@oxyhq/core 12.10.5 → 12.11.0

package/dist/esm/boot/sessionColdBoot.js

@@ -15,15 +15,28 @@
  *      origin persisted a `deviceId` + `deviceSecret`, mint a short access token
  *      with a single bearer-less POST to `/session/device/token` (no cookie, no
  *      navigation) and rotate the secret in-use.
- *   3. `shared-key-signin` (native) — re-mint from the shared-keychain identity.
+ *   3. `shared-key-signin` (native, ACCOUNT mode) — re-mint from the
+ *      shared-keychain identity — OR `identity-key-signin` (IDENTITY mode) —
+ *      re-mint from THIS device's primary identity key.
  *   4. Signed out.
  *
+ * Two session modes (see {@link RunSessionColdBootOptions.sessionMode}):
+ *   - `account` (default) — the device's ACTIVE account owns the session. Every
+ *     Oxy app but the identity vault boots this way; behaviour is unchanged.
+ *   - `identity` — the owner of the local PRIMARY identity key owns the session,
+ *     permanently, regardless of which account the device is switched to. Each
+ *     step above is bound to the persisted identity pin, and the shared-keychain
+ *     lane is replaced by the primary-key one (the shared slot is a CROSS-APP
+ *     slot that may hold a different identity).
+ *
  * ESM-safe (no `require()`); no react/react-native/expo imports.
  */
 import { runColdBoot } from '../utils/coldBoot.js';
 import { isNative as detectNative } from '../utils/platform.js';
 import { logger } from '../logger/index.js';
+import { computeIdentityTag } from '../utils/cacheKey.js';
 import { TOKEN_REFRESH_LEAD_MS, refreshDeviceSecretArm } from '../session/refresh.js';
+import { establishIdentitySession, resolveIdentityPin, } from '../session/identitySession.js';
 /**
  * Run the device-first cold boot. Resolves to the `runColdBoot` outcome and, as
  * a side effect, invokes `onSession` (winning session, token already planted) or
@@ -32,6 +45,14 @@ import { TOKEN_REFRESH_LEAD_MS, refreshDeviceSecretArm } from '../session/refres
 export async function runSessionColdBoot(opts) {
     const { oxy, store } = opts;
     const isNative = opts.platform?.isNative ?? detectNative();
+    // Non-null ONLY in identity mode; every `!== null` test below therefore reads
+    // as "is this boot identity-bound?" while also narrowing the binding.
+    const identityBinding = opts.sessionMode === 'identity' ? opts.identity ?? null : null;
+    if (opts.sessionMode === 'identity' && identityBinding === null) {
+        logger.error('runSessionColdBoot: sessionMode "identity" requires an `identity` binding — refusing to run any lane (an identity-bound client must never adopt the device active account)', undefined, { component: 'sessionColdBoot', method: 'runSessionColdBoot' });
+        await opts.onSignedOut?.('error');
+        return { kind: 'unauthenticated' };
+    }
     // Best-effort connectivity gate for the NETWORK steps only. A missing hint or
     // any non-`true` verdict means "assume online" — never falsely skip a real
     // sign-in on an ambiguous probe.
@@ -39,6 +60,22 @@ export async function runSessionColdBoot(opts) {
     // Boot-local (not module-level) so it cannot leak across boots or break under
     // bundler re-evaluation.
     let signedOutReason = 'no_session';
+    // Boot-local memo for the identity pin. Resolved lazily INSIDE a step so the
+    // (local, but storage-backed) read is covered by `overallDeadlineMs`, and
+    // resolved at most once per boot so two steps cannot disagree. Always `null`
+    // in account mode.
+    let pinResolved = false;
+    let cachedPin = null;
+    const getIdentityPin = async () => {
+        if (identityBinding === null) {
+            return null;
+        }
+        if (!pinResolved) {
+            cachedPin = await resolveIdentityPin(identityBinding);
+            pinResolved = true;
+        }
+        return cachedPin;
+    };
     const steps = [];
     // 1. warm-token-plant (web + native) — the fastest path. When the persisted
     //    store already holds a still-valid warm access token (its expiry more than
@@ -66,6 +103,19 @@ export async function runSessionColdBoot(opts) {
             if (!Number.isFinite(expiresAtMs) || expiresAtMs <= Date.now() + TOKEN_REFRESH_LEAD_MS) {
                 return { kind: 'skip' };
             }
+            if (identityBinding !== null) {
+                // Identity-bound: a persisted token is only acceptable when it belongs to
