@oxyhq/core 12.9.0 → 12.10.1

package/dist/esm/i18n/locales/locales/es-ES.json

@@ -290,6 +290,8 @@
       "saving": "Guardando…",
       "helper": "El círculo recortado es lo que aparecerá en tu perfil. Pellizca para acercar, arrastra para colocar.",
       "zoom": "{{value}}×",
+      "zoomIn": "Acercar",
+      "zoomOut": "Alejar",
       "a11yImage": "Vista previa del recorte. Pellizca para acercar y arrastra para reposicionar la imagen.",
       "a11yReset": "Restablecer el recorte a la posición predeterminada",
       "a11yResetAnnouncement": "Recorte restablecido"
@@ -310,6 +312,47 @@
     },
     "changeAvatar": "Cambiar avatar"
   },
+  "changeAvatar": {
+    "title": "Cambiar foto de perfil",
+    "sources": {
+      "upload": {
+        "title": "Subir desde el dispositivo",
+        "description": "Elige una foto de tu galería"
+      },
+      "camera": {
+        "title": "Hacer una foto",
+        "description": "Usa tu cámara"
+      },
+      "files": {
+        "title": "Mis archivos de Oxy",
+        "description": "Elige una imagen que ya has subido"
+      },
+      "remove": {
+        "title": "Eliminar la foto actual",
+        "description": "Vuelve a tus iniciales"
+      }
+    },
+    "remove": {
+      "confirmTitle": "¿Eliminar la foto de perfil?",
+      "confirmMessage": "Tu perfil mostrará tus iniciales. Puedes añadir una foto nueva cuando quieras.",
+      "confirmLabel": "Eliminar"
+    },
+    "permission": {
+      "libraryDenied": "Oxy necesita acceso a tus fotos para subir una imagen.",
+      "cameraDenied": "Oxy necesita acceso a tu cámara para hacer una foto.",
+      "openSettings": "Abrir ajustes"
+    },
+    "errors": {
+      "pickerUnavailable": "La selección de fotos no está disponible en este dispositivo.",
+      "cameraUnavailable": "La cámara no está disponible en este dispositivo.",
+      "pickFailed": "No se pudo abrir el selector de fotos.",
+      "cameraFailed": "No se pudo abrir la cámara.",
+      "loadImageFailed": "No se pudo cargar la imagen seleccionada."
+    },
+    "a11y": {
+      "currentPhoto": "Tu foto de perfil actual"
+    }
+  },
   "common": {
     "actions": {
       "back": "Atrás",
@@ -619,7 +662,8 @@
     "getCommons": "Descargar Commons",
     "commonsNotInstalled": "¿No tienes Commons? Descarga la app para iniciar sesión con tu Oxy ID.",
     "showQrAnyway": "Tengo Commons en otro dispositivo",
-    "switchWhileSignedInAs": "Cambiar de cuenta, con la sesión iniciada como {{name}}"
+    "switchWhileSignedInAs": "Cambiar de cuenta, con la sesión iniciada como {{name}}",
+    "manageOnDevice": "Gestionar cuentas en este dispositivo"
   },
   "feedback": {
     "type": {
@@ -1442,6 +1486,11 @@
     "uploadPhotos": "Subir fotos",
     "uploadFiles": "Subir archivos",
     "clearSearch": "Limpiar búsqueda",
+    "retry": "Reintentar",
+    "loadError": {
+      "title": "No se pudieron cargar tus archivos",
+      "description": "Algo salió mal. Comprueba tu conexión e inténtalo de nuevo."
+    },
     "choosePhoto": "Elegir foto",
     "done": "Listo",
     "doneWithCount": "Listo ({{count}})",
@@ -1615,6 +1664,8 @@
   "accountMenu": {
     "label": "Menú de cuenta",
     "manage": "Gestiona tu cuenta de Oxy",
+    "greeting": "¡Hola, {{name}}!",
+    "switchAccount": "Cambiar de cuenta",
     "viewProfile": "Ver perfil",
     "addAnother": "Añadir otra cuenta",
     "signOutAll": "Cerrar sesión en todas las cuentas",
@@ -1622,7 +1673,22 @@
     "openHint": "Abre el menú de cuenta",
     "openWithUser": "Menú de cuenta de {{name}}",
     "switching": "Cambiando de cuenta…",
-    "signOutAccount": "Cerrar sesión de {{name}}"
+    "signOutAccount": "Cerrar sesión de {{name}}",
+    "storage": {
+      "title": "Almacenamiento de Oxy",
+      "usage": "{{used}} de {{total}} en uso",
+      "used": "Usado",
+      "free": "Libre",
+      "unavailable": "Detalles de uso no disponibles",
+      "upgrade": "Mejorar plan",
+      "manage": "Gestionar almacenamiento"
+    },
+    "data": "Tus datos en Oxy",
+    "settings": "Ajustes de Oxy",
+    "help": "Ayuda y comentarios",
+    "signOut": "Cerrar sesión",
+    "privacy": "Política de privacidad",
+    "terms": "Términos del servicio"
   },
   "accounts": {
     "activeAccount": {

