@oxyhq/core 20.1.0 → 21.0.1

package/dist/cjs/HttpService.js

@@ -965,19 +965,46 @@ class HttpService {
         return this.deviceSecretMintInFlight;
     }
     /**
-     * Unwrap standardized API response format
+     * Unwrap the standardized API response envelope — EXCEPT when the envelope is
+     * a page, in which case it travels whole.
+     *
+     * `{ data: <payload> }` is the house success envelope (`sendSuccess`), and
+     * reducing it to `<payload>` is what every call site in the SDK expects. But
+     * the reduction DISCARDS every sibling key, silently, and a page's siblings
+     * are the only thing that says where the next page starts. That is how
+     * `GET /accounts/:id/audit` lost its `nextCursor`: the caller received a bare
+     * array, `getNextPageParam` read `undefined`, and pagination was dead past the
+     * first page with nothing to show that it was.
+     *
+     * ## Why the rule is narrow, and not "any sibling key survives"
+     *
+     * "An object carrying `data` plus anything else is not an envelope" is the
+     * tempting general rule, and it is wrong here: this API already answers
+     * `{ data, count }` on ~15 routes, plus `{ data, source }`, `{ data, reason }`
+     * and `{ data, secretDestroyed }`, and a dozen measured Console call sites
+     * type those as the bare payload (`Array<ProviderConnection>`,
+     * `AccountBillingState | null`, …). Preserving those envelopes would hand every
+     * one of them an object where it expects its payload — at runtime only, since
+     * the response type is a call-site assertion. So the rule names PAGINATION
+     * specifically: `data` beside {@link PAGE_ENVELOPE_KEYS} is a page.
+     *
+     * A route whose sibling key genuinely matters to its caller belongs in that
+     * list, or should not be a sibling of `data` at all — the cursor-paginated
+     * surfaces already in the SDK (`{ follows, nextCursor }`,
+     * `{ records, nextCursor }`) sidestep this by never using `data`.
      */
     unwrapResponse(responseData) {
-        // Handle paginated responses: { data: [...], pagination: {...} }
-        if (responseData && typeof responseData === 'object' && 'data' in responseData && 'pagination' in responseData) {
+        if (!responseData || typeof responseData !== 'object' || !('data' in responseData)) {
+            // Not the success envelope (or not an object at all) — as-is.
             return responseData;
         }
-        // Handle regular success responses: { data: ... }
-        if (responseData && typeof responseData === 'object' && 'data' in responseData && !Array.isArray(responseData)) {
-            return responseData.data;
+        // A page travels whole: its cursor/pagination sibling is unrecoverable
+        // information, not decoration.
+        if (HttpService.PAGE_ENVELOPE_KEYS.some((key) => key in responseData)) {
+            return responseData;
         }
-        // Return as-is for responses that don't use sendSuccess wrapper
-        return responseData;
+        // Regular success envelope: `{ data: ... }` -> the payload.
+        return Array.isArray(responseData) ? responseData : responseData.data;
     }
     /**
      * Update request metrics
@@ -1155,3 +1182,15 @@ exports.HttpService = HttpService;
  * ambiguous with a serialized request body.
  */
 HttpService.CACHE_IDENTITY_DELIM = ' id=';
+/**
+ * The keys whose presence beside `data` makes a body a PAGE rather than a
+ * payload — see {@link unwrapResponse} for why this list is narrow.
+ *
+ *  - `pagination` — the offset-paginated house envelope (`sendPaginated`).
+ *  - `nextCursor` — the keyset-paginated one (the account audit trails).
+ *
+ * Membership is decided by key PRESENCE, never by value: the last page sends
+ * `nextCursor: null`, and an envelope that collapsed into a bare payload
+ * exactly when the stream ended would be a worse bug than the one this fixes.
+ */
+HttpService.PAGE_ENVELOPE_KEYS = ['pagination', 'nextCursor'];

package/dist/cjs/boot/sessionColdBoot.js

@@ -18,10 +18,17 @@ exports.runSessionColdBoot = runSessionColdBoot;
  *      origin persisted a `deviceId` + `deviceSecret`, mint a short access token
  *      with a single bearer-less POST to `/session/device/token` (no cookie, no
  *      navigation) and rotate the secret in-use.
- *   3. `shared-key-signin` (native, ACCOUNT mode) — re-mint from the
- *      shared-keychain identity — OR `identity-key-signin` (IDENTITY mode) —
- *      re-mint from THIS device's primary identity key.
- *   4. Signed out.
+ *   3. `shared-device-adopt` (native, ACCOUNT mode) — this app has no credential
+ *      of its own but a sibling official app already put one in the shared native
+ *      slot: adopt it and mint. This is how a newly installed official app joins
+ *      the device's existing session WITHOUT another QR and without ever touching
+ *      the Commons private key.
