@oxyhq/core 12.10.6 → 12.11.1

package/dist/cjs/HttpService.js

@@ -56,11 +56,30 @@ const CSRF_FETCH_MAX_ATTEMPTS = 2;
 const CSRF_FETCH_RETRY_DELAY_MS = 500;
 /**
  * Cooldown (ms) applied after a failed access-token refresh before another
- * refresh is attempted. Prevents a refresh storm (and server hammering) when
+ * refresh is attempted while the CURRENT token is still valid (a proactive,
+ * near-expiry refresh). Prevents a refresh storm (and server hammering) when
  * the auth refresh handler is failing — every in-flight request that
- * hits a 401 would otherwise trigger its own refresh.
+ * hits a 401 would otherwise trigger its own refresh. A still-valid token can
+ * afford to wait this out; the request keeps carrying it in the meantime.
  */
 const TOKEN_REFRESH_COOLDOWN_MS = 15000;
+/**
+ * Cooldown (ms) applied after a failed refresh when the CURRENT access token is
+ * already past its `exp`. Much shorter than {@link TOKEN_REFRESH_COOLDOWN_MS}:
+ * an expired token is UNUSABLE, so the client must re-mint as soon as the mint
+ * endpoint is reachable again (e.g. a few seconds after an ECS rolling-deploy
+ * blip drains/restarts a task) instead of waiting out the full proactive
+ * cooldown while every request forwards or omits a stale bearer → server 401.
+ *
+ * Still NON-ZERO on purpose: it bounds the request-driven retry rate to at most
+ * one attempt per this interval so a PROLONGED outage cannot become a tight
+ * network storm. Combined with the process-wide single-flight below (concurrent
+ * requests coalesce to one in-flight mint) and the refresh handler's own
+ * terminal-state handling (a genuinely revoked session clears its device
+ * credential and stops issuing network mints), this recovers a transient blip
+ * ~15× faster without weakening the storm guard.
+ */
+const EXPIRED_TOKEN_REFRESH_COOLDOWN_MS = 1000;
 /**
  * Lead time (seconds) before access-token expiry at which a preflight refresh
  * is triggered. A token within this window of `exp` is treated as effectively
@@ -133,7 +152,15 @@ class TokenStore {
 class HttpService {
     constructor(config) {
         this.tokenRefreshPromise = null;
-        this.tokenRefreshCooldownUntil = 0;
+        /**
+         * Epoch ms of the last FAILED refresh (0 = none since the last success). The
+         * post-failure cooldown is measured from here; its length depends on whether
+         * the current token is still valid ({@link TOKEN_REFRESH_COOLDOWN_MS}) or
+         * already expired ({@link EXPIRED_TOKEN_REFRESH_COOLDOWN_MS}), so an expired
+         * token recovers promptly the instant it crosses `exp` — without storing a
+         * fixed deadline that could not shrink once the token expired mid-cooldown.
+         */
+        this.lastRefreshFailureAt = 0;
         this.authRefreshHandler = null;
         this.accessTokenProvider = null;
         this.deviceSecretMintInFlight = null;
@@ -823,26 +850,38 @@ class HttpService {
         if (!this.authRefreshHandler) {
             return null;
         }
-        if (Date.now() < this.tokenRefreshCooldownUntil) {
+        // Post-failure cooldown. A genuinely EXPIRED current token uses a much
+        // shorter cooldown than a still-valid (proactive, near-expiry) one: an
+        // expired token is unusable, so re-mint as soon as the endpoint is reachable
+        // again rather than waiting out the full window while requests carry a stale
+        // bearer. Both cooldowns are measured from the last failure, so the moment a
+        // still-valid token crosses `exp` mid-cooldown the shorter window applies.
+        const cooldownMs = this.isAccessTokenExpired()
+            ? EXPIRED_TOKEN_REFRESH_COOLDOWN_MS
+            : TOKEN_REFRESH_COOLDOWN_MS;
+        if (Date.now() - this.lastRefreshFailureAt < cooldownMs) {
             return null;
         }
         if (!this.tokenRefreshPromise) {
             this.tokenRefreshPromise = this.authRefreshHandler(reason)
                 .then((newToken) => {
                 if (!newToken) {
-                    this.tokenRefreshCooldownUntil = Date.now() + TOKEN_REFRESH_COOLDOWN_MS;
+                    this.lastRefreshFailureAt = Date.now();
                     return null;
                 }
                 if (this.tokenStore.getAccessToken() !== newToken) {
                     this.tokenStore.setTokens(newToken);
                     this.notifyTokenChange();
                 }
+                // A success clears the failure timestamp so the next refresh is never
+                // throttled by a stale cooldown.
+                this.lastRefreshFailureAt = 0;
                 this.logger.debug('Token refreshed via the auth refresh handler');
                 return newToken;
             })
                 .catch((error) => {
                 this.logger.warn('Token refresh failed:', error);
-                this.tokenRefreshCooldownUntil = Date.now() + TOKEN_REFRESH_COOLDOWN_MS;
+                this.lastRefreshFailureAt = Date.now();
                 return null;
             })
                 .finally(() => {
@@ -851,6 +890,27 @@ class HttpService {
         }
         return this.tokenRefreshPromise;
     }
+    /**
+     * Whether the CURRENT stored access token is already past its `exp`. Drives
+     * the shorter post-failure refresh cooldown ({@link EXPIRED_TOKEN_REFRESH_COOLDOWN_MS}):
+     * a still-valid (near-expiry) token can wait out the full cooldown, but an
+     * expired one must re-mint promptly. Returns `false` for an absent or
+     * opaque/no-`exp` token — no proof it is expired, so keep the conservative
+     * (longer) cooldown and avoid an unnecessary retry loop.
+     */
+    isAccessTokenExpired() {
+        const token = this.tokenStore.getAccessToken();
+        if (!token) {
+            return false;
+        }
+        try {
+            const decoded = (0, jwt_decode_1.jwtDecode)(token);
+            return typeof decoded.exp === 'number' && decoded.exp <= Math.floor(Date.now() / 1000);
+        }
+        catch {
+            return false;
+        }
+    }
     /**
      * PROCESS-WIDE single-flight for the rotating device-secret mint
      * (`POST /session/device/token`).

