is installed on this device. See {@link CommonsAvailability}. */
@@ -291,8 +299,6 @@ export interface AccountDialogControllerOptions {
    * server would reject.
    */
   clientId?: string | null;
-  /** Locale for display-name resolution. */
-  locale?: string;
   /**
    * Commit a freshly-authorized SIGN-IN session (device flow / shared identity)
    * into the host's session set — device-first registration + durable persist +
@@ -302,24 +308,12 @@ export interface AccountDialogControllerOptions {
    * `SessionClient.registerAndActivate` (registration + activation only — no
    * provider-side durable persist/hydration).
    *
-   * This is the SIGN-IN commit: registers the session into the host's device
-   * set with durable persist + profile hydration. An account SWITCH uses
-   * {@link commitSwitchedSession} instead — see below.
+   * Sign-in is the only thing that commits a session here. An account SWITCH
+   * used to mint one too, on first entry into a graph account; activation mints
+   * the delegated session SERVER-side and hands back a bearer, so there is no
+   * second commit funnel to keep in step with this one.
    */
   commitSession?: (session: SessionLoginResponse) => Promise<void>;
-  /**
-   * Commit a minted graph SWITCH session into the host's session set — same
-   * device-first registration + durable persist + profile hydration as
-   * {@link commitSession}, but IN-PLACE: it must NOT re-run sign-in side effects
-   * that belong only to a fresh authorization (for example, a redundant full
-   * device-set reconcile on switch). Cross-tab/app propagation of the switch
-   * still happens instantly via the server's device-scoped `session_state` /
-   * `session_accounts_changed` socket broadcast — no navigation required.
-   *
-   * When omitted the controller falls back to {@link commitSession} (if wired)
-   * and then to `SessionClient.registerAndActivate`.
-   */
-  commitSwitchedSession?: (session: SessionLoginResponse) => Promise<void>;
   /** Notified after a completed sign-in (bearer planted + session committed). */
   onSignedIn?: (user: MinimalUserData) => void;
   /**
@@ -436,9 +430,7 @@ export class AccountDialogController {
   private readonly oxyServices: OxyServices;
   private readonly sessionClient: SessionClient;
   private readonly clientId: string | null;
-  private readonly locale?: string;
   private readonly commitSession?: (session: SessionLoginResponse) => Promise<void>;
-  private readonly commitSwitchedSession?: (session: SessionLoginResponse) => Promise<void>;
   private readonly onSignedIn?: (user: MinimalUserData) => void;
   private readonly pollIntervalMs: number;
   private readonly openUrl?: (url: string) => void;
@@ -452,11 +444,11 @@ export class AccountDialogController {
 
   // --- Internal (unprojected) state ---
   private view: AccountDialogView = 'accounts';
-  private graph: AccountNode[] = [];
-  private profilesById = new Map<string, User>();
   private loading = false;
   private error: string | null = null;
-  private switchingAccountId: string | null = null;
+  private activatingContextId: string | null = null;
+  private removingContextId: string | null = null;
+  private removingPrincipalId: string | null = null;
   private signIn: SignInFlowState = IDLE_SIGN_IN;
   private commonsAvailability: CommonsAvailability = 'unknown';
 
@@ -494,9 +486,7 @@ export class AccountDialogController {
     this.oxyServices = options.oxyServices;
     this.sessionClient = options.sessionClient;
     this.clientId = options.clientId ?? null;
-    this.locale = options.locale;
     this.commitSession = options.commitSession;
-    this.commitSwitchedSession = options.commitSwitchedSession;
     this.onSignedIn = options.onSignedIn;
     this.pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
     this.openUrl = options.openUrl;
@@ -539,11 +529,12 @@ export class AccountDialogController {
     this.started = true;
     this.authed = this.isAuthenticated();
     this.unsubscribeSession = this.sessionClient.subscribe(() => {
-      // A device-state change (switch / sign-out / sibling sign-in) can add or
-      // remove accounts — re-project immediately, refetch profiles when new
-      // account ids appeared, and reconcile the auth-readiness edge.
+      // A device change (switch / sign-out / sibling sign-in) re-reads the
+      // directory inside `SessionClient` before it notifies, so the snapshot
+      // this rebuilds is already the new one — publish it and reconcile the
+      // auth-readiness edge. No profile fetch: the directory carries the display
+      // metadata a row needs.
       this.emit();
-      void this.ensureProfiles();
       this.reconcileAuth();
     });
     // The access token is planted AFTER `SessionClient.applyState` fires its
@@ -626,9 +617,9 @@ export class AccountDialogController {
       void this.refresh();
       return;
     }
-    // Signed out: the graph is no longer fetchable/switchable — drop it and
-    // re-project from the device session set alone.
-    this.graph = [];
+    // Signed out. The directory is bearer-read and `SessionClient` drops the one
+    // it holds when the device empties, so there is nothing to clear here — only
+    // the in-flight bookkeeping, which no longer describes anything.
     this.error = null;
     this.loading = false;
     this.emit();
@@ -663,164 +654,148 @@ export class AccountDialogController {
   }
 