+ *   4. `shared-key-signin` (native, ACCOUNT mode) — the legacy lane: re-mint by
+ *      signing with the shared-keychain IDENTITY key. Retained as a recovery /
+ *      compatibility path for devices whose apps have not yet published a shared
+ *      device credential — OR `identity-key-signin` (IDENTITY mode) — re-mint
+ *      from THIS device's primary identity key.
+ *   5. Signed out.
  *
  * Two session modes (see {@link RunSessionColdBootOptions.sessionMode}):
  *   - `account` (default) — the device's ACTIVE account owns the session. Every
@@ -40,6 +47,7 @@ const logger_1 = require("../logger");
 const cacheKey_1 = require("../utils/cacheKey");
 const refresh_1 = require("../session/refresh");
 const identitySession_1 = require("../session/identitySession");
+const sharedDeviceCredential_1 = require("../session/sharedDeviceCredential");
 /**
  * Run the device-first cold boot. Resolves to the `runColdBoot` outcome and, as
  * a side effect, invokes `onSession` (winning session, token already planted) or
@@ -239,10 +247,101 @@ async function runSessionColdBoot(opts) {
             },
         });
     }
-    else {
-        // 3. shared-key-signin (native) — re-mint from the shared identity. Native
-        //    AND online: it is a network step (challenge + verify round-trips), so it
-        //    is gated by the same offline hint as the mint lane. `{ retry: false }`
+    else if (opts.sharedDeviceCredential) {
+        // 3. shared-device-adopt (native, ACCOUNT mode) — join the device's existing
+        //    session through the shared native credential slot.
+        //
+        //    This is the lane that separates identity from session transport. What it
+        //    reads is an ordinary, individually revocable `deviceId` + `deviceSecret`
+        //    put there by a sibling official app — never the Commons private key. It
+        //    is what lets a freshly installed official app land signed in with no QR,
+        //    and it is why an ordinary app never needs identity-key access at all.
+        //
+        //    `decideSharedDeviceJoin` gates it: an app that already holds its own
+        //    credential is never moved, and an UNREADABLE slot is never mistaken for
+        //    an empty one. The lane therefore cannot sign anyone out, in either
+        //    upgrade order.
+        const sharedSlot = opts.sharedDeviceCredential;
+        steps.push({
+            id: 'shared-device-adopt',
+            // The adoption itself is local, but it is only worth committing alongside
+            // a mint that proves the credential — so the whole lane is online-gated
+            // like every other network step.
+            enabled: () => isNative && !isOffline(),
+            run: async () => {
+                const before = await store.load();
+                const decision = (0, sharedDeviceCredential_1.decideSharedDeviceJoin)(before, await sharedSlot.read());
+                if (decision.action === 'skip') {
+                    logger_1.logger.debug(`shared device credential not adopted (${decision.reason})`, { component: 'sessionColdBoot', method: 'shared-device-adopt' });
+                    return { kind: 'skip' };
+                }
+                // Restore the store to exactly what it held before this lane touched it.
+                // A credential we adopted and could not prove must not be left behind for
+                // the next boot's mint lane to keep retrying.
+                const revert = async () => {
+                    if (before) {
+                        await store.save(before);
+                    }
+                    else {
+                        await store.clear();
+                    }
+                };
+                const adopted = {
+                    // The mint fills both in from the device's live state; carrying the
+                    // previous session's ids into a different device session would be a
+                    // lie for however long the mint takes.
+                    sessionId: '',
+                    userId: '',
+                    deviceId: decision.credential.deviceId,
+                    deviceSecret: decision.credential.deviceSecret,
+                };
+                if (!(await store.save(adopted))) {
+                    logger_1.logger.error('adopted the shared device credential but it could not be durably persisted — reverting', undefined, { component: 'sessionColdBoot', method: 'shared-device-adopt' });
+                    await revert();
+                    return { kind: 'skip' };
+                }
+                const result = await (0, refresh_1.refreshDeviceSecretArm)({ oxy, store, pin: null });
+                if (result.status === 'ok') {
+                    return {
+                        kind: 'session',
+                        session: {
+                            sessionId: result.sessionId,
+                            userId: result.userId,
+                            accessToken: result.token,
+                        },
+                    };
+                }
+                if (result.status === 'invalid-secret') {
+                    // The one place we hold POSITIVE proof that the exact bytes in the
+                    // shared slot are dead — the server rejected them by name. Clearing it
+                    // signs nobody out (a credential the server does not recognise cannot
+                    // be minting for anyone) and it is what stops a dead credential from
+                    // blocking every future install: a stale slot owned by a different
+                    // `deviceId` is otherwise never overwritten, by design.
