@oxyhq/core 12.9.0 → 12.10.1

package/dist/cjs/i18n/locales/locales/es-ES.json

@@ -290,6 +290,8 @@
       "saving": "Guardando…",
       "helper": "El círculo recortado es lo que aparecerá en tu perfil. Pellizca para acercar, arrastra para colocar.",
       "zoom": "{{value}}×",
+      "zoomIn": "Acercar",
+      "zoomOut": "Alejar",
       "a11yImage": "Vista previa del recorte. Pellizca para acercar y arrastra para reposicionar la imagen.",
       "a11yReset": "Restablecer el recorte a la posición predeterminada",
       "a11yResetAnnouncement": "Recorte restablecido"
@@ -310,6 +312,47 @@
     },
     "changeAvatar": "Cambiar avatar"
   },
+  "changeAvatar": {
+    "title": "Cambiar foto de perfil",
+    "sources": {
+      "upload": {
+        "title": "Subir desde el dispositivo",
+        "description": "Elige una foto de tu galería"
+      },
+      "camera": {
+        "title": "Hacer una foto",
+        "description": "Usa tu cámara"
+      },
+      "files": {
+        "title": "Mis archivos de Oxy",
+        "description": "Elige una imagen que ya has subido"
+      },
+      "remove": {
+        "title": "Eliminar la foto actual",
+        "description": "Vuelve a tus iniciales"
+      }
+    },
+    "remove": {
+      "confirmTitle": "¿Eliminar la foto de perfil?",
+      "confirmMessage": "Tu perfil mostrará tus iniciales. Puedes añadir una foto nueva cuando quieras.",
+      "confirmLabel": "Eliminar"
+    },
+    "permission": {
+      "libraryDenied": "Oxy necesita acceso a tus fotos para subir una imagen.",
+      "cameraDenied": "Oxy necesita acceso a tu cámara para hacer una foto.",
+      "openSettings": "Abrir ajustes"
+    },
+    "errors": {
+      "pickerUnavailable": "La selección de fotos no está disponible en este dispositivo.",
+      "cameraUnavailable": "La cámara no está disponible en este dispositivo.",
+      "pickFailed": "No se pudo abrir el selector de fotos.",
+      "cameraFailed": "No se pudo abrir la cámara.",
+      "loadImageFailed": "No se pudo cargar la imagen seleccionada."
+    },
+    "a11y": {
+      "currentPhoto": "Tu foto de perfil actual"
+    }
+  },
   "common": {
     "actions": {
       "back": "Atrás",
@@ -619,7 +662,8 @@
     "getCommons": "Descargar Commons",
     "commonsNotInstalled": "¿No tienes Commons? Descarga la app para iniciar sesión con tu Oxy ID.",
     "showQrAnyway": "Tengo Commons en otro dispositivo",
-    "switchWhileSignedInAs": "Cambiar de cuenta, con la sesión iniciada como {{name}}"
+    "switchWhileSignedInAs": "Cambiar de cuenta, con la sesión iniciada como {{name}}",
+    "manageOnDevice": "Gestionar cuentas en este dispositivo"
   },
   "feedback": {
     "type": {
@@ -1442,6 +1486,11 @@
     "uploadPhotos": "Subir fotos",
     "uploadFiles": "Subir archivos",
     "clearSearch": "Limpiar búsqueda",
+    "retry": "Reintentar",
+    "loadError": {
+      "title": "No se pudieron cargar tus archivos",
+      "description": "Algo salió mal. Comprueba tu conexión e inténtalo de nuevo."
+    },
     "choosePhoto": "Elegir foto",
     "done": "Listo",
     "doneWithCount": "Listo ({{count}})",
@@ -1615,6 +1664,8 @@
   "accountMenu": {
     "label": "Menú de cuenta",
     "manage": "Gestiona tu cuenta de Oxy",
+    "greeting": "¡Hola, {{name}}!",
+    "switchAccount": "Cambiar de cuenta",
     "viewProfile": "Ver perfil",
     "addAnother": "Añadir otra cuenta",
     "signOutAll": "Cerrar sesión en todas las cuentas",
@@ -1622,7 +1673,22 @@
     "openHint": "Abre el menú de cuenta",
     "openWithUser": "Menú de cuenta de {{name}}",
     "switching": "Cambiando de cuenta…",
-    "signOutAccount": "Cerrar sesión de {{name}}"
+    "signOutAccount": "Cerrar sesión de {{name}}",
+    "storage": {
+      "title": "Almacenamiento de Oxy",
+      "usage": "{{used}} de {{total}} en uso",
+      "used": "Usado",
+      "free": "Libre",
+      "unavailable": "Detalles de uso no disponibles",
+      "upgrade": "Mejorar plan",
+      "manage": "Gestionar almacenamiento"
+    },
+    "data": "Tus datos en Oxy",
+    "settings": "Ajustes de Oxy",
+    "help": "Ayuda y comentarios",
+    "signOut": "Cerrar sesión",
+    "privacy": "Política de privacidad",
+    "terms": "Términos del servicio"
   },
   "accounts": {
     "activeAccount": {

