@oxyhq/services 26.0.0 → 26.0.1

package/src/ui/oauth/__tests__/oauthPopup.test.ts

@@ -9,7 +9,6 @@ import { OXY_OAUTH_CODE_MESSAGE_TYPE, OXY_OAUTH_ERROR_MESSAGE_TYPE } from '../oa
 import type { OAuthPopupHandle, OAuthPopupOutcome } from '../types';
 
 const IDP_ORIGIN = 'https://auth.oxy.so';
-const REDIRECT_URI = 'https://mention.earth';
 const STATE = 'state-abc';
 
 interface ControllablePopup extends OAuthPopupHandle {
@@ -162,7 +161,6 @@ describe('awaitOAuthPopupResult', () => {
       popup,
       expectedOrigin: IDP_ORIGIN,
       expectedState: STATE,
-      redirectUri: REDIRECT_URI,
     });
 
     dispatchMessage(codeMessage(popup));
@@ -177,7 +175,6 @@ describe('awaitOAuthPopupResult', () => {
       popup,
       expectedOrigin: IDP_ORIGIN,
       expectedState: STATE,
-      redirectUri: REDIRECT_URI,
     });
 
     dispatchMessage({
@@ -205,7 +202,6 @@ describe('awaitOAuthPopupResult', () => {
       popup,
       expectedOrigin: IDP_ORIGIN,
       expectedState: STATE,
-      redirectUri: REDIRECT_URI,
     });
 
     dispatchMessage(codeMessage(popup, 'a-different-state'));
@@ -223,7 +219,6 @@ describe('awaitOAuthPopupResult', () => {
       popup,
       expectedOrigin: IDP_ORIGIN,
       expectedState: STATE,
-      redirectUri: REDIRECT_URI,
       timeoutMs: 60_000,
     });
 
@@ -242,7 +237,6 @@ describe('awaitOAuthPopupResult', () => {
       popup,
       expectedOrigin: IDP_ORIGIN,
       expectedState: STATE,
-      redirectUri: REDIRECT_URI,
       timeoutMs: 60_000,
     });
 
@@ -260,7 +254,6 @@ describe('awaitOAuthPopupResult', () => {
       popup,
       expectedOrigin: IDP_ORIGIN,
       expectedState: STATE,
-      redirectUri: REDIRECT_URI,
     });
 
     dispatchMessage(codeMessage(popup));
@@ -284,7 +277,6 @@ describe('awaitOAuthPopupResult', () => {
       popup,
       expectedOrigin: IDP_ORIGIN,
       expectedState: STATE,
-      redirectUri: REDIRECT_URI,
     });
 
     popup.setClosed();
@@ -303,7 +295,6 @@ describe('awaitOAuthPopupResult', () => {
       popup,
       expectedOrigin: IDP_ORIGIN,
       expectedState: STATE,
-      redirectUri: REDIRECT_URI,
     });
 
     // The IdP posts its result and immediately closes itself.
@@ -322,7 +313,6 @@ describe('awaitOAuthPopupResult', () => {
       popup,
       expectedOrigin: IDP_ORIGIN,
       expectedState: STATE,
-      redirectUri: REDIRECT_URI,
       timeoutMs: 30_000,
     });
 
@@ -333,20 +323,4 @@ describe('awaitOAuthPopupResult', () => {
     await expect(promise).resolves.toEqual({ kind: 'timed-out' });
     expectFullCleanup();
   });
-
-  it('reads a same-origin redirect fallback from the popup URL when postMessage is unavailable', async () => {
-    const popup = fakePopup();
-    popup.location.href = `${REDIRECT_URI}?code=auth-code&state=${STATE}`;
-    const promise = awaitOAuthPopupResult({
-      popup,
-      expectedOrigin: IDP_ORIGIN,
-      expectedState: STATE,
-      redirectUri: REDIRECT_URI,
-    });
-
-    jest.advanceTimersByTime(1000);
-
-    await expect(promise).resolves.toEqual({ kind: 'code', code: 'auth-code', state: STATE });
-    expectFullCleanup();
-  });
 });

package/src/ui/oauth/browserAuthTransport.ts

@@ -102,60 +102,58 @@ export async function startWebOAuthSignIn(
     return startRedirectSignIn(context, options, 'popup-blocked');
   }
 
