@oxyhq/services 25.0.1 → 26.0.1

package/src/ui/hooks/useAvatarPicker.ts

@@ -24,7 +24,7 @@ import { useCallback } from 'react';
 import type { OxyServices } from '@oxyhq/core';
 import { translate, updateAvatarVisibility } from '@oxyhq/core';
 import type { QueryClient } from '@tanstack/react-query';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 import { updateProfileWithAvatar } from '../utils/avatarUtils';
 import { openWithinOrPresent } from '../navigation/surfaces';
 import type { AvatarCropResult } from '../screens/AvatarCropScreen';

package/src/ui/hooks/useOnlineStatus.ts

@@ -2,9 +2,8 @@
  * useOnlineStatus
  *
  * Reactive boolean reflecting TanStack Query's `onlineManager` state.
- * Mirrors browser `online`/`offline` events on web and NetInfo reachability
- * updates on native (both wired up in `OxyProvider`, aligned with Bloom's
- * `ConnectionStatusToasts` semantics).
+ * Mirrors browser `online`/`offline` events on web and NetInfo updates on
+ * native (both wired up in `OxyProvider`).
  *
  * Use this for surfacing offline UI — an OfflineBanner, a disabled "Sync"
  * button, an inline "queued" badge on pending writes, etc. For pending /

package/src/ui/hooks/useSessionManagement.ts

@@ -9,6 +9,7 @@ import type { OxyServices } from '@oxyhq/core';
 import type { QueryClient } from '@tanstack/react-query';
 import { clearQueryCache } from './queryClient';
 import { isWebBrowser } from '../utils/isWebBrowser';
+import { clearCrossOriginRestoreGuards } from '../utils/crossOriginRestore';
 import { resetSessionScopedStores } from '../stores/resetSessionScopedStores';
 
 export interface UseSessionManagementOptions {
@@ -196,6 +197,7 @@ export const useSessionManagement = ({
     }
     
     await clearSessionStorage();
+    clearCrossOriginRestoreGuards();
     onAuthStateChange?.(null);
   }, [clearSessionStorage, logoutStore, onAuthStateChange, oxyServices, queryClient, storage, logger]);
 

package/src/ui/hooks/useSettingToggle.ts

@@ -1,5 +1,5 @@
 import { useState, useCallback, useEffect } from 'react';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 
 interface UseSettingToggleOptions {
     /** Initial value of the setting */

package/src/ui/hooks/useSurfaceHeader.ts

@@ -10,13 +10,8 @@ import type { DialogHeaderConfig } from '@oxyhq/bloom/dialog';
  * design-system fields Bloom's nav header supports: the single trailing
  * `primaryAction` CTA (Upload / Save), a trailing icon `actions` row, a header
  * `search` / `segments` in the large-title zone, an `onImage` `tone` over media,
- * and a wizard `progress` bar.
- *
- * Only the NODE fields (`left`/`right`/`titleContent`, and an action's `icon`)
- * must be referentially stable — a node can only be compared by identity, so an
- * inline one thrashes the header. The rich OBJECT fields are compared by value
- * (see {@link surfaceHeaderContentEqual}), so an inline `primaryAction` /
- * `actions` / `search` / `segments` / `progress` is safe to pass.
+ * and a wizard `progress` bar. Object/slot fields MUST be referentially stable
+ * (memoize them with `useMemo`) so the header does not thrash.
  */
 export type SurfaceHeaderContent = Pick<
   DialogHeaderConfig,
@@ -47,86 +42,16 @@ interface SurfaceHeaderContextValue {
  */
 export const SurfaceHeaderContext = createContext<SurfaceHeaderContextValue | null>(null);
 