package/dist/esm/i18n/locales/locales/fr-FR.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "Vos comptes"
+    },
+    "loading": "Chargement des comptes...",
     "qrHeadline": "Connectez-vous avec votre identité Oxy",
     "signInWithOxy": "Se connecter avec Oxy",
     "useIdentityOnDevice": "Pas de Commons ? Utilisez une clé d'accès sur cet appareil",

package/dist/esm/i18n/locales/locales/it-IT.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "I tuoi account"
+    },
+    "loading": "Caricamento account...",
     "qrHeadline": "Accedi con la tua identità Oxy",
     "signInWithOxy": "Accedi con Oxy",
     "useIdentityOnDevice": "Non hai Commons? Usa una passkey su questo dispositivo",

package/dist/esm/i18n/locales/locales/ja-JP.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "あなたのアカウント"
+    },
+    "loading": "アカウントを読み込み中...",
     "qrHeadline": "Oxy IDでサインイン",
     "signInWithOxy": "Oxyでサインイン",
     "useIdentityOnDevice": "Commonsがありませんか？このデバイスのパスキーを使用",

package/dist/esm/i18n/locales/locales/ko-KR.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "내 계정"
+    },
+    "loading": "계정을 불러오는 중...",
     "qrHeadline": "Oxy ID로 로그인",
     "signInWithOxy": "Oxy로 로그인",
     "useIdentityOnDevice": "Commons가 없으신가요? 이 기기의 패스키를 사용하세요",

package/dist/esm/i18n/locales/locales/pt-PT.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "As suas contas"
+    },
+    "loading": "A carregar contas...",
     "qrHeadline": "Inicie sessão com a sua identidade Oxy",
     "signInWithOxy": "Iniciar sessão com Oxy",
     "useIdentityOnDevice": "Não tem o Commons? Use uma chave de acesso neste dispositivo",

package/dist/esm/i18n/locales/locales/zh-CN.json

@@ -112,6 +112,10 @@
     }
   },
   "accountSwitcher": {
+    "sections": {
+      "yourAccounts": "你的账户"
+    },
+    "loading": "正在加载账户...",
     "qrHeadline": "使用您的 Oxy 身份登录",
     "signInWithOxy": "使用 Oxy 登录",
     "useIdentityOnDevice": "没有 Commons？改用此设备上的通行密钥",

package/dist/esm/i18n/locales/pt-PT.json

@@ -112,6 +112,10 @@
         }
     },
     "accountSwitcher": {
+        "sections": {
+            "yourAccounts": "As suas contas"
+        },
+        "loading": "A carregar contas...",
         "qrHeadline": "Inicie sessão com a sua identidade Oxy",
         "signInWithOxy": "Iniciar sessão com Oxy",
         "useIdentityOnDevice": "Não tem o Commons? Use uma chave de acesso neste dispositivo",

