@oxyhq/core 20.1.0 → 21.0.1

package/dist/esm/HttpService.js

@@ -962,19 +962,46 @@ export class HttpService {
         return this.deviceSecretMintInFlight;
     }
     /**
-     * Unwrap standardized API response format
+     * Unwrap the standardized API response envelope — EXCEPT when the envelope is
+     * a page, in which case it travels whole.
+     *
+     * `{ data: <payload> }` is the house success envelope (`sendSuccess`), and
+     * reducing it to `<payload>` is what every call site in the SDK expects. But
+     * the reduction DISCARDS every sibling key, silently, and a page's siblings
+     * are the only thing that says where the next page starts. That is how
+     * `GET /accounts/:id/audit` lost its `nextCursor`: the caller received a bare
+     * array, `getNextPageParam` read `undefined`, and pagination was dead past the
+     * first page with nothing to show that it was.
+     *
+     * ## Why the rule is narrow, and not "any sibling key survives"
+     *
+     * "An object carrying `data` plus anything else is not an envelope" is the
+     * tempting general rule, and it is wrong here: this API already answers
+     * `{ data, count }` on ~15 routes, plus `{ data, source }`, `{ data, reason }`
+     * and `{ data, secretDestroyed }`, and a dozen measured Console call sites
+     * type those as the bare payload (`Array<ProviderConnection>`,
+     * `AccountBillingState | null`, …). Preserving those envelopes would hand every
+     * one of them an object where it expects its payload — at runtime only, since
+     * the response type is a call-site assertion. So the rule names PAGINATION
+     * specifically: `data` beside {@link PAGE_ENVELOPE_KEYS} is a page.
+     *
+     * A route whose sibling key genuinely matters to its caller belongs in that
+     * list, or should not be a sibling of `data` at all — the cursor-paginated
+     * surfaces already in the SDK (`{ follows, nextCursor }`,
+     * `{ records, nextCursor }`) sidestep this by never using `data`.
      */
     unwrapResponse(responseData) {
-        // Handle paginated responses: { data: [...], pagination: {...} }
-        if (responseData && typeof responseData === 'object' && 'data' in responseData && 'pagination' in responseData) {
+        if (!responseData || typeof responseData !== 'object' || !('data' in responseData)) {
+            // Not the success envelope (or not an object at all) — as-is.
             return responseData;
         }
-        // Handle regular success responses: { data: ... }
-        if (responseData && typeof responseData === 'object' && 'data' in responseData && !Array.isArray(responseData)) {
-            return responseData.data;
+        // A page travels whole: its cursor/pagination sibling is unrecoverable
+        // information, not decoration.
+        if (HttpService.PAGE_ENVELOPE_KEYS.some((key) => key in responseData)) {
+            return responseData;
         }
-        // Return as-is for responses that don't use sendSuccess wrapper
-        return responseData;
+        // Regular success envelope: `{ data: ... }` -> the payload.
+        return Array.isArray(responseData) ? responseData : responseData.data;
     }
     /**
      * Update request metrics
@@ -1151,3 +1178,15 @@ export class HttpService {
  * ambiguous with a serialized request body.
  */
 HttpService.CACHE_IDENTITY_DELIM = ' id=';
+/**
+ * The keys whose presence beside `data` makes a body a PAGE rather than a
+ * payload — see {@link unwrapResponse} for why this list is narrow.
+ *
+ *  - `pagination` — the offset-paginated house envelope (`sendPaginated`).
+ *  - `nextCursor` — the keyset-paginated one (the account audit trails).
+ *
+ * Membership is decided by key PRESENCE, never by value: the last page sends
+ * `nextCursor: null`, and an envelope that collapsed into a bare payload
+ * exactly when the stream ended would be a worse bug than the one this fixes.
+ */
+HttpService.PAGE_ENVELOPE_KEYS = ['pagination', 'nextCursor'];

