@oxyhq/services 6.10.7 → 7.0.0

package/src/ui/components/accountMenuRows.ts

@@ -0,0 +1,60 @@
+import type { User, ClientSession } from '@oxyhq/core';
+import { getAccountDisplayName, getAccountFallbackHandle } from '@oxyhq/core';
+
+export interface AccountRow {
+    sessionId: string;
+    isActive: boolean;
+    displayName: string;
+    secondary: string | null;
+    avatarUri?: string;
+    user: User | null;
+}
+
+export interface BuildAccountRowsInput {
+    sessions: ClientSession[] | null | undefined;
+    activeSessionId: string | null | undefined;
+    user: User | null | undefined;
+    locale: string;
+    getAvatarUrl: (avatarId: string) => string;
+}
+
+/**
+ * Pure builder for `AccountMenu` rows. Extracted so the multi-account display
+ * logic can be unit-tested without rendering React Native.
+ *
+ * Each `sessions[i]` becomes one row. Only the row matching `activeSessionId`
+ * carries the loaded `user` payload — the others are placeholders shown by
+ * fallback handle. This mirrors how `OxyContext` only hydrates one user at a
+ * time.
+ */
+export function buildAccountRows({
+    sessions,
+    activeSessionId,
+    user,
+    locale,
+    getAvatarUrl,
+}: BuildAccountRowsInput): AccountRow[] {
+    return (sessions ?? []).map((session: ClientSession) => {
+        const isActive = session.sessionId === activeSessionId;
+        const candidate: Partial<User> | null = isActive ? user ?? null : null;
+        const displayName = getAccountDisplayName(
+            candidate ?? { username: undefined },
+            locale,
+        );
+        const handle = getAccountFallbackHandle(candidate ?? { username: undefined });
+        const secondary = (candidate?.email)
+            ?? (handle && candidate?.username ? `@${handle}` : handle)
+            ?? null;
+        const avatarUri = candidate?.avatar
+            ? getAvatarUrl(candidate.avatar)
+            : undefined;
+        return {
+            sessionId: session.sessionId,
+            isActive,
+            displayName,
+            secondary,
+            avatarUri,
+            user: isActive ? user ?? null : null,
+        };
+    });
+}

package/src/ui/components/payment/PaymentDetailsStep.tsx

@@ -4,7 +4,7 @@ import { View, Text, Animated, TouchableOpacity, Clipboard, Linking } from 'reac
 import { Ionicons } from '@expo/vector-icons';
 import { Button } from '@oxyhq/bloom/button';
 import TextField from '../TextField';
-import { FAIRWalletIcon } from '../icon';
+import FAIRWalletIcon from '../icon/FAIRWalletIcon';
 import { createPaymentStyles } from './paymentStyles';
 import { toast } from '@oxyhq/bloom';
 import type { CardDetails, PaymentColors, PaymentStepAnimations } from './types';

package/src/ui/components/payment/PaymentMethodStep.tsx

@@ -4,7 +4,7 @@ import { View, Text, Animated } from 'react-native';
 import { Ionicons } from '@expo/vector-icons';
 import { SettingsListGroup, SettingsListItem } from '@oxyhq/bloom/settings-list';
 import { Button } from '@oxyhq/bloom/button';
-import { FAIRWalletIcon } from '../icon';
+import FAIRWalletIcon from '../icon/FAIRWalletIcon';
 import { createPaymentStyles } from './paymentStyles';
 import type { PaymentMethod, PaymentColors, PaymentStepAnimations } from './types';
 import { useI18n } from '../../hooks/useI18n';

package/src/ui/components/theming.tsx

@@ -1,5 +1,5 @@
 import { useTheme } from '@oxyhq/bloom/theme';
-import { getTheme } from '../styles';
+import { getTheme } from '../styles/theme';
 import type { InternalTheme } from './types';
 