-type HeaderPrimaryAction = NonNullable<SurfaceHeaderContent['primaryAction']>;
-type HeaderAction = NonNullable<SurfaceHeaderContent['actions']>[number];
-type HeaderSearch = NonNullable<SurfaceHeaderContent['search']>;
-type HeaderSegments = NonNullable<SurfaceHeaderContent['segments']>;
-type HeaderProgress = NonNullable<SurfaceHeaderContent['progress']>;
-
-function primaryActionEqual(
-  a: HeaderPrimaryAction | undefined,
-  b: HeaderPrimaryAction | undefined,
-): boolean {
-  if (a === b) return true;
-  if (!a || !b) return false;
-  // `onPress` is a fresh closure each render — its identity never changes what
-  // the button renders, so compare only the render-affecting scalars.
-  return a.label === b.label && !!a.disabled === !!b.disabled && !!a.loading === !!b.loading;
-}
-
-function actionsEqual(a: HeaderAction[] | undefined, b: HeaderAction[] | undefined): boolean {
-  if (a === b) return true;
-  if (!a || !b || a.length !== b.length) return false;
-  for (let i = 0; i < a.length; i += 1) {
-    const x = a[i];
-    const y = b[i];
-    if (!x || !y) return false;
-    // `icon` is a node (identity); `onPress` is ignored, like `primaryAction`'s.
-    if (
-      x.accessibilityLabel !== y.accessibilityLabel ||
-      !!x.disabled !== !!y.disabled ||
-      x.icon !== y.icon
-    ) {
-      return false;
-    }
-  }
-  return true;
-}
-
-function searchEqual(a: HeaderSearch | undefined, b: HeaderSearch | undefined): boolean {
-  if (a === b) return true;
-  if (!a || !b) return false;
-  return a.value === b.value && a.placeholder === b.placeholder;
-}
-
-function segmentsEqual(a: HeaderSegments | undefined, b: HeaderSegments | undefined): boolean {
-  if (a === b) return true;
-  if (!a || !b || a.value !== b.value || a.items.length !== b.items.length) return false;
-  for (let i = 0; i < a.items.length; i += 1) {
-    const x = a.items[i];
-    const y = b.items[i];
-    if (!x || !y || x.key !== y.key || x.label !== y.label) return false;
-  }
-  return true;
-}
-
-function progressEqual(a: HeaderProgress | undefined, b: HeaderProgress | undefined): boolean {
-  if (a === b) return true;
-  if (!a || !b) return false;
-  return a.step === b.step && a.total === b.total;
-}
-
 /**
- * Value-equality for a surface's header contribution.
- *
- * This MIRRORS Bloom's own `configsEqual` (`@oxyhq/bloom/dialog`), which guards
- * the header store one layer down — deliberately field for field. The two must
- * not diverge: this comparator is the gate that decides whether the host's
- * `setContent` fires, so a comparator STRICTER than Bloom's re-introduces the
- * update loop Bloom's own guard was written to prevent.
- *
- * Scalars (`title`/`subtitle`/`largeTitle`/`tone`) compare by value. The rich
- * object fields (`primaryAction`/`actions`/`search`/`segments`/`progress`)
- * compare by their render-affecting scalars, so a screen may build them inline:
- * a fresh object with unchanged contents is NOT a change. Only the node fields
- * (`titleContent`/`left`/`right`, and an action's `icon`) compare by identity —
- * there is nothing else to compare a `ReactNode` by — so those, and only those,
- * carry the memoize-me contract.
+ * Shallow value-equality for a surface's header contribution.
  *
- * Function-typed affordances compare by PRESENCE, never identity: `onBack`
- * legitimately gets a fresh closure each render and its identity never changes
- * what the header renders, so it must not count as a change (that is exactly
- * what would drive the update loop).
+ * Scalars (`title`/`subtitle`/`largeTitle`/`tone`) compare by value; the object
+ * and node fields (`titleContent`/`left`/`right`/`primaryAction`/`actions`/
+ * `search`/`segments`/`progress`) compare by identity — callers memoize them, per
+ * this hook's contract. Function-typed affordances compare by PRESENCE, never
+ * identity: `onBack` legitimately gets a fresh closure each render, and its
+ * identity never changes what the header renders, so it must not count as a
+ * change (that is exactly what would drive the update loop).
  */
 function surfaceHeaderContentEqual(
   a: SurfaceHeaderContent | null,
@@ -142,12 +67,12 @@ function surfaceHeaderContentEqual(
     a.left === b.left &&
     a.right === b.right &&
     !!a.onBack === !!b.onBack &&
+    a.primaryAction === b.primaryAction &&
+    a.actions === b.actions &&
+    a.search === b.search &&
+    a.segments === b.segments &&
     a.tone === b.tone &&
-    primaryActionEqual(a.primaryAction, b.primaryAction) &&
-    actionsEqual(a.actions, b.actions) &&
-    searchEqual(a.search, b.search) &&
-    segmentsEqual(a.segments, b.segments) &&
-    progressEqual(a.progress, b.progress)
+    a.progress === b.progress
   );
 }
 

