@oxyhq/core 12.10.0 → 12.10.2

package/src/i18n/locales/ko-KR.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "내 계정"
+    },
+    "loading": "계정을 불러오는 중...",
     "qrHeadline": "Oxy ID로 로그인",
     "signInWithOxy": "Oxy로 로그인",
     "useIdentityOnDevice": "Commons가 없으신가요? 이 기기의 패스키를 사용하세요",

package/src/i18n/locales/pt-PT.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "As suas contas"
+    },
+    "loading": "A carregar contas...",
     "qrHeadline": "Inicie sessão com a sua identidade Oxy",
     "signInWithOxy": "Iniciar sessão com Oxy",
     "useIdentityOnDevice": "Não tem o Commons? Use uma chave de acesso neste dispositivo",

package/src/i18n/locales/zh-CN.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "你的账户"
+    },
+    "loading": "正在加载账户...",
     "qrHeadline": "使用您的 Oxy 身份登录",
     "signInWithOxy": "使用 Oxy 登录",
     "useIdentityOnDevice": "没有 Commons？改用此设备上的通行密钥",

package/src/mixins/OxyServices.auth.ts

@@ -371,7 +371,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
         'POST',
         '/auth/service-token',
         { apiKey: key, apiSecret: secret },
-        { cache: false, retry: false }
+        { cache: false, retry: false, skipAuth: true }
       );
 
       const expiresAt = Date.now() + response.expiresIn * 1000;
@@ -486,7 +486,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           publicKey,
           signature,
           timestamp,
-        }, { cache: false });
+        }, { cache: false, skipAuth: true });
 
         if (!res || (typeof res === 'object' && Object.keys(res).length === 0)) {
           throw new OxyAuthenticationError('Registration failed', 'REGISTER_FAILED', 400);
@@ -515,7 +515,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
       try {
         return await this.makeRequest<ChallengeResponse>('POST', '/auth/challenge', {
           publicKey,
-        }, { cache: false, ...requestOptions });
+        }, { cache: false, skipAuth: true, ...requestOptions });
       } catch (error) {
         throw this.handleError(error);
       }
@@ -552,7 +552,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           timestamp,
           deviceName,
           deviceFingerprint,
-        }, { cache: false, ...requestOptions });
+        }, { cache: false, skipAuth: true, ...requestOptions });
 
         // Plant the freshly-minted tokens, mirroring `claimSessionByToken`.
         // `/auth/verify` returns the first access token (and refresh token) in
@@ -581,7 +581,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'GET',
           `/auth/check-publickey/${encodeURIComponent(publicKey)}`,
           undefined,
-          { cache: false }
+          { cache: false, skipAuth: true }
         );
       } catch (error) {
         throw this.handleError(error);
@@ -597,7 +597,12 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'GET',
           `/auth/user/${encodeURIComponent(publicKey)}`,
           undefined,
-          { cache: true, cacheTTL: 2 * 60 * 1000 }
+          {
+            cache: true,
+            cacheTTL: 2 * 60 * 1000,
+            // Public lookup by public key (pre-session) — skip the bearer preflight.
+            skipAuth: true,
+          },
         );
         return normalizeUserIdentity(user);
       } catch (error) {
@@ -697,7 +702,8 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
             sessionToken,
             ...(options.deviceFingerprint ? { deviceFingerprint: options.deviceFingerprint } : {}),
           },
-          { cache: false, retry: false }
+          // Body-authenticated device-flow claim (no bearer) — skip the preflight.
+          { cache: false, retry: false, skipAuth: true }
         );
 
         this.setTokens(res.accessToken);
@@ -806,7 +812,10 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'POST',
           '/auth/session/create',
           { sessionToken, expiresAt, clientId: params.clientId },
-          { cache: false }
+          // Public/pre-session (no bearer): skip the preflight so a stale
+          // near-expiry token cannot re-enter refreshAccessToken while the
+          // refresh handler is already in flight (self-await hang).
+          { cache: false, skipAuth: true },
         );
 
