@oxyhq/core 12.10.0 → 12.10.2

package/dist/cjs/i18n/locales/locales/ko-KR.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "내 계정"
+    },
+    "loading": "계정을 불러오는 중...",
     "qrHeadline": "Oxy ID로 로그인",
     "signInWithOxy": "Oxy로 로그인",
     "useIdentityOnDevice": "Commons가 없으신가요? 이 기기의 패스키를 사용하세요",

package/dist/cjs/i18n/locales/locales/pt-PT.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "As suas contas"
+    },
+    "loading": "A carregar contas...",
     "qrHeadline": "Inicie sessão com a sua identidade Oxy",
     "signInWithOxy": "Iniciar sessão com Oxy",
     "useIdentityOnDevice": "Não tem o Commons? Use uma chave de acesso neste dispositivo",

package/dist/cjs/i18n/locales/locales/zh-CN.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "你的账户"
+    },
+    "loading": "正在加载账户...",
     "qrHeadline": "使用您的 Oxy 身份登录",
     "signInWithOxy": "使用 Oxy 登录",
     "useIdentityOnDevice": "没有 Commons？改用此设备上的通行密钥",

package/dist/cjs/i18n/locales/pt-PT.json

@@ -112,6 +112,10 @@
         }
     },
     "accountSwitcher": {
+        "sections": {
+            "yourAccounts": "As suas contas"
+        },
+        "loading": "A carregar contas...",
         "qrHeadline": "Inicie sessão com a sua identidade Oxy",
         "signInWithOxy": "Iniciar sessão com Oxy",
         "useIdentityOnDevice": "Não tem o Commons? Use uma chave de acesso neste dispositivo",

package/dist/cjs/i18n/locales/zh-CN.json

@@ -112,6 +112,10 @@
         }
     },
     "accountSwitcher": {
+        "sections": {
+            "yourAccounts": "你的账户"
+        },
+        "loading": "正在加载账户...",
         "qrHeadline": "使用您的 Oxy 身份登录",
         "signInWithOxy": "使用 Oxy 登录",
         "useIdentityOnDevice": "没有 Commons？改用此设备上的通行密钥",

