@oxyhq/core 4.0.1 → 5.1.0

package/dist/esm/HttpService.js

@@ -17,7 +17,8 @@ import { RequestDeduplicator, RequestQueue, SimpleLogger } from './utils/request
 import { retryAsync } from './utils/asyncUtils.js';
 import { handleHttpError } from './utils/errorUtils.js';
 import { jwtDecode } from 'jwt-decode';
-import { isNative, isReactNative, getPlatformOS } from './utils/platform.js';
+import { isNative, getPlatformOS } from './utils/platform.js';
+import { isReactNative } from '@oxyhq/protocol';
 import { computeIdentityTag, fnv1a32 } from './utils/cacheKey.js';
 /**
  * Check if we're running in a native app environment (React Native, not web)
@@ -146,8 +147,6 @@ export class HttpService {
          * Each listener receives the resulting access token, or `null` when cleared.
          */
         this._tokenChangeListeners = new Set();
-        // Acting-as identity for managed accounts
-        this._actingAsUserId = null;
         // Performance monitoring
         this.requestMetrics = {
             totalRequests: 0,
@@ -321,10 +320,6 @@ export class HttpService {
                         hasNativeAppHeader: headers['X-Native-App'] === 'true',
                     });
                 }
-                // Add X-Acting-As header for managed account identity delegation
-                if (this._actingAsUserId) {
-                    headers['X-Acting-As'] = this._actingAsUserId;
-                }
                 // Merge custom headers if provided
                 if (config.headers) {
                     Object.entries(config.headers).forEach(([key, value]) => {
@@ -630,12 +625,12 @@ export class HttpService {
      * Derive a stable, non-sensitive identity discriminator for cache scoping.
      *
      * Thin instance wrapper over the pure {@link computeIdentityTag} helper —
-     * binds it to this instance's live access token and acting-as id. See that
-     * function's docs for the full resolution contract (anon fallback, decoded
-     * `userId || id`, token-hash fallback for undecodable tokens).
+     * binds it to this instance's live access token. See that function's docs for
+     * the full resolution contract (anon fallback, decoded `userId || id`,
+     * token-hash fallback for undecodable tokens).
      */
     computeIdentityTag() {
-        return computeIdentityTag(this.tokenStore.getAccessToken(), this._actingAsUserId);
+        return computeIdentityTag(this.tokenStore.getAccessToken());
     }
     /**
      * Generate cache key efficiently
@@ -882,13 +877,6 @@ export class HttpService {
     async delete(url, config) {
         return this.request({ method: 'DELETE', url, ...config });
     }
-    // Acting-as identity management (managed accounts)
-    setActingAs(userId) {
-        this._actingAsUserId = userId;
-    }
-    getActingAs() {
-        return this._actingAsUserId;
-    }
     // Token management
     setTokens(accessToken) {
         this.tokenStore.setTokens(accessToken);

package/dist/esm/OxyServices.base.js

@@ -275,27 +275,6 @@ export class OxyServicesBase {
             return null;
         }
     }
-    /**
-     * Set the acting-as identity for managed accounts.
-     *
-     * When set, all subsequent API requests will include the `X-Acting-As` header,
-     * causing the server to attribute actions to the managed account. The
-     * authenticated user must be an authorized manager of the target account.
-     *
-     * Pass `null` to clear and revert to the authenticated user's own identity.
-     *
-     * @param userId - The managed account user ID, or null to clear
-     */
-    setActingAs(userId) {
-        this.httpService.setActingAs(userId);
-    }
-    /**
-     * Get the current acting-as identity (managed account user ID), or null
-     * if operating as the authenticated user's own identity.
-     */
-    getActingAs() {
-        return this.httpService.getActingAs();
-    }
     /**
      * Wait for authentication to be ready
      *