         return {
@@ -836,7 +845,10 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'GET',
           `/auth/session/status/${encodeURIComponent(sessionToken)}`,
           undefined,
-          { cache: false, retry: false }
+          // Public/pre-session (no bearer): a preflight here is wrong per se and,
+          // if ever reached while a refresh is pending, would re-enter
+          // refreshAccessToken and await the very promise it runs inside.
+          { cache: false, retry: false, skipAuth: true }
         );
       } catch (error) {
         throw this.handleError(error);
@@ -859,7 +871,9 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'GET',
           `/auth/session/approve-info/${encodeURIComponent(authorizeCode)}`,
           undefined,
-          { cache: false }
+          // Public (no auth required) — skip the bearer preflight (avoids the
+          // pre-session self-await class).
+          { cache: false, skipAuth: true }
         );
         return {
           application: raw.application,
@@ -917,7 +931,8 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
             ...(params.deviceName ? { deviceName: params.deviceName } : {}),
             ...(params.deviceFingerprint ? { deviceFingerprint: params.deviceFingerprint } : {}),
           },
-          { cache: false }
+          // Key-signed, cookieless (no bearer) — skip the preflight.
+          { cache: false, skipAuth: true }
         );
       } catch (error) {
         throw this.handleError(error);
@@ -936,7 +951,8 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'POST',
           `/auth/session/deny/${encodeURIComponent(authorizeCode)}`,
           undefined,
-          { cache: false }
+          // Public (no auth required) — skip the bearer preflight.
+          { cache: false, skipAuth: true }
         );
       } catch (error) {
         throw this.handleError(error);
@@ -1069,7 +1085,8 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
      */
     async checkUsernameAvailability(username: string): Promise<{ available: boolean; message: string }> {
       try {
-        return await this.makeRequest('GET', `/auth/check-username/${username}`, undefined, { cache: false });
+        // Public availability lookup (pre-session) — skip the bearer preflight.
+        return await this.makeRequest('GET', `/auth/check-username/${username}`, undefined, { cache: false, skipAuth: true });
       } catch (error) {
         throw this.handleError(error);
       }
@@ -1080,7 +1097,8 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
      */
     async checkEmailAvailability(email: string): Promise<{ available: boolean; message: string }> {
       try {
-        return await this.makeRequest('GET', `/auth/check-email/${email}`, undefined, { cache: false });
+        // Public availability lookup (pre-session) — skip the bearer preflight.
+        return await this.makeRequest('GET', `/auth/check-email/${email}`, undefined, { cache: false, skipAuth: true });
       } catch (error) {
         throw this.handleError(error);
       }
@@ -1103,7 +1121,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'POST',
           '/auth/webauthn/register/options',
           { ...(username !== undefined ? { username } : {}) },
-          { cache: false },
+          { cache: false, ...(username !== undefined ? { skipAuth: true } : {}) },
         );
       } catch (error) {
         throw this.handleError(error);
@@ -1137,7 +1155,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'POST',
           '/auth/webauthn/register/verify',
           { response, ...envelope },
-          { cache: false },
+          { cache: false, ...(envelope.username !== undefined ? { skipAuth: true } : {}) },
         );
         if (res && typeof res === 'object') {
           const record = res as Record<string, unknown>;
@@ -1180,7 +1198,8 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'POST',
           '/auth/webauthn/login/options',
           { ...(username !== undefined ? { username } : {}) },
-          { cache: false },
+          // Pre-session login ceremony — skip the bearer preflight.
+          { cache: false, skipAuth: true },
         );
       } catch (error) {
         throw this.handleError(error);
@@ -1204,7 +1223,8 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'POST',
           '/auth/webauthn/login/verify',
           { response, ...envelope },
-          { cache: false },
+          // Pre-session login ceremony — skip the bearer preflight.
+          { cache: false, skipAuth: true },
         );
         const parsed = safeParseContract(loginResultSchema, res);
         if (!parsed) {
@@ -1237,7 +1257,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           clientId: params.clientId,
           redirectUri: params.redirectUri,
           codeVerifier: params.codeVerifier,
-        }, { cache: false });
+        }, { cache: false, skipAuth: true });
         const payload =
           (res as { data?: Record<string, unknown> }).data ??
           (res as Record<string, unknown>);