-  try {
-    const prepared = await prepareAuthorizeRequest({
-      clientId: context.clientId,
-      redirectUri: options.redirectUri,
-      authorizeBaseUrl: context.authorizeBaseUrl,
-      scope: options.scope,
-      responseMode: 'web_message',
-    });
+  const prepared = await prepareAuthorizeRequest({
+    clientId: context.clientId,
+    redirectUri: options.redirectUri,
+    authorizeBaseUrl: context.authorizeBaseUrl,
+    scope: options.scope,
+    responseMode: 'web_message',
+  });
 
-    if (!navigateOAuthPopup(popup, prepared.authorizeUrl)) {
-      return startRedirectSignIn(context, options, 'popup-navigation-failed');
-    }
+  if (!navigateOAuthPopup(popup, prepared.authorizeUrl)) {
+    closeOAuthPopup(popup);
+    return startRedirectSignIn(context, options, 'popup-navigation-failed');
+  }
 
-    const outcome = await awaitOAuthPopupResult({
-      popup,
-      expectedOrigin: prepared.authorizeOrigin,
-      expectedState: prepared.handshake.state,
-      redirectUri: options.redirectUri,
-      ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),
-    });
+  const outcome = await awaitOAuthPopupResult({
+    popup,
+    expectedOrigin: prepared.authorizeOrigin,
+    expectedState: prepared.handshake.state,
+    ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),
+  });
+  // The IdP closes itself after delivering; this covers every other outcome
+  // (timeout, mismatch, an error the IdP reported before closing).
+  closeOAuthPopup(popup);
 
-    switch (outcome.kind) {
-      case 'code': {
-        const completion = await completeOAuthCode({
-          oxyServices: context.oxyServices,
-          clientId: context.clientId,
-          code: outcome.code,
-          returnedState: outcome.state,
-          handshake: prepared.handshake,
-          redirectUri: options.redirectUri,
-          commitSession: context.commitSession,
-        });
-        return completion.ok
-          ? { status: 'signed-in' }
-          : { status: 'failed', reason: completion.reason };
-      }
-      case 'oauth-error':
-        return {
-          status: 'failed',
-          reason: 'idp-error',
-          description: outcome.errorDescription ?? outcome.error,
-        };
-      case 'state-mismatch':
-        return { status: 'failed', reason: 'state-mismatch' };
-      case 'closed':
-        return { status: 'cancelled' };
-      case 'timed-out':
-        return { status: 'timed-out' };
-      case 'unsupported':
-        return { status: 'unsupported', reason: 'no-browser' };
+  switch (outcome.kind) {
+    case 'code': {
+      const completion = await completeOAuthCode({
+        oxyServices: context.oxyServices,
+        clientId: context.clientId,
+        code: outcome.code,
+        returnedState: outcome.state,
+        handshake: prepared.handshake,
+        redirectUri: options.redirectUri,
+        commitSession: context.commitSession,
+      });
+      return completion.ok
+        ? { status: 'signed-in' }
+        : { status: 'failed', reason: completion.reason };
     }
-  } finally {
-    // Covers throws after open (prepare/exchange/commit) and every settled outcome.
-    closeOAuthPopup(popup);
+    case 'oauth-error':
+      return {
+        status: 'failed',
+        reason: 'idp-error',
+        description: outcome.errorDescription ?? outcome.error,
+      };
+    case 'state-mismatch':
+      return { status: 'failed', reason: 'state-mismatch' };
+    case 'closed':
+      return { status: 'cancelled' };
+    case 'timed-out':
+      return { status: 'timed-out' };
+    case 'unsupported':
+      return { status: 'unsupported', reason: 'no-browser' };
   }
 }
 
@@ -180,11 +178,7 @@ async function startRedirectSignIn(
     scope: options.scope,
   });
 