 /**

package/src/ui/context/OxyContext.tsx

@@ -25,6 +25,7 @@ import { useAuthOperations } from './hooks/useAuthOperations';
 import { useDeviceManagement } from '../hooks/useDeviceManagement';
 import { getStorageKeys, createPlatformStorage, type StorageInterface } from '../utils/storageHelpers';
 import { isInvalidSessionError, isTimeoutOrNetworkError } from '../utils/errorHandlers';
+import { readActiveAuthuser, writeActiveAuthuser } from '../utils/activeAuthuser';
 import type { RouteName } from '../navigation/routes';
 import { showBottomSheet as globalShowBottomSheet } from '../navigation/bottomSheetManager';
 import { useQueryClient } from '@tanstack/react-query';
@@ -97,6 +98,10 @@ export interface OxyContextState {
 
 const OxyContext = createContext<OxyContextState | null>(null);
 
+// Active-authuser persistence helpers (web localStorage; native no-op) live in
+// `../utils/activeAuthuser` so the session-management and auth-operations hooks
+// can share them without re-importing this 1k-line context file.
+
 export interface OxyContextProviderProps {
   children: ReactNode;
   oxyServices?: OxyServices;
@@ -235,16 +240,58 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
 
   const storageKeys = useMemo(() => getStorageKeys(storageKeyPrefix), [storageKeyPrefix]);
 
-  // Simple storage initialization - no complex hook needed
+  // Storage initialization.
+  //
+  // `storage` (state) drives render-time gating (`isStorageReady`) and the
+  // hooks below. But it is `null` for a brief window after mount while
+  // `createPlatformStorage()` resolves (a microtask on web; a dynamic
+  // `import()` on native). Any persistence path that fires during that window
+  // — e.g. an interactive FedCM sign-in the instant the screen mounts — would
+  // read `storage === null` and SILENTLY skip writing the session, leaving the
+  // user signed-in in-memory but with nothing to restore on reload.
+  //
+  // To make persistence robust regardless of timing we ALSO expose the storage
+  // as an awaitable promise (`getReadyStorage`). Persistence code awaits the
+  // ready instance instead of branching on the possibly-null state, so a write
+  // is never silently dropped just because it raced storage init.
   const storageRef = useRef<StorageInterface | null>(null);
   const [storage, setStorage] = useState<StorageInterface | null>(null);
 
+  // A single, stable deferred that resolves with the initialized storage. Built
+  // lazily via a ref initializer so the resolver is captured exactly once and
+  // the promise identity is stable across renders.
+  const buildStorageDeferred = () => {
+    let resolve: (storage: StorageInterface) => void = () => undefined;
+    const promise = new Promise<StorageInterface>((res) => {
+      resolve = res;
+    });
+    return { promise, resolve };
+  };
+  const storageReadyRef = useRef<ReturnType<typeof buildStorageDeferred> | null>(null);
+  if (storageReadyRef.current === null) {
+    storageReadyRef.current = buildStorageDeferred();
+  }
+  const storageReady = storageReadyRef.current;
+
+  // Resolve the storage instance that is guaranteed to be ready. Returns the
+  // already-initialized instance synchronously when available, otherwise awaits
+  // the init promise. Never resolves to `null`.
+  const getReadyStorage = useCallback((): Promise<StorageInterface> => {
+    if (storageRef.current) {
+      return Promise.resolve(storageRef.current);
+    }
+    return storageReady.promise;
+  }, [storageReady]);
+
   useEffect(() => {
     let mounted = true;
     createPlatformStorage()
       .then((storageInstance) => {
+        // Resolve the ready-promise even if the component unmounted: in-flight
+        // persistence awaiting it must still complete against a real store.
+        storageRef.current = storageInstance;
+        storageReady.resolve(storageInstance);
         if (mounted) {
-          storageRef.current = storageInstance;
           setStorage(storageInstance);
         }
       })
@@ -262,7 +309,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     return () => {
       mounted = false;
     };
-  }, [logger, onError]);
+  }, [logger, onError, storageReady]);
 
 
   // Offline queuing is now handled by TanStack Query mutations
@@ -375,6 +422,130 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   const clearSessionStateRef = useRef(clearSessionState);
   clearSessionStateRef.current = clearSessionState;
 