package/src/ui/oauth/__tests__/oauthPopup.test.ts

@@ -9,7 +9,6 @@ import { OXY_OAUTH_CODE_MESSAGE_TYPE, OXY_OAUTH_ERROR_MESSAGE_TYPE } from '../oa
 import type { OAuthPopupHandle, OAuthPopupOutcome } from '../types';
 
 const IDP_ORIGIN = 'https://auth.oxy.so';
-const REDIRECT_URI = 'https://mention.earth';
 const STATE = 'state-abc';
 
 interface ControllablePopup extends OAuthPopupHandle {
@@ -162,7 +161,6 @@ describe('awaitOAuthPopupResult', () => {
       popup,
       expectedOrigin: IDP_ORIGIN,
       expectedState: STATE,
-      redirectUri: REDIRECT_URI,
     });
 
     dispatchMessage(codeMessage(popup));
@@ -177,7 +175,6 @@ describe('awaitOAuthPopupResult', () => {
       popup,
       expectedOrigin: IDP_ORIGIN,
       expectedState: STATE,
-      redirectUri: REDIRECT_URI,
     });
 
     dispatchMessage({
@@ -205,7 +202,6 @@ describe('awaitOAuthPopupResult', () => {
       popup,
       expectedOrigin: IDP_ORIGIN,
       expectedState: STATE,
-      redirectUri: REDIRECT_URI,
     });
 
     dispatchMessage(codeMessage(popup, 'a-different-state'));
@@ -223,7 +219,6 @@ describe('awaitOAuthPopupResult', () => {
       popup,
       expectedOrigin: IDP_ORIGIN,
       expectedState: STATE,
-      redirectUri: REDIRECT_URI,
       timeoutMs: 60_000,
     });
 
@@ -242,7 +237,6 @@ describe('awaitOAuthPopupResult', () => {
       popup,
       expectedOrigin: IDP_ORIGIN,
       expectedState: STATE,
-      redirectUri: REDIRECT_URI,
       timeoutMs: 60_000,
     });
 
@@ -260,7 +254,6 @@ describe('awaitOAuthPopupResult', () => {
       popup,
       expectedOrigin: IDP_ORIGIN,
       expectedState: STATE,
-      redirectUri: REDIRECT_URI,
     });
 
     dispatchMessage(codeMessage(popup));
@@ -284,7 +277,6 @@ describe('awaitOAuthPopupResult', () => {
       popup,
       expectedOrigin: IDP_ORIGIN,
       expectedState: STATE,
-      redirectUri: REDIRECT_URI,
     });
 
     popup.setClosed();
@@ -303,7 +295,6 @@ describe('awaitOAuthPopupResult', () => {
       popup,
       expectedOrigin: IDP_ORIGIN,
       expectedState: STATE,
-      redirectUri: REDIRECT_URI,
     });
 
     // The IdP posts its result and immediately closes itself.
@@ -322,7 +313,6 @@ describe('awaitOAuthPopupResult', () => {
       popup,
       expectedOrigin: IDP_ORIGIN,
       expectedState: STATE,
-      redirectUri: REDIRECT_URI,
       timeoutMs: 30_000,
     });
 
@@ -333,20 +323,4 @@ describe('awaitOAuthPopupResult', () => {
     await expect(promise).resolves.toEqual({ kind: 'timed-out' });
     expectFullCleanup();
   });
-
-  it('reads a same-origin redirect fallback from the popup URL when postMessage is unavailable', async () => {
-    const popup = fakePopup();
-    popup.location.href = `${REDIRECT_URI}?code=auth-code&state=${STATE}`;
-    const promise = awaitOAuthPopupResult({
-      popup,
-      expectedOrigin: IDP_ORIGIN,
-      expectedState: STATE,
-      redirectUri: REDIRECT_URI,
-    });
-
-    jest.advanceTimersByTime(1000);
-
-    await expect(promise).resolves.toEqual({ kind: 'code', code: 'auth-code', state: STATE });
-    expectFullCleanup();
-  });
 });

package/src/ui/oauth/browserAuthTransport.ts

@@ -102,60 +102,58 @@ export async function startWebOAuthSignIn(
     return startRedirectSignIn(context, options, 'popup-blocked');
   }
 