package/dist/cjs/i18n/locales/locales/fr-FR.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "Vos comptes"
+    },
+    "loading": "Chargement des comptes...",
     "qrHeadline": "Connectez-vous avec votre identité Oxy",
     "signInWithOxy": "Se connecter avec Oxy",
     "useIdentityOnDevice": "Pas de Commons ? Utilisez une clé d'accès sur cet appareil",

package/dist/cjs/i18n/locales/locales/it-IT.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "I tuoi account"
+    },
+    "loading": "Caricamento account...",
     "qrHeadline": "Accedi con la tua identità Oxy",
     "signInWithOxy": "Accedi con Oxy",
     "useIdentityOnDevice": "Non hai Commons? Usa una passkey su questo dispositivo",

package/dist/cjs/i18n/locales/locales/ja-JP.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "あなたのアカウント"
+    },
+    "loading": "アカウントを読み込み中...",
     "qrHeadline": "Oxy IDでサインイン",
     "signInWithOxy": "Oxyでサインイン",
     "useIdentityOnDevice": "Commonsがありませんか？このデバイスのパスキーを使用",

package/dist/cjs/i18n/locales/locales/ko-KR.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "내 계정"
+    },
+    "loading": "계정을 불러오는 중...",
     "qrHeadline": "Oxy ID로 로그인",
     "signInWithOxy": "Oxy로 로그인",
     "useIdentityOnDevice": "Commons가 없으신가요? 이 기기의 패스키를 사용하세요",

package/dist/cjs/i18n/locales/locales/pt-PT.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "As suas contas"
+    },
+    "loading": "A carregar contas...",
     "qrHeadline": "Inicie sessão com a sua identidade Oxy",
     "signInWithOxy": "Iniciar sessão com Oxy",
     "useIdentityOnDevice": "Não tem o Commons? Use uma chave de acesso neste dispositivo",

package/dist/cjs/i18n/locales/locales/zh-CN.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "你的账户"
+    },
+    "loading": "正在加载账户...",
     "qrHeadline": "使用您的 Oxy 身份登录",
     "signInWithOxy": "使用 Oxy 登录",
     "useIdentityOnDevice": "没有 Commons？改用此设备上的通行密钥",

package/dist/cjs/i18n/locales/pt-PT.json

@@ -112,6 +112,10 @@
         }
     },
     "accountSwitcher": {
+        "sections": {
+            "yourAccounts": "As suas contas"
+        },
+        "loading": "A carregar contas...",
         "qrHeadline": "Inicie sessão com a sua identidade Oxy",
         "signInWithOxy": "Iniciar sessão com Oxy",
         "useIdentityOnDevice": "Não tem o Commons? Use uma chave de acesso neste dispositivo",

package/dist/cjs/i18n/locales/zh-CN.json

@@ -112,6 +112,10 @@
         }
     },
     "accountSwitcher": {
+        "sections": {
+            "yourAccounts": "你的账户"
+        },
+        "loading": "正在加载账户...",
         "qrHeadline": "使用您的 Oxy 身份登录",
         "signInWithOxy": "使用 Oxy 登录",
         "useIdentityOnDevice": "没有 Commons？改用此设备上的通行密钥",

