@oxyhq/core 12.10.0 → 12.10.2

package/dist/types/HttpService.d.ts

@@ -40,6 +40,20 @@ export interface RequestOptions {
      * mint call fully independent of the current (near-expired) bearer.
      */
     skipAuth?: boolean;
+    /**
+     * Execute this request WITHOUT taking a `RequestQueue` slot — run it directly.
+     *
+     * A queue slot represents network occupancy for ordinary DATA requests. The
+     * CONTROL-PLANE calls the auth lane depends on (the device-secret mint, `POST
+     * /session/device/token`, reached from `getAuthHeader` → `refreshAccessToken`)
+     * must never compete for a slot: when `maxConcurrentRequests` requests are all
+     * parked awaiting that very mint, a queued mint could never acquire a slot to
+     * run — a systemic deadlock. `bypassQueue` lets the mint run even when the
+     * queue is saturated. (The auth preflight is also resolved OUTSIDE the slot in
+     * `request()`, so ordinary requests never hold a slot while awaiting the mint;
+     * this flag is the explicit guarantee for the mint itself.)
+     */
+    bypassQueue?: boolean;
 }
 interface RequestConfig extends RequestOptions {
     method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';

package/dist/types/session/accountDialogController.d.ts

@@ -35,6 +35,13 @@
  * password, social login, and 2FA were removed ecosystem-wide. Account
  * creation (`signup` view) is the same two identity backends: a passkey
  * ceremony on web, or a Commons-created identity.
+ *
+ * The controller owns NO surface PRESENTATION: whether the account dialog is
+ * mounted, visible, or dismissed is the job of the shared surface stack
+ * (`@oxyhq/services` presents the `AccountDialog` surface into `@oxyhq/bloom`'s
+ * stack). This is a headless state machine only — it exposes `setView` /
+ * `add` / `startSignup` (the view axis) and `cancelSignIn` (device-flow
+ * teardown), never an `open` / `close` / `visible`.
  */
 import type { OxyServices } from '../OxyServices';
 import type { SessionLoginResponse, MinimalUserData } from '../models/session';
@@ -294,8 +301,6 @@ export declare class AccountDialogController {
     private reconcileAuth;
     /** Set the dialog view directly. */
     setView(view: AccountDialogView): void;
-    /** Return to the account list and cancel any in-flight sign-in flow. */
-    close(): void;
     /** Switch to the "add account" view (the sign-in entry chooser). */
     add(): void;
     /** Switch to the "create account" view (passkey / Commons signup entry). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "12.10.0",
+  "version": "12.10.2",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/HttpService.ts

@@ -85,6 +85,20 @@ export interface RequestOptions {
    * mint call fully independent of the current (near-expired) bearer.
    */
   skipAuth?: boolean;
+  /**
+   * Execute this request WITHOUT taking a `RequestQueue` slot — run it directly.
+   *
+   * A queue slot represents network occupancy for ordinary DATA requests. The
+   * CONTROL-PLANE calls the auth lane depends on (the device-secret mint, `POST
+   * /session/device/token`, reached from `getAuthHeader` → `refreshAccessToken`)
+   * must never compete for a slot: when `maxConcurrentRequests` requests are all
+   * parked awaiting that very mint, a queued mint could never acquire a slot to
+   * run — a systemic deadlock. `bypassQueue` lets the mint run even when the
+   * queue is saturated. (The auth preflight is also resolved OUTSIDE the slot in
+   * `request()`, so ordinary requests never hold a slot while awaiting the mint;
+   * this flag is the explicit guarantee for the mint itself.)
+   */
+  bypassQueue?: boolean;
 }
 
 interface RequestConfig extends RequestOptions {
@@ -414,24 +428,29 @@ export class HttpService {
       this.requestMetrics.cacheMisses++;
     }
 
