@oxyhq/core 12.10.0 → 12.10.2

package/dist/esm/i18n/locales/locales/ko-KR.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "내 계정"
+    },
+    "loading": "계정을 불러오는 중...",
     "qrHeadline": "Oxy ID로 로그인",
     "signInWithOxy": "Oxy로 로그인",
     "useIdentityOnDevice": "Commons가 없으신가요? 이 기기의 패스키를 사용하세요",

package/dist/esm/i18n/locales/locales/pt-PT.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "As suas contas"
+    },
+    "loading": "A carregar contas...",
     "qrHeadline": "Inicie sessão com a sua identidade Oxy",
     "signInWithOxy": "Iniciar sessão com Oxy",
     "useIdentityOnDevice": "Não tem o Commons? Use uma chave de acesso neste dispositivo",

package/dist/esm/i18n/locales/locales/zh-CN.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "你的账户"
+    },
+    "loading": "正在加载账户...",
     "qrHeadline": "使用您的 Oxy 身份登录",
     "signInWithOxy": "使用 Oxy 登录",
     "useIdentityOnDevice": "没有 Commons？改用此设备上的通行密钥",

package/dist/esm/i18n/locales/pt-PT.json

@@ -112,6 +112,10 @@
         }
     },
     "accountSwitcher": {
+        "sections": {
+            "yourAccounts": "As suas contas"
+        },
+        "loading": "A carregar contas...",
         "qrHeadline": "Inicie sessão com a sua identidade Oxy",
         "signInWithOxy": "Iniciar sessão com Oxy",
         "useIdentityOnDevice": "Não tem o Commons? Use uma chave de acesso neste dispositivo",

package/dist/esm/i18n/locales/zh-CN.json

@@ -112,6 +112,10 @@
         }
     },
     "accountSwitcher": {
+        "sections": {
+            "yourAccounts": "你的账户"
+        },
+        "loading": "正在加载账户...",
         "qrHeadline": "使用您的 Oxy 身份登录",
         "signInWithOxy": "使用 Oxy 登录",
         "useIdentityOnDevice": "没有 Commons？改用此设备上的通行密钥",