+                    await sharedSlot.clear();
+                }
+                else if (result.status === 'no-session') {
+                    signedOutReason = 'no_session';
+                }
+                await revert();
+                return { kind: 'skip' };
+            },
+        });
+    }
+    if (identityBinding === null) {
+        // 4. shared-key-signin (native) — the RECOVERY / COMPATIBILITY lane: sign a
+        //    challenge with the shared-keychain IDENTITY key to re-mint a session.
+        //
+        //    It runs LAST on purpose. Using the self-custody key to obtain an ordinary
+        //    session is the over-sharing #937 sets out to end, so it is now reachable
+        //    only on a device where no sibling app has published a shared device
+        //    credential yet — an install that predates this lane, or one where the
+        //    shared slot is unreadable. Its own `store.save` below feeds the shared
+        //    slot through the mirroring store, so the FIRST boot that takes this lane
+        //    is also the last one that needs to: every later app joins by credential.
+        //
+        //    Native AND online: it is a network step (challenge + verify round-trips),
+        //    so it is gated by the same offline hint as the mint lane. `{ retry: false }`
         //    keeps the two round-trips as single attempts — the refresh scheduler /
         //    401 lane own later retries — so this step cannot multiply boot latency.
         steps.push({

package/dist/cjs/i18n/locales/en-US.json

@@ -396,13 +396,22 @@
             "remoteSignOutFailed": "There was a problem signing out from the device. Please try again.",
             "noOtherDeviceSessions": "No other device sessions found to sign out from.",
             "signOutOthersSuccess": "Signed out from all other devices successfully!",
-            "signOutOthersFailed": "There was a problem signing out from other devices. Please try again."
+            "signOutOthersFailed": "There was a problem signing out from other devices. Please try again.",
+            "contextRemoved": "Removed {{account}}",
+            "contextRemoveFailed": "There was a problem removing that account. Please try again.",
+            "principalRemoved": "Signed {{name}} out of this device",
+            "principalRemoveFailed": "There was a problem signing that person out. Please try again.",
+            "activateFailed": "There was a problem switching accounts. Please try again."
         },
         "confirms": {
             "remove": "Are you sure you want to remove {{displayName}} from this device? You'll need to sign in again to access this account.",
             "logoutAll": "Are you sure you want to sign out of all accounts? This will remove all saved accounts from this device.",
             "remoteLogout": "Are you sure you want to sign out from \"{{deviceName}}\"? This will end the session on that device.",
-            "logoutOthers": "Are you sure you want to sign out from all {{count}} other device(s)? This will end sessions on all other devices except this one."
+            "logoutOthers": "Are you sure you want to sign out from all {{count}} other device(s)? This will end sessions on all other devices except this one.",
+            "removeContextTitle": "Remove this account?",
+            "removeContext": "Stop {{person}} acting as {{account}} on this device? Anyone else who reaches {{account}} here keeps their access.",
+            "removePrincipalTitle": "Sign out of this device?",
+            "removePrincipal": "Sign {{name}} out of this device? Every account they reach here is removed. Nobody else is affected."
         },
         "device": {
             "loadingTitle": "Loading device sessions...",
@@ -439,6 +448,14 @@
             "openedInCommons": "Opened in Commons",
             "confirming": "Confirming identity",
             "confirmed": "Identity confirmed"
+        },
+        "context": {
+            "unavailable": "Unavailable right now",
+            "operatedBy": "Operated by {{name}}",
+            "remove": "Remove {{account}} from {{person}}"
+        },
+        "principal": {
+            "signOut": "Sign {{name}} out of this device"
         }
     },
     "reputation": {
@@ -2119,8 +2136,13 @@
             "filesWrite": "Upload and modify your files",
             "filesDelete": "Delete your files",
             "webhooksReceive": "Receive webhooks",
-            "chatCompletions": "Use AI chat on your behalf",
-            "modelsRead": "List available AI models",
+            "inferenceInvoke": "Run AI requests on your behalf",
+            "inferenceModelsRead": "List available AI models",
+            "inferenceUsageRead": "Read its AI usage and costs",
+            "inferenceRoutingRead": "Read how AI requests are routed",
+            "inferenceRoutingWrite": "Change how AI requests are routed",
+            "inferenceProvidersRead": "Read its connected AI providers",
+            "inferenceProvidersWrite": "Manage its connected AI providers",
             "federationWrite": "Act across federated services"
         },
         "account": {

package/dist/cjs/i18n/locales/es-ES.json

@@ -636,13 +636,22 @@
             "remoteSignOutFailed": "Hubo un problema al cerrar sesión en el dispositivo. Inténtalo de nuevo.",
             "noOtherDeviceSessions": "No se encontraron otras sesiones de dispositivo para cerrar.",
             "signOutOthersSuccess": "¡Sesiones cerradas correctamente en los demás dispositivos!",
-            "signOutOthersFailed": "Hubo un problema al cerrar sesión en otros dispositivos. Inténtalo de nuevo."