package/dist/cjs/index.js

@@ -18,10 +18,10 @@
  * If a symbol does not appear here, it is NOT part of the public API.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.normalizeLocale = exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = exports.AEAD_KEY_LENGTH = exports.decryptAead = exports.encryptAead = exports.hkdfSha256 = exports.RecoveryPhraseService = exports.SignatureService = exports.updateIdentityMarker = exports.readIdentityMarker = exports.IdentityUnavailableError = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.ORGANIZATION_CATEGORIES = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.AssetUrlResolutionError = exports.OxyServices = void 0;
-exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = void 0;
-exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.isOxyRpOrigin = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.isValidDisplayName = exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = void 0;
-exports.packageInfo = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.redeemHubTicketOnHub = exports.syncHubAfterSignIn = exports.parseHubSyncReturnUrl = exports.normalizeOfficialReturnOrigin = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.isIdpHubOrigin = exports.buildHubSyncUrl = exports.buildIdpHubOrigin = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.normalizeOAuthRedirectUri = exports.OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = exports.OXY_SILENT_OAUTH_ATTEMPTED_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = void 0;
+exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = exports.AEAD_KEY_LENGTH = exports.decryptAead = exports.encryptAead = exports.hkdfSha256 = exports.RecoveryPhraseService = exports.SignatureService = exports.updateIdentityMarker = exports.readIdentityMarker = exports.IdentityUnavailableError = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.ORGANIZATION_CATEGORIES = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.AssetUrlResolutionError = exports.OxyServices = void 0;
+exports.buildUrl = exports.buildSearchParams = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = void 0;
+exports.isOxyRpOrigin = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.isValidDisplayName = exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = void 0;
+exports.packageInfo = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.redeemHubTicketOnHub = exports.syncHubAfterSignIn = exports.parseHubSyncReturnUrl = exports.normalizeOfficialReturnOrigin = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.isIdpHubOrigin = exports.buildHubSyncUrl = exports.buildIdpHubOrigin = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.normalizeOAuthRedirectUri = exports.OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = exports.OXY_SILENT_OAUTH_ATTEMPTED_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = void 0;
 // Ensure crypto polyfills are loaded before anything else
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
@@ -40,6 +40,9 @@ Object.defineProperty(exports, "oxyClient", { enumerable: true, get: function ()
 // ---------------------------------------------------------------------------
 var OxyServices_auth_1 = require("./mixins/OxyServices.auth");
 Object.defineProperty(exports, "ServiceCredentialMismatchError", { enumerable: true, get: function () { return OxyServices_auth_1.ServiceCredentialMismatchError; } });
+var commonsApproval_1 = require("./utils/commonsApproval");
+Object.defineProperty(exports, "getCommonsApprovalBlockingReason", { enumerable: true, get: function () { return commonsApproval_1.getCommonsApprovalBlockingReason; } });
+Object.defineProperty(exports, "parseCommonsApprovalExpiresAt", { enumerable: true, get: function () { return commonsApproval_1.parseCommonsApprovalExpiresAt; } });
 var OxyServices_appData_1 = require("./mixins/OxyServices.appData");
 Object.defineProperty(exports, "OxyAppDataIdentifierError", { enumerable: true, get: function () { return OxyServices_appData_1.OxyAppDataIdentifierError; } });
 // ---------------------------------------------------------------------------