package/src/mixins/OxyServices.connectedApps.ts

@@ -105,7 +105,12 @@ export function OxyServicesConnectedAppsMixin<T extends typeof OxyServicesBase>(
           'GET',
           `/auth/oauth/client/${encodeURIComponent(clientId)}`,
           undefined,
-          { cache: true, cacheTTL: CACHE_TIMES.MEDIUM },
+          {
+            cache: true,
+            cacheTTL: CACHE_TIMES.MEDIUM,
+            // Public client metadata (pre-session consent UI) — skip the bearer preflight.
+            skipAuth: true,
+          },
         );
         return res.application;
       } catch (error) {

package/src/mixins/OxyServices.deviceBoot.ts

@@ -58,7 +58,10 @@ export function OxyServicesDeviceBootMixin<T extends typeof OxyServicesBase>(Bas
           'POST',
           '/session/device/token',
           { deviceId, deviceSecret },
-          { cache: false, skipAuth: true, retry: false },
+          // `bypassQueue`: this mint is the control-plane call the auth lane
+          // depends on — it must run even when every RequestQueue slot is parked
+          // awaiting it, or the whole client deadlocks. See RequestOptions.bypassQueue.
+          { cache: false, skipAuth: true, retry: false, bypassQueue: true },
         );
         const parsed = safeParseContract(deviceTokenMintResponseSchema, res);
         if (!parsed) {
@@ -99,7 +102,9 @@ export function OxyServicesDeviceBootMixin<T extends typeof OxyServicesBase>(Bas
           'POST',
           '/session/device/redeem-ticket',
           { ticket, returnOrigin },
-          { cache: false, skipAuth: true },
+          // Public device-hub sync mint (bearer-less). Same control-plane class as
+          // the device-secret mint — bypassQueue so it never waits for a slot.
+          { cache: false, skipAuth: true, bypassQueue: true },
         );
         const parsed = safeParseContract(deviceHubTicketRedeemResponseSchema, res);
         if (!parsed) {

package/src/mixins/OxyServices.user.ts

@@ -186,6 +186,8 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
       return await this.makeRequest('GET', `/auth/lookup/${encodeURIComponent(username)}`, undefined, {
         cache: true,
         cacheTTL: 60 * 1000, // 1 minute cache
+        // Public login-flow lookup (pre-session) — skip the bearer preflight.
+        skipAuth: true,
       });
     }
 

package/src/mixins/__tests__/OxyServices.deviceBoot.test.ts

@@ -31,17 +31,19 @@ describe('OxyServices.deviceBoot', () => {
       },
     };
 
-    it('POSTs deviceId + deviceSecret with skipAuth + retry:false (no bearer, no cache, single attempt) and returns the validated mint', async () => {
+    it('POSTs deviceId + deviceSecret with skipAuth + retry:false + bypassQueue (no bearer, no cache, single attempt, never queued) and returns the validated mint', async () => {
       makeRequest.mockResolvedValueOnce(MINT);
       const result = await oxy.mintFromDeviceSecret('dev-1', 'ds-current-secret');
       expect(result).toEqual(MINT);
       // `retry: false` — the scheduler/401 lane own backoff; HttpService's inner
       // retry here would only multiply cold-boot latency on a slow network.
+      // `bypassQueue: true` — the mint is the control-plane call the auth lane
+      // depends on; it must never wait for a RequestQueue slot (deadlock).
       expect(makeRequest).toHaveBeenCalledWith(
         'POST',
         '/session/device/token',
         { deviceId: 'dev-1', deviceSecret: 'ds-current-secret' },
-        { cache: false, skipAuth: true, retry: false },
+        { cache: false, skipAuth: true, retry: false, bypassQueue: true },
       );
     });
 