package/dist/cjs/boot/sessionColdBoot.js

@@ -18,15 +18,28 @@ exports.runSessionColdBoot = runSessionColdBoot;
  *      origin persisted a `deviceId` + `deviceSecret`, mint a short access token
  *      with a single bearer-less POST to `/session/device/token` (no cookie, no
  *      navigation) and rotate the secret in-use.
- *   3. `shared-key-signin` (native) — re-mint from the shared-keychain identity.
+ *   3. `shared-key-signin` (native, ACCOUNT mode) — re-mint from the
+ *      shared-keychain identity — OR `identity-key-signin` (IDENTITY mode) —
+ *      re-mint from THIS device's primary identity key.
  *   4. Signed out.
  *
+ * Two session modes (see {@link RunSessionColdBootOptions.sessionMode}):
+ *   - `account` (default) — the device's ACTIVE account owns the session. Every
+ *     Oxy app but the identity vault boots this way; behaviour is unchanged.
+ *   - `identity` — the owner of the local PRIMARY identity key owns the session,
+ *     permanently, regardless of which account the device is switched to. Each
+ *     step above is bound to the persisted identity pin, and the shared-keychain
+ *     lane is replaced by the primary-key one (the shared slot is a CROSS-APP
+ *     slot that may hold a different identity).
+ *
  * ESM-safe (no `require()`); no react/react-native/expo imports.
  */
 const coldBoot_1 = require("../utils/coldBoot");
 const platform_1 = require("../utils/platform");
 const logger_1 = require("../logger");
+const cacheKey_1 = require("../utils/cacheKey");
 const refresh_1 = require("../session/refresh");
+const identitySession_1 = require("../session/identitySession");
 /**
  * Run the device-first cold boot. Resolves to the `runColdBoot` outcome and, as
  * a side effect, invokes `onSession` (winning session, token already planted) or
@@ -35,6 +48,14 @@ const refresh_1 = require("../session/refresh");
 async function runSessionColdBoot(opts) {
     const { oxy, store } = opts;
     const isNative = opts.platform?.isNative ?? (0, platform_1.isNative)();
+    // Non-null ONLY in identity mode; every `!== null` test below therefore reads
+    // as "is this boot identity-bound?" while also narrowing the binding.
+    const identityBinding = opts.sessionMode === 'identity' ? opts.identity ?? null : null;
+    if (opts.sessionMode === 'identity' && identityBinding === null) {
+        logger_1.logger.error('runSessionColdBoot: sessionMode "identity" requires an `identity` binding — refusing to run any lane (an identity-bound client must never adopt the device active account)', undefined, { component: 'sessionColdBoot', method: 'runSessionColdBoot' });
+        await opts.onSignedOut?.('error');
+        return { kind: 'unauthenticated' };
+    }
     // Best-effort connectivity gate for the NETWORK steps only. A missing hint or
     // any non-`true` verdict means "assume online" — never falsely skip a real
     // sign-in on an ambiguous probe.
@@ -42,6 +63,22 @@ async function runSessionColdBoot(opts) {
     // Boot-local (not module-level) so it cannot leak across boots or break under
     // bundler re-evaluation.
     let signedOutReason = 'no_session';
+    // Boot-local memo for the identity pin. Resolved lazily INSIDE a step so the
+    // (local, but storage-backed) read is covered by `overallDeadlineMs`, and
+    // resolved at most once per boot so two steps cannot disagree. Always `null`
+    // in account mode.
+    let pinResolved = false;
+    let cachedPin = null;
+    const getIdentityPin = async () => {
+        if (identityBinding === null) {
+            return null;
+        }
+        if (!pinResolved) {
+            cachedPin = await (0, identitySession_1.resolveIdentityPin)(identityBinding);
+            pinResolved = true;
+        }
+        return cachedPin;
+    };
     const steps = [];
     // 1. warm-token-plant (web + native) — the fastest path. When the persisted
     //    store already holds a still-valid warm access token (its expiry more than
@@ -69,6 +106,19 @@ async function runSessionColdBoot(opts) {
             if (!Number.isFinite(expiresAtMs) || expiresAtMs <= Date.now() + refresh_1.TOKEN_REFRESH_LEAD_MS) {
                 return { kind: 'skip' };
             }
+            if (identityBinding !== null) {
+                // Identity-bound: a persisted token is only acceptable when it belongs to
+                // the PINNED account. Both the token's own claim (`computeIdentityTag`,