package/dist/cjs/mixins/OxyServices.auth.js

@@ -1,8 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ServiceCredentialMismatchError = void 0;
+exports.ServiceCredentialMismatchError = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = void 0;
 exports.OxyServicesAuthMixin = OxyServicesAuthMixin;
 const contracts_1 = require("@oxyhq/contracts");
+var commonsApproval_1 = require("../utils/commonsApproval");
+Object.defineProperty(exports, "getCommonsApprovalBlockingReason", { enumerable: true, get: function () { return commonsApproval_1.getCommonsApprovalBlockingReason; } });
+Object.defineProperty(exports, "parseCommonsApprovalExpiresAt", { enumerable: true, get: function () { return commonsApproval_1.parseCommonsApprovalExpiresAt; } });
 const OxyServices_errors_1 = require("../OxyServices.errors");
 const keyManager_1 = require("../crypto/keyManager");
 const signatureService_1 = require("../crypto/signatureService");
@@ -186,7 +189,7 @@ function OxyServicesAuthMixin(Base) {
          * @internal
          */
         async _doFetchServiceToken(key, secret, cacheKey, secretBuf) {
-            const response = await this.makeRequest('POST', '/auth/service-token', { apiKey: key, apiSecret: secret }, { cache: false, retry: false });
+            const response = await this.makeRequest('POST', '/auth/service-token', { apiKey: key, apiSecret: secret }, { cache: false, retry: false, skipAuth: true });
             const expiresAt = Date.now() + response.expiresIn * 1000;
             // Update the entry in-place so any caller that already grabbed a reference
             // (via `_serviceTokenCache.get(...)`) sees the fresh state.
@@ -283,7 +286,7 @@ function OxyServicesAuthMixin(Base) {
                     publicKey,
                     signature,
                     timestamp,
-                }, { cache: false });
+                }, { cache: false, skipAuth: true });
                 if (!res || (typeof res === 'object' && Object.keys(res).length === 0)) {
                     throw new OxyServices_errors_1.OxyAuthenticationError('Registration failed', 'REGISTER_FAILED', 400);
                 }
@@ -307,7 +310,7 @@ function OxyServicesAuthMixin(Base) {
             try {
                 return await this.makeRequest('POST', '/auth/challenge', {
                     publicKey,
-                }, { cache: false, ...requestOptions });
+                }, { cache: false, skipAuth: true, ...requestOptions });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -336,7 +339,7 @@ function OxyServicesAuthMixin(Base) {
                     timestamp,
                     deviceName,
                     deviceFingerprint,
-                }, { cache: false, ...requestOptions });
+                }, { cache: false, skipAuth: true, ...requestOptions });
                 // Plant the freshly-minted tokens, mirroring `claimSessionByToken`.
                 // `/auth/verify` returns the first access token (and refresh token) in
                 // its body, so installing it here means callers get an authenticated
@@ -359,7 +362,7 @@ function OxyServicesAuthMixin(Base) {
          */
         async checkPublicKeyRegistered(publicKey) {
             try {
-                return await this.makeRequest('GET', `/auth/check-publickey/${encodeURIComponent(publicKey)}`, undefined, { cache: false });
+                return await this.makeRequest('GET', `/auth/check-publickey/${encodeURIComponent(publicKey)}`, undefined, { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -370,7 +373,12 @@ function OxyServicesAuthMixin(Base) {
          */
         async getUserByPublicKey(publicKey) {
             try {
-                const user = await this.makeRequest('GET', `/auth/user/${encodeURIComponent(publicKey)}`, undefined, { cache: true, cacheTTL: 2 * 60 * 1000 });
+                const user = await this.makeRequest('GET', `/auth/user/${encodeURIComponent(publicKey)}`, undefined, {
+                    cache: true,
+                    cacheTTL: 2 * 60 * 1000,
+                    // Public lookup by public key (pre-session) — skip the bearer preflight.
+                    skipAuth: true,
+                });
                 return (0, userIdentity_1.normalizeUserIdentity)(user);
             }
             catch (error) {
@@ -441,7 +449,9 @@ function OxyServicesAuthMixin(Base) {
                 const res = await this.makeRequest('POST', '/auth/session/claim', {
                     sessionToken,
                     ...(options.deviceFingerprint ? { deviceFingerprint: options.deviceFingerprint } : {}),
-                }, { cache: false, retry: false });
+                }, 
+                // Body-authenticated device-flow claim (no bearer) — skip the preflight.
+                { cache: false, retry: false, skipAuth: true });
                 this.setTokens(res.accessToken);
                 return res;
             }
@@ -525,7 +535,11 @@ function OxyServicesAuthMixin(Base) {
                 // QR. Reuses the platform-safe random generator.
                 const sessionToken = await signatureService_1.SignatureService.generateChallenge();
                 const expiresAt = Date.now() + COMMONS_SIGN_IN_EXPIRY_MS;
-                const res = await this.makeRequest('POST', '/auth/session/create', { sessionToken, expiresAt, clientId: params.clientId }, { cache: false });
+                const res = await this.makeRequest('POST', '/auth/session/create', { sessionToken, expiresAt, clientId: params.clientId }, 
+                // Public/pre-session (no bearer): skip the preflight so a stale
+                // near-expiry token cannot re-enter refreshAccessToken while the
+                // refresh handler is already in flight (self-await hang).
+                { cache: false, skipAuth: true });
                 return {
                     sessionToken,
                     authorizeCode: res.authorizeCode,
@@ -549,7 +563,11 @@ function OxyServicesAuthMixin(Base) {
          */
         async pollCommonsSignIn(sessionToken) {
             try {
-                return await this.makeRequest('GET', `/auth/session/status/${encodeURIComponent(sessionToken)}`, undefined, { cache: false, retry: false });