+                // the PINNED account. Both the token's own claim (`computeIdentityTag`,
+                // the same derivation `SessionClient.applyState` uses) and the owning
+                // session identity must match — a token planted for another account by an
+                // earlier account-mode write is exactly the durable drift this gate stops.
+                const pin = await getIdentityPin();
+                if (pin === null ||
+                    persisted.userId !== pin.accountId ||
+                    computeIdentityTag(persisted.accessToken) !== pin.accountId) {
+                    return { kind: 'skip' };
+                }
+            }
             oxy.setTokens(persisted.accessToken);
             return {
                 kind: 'session',
@@ -91,7 +141,16 @@ export async function runSessionColdBoot(opts) {
         // a doomed mint cannot burn the overall deadline before routing settles.
         enabled: () => !isOffline(),
         run: async () => {
-            const result = await refreshDeviceSecretArm({ oxy, store });
+            const pin = await getIdentityPin();
+            if (identityBinding !== null && pin === null) {
+                // Identity-bound with no verified pin (never written, or cleared because
+                // the local key changed/vanished). An UNPINNED mint would adopt whichever
+                // account the device is currently switched to — the exact drift this mode
+                // exists to prevent. Fall through to `identity-key-signin`, which
+                // re-derives the account from the local key and rewrites the pin.
+                return { kind: 'skip' };
+            }
+            const result = await refreshDeviceSecretArm({ oxy, store, pin });
             switch (result.status) {
                 case 'ok':
                     // The arm persisted the rotated secret and planted the token.
@@ -125,6 +184,12 @@ export async function runSessionColdBoot(opts) {
                     // the secret; a later boot/attempt re-mints once storage recovers.
                     logger.error('device-secret mint rotated the secret but it could not be durably persisted — not planting', undefined, { component: 'sessionColdBoot', method: 'device-secret-mint' });
                     return { kind: 'skip' };
+                case 'account-not-on-device':
+                    // Pinned mint rejected: the pinned account is no longer a live account
+                    // of this device session. The secret is healthy — keep it untouched and
+                    // let `identity-key-signin` re-establish from the local key.
+                    logger.debug('pinned device-secret mint rejected (account_not_on_device) — keeping secret, re-establishing from the identity key', { component: 'sessionColdBoot', method: 'device-secret-mint' });
+                    return { kind: 'skip' };
                 case 'transient':
                     // Network / 5xx: keep the secret; a later attempt can succeed.
                     logger.debug('device-secret mint failed (transient) — keeping secret', { component: 'sessionColdBoot', method: 'device-secret-mint' });
@@ -134,42 +199,82 @@ export async function runSessionColdBoot(opts) {
             }
         },
     });
-    // 3. shared-key-signin (native) — re-mint from the shared identity. Native
-    //    AND online: it is a network step (challenge + verify round-trips), so it
-    //    is gated by the same offline hint as the mint lane. `{ retry: false }`
-    //    keeps the two round-trips as single attempts — the refresh scheduler /
-    //    401 lane own later retries — so this step cannot multiply boot latency.
-    steps.push({
-        id: 'shared-key-signin',
-        enabled: () => isNative && !isOffline(),
-        run: async () => {
-            const session = await oxy.signInWithSharedIdentity({ requestOptions: { retry: false } });
-            if (!session?.accessToken) {
-                return { kind: 'skip' };
-            }
-            // `verifyChallenge` mints a rotating deviceSecret; persist it so the next
-            // boot can use the faster device-secret-mint lane (sockets + tab-focus
-            // re-mint depend on the credential being in the store).
-            if (session.deviceId && session.deviceSecret) {
-                await store.save({
-                    sessionId: session.sessionId,