-  try {
-    const prepared = await prepareAuthorizeRequest({
-      clientId: context.clientId,
-      redirectUri: options.redirectUri,
-      authorizeBaseUrl: context.authorizeBaseUrl,
-      scope: options.scope,
-      responseMode: 'web_message',
-    });
+  const prepared = await prepareAuthorizeRequest({
+    clientId: context.clientId,
+    redirectUri: options.redirectUri,
+    authorizeBaseUrl: context.authorizeBaseUrl,
+    scope: options.scope,
+    responseMode: 'web_message',
+  });
 
-    if (!navigateOAuthPopup(popup, prepared.authorizeUrl)) {
-      return startRedirectSignIn(context, options, 'popup-navigation-failed');
-    }
+  if (!navigateOAuthPopup(popup, prepared.authorizeUrl)) {
+    closeOAuthPopup(popup);
+    return startRedirectSignIn(context, options, 'popup-navigation-failed');
+  }
 
-    const outcome = await awaitOAuthPopupResult({
-      popup,
-      expectedOrigin: prepared.authorizeOrigin,
-      expectedState: prepared.handshake.state,
-      redirectUri: options.redirectUri,
-      ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),
-    });
+  const outcome = await awaitOAuthPopupResult({
+    popup,
+    expectedOrigin: prepared.authorizeOrigin,
+    expectedState: prepared.handshake.state,
+    ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),
+  });
+  // The IdP closes itself after delivering; this covers every other outcome
+  // (timeout, mismatch, an error the IdP reported before closing).
+  closeOAuthPopup(popup);
 
-    switch (outcome.kind) {
-      case 'code': {
-        const completion = await completeOAuthCode({
-          oxyServices: context.oxyServices,
-          clientId: context.clientId,
-          code: outcome.code,
-          returnedState: outcome.state,
-          handshake: prepared.handshake,
-          redirectUri: options.redirectUri,
-          commitSession: context.commitSession,
-        });
-        return completion.ok
-          ? { status: 'signed-in' }
-          : { status: 'failed', reason: completion.reason };
-      }
-      case 'oauth-error':
-        return {
-          status: 'failed',
-          reason: 'idp-error',
-          description: outcome.errorDescription ?? outcome.error,
-        };
-      case 'state-mismatch':
-        return { status: 'failed', reason: 'state-mismatch' };
-      case 'closed':
-        return { status: 'cancelled' };
-      case 'timed-out':
-        return { status: 'timed-out' };
-      case 'unsupported':
-        return { status: 'unsupported', reason: 'no-browser' };
+  switch (outcome.kind) {
+    case 'code': {
+      const completion = await completeOAuthCode({
+        oxyServices: context.oxyServices,
+        clientId: context.clientId,
+        code: outcome.code,
+        returnedState: outcome.state,
+        handshake: prepared.handshake,
+        redirectUri: options.redirectUri,
+        commitSession: context.commitSession,
+      });
+      return completion.ok
+        ? { status: 'signed-in' }
+        : { status: 'failed', reason: completion.reason };
     }
-  } finally {
-    // Covers throws after open (prepare/exchange/commit) and every settled outcome.
-    closeOAuthPopup(popup);
+    case 'oauth-error':
+      return {
+        status: 'failed',
+        reason: 'idp-error',
+        description: outcome.errorDescription ?? outcome.error,
+      };
+    case 'state-mismatch':
+      return { status: 'failed', reason: 'state-mismatch' };
+    case 'closed':
+      return { status: 'cancelled' };
+    case 'timed-out':
+      return { status: 'timed-out' };
+    case 'unsupported':
+      return { status: 'unsupported', reason: 'no-browser' };
   }
 }
 
@@ -180,11 +178,7 @@ async function startRedirectSignIn(
     scope: options.scope,
   });
 