package/dist/esm/crypto/keyManager.js

@@ -6,8 +6,8 @@
  */
 import _cjs_elliptic from 'elliptic';
 const { ec: EC } = _cjs_elliptic;
-import { isWeb, isIOS, isAndroid, isReactNative, isNodeJS } from '../utils/platform.js';
-import { loadExpoCrypto, loadNodeCrypto, loadSecureStore } from '../utils/platformCrypto.js';
+import { isWeb, isIOS, isAndroid } from '../utils/platform.js';
+import { isReactNative, isNodeJS, loadExpoCrypto, loadNodeCrypto, loadSecureStore } from '@oxyhq/protocol';
 import { logger } from '../utils/loggerUtils.js';
 import { isDev } from '../shared/utils/debugUtils.js';
 /**
@@ -68,8 +68,8 @@ const ANDROID_ACCOUNT_TYPE = 'com.oxy.account';
 /**
  * Initialize React Native specific modules
  *
- * Delegates to `platformCrypto`, which is a per-platform module
- * (`platformCrypto.ts` vs `platformCrypto.react-native.ts`) selected by the
+ * Delegates to `@oxyhq/protocol`'s `platform/crypto`, a per-platform module
+ * (`crypto.ts` vs `crypto.native.ts`) selected by the
  * consumer's bundler. On RN it returns a statically-imported handle to
  * `expo-secure-store`; off RN it throws (and is never called because every
  * caller is gated by `isWebPlatform()` / native-only paths).

package/dist/esm/crypto/polyfill.js

@@ -6,12 +6,12 @@
  *
  * - Browser/Node.js: Uses native crypto
  * - React Native: Uses expo-crypto (statically imported via the
- *   per-platform `platformCrypto` module — see that file's doc-comment for
- *   how platform routing works).
+ *   per-platform `platform/crypto` module in `@oxyhq/protocol` — see that
+ *   file's doc-comment for how platform routing works).
  */
 import _cjs_buffer from 'buffer';
 const { Buffer } = _cjs_buffer;
-import { getRandomBytesRN } from '../utils/platformCrypto.js';
+import { getRandomBytesRN } from '@oxyhq/protocol';
 const getGlobalObject = () => {
     if (typeof globalThis !== 'undefined')
         return globalThis;
@@ -31,7 +31,8 @@ if (!globalObject.Buffer) {
 /**
  * Synchronous random-bytes shim. On RN, this delegates to
  * `expo-crypto.getRandomBytes` (statically imported by the RN variant of
- * `platformCrypto`, so available without any async warm-up). On Node /
+ * `@oxyhq/protocol`'s `platform/crypto`, so available without any async
+ * warm-up). On Node /
  * browser, this throws — but is never called there because both platforms
  * already provide `globalThis.crypto.getRandomValues` natively.
  */