package/src/mixins/__tests__/commonsSignIn.test.ts

@@ -57,7 +57,7 @@ describe('OxyServices — "Sign in with Oxy" handoff', () => {
         'POST',
         '/auth/session/create',
         { sessionToken: 'secret-session-token', expiresAt: 1700000300000, clientId: 'oxy_dk_test' },
-        expect.objectContaining({ cache: false }),
+        expect.objectContaining({ cache: false, skipAuth: true }),
       );
       // ...and the handle carries the SECRET token + the server's public code/payload.
       expect(handle).toEqual({
@@ -251,7 +251,7 @@ describe('OxyServices — "Sign in with Oxy" handoff', () => {
         'POST',
         '/auth/challenge',
         { publicKey: 'pub-x' },
-        { cache: false },
+        { cache: false, skipAuth: true },
       );
 
       await oxy.requestChallenge('pub-x', { retry: false });
@@ -259,7 +259,7 @@ describe('OxyServices — "Sign in with Oxy" handoff', () => {
         'POST',
         '/auth/challenge',
         { publicKey: 'pub-x' },
-        { cache: false, retry: false },
+        { cache: false, skipAuth: true, retry: false },
       );
     });
 
@@ -282,7 +282,7 @@ describe('OxyServices — "Sign in with Oxy" handoff', () => {
           deviceName: 'dev',
           deviceFingerprint: 'fp',
         },
-        { cache: false, retry: false, timeout: 9000 },
+        { cache: false, skipAuth: true, retry: false, timeout: 9000 },
       );
     });
   });