+    // Resolve the auth preflight OUTSIDE the queue slot. A slot represents
+    // NETWORK OCCUPANCY only. `getAuthHeader` may await the single-flight token
+    // refresh/mint — itself a request — so if a slot-holding request awaited it
+    // here and every slot were held by requests all waiting on that same mint,
+    // the mint could never acquire a slot to run (systemic deadlock). Resolving
+    // it before enqueue means auth-blocked requests hold NO slot while the shared
+    // mint runs. `skipAuth` requests (the body-authenticated mint) send NO bearer
+    // and skip the near-expiry preflight — see RequestOptions.skipAuth. The
+    // 401/CSRF retry re-enters request() with a fresh config, so it re-resolves
+    // these here with the refreshed token / cleared CSRF.
+    const isStateChangingMethod = ['POST', 'PUT', 'PATCH', 'DELETE'].includes(method);
+    const authHeader = config.skipAuth ? null : await this.getAuthHeader();
+    // CSRF protects cookie-authenticated browser writes. Bearer-authenticated SDK
+    // clients are not vulnerable to ambient-cookie CSRF, and linked app APIs
+    // should not need to implement a duplicate `/csrf-token` route.
+    const csrfToken = isStateChangingMethod && !authHeader ? await this.fetchCsrfToken() : null;
+
     // Request function
     const requestFn = async (): Promise<T> => {
       const startTime = Date.now();
       try {
         // Build URL with params
         const fullUrl = this.buildURL(url, params);
-        
-        // Get auth token (with auto-refresh). `skipAuth` requests (the
-        // body-authenticated refresh endpoint) send NO bearer and skip the
-        // near-expiry preflight — see RequestOptions.skipAuth for the deadlock
-        // this avoids.
-        const authHeader = config.skipAuth ? null : await this.getAuthHeader();
-
-        // CSRF protects cookie-authenticated browser writes. Bearer-authenticated
-        // SDK clients are not vulnerable to ambient-cookie CSRF, and linked app
-        // APIs should not need to implement a duplicate `/csrf-token` route.
-        const isStateChangingMethod = ['POST', 'PUT', 'PATCH', 'DELETE'].includes(method);
-        const csrfToken = isStateChangingMethod && !authHeader ? await this.fetchCsrfToken() : null;
 
         // Determine if data is FormData using robust detection
         const isFormData = this.isFormData(data);
@@ -665,8 +684,12 @@ export class HttpService {
       ? () => this.deduplicator.deduplicate(dedupeKey, requestWithRetry)
       : requestWithRetry;
 
-    // Execute request (with queue if needed)
-    const result = await this.requestQueue.enqueue(finalRequest);
+    // Execute the request. Control-plane calls the auth lane depends on
+    // (`bypassQueue`, e.g. the device-secret mint) run DIRECTLY — a queued mint
+    // could never acquire a slot when every slot is parked awaiting it.
+    const result = config.bypassQueue
+      ? await finalRequest()
+      : await this.requestQueue.enqueue(finalRequest);
 
     // Cache the result if caching is enabled
     if (cache && cacheKey && result) {