   // =========================================================================
-  // Account list
+  // The directory
   // =========================================================================
 
   /**
-   * Reload the account graph and per-account profiles, then re-project. Safe to
-   * call repeatedly; concurrent calls are reconciled by a sequence guard so a
-   * slow earlier fetch never overwrites a newer result.
+   * Re-read `GET /session/device/directory`. Safe to call repeatedly;
+   * concurrent calls are reconciled by a sequence guard so a slow earlier read
+   * never overwrites a newer result.
+   *
+   * This is ONE request. It used to be three — the directory, plus
+   * `listAccounts()` and `getUsersByIds()` to rebuild the same tree client-side
+   * — and the reconstruction was not merely redundant: it enumerated the
+   * CALLER's account graph, which on a device holding two people is one
+   * person's answer presented as the device's.
    */
   async refresh(): Promise<void> {
     const seq = ++this.refreshSeq;
 
-    // Never hit the private `listAccounts()` while signed out: at cold boot the
-    // bearer is not planted yet, so the call 401s → `HttpService` clears the
-    // token and signs the user out. Re-project from the device session set alone
-    // (`projectSwitchableAccounts` works from `SessionClient` state) and stop.
+    // Never read the directory while signed out: at cold boot the bearer is not
+    // planted yet, so the call 401s → `HttpService` clears the token and signs
+    // the user out.
     if (!this.isAuthenticated()) {
-      this.graph = [];
       this.loading = false;
       this.error = null;
       this.emit();
       return;
     }
 
-    const hadAccounts = this.snapshot.accounts.length > 0;
-    this.loading = !hadAccounts;
+    // Nothing to show yet is the only state worth a spinner; a re-read behind an
+    // already-rendered directory refreshes in place.
+    this.loading = this.sessionClient.getDirectory() === null;
     this.error = null;
     this.emit();
 
-    let graph: AccountNode[] = this.graph;
     try {
-      graph = await this.oxyServices.listAccounts();
+      await this.sessionClient.refreshDirectory();
     } catch (error) {
-      // A 401 here is the EXPECTED signed-out edge, not a failure: the bearer was
+      // A 401 is the EXPECTED signed-out edge, not a failure: the bearer was
       // stale/revoked, so `HttpService` already cleared it and emitted
-      // `onTokensChanged(null)`, which drops the graph via `reconcileAuth`. Log at
-      // debug and leave the dialog error-free — a signed-out device with zero
-      // accounts is a normal state, not a warning. Any other error (network, 5xx,
-      // malformed) IS unexpected: surface it and warn while keeping the prior graph
-      // so device rows still render.
+      // `onTokensChanged(null)`. Any OTHER error (network, 5xx, malformed) IS
+      // unexpected — surface it, and keep whatever directory is already held so
+      // an outage degrades rather than blanks the switcher.
       if (extractErrorStatus(error) === 401) {
-        logger.debug('[AccountDialogController] listAccounts unauthorized (signed out)', { component: 'AccountDialogController' }, error);
+        logger.debug('[AccountDialogController] directory unauthorized (signed out)', { component: 'AccountDialogController' }, error);
       } else {
         this.error = errorMessage(error);
-        logger.warn('[AccountDialogController] listAccounts failed', { component: 'AccountDialogController' }, error);
+        logger.warn('[AccountDialogController] directory refresh failed', { component: 'AccountDialogController' }, error);
       }
     }
     if (seq !== this.refreshSeq) return; // superseded by a newer refresh
 
-    this.graph = graph;
-    await this.loadProfiles(seq);
-    if (seq !== this.refreshSeq) return;
-
     this.loading = false;
     this.emit();
   }
 