-  if (!persistOAuthHandshake(
-    prepared.handshake.state,
-    prepared.handshake.codeVerifier,
-    options.redirectUri,
-  )) {
+  if (!persistOAuthHandshake(prepared.handshake.state, prepared.handshake.codeVerifier)) {
     return { status: 'failed', reason: 'handshake-storage' };
   }
 

package/src/ui/oauth/legacyRedirectLanes.ts

@@ -0,0 +1,43 @@
+/**
+ * The legacy, redirect-mode-only lanes that navigate the RP's TOP-LEVEL window
+ * to the IdP without a user gesture.
+ *
+ * `webAuthMode: 'popup'` exists to guarantee exactly one thing: the relying
+ * party never leaves its route. Two mechanics in this SDK break that guarantee,
+ * because each replaces the whole document on its own initiative:
+ *
+ * 1. **Cold-boot silent restore** — a full-page `prompt=none` authorize bounce
+ *    to `auth.oxy.so` when the device-secret mint finds no local session
+ *    (`maybeStartSilentOAuthRestore`, called from `runProviderColdBoot`).
+ * 2. **Post-sign-in hub sync** — a full-page hop to `auth.oxy.so/sync` that
+ *    plants this device's credential on the IdP hub so OTHER origins can later
+ *    run lane 1 (`syncHubAfterSignIn`, called from the `commitSession` funnel).
+ *
+ * Both belong to the redirect transport and are kept only for the migration
+ * window (issue #691, "Cold boot and cross-domain behavior"). In popup mode a
+ * domain with no local credential simply resolves SIGNED OUT, and the user's
+ * next explicit "Continue with Oxy" opens the popup — from a real user gesture,
+ * never automatically.
+ *
+ * NOT covered here, and correctly enabled in BOTH modes: navigations the user
+ * asked for. When the browser blocks the popup, `startWebOAuthSignIn` still
+ * falls back to a full-page redirect rather than dead-ending the sign-in, and
+ * `tryCompleteOAuthReturn` still consumes a `?code=` that is already on the URL.
+ *
+ * PHASE 7b: once the pilot flips the default transport to `'popup'`, this
+ * predicate and BOTH lanes above are deleted outright. Grepping this symbol
+ * finds every site that has to go.
+ */
+
+import type { WebAuthMode } from './types';
+
+/**
+ * Whether a provider running `webAuthMode` may perform an SDK-initiated,
+ * non-gesture, full-page navigation to the IdP.
+ *
+ * `true` only for `'redirect'` — still the default and the compatibility path,
+ * whose behaviour must stay byte-for-byte unchanged.
+ */
+export function allowsAutomaticIdpRedirect(webAuthMode: WebAuthMode): boolean {
+  return webAuthMode === 'redirect';
+}

package/src/ui/oauth/oauthPopup.ts

@@ -19,7 +19,7 @@
  *   opaque. The authorization result arrives ONLY as a `postMessage`.
  */
 
-import { canonicalizeOAuthRedirectUri, logger } from '@oxyhq/core';
+import { logger } from '@oxyhq/core';
 import { readOAuthPopupMessage } from './oauthPopupMessages';
 import type { OAuthPopupHandle, OAuthPopupOutcome } from './types';
 
@@ -119,47 +119,6 @@ export function closeOAuthPopup(popup: OAuthPopupHandle | null): void {
   }
 }
 