package/src/mixins/__tests__/preSessionSkipAuth.test.ts

@@ -0,0 +1,152 @@
+/**
+ * Regression: every purely pre-session public SDK endpoint must pass `skipAuth`
+ * so a pending refresh handler cannot self-await (see httpServiceAuthSelfAwait).
+ */
+import { OxyServices } from '../../OxyServices';
+import { SignatureService } from '../../crypto/signatureService';
+
+describe('pre-session public endpoints use skipAuth', () => {
+  let oxy: OxyServices;
+  let makeRequest: jest.SpyInstance;
+
+  beforeEach(() => {
+    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
+    makeRequest = jest.spyOn(oxy, 'makeRequest').mockResolvedValue({} as never);
+  });
+
+  afterEach(() => jest.restoreAllMocks());
+
+  it('lookupUsername skips auth preflight', async () => {
+    await oxy.lookupUsername('alice');
+    expect(makeRequest).toHaveBeenCalledWith(
+      'GET',
+      '/auth/lookup/alice',
+      undefined,
+      expect.objectContaining({ skipAuth: true }),
+    );
+  });
+
+  it('getPublicApplication skips auth preflight', async () => {
+    makeRequest.mockResolvedValueOnce({ application: { id: 'app-1', name: 'App' } });
+    await oxy.getPublicApplication('oxy_dk_test');
+    expect(makeRequest).toHaveBeenCalledWith(
+      'GET',
+      '/auth/oauth/client/oxy_dk_test',
+      undefined,
+      expect.objectContaining({ skipAuth: true }),
+    );
+  });
+
+  it('claimSessionByToken skips auth preflight', async () => {
+    makeRequest.mockResolvedValueOnce({
+      accessToken: 'tok',
+      sessionId: 's1',
+      deviceId: 'd1',
+      expiresAt: '2030-01-01T00:00:00.000Z',
+      user: { id: 'u1', username: 'u' },
+    });
+    await oxy.claimSessionByToken('secret-session-token');
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/session/claim',
+      { sessionToken: 'secret-session-token' },
+      expect.objectContaining({ skipAuth: true, retry: false }),
+    );
+  });
+
+  it('startCommonsSignIn skips auth preflight', async () => {
+    jest.spyOn(Date, 'now').mockReturnValue(1700000000000);
+    const generateChallenge = jest
+      .spyOn(SignatureService, 'generateChallenge')
+      .mockResolvedValue('secret-session-token');
+    makeRequest.mockResolvedValueOnce({
+      authorizeCode: 'code-1',
+      qrPayload: 'oxycommons://approve?v=1&code=code-1',
+      status: 'pending',
+    });
+    await oxy.startCommonsSignIn({ clientId: 'oxy_dk_test' });
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/session/create',
+      expect.objectContaining({ sessionToken: 'secret-session-token', clientId: 'oxy_dk_test' }),
+      expect.objectContaining({ cache: false, skipAuth: true }),
+    );
+    generateChallenge.mockRestore();
+  });
+
+  it('getUserByPublicKey skips auth preflight', async () => {
+    makeRequest.mockResolvedValueOnce({ id: 'u1', username: 'alice' });
+    await oxy.getUserByPublicKey('abc123');
+    expect(makeRequest).toHaveBeenCalledWith(
+      'GET',
+      '/auth/user/abc123',
+      undefined,
+      expect.objectContaining({ skipAuth: true }),
+    );
+  });
+
+  it('webauthnRegisterOptions skips auth preflight on signup (username provided)', async () => {
+    await oxy.webauthnRegisterOptions('alice');
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/webauthn/register/options',
+      { username: 'alice' },
+      expect.objectContaining({ skipAuth: true }),
+    );
+  });
+
+  it('webauthnRegisterVerify skips auth preflight on signup (username in envelope)', async () => {
+    makeRequest.mockResolvedValueOnce({
+      sessionId: 's1',
+      deviceId: 'd1',
+      accessToken: 'tok',
+      expiresAt: '2030-01-01T00:00:00.000Z',
+      deviceSecret: 'ds',
+      user: { id: 'u1', username: 'alice' },
+    });
+    await oxy.webauthnRegisterVerify({ id: 'cred' }, { username: 'alice' });
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/webauthn/register/verify',
+      expect.objectContaining({ username: 'alice' }),
+      expect.objectContaining({ skipAuth: true }),
+    );
+  });
+
+  it('getServiceToken skips auth preflight', async () => {
+    makeRequest.mockResolvedValueOnce({ token: 'svc-tok', expiresIn: 3600 });
+    await oxy.getServiceToken('oxy_dk_svc', 'secret-value');
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/service-token',
+      { apiKey: 'oxy_dk_svc', apiSecret: 'secret-value' },
+      expect.objectContaining({ skipAuth: true, cache: false, retry: false }),
+    );
+  });
+
+  it('exchangeOAuthCode skips auth preflight', async () => {
+    makeRequest.mockResolvedValueOnce({
+      sessionId: 's1',
+      deviceId: 'd1',
+      accessToken: 'tok',
+      user: { id: 'u1' },
+    });
+    await oxy.exchangeOAuthCode({
+      code: 'code-1',
+      clientId: 'oxy_dk_test',
+      redirectUri: 'https://app.example/callback',
+      codeVerifier: 'verifier',
+    });
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/oauth/token',
+      {
+        code: 'code-1',
+        clientId: 'oxy_dk_test',
+        redirectUri: 'https://app.example/callback',
+        codeVerifier: 'verifier',
+      },
+      expect.objectContaining({ skipAuth: true }),
+    );
+  });
+});

package/src/mixins/__tests__/webauthnAuth.test.ts

@@ -48,7 +48,7 @@ describe('webauthnRegisterOptions', () => {
       'POST',
       '/auth/webauthn/register/options',
       { username: 'alice' },
-      { cache: false },
+      { cache: false, skipAuth: true },
     );
   });
 