+  // Durable, navigation-safe session persistence.
+  //
+  // Writes the active-session id and appends the session id to the durable
+  // `session_ids` list, awaiting the READY storage instance (never the possibly
+  // -null `storage` state) so a write is never dropped because it raced storage
+  // init. Callers MUST invoke this BEFORE any work that can trigger a route
+  // navigation (`onAuthStateChange`) — navigation can interrupt a still-pending
+  // async write, which is exactly what once left `session_ids` empty after a
+  // successful sign-in. Shared by the FedCM/popup path and the cold-boot
+  // refresh-cookie restore so both land the same durable record.
+  const persistSessionDurably = useCallback(async (sessionId: string): Promise<void> => {
+    const readyStorage = await getReadyStorage();
+    await readyStorage.setItem(storageKeys.activeSessionId, sessionId);
+    const existingIds = await readyStorage.getItem(storageKeys.sessionIds);
+    let sessionIds: string[] = [];
+    try { sessionIds = existingIds ? JSON.parse(existingIds) : []; } catch { /* corrupted storage */ }
+    if (!sessionIds.includes(sessionId)) {
+      sessionIds.push(sessionId);
+      await readyStorage.setItem(storageKeys.sessionIds, JSON.stringify(sessionIds));
+    }
+  }, [getReadyStorage, storageKeys.activeSessionId, storageKeys.sessionIds]);
+
+  // Refs so the cold-boot restore can plant session state without widening its
+  // dependency array (mirrors the existing ref pattern above).
+  const setActiveSessionIdRef = useRef(setActiveSessionId);
+  setActiveSessionIdRef.current = setActiveSessionId;
+  const loginSuccessRef = useRef(loginSuccess);
+  loginSuccessRef.current = loginSuccess;
+  const onAuthStateChangeRef = useRef(onAuthStateChange);
+  onAuthStateChangeRef.current = onAuthStateChange;
+
+  // Cold-boot session restore via the secure refresh cookies (web only).
+  //
+  // Calls `oxyServices.refreshAllSessions()` → `POST /auth/refresh-all` with
+  // `credentials: 'include'`. The server rotates every device-local
+  // `oxy_rt_${authuser}` cookie in parallel and returns one entry per valid
+  // account (Google-style multi-account). On an older server that lacks the
+  // multi-account endpoint, the SDK transparently falls back to the legacy
+  // `/auth/refresh` single-account path and wraps the result in the same
+  // shape, so this caller doesn't branch.
+  //
+  // Active-account selection: the persisted `oxy_active_authuser` slot index
+  // wins when it matches a returned account; otherwise the lowest `authuser`
+  // is picked. JS never sees the refresh cookies (httpOnly).
+  //
+  // Returns `true` when at least one session was restored (caller short-
+  // circuits the bearer path); `false` on no signed-in accounts / any failure
+  // (caller proceeds unauthenticated through the existing flow — nothing is
+  // cleared).
+  const restoreViaRefreshCookie = useCallback(async (): Promise<boolean> => {
+    if (!isWebBrowser()) {
+      return false;
+    }
+
+    let snapshot;
+    try {
+      snapshot = await oxyServices.refreshAllSessions();
+    } catch (fetchError) {
+      // Offline / network error — fall through to the cached/stored-session flow.