package/dist/esm/boot/sessionColdBoot.js

@@ -15,10 +15,17 @@
  *      origin persisted a `deviceId` + `deviceSecret`, mint a short access token
  *      with a single bearer-less POST to `/session/device/token` (no cookie, no
  *      navigation) and rotate the secret in-use.
- *   3. `shared-key-signin` (native, ACCOUNT mode) — re-mint from the
- *      shared-keychain identity — OR `identity-key-signin` (IDENTITY mode) —
- *      re-mint from THIS device's primary identity key.
- *   4. Signed out.
+ *   3. `shared-device-adopt` (native, ACCOUNT mode) — this app has no credential
+ *      of its own but a sibling official app already put one in the shared native
+ *      slot: adopt it and mint. This is how a newly installed official app joins
+ *      the device's existing session WITHOUT another QR and without ever touching
+ *      the Commons private key.
+ *   4. `shared-key-signin` (native, ACCOUNT mode) — the legacy lane: re-mint by
+ *      signing with the shared-keychain IDENTITY key. Retained as a recovery /
+ *      compatibility path for devices whose apps have not yet published a shared
+ *      device credential — OR `identity-key-signin` (IDENTITY mode) — re-mint
+ *      from THIS device's primary identity key.
+ *   5. Signed out.
  *
  * Two session modes (see {@link RunSessionColdBootOptions.sessionMode}):
  *   - `account` (default) — the device's ACTIVE account owns the session. Every
@@ -37,6 +44,7 @@ import { logger } from '../logger/index.js';
 import { computeIdentityTag } from '../utils/cacheKey.js';
 import { TOKEN_REFRESH_LEAD_MS, refreshDeviceSecretArm } from '../session/refresh.js';
 import { establishIdentitySession, resolveIdentityPin, } from '../session/identitySession.js';
+import { decideSharedDeviceJoin, } from '../session/sharedDeviceCredential.js';
 /**
  * Run the device-first cold boot. Resolves to the `runColdBoot` outcome and, as
  * a side effect, invokes `onSession` (winning session, token already planted) or
@@ -236,10 +244,101 @@ export async function runSessionColdBoot(opts) {
             },
         });
     }
-    else {
-        // 3. shared-key-signin (native) — re-mint from the shared identity. Native
-        //    AND online: it is a network step (challenge + verify round-trips), so it
-        //    is gated by the same offline hint as the mint lane. `{ retry: false }`
+    else if (opts.sharedDeviceCredential) {
+        // 3. shared-device-adopt (native, ACCOUNT mode) — join the device's existing
+        //    session through the shared native credential slot.
+        //
+        //    This is the lane that separates identity from session transport. What it
+        //    reads is an ordinary, individually revocable `deviceId` + `deviceSecret`
+        //    put there by a sibling official app — never the Commons private key. It
+        //    is what lets a freshly installed official app land signed in with no QR,
+        //    and it is why an ordinary app never needs identity-key access at all.
+        //
+        //    `decideSharedDeviceJoin` gates it: an app that already holds its own
+        //    credential is never moved, and an UNREADABLE slot is never mistaken for
+        //    an empty one. The lane therefore cannot sign anyone out, in either
+        //    upgrade order.
+        const sharedSlot = opts.sharedDeviceCredential;
+        steps.push({
+            id: 'shared-device-adopt',
+            // The adoption itself is local, but it is only worth committing alongside
+            // a mint that proves the credential — so the whole lane is online-gated
+            // like every other network step.
+            enabled: () => isNative && !isOffline(),
+            run: async () => {
+                const before = await store.load();
+                const decision = decideSharedDeviceJoin(before, await sharedSlot.read());
+                if (decision.action === 'skip') {
+                    logger.debug(`shared device credential not adopted (${decision.reason})`, { component: 'sessionColdBoot', method: 'shared-device-adopt' });
+                    return { kind: 'skip' };
+                }
+                // Restore the store to exactly what it held before this lane touched it.
+                // A credential we adopted and could not prove must not be left behind for
+                // the next boot's mint lane to keep retrying.
+                const revert = async () => {
+                    if (before) {
+                        await store.save(before);
+                    }
+                    else {
+                        await store.clear();
+                    }
+                };
+                const adopted = {
+                    // The mint fills both in from the device's live state; carrying the
+                    // previous session's ids into a different device session would be a
+                    // lie for however long the mint takes.
+                    sessionId: '',
+                    userId: '',
+                    deviceId: decision.credential.deviceId,
+                    deviceSecret: decision.credential.deviceSecret,
+                };
+                if (!(await store.save(adopted))) {
+                    logger.error('adopted the shared device credential but it could not be durably persisted — reverting', undefined, { component: 'sessionColdBoot', method: 'shared-device-adopt' });
+                    await revert();
+                    return { kind: 'skip' };
+                }
+                const result = await refreshDeviceSecretArm({ oxy, store, pin: null });
+                if (result.status === 'ok') {
+                    return {
+                        kind: 'session',
+                        session: {
+                            sessionId: result.sessionId,
+                            userId: result.userId,
+                            accessToken: result.token,
+                        },
+                    };
+                }
+                if (result.status === 'invalid-secret') {
+                    // The one place we hold POSITIVE proof that the exact bytes in the
+                    // shared slot are dead — the server rejected them by name. Clearing it
+                    // signs nobody out (a credential the server does not recognise cannot
+                    // be minting for anyone) and it is what stops a dead credential from
+                    // blocking every future install: a stale slot owned by a different
+                    // `deviceId` is otherwise never overwritten, by design.
+                    await sharedSlot.clear();
+                }
+                else if (result.status === 'no-session') {
+                    signedOutReason = 'no_session';
+                }
+                await revert();
+                return { kind: 'skip' };
+            },
+        });
+    }
+    if (identityBinding === null) {
+        // 4. shared-key-signin (native) — the RECOVERY / COMPATIBILITY lane: sign a
+        //    challenge with the shared-keychain IDENTITY key to re-mint a session.
+        //
+        //    It runs LAST on purpose. Using the self-custody key to obtain an ordinary
+        //    session is the over-sharing #937 sets out to end, so it is now reachable
+        //    only on a device where no sibling app has published a shared device
+        //    credential yet — an install that predates this lane, or one where the
+        //    shared slot is unreadable. Its own `store.save` below feeds the shared
+        //    slot through the mirroring store, so the FIRST boot that takes this lane
+        //    is also the last one that needs to: every later app joins by credential.
+        //
+        //    Native AND online: it is a network step (challenge + verify round-trips),
+        //    so it is gated by the same offline hint as the mint lane. `{ retry: false }`
         //    keeps the two round-trips as single attempts — the refresh scheduler /
         //    401 lane own later retries — so this step cannot multiply boot latency.
         steps.push({