-  if (!persistOAuthHandshake(
-    prepared.handshake.state,
-    prepared.handshake.codeVerifier,
-    options.redirectUri,
-  )) {
+  if (!persistOAuthHandshake(prepared.handshake.state, prepared.handshake.codeVerifier)) {
     return { status: 'failed', reason: 'handshake-storage' };
   }
 

package/src/ui/oauth/legacyRedirectLanes.ts

@@ -0,0 +1,43 @@
+/**
+ * The legacy, redirect-mode-only lanes that navigate the RP's TOP-LEVEL window
+ * to the IdP without a user gesture.
+ *
+ * `webAuthMode: 'popup'` exists to guarantee exactly one thing: the relying
+ * party never leaves its route. Two mechanics in this SDK break that guarantee,
+ * because each replaces the whole document on its own initiative:
+ *
+ * 1. **Cold-boot silent restore** — a full-page `prompt=none` authorize bounce
+ *    to `auth.oxy.so` when the device-secret mint finds no local session
+ *    (`maybeStartSilentOAuthRestore`, called from `runProviderColdBoot`).
+ * 2. **Post-sign-in hub sync** — a full-page hop to `auth.oxy.so/sync` that
+ *    plants this device's credential on the IdP hub so OTHER origins can later
+ *    run lane 1 (`syncHubAfterSignIn`, called from the `commitSession` funnel).
+ *
+ * Both belong to the redirect transport and are kept only for the migration
+ * window (issue #691, "Cold boot and cross-domain behavior"). In popup mode a
+ * domain with no local credential simply resolves SIGNED OUT, and the user's
+ * next explicit "Continue with Oxy" opens the popup — from a real user gesture,
+ * never automatically.
+ *
+ * NOT covered here, and correctly enabled in BOTH modes: navigations the user
+ * asked for. When the browser blocks the popup, `startWebOAuthSignIn` still
+ * falls back to a full-page redirect rather than dead-ending the sign-in, and
+ * `tryCompleteOAuthReturn` still consumes a `?code=` that is already on the URL.
+ *
+ * PHASE 7b: once the pilot flips the default transport to `'popup'`, this
+ * predicate and BOTH lanes above are deleted outright. Grepping this symbol
+ * finds every site that has to go.
+ */
+
+import type { WebAuthMode } from './types';
+
+/**
+ * Whether a provider running `webAuthMode` may perform an SDK-initiated,
+ * non-gesture, full-page navigation to the IdP.
+ *
+ * `true` only for `'redirect'` — still the default and the compatibility path,
+ * whose behaviour must stay byte-for-byte unchanged.
+ */
+export function allowsAutomaticIdpRedirect(webAuthMode: WebAuthMode): boolean {
+  return webAuthMode === 'redirect';
+}

package/src/ui/oauth/oauthPopup.ts

@@ -19,7 +19,7 @@
  *   opaque. The authorization result arrives ONLY as a `postMessage`.
  */
 
-import { canonicalizeOAuthRedirectUri, logger } from '@oxyhq/core';
+import { logger } from '@oxyhq/core';
 import { readOAuthPopupMessage } from './oauthPopupMessages';
 import type { OAuthPopupHandle, OAuthPopupOutcome } from './types';
 
@@ -119,47 +119,6 @@ export function closeOAuthPopup(popup: OAuthPopupHandle | null): void {
   }
 }
 