+            "signOutOthersFailed": "Hubo un problema al cerrar sesión en otros dispositivos. Inténtalo de nuevo.",
+            "contextRemoved": "Se quitó {{account}}",
+            "contextRemoveFailed": "Hubo un problema al quitar esa cuenta. Inténtalo de nuevo.",
+            "principalRemoved": "Se cerró la sesión de {{name}} en este dispositivo",
+            "principalRemoveFailed": "Hubo un problema al cerrar esa sesión. Inténtalo de nuevo.",
+            "activateFailed": "Hubo un problema al cambiar de cuenta. Inténtalo de nuevo."
         },
         "confirms": {
             "remove": "¿Seguro que quieres eliminar a {{displayName}} de este dispositivo? Tendrás que iniciar sesión de nuevo para acceder a esta cuenta.",
             "logoutAll": "¿Seguro que quieres cerrar sesión en todas las cuentas? Esto eliminará todas las cuentas guardadas de este dispositivo.",
             "remoteLogout": "¿Seguro que quieres cerrar sesión en \"{{deviceName}}\"? Esto finalizará la sesión en ese dispositivo.",
-            "logoutOthers": "¿Seguro que quieres cerrar sesión en los otros {{count}} dispositivo(s)? Esto finalizará las sesiones en todos los demás dispositivos excepto en este."
+            "logoutOthers": "¿Seguro que quieres cerrar sesión en los otros {{count}} dispositivo(s)? Esto finalizará las sesiones en todos los demás dispositivos excepto en este.",
+            "removeContextTitle": "¿Quitar esta cuenta?",
+            "removeContext": "¿Dejar de usar {{account}} como {{person}} en este dispositivo? Quien más acceda a {{account}} aquí lo conserva.",
+            "removePrincipalTitle": "¿Cerrar sesión en este dispositivo?",
+            "removePrincipal": "¿Cerrar la sesión de {{name}} en este dispositivo? Se quitan todas las cuentas a las que llega desde aquí. No afecta a nadie más."
         },
         "device": {
             "loadingTitle": "Cargando sesiones de dispositivo...",
@@ -679,6 +688,14 @@
             "openedInCommons": "Abierto en Commons",
             "confirming": "Confirmando identidad",
             "confirmed": "Identidad confirmada"
+        },
+        "context": {
+            "unavailable": "No disponible ahora mismo",
+            "operatedBy": "Gestionada por {{name}}",
+            "remove": "Quitar {{account}} de {{person}}"
+        },
+        "principal": {
+            "signOut": "Cerrar la sesión de {{name}} en este dispositivo"
         }
     },
     "feedback": {
@@ -2119,8 +2136,13 @@
             "filesWrite": "Subir y modificar tus archivos",
             "filesDelete": "Eliminar tus archivos",
             "webhooksReceive": "Recibir webhooks",
-            "chatCompletions": "Usar el chat con IA en tu nombre",
-            "modelsRead": "Ver los modelos de IA disponibles",
+            "inferenceInvoke": "Ejecutar peticiones de IA en tu nombre",
+            "inferenceModelsRead": "Ver los modelos de IA disponibles",
+            "inferenceUsageRead": "Ver su consumo y costes de IA",
+            "inferenceRoutingRead": "Ver cómo se enrutan las peticiones de IA",
+            "inferenceRoutingWrite": "Cambiar cómo se enrutan las peticiones de IA",
+            "inferenceProvidersRead": "Ver sus proveedores de IA conectados",
+            "inferenceProvidersWrite": "Gestionar sus proveedores de IA conectados",
             "federationWrite": "Actuar en servicios federados"
         },
         "account": {

package/dist/cjs/i18n/locales/locales/en-US.json

@@ -396,13 +396,22 @@
       "remoteSignOutFailed": "There was a problem signing out from the device. Please try again.",
       "noOtherDeviceSessions": "No other device sessions found to sign out from.",
       "signOutOthersSuccess": "Signed out from all other devices successfully!",
-      "signOutOthersFailed": "There was a problem signing out from other devices. Please try again."
+      "signOutOthersFailed": "There was a problem signing out from other devices. Please try again.",
+      "contextRemoved": "Removed {{account}}",
+      "contextRemoveFailed": "There was a problem removing that account. Please try again.",
+      "principalRemoved": "Signed {{name}} out of this device",
+      "principalRemoveFailed": "There was a problem signing that person out. Please try again.",
+      "activateFailed": "There was a problem switching accounts. Please try again."