package/dist/esm/i18n/locales/en-US.json

@@ -396,13 +396,22 @@
             "remoteSignOutFailed": "There was a problem signing out from the device. Please try again.",
             "noOtherDeviceSessions": "No other device sessions found to sign out from.",
             "signOutOthersSuccess": "Signed out from all other devices successfully!",
-            "signOutOthersFailed": "There was a problem signing out from other devices. Please try again."
+            "signOutOthersFailed": "There was a problem signing out from other devices. Please try again.",
+            "contextRemoved": "Removed {{account}}",
+            "contextRemoveFailed": "There was a problem removing that account. Please try again.",
+            "principalRemoved": "Signed {{name}} out of this device",
+            "principalRemoveFailed": "There was a problem signing that person out. Please try again.",
+            "activateFailed": "There was a problem switching accounts. Please try again."
         },
         "confirms": {
             "remove": "Are you sure you want to remove {{displayName}} from this device? You'll need to sign in again to access this account.",
             "logoutAll": "Are you sure you want to sign out of all accounts? This will remove all saved accounts from this device.",
             "remoteLogout": "Are you sure you want to sign out from \"{{deviceName}}\"? This will end the session on that device.",
-            "logoutOthers": "Are you sure you want to sign out from all {{count}} other device(s)? This will end sessions on all other devices except this one."
+            "logoutOthers": "Are you sure you want to sign out from all {{count}} other device(s)? This will end sessions on all other devices except this one.",
+            "removeContextTitle": "Remove this account?",
+            "removeContext": "Stop {{person}} acting as {{account}} on this device? Anyone else who reaches {{account}} here keeps their access.",
+            "removePrincipalTitle": "Sign out of this device?",
+            "removePrincipal": "Sign {{name}} out of this device? Every account they reach here is removed. Nobody else is affected."
         },
         "device": {
             "loadingTitle": "Loading device sessions...",
@@ -439,6 +448,14 @@
             "openedInCommons": "Opened in Commons",
             "confirming": "Confirming identity",
             "confirmed": "Identity confirmed"
+        },
+        "context": {
+            "unavailable": "Unavailable right now",
+            "operatedBy": "Operated by {{name}}",
+            "remove": "Remove {{account}} from {{person}}"
+        },
+        "principal": {
+            "signOut": "Sign {{name}} out of this device"
         }
     },
     "reputation": {
@@ -2119,8 +2136,13 @@
             "filesWrite": "Upload and modify your files",
             "filesDelete": "Delete your files",
             "webhooksReceive": "Receive webhooks",
-            "chatCompletions": "Use AI chat on your behalf",
-            "modelsRead": "List available AI models",
+            "inferenceInvoke": "Run AI requests on your behalf",
+            "inferenceModelsRead": "List available AI models",
+            "inferenceUsageRead": "Read its AI usage and costs",
+            "inferenceRoutingRead": "Read how AI requests are routed",
+            "inferenceRoutingWrite": "Change how AI requests are routed",
+            "inferenceProvidersRead": "Read its connected AI providers",
+            "inferenceProvidersWrite": "Manage its connected AI providers",
             "federationWrite": "Act across federated services"
         },
         "account": {