package/dist/esm/mixins/OxyServices.auth.js

@@ -182,7 +182,7 @@ export function OxyServicesAuthMixin(Base) {
          * @internal
          */
         async _doFetchServiceToken(key, secret, cacheKey, secretBuf) {
-            const response = await this.makeRequest('POST', '/auth/service-token', { apiKey: key, apiSecret: secret }, { cache: false, retry: false });
+            const response = await this.makeRequest('POST', '/auth/service-token', { apiKey: key, apiSecret: secret }, { cache: false, retry: false, skipAuth: true });
             const expiresAt = Date.now() + response.expiresIn * 1000;
             // Update the entry in-place so any caller that already grabbed a reference
             // (via `_serviceTokenCache.get(...)`) sees the fresh state.
@@ -279,7 +279,7 @@ export function OxyServicesAuthMixin(Base) {
                     publicKey,
                     signature,
                     timestamp,
-                }, { cache: false });
+                }, { cache: false, skipAuth: true });
                 if (!res || (typeof res === 'object' && Object.keys(res).length === 0)) {
                     throw new OxyAuthenticationError('Registration failed', 'REGISTER_FAILED', 400);
                 }
@@ -303,7 +303,7 @@ export function OxyServicesAuthMixin(Base) {
             try {
                 return await this.makeRequest('POST', '/auth/challenge', {
                     publicKey,
-                }, { cache: false, ...requestOptions });
+                }, { cache: false, skipAuth: true, ...requestOptions });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -332,7 +332,7 @@ export function OxyServicesAuthMixin(Base) {
                     timestamp,
                     deviceName,
                     deviceFingerprint,
-                }, { cache: false, ...requestOptions });
+                }, { cache: false, skipAuth: true, ...requestOptions });
                 // Plant the freshly-minted tokens, mirroring `claimSessionByToken`.
                 // `/auth/verify` returns the first access token (and refresh token) in
                 // its body, so installing it here means callers get an authenticated
@@ -355,7 +355,7 @@ export function OxyServicesAuthMixin(Base) {
          */
         async checkPublicKeyRegistered(publicKey) {
             try {
-                return await this.makeRequest('GET', `/auth/check-publickey/${encodeURIComponent(publicKey)}`, undefined, { cache: false });
+                return await this.makeRequest('GET', `/auth/check-publickey/${encodeURIComponent(publicKey)}`, undefined, { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -366,7 +366,12 @@ export function OxyServicesAuthMixin(Base) {
          */
         async getUserByPublicKey(publicKey) {
             try {
-                const user = await this.makeRequest('GET', `/auth/user/${encodeURIComponent(publicKey)}`, undefined, { cache: true, cacheTTL: 2 * 60 * 1000 });
+                const user = await this.makeRequest('GET', `/auth/user/${encodeURIComponent(publicKey)}`, undefined, {
+                    cache: true,
+                    cacheTTL: 2 * 60 * 1000,
+                    // Public lookup by public key (pre-session) — skip the bearer preflight.
+                    skipAuth: true,
+                });
                 return normalizeUserIdentity(user);
             }
             catch (error) {
@@ -437,7 +442,9 @@ export function OxyServicesAuthMixin(Base) {
                 const res = await this.makeRequest('POST', '/auth/session/claim', {
                     sessionToken,
                     ...(options.deviceFingerprint ? { deviceFingerprint: options.deviceFingerprint } : {}),
-                }, { cache: false, retry: false });
+                }, 
+                // Body-authenticated device-flow claim (no bearer) — skip the preflight.
+                { cache: false, retry: false, skipAuth: true });
                 this.setTokens(res.accessToken);
                 return res;
             }
@@ -521,7 +528,11 @@ export function OxyServicesAuthMixin(Base) {
                 // QR. Reuses the platform-safe random generator.
                 const sessionToken = await SignatureService.generateChallenge();
                 const expiresAt = Date.now() + COMMONS_SIGN_IN_EXPIRY_MS;
-                const res = await this.makeRequest('POST', '/auth/session/create', { sessionToken, expiresAt, clientId: params.clientId }, { cache: false });
+                const res = await this.makeRequest('POST', '/auth/session/create', { sessionToken, expiresAt, clientId: params.clientId }, 
+                // Public/pre-session (no bearer): skip the preflight so a stale
+                // near-expiry token cannot re-enter refreshAccessToken while the
+                // refresh handler is already in flight (self-await hang).
+                { cache: false, skipAuth: true });
                 return {
                     sessionToken,
                     authorizeCode: res.authorizeCode,
@@ -545,7 +556,11 @@ export function OxyServicesAuthMixin(Base) {
          */
         async pollCommonsSignIn(sessionToken) {
             try {
-                return await this.makeRequest('GET', `/auth/session/status/${encodeURIComponent(sessionToken)}`, undefined, { cache: false, retry: false });
+                return await this.makeRequest('GET', `/auth/session/status/${encodeURIComponent(sessionToken)}`, undefined, 
+                // Public/pre-session (no bearer): a preflight here is wrong per se and,
+                // if ever reached while a refresh is pending, would re-enter
+                // refreshAccessToken and await the very promise it runs inside.
+                { cache: false, retry: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -563,7 +578,10 @@ export function OxyServicesAuthMixin(Base) {