package/src/__tests__/httpServiceAuthSelfAwait.test.ts

@@ -0,0 +1,108 @@
+/**
+ * Auth self-await regression.
+ *
+ * The refresh handler (arm 2 shared-key sign-in) calls PRE-SESSION public
+ * endpoints (`/auth/challenge`, `/auth/verify`, the commons-signin surface, …)
+ * from INSIDE the single-flight `tokenRefreshPromise`. If any of those carried
+ * an auth preflight (no `skipAuth`), its `getAuthHeader` would call
+ * `refreshAccessToken`, find the handler's own promise already in flight, and
+ * await it — the handler awaiting itself → permanent hang (no deadline on the
+ * auto-connect lane makes it visible). `skipAuth` on every pre-session public
+ * endpoint is what prevents this; these tests lock the invariant.
+ */
+import { HttpService } from '../HttpService';
+
+function createJwt(payload: Record<string, unknown>): string {
+  const encode = (value: unknown): string => Buffer.from(JSON.stringify(value)).toString('base64url');
+  return `${encode({ alg: 'HS256', typ: 'JWT' })}.${encode(payload)}.signature`;
+}
+
+function jsonResponse(data: unknown): Response {
+  return new Response(JSON.stringify({ data }), {
+    status: 200,
+    headers: { 'content-type': 'application/json' },
+  });
+}
+
+const nowSec = (): number => Math.floor(Date.now() / 1000);
+
+/** Resolve to `true` if `promise` settles within `ms`, else `false`. Always
+ *  clears its timer so no pending timeout leaks into jest's teardown. */
+async function settlesWithin(promise: Promise<unknown>, ms: number): Promise<boolean> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const timeout = new Promise<false>((resolve) => {
+    timer = setTimeout(() => resolve(false), ms);
+  });
+  try {
+    return await Promise.race([promise.then(() => true), timeout]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+describe('HttpService auth self-await', () => {
+  const originalFetch = globalThis.fetch;
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+    jest.restoreAllMocks();
+  });
+
+  it('a skipAuth request issued from INSIDE the refresh handler resolves (no self-await)', async () => {
+    globalThis.fetch = (async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.includes('/auth/challenge')) return jsonResponse({ challenge: 'c' });
+      return jsonResponse({ ok: true });
+    }) as typeof fetch;
+
+    const http = new HttpService({ baseURL: 'https://api.oxy.so', enableRetry: false });
+    // Near-expiry → the data request's preflight starts the refresh.
+    http.setTokens(createJwt({ userId: 'u', exp: nowSec() + 30 }));
+
+    http.setAuthRefreshHandler(async () => {
+      // Mirror arm 2: from inside the handler, hit a pre-session public endpoint.
+      // With skipAuth it does NOT re-enter refreshAccessToken; without it, its
+      // preflight would await THIS handler's own pending promise → self-await.
+      await http.post('/auth/challenge', { publicKey: 'p' }, { skipAuth: true, retry: false });
+      const fresh = createJwt({ userId: 'u', exp: nowSec() + 3600, jti: 'fresh' });
+      http.setTokens(fresh);
+      return fresh;
+    });
+
+    expect(await settlesWithin(http.get('/data'), 500)).toBe(true);
+  });
+
+  it('a skipAuth public request does NOT await a pending refresh', async () => {
+    let releaseRefresh: (() => void) | undefined;
+    const refreshGate = new Promise<void>((resolve) => {
+      releaseRefresh = resolve;
+    });
+
+    globalThis.fetch = (async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.includes('/auth/challenge')) return jsonResponse({ challenge: 'c' });
+      return jsonResponse({ ok: true });
+    }) as typeof fetch;
+
+    const http = new HttpService({ baseURL: 'https://api.oxy.so', enableRetry: false });
+    http.setTokens(createJwt({ userId: 'u', exp: nowSec() + 30 }));
+
+    http.setAuthRefreshHandler(async () => {
+      await refreshGate; // hold the refresh open
+      const fresh = createJwt({ userId: 'u', exp: nowSec() + 3600, jti: 'fresh' });
+      http.setTokens(fresh);
+      return fresh;
+    });
+
+    // A data request whose preflight starts (and blocks on) the held refresh.
+    const data = http.get('/data');
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    // A skipAuth public request must settle WITHOUT waiting for the held refresh.
+    const pub = http.post('/auth/challenge', { publicKey: 'p' }, { skipAuth: true, retry: false });
+    expect(await settlesWithin(pub, 300)).toBe(true);
+
+    releaseRefresh?.();
+    await data;
+  });
+});