package/dist/esm/i18n/locales/es-ES.json

@@ -636,13 +636,22 @@
             "remoteSignOutFailed": "Hubo un problema al cerrar sesión en el dispositivo. Inténtalo de nuevo.",
             "noOtherDeviceSessions": "No se encontraron otras sesiones de dispositivo para cerrar.",
             "signOutOthersSuccess": "¡Sesiones cerradas correctamente en los demás dispositivos!",
-            "signOutOthersFailed": "Hubo un problema al cerrar sesión en otros dispositivos. Inténtalo de nuevo."
+            "signOutOthersFailed": "Hubo un problema al cerrar sesión en otros dispositivos. Inténtalo de nuevo.",
+            "contextRemoved": "Se quitó {{account}}",
+            "contextRemoveFailed": "Hubo un problema al quitar esa cuenta. Inténtalo de nuevo.",
+            "principalRemoved": "Se cerró la sesión de {{name}} en este dispositivo",
+            "principalRemoveFailed": "Hubo un problema al cerrar esa sesión. Inténtalo de nuevo.",
+            "activateFailed": "Hubo un problema al cambiar de cuenta. Inténtalo de nuevo."
         },
         "confirms": {
             "remove": "¿Seguro que quieres eliminar a {{displayName}} de este dispositivo? Tendrás que iniciar sesión de nuevo para acceder a esta cuenta.",
             "logoutAll": "¿Seguro que quieres cerrar sesión en todas las cuentas? Esto eliminará todas las cuentas guardadas de este dispositivo.",
             "remoteLogout": "¿Seguro que quieres cerrar sesión en \"{{deviceName}}\"? Esto finalizará la sesión en ese dispositivo.",
-            "logoutOthers": "¿Seguro que quieres cerrar sesión en los otros {{count}} dispositivo(s)? Esto finalizará las sesiones en todos los demás dispositivos excepto en este."
+            "logoutOthers": "¿Seguro que quieres cerrar sesión en los otros {{count}} dispositivo(s)? Esto finalizará las sesiones en todos los demás dispositivos excepto en este.",
+            "removeContextTitle": "¿Quitar esta cuenta?",
+            "removeContext": "¿Dejar de usar {{account}} como {{person}} en este dispositivo? Quien más acceda a {{account}} aquí lo conserva.",
+            "removePrincipalTitle": "¿Cerrar sesión en este dispositivo?",
+            "removePrincipal": "¿Cerrar la sesión de {{name}} en este dispositivo? Se quitan todas las cuentas a las que llega desde aquí. No afecta a nadie más."
         },
         "device": {
             "loadingTitle": "Cargando sesiones de dispositivo...",
@@ -679,6 +688,14 @@
             "openedInCommons": "Abierto en Commons",
             "confirming": "Confirmando identidad",
             "confirmed": "Identidad confirmada"
+        },
+        "context": {
+            "unavailable": "No disponible ahora mismo",
+            "operatedBy": "Gestionada por {{name}}",
+            "remove": "Quitar {{account}} de {{person}}"
+        },
+        "principal": {
+            "signOut": "Cerrar la sesión de {{name}} en este dispositivo"
         }
     },
     "feedback": {
@@ -2119,8 +2136,13 @@
             "filesWrite": "Subir y modificar tus archivos",
             "filesDelete": "Eliminar tus archivos",
             "webhooksReceive": "Recibir webhooks",
-            "chatCompletions": "Usar el chat con IA en tu nombre",
-            "modelsRead": "Ver los modelos de IA disponibles",
+            "inferenceInvoke": "Ejecutar peticiones de IA en tu nombre",
+            "inferenceModelsRead": "Ver los modelos de IA disponibles",
+            "inferenceUsageRead": "Ver su consumo y costes de IA",
+            "inferenceRoutingRead": "Ver cómo se enrutan las peticiones de IA",
+            "inferenceRoutingWrite": "Cambiar cómo se enrutan las peticiones de IA",
+            "inferenceProvidersRead": "Ver sus proveedores de IA conectados",
+            "inferenceProvidersWrite": "Gestionar sus proveedores de IA conectados",
             "federationWrite": "Actuar en servicios federados"
         },
         "account": {