-                    userId: session.user.id,
-                    deviceId: session.deviceId,
-                    deviceSecret: session.deviceSecret,
-                    accessToken: session.accessToken,
-                    expiresAt: session.expiresAt,
+    if (identityBinding !== null) {
+        // 3-identity. identity-key-signin — re-mint from THIS device's PRIMARY
+        //    identity key (`getPublicKey` → challenge → sign → verify). It REPLACES
+        //    `shared-key-signin`, which reads the CROSS-APP shared keychain slot and
+        //    may therefore hold a different identity than the device's primary — the
+        //    one thing an identity-bound client must never adopt. The server resolves
+        //    the account from the verified signer, so the winning session is
+        //    identity-authoritative and the pin is (re)written from it.
+        //
+        //    Online-gated like every network step; `{ retry: false }` keeps the two
+        //    round-trips single attempts (the refresh scheduler / 401 lane own later
+        //    retries) so this step cannot multiply boot latency. On web
+        //    `KeyManager.getPublicKey()` resolves to `null`, so it skips.
+        steps.push({
+            id: 'identity-key-signin',
+            enabled: () => !isOffline(),
+            run: async () => {
+                const established = await establishIdentitySession({
+                    oxy,
+                    store,
+                    binding: identityBinding,
+                    requestOptions: { retry: false },
                 });
-            }
-            return {
-                kind: 'session',
-                session: {
-                    sessionId: session.sessionId,
-                    userId: session.user.id,
-                    accessToken: session.accessToken,
-                },
-            };
-        },
-    });
+                const accessToken = established?.session.accessToken;
+                if (!established || !accessToken) {
+                    return { kind: 'skip' };
+                }
+                return {
+                    kind: 'session',
+                    session: {
+                        sessionId: established.session.sessionId,
+                        userId: established.session.user.id,
+                        accessToken,
+                    },
+                };
+            },
+        });
+    }
+    else {
+        // 3. shared-key-signin (native) — re-mint from the shared identity. Native
+        //    AND online: it is a network step (challenge + verify round-trips), so it
+        //    is gated by the same offline hint as the mint lane. `{ retry: false }`
+        //    keeps the two round-trips as single attempts — the refresh scheduler /
+        //    401 lane own later retries — so this step cannot multiply boot latency.
+        steps.push({
+            id: 'shared-key-signin',
+            enabled: () => isNative && !isOffline(),
+            run: async () => {
+                const session = await oxy.signInWithSharedIdentity({ requestOptions: { retry: false } });
+                if (!session?.accessToken) {
+                    return { kind: 'skip' };
+                }
+                // `verifyChallenge` mints a rotating deviceSecret; persist it so the next
+                // boot can use the faster device-secret-mint lane (sockets + tab-focus
+                // re-mint depend on the credential being in the store).
+                if (session.deviceId && session.deviceSecret) {
+                    await store.save({
+                        sessionId: session.sessionId,
+                        userId: session.user.id,
+                        deviceId: session.deviceId,
+                        deviceSecret: session.deviceSecret,
+                        accessToken: session.accessToken,
+                        expiresAt: session.expiresAt,
+                    });
+                }
+                return {
+                    kind: 'session',
+                    session: {
+                        sessionId: session.sessionId,
+                        userId: session.user.id,
+                        accessToken: session.accessToken,
+                    },
+                };
+            },
+        });
+    }
     const outcome = await runColdBoot({
         steps,
         overallDeadlineMs: opts.overallDeadlineMs,