package/src/__tests__/httpServiceQueueDeadlock.test.ts

@@ -0,0 +1,128 @@
+/**
+ * RequestQueue deadlock regression.
+ *
+ * The auth preflight (`getAuthHeader` → single-flight `refreshAccessToken` → the
+ * device-secret mint) used to run INSIDE a RequestQueue slot, and the mint itself
+ * went through the queue. When `maxConcurrentRequests` requests all parked in
+ * slots awaiting that same mint, the mint could never acquire a slot to run —
+ * a systemic deadlock in which NOTHING settles (observed on a real device: the
+ * running count climbs to the pool size with zero settled requests, including a
+ * public GET /health). The fix: (1) `bypassQueue` runs control-plane calls (the
+ * mint) directly, and (2) the preflight is resolved OUTSIDE the slot, so an
+ * auth-blocked request never holds a slot while the shared mint runs.
+ */
+import { HttpService } from '../HttpService';
+
+function createJwt(payload: Record<string, unknown>): string {
+  const encode = (value: unknown): string => Buffer.from(JSON.stringify(value)).toString('base64url');
+  return `${encode({ alg: 'HS256', typ: 'JWT' })}.${encode(payload)}.signature`;
+}
+
+function jsonResponse(data: unknown): Response {
+  return new Response(JSON.stringify({ data }), {
+    status: 200,
+    headers: { 'content-type': 'application/json' },
+  });
+}
+
+/** Resolve to `true` if `promise` settles within `ms`, else `false`. Always
+ *  clears its timer so no pending timeout leaks into jest's teardown. */
+async function settlesWithin(promise: Promise<unknown>, ms: number): Promise<boolean> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const timeout = new Promise<false>((resolve) => {
+    timer = setTimeout(() => resolve(false), ms);
+  });
+  try {
+    return await Promise.race([promise.then(() => true), timeout]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+describe('HttpService RequestQueue deadlock', () => {
+  const originalFetch = globalThis.fetch;
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+    jest.restoreAllMocks();
+  });
+
+  it('runs a bypassQueue control-plane request even when every slot is held', async () => {
+    const releases: Array<() => void> = [];
+    globalThis.fetch = (async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.includes('/slow')) {
+        // Occupy the slot indefinitely until explicitly released.
+        await new Promise<void>((resolve) => releases.push(resolve));
+        return jsonResponse({ slow: true });
+      }
+      return jsonResponse({ minted: true });
+    }) as typeof fetch;
+
+    const http = new HttpService({
+      baseURL: 'https://api.oxy.so',
+      maxConcurrentRequests: 2,
+      enableRetry: false,
+    });
+
+    // Saturate both slots with requests whose fetch never settles.
+    const slowA = http.get('/slow/a', { skipAuth: true });
+    const slowB = http.get('/slow/b', { skipAuth: true });
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    // The device-secret mint (bypassQueue) must still run despite full saturation.
+    const mint = http.post(
+      '/session/device/token',
+      { deviceId: 'd', deviceSecret: 's' },
+      { skipAuth: true, bypassQueue: true, retry: false },
+    );
+
+    expect(await settlesWithin(mint, 500)).toBe(true);
+
+    releases.forEach((release) => release());
+    await Promise.all([slowA, slowB]);
+  });
+
+  it('does not deadlock when a boot burst larger than the pool all trigger the same preflight mint', async () => {
+    const now = Math.floor(Date.now() / 1000);
+    // Within the 60s refresh lead window → every request's preflight refreshes.
+    const nearExpiry = createJwt({ userId: 'u', exp: now + 30 });
+    const fresh = createJwt({ userId: 'u', exp: now + 3600, jti: 'fresh' });
+
+    let mintCalls = 0;
+    globalThis.fetch = (async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.includes('/session/device/token')) {
+        mintCalls += 1;
+        return jsonResponse({ minted: true });
+      }
+      return jsonResponse({ ok: true });
+    }) as typeof fetch;
+
+    const http = new HttpService({
+      baseURL: 'https://api.oxy.so',
+      maxConcurrentRequests: 2,
+      enableRetry: false,
+    });
+    http.setTokens(nearExpiry);
+
+    http.setAuthRefreshHandler(async () => {
+      // Mirror refreshDeviceSecretArm: mint via a bypassQueue request through the
+      // SAME instance, then plant + return the fresh token.
+      await http.post(
+        '/session/device/token',
+        { deviceId: 'd', deviceSecret: 's' },
+        { skipAuth: true, bypassQueue: true, retry: false },
+      );
+      http.setTokens(fresh);
+      return fresh;
+    });
+
+    // A boot burst of 4 against a pool of 2, all in the near-expiry window.
+    const burst = Promise.all([http.get('/a'), http.get('/b'), http.get('/c'), http.get('/d')]);
+
+    expect(await settlesWithin(burst, 800)).toBe(true);
+    // The single-flight refresh coalesces the whole burst into ONE mint.
+    expect(mintCalls).toBe(1);
+  });
+});