+      if (__DEV__) {
+        loggerUtil.debug('Refresh-all cookie restore network error (expected when offline)', { component: 'OxyContext', method: 'restoreViaRefreshCookie' }, fetchError as unknown);
+      }
+      return false;
+    }
+
+    if (snapshot.accounts.length === 0) {
+      return false;
+    }
+
+    // Pick the active account: persisted authuser if it still matches a returned
+    // account, otherwise the lowest authuser (deterministic). The server has
+    // already sorted ascending so [0] is the lowest.
+    const persistedAuthuser = readActiveAuthuser();
+    const matched = persistedAuthuser !== null
+      ? snapshot.accounts.find((a) => a.authuser === persistedAuthuser)
+      : undefined;
+    const activeAccount = matched ?? snapshot.accounts[0];
+
+    // Plant the active access token. Sibling accounts' access tokens stay in
+    // the snapshot (the chooser can drive a per-account refresh via
+    // `refreshTokenViaCookie({authuser})` on switch).
+    oxyServices.httpService.setTokens(activeAccount.accessToken);
+
+    // Fetch the full user with the freshly planted token. The refresh-all
+    // payload includes a minimal user shape (id, username, name, avatar,
+    // email, color) — sufficient for the chooser but the auth store wants the
+    // canonical User document for downstream rendering.
+    let fullUser: User;
+    try {
+      fullUser = await oxyServices.getCurrentUser();
+    } catch (userError) {
+      // Token planted but profile fetch failed (e.g. transient network). Do
+      // not claim a restored session; fall through so the stored-session flow
+      // can retry. Leave the planted token in place — it is valid and harmless.
+      if (__DEV__) {
+        loggerUtil.debug('Refresh-all cookie restore: getCurrentUser failed', { component: 'OxyContext', method: 'restoreViaRefreshCookie' }, userError as unknown);
+      }
+      return false;
+    }
+
+    // Build a ClientSession per returned account so the multi-session store
+    // reflects every device-local slot, not just the active one. The active
+    // account is flagged `isCurrent: true`.
+    const now = new Date();
+    const clientSessions: ClientSession[] = snapshot.accounts.map((account) => ({
+      sessionId: account.sessionId,
+      deviceId: '',
+      expiresAt: account.expiresAt || new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000).toISOString(),
+      lastActive: now.toISOString(),
+      userId: account.user?.id,
+      isCurrent: account.sessionId === activeAccount.sessionId,
+      authuser: account.authuser,
+    }));
+
+    updateSessionsRef.current(clientSessions, { merge: true });
+    setActiveSessionIdRef.current(activeAccount.sessionId);
+    writeActiveAuthuser(activeAccount.authuser);
+    await persistSessionDurably(activeAccount.sessionId);
+
+    loginSuccessRef.current(fullUser);
+    onAuthStateChangeRef.current?.(fullUser);
+    return true;
+  }, [oxyServices, persistSessionDurably]);
+
   const restoreSessionsFromStorage = useCallback(async (): Promise<void> => {
     if (!storage) {
       return;
@@ -383,6 +554,15 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     setTokenReady(false);
 