package/dist/esm/i18n/locales/ar-SA.json

@@ -124,7 +124,19 @@
         "commonsNotInstalled": "لا تملك Commons؟ احصل على التطبيق لتسجيل الدخول بمعرّف Oxy الخاص بك.",
         "showQrAnyway": "لدي Commons على جهاز آخر",
         "switchWhileSignedInAs": "تبديل الحساب، مسجّل الدخول باسم {{name}}",
-        "manageOnDevice": "إدارة الحسابات على هذا الجهاز"
+        "manageOnDevice": "إدارة الحسابات على هذا الجهاز",
+        "continueWithOxy": "المتابعة باستخدام Oxy",
+        "havingTrouble": "هل تواجه مشكلة؟",
+        "progress": {
+            "preparing": "جارٍ تحضير الطلب",
+            "awaitingApproval": "في انتظار الموافقة",
+            "scanWithCommons": "امسح الرمز باستخدام Commons على هاتفك",
+            "continueInCommons": "تابع في Commons",
+            "checkCommons": "تحقّق من Commons على هاتفك",
+            "openedInCommons": "تم الفتح في Commons",
+            "confirming": "جارٍ تأكيد الهوية",
+            "confirmed": "تم تأكيد الهوية"
+        }
     },
     "common": {
         "actions": {

package/dist/esm/i18n/locales/ca-ES.json

@@ -124,7 +124,19 @@
         "commonsNotInstalled": "No tens Commons? Descarrega l'app per iniciar sessió amb el teu Oxy ID.",
         "showQrAnyway": "Tinc Commons en un altre dispositiu",
         "switchWhileSignedInAs": "Canvia de compte, amb la sessió iniciada com a {{name}}",
-        "manageOnDevice": "Gestionar comptes en aquest dispositiu"
+        "manageOnDevice": "Gestionar comptes en aquest dispositiu",
+        "continueWithOxy": "Continua amb Oxy",
+        "havingTrouble": "Algun problema?",
+        "progress": {
+            "preparing": "Preparant la sol·licitud",
+            "awaitingApproval": "Esperant l'aprovació",
+            "scanWithCommons": "Escaneja amb Commons al teu mòbil",
+            "continueInCommons": "Continua a Commons",
+            "checkCommons": "Revisa Commons al teu mòbil",
+            "openedInCommons": "Obert a Commons",
+            "confirming": "Confirmant la identitat",
+            "confirmed": "Identitat confirmada"
+        }
     },
     "common": {
         "actions": {

package/dist/esm/i18n/locales/de-DE.json

@@ -124,7 +124,19 @@
         "commonsNotInstalled": "Kein Commons? Holen Sie sich die App, um sich mit Ihrer Oxy-ID anzumelden.",
         "showQrAnyway": "Ich habe Commons auf einem anderen Gerät",
         "switchWhileSignedInAs": "Konto wechseln, angemeldet als {{name}}",
-        "manageOnDevice": "Konten auf diesem Gerät verwalten"
+        "manageOnDevice": "Konten auf diesem Gerät verwalten",
+        "continueWithOxy": "Mit Oxy fortfahren",
+        "havingTrouble": "Gibt es ein Problem?",
+        "progress": {
+            "preparing": "Anfrage wird vorbereitet",
+            "awaitingApproval": "Warten auf Freigabe",
+            "scanWithCommons": "Scannen Sie mit Commons auf Ihrem Telefon",
+            "continueInCommons": "In Commons fortfahren",
+            "checkCommons": "Prüfen Sie Commons auf Ihrem Telefon",
+            "openedInCommons": "In Commons geöffnet",
+            "confirming": "Identität wird bestätigt",
+            "confirmed": "Identität bestätigt"
+        }
     },
     "common": {
         "actions": {

package/dist/esm/i18n/locales/en-US.json

@@ -412,9 +412,6 @@
         },
         "label": "Account switcher",
         "searchPlaceholder": "Search accounts",
-        "scanTitle": "Scan to sign in",
-        "scanSubtitle": "Open the Oxy app on your phone and scan this code",
-        "scanWithOxy": "Scan with the Oxy app to continue",
         "scanQr": "Scan QR code",
         "qrHeadline": "Sign in with your Oxy identity",
         "signInWithOxy": "Sign in with Oxy",
@@ -424,7 +421,19 @@
         "commonsNotInstalled": "Don't have Commons? Get the app to sign in with your Oxy ID.",
         "showQrAnyway": "I have Commons on another device",
         "switchWhileSignedInAs": "Switch account, signed in as {{name}}",
-        "manageOnDevice": "Manage accounts on this device"
+        "manageOnDevice": "Manage accounts on this device",
+        "continueWithOxy": "Continue with Oxy",
+        "havingTrouble": "Having trouble?",
+        "progress": {
+            "preparing": "Preparing request",
+            "awaitingApproval": "Waiting for approval",
+            "scanWithCommons": "Scan with Commons on your phone",
+            "continueInCommons": "Continue in Commons",
+            "checkCommons": "Check Commons on your phone",
+            "openedInCommons": "Opened in Commons",
+            "confirming": "Confirming identity",
+            "confirmed": "Identity confirmed"
+        }
     },
     "reputation": {
         "faq": {