+                // the same derivation `SessionClient.applyState` uses) and the owning
+                // session identity must match — a token planted for another account by an
+                // earlier account-mode write is exactly the durable drift this gate stops.
+                const pin = await getIdentityPin();
+                if (pin === null ||
+                    persisted.userId !== pin.accountId ||
+                    (0, cacheKey_1.computeIdentityTag)(persisted.accessToken) !== pin.accountId) {
+                    return { kind: 'skip' };
+                }
+            }
             oxy.setTokens(persisted.accessToken);
             return {
                 kind: 'session',
@@ -94,7 +144,16 @@ async function runSessionColdBoot(opts) {
         // a doomed mint cannot burn the overall deadline before routing settles.
         enabled: () => !isOffline(),
         run: async () => {
-            const result = await (0, refresh_1.refreshDeviceSecretArm)({ oxy, store });
+            const pin = await getIdentityPin();
+            if (identityBinding !== null && pin === null) {
+                // Identity-bound with no verified pin (never written, or cleared because
+                // the local key changed/vanished). An UNPINNED mint would adopt whichever
+                // account the device is currently switched to — the exact drift this mode
+                // exists to prevent. Fall through to `identity-key-signin`, which
+                // re-derives the account from the local key and rewrites the pin.
+                return { kind: 'skip' };
+            }
+            const result = await (0, refresh_1.refreshDeviceSecretArm)({ oxy, store, pin });
             switch (result.status) {
                 case 'ok':
                     // The arm persisted the rotated secret and planted the token.
@@ -128,6 +187,12 @@ async function runSessionColdBoot(opts) {
                     // the secret; a later boot/attempt re-mints once storage recovers.
                     logger_1.logger.error('device-secret mint rotated the secret but it could not be durably persisted — not planting', undefined, { component: 'sessionColdBoot', method: 'device-secret-mint' });
                     return { kind: 'skip' };
+                case 'account-not-on-device':
+                    // Pinned mint rejected: the pinned account is no longer a live account
+                    // of this device session. The secret is healthy — keep it untouched and
+                    // let `identity-key-signin` re-establish from the local key.
+                    logger_1.logger.debug('pinned device-secret mint rejected (account_not_on_device) — keeping secret, re-establishing from the identity key', { component: 'sessionColdBoot', method: 'device-secret-mint' });
+                    return { kind: 'skip' };
                 case 'transient':
                     // Network / 5xx: keep the secret; a later attempt can succeed.
                     logger_1.logger.debug('device-secret mint failed (transient) — keeping secret', { component: 'sessionColdBoot', method: 'device-secret-mint' });
@@ -137,42 +202,82 @@ async function runSessionColdBoot(opts) {
             }
         },
     });
-    // 3. shared-key-signin (native) — re-mint from the shared identity. Native
-    //    AND online: it is a network step (challenge + verify round-trips), so it
-    //    is gated by the same offline hint as the mint lane. `{ retry: false }`
-    //    keeps the two round-trips as single attempts — the refresh scheduler /
-    //    401 lane own later retries — so this step cannot multiply boot latency.
-    steps.push({
-        id: 'shared-key-signin',
-        enabled: () => isNative && !isOffline(),
-        run: async () => {
-            const session = await oxy.signInWithSharedIdentity({ requestOptions: { retry: false } });
-            if (!session?.accessToken) {
-                return { kind: 'skip' };
-            }
-            // `verifyChallenge` mints a rotating deviceSecret; persist it so the next
-            // boot can use the faster device-secret-mint lane (sockets + tab-focus
-            // re-mint depend on the credential being in the store).
-            if (session.deviceId && session.deviceSecret) {
-                await store.save({
-                    sessionId: session.sessionId,
-                    userId: session.user.id,