     try {
+      // Web cold-boot fast path: restore the active session from the secure
+      // httpOnly refresh cookie before the bearer-protected stored-session
+      // validation (which 401s on a hard reload). On success we are signed in
+      // from the cookie alone — no FedCM needed. On failure we fall through to
+      // the existing stored-session flow below; nothing is cleared.
+      if (await restoreViaRefreshCookie()) {
+        return;
+      }
+
       const storedSessionIdsJson = await storage.getItem(storageKeys.sessionIds);
       const storedSessionIds: string[] = storedSessionIdsJson ? JSON.parse(storedSessionIdsJson) : [];
       const storedActiveSessionId = await storage.getItem(storageKeys.activeSessionId);
@@ -473,6 +653,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     storage,
     storageKeys.activeSessionId,
     storageKeys.sessionIds,
+    restoreViaRefreshCookie,
   ]);
 
   useEffect(() => {
@@ -517,8 +698,25 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     updateSessions([clientSession], { merge: true });
     setActiveSessionId(session.sessionId);
 
-    // Fetch the full user profile now that we have a valid access token.
-    // The session only carries MinimalUserData; the store and callbacks expect a full User.
+    // Persist to storage BEFORE fetching the profile and BEFORE notifying the
+    // auth-state-change callback. The token is planted and the in-memory store
+    // is updated above; durably committing the session id here — ahead of
+    // `getCurrentUser()` / `loginSuccess` / `onAuthStateChange` — is critical
+    // because `onAuthStateChange` triggers a route navigation that can
+    // interrupt/supersede a still-pending async write. Persisting first
+    // guarantees the durable record lands; that is exactly what was missing
+    // when `oxy_session_session_ids` came back empty after a successful FedCM
+    // sign-in (the user appeared logged in until reload, then had no session to
+    // restore). `persistSessionDurably` awaits the READY storage instance rather
+    // than reading the possibly-null `storage` state, so a sign-in fired the
+    // instant the screen mounts (before storage-init populates state) is not
+    // silently dropped.
+    await persistSessionDurably(session.sessionId);
+
+    // Fetch the full user profile now that we have a valid access token and the
+    // session is durably persisted. The session only carries MinimalUserData;
+    // the store and callbacks expect a full User. The navigation kicked off by
+    // `onAuthStateChange` now happens only after the durable write is committed.
     let fullUser: User;
     try {
       fullUser = await oxyServices.getCurrentUser();
@@ -529,19 +727,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     }
     loginSuccess(fullUser);
     onAuthStateChange?.(fullUser);
-
-    // Persist to storage
-    if (storage) {
-      await storage.setItem(storageKeys.activeSessionId, session.sessionId);
-      const existingIds = await storage.getItem(storageKeys.sessionIds);
-      let sessionIds: string[] = [];
-      try { sessionIds = existingIds ? JSON.parse(existingIds) : []; } catch { /* corrupted storage */ }
-      if (!sessionIds.includes(session.sessionId)) {
-        sessionIds.push(session.sessionId);
-        await storage.setItem(storageKeys.sessionIds, JSON.stringify(sessionIds));
-      }
-    }
-  }, [oxyServices, updateSessions, setActiveSessionId, loginSuccess, onAuthStateChange, storage, storageKeys]);
+  }, [oxyServices, updateSessions, setActiveSessionId, loginSuccess, onAuthStateChange, persistSessionDurably]);
 
   // Enable web SSO only after local storage check completes and no user found
   const shouldTryWebSSO = isWebBrowser() && tokenReady && !user && initialized;

package/src/ui/context/hooks/useAuthOperations.ts

@@ -8,6 +8,8 @@ import { handleAuthError, isInvalidSessionError } from '../../utils/errorHandler
 import type { StorageInterface } from '../../utils/storageHelpers';
 import type { OxyServices } from '@oxyhq/core';
 import { SignatureService } from '@oxyhq/core';
+import { isWebBrowser } from '../../hooks/useWebSSO';
+import { clearActiveAuthuser } from '../../utils/activeAuthuser';
 
 /** Type guard for error objects with optional code and status properties */
 function isErrorWithCodeOrStatus(error: unknown): error is { code?: string; status?: number; message?: string } {
@@ -300,7 +302,19 @@ export const useAuthOperations = ({
 
       try {
         const sessionToLogout = targetSessionId || activeSessionId;
-        await oxyServices.logoutSession(activeSessionId, sessionToLogout);
+        // Web multi-account: when the target session carries an `authuser`
+        // slot index it is backed by an httpOnly `oxy_rt_${n}` cookie. Use
+        // the cookie-cleared logout endpoint so the server can `Set-Cookie`
+        // an immediate expiry alongside revoking the family. Native and
+        // legacy sessions (no `authuser` plumbed yet) fall through to the
+        // bearer-protected endpoint.
+        const targetSession = sessionsRef.current.find((s) => s.sessionId === sessionToLogout);
+        const targetAuthuser = targetSession?.authuser;
+        if (isWebBrowser() && typeof targetAuthuser === 'number') {
+          await oxyServices.logoutSessionByAuthuser(targetAuthuser);
+        } else {
+          await oxyServices.logoutSession(activeSessionId, sessionToLogout);
+        }
 
         const filteredSessions = sessionsRef.current.filter((session) => session.sessionId !== sessionToLogout);
         updateSessions(filteredSessions, { merge: false });
@@ -355,7 +369,27 @@ export const useAuthOperations = ({
     }
 