package/dist/esm/crypto/signatureService.js

@@ -1,83 +1,15 @@
 /**
- * Signature Service - ECDSA Digital Signatures
+ * Signature Service - ECDSA Digital Signatures (device-key bound)
  *
- * Handles signing and verification of messages using ECDSA secp256k1.
- * Used for authenticating requests and proving identity ownership.
+ * Handles signing and verification of messages with the user's DEVICE identity
+ * key (read from {@link KeyManager} / secure storage). All cryptography itself —
+ * canonical signing input, SHA-256, secp256k1 sign/verify, envelope assembly —
+ * is delegated to `@oxyhq/protocol`; this service only resolves the key from
+ * storage and orchestrates the protocol primitives.
  */
-import _cjs_elliptic from 'elliptic';
-const { ec: EC } = _cjs_elliptic;
+import { signEnvelope, signMessage, verifySignature, sha256, loadExpoCrypto, loadNodeCrypto, isReactNative, isNodeJS, } from '@oxyhq/protocol';
 import { KeyManager } from './keyManager.js';
-import { canonicalize } from './canonicalJson.js';
-import { isReactNative, isNodeJS } from '../utils/platform.js';
-import { loadExpoCrypto, loadNodeCrypto } from '../utils/platformCrypto.js';
 import { logger } from '../utils/loggerUtils.js';
-import { isDev } from '../shared/utils/debugUtils.js';
-const ec = new EC('secp256k1');
-/**
- * Compute the canonical signing input for a signed-record envelope.
- *
- * This is the single definition of "what the signature covers". `@oxyhq/core`
- * (client signing) and `@oxyhq/api` (server verification) both call this, so a
- * record signed by a client and verified by the server cannot drift.
- *
- * - **v1**: the canonical JSON of `{version, type, subject, issuer, record,
- *   issuedAt}` — BYTE-IDENTICAL to the original scheme, so every signature
- *   already in production keeps verifying.
- * - **v2**: the canonical JSON additionally includes the hash-chain fields
- *   `{seq, prev, collection, rkey}`. Because {@link canonicalize} sorts keys,
- *   the on-the-wire field order is irrelevant; the resulting canonical key
- *   order is `collection, issuedAt, issuer, prev, record, rkey, seq, subject,
- *   type, version`. `prev` is `null` at genesis (serialized as `null`, not
- *   omitted), so it is always part of the signed bytes.
- */
-export function signedRecordSigningInput(fields) {
-    const { version, type, subject, issuer, record, issuedAt } = fields;
-    if (version === 2) {
-        const { seq, prev, collection, rkey } = fields;
-        return canonicalize({ version, type, subject, issuer, record, issuedAt, seq, prev, collection, rkey });
-    }
-    return canonicalize({ version, type, subject, issuer, record, issuedAt });
-}
-/**
- * Compute the `recordId` (content address) of a signed record: the SHA-256 hex
- * digest of its canonical {@link signedRecordSigningInput}.
- *
- * Deterministic and stable across runtimes (it reuses the same canonicalization
- * + SHA-256 the signature itself is built on). The recordId is what `prev`
- * references in the per-subject hash chain, so `@oxyhq/core` (client) and
- * `@oxyhq/api` (server) MUST compute it identically — both call this function.
- * It is taken over the SIGNING input (excluding `publicKey`/`signature`), so it
- * is a pure content address of the record's meaning, independent of who signed.
- */
-export async function computeRecordId(fields) {
-    return sha256(signedRecordSigningInput(fields));
-}
-/**
- * Compute SHA-256 hash of a string
- */
-async function sha256(message) {
-    // In React Native, use expo-crypto
-    if (isReactNative()) {
-        const Crypto = await loadExpoCrypto();
-        return Crypto.digestStringAsync(Crypto.CryptoDigestAlgorithm.SHA256, message);
-    }
-    if (isNodeJS()) {
-        try {
-            const nodeCrypto = await loadNodeCrypto();
-            return nodeCrypto.createHash('sha256').update(message).digest('hex');
-        }
-        catch (error) {
-            // Node crypto failed to load — log and fall through to Web Crypto API
-            logger.warn('[oxy.crypto] Node crypto unavailable, falling back to Web Crypto', { component: 'SignatureService' }, error);
-        }
-    }
-    // Browser: use Web Crypto API
-    const encoder = new TextEncoder();
-    const data = encoder.encode(message);
-    const hashBuffer = await globalThis.crypto.subtle.digest('SHA-256', data);
-    const hashArray = Array.from(new Uint8Array(hashBuffer));
-    return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
-}
 export class SignatureService {
     /**
      * Generate a random challenge string (for offline use)
@@ -116,76 +48,15 @@ export class SignatureService {
         return sha256(message);
     }
     /**
-     * Sign a message using the stored private key
+     * Sign a message using the stored device private key
      * Returns the signature in DER format (hex encoded)
      */
     static async sign(message) {
-        const keyPair = await KeyManager.getKeyPairObject();
-        if (!keyPair) {
+        const privateKey = await KeyManager.getPrivateKey();