package/dist/esm/i18n/locales/es-ES.json

@@ -652,9 +652,6 @@
         },
         "label": "Selector de cuentas",
         "searchPlaceholder": "Buscar cuentas",
-        "scanTitle": "Escanea para iniciar sesión",
-        "scanSubtitle": "Abre la app de Oxy en tu móvil y escanea este código",
-        "scanWithOxy": "Escanea con la app de Oxy para continuar",
         "scanQr": "Escanear código QR",
         "qrHeadline": "Inicia sesión con tu identidad de Oxy",
         "signInWithOxy": "Inicia sesión con Oxy",
@@ -664,7 +661,19 @@
         "commonsNotInstalled": "¿No tienes Commons? Descarga la app para iniciar sesión con tu Oxy ID.",
         "showQrAnyway": "Tengo Commons en otro dispositivo",
         "switchWhileSignedInAs": "Cambiar de cuenta, con la sesión iniciada como {{name}}",
-        "manageOnDevice": "Gestionar cuentas en este dispositivo"
+        "manageOnDevice": "Gestionar cuentas en este dispositivo",
+        "continueWithOxy": "Continuar con Oxy",
+        "havingTrouble": "¿Algún problema?",
+        "progress": {
+            "preparing": "Preparando la solicitud",
+            "awaitingApproval": "Esperando la aprobación",
+            "scanWithCommons": "Escanea con Commons en tu móvil",
+            "continueInCommons": "Continúa en Commons",
+            "checkCommons": "Revisa Commons en tu móvil",
+            "openedInCommons": "Abierto en Commons",
+            "confirming": "Confirmando identidad",
+            "confirmed": "Identidad confirmada"
+        }
     },
     "feedback": {
         "type": {

package/dist/esm/i18n/locales/fr-FR.json

@@ -124,7 +124,19 @@
         "commonsNotInstalled": "Pas de Commons ? Téléchargez l'app pour vous connecter avec votre Oxy ID.",
         "showQrAnyway": "J'ai Commons sur un autre appareil",
         "switchWhileSignedInAs": "Changer de compte, connecté en tant que {{name}}",
-        "manageOnDevice": "Gérer les comptes sur cet appareil"
+        "manageOnDevice": "Gérer les comptes sur cet appareil",
+        "continueWithOxy": "Continuer avec Oxy",
+        "havingTrouble": "Un problème ?",
+        "progress": {
+            "preparing": "Préparation de la demande",
+            "awaitingApproval": "En attente d'approbation",
+            "scanWithCommons": "Scannez avec Commons sur votre téléphone",
+            "continueInCommons": "Continuez dans Commons",
+            "checkCommons": "Consultez Commons sur votre téléphone",
+            "openedInCommons": "Ouvert dans Commons",
+            "confirming": "Confirmation de l'identité",
+            "confirmed": "Identité confirmée"
+        }
     },
     "common": {
         "actions": {

package/dist/esm/i18n/locales/it-IT.json

@@ -124,7 +124,19 @@
         "commonsNotInstalled": "Non hai Commons? Scarica l'app per accedere con il tuo Oxy ID.",
         "showQrAnyway": "Ho Commons su un altro dispositivo",
         "switchWhileSignedInAs": "Cambia account, connesso come {{name}}",
-        "manageOnDevice": "Gestisci account su questo dispositivo"
+        "manageOnDevice": "Gestisci account su questo dispositivo",
+        "continueWithOxy": "Continua con Oxy",
+        "havingTrouble": "Problemi?",
+        "progress": {
+            "preparing": "Preparazione della richiesta",
+            "awaitingApproval": "In attesa di approvazione",
+            "scanWithCommons": "Scansiona con Commons sul tuo telefono",
+            "continueInCommons": "Continua in Commons",
+            "checkCommons": "Controlla Commons sul tuo telefono",
+            "openedInCommons": "Aperto in Commons",
+            "confirming": "Conferma dell'identità in corso",
+            "confirmed": "Identità confermata"
+        }
     },
     "common": {
         "actions": {