     try {
-      await oxyServices.logoutAllSessions(activeSessionId);
+      // Semantics intentionally diverge by platform to match user expectation:
+      //   - Web: "Sign out of all accounts" = sign out every device-local
+      //     account on THIS device. The cookie endpoint is the only path
+      //     that can `Set-Cookie` an immediate expiry on every
+      //     `oxy_rt_${n}` slot (plus legacy `oxy_rt`) AND revoke every
+      //     presented family server-side. The bearer-protected
+      //     `logoutAllSessions(activeSessionId)` would only revoke the
+      //     active user's sessions across devices and leave sibling
+      //     accounts' cookies sitting on this device — wrong UX for the
+      //     chooser's "Sign out of all accounts".
+      //   - Native: there are no per-account cookies; "Sign out of all"
+      //     keeps its long-standing "revoke every session of THIS user"
+      //     meaning via the bearer endpoint.
+      // After clearing on web, also drop the persisted active-authuser so
+      // the next cold boot starts from a clean slate.
+      if (isWebBrowser()) {
+        await oxyServices.logoutAllSessionsViaCookie();
+        clearActiveAuthuser();
+      } else {
+        await oxyServices.logoutAllSessions(activeSessionId);
+      }
       await clearSessionState();
     } catch (error) {
       handleAuthError(error, {

package/src/ui/hooks/mutations/mutationKeys.ts

@@ -14,6 +14,12 @@ export const mutationKeys = {
     uploadAvatar: ['mutation', 'account', 'uploadAvatar'] as const,
     updateSettings: ['mutation', 'account', 'updateSettings'] as const,
     updatePrivacySettings: ['mutation', 'account', 'updatePrivacySettings'] as const,
+    updateNotificationPreferences: [
+      'mutation',
+      'account',
+      'updateNotificationPreferences',
+    ] as const,
+    updateUserPreferences: ['mutation', 'account', 'updateUserPreferences'] as const,
     uploadFile: ['mutation', 'account', 'uploadFile'] as const,
   },
 
@@ -25,4 +31,9 @@ export const mutationKeys = {
     updateDeviceName: ['mutation', 'session', 'updateDeviceName'] as const,
     removeDevice: ['mutation', 'session', 'removeDevice'] as const,
   },
+
+  // Connected apps (FedCM grants)
+  connectedApps: {
+    revoke: ['mutation', 'connectedApps', 'revoke'] as const,
+  },
 } as const;

package/src/ui/hooks/mutations/useAccountMutations.ts

@@ -1,7 +1,19 @@
 import { useMutation, useQueryClient } from '@tanstack/react-query';
 import { authenticatedApiCall } from '@oxyhq/core';
-import type { AssetUploadInput, PrivacySettings, User } from '@oxyhq/core';
-import { queryKeys, invalidateAccountQueries, invalidateUserQueries, invalidateSessionQueries } from '../queries/queryKeys';
+import type {
+  AssetUploadInput,
+  NotificationPreferences,
+  PrivacySettings,
+  User,
+  UserPreferences,
+} from '@oxyhq/core';
+import {
+  queryKeys,
+  invalidateAccountQueries,
+  invalidateConnectedAppsQueries,
+  invalidateUserQueries,
+  invalidateSessionQueries,
+} from '../queries/queryKeys';
 import { mutationKeys } from './mutationKeys';
 import { useOxy } from '../../context/OxyContext';
 import { toast } from '@oxyhq/bloom';
@@ -505,6 +517,146 @@ interface UploadResult {
   id?: string;
 }
 