     },
     "confirms": {
       "remove": "Are you sure you want to remove {{displayName}} from this device? You'll need to sign in again to access this account.",
       "logoutAll": "Are you sure you want to sign out of all accounts? This will remove all saved accounts from this device.",
       "remoteLogout": "Are you sure you want to sign out from \"{{deviceName}}\"? This will end the session on that device.",
-      "logoutOthers": "Are you sure you want to sign out from all {{count}} other device(s)? This will end sessions on all other devices except this one."
+      "logoutOthers": "Are you sure you want to sign out from all {{count}} other device(s)? This will end sessions on all other devices except this one.",
+      "removeContextTitle": "Remove this account?",
+      "removeContext": "Stop {{person}} acting as {{account}} on this device? Anyone else who reaches {{account}} here keeps their access.",
+      "removePrincipalTitle": "Sign out of this device?",
+      "removePrincipal": "Sign {{name}} out of this device? Every account they reach here is removed. Nobody else is affected."
     },
     "device": {
       "loadingTitle": "Loading device sessions...",
@@ -439,6 +448,14 @@
       "openedInCommons": "Opened in Commons",
       "confirming": "Confirming identity",
       "confirmed": "Identity confirmed"
+    },
+    "context": {
+      "unavailable": "Unavailable right now",
+      "operatedBy": "Operated by {{name}}",
+      "remove": "Remove {{account}} from {{person}}"
+    },
+    "principal": {
+      "signOut": "Sign {{name}} out of this device"
     }
   },
   "reputation": {
@@ -2119,8 +2136,13 @@
       "filesWrite": "Upload and modify your files",
       "filesDelete": "Delete your files",
       "webhooksReceive": "Receive webhooks",
-      "chatCompletions": "Use AI chat on your behalf",
-      "modelsRead": "List available AI models",
+      "inferenceInvoke": "Run AI requests on your behalf",
+      "inferenceModelsRead": "List available AI models",
+      "inferenceUsageRead": "Read its AI usage and costs",
+      "inferenceRoutingRead": "Read how AI requests are routed",
+      "inferenceRoutingWrite": "Change how AI requests are routed",
+      "inferenceProvidersRead": "Read its connected AI providers",
+      "inferenceProvidersWrite": "Manage its connected AI providers",
       "federationWrite": "Act across federated services"
     },
     "account": {

package/dist/cjs/i18n/locales/locales/es-ES.json

@@ -636,13 +636,22 @@
       "remoteSignOutFailed": "Hubo un problema al cerrar sesión en el dispositivo. Inténtalo de nuevo.",
       "noOtherDeviceSessions": "No se encontraron otras sesiones de dispositivo para cerrar.",
       "signOutOthersSuccess": "¡Sesiones cerradas correctamente en los demás dispositivos!",
-      "signOutOthersFailed": "Hubo un problema al cerrar sesión en otros dispositivos. Inténtalo de nuevo."
+      "signOutOthersFailed": "Hubo un problema al cerrar sesión en otros dispositivos. Inténtalo de nuevo.",
+      "contextRemoved": "Se quitó {{account}}",
+      "contextRemoveFailed": "Hubo un problema al quitar esa cuenta. Inténtalo de nuevo.",
+      "principalRemoved": "Se cerró la sesión de {{name}} en este dispositivo",
+      "principalRemoveFailed": "Hubo un problema al cerrar esa sesión. Inténtalo de nuevo.",
+      "activateFailed": "Hubo un problema al cambiar de cuenta. Inténtalo de nuevo."
     },
     "confirms": {
       "remove": "¿Seguro que quieres eliminar a {{displayName}} de este dispositivo? Tendrás que iniciar sesión de nuevo para acceder a esta cuenta.",
       "logoutAll": "¿Seguro que quieres cerrar sesión en todas las cuentas? Esto eliminará todas las cuentas guardadas de este dispositivo.",
       "remoteLogout": "¿Seguro que quieres cerrar sesión en \"{{deviceName}}\"? Esto finalizará la sesión en ese dispositivo.",
-      "logoutOthers": "¿Seguro que quieres cerrar sesión en los otros {{count}} dispositivo(s)? Esto finalizará las sesiones en todos los demás dispositivos excepto en este."