+        if (!privateKey) {
             throw new Error('No identity found. Please create or import an identity first.');
         }
-        const messageHash = await sha256(message);
-        const signature = keyPair.sign(messageHash);
-        return signature.toDER('hex');
-    }
-    /**
-     * Sign a message with an explicit private key (without storing)
-     * Useful for one-time operations or testing
-     */
-    static async signWithKey(message, privateKey) {
-        const keyPair = ec.keyFromPrivate(privateKey);
-        const messageHash = await sha256(message);
-        const signature = keyPair.sign(messageHash);
-        return signature.toDER('hex');
-    }
-    /**
-     * Verify a signature against a message and public key
-     *
-     * Returns false on any error (invalid signature, malformed input, etc.).
-     * Errors are logged at debug level so they're available when troubleshooting
-     * signature mismatches but don't surface to the caller.
-     */
-    static async verify(message, signature, publicKey) {
-        try {
-            const key = ec.keyFromPublic(publicKey, 'hex');
-            const messageHash = await sha256(message);
-            return key.verify(messageHash, signature);
-        }
-        catch (error) {
-            if (isDev()) {
-                logger.debug('[oxy.crypto] verify() returned false', { component: 'SignatureService' }, error);
-            }
-            return false;
-        }
-    }
-    /**
-     * Synchronous verification (for Node.js backend)
-     * Uses crypto module directly for hashing
-     * Note: This method should only be used in Node.js environments
-     */
-    static verifySync(message, signature, publicKey) {
-        try {
-            if (!isNodeJS()) {
-                // In React Native, use async verify instead
-                throw new Error('verifySync should only be used in Node.js. Use verify() in React Native.');
-            }
-            // Intentionally using Function constructor here: this method is synchronous by design
-            // (Node.js backend hot-path) so we cannot use `await import()`. The Function constructor
-            // prevents Metro/bundlers from statically resolving the require. This is acceptable because
-            // verifySync is gated by isNodeJS() and will never execute in browser/RN environments.
-            // eslint-disable-next-line @typescript-eslint/no-implied-eval
-            const getCrypto = new Function('return require("crypto")');
-            const crypto = getCrypto();
-            const key = ec.keyFromPublic(publicKey, 'hex');
-            const messageHash = crypto.createHash('sha256').update(message).digest('hex');
-            return key.verify(messageHash, signature);
-        }
-        catch (error) {
-            if (isDev()) {
-                logger.debug('[oxy.crypto] verifySync() returned false', { component: 'SignatureService' }, error);
-            }
-            return false;
-        }
+        return signMessage(message, privateKey);
     }
     /**
      * Create a signed message object with metadata
@@ -219,7 +90,7 @@ export class SignatureService {
         }
         // Verify signature
         const messageWithTimestamp = `${message}:${timestamp}`;
-        return SignatureService.verify(messageWithTimestamp, signature, publicKey);
+        return verifySignature(messageWithTimestamp, signature, publicKey);
     }
     /**
      * Create a signed authentication challenge response
@@ -247,9 +118,10 @@ export class SignatureService {
      * Mirrors {@link signChallenge} exactly — same message format
      * (`auth:${publicKey}:${challenge}:${timestamp}`) so the server verification
      * path is unchanged — but sources the shared public/private key from
-     * `KeyManager` and signs with `signWithKey`. Used by "Sign in with Oxy"
-     * same-device shared-keychain SSO (Mechanism A): a sibling native app proves
-     * control of the shared identity to mint its own session.
+     * `KeyManager` and signs with the protocol's explicit-key {@link signMessage}.
+     * Used by "Sign in with Oxy" same-device shared-keychain SSO (Mechanism A): a
+     * sibling native app proves control of the shared identity to mint its own
+     * session.
      *
      * Throws if no shared identity exists (native-only; the shared keychain is
      * unavailable on web).
@@ -262,7 +134,7 @@ export class SignatureService {
         }
         const timestamp = Date.now();
         const message = `auth:${publicKey}:${challenge}:${timestamp}`;
-        const signature = await SignatureService.signWithKey(message, privateKey);
+        const signature = await signMessage(message, privateKey);
         return {
             challenge: signature,
             publicKey,
@@ -280,7 +152,7 @@ export class SignatureService {
             return false;
         }
         const message = `auth:${publicKey}:${originalChallenge}:${timestamp}`;
-        return SignatureService.verify(message, signature, publicKey);
