@nadohq/mobile-client 0.65.0 → 0.66.0

package/src/MobileClient.ts

@@ -5,6 +5,7 @@ import {
   WalletNotProvidedError,
 } from '@nadohq/shared';
 import axios, { AxiosInstance, AxiosResponse } from 'axios';
+import { bytesToString, keccak256, zeroHash } from 'viem';
 import {
   mapMobileAvatarPreset,
   mapMobileAvatarSelectionToServer,
@@ -14,8 +15,16 @@ import {
   mapMobileFollowListPage,
   mapMobileFollowListParamsToServer,
   mapMobileFollowMutationResult,
+  mapMobileNotificationCapabilitiesToServer,
+  mapMobileNotificationInboxV2,
   mapMobileNotificationPreferences,
   mapMobileNotificationPreferencesToServer,
+  mapMobileNotificationRegistrationV2,
+  mapMobileNotificationSettingsToServer,
+  mapMobileNotificationSettingsV2,
+  mapMobileNotificationSubscriptions,
+  mapMobileNotificationSubscriptionsUpdateToServer,
+  mapMobileProductEventToServer,
   mapMobileProfileSearchPage,
   mapMobileProfileSearchParamsToServer,
   mapMobileProfilesIncludeToServer,
@@ -26,6 +35,7 @@ import {
   mapMobileSocialFeedCommentsPage,
   mapMobileSocialFeedDrawingMutationResult,
   mapMobileSocialFeedDrawingResult,
+  mapMobileSocialFeedImage,
   mapMobileSocialFeedItem,
   mapMobileSocialFeedItemResponse,
   mapMobileSocialFeedLikeResult,
@@ -46,6 +56,7 @@ import {
 } from './dataMappers';
 import {
   buildSignedMobileRequest,
+  getMobileNonce,
   MobileSignedInner,
   MobileSignedInnerByType,
   MobileSignedInnerParams,
@@ -54,6 +65,8 @@ import {
 import {
   GetMobileFeedChartDrawingParams,
   GetMobileFeedCommentsParams,
+  GetMobileFeedImageBytesParams,
+  GetMobileFeedImageRequestParams,
   GetMobileFeedItemParams,
   GetMobileFeedParams,
   GetMobileFeedUpdatesParams,
@@ -62,7 +75,11 @@ import {
   GetMobileForYouFeedParams,
   GetMobileFriendsFeedParams,
   GetMobileMarketFeedParams,
+  GetMobileNotificationInboxV2Params,
   GetMobileNotificationPreferencesParams,
+  GetMobileNotificationRegistrationV2Params,
+  GetMobileNotificationSettingsV2Params,
+  GetMobileNotificationSubscriptionsParams,
   GetMobilePositionChartParams,
   GetMobilePositionFeedParams,
   GetMobilePositionHistoryParams,
@@ -77,19 +94,27 @@ import {
   MobileAvatarUpload,
   MobileCreateAvatarUploadParams,
   MobileCreateFeedCommentParams,
+  MobileCreateFeedImageUploadParams,
   MobileCreateFeedPostParams,
   MobileFeedChartDrawingParams,
+  MobileFeedImageRequest,
   MobileFeedPage,
   MobileFollowBatchResultItem,
   MobileFollowListPage,
   MobileFollowMutationResult,
+  MobileNotificationInboxV2,
   MobileNotificationPreferences,
+  MobileNotificationRegistrationV2,
+  MobileNotificationSettingsV2,
+  MobileNotificationSubscriptions,
   MobilePositionPresenceParams,
   MobileProfileSearchPage,
   MobilePublicProfile,
   MobileRecordFeedViewsParams,
+  MobileRecordProductEventsParams,
   MobileRegisteredWallet,
   MobileRegisterExpoTokenParams,
+  MobileRegisterExpoTokenV2Params,
   MobileSetAvatarParams,
   MobileSetBioParams,
   MobileSetFeedLikeParams,
@@ -103,6 +128,7 @@ import {
   MobileSocialFeedCommentsPage,
   MobileSocialFeedDrawingMutationResult,
   MobileSocialFeedDrawingResult,
+  MobileSocialFeedImage,
   MobileSocialFeedItem,
   MobileSocialFeedItemResponse,
   MobileSocialFeedLikeResult,
@@ -119,6 +145,8 @@ import {
   MobileSocialFeedWatchers,
   MobileUnregisterExpoTokenParams,
   MobileUpdateNotificationPreferencesParams,
+  MobileUpdateNotificationSettingsV2Params,
+  MobileUpdateNotificationSubscriptionsParams,
   MobileUsernameAvailability,
   ResolveMobileFeedActionParams,
   ResolveMobileFeedPositionParams,
@@ -135,6 +163,7 @@ import {
 import {
   MobileServerPublicQueryRequest,
   MobileServerPublicQuerySuccessResponse,
+  MobileServerSignedQuerySuccessResponse,
 } from './types/serverQueryTypes';
 import {
   MobileServerExecuteRequestType,
@@ -142,7 +171,10 @@ import {
   MobileServerPublicExecuteRequestType,
   MobileServerPublicQueryRequestByType,
   MobileServerPublicQueryRequestType,
+  MobileServerSignedQueryRequestType,
 } from './types/serverRequestTypes';
+import { buildMobileFeedImageMultipart } from './utils/buildMobileFeedImageMultipart';
+import { MOBILE_FEED_IMAGE_MAX_REQUEST_BYTES } from './utils/feed';
 import {
   isMobileServerFailureResponse,
   isMobileServerSuccessResponse,
@@ -480,7 +512,9 @@ export class MobileClient {
   /**
    * Reads one item visible to viewAs, including that account's own hidden content.
    * Creates an item session directly when sessionId is omitted.
-   * @param params - Item UUID, preview limit, and optional existing session/read identity.
+   * Pass {@link GetMobileFeedItemParams.viewEventId} when the user navigates into the detail so the
+   * subsequent {@link recordFeedViews} call can count that visit; omit it for prefetch.
+   * @param params - Item UUID, optional detail-visit event, preview limit, and optional existing session/read identity.
    * @returns The complete item and authorized reading session.
    * @throws {MobileServerFailureError} On inaccessible content or session mismatch/expiry.
    * @throws {MobileUnsupportedFeedItemError} If the service returns an unsupported item kind.
@@ -491,6 +525,7 @@ export class MobileClient {
     const body: MobileServerPublicQueryRequest<'feed_item'> = {
       type: 'feed_item',
       item_id: params.itemId,
+      view_event_id: params.viewEventId,
       comment_preview_limit: params.commentPreviewLimit,
       session_id: params.sessionId,
       ...mapMobileSocialFeedReadParamsToServer(params),
@@ -534,6 +569,7 @@ export class MobileClient {
    *
    * @throws {MobileServerFailureError} With error code `INVALID_EXPO_TOKEN` if the token is malformed, or is
    * not currently registered to a wallet.
+   * @deprecated Use {@link getNotificationSettingsV2} instead.
    */
   async getNotificationPreferences(
     params: GetMobileNotificationPreferencesParams,
@@ -649,6 +685,47 @@ export class MobileClient {
     return mapMobileSocialFeedDrawingResult(await this.publicQuery(body));
   }
 