-                    deviceId: session.deviceId,
-                    deviceSecret: session.deviceSecret,
-                    accessToken: session.accessToken,
-                    expiresAt: session.expiresAt,
+    if (identityBinding !== null) {
+        // 3-identity. identity-key-signin — re-mint from THIS device's PRIMARY
+        //    identity key (`getPublicKey` → challenge → sign → verify). It REPLACES
+        //    `shared-key-signin`, which reads the CROSS-APP shared keychain slot and
+        //    may therefore hold a different identity than the device's primary — the
+        //    one thing an identity-bound client must never adopt. The server resolves
+        //    the account from the verified signer, so the winning session is
+        //    identity-authoritative and the pin is (re)written from it.
+        //
+        //    Online-gated like every network step; `{ retry: false }` keeps the two
+        //    round-trips single attempts (the refresh scheduler / 401 lane own later
+        //    retries) so this step cannot multiply boot latency. On web
+        //    `KeyManager.getPublicKey()` resolves to `null`, so it skips.
+        steps.push({
+            id: 'identity-key-signin',
+            enabled: () => !isOffline(),
+            run: async () => {
+                const established = await (0, identitySession_1.establishIdentitySession)({
+                    oxy,
+                    store,
+                    binding: identityBinding,
+                    requestOptions: { retry: false },
                 });
-            }
-            return {
-                kind: 'session',
-                session: {
-                    sessionId: session.sessionId,
-                    userId: session.user.id,
-                    accessToken: session.accessToken,
-                },
-            };
-        },
-    });
+                const accessToken = established?.session.accessToken;
+                if (!established || !accessToken) {
+                    return { kind: 'skip' };
+                }
+                return {
+                    kind: 'session',
+                    session: {
+                        sessionId: established.session.sessionId,
+                        userId: established.session.user.id,
+                        accessToken,
+                    },
+                };
+            },
+        });
+    }
+    else {
+        // 3. shared-key-signin (native) — re-mint from the shared identity. Native
+        //    AND online: it is a network step (challenge + verify round-trips), so it
+        //    is gated by the same offline hint as the mint lane. `{ retry: false }`
+        //    keeps the two round-trips as single attempts — the refresh scheduler /
+        //    401 lane own later retries — so this step cannot multiply boot latency.
+        steps.push({
+            id: 'shared-key-signin',
+            enabled: () => isNative && !isOffline(),
+            run: async () => {
+                const session = await oxy.signInWithSharedIdentity({ requestOptions: { retry: false } });
+                if (!session?.accessToken) {
+                    return { kind: 'skip' };
+                }
+                // `verifyChallenge` mints a rotating deviceSecret; persist it so the next
+                // boot can use the faster device-secret-mint lane (sockets + tab-focus
+                // re-mint depend on the credential being in the store).
+                if (session.deviceId && session.deviceSecret) {
+                    await store.save({
+                        sessionId: session.sessionId,
+                        userId: session.user.id,
+                        deviceId: session.deviceId,
+                        deviceSecret: session.deviceSecret,
+                        accessToken: session.accessToken,
+                        expiresAt: session.expiresAt,
+                    });
+                }
+                return {
+                    kind: 'session',
+                    session: {
+                        sessionId: session.sessionId,
+                        userId: session.user.id,
+                        accessToken: session.accessToken,
+                    },
+                };
+            },
+        });
+    }
     const outcome = await (0, coldBoot_1.runColdBoot)({
         steps,
         overallDeadlineMs: opts.overallDeadlineMs,