+      "logoutOthers": "¿Seguro que quieres cerrar sesión en los otros {{count}} dispositivo(s)? Esto finalizará las sesiones en todos los demás dispositivos excepto en este.",
+      "removeContextTitle": "¿Quitar esta cuenta?",
+      "removeContext": "¿Dejar de usar {{account}} como {{person}} en este dispositivo? Quien más acceda a {{account}} aquí lo conserva.",
+      "removePrincipalTitle": "¿Cerrar sesión en este dispositivo?",
+      "removePrincipal": "¿Cerrar la sesión de {{name}} en este dispositivo? Se quitan todas las cuentas a las que llega desde aquí. No afecta a nadie más."
     },
     "device": {
       "loadingTitle": "Cargando sesiones de dispositivo...",
@@ -679,6 +688,14 @@
       "openedInCommons": "Abierto en Commons",
       "confirming": "Confirmando identidad",
       "confirmed": "Identidad confirmada"
+    },
+    "context": {
+      "unavailable": "No disponible ahora mismo",
+      "operatedBy": "Gestionada por {{name}}",
+      "remove": "Quitar {{account}} de {{person}}"
+    },
+    "principal": {
+      "signOut": "Cerrar la sesión de {{name}} en este dispositivo"
     }
   },
   "feedback": {
@@ -2119,8 +2136,13 @@
       "filesWrite": "Subir y modificar tus archivos",
       "filesDelete": "Eliminar tus archivos",
       "webhooksReceive": "Recibir webhooks",
-      "chatCompletions": "Usar el chat con IA en tu nombre",
-      "modelsRead": "Ver los modelos de IA disponibles",
+      "inferenceInvoke": "Ejecutar peticiones de IA en tu nombre",
+      "inferenceModelsRead": "Ver los modelos de IA disponibles",
+      "inferenceUsageRead": "Ver su consumo y costes de IA",
+      "inferenceRoutingRead": "Ver cómo se enrutan las peticiones de IA",
+      "inferenceRoutingWrite": "Cambiar cómo se enrutan las peticiones de IA",
+      "inferenceProvidersRead": "Ver sus proveedores de IA conectados",
+      "inferenceProvidersWrite": "Gestionar sus proveedores de IA conectados",
       "federationWrite": "Actuar en servicios federados"
     },
     "account": {

package/dist/cjs/index.js

@@ -21,8 +21,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AEAD_KEY_LENGTH = exports.decryptAead = exports.encryptAead = exports.hkdfSha256 = exports.RecoveryPhraseService = exports.SignatureService = exports.updateIdentityMarker = exports.readIdentityMarker = exports.IdentityUnavailableError = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.kindAcceptsAccountCategories = exports.isSelectableAccountCategoryId = exports.SELECTABLE_ACCOUNT_CATEGORY_IDS = exports.MAX_ACCOUNT_CATEGORIES = exports.ACCOUNT_CATEGORY_IDS = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.commonsDeliveryPlatform = exports.pushTargetsFromDelivery = exports.selectCommonsDelivery = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.ServiceAssetMetadataError = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.AssetUrlResolutionError = exports.OxyServices = void 0;
 exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = void 0;
 exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.isValidDisplayName = exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = exports.DISPLAY_NAME_INVALID_MESSAGE = exports.MAX_DISPLAY_NAME_LENGTH = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.parseHttpErrorBody = exports.isHttpRequestError = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.buildQueryParams = exports.trustTierLabel = exports.reputationCategoryLabel = exports.accountRoleLabel = exports.accountCategoryLabel = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = void 0;
-exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.canSwitchIntoAccount = exports.isSwitchTargetAccount = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.isOxyRpOrigin = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = void 0;
-exports.packageInfo = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AccountNotOnDeviceError = exports.establishIdentitySession = exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = exports.createMemoryIdentityPinStore = exports.createNativeIdentityPinStore = exports.createWebIdentityPinStore = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = void 0;
+exports.projectDevicePrincipals = exports.directoryHandle = exports.directoryDisplayName = exports.canActivateContext = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.isOxyRpOrigin = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = void 0;
+exports.packageInfo = exports.runSessionColdBoot = exports.OXY_INFERENCE_BASE_URL = exports.OxyInferenceError = exports.OxyInferenceClient = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AccountNotOnDeviceError = exports.establishIdentitySession = exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = exports.createMemoryIdentityPinStore = exports.createNativeIdentityPinStore = exports.createWebIdentityPinStore = exports.readLocalDeviceCredential = exports.publishProvenDeviceCredential = exports.normalizeSharedDeviceSessionRead = exports.decideSharedDevicePublish = exports.decideSharedDeviceJoin = exports.createSharedMirroringAuthStateStore = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.canSwitchIntoAccount = exports.isSwitchTargetAccount = exports.showsPrincipalHeaders = exports.buildSwitcherRows = exports.resolveDeviceContext = exports.resolveActiveContext = void 0;
 // Ensure crypto polyfills are loaded before anything else
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
@@ -376,20 +376,42 @@ Object.defineProperty(exports, "deviceStateToClientSessions", { enumerable: true
 Object.defineProperty(exports, "activeSessionIdOf", { enumerable: true, get: function () { return projectSessionState_1.activeSessionIdOf; } });
 Object.defineProperty(exports, "activeUserOf", { enumerable: true, get: function () { return projectSessionState_1.activeUserOf; } });
 Object.defineProperty(exports, "accountIdsOf", { enumerable: true, get: function () { return projectSessionState_1.accountIdsOf; } });
-// Unified account-list projection (THE single source of truth for the account
-// chooser: device sign-ins ∪ account graph, deduped by accountId). Pure +
-// I/O-free — the caller hydrates profiles via `getUsersByIds`. Shared by
-// `@oxyhq/services` and auth.oxy.so so the list can't diverge.