+  // =========================================================================
+  // Activation and the two removals (ADR 0002)
+  // =========================================================================
+
   /**
-   * Fetch profiles for any account id (device set ∪ graph) not yet resolved.
-   * Cheap no-op when everything is already hydrated — used from the session
-   * subscription so a newly-added device account gets a name/avatar.
+   * Activate one `principal acting as account` context — the ADR 0002 switch,
+   * and the one that can express what an account id cannot: WHICH person's
+   * route to a shared organization to become.
+   *
+   * There is no on-device/graph fork. The directory has a row for a context the
+   * principal may act as but has never entered, and `POST /session/device/
+   * activate` reuses or mints the delegated session server-side, so one call
+   * covers both cases.
+   *
+   * A context id is not stable across a removal, so a stale one is an ordinary
+   * outcome rather than a bug: the server answers 404 or 403, heals the row, and
+   * the refresh below re-reads a directory that no longer offers it.
    */
-  private async ensureProfiles(): Promise<void> {
-    // `getUsersByIds` is private — skip the whole path while signed out.
-    if (!this.isAuthenticated()) return;
-    const ids = switchableAccountIds(this.sessionClient.getState(), this.graph);
-    if (ids.every((id) => this.profilesById.has(id))) return;
-    await this.loadProfiles(this.refreshSeq);
+  async activateContext(contextId: string): Promise<boolean> {
+    if (this.activatingContextId) return false;
+    this.activatingContextId = contextId;
+    this.error = null;
     this.emit();
+    try {
+      await this.sessionClient.activateContext(contextId);
+      await this.refresh();
+      return true;
+    } catch (error) {
+      this.error = errorMessage(error);
+      return false;
+    } finally {
+      this.activatingContextId = null;
+      this.emit();
+    }
   }
 
-  private async loadProfiles(seq: number): Promise<void> {
-    // `getUsersByIds` (`POST /users/by-ids`) is a private call — never issue it
-    // while signed out (the 401 → sign-out cascade). Callers already gate; this
-    // guards the network chokepoint too (e.g. the token was cleared mid-refresh).
-    if (!this.isAuthenticated()) return;
-    const ids = switchableAccountIds(this.sessionClient.getState(), this.graph);
-    if (ids.length === 0) return;
-    let profiles: User[] = [];
+  /**
+   * Remove ONE `principal → account` pair, and only that pair.
+   *
+   * Not the account across the device: the same organization reached through a
+   * second person is a different session with a different audit actor, and it
+   * stays. Routing this through `signOut({accountId})` would revoke that second
+   * person's access as a side effect of one person tidying their own list.
+   *
+   * The removed pair is not gone for good while the membership lives — the
+   * server offers it again on the next read, under a NEW id and at an unchanged
+   * revision — so nothing may hold a context id across this call.
+   */
+  async signOutContext(contextId: string): Promise<boolean> {
+    if (this.removingContextId || this.removingPrincipalId) return false;
+    this.removingContextId = contextId;
+    this.error = null;
+    this.emit();
     try {
-      profiles = await this.oxyServices.getUsersByIds(ids);
+      await this.sessionClient.signOutContext(contextId);
+      await this.refresh();
+      return true;
     } catch (error) {
-      // A 401 is the EXPECTED signed-out edge (stale/cleared bearer) — log at debug.
-      // `getUsersByIds` already swallows per-chunk failures and returns `[]`, so any
-      // OTHER error here is an unexpected total failure worth a warn. Either way keep
-      // the prior profile map.
-      if (extractErrorStatus(error) === 401) {
-        logger.debug('[AccountDialogController] getUsersByIds unauthorized (signed out)', { component: 'AccountDialogController' }, error);
-      } else {
-        logger.warn('[AccountDialogController] getUsersByIds failed', { component: 'AccountDialogController' }, error);
-      }
-      return;
-    }
-    if (seq !== this.refreshSeq) return; // superseded
-    const next = new Map(this.profilesById);
-    for (const profile of profiles) {
-      next.set(profile.id, profile);
+      this.error = errorMessage(error);
+      return false;
+    } finally {
+      this.removingContextId = null;
+      this.emit();
     }
-    this.profilesById = next;
   }
 