package/dist/esm/i18n/locales/zh-CN.json

@@ -112,6 +112,10 @@
         }
     },
     "accountSwitcher": {
+        "sections": {
+            "yourAccounts": "你的账户"
+        },
+        "loading": "正在加载账户...",
         "qrHeadline": "使用您的 Oxy 身份登录",
         "signInWithOxy": "使用 Oxy 登录",
         "useIdentityOnDevice": "没有 Commons？改用此设备上的通行密钥",

package/dist/esm/index.js

@@ -26,7 +26,8 @@ export { OXY_CLOUD_URL, oxyClient } from './OxyServices.js';
 // ---------------------------------------------------------------------------
 // Authentication
 // ---------------------------------------------------------------------------
-export { ServiceCredentialMismatchError } from './mixins/OxyServices.auth.js';
+export { ServiceCredentialMismatchError, } from './mixins/OxyServices.auth.js';
+export { getCommonsApprovalBlockingReason, parseCommonsApprovalExpiresAt, } from './utils/commonsApproval.js';
 export { OxyAppDataIdentifierError } from './mixins/OxyServices.appData.js';
 // ---------------------------------------------------------------------------
 // User identity and handles

package/dist/esm/mixins/OxyServices.auth.js

@@ -1,4 +1,5 @@
 import { loginResultSchema, safeParseContract } from '@oxyhq/contracts';
+export { getCommonsApprovalBlockingReason, parseCommonsApprovalExpiresAt, } from '../utils/commonsApproval.js';
 import { OxyAuthenticationError } from '../OxyServices.errors.js';
 import { KeyManager } from '../crypto/keyManager.js';
 import { SignatureService } from '../crypto/signatureService.js';
@@ -181,7 +182,7 @@ export function OxyServicesAuthMixin(Base) {
          * @internal
          */
         async _doFetchServiceToken(key, secret, cacheKey, secretBuf) {
-            const response = await this.makeRequest('POST', '/auth/service-token', { apiKey: key, apiSecret: secret }, { cache: false, retry: false });
+            const response = await this.makeRequest('POST', '/auth/service-token', { apiKey: key, apiSecret: secret }, { cache: false, retry: false, skipAuth: true });
             const expiresAt = Date.now() + response.expiresIn * 1000;
             // Update the entry in-place so any caller that already grabbed a reference
             // (via `_serviceTokenCache.get(...)`) sees the fresh state.
@@ -278,7 +279,7 @@ export function OxyServicesAuthMixin(Base) {
                     publicKey,
                     signature,
                     timestamp,
-                }, { cache: false });
+                }, { cache: false, skipAuth: true });
                 if (!res || (typeof res === 'object' && Object.keys(res).length === 0)) {
                     throw new OxyAuthenticationError('Registration failed', 'REGISTER_FAILED', 400);
                 }
@@ -302,7 +303,7 @@ export function OxyServicesAuthMixin(Base) {
             try {
                 return await this.makeRequest('POST', '/auth/challenge', {
                     publicKey,
-                }, { cache: false, ...requestOptions });
+                }, { cache: false, skipAuth: true, ...requestOptions });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -331,7 +332,7 @@ export function OxyServicesAuthMixin(Base) {
                     timestamp,
                     deviceName,
                     deviceFingerprint,
-                }, { cache: false, ...requestOptions });
+                }, { cache: false, skipAuth: true, ...requestOptions });
                 // Plant the freshly-minted tokens, mirroring `claimSessionByToken`.
                 // `/auth/verify` returns the first access token (and refresh token) in
                 // its body, so installing it here means callers get an authenticated
@@ -354,7 +355,7 @@ export function OxyServicesAuthMixin(Base) {
          */
         async checkPublicKeyRegistered(publicKey) {
             try {
-                return await this.makeRequest('GET', `/auth/check-publickey/${encodeURIComponent(publicKey)}`, undefined, { cache: false });
+                return await this.makeRequest('GET', `/auth/check-publickey/${encodeURIComponent(publicKey)}`, undefined, { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -365,7 +366,12 @@ export function OxyServicesAuthMixin(Base) {
          */
         async getUserByPublicKey(publicKey) {
             try {
-                const user = await this.makeRequest('GET', `/auth/user/${encodeURIComponent(publicKey)}`, undefined, { cache: true, cacheTTL: 2 * 60 * 1000 });