+        return verifySignature(message, signature, publicKey);
     }
     /**
      * Create a registration signature
@@ -328,9 +200,11 @@ export class SignatureService {
      *
      * The envelope is self-issued: `issuer` equals `subject` (the signer's DID).
      * The signature covers the canonical JSON of every field EXCEPT `publicKey`
-     * and `signature` (see {@link signedRecordSigningInput}); `alg` is
-     * `ES256K-DER-SHA256` (secp256k1 over the SHA-256 of the canonical bytes,
-     * DER-encoded), the same scheme this service uses everywhere else.
+     * and `signature`; `alg` is `ES256K-DER-SHA256` (secp256k1 over the SHA-256 of
+     * the canonical bytes, DER-encoded). The cryptography is delegated to the
+     * protocol's {@link signEnvelope}, which derives the (uncompressed-hex)
+     * `publicKey` from the stored device key — identical to the registered
+     * verification method.
      *
      * Requires a stored identity (native secure storage); throws if none exists.
      *
@@ -339,41 +213,26 @@ export class SignatureService {
      * @param record - The arbitrary record payload to attest to.
      */
     static async signRecord(type, subject, record) {
-        const publicKey = await KeyManager.getPublicKey();
-        if (!publicKey) {
+        const privateKey = await KeyManager.getPrivateKey();
+        if (!privateKey) {
             throw new Error('No identity found. Please create or import an identity first.');
         }
-        const version = 1;
-        const issuer = subject;
-        const issuedAt = Date.now();
-        const signingInput = signedRecordSigningInput({
-            version,
-            type,
-            subject,
-            issuer,
-            record,
-            issuedAt,
-        });
-        const signature = await SignatureService.sign(signingInput);
-        return {
-            version,
+        return signEnvelope({
+            version: 1,
             type,
             subject,
-            issuer,
+            issuer: subject,
             record,
-            issuedAt,
-            publicKey,
-            alg: 'ES256K-DER-SHA256',
-            signature,
-        };
+            issuedAt: Date.now(),
+        }, privateKey);
     }
     /**
      * Build a signed-record envelope (v2) carrying the per-subject hash-chain
      * fields.
      *
      * Identical to {@link signRecord} (self-issued: `issuer === subject`; same
-     * `ES256K-DER-SHA256` scheme over {@link signedRecordSigningInput}) but
-     * `version` is `2` and the signed bytes additionally cover the chain fields:
+     * `ES256K-DER-SHA256` scheme) but `version` is `2` and the signed bytes
+     * additionally cover the chain fields:
      *
      * @param type - The record category.
      * @param subject - The subject DID the record is about (also the issuer).
@@ -388,57 +247,23 @@ export class SignatureService {
      * none exists.
      */
     static async signRecordV2(type, subject, record, chain) {
-        const publicKey = await KeyManager.getPublicKey();
-        if (!publicKey) {
+        const privateKey = await KeyManager.getPrivateKey();
+        if (!privateKey) {
             throw new Error('No identity found. Please create or import an identity first.');
         }
-        const version = 2;
-        const issuer = subject;
-        const issuedAt = Date.now();
         const { seq, prev, collection, rkey } = chain;
-        const signingInput = signedRecordSigningInput({
-            version,
+        return signEnvelope({
+            version: 2,
             type,
             subject,
-            issuer,
+            issuer: subject,
             record,
-            issuedAt,
+            issuedAt: Date.now(),
             seq,
             prev,
             collection,
             rkey,
-        });
-        const signature = await SignatureService.sign(signingInput);
-        return {
-            version,
-            type,
-            subject,
-            issuer,
-            record,
-            issuedAt,
-            seq,
-            prev,
-            collection,
-            rkey,
-            publicKey,
-            alg: 'ES256K-DER-SHA256',
-            signature,
-        };
-    }
-    /**
-     * Verify a signed-record envelope: recompute the canonical signing input from
-     * the envelope's own fields and check the signature against the envelope's
-     * `publicKey`.
-     *
-     * Note: this confirms the signature is internally consistent with the
-     * embedded `publicKey`. It does NOT establish that `publicKey` is an
-     * authorized verification method for `subject` — that authorization check is
-     * the server's responsibility (it asserts the key is a current verification
-     * method on the subject's DID).
-     */
-    static async verifyRecord(envelope) {
-        const signingInput = signedRecordSigningInput(envelope);
-        return SignatureService.verify(signingInput, envelope.signature, envelope.publicKey);
+        }, privateKey);
     }
 }
 export default SignatureService;