          */
         async getCommonsApprovalInfo(authorizeCode) {
             try {
-                const raw = await this.makeRequest('GET', `/auth/session/approve-info/${encodeURIComponent(authorizeCode)}`, undefined, { cache: false });
+                const raw = await this.makeRequest('GET', `/auth/session/approve-info/${encodeURIComponent(authorizeCode)}`, undefined, 
+                // Public (no auth required) — skip the bearer preflight (avoids the
+                // pre-session self-await class).
+                { cache: false, skipAuth: true });
                 return {
                     application: raw.application,
                     scopes: raw.scopes,
@@ -610,7 +628,9 @@ export function OxyServicesAuthMixin(Base) {
                     timestamp: signed.timestamp,
                     ...(params.deviceName ? { deviceName: params.deviceName } : {}),
                     ...(params.deviceFingerprint ? { deviceFingerprint: params.deviceFingerprint } : {}),
-                }, { cache: false });
+                }, 
+                // Key-signed, cookieless (no bearer) — skip the preflight.
+                { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -624,7 +644,9 @@ export function OxyServicesAuthMixin(Base) {
          */
         async denyCommonsSignIn(authorizeCode) {
             try {
-                return await this.makeRequest('POST', `/auth/session/deny/${encodeURIComponent(authorizeCode)}`, undefined, { cache: false });
+                return await this.makeRequest('POST', `/auth/session/deny/${encodeURIComponent(authorizeCode)}`, undefined, 
+                // Public (no auth required) — skip the bearer preflight.
+                { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -735,7 +757,8 @@ export function OxyServicesAuthMixin(Base) {
          */
         async checkUsernameAvailability(username) {
             try {
-                return await this.makeRequest('GET', `/auth/check-username/${username}`, undefined, { cache: false });
+                // Public availability lookup (pre-session) — skip the bearer preflight.
+                return await this.makeRequest('GET', `/auth/check-username/${username}`, undefined, { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -746,7 +769,8 @@ export function OxyServicesAuthMixin(Base) {
          */
         async checkEmailAvailability(email) {
             try {
-                return await this.makeRequest('GET', `/auth/check-email/${email}`, undefined, { cache: false });
+                // Public availability lookup (pre-session) — skip the bearer preflight.
+                return await this.makeRequest('GET', `/auth/check-email/${email}`, undefined, { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -765,7 +789,7 @@ export function OxyServicesAuthMixin(Base) {
          */
         async webauthnRegisterOptions(username) {
             try {
-                return await this.makeRequest('POST', '/auth/webauthn/register/options', { ...(username !== undefined ? { username } : {}) }, { cache: false });
+                return await this.makeRequest('POST', '/auth/webauthn/register/options', { ...(username !== undefined ? { username } : {}) }, { cache: false, ...(username !== undefined ? { skipAuth: true } : {}) });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -786,7 +810,7 @@ export function OxyServicesAuthMixin(Base) {
          */
         async webauthnRegisterVerify(response, envelope = {}) {
             try {
-                const res = await this.makeRequest('POST', '/auth/webauthn/register/verify', { response, ...envelope }, { cache: false });
+                const res = await this.makeRequest('POST', '/auth/webauthn/register/verify', { response, ...envelope }, { cache: false, ...(envelope.username !== undefined ? { skipAuth: true } : {}) });
                 if (res && typeof res === 'object') {
                     const record = res;
                     // Signup branch: mints a session (LoginSessionResult, carries
@@ -824,7 +848,9 @@ export function OxyServicesAuthMixin(Base) {
          */
         async webauthnLoginOptions(username) {
             try {
-                return await this.makeRequest('POST', '/auth/webauthn/login/options', { ...(username !== undefined ? { username } : {}) }, { cache: false });
+                return await this.makeRequest('POST', '/auth/webauthn/login/options', { ...(username !== undefined ? { username } : {}) }, 
+                // Pre-session login ceremony — skip the bearer preflight.
+                { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -840,7 +866,9 @@ export function OxyServicesAuthMixin(Base) {
          */
         async webauthnLoginVerify(response, envelope = {}) {
             try {
-                const res = await this.makeRequest('POST', '/auth/webauthn/login/verify', { response, ...envelope }, { cache: false });
+                const res = await this.makeRequest('POST', '/auth/webauthn/login/verify', { response, ...envelope }, 
+                // Pre-session login ceremony — skip the bearer preflight.
+                { cache: false, skipAuth: true });
                 const parsed = safeParseContract(loginResultSchema, res);
                 if (!parsed) {
                     throw new Error('auth/webauthn/login/verify returned an unexpected response shape');
@@ -867,7 +895,7 @@ export function OxyServicesAuthMixin(Base) {
                     clientId: params.clientId,
                     redirectUri: params.redirectUri,
                     codeVerifier: params.codeVerifier,
-                }, { cache: false });
+                }, { cache: false, skipAuth: true });
                 const payload = res.data ??
                     res;
                 if (!payload || typeof payload !== 'object') {