+  /**
+   * Resolves a backend feed image path against this client's mobile gateway URL.
+   * @param path - Backend path from image metadata, rooted at /v1/mobile or the mobile service root.
+   * @returns An absolute URL suitable for authenticated fetches.
+   */
+  resolveFeedImageUrl(path: string): string {
+    return `${this.opts.url}${path.replace(/^\/v1\/mobile(?=\/)/, '')}`;
+  }
+
+  /**
+   * Prepares a protected image request for native image components without downloading or encoding bytes.
+   * Does not count as a detail visit or recorded view.
+   * @param params - Image path from metadata plus the original session credentials.
+   * @returns Absolute URL and headers; pass them as the image source's URI and headers.
+   */
+  getFeedImageRequest(
+    params: GetMobileFeedImageRequestParams,
+  ): MobileFeedImageRequest {
+    return {
+      url: this.resolveFeedImageUrl(params.path),
+      headers: {
+        'x-feed-session-id': params.sessionId,
+        'x-feed-viewer-token': params.viewerToken,
+      },
+    };
+  }
+
+  /**
+   * Fetches protected feed image bytes using the reading session that fully delivered the parent item.
+   * Does not count as a detail visit or recorded view.
+   * @param params - Image path from metadata plus the original session credentials.
+   * @returns Raw image bytes.
+   * @throws {MobileServerFailureError} On session, permission, or availability errors.
+   */
+  async getFeedImageBytes(
+    params: GetMobileFeedImageBytesParams,
+  ): Promise<Uint8Array> {
+    const { url, headers } = this.getFeedImageRequest(params);
+    return this.publicGetBytes(url, headers);
+  }
+
   /**
    * Reads a comment thread with an optional anchor and bidirectional pagination.
    * Independent reads create a public-only session; reused sessions retain their original scope.
@@ -743,6 +820,85 @@ export class MobileClient {
     return mapMobileSocialFeedWatchers(await this.publicQuery(body));
   }
 