package/dist/esm/index.js

@@ -64,8 +64,7 @@ export { mergeSessions, normalizeAndSortSessions, sessionsArraysEqual, } from '.
 // Crypto / identity
 // ---------------------------------------------------------------------------
 export { KeyManager, IdentityAlreadyExistsError, IdentityPersistError, } from './crypto/keyManager.js';
-export { SignatureService, signedRecordSigningInput, computeRecordId } from './crypto/signatureService.js';
-export { canonicalize } from './crypto/canonicalJson.js';
+export { SignatureService } from './crypto/signatureService.js';
 export { RecoveryPhraseService } from './crypto/recoveryPhrase.js';
 // ---------------------------------------------------------------------------
 // Devices

package/dist/esm/mixins/OxyServices.accounts.js

@@ -1,3 +1,6 @@
+import { normalizeUserIdentity } from '../utils/userIdentity.js';
+import { isWeb } from '../utils/platform.js';
+import { logger } from '../utils/loggerUtils.js';
 import { CACHE_TIMES } from './mixinHelpers.js';
 export function OxyServicesAccountsMixin(Base) {
     return class extends Base {
@@ -40,6 +43,93 @@ export function OxyServicesAccountsMixin(Base) {
                 throw this.handleError(error);
             }
         }
+        /**
+         * Switch the active session INTO a managed account.
+         *
+         * Calls `POST /accounts/:id/switch` with the signed-in operator's bearer.
+         * The server authorises the operator (must hold `account:act_as` over the
+         * target, directly or inherited — else 403; 404 if missing/archived; 403 if
+         * the target is a personal account), then mints a REAL session for the
+         * target account and returns it in the canonical login / `claimSessionByToken`
+         * shape (`{ sessionId, deviceId, expiresAt, accessToken, user, authuser }`).
+         *
+         * Unlike the removed `X-Acting-As` delegation header, the returned session
+         * IS the new identity: this plants `accessToken` as the active token —
+         * exactly like `claimSessionByToken` / `verifyChallenge` — so every
+         * subsequent request authenticates as the target account.
+         *
+         * Joining the device multi-account set (so the switch survives a reload and
+         * propagates cross-domain via `/auth/refresh-all`) requires a SECOND call, to
+         * `POST /auth/session`, made here after the token is planted. The switch route
+         * lives at `/accounts/*`, OUTSIDE the `oxy_rt_<authuser>` cookie's `Path=/auth`
+         * scope, so the server never sees the device's existing slots from it and
+         * would clobber slot 0 (destroying the operator's own session). `/auth/session`
+         * runs where those cookies ARE visible, so the server allocates a NEW slot that
+         * coexists with the operator's and returns its `authuser`. This step is
+         * web-only (native multi-account uses stored sessions, not cookies) and
+         * best-effort — a failure leaves the in-session switch intact; the switched
+         * account simply won't survive a reload until the cookie is next established.
+         *
+         * After planting, the SDK's identity-scoped GET cache is fully cleared so
+         * every cached read re-fetches as the new account. (The consuming
+         * `OxyContext` additionally invalidates its React Query cache and updates
+         * session state from the returned `user`; this clears the SDK's own HTTP
+         * cache at the source — `setTokens` deliberately preserves the warm cache for
+         * same-user silent refreshes, so the sweep here is explicit.)
+         *
+         * @param accountId - The target account's Mongo `_id`.
+         * @returns The minted session (planted) plus the device `authuser` slot.
+         */
+        async switchToAccount(accountId) {
+            try {
+                const res = await this.makeRequest('POST', `/accounts/${encodeURIComponent(accountId)}/switch`, undefined, { cache: false });
+                // Plant the freshly minted session as the ACTIVE session, mirroring
+                // `claimSessionByToken` / `verifyChallenge`: the response body carries
+                // the first access token. The device refresh cookie is established below.
+                if (res?.accessToken) {
+                    this.setTokens(res.accessToken);
+                }
+                // Register the switched session in the device's multi-account set by
+                // establishing its first-party refresh cookie. This MUST be a separate
+                // call to `POST /auth/session`: the switch route is at `/accounts/*`,
+                // outside the `oxy_rt_<authuser>` cookie's `Path=/auth` scope, so it can
+                // never read the device's existing slots and would overwrite slot 0
+                // (destroying the operator's own session). `/auth/session` runs where the
+                // cookies ARE visible, so the server allocates a NEW slot that coexists
+                // with the operator's and returns its `authuser`. Web-only; best-effort.
+                let authuser = res.authuser;
+                if (isWeb()) {
+                    try {
+                        const established = await this.makeRequest('POST', '/auth/session', undefined, { cache: false });
+                        if (typeof established?.authuser === 'number') {
+                            authuser = established.authuser;
+                        }
+                        // /auth/session mints a fresh access token off the same session;
+                        // re-plant it so the active token matches the rotated cookie.
+                        if (established?.accessToken) {
+                            this.setTokens(established.accessToken);
+                        }
+                    }
+                    catch (error) {
+                        logger.warn('[OxyServices] Failed to establish device refresh cookie after account switch; the switch is active in-session but may not survive a reload', { component: 'OxyServices', method: 'switchToAccount' }, error);
+                    }
+                }
+                // Identity changed → drop the entire GET response cache so no entry
+                // personalised for the previous identity is reused. Cache keys are
+                // identity-scoped, so a different identity could not READ the old
+                // entries anyway, but clearing guarantees a clean refetch as the new
+                // account and frees the prior identity's resident data.
+                this.clearCache();
+                return {
+                    ...res,
+                    ...(typeof authuser === 'number' ? { authuser } : {}),
+                    user: normalizeUserIdentity(res.user),
+                };
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
         /**
          * Create a new (non-personal) account. The caller becomes its `owner`.
          * @param data - Account configuration: kind, optional parent, and profile.