package/dist/esm/mixins/OxyServices.connectedApps.js

@@ -16,7 +16,12 @@ export function OxyServicesConnectedAppsMixin(Base) {
          */
         async getPublicApplication(clientId) {
             try {
-                const res = await this.makeRequest('GET', `/auth/oauth/client/${encodeURIComponent(clientId)}`, undefined, { cache: true, cacheTTL: CACHE_TIMES.MEDIUM });
+                const res = await this.makeRequest('GET', `/auth/oauth/client/${encodeURIComponent(clientId)}`, undefined, {
+                    cache: true,
+                    cacheTTL: CACHE_TIMES.MEDIUM,
+                    // Public client metadata (pre-session consent UI) — skip the bearer preflight.
+                    skipAuth: true,
+                });
                 return res.application;
             }
             catch (error) {

package/dist/esm/mixins/OxyServices.deviceBoot.js

@@ -41,7 +41,11 @@ export function OxyServicesDeviceBootMixin(Base) {
          */
         async mintFromDeviceSecret(deviceId, deviceSecret) {
             try {
-                const res = await this.makeRequest('POST', '/session/device/token', { deviceId, deviceSecret }, { cache: false, skipAuth: true, retry: false });
+                const res = await this.makeRequest('POST', '/session/device/token', { deviceId, deviceSecret }, 
+                // `bypassQueue`: this mint is the control-plane call the auth lane
+                // depends on — it must run even when every RequestQueue slot is parked
+                // awaiting it, or the whole client deadlocks. See RequestOptions.bypassQueue.
+                { cache: false, skipAuth: true, retry: false, bypassQueue: true });
                 const parsed = safeParseContract(deviceTokenMintResponseSchema, res);
                 if (!parsed) {
                     throw new Error('session/device/token returned an unexpected response shape');
@@ -69,7 +73,10 @@ export function OxyServicesDeviceBootMixin(Base) {
         /** Redeem a hub sync ticket for a fresh device secret (public). */
         async redeemHubTicket(ticket, returnOrigin) {
             try {
-                const res = await this.makeRequest('POST', '/session/device/redeem-ticket', { ticket, returnOrigin }, { cache: false, skipAuth: true });
+                const res = await this.makeRequest('POST', '/session/device/redeem-ticket', { ticket, returnOrigin }, 
+                // Public device-hub sync mint (bearer-less). Same control-plane class as
+                // the device-secret mint — bypassQueue so it never waits for a slot.
+                { cache: false, skipAuth: true, bypassQueue: true });
                 const parsed = safeParseContract(deviceHubTicketRedeemResponseSchema, res);
                 if (!parsed) {
                     throw new Error('session/device/redeem-ticket returned an unexpected response shape');

package/dist/esm/mixins/OxyServices.user.js

@@ -56,6 +56,8 @@ export function OxyServicesUserMixin(Base) {
             return await this.makeRequest('GET', `/auth/lookup/${encodeURIComponent(username)}`, undefined, {
                 cache: true,
                 cacheTTL: 60 * 1000, // 1 minute cache
+                // Public login-flow lookup (pre-session) — skip the bearer preflight.
+                skipAuth: true,
             });
         }
         /**

package/dist/esm/session/accountDialogController.js

@@ -35,6 +35,13 @@
  * password, social login, and 2FA were removed ecosystem-wide. Account
  * creation (`signup` view) is the same two identity backends: a passkey
  * ceremony on web, or a Commons-created identity.
+ *
+ * The controller owns NO surface PRESENTATION: whether the account dialog is
+ * mounted, visible, or dismissed is the job of the shared surface stack
+ * (`@oxyhq/services` presents the `AccountDialog` surface into `@oxyhq/bloom`'s
+ * stack). This is a headless state machine only — it exposes `setView` /
+ * `add` / `startSignup` (the view axis) and `cancelSignIn` (device-flow
+ * teardown), never an `open` / `close` / `visible`.
  */
 import { logger } from '../logger/index.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
@@ -248,11 +255,6 @@ export class AccountDialogController {
         this.view = view;
         this.emit();
     }
-    /** Return to the account list and cancel any in-flight sign-in flow. */
-    close() {
-        this.cancelSignIn();
-        this.setView('accounts');
-    }
     /** Switch to the "add account" view (the sign-in entry chooser). */
     add() {
         this.setView('add');