package/src/i18n/locales/ar-SA.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "حساباتك"
+    },
+    "loading": "جارٍ تحميل الحسابات...",
     "qrHeadline": "سجّل الدخول بهوية Oxy الخاصة بك",
     "signInWithOxy": "تسجيل الدخول باستخدام Oxy",
     "useIdentityOnDevice": "لا تملك Commons؟ استخدم مفتاح مرور على هذا الجهاز بدلاً من ذلك",

package/src/i18n/locales/ca-ES.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "Els teus comptes"
+    },
+    "loading": "S'estan carregant els comptes...",
     "qrHeadline": "Inicia sessió amb la teva identitat d'Oxy",
     "signInWithOxy": "Inicia sessió amb Oxy",
     "useIdentityOnDevice": "No tens Commons? Fes servir una clau d'accés en aquest dispositiu",

package/src/i18n/locales/de-DE.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "Ihre Konten"
+    },
+    "loading": "Konten werden geladen...",
     "qrHeadline": "Melden Sie sich mit Ihrer Oxy-Identität an",
     "signInWithOxy": "Mit Oxy anmelden",
     "useIdentityOnDevice": "Kein Commons? Verwenden Sie stattdessen einen Passkey auf diesem Gerät",

package/src/i18n/locales/en-US.json

@@ -421,7 +421,8 @@
     "getCommons": "Get Commons",
     "commonsNotInstalled": "Don't have Commons? Get the app to sign in with your Oxy ID.",
     "showQrAnyway": "I have Commons on another device",
-    "switchWhileSignedInAs": "Switch account, signed in as {{name}}"
+    "switchWhileSignedInAs": "Switch account, signed in as {{name}}",
+    "manageOnDevice": "Manage accounts on this device"
   },
   "reputation": {
     "faq": {
@@ -754,6 +755,8 @@
       "saving": "Saving…",
       "helper": "The cropped circle is what will appear on your profile. Pinch to zoom, drag to position.",
       "zoom": "{{value}}×",
+      "zoomIn": "Zoom in",
+      "zoomOut": "Zoom out",
       "a11yImage": "Crop preview. Pinch to zoom and drag to reposition the image.",
       "a11yReset": "Reset crop to default position",
       "a11yResetAnnouncement": "Crop reset"
@@ -774,6 +777,47 @@
     },
     "changeAvatar": "Change avatar"
   },
+  "changeAvatar": {
+    "title": "Change profile picture",
+    "sources": {
+      "upload": {
+        "title": "Upload from device",
+        "description": "Choose a photo from your gallery"
+      },
+      "camera": {
+        "title": "Take a picture",
+        "description": "Use your camera"
+      },
+      "files": {
+        "title": "My Oxy files",
+        "description": "Pick an image you already uploaded"
+      },
+      "remove": {
+        "title": "Remove current photo",
+        "description": "Go back to your initials"
+      }
+    },
+    "remove": {
+      "confirmTitle": "Remove profile picture?",
+      "confirmMessage": "Your profile will show your initials instead. You can add a new photo at any time.",
+      "confirmLabel": "Remove"
+    },
+    "permission": {
+      "libraryDenied": "Oxy needs access to your photos to upload a picture.",
+      "cameraDenied": "Oxy needs access to your camera to take a picture.",
+      "openSettings": "Open settings"
+    },
+    "errors": {
+      "pickerUnavailable": "Photo picking is not available on this device.",
+      "cameraUnavailable": "The camera is not available on this device.",
+      "pickFailed": "Could not open the photo picker.",
+      "cameraFailed": "Could not open the camera.",
+      "loadImageFailed": "Could not load the selected image."
+    },
+    "a11y": {
+      "currentPhoto": "Your current profile picture"
+    }
+  },
   "accountOverview": {
     "title": "Account",
     "sections": {
@@ -1442,6 +1486,11 @@
     "uploadPhotos": "Upload Photos",
     "uploadFiles": "Upload Files",
     "clearSearch": "Clear Search",
+    "retry": "Try again",
+    "loadError": {
+      "title": "Couldn't load your files",
+      "description": "Something went wrong. Check your connection and try again."
+    },
     "choosePhoto": "Choose Photo",
     "done": "Done",
     "doneWithCount": "Done ({{count}})",
@@ -1614,7 +1663,9 @@
   },
   "accountMenu": {
     "label": "Account menu",
-    "manage": "Manage your Oxy Account",
+    "manage": "Manage your Oxy account",
+    "greeting": "Hi, {{name}}!",
+    "switchAccount": "Switch account",
     "viewProfile": "View profile",
     "addAnother": "Add another account",
     "signOutAll": "Sign out of all accounts",
@@ -1622,7 +1673,22 @@
     "openHint": "Opens the account menu",
     "openWithUser": "Account menu for {{name}}",
     "switching": "Switching account…",
-    "signOutAccount": "Sign out {{name}}"
+    "signOutAccount": "Sign out {{name}}",
+    "storage": {
+      "title": "Oxy storage",
+      "usage": "{{used}} of {{total}} used",
+      "used": "Used",
+      "free": "Free",
+      "unavailable": "Usage details unavailable",
+      "upgrade": "Upgrade plan",
+      "manage": "Manage storage"
+    },
+    "data": "Your data in Oxy",
+    "settings": "Oxy settings",
+    "help": "Help & feedback",
+    "signOut": "Sign out",
+    "privacy": "Privacy Policy",
+    "terms": "Terms of Service"
   },
   "accounts": {
     "activeAccount": {