+                return await this.makeRequest('GET', `/auth/session/status/${encodeURIComponent(sessionToken)}`, undefined, 
+                // Public/pre-session (no bearer): a preflight here is wrong per se and,
+                // if ever reached while a refresh is pending, would re-enter
+                // refreshAccessToken and await the very promise it runs inside.
+                { cache: false, retry: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -567,7 +585,10 @@ function OxyServicesAuthMixin(Base) {
          */
         async getCommonsApprovalInfo(authorizeCode) {
             try {
-                const raw = await this.makeRequest('GET', `/auth/session/approve-info/${encodeURIComponent(authorizeCode)}`, undefined, { cache: false });
+                const raw = await this.makeRequest('GET', `/auth/session/approve-info/${encodeURIComponent(authorizeCode)}`, undefined, 
+                // Public (no auth required) — skip the bearer preflight (avoids the
+                // pre-session self-await class).
+                { cache: false, skipAuth: true });
                 return {
                     application: raw.application,
                     scopes: raw.scopes,
@@ -614,7 +635,9 @@ function OxyServicesAuthMixin(Base) {
                     timestamp: signed.timestamp,
                     ...(params.deviceName ? { deviceName: params.deviceName } : {}),
                     ...(params.deviceFingerprint ? { deviceFingerprint: params.deviceFingerprint } : {}),
-                }, { cache: false });
+                }, 
+                // Key-signed, cookieless (no bearer) — skip the preflight.
+                { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -628,7 +651,9 @@ function OxyServicesAuthMixin(Base) {
          */
         async denyCommonsSignIn(authorizeCode) {
             try {
-                return await this.makeRequest('POST', `/auth/session/deny/${encodeURIComponent(authorizeCode)}`, undefined, { cache: false });
+                return await this.makeRequest('POST', `/auth/session/deny/${encodeURIComponent(authorizeCode)}`, undefined, 
+                // Public (no auth required) — skip the bearer preflight.
+                { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -739,7 +764,8 @@ function OxyServicesAuthMixin(Base) {
          */
         async checkUsernameAvailability(username) {
             try {
-                return await this.makeRequest('GET', `/auth/check-username/${username}`, undefined, { cache: false });
+                // Public availability lookup (pre-session) — skip the bearer preflight.
+                return await this.makeRequest('GET', `/auth/check-username/${username}`, undefined, { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -750,7 +776,8 @@ function OxyServicesAuthMixin(Base) {
          */
         async checkEmailAvailability(email) {
             try {
-                return await this.makeRequest('GET', `/auth/check-email/${email}`, undefined, { cache: false });
+                // Public availability lookup (pre-session) — skip the bearer preflight.
+                return await this.makeRequest('GET', `/auth/check-email/${email}`, undefined, { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -769,7 +796,7 @@ function OxyServicesAuthMixin(Base) {
          */
         async webauthnRegisterOptions(username) {
             try {
-                return await this.makeRequest('POST', '/auth/webauthn/register/options', { ...(username !== undefined ? { username } : {}) }, { cache: false });
+                return await this.makeRequest('POST', '/auth/webauthn/register/options', { ...(username !== undefined ? { username } : {}) }, { cache: false, ...(username !== undefined ? { skipAuth: true } : {}) });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -790,7 +817,7 @@ function OxyServicesAuthMixin(Base) {
          */
         async webauthnRegisterVerify(response, envelope = {}) {
             try {
-                const res = await this.makeRequest('POST', '/auth/webauthn/register/verify', { response, ...envelope }, { cache: false });
+                const res = await this.makeRequest('POST', '/auth/webauthn/register/verify', { response, ...envelope }, { cache: false, ...(envelope.username !== undefined ? { skipAuth: true } : {}) });
                 if (res && typeof res === 'object') {
                     const record = res;
                     // Signup branch: mints a session (LoginSessionResult, carries
@@ -828,7 +855,9 @@ function OxyServicesAuthMixin(Base) {
          */
         async webauthnLoginOptions(username) {
             try {
-                return await this.makeRequest('POST', '/auth/webauthn/login/options', { ...(username !== undefined ? { username } : {}) }, { cache: false });
+                return await this.makeRequest('POST', '/auth/webauthn/login/options', { ...(username !== undefined ? { username } : {}) }, 
+                // Pre-session login ceremony — skip the bearer preflight.
+                { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -844,7 +873,9 @@ function OxyServicesAuthMixin(Base) {
          */
         async webauthnLoginVerify(response, envelope = {}) {
             try {
-                const res = await this.makeRequest('POST', '/auth/webauthn/login/verify', { response, ...envelope }, { cache: false });
+                const res = await this.makeRequest('POST', '/auth/webauthn/login/verify', { response, ...envelope }, 
+                // Pre-session login ceremony — skip the bearer preflight.
+                { cache: false, skipAuth: true });
                 const parsed = (0, contracts_1.safeParseContract)(contracts_1.loginResultSchema, res);
                 if (!parsed) {
                     throw new Error('auth/webauthn/login/verify returned an unexpected response shape');
@@ -871,7 +902,7 @@ function OxyServicesAuthMixin(Base) {
                     clientId: params.clientId,
                     redirectUri: params.redirectUri,
                     codeVerifier: params.codeVerifier,
-                }, { cache: false });
+                }, { cache: false, skipAuth: true });
                 const payload = res.data ??
                     res;
                 if (!payload || typeof payload !== 'object') {