package/dist/esm/i18n/locales/locales/en-US.json

@@ -396,13 +396,22 @@
       "remoteSignOutFailed": "There was a problem signing out from the device. Please try again.",
       "noOtherDeviceSessions": "No other device sessions found to sign out from.",
       "signOutOthersSuccess": "Signed out from all other devices successfully!",
-      "signOutOthersFailed": "There was a problem signing out from other devices. Please try again."
+      "signOutOthersFailed": "There was a problem signing out from other devices. Please try again.",
+      "contextRemoved": "Removed {{account}}",
+      "contextRemoveFailed": "There was a problem removing that account. Please try again.",
+      "principalRemoved": "Signed {{name}} out of this device",
+      "principalRemoveFailed": "There was a problem signing that person out. Please try again.",
+      "activateFailed": "There was a problem switching accounts. Please try again."
     },
     "confirms": {
       "remove": "Are you sure you want to remove {{displayName}} from this device? You'll need to sign in again to access this account.",
       "logoutAll": "Are you sure you want to sign out of all accounts? This will remove all saved accounts from this device.",
       "remoteLogout": "Are you sure you want to sign out from \"{{deviceName}}\"? This will end the session on that device.",
-      "logoutOthers": "Are you sure you want to sign out from all {{count}} other device(s)? This will end sessions on all other devices except this one."
+      "logoutOthers": "Are you sure you want to sign out from all {{count}} other device(s)? This will end sessions on all other devices except this one.",
+      "removeContextTitle": "Remove this account?",
+      "removeContext": "Stop {{person}} acting as {{account}} on this device? Anyone else who reaches {{account}} here keeps their access.",
+      "removePrincipalTitle": "Sign out of this device?",
+      "removePrincipal": "Sign {{name}} out of this device? Every account they reach here is removed. Nobody else is affected."
     },
     "device": {
       "loadingTitle": "Loading device sessions...",
@@ -439,6 +448,14 @@
       "openedInCommons": "Opened in Commons",
       "confirming": "Confirming identity",
       "confirmed": "Identity confirmed"
+    },
+    "context": {
+      "unavailable": "Unavailable right now",
+      "operatedBy": "Operated by {{name}}",
+      "remove": "Remove {{account}} from {{person}}"
+    },
+    "principal": {
+      "signOut": "Sign {{name}} out of this device"
     }
   },
   "reputation": {
@@ -2119,8 +2136,13 @@
       "filesWrite": "Upload and modify your files",
       "filesDelete": "Delete your files",
       "webhooksReceive": "Receive webhooks",
-      "chatCompletions": "Use AI chat on your behalf",
-      "modelsRead": "List available AI models",
+      "inferenceInvoke": "Run AI requests on your behalf",
+      "inferenceModelsRead": "List available AI models",
+      "inferenceUsageRead": "Read its AI usage and costs",
+      "inferenceRoutingRead": "Read how AI requests are routed",
+      "inferenceRoutingWrite": "Change how AI requests are routed",
+      "inferenceProvidersRead": "Read its connected AI providers",
+      "inferenceProvidersWrite": "Manage its connected AI providers",
       "federationWrite": "Act across federated services"
     },
     "account": {