package/dist/cjs/i18n/locales/ar-SA.json

@@ -124,7 +124,19 @@
         "commonsNotInstalled": "لا تملك Commons؟ احصل على التطبيق لتسجيل الدخول بمعرّف Oxy الخاص بك.",
         "showQrAnyway": "لدي Commons على جهاز آخر",
         "switchWhileSignedInAs": "تبديل الحساب، مسجّل الدخول باسم {{name}}",
-        "manageOnDevice": "إدارة الحسابات على هذا الجهاز"
+        "manageOnDevice": "إدارة الحسابات على هذا الجهاز",
+        "continueWithOxy": "المتابعة باستخدام Oxy",
+        "havingTrouble": "هل تواجه مشكلة؟",
+        "progress": {
+            "preparing": "جارٍ تحضير الطلب",
+            "awaitingApproval": "في انتظار الموافقة",
+            "scanWithCommons": "امسح الرمز باستخدام Commons على هاتفك",
+            "continueInCommons": "تابع في Commons",
+            "checkCommons": "تحقّق من Commons على هاتفك",
+            "openedInCommons": "تم الفتح في Commons",
+            "confirming": "جارٍ تأكيد الهوية",
+            "confirmed": "تم تأكيد الهوية"
+        }
     },
     "common": {
         "actions": {

package/dist/cjs/i18n/locales/ca-ES.json

@@ -124,7 +124,19 @@
         "commonsNotInstalled": "No tens Commons? Descarrega l'app per iniciar sessió amb el teu Oxy ID.",
         "showQrAnyway": "Tinc Commons en un altre dispositiu",
         "switchWhileSignedInAs": "Canvia de compte, amb la sessió iniciada com a {{name}}",
-        "manageOnDevice": "Gestionar comptes en aquest dispositiu"
+        "manageOnDevice": "Gestionar comptes en aquest dispositiu",
+        "continueWithOxy": "Continua amb Oxy",
+        "havingTrouble": "Algun problema?",
+        "progress": {
+            "preparing": "Preparant la sol·licitud",
+            "awaitingApproval": "Esperant l'aprovació",
+            "scanWithCommons": "Escaneja amb Commons al teu mòbil",
+            "continueInCommons": "Continua a Commons",
+            "checkCommons": "Revisa Commons al teu mòbil",
+            "openedInCommons": "Obert a Commons",
+            "confirming": "Confirmant la identitat",
+            "confirmed": "Identitat confirmada"
+        }
     },
     "common": {
         "actions": {