package/dist/cjs/mixins/OxyServices.connectedApps.js

@@ -19,7 +19,12 @@ function OxyServicesConnectedAppsMixin(Base) {
          */
         async getPublicApplication(clientId) {
             try {
-                const res = await this.makeRequest('GET', `/auth/oauth/client/${encodeURIComponent(clientId)}`, undefined, { cache: true, cacheTTL: mixinHelpers_1.CACHE_TIMES.MEDIUM });
+                const res = await this.makeRequest('GET', `/auth/oauth/client/${encodeURIComponent(clientId)}`, undefined, {
+                    cache: true,
+                    cacheTTL: mixinHelpers_1.CACHE_TIMES.MEDIUM,
+                    // Public client metadata (pre-session consent UI) — skip the bearer preflight.
+                    skipAuth: true,
+                });
                 return res.application;
             }
             catch (error) {

package/dist/cjs/mixins/OxyServices.deviceBoot.js

@@ -44,7 +44,11 @@ function OxyServicesDeviceBootMixin(Base) {
          */
         async mintFromDeviceSecret(deviceId, deviceSecret) {
             try {
-                const res = await this.makeRequest('POST', '/session/device/token', { deviceId, deviceSecret }, { cache: false, skipAuth: true, retry: false });
+                const res = await this.makeRequest('POST', '/session/device/token', { deviceId, deviceSecret }, 
+                // `bypassQueue`: this mint is the control-plane call the auth lane
+                // depends on — it must run even when every RequestQueue slot is parked
+                // awaiting it, or the whole client deadlocks. See RequestOptions.bypassQueue.
+                { cache: false, skipAuth: true, retry: false, bypassQueue: true });
                 const parsed = (0, contracts_1.safeParseContract)(contracts_1.deviceTokenMintResponseSchema, res);
                 if (!parsed) {
                     throw new Error('session/device/token returned an unexpected response shape');
@@ -72,7 +76,10 @@ function OxyServicesDeviceBootMixin(Base) {
         /** Redeem a hub sync ticket for a fresh device secret (public). */
         async redeemHubTicket(ticket, returnOrigin) {
             try {
-                const res = await this.makeRequest('POST', '/session/device/redeem-ticket', { ticket, returnOrigin }, { cache: false, skipAuth: true });
+                const res = await this.makeRequest('POST', '/session/device/redeem-ticket', { ticket, returnOrigin }, 
+                // Public device-hub sync mint (bearer-less). Same control-plane class as
+                // the device-secret mint — bypassQueue so it never waits for a slot.
+                { cache: false, skipAuth: true, bypassQueue: true });
                 const parsed = (0, contracts_1.safeParseContract)(contracts_1.deviceHubTicketRedeemResponseSchema, res);
                 if (!parsed) {
                     throw new Error('session/device/redeem-ticket returned an unexpected response shape');