+                const user = await this.makeRequest('GET', `/auth/user/${encodeURIComponent(publicKey)}`, undefined, {
+                    cache: true,
+                    cacheTTL: 2 * 60 * 1000,
+                    // Public lookup by public key (pre-session) — skip the bearer preflight.
+                    skipAuth: true,
+                });
                 return normalizeUserIdentity(user);
             }
             catch (error) {
@@ -436,7 +442,9 @@ export function OxyServicesAuthMixin(Base) {
                 const res = await this.makeRequest('POST', '/auth/session/claim', {
                     sessionToken,
                     ...(options.deviceFingerprint ? { deviceFingerprint: options.deviceFingerprint } : {}),
-                }, { cache: false, retry: false });
+                }, 
+                // Body-authenticated device-flow claim (no bearer) — skip the preflight.
+                { cache: false, retry: false, skipAuth: true });
                 this.setTokens(res.accessToken);
                 return res;
             }
@@ -520,7 +528,11 @@ export function OxyServicesAuthMixin(Base) {
                 // QR. Reuses the platform-safe random generator.
                 const sessionToken = await SignatureService.generateChallenge();
                 const expiresAt = Date.now() + COMMONS_SIGN_IN_EXPIRY_MS;
-                const res = await this.makeRequest('POST', '/auth/session/create', { sessionToken, expiresAt, clientId: params.clientId }, { cache: false });
+                const res = await this.makeRequest('POST', '/auth/session/create', { sessionToken, expiresAt, clientId: params.clientId }, 
+                // Public/pre-session (no bearer): skip the preflight so a stale
+                // near-expiry token cannot re-enter refreshAccessToken while the
+                // refresh handler is already in flight (self-await hang).
+                { cache: false, skipAuth: true });
                 return {
                     sessionToken,
                     authorizeCode: res.authorizeCode,
@@ -544,7 +556,11 @@ export function OxyServicesAuthMixin(Base) {
          */
         async pollCommonsSignIn(sessionToken) {
             try {
-                return await this.makeRequest('GET', `/auth/session/status/${encodeURIComponent(sessionToken)}`, undefined, { cache: false, retry: false });
+                return await this.makeRequest('GET', `/auth/session/status/${encodeURIComponent(sessionToken)}`, undefined, 
+                // Public/pre-session (no bearer): a preflight here is wrong per se and,
+                // if ever reached while a refresh is pending, would re-enter
+                // refreshAccessToken and await the very promise it runs inside.
+                { cache: false, retry: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -562,7 +578,10 @@ export function OxyServicesAuthMixin(Base) {
          */
         async getCommonsApprovalInfo(authorizeCode) {
             try {
-                const raw = await this.makeRequest('GET', `/auth/session/approve-info/${encodeURIComponent(authorizeCode)}`, undefined, { cache: false });
+                const raw = await this.makeRequest('GET', `/auth/session/approve-info/${encodeURIComponent(authorizeCode)}`, undefined, 
+                // Public (no auth required) — skip the bearer preflight (avoids the
+                // pre-session self-await class).
+                { cache: false, skipAuth: true });
                 return {
                     application: raw.application,
                     scopes: raw.scopes,
@@ -609,7 +628,9 @@ export function OxyServicesAuthMixin(Base) {
                     timestamp: signed.timestamp,
                     ...(params.deviceName ? { deviceName: params.deviceName } : {}),
                     ...(params.deviceFingerprint ? { deviceFingerprint: params.deviceFingerprint } : {}),
-                }, { cache: false });
+                }, 
+                // Key-signed, cookieless (no bearer) — skip the preflight.
+                { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -623,7 +644,9 @@ export function OxyServicesAuthMixin(Base) {
          */
         async denyCommonsSignIn(authorizeCode) {
             try {
-                return await this.makeRequest('POST', `/auth/session/deny/${encodeURIComponent(authorizeCode)}`, undefined, { cache: false });