-/**
- * When the IdP falls back to a top-level redirect inside the popup (no usable
- * `window.opener`), a same-origin `redirect_uri` is readable from the opener.
- * Cross-origin redirects remain opaque and are not handled here.
- */
-function readSameOriginRedirectOutcome(
-  popup: OAuthPopupHandle,
-  redirectUri: string,
-  expectedState: string,
-): OAuthPopupOutcome | null {
-  try {
-    const href = popup.location.href;
-    if (!href) return null;
-
-    const popupUrl = new URL(href);
-    const expected = new URL(canonicalizeOAuthRedirectUri(redirectUri));
-    if (popupUrl.origin !== expected.origin) return null;
-    if (popupUrl.pathname !== expected.pathname) return null;
-
-    const oauthError = popupUrl.searchParams.get('error');
-    if (oauthError) {
-      const errorDescription = popupUrl.searchParams.get('error_description') ?? undefined;
-      return {
-        kind: 'oauth-error',
-        error: oauthError,
-        ...(errorDescription ? { errorDescription } : {}),
-      };
-    }
-
-    const code = popupUrl.searchParams.get('code');
-    if (!code) return null;
-
-    const state = popupUrl.searchParams.get('state');
-    if (!state || state !== expectedState) return { kind: 'state-mismatch' };
-    return { kind: 'code', code, state };
-  } catch {
-    // Cross-origin navigation — the popup URL is opaque to the opener.
-    return null;
-  }
-}
-
 /** Inputs for {@link awaitOAuthPopupResult}. */
 export interface AwaitOAuthPopupOptions {
   /** The exact window reference returned by {@link openOAuthPopup}. */
@@ -168,12 +127,6 @@ export interface AwaitOAuthPopupOptions {
   expectedOrigin: string;
   /** The CSRF `state` sent on the authorize request. */
   expectedState: string;
-  /**
-   * EXACT registered redirect URI for this attempt. When the IdP cannot
-   * `postMessage` (no usable opener) it falls back to redirecting the popup;
-   * if that lands on the same origin, the result is read from the popup URL.
-   */
-  redirectUri: string;
   /** @default DEFAULT_OAUTH_POPUP_TIMEOUT_MS */
   timeoutMs?: number;
 }
@@ -192,13 +145,8 @@ export interface AwaitOAuthPopupOptions {
 export function awaitOAuthPopupResult(
   options: AwaitOAuthPopupOptions,
 ): Promise<OAuthPopupOutcome> {
-  const {
-    popup,
-    expectedOrigin,
-    expectedState,
-    redirectUri,
-    timeoutMs = DEFAULT_OAUTH_POPUP_TIMEOUT_MS,
-  } = options;
+  const { popup, expectedOrigin, expectedState, timeoutMs = DEFAULT_OAUTH_POPUP_TIMEOUT_MS } =
+    options;
 
   const host = messageEventHost();
   if (!host) return Promise.resolve({ kind: 'unsupported' });
@@ -258,12 +206,6 @@ export function awaitOAuthPopupResult(
     timeoutTimer = setTimeout(() => settle({ kind: 'timed-out' }), timeoutMs);
 
     closePoll = setInterval(() => {
-      const redirectOutcome = readSameOriginRedirectOutcome(popup, redirectUri, expectedState);
-      if (redirectOutcome) {
-        settle(redirectOutcome);
-        return;
-      }
-
       if (!popup.closed) return;
       // Stop sampling immediately: the window is gone and only the in-flight
       // message (if any) can still change the outcome.

package/src/ui/screens/AccountMembersScreen.tsx

@@ -7,7 +7,7 @@ import {
 } from 'react-native';
 import Ionicons from '@expo/vector-icons/Ionicons';
 import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 import { surfaces } from '@oxyhq/bloom/surfaces';
 import { useTheme } from '@oxyhq/bloom/theme';
 import { Text } from '@oxyhq/bloom/typography';

package/src/ui/screens/AccountSettingsScreen.tsx

@@ -5,21 +5,21 @@ import {
   ActivityIndicator,
 } from 'react-native';
 import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 import { surfaces } from '@oxyhq/bloom/surfaces';
 import { useTheme } from '@oxyhq/bloom/theme';
 import { Text } from '@oxyhq/bloom/typography';
 import { Button } from '@oxyhq/bloom/button';
 import { TextField, TextFieldInput } from '@oxyhq/bloom/text-field';
 import { SettingsListGroup, SettingsListItem } from '@oxyhq/bloom/settings-list';
-import { DISPLAY_NAME_INVALID_MESSAGE, getNormalizedUserHandle, isValidDisplayName, MAX_DISPLAY_NAME_LENGTH, type UpdateAccountInput } from '@oxyhq/core';
+import type { UpdateAccountInput } from '@oxyhq/core';
 import type { BaseScreenProps } from '../types/navigation';
 import { SettingsIcon } from '../components/SettingsIcon';
 import { useOxy } from '../context/OxyContext';
 import { useI18n } from '../hooks/useI18n';
 import { useSurfaceHeader } from '../hooks/useSurfaceHeader';
 
-const DISPLAY_NAME_MAX = MAX_DISPLAY_NAME_LENGTH;
+const DISPLAY_NAME_MAX = 50;
 const BIO_MAX = 160;
 
 const errorMessage = (error: unknown, fallback: string): string =>
@@ -62,15 +62,14 @@ const AccountSettingsScreen: React.FC<BaseScreenProps> = ({ onClose, goBack, nav
   // Editable fields, seeded lazily from the loaded account once.
   const [seeded, setSeeded] = useState(false);
   const [displayName, setDisplayName] = useState('');
-  const [displayNameError, setDisplayNameError] = useState('');
   const [bio, setBio] = useState('');
 