package/dist/cjs/mixins/OxyServices.identityBackup.js

@@ -141,6 +141,17 @@ function OxyServicesIdentityBackupMixin(Base) {
                 const aad = buildBackupAad(envelope.version, envelope.publicKeyHint);
                 const plaintext = (0, aead_1.decryptAead)(backupKey, fromHex(envelope.nonce), fromHex(envelope.ciphertext), aad);
                 const payload = JSON.parse(new TextDecoder().decode(plaintext));
+                if (!payload.privateKey || !payload.publicKey) {
+                    throw new Error('Backup payload is missing key material');
+                }
+                const derivedFromPhrase = await recoveryPhrase_1.RecoveryPhraseService.derivePublicKeyFromPhrase(phrase);
+                const derivedFromPrivate = keyManager_1.KeyManager.derivePublicKey(payload.privateKey);
+                const phrasePk = derivedFromPhrase.toLowerCase();
+                const payloadPk = payload.publicKey.toLowerCase();
+                const privatePk = derivedFromPrivate.toLowerCase();
+                if (phrasePk !== payloadPk || privatePk !== payloadPk) {
+                    throw new Error('Backup payload does not match the recovery phrase');
+                }
                 // Persist the recovered key. Native-only; refuses to clobber a different
                 // identity unless overwrite — the IdentityAlreadyExistsError propagates.
                 return await keyManager_1.KeyManager.importKeyPair(payload.privateKey, {

package/dist/cjs/mixins/OxyServices.user.js

@@ -59,6 +59,8 @@ function OxyServicesUserMixin(Base) {
             return await this.makeRequest('GET', `/auth/lookup/${encodeURIComponent(username)}`, undefined, {
                 cache: true,
                 cacheTTL: 60 * 1000, // 1 minute cache
+                // Public login-flow lookup (pre-session) — skip the bearer preflight.
+                skipAuth: true,
             });
         }
         /**
@@ -423,6 +425,10 @@ function OxyServicesUserMixin(Base) {
                 const result = await this.makeRequest('PATCH', `/privacy/${id}/privacy`, settings, {
                     cache: false,
                 });
+                this.clearCacheByPrefix('GET:/session/user/');
+                this.clearCacheByPrefix('GET:/users/me');
+                this.clearCacheByPrefix('GET:/profiles/username/');
+                this.clearCacheEntry(`GET:/users/${id}`);
                 this.clearCacheEntry(`GET:/privacy/${id}/privacy`);
                 return result;
             }

package/dist/cjs/session/accountDialogController.js

@@ -36,6 +36,13 @@
  * password, social login, and 2FA were removed ecosystem-wide. Account
  * creation (`signup` view) is the same two identity backends: a passkey
  * ceremony on web, or a Commons-created identity.
+ *
+ * The controller owns NO surface PRESENTATION: whether the account dialog is
+ * mounted, visible, or dismissed is the job of the shared surface stack
+ * (`@oxyhq/services` presents the `AccountDialog` surface into `@oxyhq/bloom`'s
+ * stack). This is a headless state machine only — it exposes `setView` /
+ * `add` / `startSignup` (the view axis) and `cancelSignIn` (device-flow
+ * teardown), never an `open` / `close` / `visible`.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AccountDialogController = void 0;
@@ -252,11 +259,6 @@ class AccountDialogController {
         this.view = view;
         this.emit();
     }
-    /** Return to the account list and cancel any in-flight sign-in flow. */
-    close() {
-        this.cancelSignIn();
-        this.setView('accounts');
-    }
     /** Switch to the "add account" view (the sign-in entry chooser). */
     add() {
         this.setView('add');

package/dist/cjs/utils/commonsApproval.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCommonsApprovalBlockingReason = getCommonsApprovalBlockingReason;
+exports.parseCommonsApprovalExpiresAt = parseCommonsApprovalExpiresAt;
+/**
+ * Returns a user-facing blocking reason when an approval payload must not be
+ * shown as actionable, or `null` when the request is still pending and valid.
+ */
+function getCommonsApprovalBlockingReason(info) {
+    if (!info.application?.id) {
+        return 'The requesting application could not be resolved.';
+    }
+    if (info.status !== 'pending') {
+        return 'This sign-in request is invalid, already used, or expired.';
+    }
+    const expiresAtMs = parseCommonsApprovalExpiresAt(info.expiresAt);
+    if (expiresAtMs !== null && expiresAtMs < Date.now()) {
+        return 'This sign-in request has expired. Ask for a new QR code.';
+    }
+    return null;
+}
+/** Normalize API `expiresAt` (number or ISO string) to epoch ms. */
+function parseCommonsApprovalExpiresAt(expiresAt) {
+    if (typeof expiresAt === 'number' && Number.isFinite(expiresAt))
+        return expiresAt;
+    if (typeof expiresAt === 'string') {
+        const ms = Date.parse(expiresAt);
+        return Number.isFinite(ms) ? ms : null;
+    }
+    return null;
+}