+                return await this.makeRequest('POST', `/auth/session/deny/${encodeURIComponent(authorizeCode)}`, undefined, 
+                // Public (no auth required) — skip the bearer preflight.
+                { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -734,7 +757,8 @@ export function OxyServicesAuthMixin(Base) {
          */
         async checkUsernameAvailability(username) {
             try {
-                return await this.makeRequest('GET', `/auth/check-username/${username}`, undefined, { cache: false });
+                // Public availability lookup (pre-session) — skip the bearer preflight.
+                return await this.makeRequest('GET', `/auth/check-username/${username}`, undefined, { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -745,7 +769,8 @@ export function OxyServicesAuthMixin(Base) {
          */
         async checkEmailAvailability(email) {
             try {
-                return await this.makeRequest('GET', `/auth/check-email/${email}`, undefined, { cache: false });
+                // Public availability lookup (pre-session) — skip the bearer preflight.
+                return await this.makeRequest('GET', `/auth/check-email/${email}`, undefined, { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -764,7 +789,7 @@ export function OxyServicesAuthMixin(Base) {
          */
         async webauthnRegisterOptions(username) {
             try {
-                return await this.makeRequest('POST', '/auth/webauthn/register/options', { ...(username !== undefined ? { username } : {}) }, { cache: false });
+                return await this.makeRequest('POST', '/auth/webauthn/register/options', { ...(username !== undefined ? { username } : {}) }, { cache: false, ...(username !== undefined ? { skipAuth: true } : {}) });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -785,7 +810,7 @@ export function OxyServicesAuthMixin(Base) {
          */
         async webauthnRegisterVerify(response, envelope = {}) {
             try {
-                const res = await this.makeRequest('POST', '/auth/webauthn/register/verify', { response, ...envelope }, { cache: false });
+                const res = await this.makeRequest('POST', '/auth/webauthn/register/verify', { response, ...envelope }, { cache: false, ...(envelope.username !== undefined ? { skipAuth: true } : {}) });
                 if (res && typeof res === 'object') {
                     const record = res;
                     // Signup branch: mints a session (LoginSessionResult, carries
@@ -823,7 +848,9 @@ export function OxyServicesAuthMixin(Base) {
          */
         async webauthnLoginOptions(username) {
             try {
-                return await this.makeRequest('POST', '/auth/webauthn/login/options', { ...(username !== undefined ? { username } : {}) }, { cache: false });
+                return await this.makeRequest('POST', '/auth/webauthn/login/options', { ...(username !== undefined ? { username } : {}) }, 
+                // Pre-session login ceremony — skip the bearer preflight.
+                { cache: false, skipAuth: true });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -839,7 +866,9 @@ export function OxyServicesAuthMixin(Base) {
          */
         async webauthnLoginVerify(response, envelope = {}) {
             try {
-                const res = await this.makeRequest('POST', '/auth/webauthn/login/verify', { response, ...envelope }, { cache: false });
+                const res = await this.makeRequest('POST', '/auth/webauthn/login/verify', { response, ...envelope }, 
+                // Pre-session login ceremony — skip the bearer preflight.
+                { cache: false, skipAuth: true });
                 const parsed = safeParseContract(loginResultSchema, res);
                 if (!parsed) {
                     throw new Error('auth/webauthn/login/verify returned an unexpected response shape');
@@ -866,7 +895,7 @@ export function OxyServicesAuthMixin(Base) {
                     clientId: params.clientId,
                     redirectUri: params.redirectUri,
                     codeVerifier: params.codeVerifier,
-                }, { cache: false });
+                }, { cache: false, skipAuth: true });
                 const payload = res.data ??
                     res;
                 if (!payload || typeof payload !== 'object') {