package/src/i18n/locales/es-ES.json

@@ -290,6 +290,8 @@
       "saving": "Guardando…",
       "helper": "El círculo recortado es lo que aparecerá en tu perfil. Pellizca para acercar, arrastra para colocar.",
       "zoom": "{{value}}×",
+      "zoomIn": "Acercar",
+      "zoomOut": "Alejar",
       "a11yImage": "Vista previa del recorte. Pellizca para acercar y arrastra para reposicionar la imagen.",
       "a11yReset": "Restablecer el recorte a la posición predeterminada",
       "a11yResetAnnouncement": "Recorte restablecido"
@@ -310,6 +312,47 @@
     },
     "changeAvatar": "Cambiar avatar"
   },
+  "changeAvatar": {
+    "title": "Cambiar foto de perfil",
+    "sources": {
+      "upload": {
+        "title": "Subir desde el dispositivo",
+        "description": "Elige una foto de tu galería"
+      },
+      "camera": {
+        "title": "Hacer una foto",
+        "description": "Usa tu cámara"
+      },
+      "files": {
+        "title": "Mis archivos de Oxy",
+        "description": "Elige una imagen que ya has subido"
+      },
+      "remove": {
+        "title": "Eliminar la foto actual",
+        "description": "Vuelve a tus iniciales"
+      }
+    },
+    "remove": {
+      "confirmTitle": "¿Eliminar la foto de perfil?",
+      "confirmMessage": "Tu perfil mostrará tus iniciales. Puedes añadir una foto nueva cuando quieras.",
+      "confirmLabel": "Eliminar"
+    },
+    "permission": {
+      "libraryDenied": "Oxy necesita acceso a tus fotos para subir una imagen.",
+      "cameraDenied": "Oxy necesita acceso a tu cámara para hacer una foto.",
+      "openSettings": "Abrir ajustes"
+    },
+    "errors": {
+      "pickerUnavailable": "La selección de fotos no está disponible en este dispositivo.",
+      "cameraUnavailable": "La cámara no está disponible en este dispositivo.",
+      "pickFailed": "No se pudo abrir el selector de fotos.",
+      "cameraFailed": "No se pudo abrir la cámara.",
+      "loadImageFailed": "No se pudo cargar la imagen seleccionada."
+    },
+    "a11y": {
+      "currentPhoto": "Tu foto de perfil actual"
+    }
+  },
   "common": {
     "actions": {
       "back": "Atrás",
@@ -619,7 +662,8 @@
     "getCommons": "Descargar Commons",
     "commonsNotInstalled": "¿No tienes Commons? Descarga la app para iniciar sesión con tu Oxy ID.",
     "showQrAnyway": "Tengo Commons en otro dispositivo",
-    "switchWhileSignedInAs": "Cambiar de cuenta, con la sesión iniciada como {{name}}"
+    "switchWhileSignedInAs": "Cambiar de cuenta, con la sesión iniciada como {{name}}",
+    "manageOnDevice": "Gestionar cuentas en este dispositivo"