@@ -83,7 +83,7 @@ describe('webauthnLoginOptions', () => {
       'POST',
       '/auth/webauthn/login/options',
       { username: 'alice' },
-      { cache: false },
+      { cache: false, skipAuth: true },
     );
   });
 
@@ -94,7 +94,7 @@ describe('webauthnLoginOptions', () => {
       'POST',
       '/auth/webauthn/login/options',
       {},
-      { cache: false },
+      { cache: false, skipAuth: true },
     );
   });
 });
@@ -129,7 +129,7 @@ describe('webauthnRegisterVerify', () => {
       'POST',
       '/auth/webauthn/register/verify',
       { response: CREATE_RESPONSE, username: 'alice', deviceName: 'Phone', deviceFingerprint: 'fp-1' },
-      { cache: false },
+      { cache: false, skipAuth: true },
     );
   });
 
@@ -183,7 +183,7 @@ describe('webauthnLoginVerify', () => {
       'POST',
       '/auth/webauthn/login/verify',
       { response: GET_RESPONSE, deviceName: 'Phone', deviceFingerprint: 'fp-1', deviceId: 'dev-persisted' },
-      { cache: false },
+      { cache: false, skipAuth: true },
     );
   });
 
@@ -194,7 +194,7 @@ describe('webauthnLoginVerify', () => {
       'POST',
       '/auth/webauthn/login/verify',
       { response: GET_RESPONSE },
-      { cache: false },
+      { cache: false, skipAuth: true },
     );
   });
 

package/src/session/__tests__/accountDialogController.test.ts

@@ -163,7 +163,7 @@ describe('AccountDialogController — initial + views', () => {
     expect(snap.commonsAvailability).toBe('unknown');
   });
 
-  it('setView / add / close move between views and notify subscribers', () => {
+  it('setView / add move between views and notify subscribers', () => {
     const { controller } = makeHarness();
     const seen: string[] = [];
     controller.subscribe((s) => seen.push(s.view));
@@ -172,7 +172,7 @@ describe('AccountDialogController — initial + views', () => {
     expect(controller.getSnapshot().view).toBe('add');
     controller.setView('signin');
     expect(controller.getSnapshot().view).toBe('signin');
-    controller.close();
+    controller.setView('accounts');
     expect(controller.getSnapshot().view).toBe('accounts');
 
     expect(seen).toEqual(['add', 'signin', 'accounts']);
@@ -185,7 +185,7 @@ describe('AccountDialogController — initial + views', () => {
 
     controller.startSignup();
     expect(controller.getSnapshot().view).toBe('signup');
-    controller.close();
+    controller.setView('accounts');
     expect(controller.getSnapshot().view).toBe('accounts');
 
     expect(seen).toEqual(['signup', 'accounts']);

package/src/session/accountDialogController.ts

@@ -35,6 +35,13 @@
  * password, social login, and 2FA were removed ecosystem-wide. Account
  * creation (`signup` view) is the same two identity backends: a passkey
  * ceremony on web, or a Commons-created identity.
+ *
+ * The controller owns NO surface PRESENTATION: whether the account dialog is
+ * mounted, visible, or dismissed is the job of the shared surface stack
+ * (`@oxyhq/services` presents the `AccountDialog` surface into `@oxyhq/bloom`'s
+ * stack). This is a headless state machine only — it exposes `setView` /
+ * `add` / `startSignup` (the view axis) and `cancelSignIn` (device-flow
+ * teardown), never an `open` / `close` / `visible`.
  */
 
 import type { OxyServices } from '../OxyServices';
@@ -462,12 +469,6 @@ export class AccountDialogController {
     this.emit();
   }
 
-  /** Return to the account list and cancel any in-flight sign-in flow. */
-  close(): void {
-    this.cancelSignIn();
-    this.setView('accounts');
-  }
-
   /** Switch to the "add account" view (the sign-in entry chooser). */
   add(): void {
     this.setView('add');