package/dist/esm/i18n/locales/ja-JP.json

@@ -124,7 +124,19 @@
         "commonsNotInstalled": "Commonsがありませんか？アプリを入手してOxy IDでサインインしましょう。",
         "showQrAnyway": "別のデバイスにCommonsがあります",
         "switchWhileSignedInAs": "アカウントを切り替え（{{name}} としてログイン中）",
-        "manageOnDevice": "このデバイスのアカウントを管理"
+        "manageOnDevice": "このデバイスのアカウントを管理",
+        "continueWithOxy": "Oxyで続ける",
+        "havingTrouble": "うまくいきませんか？",
+        "progress": {
+            "preparing": "リクエストを準備しています",
+            "awaitingApproval": "承認を待っています",
+            "scanWithCommons": "スマートフォンのCommonsでスキャンしてください",
+            "continueInCommons": "Commonsで続けてください",
+            "checkCommons": "スマートフォンのCommonsを確認してください",
+            "openedInCommons": "Commonsで開きました",
+            "confirming": "本人確認をしています",
+            "confirmed": "本人確認が完了しました"
+        }
     },
     "common": {
         "actions": {

package/dist/esm/i18n/locales/ko-KR.json

@@ -124,7 +124,19 @@
         "commonsNotInstalled": "Commons가 없으신가요? 앱을 다운로드하여 Oxy ID로 로그인하세요.",
         "showQrAnyway": "다른 기기에 Commons가 있습니다",
         "switchWhileSignedInAs": "계정 전환, {{name}}(으)로 로그인됨",
-        "manageOnDevice": "이 기기의 계정 관리"
+        "manageOnDevice": "이 기기의 계정 관리",
+        "continueWithOxy": "Oxy로 계속하기",
+        "havingTrouble": "문제가 있으신가요?",
+        "progress": {
+            "preparing": "요청 준비 중",
+            "awaitingApproval": "승인 대기 중",
+            "scanWithCommons": "휴대폰의 Commons로 스캔하세요",
+            "continueInCommons": "Commons에서 계속하세요",
+            "checkCommons": "휴대폰에서 Commons를 확인하세요",
+            "openedInCommons": "Commons에서 열림",
+            "confirming": "신원 확인 중",
+            "confirmed": "신원 확인 완료"
+        }
     },
     "common": {
         "actions": {

package/dist/esm/i18n/locales/locales/ar-SA.json

@@ -124,7 +124,19 @@
     "commonsNotInstalled": "لا تملك Commons؟ احصل على التطبيق لتسجيل الدخول بمعرّف Oxy الخاص بك.",
     "showQrAnyway": "لدي Commons على جهاز آخر",
     "switchWhileSignedInAs": "تبديل الحساب، مسجّل الدخول باسم {{name}}",
-    "manageOnDevice": "إدارة الحسابات على هذا الجهاز"
+    "manageOnDevice": "إدارة الحسابات على هذا الجهاز",
+    "continueWithOxy": "المتابعة باستخدام Oxy",
+    "havingTrouble": "هل تواجه مشكلة؟",
+    "progress": {
+      "preparing": "جارٍ تحضير الطلب",
+      "awaitingApproval": "في انتظار الموافقة",
+      "scanWithCommons": "امسح الرمز باستخدام Commons على هاتفك",
+      "continueInCommons": "تابع في Commons",
+      "checkCommons": "تحقّق من Commons على هاتفك",
+      "openedInCommons": "تم الفتح في Commons",
+      "confirming": "جارٍ تأكيد الهوية",
+      "confirmed": "تم تأكيد الهوية"
+    }
   },
   "common": {
     "actions": {