-// `isSwitchTargetAccount` is the structural half ("is this kind switchable at
-// all?"); `canSwitchIntoAccount` adds the caller's `account:act_as` permission.
-// Both are exported so surfaces that render `AccountNode`s rather than the
-// projection — the Console workspace switcher, managed-accounts rows — ask the
-// SAME questions instead of testing a kind literal.
-var accountProjection_1 = require("./session/accountProjection");
-Object.defineProperty(exports, "isSwitchTargetAccount", { enumerable: true, get: function () { return accountProjection_1.isSwitchTargetAccount; } });
-Object.defineProperty(exports, "canSwitchIntoAccount", { enumerable: true, get: function () { return accountProjection_1.canSwitchIntoAccount; } });
-Object.defineProperty(exports, "projectSwitchableAccounts", { enumerable: true, get: function () { return accountProjection_1.projectSwitchableAccounts; } });
-Object.defineProperty(exports, "switchableAccountIds", { enumerable: true, get: function () { return accountProjection_1.switchableAccountIds; } });
+// Pure projections over the device DIRECTORY (`GET /session/device/directory`,
+// ADR 0002) — the read model that keeps the actor (the human who authenticated)
+// and the subject (the account being acted as) apart. The flat
+// `DeviceSessionState` collapses them into one row, so it can neither tell
+// "signed in as an org" from "a person operating that org" nor hold two people
+// reaching the same org on one device.
+// `canActivateContext` is the switchability question — `available` alone, never
+// composed with `onDevice`, which is a different fact in both directions.
+// `projectDevicePrincipals` is the switcher's shape: people, each with what
+// they may become. Grouped rather than flat because the same organization
+// reached through two people is TWO rows under two humans, which a list keyed
+// by account cannot say.
+var deviceDirectory_1 = require("./session/deviceDirectory");
+Object.defineProperty(exports, "canActivateContext", { enumerable: true, get: function () { return deviceDirectory_1.canActivateContext; } });
+Object.defineProperty(exports, "directoryDisplayName", { enumerable: true, get: function () { return deviceDirectory_1.directoryDisplayName; } });
+Object.defineProperty(exports, "directoryHandle", { enumerable: true, get: function () { return deviceDirectory_1.directoryHandle; } });
+Object.defineProperty(exports, "projectDevicePrincipals", { enumerable: true, get: function () { return deviceDirectory_1.projectDevicePrincipals; } });
+Object.defineProperty(exports, "resolveActiveContext", { enumerable: true, get: function () { return deviceDirectory_1.resolveActiveContext; } });
+Object.defineProperty(exports, "resolveDeviceContext", { enumerable: true, get: function () { return deviceDirectory_1.resolveDeviceContext; } });
+// The switcher's RENDER model over that projection — names, handles and avatar
+// URLs resolved once. Shared by `@oxyhq/services`' account dialog and the
+// auth.oxy.so chooser so the two cannot drift, the same reason the flat
+// projection lived here before it.
+var deviceSwitcherRows_1 = require("./session/deviceSwitcherRows");
+Object.defineProperty(exports, "buildSwitcherRows", { enumerable: true, get: function () { return deviceSwitcherRows_1.buildSwitcherRows; } });
+Object.defineProperty(exports, "showsPrincipalHeaders", { enumerable: true, get: function () { return deviceSwitcherRows_1.showsPrincipalHeaders; } });
+// The switch-target predicates over the account GRAPH — a list of accounts to
+// manage, not the device's list of identities to become (that is the directory
+// above). `isSwitchTargetAccount` is the structural half ("is this kind
+// switchable at all?"); `canSwitchIntoAccount` adds the caller's
+// `account:act_as` permission. Exported so the surfaces that render
+// `AccountNode`s — the Console workspace switcher, managed-accounts rows — ask
+// the SAME questions instead of testing a kind literal.