   // Seed the form from the account during render (no useEffect): the first time
   // the query resolves we capture its values into local edit state.
   if (node && !seeded) {
-    setDisplayName(
-      node.account?.name?.displayName ?? getNormalizedUserHandle(node.account) ?? '',
-    );
+    const first = node.account?.name?.first ?? '';
+    const last = node.account?.name?.last ?? '';
+    setDisplayName([first, last].filter(Boolean).join(' '));
     setBio(node.account?.bio ?? '');
     setSeeded(true);
   }
@@ -122,27 +121,8 @@ const AccountSettingsScreen: React.FC<BaseScreenProps> = ({ onClose, goBack, nav
     if (confirmed) archiveMutation.mutate();
   }, [archiveMutation, t]);
 
-  const handleDisplayNameChange = useCallback((value: string) => {
-    setDisplayName(value);
-    const trimmed = value.trim();
-    if (!trimmed) {
-      setDisplayNameError('');
-      return;
-    }
-    const nameParts = trimmed.split(/\s+/).filter(Boolean);
-    const first = nameParts[0] || '';
-    const last = nameParts.length > 1 ? nameParts.slice(1).join(' ') : '';
-    const invalidPart = [first, last].find((part) => part && !isValidDisplayName(part));
-    setDisplayNameError(
-      invalidPart
-        ? (t('accounts.settings.displayName.invalidChars') || DISPLAY_NAME_INVALID_MESSAGE)
-        : '',
-    );
-  }, [t]);
-
   const handleSave = useCallback(() => {
     const trimmed = displayName.trim();
-    if (!trimmed || displayNameError) return;
     const nameParts = trimmed.split(/\s+/).filter(Boolean);
     const first = nameParts[0] || '';
     const last = nameParts.length > 1 ? nameParts.slice(1).join(' ') : undefined;
@@ -150,7 +130,7 @@ const AccountSettingsScreen: React.FC<BaseScreenProps> = ({ onClose, goBack, nav
       name: { first, last },
       bio: bio.trim() ? bio.trim() : null,
     });
-  }, [displayName, displayNameError, bio, updateMutation]);
+  }, [displayName, bio, updateMutation]);
 
   const title = t('accounts.settings.title') || 'Account settings';
 
@@ -191,23 +171,15 @@ const AccountSettingsScreen: React.FC<BaseScreenProps> = ({ onClose, goBack, nav
               {/* Profile edit */}
               {canUpdate ? (
                 <View className="gap-space-16 p-space-16 rounded-radius-20 bg-fill">
-                  <View className="gap-space-4">
-                    <TextField isInvalid={Boolean(displayNameError)}>
-                      <TextFieldInput
-                        floatingLabel
-                        label={t('accounts.settings.displayName.label') || 'Display name'}
-                        value={displayName}
-                        onChangeText={handleDisplayNameChange}
-                        isInvalid={Boolean(displayNameError)}
-                        maxLength={DISPLAY_NAME_MAX}
-                      />
-                    </TextField>
-                    {displayNameError ? (
-                      <Text className="text-caption font-caption text-negative px-space-4">
-                        {displayNameError}
-                      </Text>
-                    ) : null}
-                  </View>
+                  <TextField>
+                    <TextFieldInput
+                      floatingLabel
+                      label={t('accounts.settings.displayName.label') || 'Display name'}
+                      value={displayName}
+                      onChangeText={setDisplayName}
+                      maxLength={DISPLAY_NAME_MAX}
+                    />
+                  </TextField>
                   <View className="gap-space-4">
                     <TextField>
                       <TextFieldInput
@@ -228,7 +200,7 @@ const AccountSettingsScreen: React.FC<BaseScreenProps> = ({ onClose, goBack, nav
                   <Button
                     variant="primary"
                     onPress={handleSave}
-                    disabled={updateMutation.isPending || !displayName.trim() || Boolean(displayNameError)}
+                    disabled={updateMutation.isPending || !displayName.trim()}
                     loading={updateMutation.isPending}
                     accessibilityLabel={t('accounts.settings.save') || 'Save changes'}
                     className="w-full"