package/dist/esm/i18n/locales/locales/es-ES.json

@@ -636,13 +636,22 @@
       "remoteSignOutFailed": "Hubo un problema al cerrar sesión en el dispositivo. Inténtalo de nuevo.",
       "noOtherDeviceSessions": "No se encontraron otras sesiones de dispositivo para cerrar.",
       "signOutOthersSuccess": "¡Sesiones cerradas correctamente en los demás dispositivos!",
-      "signOutOthersFailed": "Hubo un problema al cerrar sesión en otros dispositivos. Inténtalo de nuevo."
+      "signOutOthersFailed": "Hubo un problema al cerrar sesión en otros dispositivos. Inténtalo de nuevo.",
+      "contextRemoved": "Se quitó {{account}}",
+      "contextRemoveFailed": "Hubo un problema al quitar esa cuenta. Inténtalo de nuevo.",
+      "principalRemoved": "Se cerró la sesión de {{name}} en este dispositivo",
+      "principalRemoveFailed": "Hubo un problema al cerrar esa sesión. Inténtalo de nuevo.",
+      "activateFailed": "Hubo un problema al cambiar de cuenta. Inténtalo de nuevo."
     },
     "confirms": {
       "remove": "¿Seguro que quieres eliminar a {{displayName}} de este dispositivo? Tendrás que iniciar sesión de nuevo para acceder a esta cuenta.",
       "logoutAll": "¿Seguro que quieres cerrar sesión en todas las cuentas? Esto eliminará todas las cuentas guardadas de este dispositivo.",
       "remoteLogout": "¿Seguro que quieres cerrar sesión en \"{{deviceName}}\"? Esto finalizará la sesión en ese dispositivo.",
-      "logoutOthers": "¿Seguro que quieres cerrar sesión en los otros {{count}} dispositivo(s)? Esto finalizará las sesiones en todos los demás dispositivos excepto en este."
+      "logoutOthers": "¿Seguro que quieres cerrar sesión en los otros {{count}} dispositivo(s)? Esto finalizará las sesiones en todos los demás dispositivos excepto en este.",
+      "removeContextTitle": "¿Quitar esta cuenta?",
+      "removeContext": "¿Dejar de usar {{account}} como {{person}} en este dispositivo? Quien más acceda a {{account}} aquí lo conserva.",
+      "removePrincipalTitle": "¿Cerrar sesión en este dispositivo?",
+      "removePrincipal": "¿Cerrar la sesión de {{name}} en este dispositivo? Se quitan todas las cuentas a las que llega desde aquí. No afecta a nadie más."
     },
     "device": {
       "loadingTitle": "Cargando sesiones de dispositivo...",
@@ -679,6 +688,14 @@
       "openedInCommons": "Abierto en Commons",
       "confirming": "Confirmando identidad",
       "confirmed": "Identidad confirmada"
+    },
+    "context": {
+      "unavailable": "No disponible ahora mismo",
+      "operatedBy": "Gestionada por {{name}}",
+      "remove": "Quitar {{account}} de {{person}}"
+    },
+    "principal": {
+      "signOut": "Cerrar la sesión de {{name}} en este dispositivo"
     }
   },
   "feedback": {
@@ -2119,8 +2136,13 @@
       "filesWrite": "Subir y modificar tus archivos",
       "filesDelete": "Eliminar tus archivos",
       "webhooksReceive": "Recibir webhooks",
-      "chatCompletions": "Usar el chat con IA en tu nombre",
-      "modelsRead": "Ver los modelos de IA disponibles",
+      "inferenceInvoke": "Ejecutar peticiones de IA en tu nombre",
+      "inferenceModelsRead": "Ver los modelos de IA disponibles",
+      "inferenceUsageRead": "Ver su consumo y costes de IA",
+      "inferenceRoutingRead": "Ver cómo se enrutan las peticiones de IA",
+      "inferenceRoutingWrite": "Cambiar cómo se enrutan las peticiones de IA",
+      "inferenceProvidersRead": "Ver sus proveedores de IA conectados",
+      "inferenceProvidersWrite": "Gestionar sus proveedores de IA conectados",
       "federationWrite": "Actuar en servicios federados"
     },
     "account": {