package/dist/cjs/i18n/locales/de-DE.json

@@ -124,7 +124,19 @@
         "commonsNotInstalled": "Kein Commons? Holen Sie sich die App, um sich mit Ihrer Oxy-ID anzumelden.",
         "showQrAnyway": "Ich habe Commons auf einem anderen Gerät",
         "switchWhileSignedInAs": "Konto wechseln, angemeldet als {{name}}",
-        "manageOnDevice": "Konten auf diesem Gerät verwalten"
+        "manageOnDevice": "Konten auf diesem Gerät verwalten",
+        "continueWithOxy": "Mit Oxy fortfahren",
+        "havingTrouble": "Gibt es ein Problem?",
+        "progress": {
+            "preparing": "Anfrage wird vorbereitet",
+            "awaitingApproval": "Warten auf Freigabe",
+            "scanWithCommons": "Scannen Sie mit Commons auf Ihrem Telefon",
+            "continueInCommons": "In Commons fortfahren",
+            "checkCommons": "Prüfen Sie Commons auf Ihrem Telefon",
+            "openedInCommons": "In Commons geöffnet",
+            "confirming": "Identität wird bestätigt",
+            "confirmed": "Identität bestätigt"
+        }
     },
     "common": {
         "actions": {

package/dist/cjs/i18n/locales/en-US.json

@@ -412,9 +412,6 @@
         },
         "label": "Account switcher",
         "searchPlaceholder": "Search accounts",
-        "scanTitle": "Scan to sign in",
-        "scanSubtitle": "Open the Oxy app on your phone and scan this code",
-        "scanWithOxy": "Scan with the Oxy app to continue",
         "scanQr": "Scan QR code",
         "qrHeadline": "Sign in with your Oxy identity",
         "signInWithOxy": "Sign in with Oxy",
@@ -424,7 +421,19 @@
         "commonsNotInstalled": "Don't have Commons? Get the app to sign in with your Oxy ID.",
         "showQrAnyway": "I have Commons on another device",
         "switchWhileSignedInAs": "Switch account, signed in as {{name}}",
-        "manageOnDevice": "Manage accounts on this device"
+        "manageOnDevice": "Manage accounts on this device",
+        "continueWithOxy": "Continue with Oxy",
+        "havingTrouble": "Having trouble?",
+        "progress": {
+            "preparing": "Preparing request",
+            "awaitingApproval": "Waiting for approval",
+            "scanWithCommons": "Scan with Commons on your phone",
+            "continueInCommons": "Continue in Commons",
+            "checkCommons": "Check Commons on your phone",
+            "openedInCommons": "Opened in Commons",
+            "confirming": "Confirming identity",
+            "confirmed": "Identity confirmed"
+        }
     },
     "reputation": {
         "faq": {

package/dist/cjs/i18n/locales/es-ES.json

@@ -652,9 +652,6 @@
         },
         "label": "Selector de cuentas",
         "searchPlaceholder": "Buscar cuentas",
-        "scanTitle": "Escanea para iniciar sesión",
-        "scanSubtitle": "Abre la app de Oxy en tu móvil y escanea este código",
-        "scanWithOxy": "Escanea con la app de Oxy para continuar",
         "scanQr": "Escanear código QR",
         "qrHeadline": "Inicia sesión con tu identidad de Oxy",
         "signInWithOxy": "Inicia sesión con Oxy",
@@ -664,7 +661,19 @@
         "commonsNotInstalled": "¿No tienes Commons? Descarga la app para iniciar sesión con tu Oxy ID.",
         "showQrAnyway": "Tengo Commons en otro dispositivo",
         "switchWhileSignedInAs": "Cambiar de cuenta, con la sesión iniciada como {{name}}",
-        "manageOnDevice": "Gestionar cuentas en este dispositivo"
+        "manageOnDevice": "Gestionar cuentas en este dispositivo",
+        "continueWithOxy": "Continuar con Oxy",
+        "havingTrouble": "¿Algún problema?",
+        "progress": {
+            "preparing": "Preparando la solicitud",
+            "awaitingApproval": "Esperando la aprobación",
+            "scanWithCommons": "Escanea con Commons en tu móvil",
+            "continueInCommons": "Continúa en Commons",
+            "checkCommons": "Revisa Commons en tu móvil",
+            "openedInCommons": "Abierto en Commons",
+            "confirming": "Confirmando identidad",
+            "confirmed": "Identidad confirmada"
+        }
     },
     "feedback": {
         "type": {