package/dist/cjs/mixins/OxyServices.auth.js

@@ -189,7 +189,7 @@ function OxyServicesAuthMixin(Base) {
          * @internal
          */
         async _doFetchServiceToken(key, secret, cacheKey, secretBuf) {
-            const response = await this.makeRequest('POST', '/auth/service-token', { apiKey: key, apiSecret: secret }, { cache: false, retry: false });
+            const response = await this.makeRequest('POST', '/auth/service-token', { apiKey: key, apiSecret: secret }, { cache: false, retry: false, skipAuth: true });
             const expiresAt = Date.now() + response.expiresIn * 1000;
             // Update the entry in-place so any caller that already grabbed a reference
             // (via `_serviceTokenCache.get(...)`) sees the fresh state.
@@ -286,7 +286,7 @@ function OxyServicesAuthMixin(Base) {
                     publicKey,
                     signature,
                     timestamp,
-                }, { cache: false });
+                }, { cache: false, skipAuth: true });
                 if (!res || (typeof res === 'object' && Object.keys(res).length === 0)) {
                     throw new OxyServices_errors_1.OxyAuthenticationError('Registration failed', 'REGISTER_FAILED', 400);
                 }
@@ -310,7 +310,7 @@ function OxyServicesAuthMixin(Base) {
             try {
                 return await this.makeRequest('POST', '/auth/challenge', {
                     publicKey,
-                }, { cache: false, ...requestOptions });
+                }, { cache: false, skipAuth: true, ...requestOptions });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -339,7 +339,7 @@ function OxyServicesAuthMixin(Base) {
                     timestamp,
                     deviceName,
                     deviceFingerprint,
-                }, { cache: false, ...requestOptions });
+                }, { cache: false, skipAuth: true, ...requestOptions });
                 // Plant the freshly-minted tokens, mirroring `claimSessionByToken`.
                 // `/auth/verify` returns the first access token (and refresh token) in
                 // its body, so installing it here means callers get an authenticated
@@ -362,7 +362,7 @@ function OxyServicesAuthMixin(Base) {
          */
         async checkPublicKeyRegistered(publicKey) {
             try {
-                return await this.makeRequest('GET', `/auth/check-publickey/${encodeURIComponent(publicKey)}`, undefined, { cache: false });
+                return await this.makeRequest('GET', `/auth/check-publickey/${encodeURIComponent(publicKey)}`, undefined, { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -373,7 +373,12 @@ function OxyServicesAuthMixin(Base) {
          */
         async getUserByPublicKey(publicKey) {
             try {
-                const user = await this.makeRequest('GET', `/auth/user/${encodeURIComponent(publicKey)}`, undefined, { cache: true, cacheTTL: 2 * 60 * 1000 });
+                const user = await this.makeRequest('GET', `/auth/user/${encodeURIComponent(publicKey)}`, undefined, {
+                    cache: true,
+                    cacheTTL: 2 * 60 * 1000,
+                    // Public lookup by public key (pre-session) — skip the bearer preflight.
+                    skipAuth: true,
+                });
                 return (0, userIdentity_1.normalizeUserIdentity)(user);
             }
             catch (error) {
@@ -444,7 +449,9 @@ function OxyServicesAuthMixin(Base) {
                 const res = await this.makeRequest('POST', '/auth/session/claim', {
                     sessionToken,
                     ...(options.deviceFingerprint ? { deviceFingerprint: options.deviceFingerprint } : {}),
-                }, { cache: false, retry: false });
+                }, 
+                // Body-authenticated device-flow claim (no bearer) — skip the preflight.
+                { cache: false, retry: false, skipAuth: true });
                 this.setTokens(res.accessToken);
                 return res;
             }
@@ -528,7 +535,11 @@ function OxyServicesAuthMixin(Base) {
                 // QR. Reuses the platform-safe random generator.
                 const sessionToken = await signatureService_1.SignatureService.generateChallenge();
                 const expiresAt = Date.now() + COMMONS_SIGN_IN_EXPIRY_MS;
-                const res = await this.makeRequest('POST', '/auth/session/create', { sessionToken, expiresAt, clientId: params.clientId }, { cache: false });
+                const res = await this.makeRequest('POST', '/auth/session/create', { sessionToken, expiresAt, clientId: params.clientId }, 
+                // Public/pre-session (no bearer): skip the preflight so a stale
+                // near-expiry token cannot re-enter refreshAccessToken while the
+                // refresh handler is already in flight (self-await hang).
+                { cache: false, skipAuth: true });
                 return {
                     sessionToken,
                     authorizeCode: res.authorizeCode,
@@ -552,7 +563,11 @@ function OxyServicesAuthMixin(Base) {
          */
         async pollCommonsSignIn(sessionToken) {
             try {
-                return await this.makeRequest('GET', `/auth/session/status/${encodeURIComponent(sessionToken)}`, undefined, { cache: false, retry: false });
+                return await this.makeRequest('GET', `/auth/session/status/${encodeURIComponent(sessionToken)}`, undefined, 
+                // Public/pre-session (no bearer): a preflight here is wrong per se and,
+                // if ever reached while a refresh is pending, would re-enter
+                // refreshAccessToken and await the very promise it runs inside.
+                { cache: false, retry: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -570,7 +585,10 @@ function OxyServicesAuthMixin(Base) {
