@oxyhq/core 12.4.0 → 12.5.0

package/dist/cjs/mixins/OxyServices.user.js

@@ -440,6 +440,17 @@ function OxyServicesUserMixin(Base) {
         async updateUserPreferences(preferences) {
             return this.updateProfile({ userPreferences: preferences });
         }
+        /**
+         * Update the authenticated user's portable theme preference (light/dark/
+         * system + Bloom color-preset key). Persisted on the User document via the
+         * SAME `PUT /users/me` settings path as the other preferences — same cache
+         * invalidation — so the next cold boot serves it on the self/session payload
+         * with no extra network call. The full object is written (both `mode` and
+         * `colorPreset` are required by the API).
+         */
+        async updateThemePreference(themePreference) {
+            return this.updateProfile({ themePreference });
+        }
         /**
          * Request account verification
          */

package/dist/cjs/server/safeFetch.js

@@ -383,7 +383,7 @@ function buildRequestOptions(target, pinnedIp, pinnedFamily, method, headers, si
     };
 }
 /** Perform a single upstream request (no auto-redirect). */
-function fetchOnce(options, isHttps, headersTimeoutMs) {
+function fetchOnce(options, isHttps, headersTimeoutMs, body) {
     return new Promise((resolve, reject) => {
         const transport = isHttps ? node_https_1.default : node_http_1.default;
         const req = transport.request(options, (res) => resolve(res));
@@ -391,7 +391,7 @@ function fetchOnce(options, isHttps, headersTimeoutMs) {
             req.destroy(new UpstreamError('upstream headers timeout'));
         });
         req.on('error', (err) => reject(err));
-        req.end();
+        req.end(body);
     });
 }
 /**
@@ -406,7 +406,7 @@ function fetchOnce(options, isHttps, headersTimeoutMs) {
  * @throws {UpstreamError} on redirect-loop / malformed-redirect / timeout.
  */
 async function safeFetch(rawUrl, options = {}) {
-    const { method = 'GET', headers: callerHeaders, maxRedirects = exports.MAX_REDIRECTS, headersTimeoutMs = exports.UPSTREAM_HEADERS_TIMEOUT_MS, signal, } = options;
+    const { method = 'GET', headers: callerHeaders, body, maxRedirects = exports.MAX_REDIRECTS, headersTimeoutMs = exports.UPSTREAM_HEADERS_TIMEOUT_MS, signal, } = options;
     // Normalize a case-insensitive header map and ensure a User-Agent default.
     const baseHeaders = {};
     if (callerHeaders) {
@@ -429,7 +429,7 @@ async function safeFetch(rawUrl, options = {}) {
         }
         const target = new node_url_1.URL(currentUrl);
         const requestOptions = buildRequestOptions(target, guard.ip, guard.family, method, baseHeaders, signal);
-        const response = await fetchOnce(requestOptions, target.protocol === 'https:', headersTimeoutMs);
+        const response = await fetchOnce(requestOptions, target.protocol === 'https:', headersTimeoutMs, body);
         const status = response.statusCode ?? 0;
         if (REDIRECT_STATUS_CODES.has(status)) {
             const location = response.headers.location;

package/dist/cjs/session/refresh.js

@@ -75,9 +75,20 @@ async function refreshDeviceSecretArm(deps) {
                 // Structural read (not `instanceof Error`): the thrown value can be a
                 // plain ApiError-shaped object or come from another realm.
                 const message = error?.message;
-                return typeof message === 'string' && message.includes('no_active_session')
-                    ? { status: 'no-session' }
-                    : { status: 'invalid-secret' };
+                const body = typeof message === 'string' ? message : '';
+                // ONLY the server's explicit `invalid_device_secret` proves the presented
+                // secret is bad and may clear the durable device credential. `no_active_session`
+                // is an authoritative signed-out. ANY OTHER 401 — a middleware/CSRF/proxy 401,
+                // an ALB/starting-instance 401, a CORS error page, etc., all common during a
+                // deploy/restart window — is NOT proof the secret diverged: treat it as
+                // transient and KEEP the credential so a later attempt self-heals. Wiping the
+                // credential on an ambiguous 401 is what logged users out on every deploy,
+                // ecosystem-wide.
+                if (body.includes('invalid_device_secret'))
+                    return { status: 'invalid-secret' };
+                if (body.includes('no_active_session'))
+                    return { status: 'no-session' };
+                return { status: 'transient' };
             }
             return { status: 'transient' };
         }