-  // =========================================================================
-  // Switching (uniform switch model — reuses the existing SDK primitives)
-  // =========================================================================
-
   /**
-   * Switch the active account to `accountId`.
-   *
-   * Uniform switch model, mirroring the SDK's existing path — NOT a new switch
-   * mechanism:
-   *   - already on this device → `SessionClient.switchAccount` (device-first
-   *     switch of `/session/device/switch`);
-   *   - a graph account not yet on the device (first entry) →
-   *     `oxyServices.switchToAccount` mints + plants a real session and the
-   *     server registers it into the device set, then it is committed
-   *     (`commitSession` when supplied, else `SessionClient.registerAndActivate`).
+   * Remove ONE PERSON and every context they reach — and nobody else's,
+   * including when another principal independently operates the same account.
    *
-   * The resulting device-state change flows back through the `SessionClient`
-   * subscription, which re-projects the active row. Concurrent switches are
-   * ignored while one is in flight.
+   * A separate call from {@link signOutContext} because it is a separate
+   * question, not a loop over the first one: the server removes the principal
+   * and elects a replacement active context in one transition.
    */
-  async switchTo(accountId: string): Promise<boolean> {
-    if (this.switchingAccountId) return false;
-    this.switchingAccountId = accountId;
+  async signOutPrincipal(principalId: string): Promise<boolean> {
+    if (this.removingContextId || this.removingPrincipalId) return false;
+    this.removingPrincipalId = principalId;
     this.error = null;
     this.emit();
     try {
-      const state = this.sessionClient.getState();
-      const onDevice = state?.accounts.some((account) => account.accountId === accountId) ?? false;
-      if (onDevice) {
-        await this.sessionClient.switchAccount(accountId);
-      } else {
-        const result = await this.oxyServices.switchToAccount(accountId);
-        if (!result?.user || !result?.sessionId) {
-          throw new Error('Account switch did not return a valid session');
-        }
-        await this.commitAuthorizedSession(
-          {
-            sessionId: result.sessionId,
-            deviceId: result.deviceId,
-            expiresAt: result.expiresAt,
-            user: result.user,
-            accessToken: result.accessToken,
-          },
-          result.user,
-          // A switch is IN-PLACE: use the switch commit funnel (not sign-in).
-          // Cross-tab/app propagation rides the server's `session_state` socket
-          // broadcast, not a navigation.
-          { fromSwitch: true },
-        );
-      }
-      // Re-project + refetch immediately; the subscription also fires.
+      await this.sessionClient.signOutPrincipal(principalId);
       await this.refresh();
       return true;
     } catch (error) {
       this.error = errorMessage(error);
       return false;
     } finally {
-      this.switchingAccountId = null;
+      this.removingPrincipalId = null;
       this.emit();
     }
   }
@@ -1346,21 +1321,13 @@ export class AccountDialogController {
    * Register a token-planted session into the device set. Prefers the
    * consumer's commit funnel (durable persist + hydration); falls back to
    * `SessionClient.registerAndActivate` (registration + activation only).
-   *
-   * A SWITCH (`opts.fromSwitch`) uses the IN-PLACE `commitSwitchedSession` funnel;
-   * a SIGN-IN uses `commitSession`. When the switch funnel is not wired it falls
-   * back to the sign-in funnel, then to `registerAndActivate`.
    */
   private async commitAuthorizedSession(
     session: SessionLoginResponse,
     user: MinimalUserData,
-    opts?: { fromSwitch?: boolean },
   ): Promise<void> {
-    const commit = opts?.fromSwitch
-      ? this.commitSwitchedSession ?? this.commitSession
-      : this.commitSession;
-    if (commit) {
-      await commit(session);
+    if (this.commitSession) {
+      await this.commitSession(session);
     } else {
       await this.sessionClient.registerAndActivate(user.id);
     }
@@ -1490,21 +1457,16 @@ export class AccountDialogController {
   }
 
   private computeSnapshot(): AccountDialogSnapshot {
-    const state = this.sessionClient.getState();
+    const directory = this.sessionClient.getDirectory();
     return {
       view: this.view,
-      accounts: projectSwitchableAccounts({
-        state,
-        graph: this.graph,
-        profilesById: this.profilesById,
-        locale: this.locale,
-        resolveAvatarUrl: (avatar) =>
-          (avatar ? this.oxyServices.getFileDownloadUrl(avatar, 'thumb') : undefined),
-      }),
-      activeAccountId: state?.activeAccountId ?? null,
+      directory,
+      activeContext: resolveActiveContext(directory),
       loading: this.loading,
       error: this.error,
-      switchingAccountId: this.switchingAccountId,
+      activatingContextId: this.activatingContextId,
+      removingContextId: this.removingContextId,
+      removingPrincipalId: this.removingPrincipalId,
       signIn: this.signIn,
       commonsAvailability: this.commonsAvailability,
     };