package/dist/cjs/i18n/locales/fr-FR.json

@@ -124,7 +124,19 @@
         "commonsNotInstalled": "Pas de Commons ? Téléchargez l'app pour vous connecter avec votre Oxy ID.",
         "showQrAnyway": "J'ai Commons sur un autre appareil",
         "switchWhileSignedInAs": "Changer de compte, connecté en tant que {{name}}",
-        "manageOnDevice": "Gérer les comptes sur cet appareil"
+        "manageOnDevice": "Gérer les comptes sur cet appareil",
+        "continueWithOxy": "Continuer avec Oxy",
+        "havingTrouble": "Un problème ?",
+        "progress": {
+            "preparing": "Préparation de la demande",
+            "awaitingApproval": "En attente d'approbation",
+            "scanWithCommons": "Scannez avec Commons sur votre téléphone",
+            "continueInCommons": "Continuez dans Commons",
+            "checkCommons": "Consultez Commons sur votre téléphone",
+            "openedInCommons": "Ouvert dans Commons",
+            "confirming": "Confirmation de l'identité",
+            "confirmed": "Identité confirmée"
+        }
     },
     "common": {
         "actions": {

package/dist/cjs/i18n/locales/it-IT.json

@@ -124,7 +124,19 @@
         "commonsNotInstalled": "Non hai Commons? Scarica l'app per accedere con il tuo Oxy ID.",
         "showQrAnyway": "Ho Commons su un altro dispositivo",
         "switchWhileSignedInAs": "Cambia account, connesso come {{name}}",
-        "manageOnDevice": "Gestisci account su questo dispositivo"
+        "manageOnDevice": "Gestisci account su questo dispositivo",
+        "continueWithOxy": "Continua con Oxy",
+        "havingTrouble": "Problemi?",
+        "progress": {
+            "preparing": "Preparazione della richiesta",
+            "awaitingApproval": "In attesa di approvazione",
+            "scanWithCommons": "Scansiona con Commons sul tuo telefono",
+            "continueInCommons": "Continua in Commons",
+            "checkCommons": "Controlla Commons sul tuo telefono",
+            "openedInCommons": "Aperto in Commons",
+            "confirming": "Conferma dell'identità in corso",
+            "confirmed": "Identità confermata"
+        }
     },
     "common": {
         "actions": {

package/dist/cjs/i18n/locales/ja-JP.json

@@ -124,7 +124,19 @@
         "commonsNotInstalled": "Commonsがありませんか？アプリを入手してOxy IDでサインインしましょう。",
         "showQrAnyway": "別のデバイスにCommonsがあります",
         "switchWhileSignedInAs": "アカウントを切り替え（{{name}} としてログイン中）",
-        "manageOnDevice": "このデバイスのアカウントを管理"
+        "manageOnDevice": "このデバイスのアカウントを管理",
+        "continueWithOxy": "Oxyで続ける",
+        "havingTrouble": "うまくいきませんか？",
+        "progress": {
+            "preparing": "リクエストを準備しています",
+            "awaitingApproval": "承認を待っています",
+            "scanWithCommons": "スマートフォンのCommonsでスキャンしてください",
+            "continueInCommons": "Commonsで続けてください",
+            "checkCommons": "スマートフォンのCommonsを確認してください",
+            "openedInCommons": "Commonsで開きました",
+            "confirming": "本人確認をしています",
+            "confirmed": "本人確認が完了しました"
+        }
     },
     "common": {
         "actions": {

package/dist/cjs/i18n/locales/ko-KR.json

@@ -124,7 +124,19 @@
         "commonsNotInstalled": "Commons가 없으신가요? 앱을 다운로드하여 Oxy ID로 로그인하세요.",
         "showQrAnyway": "다른 기기에 Commons가 있습니다",
         "switchWhileSignedInAs": "계정 전환, {{name}}(으)로 로그인됨",
-        "manageOnDevice": "이 기기의 계정 관리"
+        "manageOnDevice": "이 기기의 계정 관리",
+        "continueWithOxy": "Oxy로 계속하기",
+        "havingTrouble": "문제가 있으신가요?",
+        "progress": {
+            "preparing": "요청 준비 중",
+            "awaitingApproval": "승인 대기 중",
+            "scanWithCommons": "휴대폰의 Commons로 스캔하세요",
+            "continueInCommons": "Commons에서 계속하세요",
+            "checkCommons": "휴대폰에서 Commons를 확인하세요",
+            "openedInCommons": "Commons에서 열림",
+            "confirming": "신원 확인 중",
+            "confirmed": "신원 확인 완료"
+        }
     },
     "common": {
         "actions": {