package/dist/esm/i18n/locales/locales/ca-ES.json

@@ -124,7 +124,19 @@
     "commonsNotInstalled": "No tens Commons? Descarrega l'app per iniciar sessió amb el teu Oxy ID.",
     "showQrAnyway": "Tinc Commons en un altre dispositiu",
     "switchWhileSignedInAs": "Canvia de compte, amb la sessió iniciada com a {{name}}",
-    "manageOnDevice": "Gestionar comptes en aquest dispositiu"
+    "manageOnDevice": "Gestionar comptes en aquest dispositiu",
+    "continueWithOxy": "Continua amb Oxy",
+    "havingTrouble": "Algun problema?",
+    "progress": {
+      "preparing": "Preparant la sol·licitud",
+      "awaitingApproval": "Esperant l'aprovació",
+      "scanWithCommons": "Escaneja amb Commons al teu mòbil",
+      "continueInCommons": "Continua a Commons",
+      "checkCommons": "Revisa Commons al teu mòbil",
+      "openedInCommons": "Obert a Commons",
+      "confirming": "Confirmant la identitat",
+      "confirmed": "Identitat confirmada"
+    }
   },
   "common": {
     "actions": {

package/dist/esm/i18n/locales/locales/de-DE.json

@@ -124,7 +124,19 @@
     "commonsNotInstalled": "Kein Commons? Holen Sie sich die App, um sich mit Ihrer Oxy-ID anzumelden.",
     "showQrAnyway": "Ich habe Commons auf einem anderen Gerät",
     "switchWhileSignedInAs": "Konto wechseln, angemeldet als {{name}}",
-    "manageOnDevice": "Konten auf diesem Gerät verwalten"
+    "manageOnDevice": "Konten auf diesem Gerät verwalten",
+    "continueWithOxy": "Mit Oxy fortfahren",
+    "havingTrouble": "Gibt es ein Problem?",
+    "progress": {
+      "preparing": "Anfrage wird vorbereitet",
+      "awaitingApproval": "Warten auf Freigabe",
+      "scanWithCommons": "Scannen Sie mit Commons auf Ihrem Telefon",
+      "continueInCommons": "In Commons fortfahren",
+      "checkCommons": "Prüfen Sie Commons auf Ihrem Telefon",
+      "openedInCommons": "In Commons geöffnet",
+      "confirming": "Identität wird bestätigt",
+      "confirmed": "Identität bestätigt"
+    }
   },
   "common": {
     "actions": {

package/dist/esm/i18n/locales/locales/en-US.json

@@ -412,9 +412,6 @@
     },
     "label": "Account switcher",
     "searchPlaceholder": "Search accounts",
-    "scanTitle": "Scan to sign in",
-    "scanSubtitle": "Open the Oxy app on your phone and scan this code",
-    "scanWithOxy": "Scan with the Oxy app to continue",
     "scanQr": "Scan QR code",
     "qrHeadline": "Sign in with your Oxy identity",
     "signInWithOxy": "Sign in with Oxy",
@@ -424,7 +421,19 @@
     "commonsNotInstalled": "Don't have Commons? Get the app to sign in with your Oxy ID.",
     "showQrAnyway": "I have Commons on another device",
     "switchWhileSignedInAs": "Switch account, signed in as {{name}}",
-    "manageOnDevice": "Manage accounts on this device"
+    "manageOnDevice": "Manage accounts on this device",
+    "continueWithOxy": "Continue with Oxy",
+    "havingTrouble": "Having trouble?",
+    "progress": {
+      "preparing": "Preparing request",
+      "awaitingApproval": "Waiting for approval",
+      "scanWithCommons": "Scan with Commons on your phone",
+      "continueInCommons": "Continue in Commons",
+      "checkCommons": "Check Commons on your phone",
+      "openedInCommons": "Opened in Commons",
+      "confirming": "Confirming identity",
+      "confirmed": "Identity confirmed"
+    }
   },
   "reputation": {
     "faq": {