package/src/session/accountSwitchTargets.ts

@@ -0,0 +1,87 @@
+/**
+ * The two questions an account chooser asks of an account-graph node: is this
+ * kind switchable at all, and may THIS caller become it.
+ *
+ * Pure and I/O-free. They live here rather than beside the surfaces that ask
+ * them because there is more than one such surface — the Console's workspace
+ * tree, the Accounts app's managed-account rows — and a second enumeration of
+ * switch targets is a second place for the rule to go missing, which is
+ * precisely how the Console went on offering `channel` rows after the rule
+ * learned to drop them.
+ *
+ * The DEVICE switcher no longer asks anything here: it renders the server's
+ * device directory (ADR 0002, `deviceDirectory.ts`), whose `available` field is
+ * the server's own authorization verdict. These predicates answer a different
+ * question — one about the caller's account GRAPH, which is a list of accounts
+ * to manage, not a list of identities the device can become.
+ */
+
+import { isActAsEligibleKind } from '@oxyhq/contracts';
+import type {
+  AccountRelationship,
+  AccountKind,
+  AccountMember,
+} from '../mixins/OxyServices.accounts';
+
+/**
+ * Whether the caller can BECOME this account — the one question every account
+ * switcher asks, answered here so no surface has to re-derive it.
+ *
+ * Two independent grounds, either of which suffices:
+ *
+ *  - **It is already the caller's own identity** (`relationship: 'self'`).
+ *    `GET /accounts` resolves its caller through `resolveOperatorId`, so `self`
+ *    is the HUMAN operator's personal account even while they are operating an
+ *    org — never the operated account. Kind is irrelevant on this ground: the
+ *    caller IS that account, so returning to it asks the server for nothing.
+ *  - **The server will mint a session for it** — `isActAsEligibleKind(kind)` is
+ *    the exact predicate `POST /accounts/:id/switch` enforces, so a row offered
+ *    on this ground is never a dead button.
+ *
+ * `isActAsEligibleKind` ALONE is not this question, and reaching for it
+ * directly is the mistake this function exists to prevent: it is false for
+ * `personal` as well as `channel`, so a switcher gated on it alone renders an
+ * empty list rather than a filtered one. Equally, `kind !== 'channel'` is not
+ * this question either — it silently admits every kind invented after it was
+ * written, which is the same trap `isActAsEligibleKind` was introduced to close
+ * on the server.
+ *
+ * Takes a structural subset rather than a whole {@link AccountNode} so a caller
+ * holding an already-projected row can ask it too.
+ */
+export function isSwitchTargetAccount(
+  node: { kind?: AccountKind | null; relationship?: AccountRelationship },
+): boolean {
+  return node.relationship === 'self' || isActAsEligibleKind(node.kind);
+}
+
+/**
+ * Whether the caller may switch INTO this account — the server-side
+ * `account:act_as` gate plus the structural {@link isSwitchTargetAccount} rule.
+ *
+ * `relationship: 'self'` always passes (returning to the caller's own personal
+ * account). Every other ground requires a switch-eligible kind AND
+ * `account:act_as` in the resolved membership permissions. When permissions are
+ * absent but the relationship is `owner`, the owner baseline is assumed — the
+ * API always resolves effective permissions for owned accounts, but test
+ * fixtures and stale rows may omit the membership blob.
+ */
+export function canSwitchIntoAccount(
+  node: {
+    kind?: AccountKind | null;
+    relationship?: AccountRelationship;
+    callerMembership?: AccountMember | null;
+  },
+): boolean {
+  if (node.relationship === 'self') {
+    return true;
+  }
+  if (!isSwitchTargetAccount(node)) {
+    return false;
+  }
+  const permissions = node.callerMembership?.permissions;
+  if (permissions) {
+    return permissions.includes('account:act_as');
+  }
+  return node.relationship === 'owner';
+}