-/**
- * When the IdP falls back to a top-level redirect inside the popup (no usable
- * `window.opener`), a same-origin `redirect_uri` is readable from the opener.
- * Cross-origin redirects remain opaque and are not handled here.
- */
-function readSameOriginRedirectOutcome(
-  popup: OAuthPopupHandle,
-  redirectUri: string,
-  expectedState: string,
-): OAuthPopupOutcome | null {
-  try {
-    const href = popup.location.href;
-    if (!href) return null;
-
-    const popupUrl = new URL(href);
-    const expected = new URL(canonicalizeOAuthRedirectUri(redirectUri));
-    if (popupUrl.origin !== expected.origin) return null;
-    if (popupUrl.pathname !== expected.pathname) return null;
-
-    const oauthError = popupUrl.searchParams.get('error');
-    if (oauthError) {
-      const errorDescription = popupUrl.searchParams.get('error_description') ?? undefined;
-      return {
-        kind: 'oauth-error',
-        error: oauthError,
-        ...(errorDescription ? { errorDescription } : {}),
-      };
-    }
-
-    const code = popupUrl.searchParams.get('code');
-    if (!code) return null;
-
-    const state = popupUrl.searchParams.get('state');
-    if (!state || state !== expectedState) return { kind: 'state-mismatch' };
-    return { kind: 'code', code, state };
-  } catch {
-    // Cross-origin navigation — the popup URL is opaque to the opener.
-    return null;
-  }
-}
-
 /** Inputs for {@link awaitOAuthPopupResult}. */
 export interface AwaitOAuthPopupOptions {
   /** The exact window reference returned by {@link openOAuthPopup}. */
@@ -168,12 +127,6 @@ export interface AwaitOAuthPopupOptions {
   expectedOrigin: string;
   /** The CSRF `state` sent on the authorize request. */
   expectedState: string;
-  /**
-   * EXACT registered redirect URI for this attempt. When the IdP cannot
-   * `postMessage` (no usable opener) it falls back to redirecting the popup;
-   * if that lands on the same origin, the result is read from the popup URL.
-   */
-  redirectUri: string;
   /** @default DEFAULT_OAUTH_POPUP_TIMEOUT_MS */
   timeoutMs?: number;
 }
@@ -192,13 +145,8 @@ export interface AwaitOAuthPopupOptions {
 export function awaitOAuthPopupResult(
   options: AwaitOAuthPopupOptions,
 ): Promise<OAuthPopupOutcome> {
-  const {
-    popup,
-    expectedOrigin,
-    expectedState,
-    redirectUri,
-    timeoutMs = DEFAULT_OAUTH_POPUP_TIMEOUT_MS,
-  } = options;
+  const { popup, expectedOrigin, expectedState, timeoutMs = DEFAULT_OAUTH_POPUP_TIMEOUT_MS } =
+    options;
 
   const host = messageEventHost();
   if (!host) return Promise.resolve({ kind: 'unsupported' });
@@ -258,12 +206,6 @@ export function awaitOAuthPopupResult(
     timeoutTimer = setTimeout(() => settle({ kind: 'timed-out' }), timeoutMs);
 
     closePoll = setInterval(() => {
-      const redirectOutcome = readSameOriginRedirectOutcome(popup, redirectUri, expectedState);
-      if (redirectOutcome) {
-        settle(redirectOutcome);
-        return;
-      }
-
       if (!popup.closed) return;
       // Stop sampling immediately: the window is gone and only the in-flight
       // message (if any) can still change the outcome.

package/src/ui/screens/AccountMembersScreen.tsx

@@ -7,7 +7,7 @@ import {
 } from 'react-native';
 import Ionicons from '@expo/vector-icons/Ionicons';
 import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 import { surfaces } from '@oxyhq/bloom/surfaces';
 import { useTheme } from '@oxyhq/bloom/theme';
 import { Text } from '@oxyhq/bloom/typography';

package/src/ui/screens/AccountSettingsScreen.tsx

@@ -5,14 +5,14 @@ import {
   ActivityIndicator,
 } from 'react-native';
 import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 import { surfaces } from '@oxyhq/bloom/surfaces';
 import { useTheme } from '@oxyhq/bloom/theme';
 import { Text } from '@oxyhq/bloom/typography';
 import { Button } from '@oxyhq/bloom/button';
 import { TextField, TextFieldInput } from '@oxyhq/bloom/text-field';
 import { SettingsListGroup, SettingsListItem } from '@oxyhq/bloom/settings-list';
-import { getNormalizedUserHandle, type UpdateAccountInput } from '@oxyhq/core';
+import type { UpdateAccountInput } from '@oxyhq/core';
 import type { BaseScreenProps } from '../types/navigation';
 import { SettingsIcon } from '../components/SettingsIcon';
 import { useOxy } from '../context/OxyContext';
@@ -67,9 +67,9 @@ const AccountSettingsScreen: React.FC<BaseScreenProps> = ({ onClose, goBack, nav
   // Seed the form from the account during render (no useEffect): the first time
   // the query resolves we capture its values into local edit state.
   if (node && !seeded) {
-    setDisplayName(
-      node.account?.name?.displayName ?? getNormalizedUserHandle(node.account) ?? '',
-    );
+    const first = node.account?.name?.first ?? '';
+    const last = node.account?.name?.last ?? '';
+    setDisplayName([first, last].filter(Boolean).join(' '));
     setBio(node.account?.bio ?? '');
     setSeeded(true);
   }