   },
   "feedback": {
     "type": {
@@ -1442,6 +1486,11 @@
     "uploadPhotos": "Subir fotos",
     "uploadFiles": "Subir archivos",
     "clearSearch": "Limpiar búsqueda",
+    "retry": "Reintentar",
+    "loadError": {
+      "title": "No se pudieron cargar tus archivos",
+      "description": "Algo salió mal. Comprueba tu conexión e inténtalo de nuevo."
+    },
     "choosePhoto": "Elegir foto",
     "done": "Listo",
     "doneWithCount": "Listo ({{count}})",
@@ -1615,6 +1664,8 @@
   "accountMenu": {
     "label": "Menú de cuenta",
     "manage": "Gestiona tu cuenta de Oxy",
+    "greeting": "¡Hola, {{name}}!",
+    "switchAccount": "Cambiar de cuenta",
     "viewProfile": "Ver perfil",
     "addAnother": "Añadir otra cuenta",
     "signOutAll": "Cerrar sesión en todas las cuentas",
@@ -1622,7 +1673,22 @@
     "openHint": "Abre el menú de cuenta",
     "openWithUser": "Menú de cuenta de {{name}}",
     "switching": "Cambiando de cuenta…",
-    "signOutAccount": "Cerrar sesión de {{name}}"
+    "signOutAccount": "Cerrar sesión de {{name}}",
+    "storage": {
+      "title": "Almacenamiento de Oxy",
+      "usage": "{{used}} de {{total}} en uso",
+      "used": "Usado",
+      "free": "Libre",
+      "unavailable": "Detalles de uso no disponibles",
+      "upgrade": "Mejorar plan",
+      "manage": "Gestionar almacenamiento"
+    },
+    "data": "Tus datos en Oxy",
+    "settings": "Ajustes de Oxy",
+    "help": "Ayuda y comentarios",
+    "signOut": "Cerrar sesión",
+    "privacy": "Política de privacidad",
+    "terms": "Términos del servicio"
   },
   "accounts": {
     "activeAccount": {

package/src/i18n/locales/fr-FR.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "Vos comptes"
+    },
+    "loading": "Chargement des comptes...",
     "qrHeadline": "Connectez-vous avec votre identité Oxy",
     "signInWithOxy": "Se connecter avec Oxy",
     "useIdentityOnDevice": "Pas de Commons ? Utilisez une clé d'accès sur cet appareil",

package/src/i18n/locales/it-IT.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "I tuoi account"
+    },
+    "loading": "Caricamento account...",
     "qrHeadline": "Accedi con la tua identità Oxy",
     "signInWithOxy": "Accedi con Oxy",
     "useIdentityOnDevice": "Non hai Commons? Usa una passkey su questo dispositivo",

package/src/i18n/locales/ja-JP.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "あなたのアカウント"
+    },
+    "loading": "アカウントを読み込み中...",
     "qrHeadline": "Oxy IDでサインイン",
     "signInWithOxy": "Oxyでサインイン",
     "useIdentityOnDevice": "Commonsがありませんか？このデバイスのパスキーを使用",