package/dist/esm/mixins/OxyServices.connectedApps.js

@@ -16,7 +16,12 @@ export function OxyServicesConnectedAppsMixin(Base) {
          */
         async getPublicApplication(clientId) {
             try {
-                const res = await this.makeRequest('GET', `/auth/oauth/client/${encodeURIComponent(clientId)}`, undefined, { cache: true, cacheTTL: CACHE_TIMES.MEDIUM });
+                const res = await this.makeRequest('GET', `/auth/oauth/client/${encodeURIComponent(clientId)}`, undefined, {
+                    cache: true,
+                    cacheTTL: CACHE_TIMES.MEDIUM,
+                    // Public client metadata (pre-session consent UI) — skip the bearer preflight.
+                    skipAuth: true,
+                });
                 return res.application;
             }
             catch (error) {

package/dist/esm/mixins/OxyServices.deviceBoot.js

@@ -41,7 +41,11 @@ export function OxyServicesDeviceBootMixin(Base) {
          */
         async mintFromDeviceSecret(deviceId, deviceSecret) {
             try {
-                const res = await this.makeRequest('POST', '/session/device/token', { deviceId, deviceSecret }, { cache: false, skipAuth: true, retry: false });
+                const res = await this.makeRequest('POST', '/session/device/token', { deviceId, deviceSecret }, 
+                // `bypassQueue`: this mint is the control-plane call the auth lane
+                // depends on — it must run even when every RequestQueue slot is parked
+                // awaiting it, or the whole client deadlocks. See RequestOptions.bypassQueue.
+                { cache: false, skipAuth: true, retry: false, bypassQueue: true });
                 const parsed = safeParseContract(deviceTokenMintResponseSchema, res);
                 if (!parsed) {
                     throw new Error('session/device/token returned an unexpected response shape');
@@ -69,7 +73,10 @@ export function OxyServicesDeviceBootMixin(Base) {
         /** Redeem a hub sync ticket for a fresh device secret (public). */
         async redeemHubTicket(ticket, returnOrigin) {
             try {
-                const res = await this.makeRequest('POST', '/session/device/redeem-ticket', { ticket, returnOrigin }, { cache: false, skipAuth: true });
+                const res = await this.makeRequest('POST', '/session/device/redeem-ticket', { ticket, returnOrigin }, 
+                // Public device-hub sync mint (bearer-less). Same control-plane class as
+                // the device-secret mint — bypassQueue so it never waits for a slot.
+                { cache: false, skipAuth: true, bypassQueue: true });
                 const parsed = safeParseContract(deviceHubTicketRedeemResponseSchema, res);
                 if (!parsed) {
                     throw new Error('session/device/redeem-ticket returned an unexpected response shape');

package/dist/esm/mixins/OxyServices.identityBackup.js

@@ -138,6 +138,17 @@ export function OxyServicesIdentityBackupMixin(Base) {
                 const aad = buildBackupAad(envelope.version, envelope.publicKeyHint);
                 const plaintext = decryptAead(backupKey, fromHex(envelope.nonce), fromHex(envelope.ciphertext), aad);
                 const payload = JSON.parse(new TextDecoder().decode(plaintext));
+                if (!payload.privateKey || !payload.publicKey) {
+                    throw new Error('Backup payload is missing key material');
+                }
+                const derivedFromPhrase = await RecoveryPhraseService.derivePublicKeyFromPhrase(phrase);
+                const derivedFromPrivate = KeyManager.derivePublicKey(payload.privateKey);
+                const phrasePk = derivedFromPhrase.toLowerCase();
+                const payloadPk = payload.publicKey.toLowerCase();
+                const privatePk = derivedFromPrivate.toLowerCase();
+                if (phrasePk !== payloadPk || privatePk !== payloadPk) {
+                    throw new Error('Backup payload does not match the recovery phrase');
+                }
                 // Persist the recovered key. Native-only; refuses to clobber a different
                 // identity unless overwrite — the IdentityAlreadyExistsError propagates.
                 return await KeyManager.importKeyPair(payload.privateKey, {