          */
         async getCommonsApprovalInfo(authorizeCode) {
             try {
-                const raw = await this.makeRequest('GET', `/auth/session/approve-info/${encodeURIComponent(authorizeCode)}`, undefined, { cache: false });
+                const raw = await this.makeRequest('GET', `/auth/session/approve-info/${encodeURIComponent(authorizeCode)}`, undefined, 
+                // Public (no auth required) — skip the bearer preflight (avoids the
+                // pre-session self-await class).
+                { cache: false, skipAuth: true });
                 return {
                     application: raw.application,
                     scopes: raw.scopes,
@@ -617,7 +635,9 @@ function OxyServicesAuthMixin(Base) {
                     timestamp: signed.timestamp,
                     ...(params.deviceName ? { deviceName: params.deviceName } : {}),
                     ...(params.deviceFingerprint ? { deviceFingerprint: params.deviceFingerprint } : {}),
-                }, { cache: false });
+                }, 
+                // Key-signed, cookieless (no bearer) — skip the preflight.
+                { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -631,7 +651,9 @@ function OxyServicesAuthMixin(Base) {
          */
         async denyCommonsSignIn(authorizeCode) {
             try {
-                return await this.makeRequest('POST', `/auth/session/deny/${encodeURIComponent(authorizeCode)}`, undefined, { cache: false });
+                return await this.makeRequest('POST', `/auth/session/deny/${encodeURIComponent(authorizeCode)}`, undefined, 
+                // Public (no auth required) — skip the bearer preflight.
+                { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -742,7 +764,8 @@ function OxyServicesAuthMixin(Base) {
          */
         async checkUsernameAvailability(username) {
             try {
-                return await this.makeRequest('GET', `/auth/check-username/${username}`, undefined, { cache: false });
+                // Public availability lookup (pre-session) — skip the bearer preflight.
+                return await this.makeRequest('GET', `/auth/check-username/${username}`, undefined, { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -753,7 +776,8 @@ function OxyServicesAuthMixin(Base) {
          */
         async checkEmailAvailability(email) {
             try {
-                return await this.makeRequest('GET', `/auth/check-email/${email}`, undefined, { cache: false });
+                // Public availability lookup (pre-session) — skip the bearer preflight.
+                return await this.makeRequest('GET', `/auth/check-email/${email}`, undefined, { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -772,7 +796,7 @@ function OxyServicesAuthMixin(Base) {
          */
         async webauthnRegisterOptions(username) {
             try {
-                return await this.makeRequest('POST', '/auth/webauthn/register/options', { ...(username !== undefined ? { username } : {}) }, { cache: false });
+                return await this.makeRequest('POST', '/auth/webauthn/register/options', { ...(username !== undefined ? { username } : {}) }, { cache: false, ...(username !== undefined ? { skipAuth: true } : {}) });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -793,7 +817,7 @@ function OxyServicesAuthMixin(Base) {
          */
         async webauthnRegisterVerify(response, envelope = {}) {
             try {
-                const res = await this.makeRequest('POST', '/auth/webauthn/register/verify', { response, ...envelope }, { cache: false });
+                const res = await this.makeRequest('POST', '/auth/webauthn/register/verify', { response, ...envelope }, { cache: false, ...(envelope.username !== undefined ? { skipAuth: true } : {}) });
                 if (res && typeof res === 'object') {
                     const record = res;
                     // Signup branch: mints a session (LoginSessionResult, carries
@@ -831,7 +855,9 @@ function OxyServicesAuthMixin(Base) {
          */
         async webauthnLoginOptions(username) {
             try {
-                return await this.makeRequest('POST', '/auth/webauthn/login/options', { ...(username !== undefined ? { username } : {}) }, { cache: false });
+                return await this.makeRequest('POST', '/auth/webauthn/login/options', { ...(username !== undefined ? { username } : {}) }, 
+                // Pre-session login ceremony — skip the bearer preflight.
+                { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -847,7 +873,9 @@ function OxyServicesAuthMixin(Base) {
          */
         async webauthnLoginVerify(response, envelope = {}) {
             try {
-                const res = await this.makeRequest('POST', '/auth/webauthn/login/verify', { response, ...envelope }, { cache: false });
+                const res = await this.makeRequest('POST', '/auth/webauthn/login/verify', { response, ...envelope }, 
+                // Pre-session login ceremony — skip the bearer preflight.
+                { cache: false, skipAuth: true });
                 const parsed = (0, contracts_1.safeParseContract)(contracts_1.loginResultSchema, res);
                 if (!parsed) {
                     throw new Error('auth/webauthn/login/verify returned an unexpected response shape');
@@ -874,7 +902,7 @@ function OxyServicesAuthMixin(Base) {
                     clientId: params.clientId,
                     redirectUri: params.redirectUri,
                     codeVerifier: params.codeVerifier,
-                }, { cache: false });
+                }, { cache: false, skipAuth: true });
                 const payload = res.data ??
                     res;
                 if (!payload || typeof payload !== 'object') {