+var accountSwitchTargets_1 = require("./session/accountSwitchTargets");
+Object.defineProperty(exports, "isSwitchTargetAccount", { enumerable: true, get: function () { return accountSwitchTargets_1.isSwitchTargetAccount; } });
+Object.defineProperty(exports, "canSwitchIntoAccount", { enumerable: true, get: function () { return accountSwitchTargets_1.canSwitchIntoAccount; } });
 // Headless controller for the unified account dialog. Framework-agnostic
 // state machine + subscribe/getSnapshot store (bind via `useSyncExternalStore`)
 // — sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff;
@@ -411,6 +433,18 @@ Object.defineProperty(exports, "createWebAuthStateStore", { enumerable: true, ge
 Object.defineProperty(exports, "createNativeAuthStateStore", { enumerable: true, get: function () { return authStateStore_1.createNativeAuthStateStore; } });
 Object.defineProperty(exports, "createMemoryAuthStateStore", { enumerable: true, get: function () { return authStateStore_1.createMemoryAuthStateStore; } });
 Object.defineProperty(exports, "AUTH_STATE_STORAGE_KEY", { enumerable: true, get: function () { return authStateStore_1.AUTH_STATE_STORAGE_KEY; } });
+// The shared NATIVE DeviceSession credential — how several official apps on one
+// device end up on ONE `DeviceSession` and therefore one active context. It is an
+// ordinary rotatable/revocable `deviceId` + `deviceSecret`, deliberately NOT the
+// Commons private identity key: an app that only needs a session must never be
+// handed the key that signs identity approvals.
+var sharedDeviceCredential_1 = require("./session/sharedDeviceCredential");
+Object.defineProperty(exports, "createSharedMirroringAuthStateStore", { enumerable: true, get: function () { return sharedDeviceCredential_1.createSharedMirroringAuthStateStore; } });
+Object.defineProperty(exports, "decideSharedDeviceJoin", { enumerable: true, get: function () { return sharedDeviceCredential_1.decideSharedDeviceJoin; } });
+Object.defineProperty(exports, "decideSharedDevicePublish", { enumerable: true, get: function () { return sharedDeviceCredential_1.decideSharedDevicePublish; } });
+Object.defineProperty(exports, "normalizeSharedDeviceSessionRead", { enumerable: true, get: function () { return sharedDeviceCredential_1.normalizeSharedDeviceSessionRead; } });
+Object.defineProperty(exports, "publishProvenDeviceCredential", { enumerable: true, get: function () { return sharedDeviceCredential_1.publishProvenDeviceCredential; } });
+Object.defineProperty(exports, "readLocalDeviceCredential", { enumerable: true, get: function () { return sharedDeviceCredential_1.readLocalDeviceCredential; } });
 // Identity-bound sessions (the identity vault). The pin is the durable
 // `{publicKey, accountId}` binding between this device's PRIMARY identity key
 // and the account it authenticates as; it is what keeps such a client from
@@ -436,6 +470,13 @@ Object.defineProperty(exports, "createAuthRefreshHandler", { enumerable: true, g
 Object.defineProperty(exports, "installAuthRefreshHandler", { enumerable: true, get: function () { return refresh_1.installAuthRefreshHandler; } });
 Object.defineProperty(exports, "startTokenRefreshScheduler", { enumerable: true, get: function () { return refresh_1.startTokenRefreshScheduler; } });
 Object.defineProperty(exports, "TOKEN_REFRESH_LEAD_MS", { enumerable: true, get: function () { return refresh_1.TOKEN_REFRESH_LEAD_MS; } });
+// The inference API. `oxyServices.inference()` binds the session bearer into
+// the same client an external developer constructs with an `oxy_sk_…` machine
+// key — one surface, two credential lanes. See `docs/inference/sdk.md`.
+var OxyInferenceClient_1 = require("./inference/OxyInferenceClient");
+Object.defineProperty(exports, "OxyInferenceClient", { enumerable: true, get: function () { return OxyInferenceClient_1.OxyInferenceClient; } });
+Object.defineProperty(exports, "OxyInferenceError", { enumerable: true, get: function () { return OxyInferenceClient_1.OxyInferenceError; } });
+Object.defineProperty(exports, "OXY_INFERENCE_BASE_URL", { enumerable: true, get: function () { return OxyInferenceClient_1.OXY_INFERENCE_BASE_URL; } });
 var sessionColdBoot_1 = require("./boot/sessionColdBoot");
 Object.defineProperty(exports, "runSessionColdBoot", { enumerable: true, get: function () { return sessionColdBoot_1.runSessionColdBoot; } });
 // API response contracts (request/response Zod schemas + inferred types) live in