package/dist/esm/mixins/OxyServices.user.js

@@ -56,6 +56,8 @@ export function OxyServicesUserMixin(Base) {
             return await this.makeRequest('GET', `/auth/lookup/${encodeURIComponent(username)}`, undefined, {
                 cache: true,
                 cacheTTL: 60 * 1000, // 1 minute cache
+                // Public login-flow lookup (pre-session) — skip the bearer preflight.
+                skipAuth: true,
             });
         }
         /**
@@ -420,6 +422,10 @@ export function OxyServicesUserMixin(Base) {
                 const result = await this.makeRequest('PATCH', `/privacy/${id}/privacy`, settings, {
                     cache: false,
                 });
+                this.clearCacheByPrefix('GET:/session/user/');
+                this.clearCacheByPrefix('GET:/users/me');
+                this.clearCacheByPrefix('GET:/profiles/username/');
+                this.clearCacheEntry(`GET:/users/${id}`);
                 this.clearCacheEntry(`GET:/privacy/${id}/privacy`);
                 return result;
             }

package/dist/esm/session/accountDialogController.js

@@ -35,6 +35,13 @@
  * password, social login, and 2FA were removed ecosystem-wide. Account
  * creation (`signup` view) is the same two identity backends: a passkey
  * ceremony on web, or a Commons-created identity.
+ *
+ * The controller owns NO surface PRESENTATION: whether the account dialog is
+ * mounted, visible, or dismissed is the job of the shared surface stack
+ * (`@oxyhq/services` presents the `AccountDialog` surface into `@oxyhq/bloom`'s
+ * stack). This is a headless state machine only — it exposes `setView` /
+ * `add` / `startSignup` (the view axis) and `cancelSignIn` (device-flow
+ * teardown), never an `open` / `close` / `visible`.
  */
 import { logger } from '../logger/index.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
@@ -248,11 +255,6 @@ export class AccountDialogController {
         this.view = view;
         this.emit();
     }
-    /** Return to the account list and cancel any in-flight sign-in flow. */
-    close() {
-        this.cancelSignIn();
-        this.setView('accounts');
-    }
     /** Switch to the "add account" view (the sign-in entry chooser). */
     add() {
         this.setView('add');

package/dist/esm/utils/commonsApproval.js

@@ -0,0 +1,27 @@
+/**
+ * Returns a user-facing blocking reason when an approval payload must not be
+ * shown as actionable, or `null` when the request is still pending and valid.
+ */
+export function getCommonsApprovalBlockingReason(info) {
+    if (!info.application?.id) {
+        return 'The requesting application could not be resolved.';
+    }
+    if (info.status !== 'pending') {
+        return 'This sign-in request is invalid, already used, or expired.';
+    }
+    const expiresAtMs = parseCommonsApprovalExpiresAt(info.expiresAt);
+    if (expiresAtMs !== null && expiresAtMs < Date.now()) {
+        return 'This sign-in request has expired. Ask for a new QR code.';
+    }
+    return null;
+}
+/** Normalize API `expiresAt` (number or ISO string) to epoch ms. */
+export function parseCommonsApprovalExpiresAt(expiresAt) {
+    if (typeof expiresAt === 'number' && Number.isFinite(expiresAt))
+        return expiresAt;
+    if (typeof expiresAt === 'string') {
+        const ms = Date.parse(expiresAt);
+        return Number.isFinite(ms) ? ms : null;
+    }
+    return null;
+}