package/dist/cjs/mixins/OxyServices.connectedApps.js

@@ -19,7 +19,12 @@ function OxyServicesConnectedAppsMixin(Base) {
          */
         async getPublicApplication(clientId) {
             try {
-                const res = await this.makeRequest('GET', `/auth/oauth/client/${encodeURIComponent(clientId)}`, undefined, { cache: true, cacheTTL: mixinHelpers_1.CACHE_TIMES.MEDIUM });
+                const res = await this.makeRequest('GET', `/auth/oauth/client/${encodeURIComponent(clientId)}`, undefined, {
+                    cache: true,
+                    cacheTTL: mixinHelpers_1.CACHE_TIMES.MEDIUM,
+                    // Public client metadata (pre-session consent UI) — skip the bearer preflight.
+                    skipAuth: true,
+                });
                 return res.application;
             }
             catch (error) {

package/dist/cjs/mixins/OxyServices.deviceBoot.js

@@ -44,7 +44,11 @@ function OxyServicesDeviceBootMixin(Base) {
          */
         async mintFromDeviceSecret(deviceId, deviceSecret) {
             try {
-                const res = await this.makeRequest('POST', '/session/device/token', { deviceId, deviceSecret }, { cache: false, skipAuth: true, retry: false });
+                const res = await this.makeRequest('POST', '/session/device/token', { deviceId, deviceSecret }, 
+                // `bypassQueue`: this mint is the control-plane call the auth lane
+                // depends on — it must run even when every RequestQueue slot is parked
+                // awaiting it, or the whole client deadlocks. See RequestOptions.bypassQueue.
+                { cache: false, skipAuth: true, retry: false, bypassQueue: true });
                 const parsed = (0, contracts_1.safeParseContract)(contracts_1.deviceTokenMintResponseSchema, res);
                 if (!parsed) {
                     throw new Error('session/device/token returned an unexpected response shape');
@@ -72,7 +76,10 @@ function OxyServicesDeviceBootMixin(Base) {
         /** Redeem a hub sync ticket for a fresh device secret (public). */
         async redeemHubTicket(ticket, returnOrigin) {
             try {
-                const res = await this.makeRequest('POST', '/session/device/redeem-ticket', { ticket, returnOrigin }, { cache: false, skipAuth: true });
+                const res = await this.makeRequest('POST', '/session/device/redeem-ticket', { ticket, returnOrigin }, 
+                // Public device-hub sync mint (bearer-less). Same control-plane class as
+                // the device-secret mint — bypassQueue so it never waits for a slot.
+                { cache: false, skipAuth: true, bypassQueue: true });
                 const parsed = (0, contracts_1.safeParseContract)(contracts_1.deviceHubTicketRedeemResponseSchema, res);
                 if (!parsed) {
                     throw new Error('session/device/redeem-ticket returned an unexpected response shape');

package/dist/cjs/mixins/OxyServices.user.js

@@ -59,6 +59,8 @@ function OxyServicesUserMixin(Base) {
             return await this.makeRequest('GET', `/auth/lookup/${encodeURIComponent(username)}`, undefined, {
                 cache: true,
                 cacheTTL: 60 * 1000, // 1 minute cache
+                // Public login-flow lookup (pre-session) — skip the bearer preflight.
+                skipAuth: true,
             });
         }
         /**

package/dist/cjs/session/accountDialogController.js

@@ -36,6 +36,13 @@
  * password, social login, and 2FA were removed ecosystem-wide. Account
  * creation (`signup` view) is the same two identity backends: a passkey
  * ceremony on web, or a Commons-created identity.
+ *
+ * The controller owns NO surface PRESENTATION: whether the account dialog is
+ * mounted, visible, or dismissed is the job of the shared surface stack
+ * (`@oxyhq/services` presents the `AccountDialog` surface into `@oxyhq/bloom`'s
+ * stack). This is a headless state machine only — it exposes `setView` /
+ * `add` / `startSignup` (the view axis) and `cancelSignIn` (device-flow
+ * teardown), never an `open` / `close` / `visible`.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AccountDialogController = void 0;
@@ -252,11 +259,6 @@ class AccountDialogController {
         this.view = view;
         this.emit();
     }
-    /** Return to the account list and cancel any in-flight sign-in flow. */
-    close() {
-        this.cancelSignIn();
-        this.setView('accounts');
-    }
     /** Switch to the "add account" view (the sign-in entry chooser). */
     add() {
         this.setView('add');