+/**
+ * Update the authenticated user's notification preferences with optimistic
+ * updates. Persisted on the User document via `PUT /users/me` — same cache-
+ * invalidation behaviour as `useUpdateProfile`.
+ */
+export const useUpdateNotificationPreferences = () => {
+  const { oxyServices, activeSessionId } = useOxy();
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationKey: [...mutationKeys.account.updateNotificationPreferences],
+    mutationFn: async (preferences: Partial<NotificationPreferences>) => {
+      return authenticatedApiCall<User>(
+        oxyServices,
+        activeSessionId,
+        () => oxyServices.updateNotificationPreferences(preferences)
+      );
+    },
+    onMutate: async (preferences) => {
+      await queryClient.cancelQueries({ queryKey: queryKeys.accounts.current() });
+      const previousUser = queryClient.getQueryData<User>(queryKeys.accounts.current());
+
+      if (previousUser) {
+        queryClient.setQueryData<User>(queryKeys.accounts.current(), {
+          ...previousUser,
+          notificationPreferences: {
+            ...previousUser.notificationPreferences,
+            ...preferences,
+          },
+        });
+      }
+
+      return { previousUser };
+    },
+    onError: (error, _preferences, context) => {
+      if (context?.previousUser) {
+        const current = queryClient.getQueryData<User>(queryKeys.accounts.current());
+        if (current) {
+          queryClient.setQueryData<User>(queryKeys.accounts.current(), {
+            ...current,
+            notificationPreferences: context.previousUser.notificationPreferences,
+          });
+        }
+      }
+      toast.error(
+        error instanceof Error
+          ? error.message
+          : 'Failed to update notification preferences'
+      );
+    },
+    onSuccess: (data) => {
+      queryClient.setQueryData(queryKeys.accounts.current(), data);
+      useAuthStore.getState().setUser(data);
+      invalidateAccountQueries(queryClient);
+    },
+  });
+};
+
+/**
+ * Update the authenticated user's general preferences (language, theme,
+ * reduce-motion, timezone). Persisted on the User document via
+ * `PUT /users/me`.
+ */
+export const useUpdateUserPreferences = () => {
+  const { oxyServices, activeSessionId } = useOxy();
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationKey: [...mutationKeys.account.updateUserPreferences],
+    mutationFn: async (preferences: Partial<UserPreferences>) => {
+      return authenticatedApiCall<User>(
+        oxyServices,
+        activeSessionId,
+        () => oxyServices.updateUserPreferences(preferences)
+      );
+    },
+    onMutate: async (preferences) => {
+      await queryClient.cancelQueries({ queryKey: queryKeys.accounts.current() });
+      const previousUser = queryClient.getQueryData<User>(queryKeys.accounts.current());
+
+      if (previousUser) {
+        queryClient.setQueryData<User>(queryKeys.accounts.current(), {
+          ...previousUser,
+          userPreferences: {
+            ...previousUser.userPreferences,
+            ...preferences,
+          },
+        });
+      }
+
+      return { previousUser };
+    },
+    onError: (error, _preferences, context) => {
+      if (context?.previousUser) {
+        const current = queryClient.getQueryData<User>(queryKeys.accounts.current());
+        if (current) {
+          queryClient.setQueryData<User>(queryKeys.accounts.current(), {
+            ...current,
+            userPreferences: context.previousUser.userPreferences,
+          });
+        }
+      }
+      toast.error(error instanceof Error ? error.message : 'Failed to update preferences');
+    },
+    onSuccess: (data) => {
+      queryClient.setQueryData(queryKeys.accounts.current(), data);
+      useAuthStore.getState().setUser(data);
+      invalidateAccountQueries(queryClient);
+    },
+  });
+};
+
+/**
+ * Revoke the authenticated user's authorization for a specific RP origin.
+ * Removes the FedCM grant so the origin no longer appears in the user's
+ * "Connected apps" list — next sign-in from that origin will require explicit
+ * re-consent.
+ */
+export const useRevokeAuthorizedApp = () => {
+  const { oxyServices, activeSessionId } = useOxy();
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationKey: [...mutationKeys.connectedApps.revoke],
+    mutationFn: async (origin: string) => {
+      return authenticatedApiCall<void>(oxyServices, activeSessionId, () =>
+        oxyServices.revokeAuthorizedApp(origin)
+      );
+    },
+    onSuccess: () => {
+      invalidateConnectedAppsQueries(queryClient);
+    },
+    onError: (error) => {
+      toast.error(
+        error instanceof Error ? error.message : 'Failed to revoke authorized app'
+      );
+    },
+  });
+};
+
 /**
  * Upload file with authentication handling and progress tracking
  */