package/dist/cjs/i18n/locales/locales/ar-SA.json

@@ -124,7 +124,19 @@
     "commonsNotInstalled": "لا تملك Commons؟ احصل على التطبيق لتسجيل الدخول بمعرّف Oxy الخاص بك.",
     "showQrAnyway": "لدي Commons على جهاز آخر",
     "switchWhileSignedInAs": "تبديل الحساب، مسجّل الدخول باسم {{name}}",
-    "manageOnDevice": "إدارة الحسابات على هذا الجهاز"
+    "manageOnDevice": "إدارة الحسابات على هذا الجهاز",
+    "continueWithOxy": "المتابعة باستخدام Oxy",
+    "havingTrouble": "هل تواجه مشكلة؟",
+    "progress": {
+      "preparing": "جارٍ تحضير الطلب",
+      "awaitingApproval": "في انتظار الموافقة",
+      "scanWithCommons": "امسح الرمز باستخدام Commons على هاتفك",
+      "continueInCommons": "تابع في Commons",
+      "checkCommons": "تحقّق من Commons على هاتفك",
+      "openedInCommons": "تم الفتح في Commons",
+      "confirming": "جارٍ تأكيد الهوية",
+      "confirmed": "تم تأكيد الهوية"
+    }
   },
   "common": {
     "actions": {

package/dist/cjs/i18n/locales/locales/ca-ES.json

@@ -124,7 +124,19 @@
     "commonsNotInstalled": "No tens Commons? Descarrega l'app per iniciar sessió amb el teu Oxy ID.",
     "showQrAnyway": "Tinc Commons en un altre dispositiu",
     "switchWhileSignedInAs": "Canvia de compte, amb la sessió iniciada com a {{name}}",
-    "manageOnDevice": "Gestionar comptes en aquest dispositiu"
+    "manageOnDevice": "Gestionar comptes en aquest dispositiu",
+    "continueWithOxy": "Continua amb Oxy",
+    "havingTrouble": "Algun problema?",
+    "progress": {
+      "preparing": "Preparant la sol·licitud",
+      "awaitingApproval": "Esperant l'aprovació",
+      "scanWithCommons": "Escaneja amb Commons al teu mòbil",
+      "continueInCommons": "Continua a Commons",
+      "checkCommons": "Revisa Commons al teu mòbil",
+      "openedInCommons": "Obert a Commons",
+      "confirming": "Confirmant la identitat",
+      "confirmed": "Identitat confirmada"
+    }
   },
   "common": {
     "actions": {

package/dist/cjs/i18n/locales/locales/de-DE.json

@@ -124,7 +124,19 @@
     "commonsNotInstalled": "Kein Commons? Holen Sie sich die App, um sich mit Ihrer Oxy-ID anzumelden.",
     "showQrAnyway": "Ich habe Commons auf einem anderen Gerät",
     "switchWhileSignedInAs": "Konto wechseln, angemeldet als {{name}}",
-    "manageOnDevice": "Konten auf diesem Gerät verwalten"
+    "manageOnDevice": "Konten auf diesem Gerät verwalten",
+    "continueWithOxy": "Mit Oxy fortfahren",
+    "havingTrouble": "Gibt es ein Problem?",
+    "progress": {
+      "preparing": "Anfrage wird vorbereitet",
+      "awaitingApproval": "Warten auf Freigabe",
+      "scanWithCommons": "Scannen Sie mit Commons auf Ihrem Telefon",
+      "continueInCommons": "In Commons fortfahren",
+      "checkCommons": "Prüfen Sie Commons auf Ihrem Telefon",
+      "openedInCommons": "In Commons geöffnet",
+      "confirming": "Identität wird bestätigt",
+      "confirmed": "Identität bestätigt"
+    }
   },
   "common": {
     "actions": {