package/src/ui/screens/AccountVerificationScreen.tsx

@@ -4,7 +4,7 @@ import {
     StyleSheet,
 } from 'react-native';
 import type { BaseScreenProps } from '../types/navigation';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 import { surfaces } from '@oxyhq/bloom/surfaces';
 import { useTheme } from '@oxyhq/bloom/theme';
 import { H4, Text } from '@oxyhq/bloom/typography';

package/src/ui/screens/AppInfoScreen.tsx

@@ -9,7 +9,7 @@ import {
 } from 'react-native';
 import type { BaseScreenProps } from '../types/navigation';
 import { packageInfo } from '@oxyhq/core';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 import OxyServicesLogo from '../../assets/icons/OxyServices';
 import { SettingsIcon } from '../components/SettingsIcon';
 import { useTheme } from '@oxyhq/bloom/theme';

package/src/ui/screens/AvatarCropScreen.tsx

@@ -55,7 +55,7 @@ import { useOxy } from '../context/OxyContext';
 import { useI18n } from '../hooks/useI18n';
 import { useReduceMotion } from '../hooks/useReduceMotion';
 import { useSurfaceHeader, type SurfaceHeaderContent } from '../hooks/useSurfaceHeader';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 import type { BaseScreenProps } from '../types/navigation';
 
 /** Component name used in `logger` context for filtered diagnostics. */

package/src/ui/screens/ChangeAvatarScreen.tsx

@@ -39,8 +39,8 @@ import {
 } from '@oxyhq/bloom/admonition';
 import { surfaces as bloomSurfaces } from '@oxyhq/bloom/surfaces';
 import { useTheme } from '@oxyhq/bloom/theme';
-import { toast } from '@oxyhq/bloom/toast';
-import { getNormalizedUserHandle, logger } from '@oxyhq/core';
+import { toast } from '@oxyhq/bloom';
+import { getAccountDisplayName, logger } from '@oxyhq/core';
 import type { FileMetadata } from '@oxyhq/core';
 import { useOxy } from '../context/OxyContext';
 import { useI18n } from '../hooks/useI18n';
@@ -133,7 +133,7 @@ async function loadImagePicker(): Promise<ImagePickerModule | null> {
 
 const ChangeAvatarScreen: React.FC<BaseScreenProps> = ({ navigate, dismiss }) => {
     const bloomTheme = useTheme();
-    const { t } = useI18n();
+    const { t, locale } = useI18n();
     const { user, oxyServices } = useOxy();
 
     /** Set when a permission was refused — drives the inline denied notice. */
@@ -143,10 +143,7 @@ const ChangeAvatarScreen: React.FC<BaseScreenProps> = ({ navigate, dismiss }) =>
 
     useSurfaceHeader(useMemo(() => ({ title: t('changeAvatar.title') }), [t]));
 
-    const displayName = useMemo(
-        () => user?.name?.displayName ?? getNormalizedUserHandle(user) ?? '',
-        [user],
-    );
+    const displayName = useMemo(() => getAccountDisplayName(user, locale), [user, locale]);
     const avatarUri = useMemo(
         // `thumb` is 256x256 — exactly a 2x source for the 132dp hero.
         () => (user?.avatar ? oxyServices.getFileDownloadUrl(user.avatar, 'thumb') : undefined),

package/src/ui/screens/ConnectedAppsScreen.tsx

@@ -1,6 +1,6 @@
 import React, { useCallback, useState } from 'react';
 import { ActivityIndicator, FlatList, RefreshControl, StyleSheet, View } from 'react-native';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 import { surfaces } from '@oxyhq/bloom/surfaces';
 import { useTheme } from '@oxyhq/bloom/theme';
 import { SettingsListGroup, SettingsListItem } from '@oxyhq/bloom/settings-list';
@@ -108,7 +108,7 @@ const ConnectedAppsScreen: React.FC<BaseScreenProps> = ({ onClose, goBack }) =>
                 </Text>
             </View>
         ),
-        [t],
+        [t, bloomTheme.colors.textSecondary],
     );
 
     const renderItem = useCallback(