package/dist/esm/i18n/locales/locales/es-ES.json

@@ -652,9 +652,6 @@
     },
     "label": "Selector de cuentas",
     "searchPlaceholder": "Buscar cuentas",
-    "scanTitle": "Escanea para iniciar sesión",
-    "scanSubtitle": "Abre la app de Oxy en tu móvil y escanea este código",
-    "scanWithOxy": "Escanea con la app de Oxy para continuar",
     "scanQr": "Escanear código QR",
     "qrHeadline": "Inicia sesión con tu identidad de Oxy",
     "signInWithOxy": "Inicia sesión con Oxy",
@@ -664,7 +661,19 @@
     "commonsNotInstalled": "¿No tienes Commons? Descarga la app para iniciar sesión con tu Oxy ID.",
     "showQrAnyway": "Tengo Commons en otro dispositivo",
     "switchWhileSignedInAs": "Cambiar de cuenta, con la sesión iniciada como {{name}}",
-    "manageOnDevice": "Gestionar cuentas en este dispositivo"
+    "manageOnDevice": "Gestionar cuentas en este dispositivo",
+    "continueWithOxy": "Continuar con Oxy",
+    "havingTrouble": "¿Algún problema?",
+    "progress": {
+      "preparing": "Preparando la solicitud",
+      "awaitingApproval": "Esperando la aprobación",
+      "scanWithCommons": "Escanea con Commons en tu móvil",
+      "continueInCommons": "Continúa en Commons",
+      "checkCommons": "Revisa Commons en tu móvil",
+      "openedInCommons": "Abierto en Commons",
+      "confirming": "Confirmando identidad",
+      "confirmed": "Identidad confirmada"
+    }
   },
   "feedback": {
     "type": {

package/dist/esm/i18n/locales/locales/fr-FR.json

@@ -124,7 +124,19 @@
     "commonsNotInstalled": "Pas de Commons ? Téléchargez l'app pour vous connecter avec votre Oxy ID.",
     "showQrAnyway": "J'ai Commons sur un autre appareil",
     "switchWhileSignedInAs": "Changer de compte, connecté en tant que {{name}}",
-    "manageOnDevice": "Gérer les comptes sur cet appareil"
+    "manageOnDevice": "Gérer les comptes sur cet appareil",
+    "continueWithOxy": "Continuer avec Oxy",
+    "havingTrouble": "Un problème ?",
+    "progress": {
+      "preparing": "Préparation de la demande",
+      "awaitingApproval": "En attente d'approbation",
+      "scanWithCommons": "Scannez avec Commons sur votre téléphone",
+      "continueInCommons": "Continuez dans Commons",
+      "checkCommons": "Consultez Commons sur votre téléphone",
+      "openedInCommons": "Ouvert dans Commons",
+      "confirming": "Confirmation de l'identité",
+      "confirmed": "Identité confirmée"
+    }
   },
   "common": {
     "actions": {

package/dist/esm/i18n/locales/locales/it-IT.json

@@ -124,7 +124,19 @@
     "commonsNotInstalled": "Non hai Commons? Scarica l'app per accedere con il tuo Oxy ID.",
     "showQrAnyway": "Ho Commons su un altro dispositivo",
     "switchWhileSignedInAs": "Cambia account, connesso come {{name}}",
-    "manageOnDevice": "Gestisci account su questo dispositivo"
+    "manageOnDevice": "Gestisci account su questo dispositivo",
+    "continueWithOxy": "Continua con Oxy",
+    "havingTrouble": "Problemi?",
+    "progress": {
+      "preparing": "Preparazione della richiesta",
+      "awaitingApproval": "In attesa di approvazione",
+      "scanWithCommons": "Scansiona con Commons sul tuo telefono",
+      "continueInCommons": "Continua in Commons",
+      "checkCommons": "Controlla Commons sul tuo telefono",
+      "openedInCommons": "Aperto in Commons",
+      "confirming": "Conferma dell'identità in corso",
+      "confirmed": "Identità confermata"
+    }
   },
   "common": {
     "actions": {