package/dist/esm/index.js

@@ -173,16 +173,32 @@ export { SessionClient } from './session/SessionClient.js';
 export { createSessionClientHost } from './session/sessionClientHost.js';
 export { createSessionClient } from './session/createSessionClient.js';
 export { deviceStateToClientSessions, activeSessionIdOf, activeUserOf, accountIdsOf, } from './session/projectSessionState.js';
-// Unified account-list projection (THE single source of truth for the account
-// chooser: device sign-ins ∪ account graph, deduped by accountId). Pure +
-// I/O-free — the caller hydrates profiles via `getUsersByIds`. Shared by
-// `@oxyhq/services` and auth.oxy.so so the list can't diverge.
-// `isSwitchTargetAccount` is the structural half ("is this kind switchable at
-// all?"); `canSwitchIntoAccount` adds the caller's `account:act_as` permission.
-// Both are exported so surfaces that render `AccountNode`s rather than the
-// projection — the Console workspace switcher, managed-accounts rows — ask the
-// SAME questions instead of testing a kind literal.
-export { isSwitchTargetAccount, canSwitchIntoAccount, projectSwitchableAccounts, switchableAccountIds, } from './session/accountProjection.js';
+// Pure projections over the device DIRECTORY (`GET /session/device/directory`,
+// ADR 0002) — the read model that keeps the actor (the human who authenticated)
+// and the subject (the account being acted as) apart. The flat
+// `DeviceSessionState` collapses them into one row, so it can neither tell
+// "signed in as an org" from "a person operating that org" nor hold two people
+// reaching the same org on one device.
+// `canActivateContext` is the switchability question — `available` alone, never
+// composed with `onDevice`, which is a different fact in both directions.
+// `projectDevicePrincipals` is the switcher's shape: people, each with what
+// they may become. Grouped rather than flat because the same organization
+// reached through two people is TWO rows under two humans, which a list keyed
+// by account cannot say.
+export { canActivateContext, directoryDisplayName, directoryHandle, projectDevicePrincipals, resolveActiveContext, resolveDeviceContext, } from './session/deviceDirectory.js';
+// The switcher's RENDER model over that projection — names, handles and avatar
+// URLs resolved once. Shared by `@oxyhq/services`' account dialog and the
+// auth.oxy.so chooser so the two cannot drift, the same reason the flat
+// projection lived here before it.
+export { buildSwitcherRows, showsPrincipalHeaders } from './session/deviceSwitcherRows.js';
+// The switch-target predicates over the account GRAPH — a list of accounts to
+// manage, not the device's list of identities to become (that is the directory
+// above). `isSwitchTargetAccount` is the structural half ("is this kind
+// switchable at all?"); `canSwitchIntoAccount` adds the caller's
+// `account:act_as` permission. Exported so the surfaces that render
+// `AccountNode`s — the Console workspace switcher, managed-accounts rows — ask
+// the SAME questions instead of testing a kind literal.
+export { isSwitchTargetAccount, canSwitchIntoAccount, } from './session/accountSwitchTargets.js';
 // Headless controller for the unified account dialog. Framework-agnostic
 // state machine + subscribe/getSnapshot store (bind via `useSyncExternalStore`)
 // — sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff;
@@ -198,6 +214,12 @@ export { AccountDialogController, createAccountDialogController, } from './sessi
 // via `POST /session/device/token`.
 // ---------------------------------------------------------------------------
 export { createWebAuthStateStore, createNativeAuthStateStore, createMemoryAuthStateStore, AUTH_STATE_STORAGE_KEY, } from './session/authStateStore.js';
+// The shared NATIVE DeviceSession credential — how several official apps on one
+// device end up on ONE `DeviceSession` and therefore one active context. It is an
+// ordinary rotatable/revocable `deviceId` + `deviceSecret`, deliberately NOT the
+// Commons private identity key: an app that only needs a session must never be
+// handed the key that signs identity approvals.
+export { createSharedMirroringAuthStateStore, decideSharedDeviceJoin, decideSharedDevicePublish, normalizeSharedDeviceSessionRead, publishProvenDeviceCredential, readLocalDeviceCredential, } from './session/sharedDeviceCredential.js';
 // Identity-bound sessions (the identity vault). The pin is the durable
 // `{publicKey, accountId}` binding between this device's PRIMARY identity key
 // and the account it authenticates as; it is what keeps such a client from
@@ -209,6 +231,10 @@ export { resolveIdentityPin, establishIdentitySession, } from './session/identit
 // the identity session instead of dropping a healthy device credential.
 export { AccountNotOnDeviceError } from './mixins/OxyServices.deviceBoot.js';
 export { refreshPersistedSession, refreshDeviceSecretArm, createAuthRefreshHandler, installAuthRefreshHandler, startTokenRefreshScheduler, TOKEN_REFRESH_LEAD_MS, } from './session/refresh.js';
+// The inference API. `oxyServices.inference()` binds the session bearer into
+// the same client an external developer constructs with an `oxy_sk_…` machine
+// key — one surface, two credential lanes. See `docs/inference/sdk.md`.
+export { OxyInferenceClient, OxyInferenceError, OXY_INFERENCE_BASE_URL, } from './inference/OxyInferenceClient.js';
 export { runSessionColdBoot } from './boot/sessionColdBoot.js';
 // API response contracts (request/response Zod schemas + inferred types) live in
 // `@oxyhq/contracts` — the single source of truth shared by the backend and every