package/src/ui/screens/AccountVerificationScreen.tsx

@@ -4,7 +4,7 @@ import {
     StyleSheet,
 } from 'react-native';
 import type { BaseScreenProps } from '../types/navigation';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 import { surfaces } from '@oxyhq/bloom/surfaces';
 import { useTheme } from '@oxyhq/bloom/theme';
 import { H4, Text } from '@oxyhq/bloom/typography';

package/src/ui/screens/AppInfoScreen.tsx

@@ -9,7 +9,7 @@ import {
 } from 'react-native';
 import type { BaseScreenProps } from '../types/navigation';
 import { packageInfo } from '@oxyhq/core';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 import OxyServicesLogo from '../../assets/icons/OxyServices';
 import { SettingsIcon } from '../components/SettingsIcon';
 import { useTheme } from '@oxyhq/bloom/theme';

package/src/ui/screens/AvatarCropScreen.tsx

@@ -55,7 +55,7 @@ import { useOxy } from '../context/OxyContext';
 import { useI18n } from '../hooks/useI18n';
 import { useReduceMotion } from '../hooks/useReduceMotion';
 import { useSurfaceHeader, type SurfaceHeaderContent } from '../hooks/useSurfaceHeader';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 import type { BaseScreenProps } from '../types/navigation';
 
 /** Component name used in `logger` context for filtered diagnostics. */

package/src/ui/screens/ChangeAvatarScreen.tsx

@@ -39,8 +39,8 @@ import {
 } from '@oxyhq/bloom/admonition';
 import { surfaces as bloomSurfaces } from '@oxyhq/bloom/surfaces';
 import { useTheme } from '@oxyhq/bloom/theme';
-import { toast } from '@oxyhq/bloom/toast';
-import { getNormalizedUserHandle, logger } from '@oxyhq/core';
+import { toast } from '@oxyhq/bloom';
+import { getAccountDisplayName, logger } from '@oxyhq/core';
 import type { FileMetadata } from '@oxyhq/core';
 import { useOxy } from '../context/OxyContext';
 import { useI18n } from '../hooks/useI18n';
@@ -133,7 +133,7 @@ async function loadImagePicker(): Promise<ImagePickerModule | null> {
 
 const ChangeAvatarScreen: React.FC<BaseScreenProps> = ({ navigate, dismiss }) => {
     const bloomTheme = useTheme();
-    const { t } = useI18n();
+    const { t, locale } = useI18n();
     const { user, oxyServices } = useOxy();
 
     /** Set when a permission was refused — drives the inline denied notice. */
@@ -143,10 +143,7 @@ const ChangeAvatarScreen: React.FC<BaseScreenProps> = ({ navigate, dismiss }) =>
 
     useSurfaceHeader(useMemo(() => ({ title: t('changeAvatar.title') }), [t]));
 
-    const displayName = useMemo(
-        () => user?.name?.displayName ?? getNormalizedUserHandle(user) ?? '',
-        [user],
-    );
+    const displayName = useMemo(() => getAccountDisplayName(user, locale), [user, locale]);
     const avatarUri = useMemo(
         // `thumb` is 256x256 — exactly a 2x source for the 132dp hero.
         () => (user?.avatar ? oxyServices.getFileDownloadUrl(user.avatar, 'thumb') : undefined),

package/src/ui/screens/ConnectedAppsScreen.tsx

@@ -1,6 +1,6 @@
 import React, { useCallback, useState } from 'react';
 import { ActivityIndicator, FlatList, RefreshControl, StyleSheet, View } from 'react-native';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 import { surfaces } from '@oxyhq/bloom/surfaces';
 import { useTheme } from '@oxyhq/bloom/theme';
 import { SettingsListGroup, SettingsListItem } from '@oxyhq/bloom/settings-list';
@@ -108,7 +108,7 @@ const ConnectedAppsScreen: React.FC<BaseScreenProps> = ({ onClose, goBack }) =>
                 </Text>
             </View>
         ),
-        [t],
+        [t, bloomTheme.colors.textSecondary],
     );
 
     const renderItem = useCallback(