+  /**
+   * Reads the token's latest registration generation and saved capabilities, including legacy v1 registrations.
+   * @param params - Active Expo token credential; no wallet signature is needed.
+   * @returns Saved generation as an opaque string and the complete capability declaration.
+   * @throws {MobileServerFailureError} If the token is invalid or inactive (`INVALID_EXPO_TOKEN`).
+   */
+  async getNotificationRegistrationV2(
+    params: GetMobileNotificationRegistrationV2Params,
+  ): Promise<MobileNotificationRegistrationV2> {
+    return mapMobileNotificationRegistrationV2(
+      await this.publicQuery({
+        type: 'notification_registration_v2',
+        expo_token: params.expoToken,
+      }),
+    );
+  }
+
+  /**
+   * Reads the wallet's full v2 settings document, including legacy preference mappings.
+   * @param params - Active Expo token credential. Before displaying settings, compare the wallet returned by
+   *   {@link MobileClient.getRegisteredWallet} with the connected wallet (case-insensitively).
+   * @returns CamelCase settings with the current settings revision.
+   * @throws {MobileServerFailureError} If the token is invalid or inactive (`INVALID_EXPO_TOKEN`).
+   */
+  async getNotificationSettingsV2(
+    params: GetMobileNotificationSettingsV2Params,
+  ): Promise<MobileNotificationSettingsV2> {
+    return mapMobileNotificationSettingsV2(
+      await this.publicQuery({
+        type: 'notification_settings_v2',
+        expo_token: params.expoToken,
+      }),
+    );
+  }
+
+  /*
+  Signed queries
+   */
+
+  /**
+   * Reads wallet market subscriptions and the signing Identity's enabled trader bells.
+   * @param params - Wallet authentication context; no Expo token is needed.
+   * @returns Subscriptions, import state, and the independent subscription revision.
+   * @throws {WalletNotProvidedError} If neither a linked signer nor a default wallet is configured.
+   * @throws {MobileServerFailureError} If authentication or the query fails.
+   */
+  async getNotificationSubscriptions(
+    params: GetMobileNotificationSubscriptionsParams,
+  ): Promise<MobileNotificationSubscriptions> {
+    const request = await this.getSignedRequest(
+      'notification_subscriptions',
+      params,
+      {},
+    );
+    return mapMobileNotificationSubscriptions(await this.query(request));
+  }
+
+  /**
+   * Reads private accepted notification intents, not delivery receipts or read states.
+   * @param params - Wallet authentication and optional cursor/page size (1-50, default 20).
+   * @returns A camelCase page; discard cached pages and cursors when switching wallets.
+   * @throws {WalletNotProvidedError} If neither a linked signer nor a default wallet is configured.
+   * @throws {MobileServerFailureError} If authentication or pagination validation fails.
+   * @throws {MobileUnsupportedNotificationRouteError} If a notification has an unsupported route name.
+   */
+  async getNotificationInboxV2(
+    params: GetMobileNotificationInboxV2Params,
+  ): Promise<MobileNotificationInboxV2> {
+    const request = await this.getSignedRequest(
+      'notification_inbox_v2',
+      params,
+      {
+        cursor: params.cursor ?? null,
+        limit: params.limit ?? null,
+      },
+    );
+    return mapMobileNotificationInboxV2(await this.query(request));
+  }
+
   /*
   Public executes
    */
@@ -778,6 +934,7 @@ export class MobileClient {
    *
    * @throws {MobileServerFailureError} With error code `INVALID_PREFERENCES` if those rules are violated, or
    * `INVALID_EXPO_TOKEN` if the token is malformed or is not currently registered to a wallet.
+   * @deprecated Use {@link updateNotificationSettingsV2} instead.
    */
   async updateNotificationPreferences(
     params: MobileUpdateNotificationPreferencesParams,
@@ -791,13 +948,36 @@ export class MobileClient {
   }
 
   /**
-   * Reports qualified exposures without signing. Ordinary reads and root previews do not count as exposures.
-   * The caller must satisfy the session's viewTracking requirements before reporting an item.
-   * @param params - Original reading session and viewer token, plus one to fifty fully delivered, readable,
-   * interactive item IDs. The service deduplicates repeated exposures.
-   * @returns Separate lists of newly accepted and already-counted item IDs.
-   * @throws {MobileServerFailureError} On invalid parameters, session mismatch or expiry, or any ineligible item.
-   * A rejected batch is not partially counted. Acquire a new session after expiry and re-evaluate exposure eligibility.
+   * Replaces all v2 settings fields using optimistic concurrency; legacy overlapping preferences are synced.
+   * @param params - Active Expo token, latest settings revision, and complete replacement settings.
+   * @returns The saved settings document with its incremented revision.
+   * @throws {MobileServerFailureError} On invalid token/settings or revision conflict (`NOTIFICATION_REVISION_CONFLICT`). Re-read and
+   * merge only the user's current change before retrying; never blindly replay a stale document.
+   */
+  async updateNotificationSettingsV2(
+    params: MobileUpdateNotificationSettingsV2Params,
+  ): Promise<MobileNotificationSettingsV2> {
+    return mapMobileNotificationSettingsV2(
+      await this.publicExecute({
+        type: 'update_notification_settings_v2',
+        expo_token: params.expoToken,
+        expected_revision: params.expectedRevision,
+        settings: mapMobileNotificationSettingsToServer(params.settings),
+      }),
+    );
+  }
+
+  /**
+   * Reports a detail visit without signing. Feed-list card impressions and previews do not count.
+   * After the primary detail target is shown in the foreground, send the same viewEventId previously
+   * registered through {@link getFeedItem}, together with that response's sessionId and viewerToken.
+   * Reuse the event ID on retries for the same visit; generate a new one only after leaving and re-entering.
+   * @param params - Original reading session and viewer token, the registered detail-visit event, and exactly
+   * one fully delivered, readable detail-target item ID.
+   * @returns Separate lists of newly accepted and already-counted item IDs for that event.
+   * @throws {MobileServerFailureError} On invalid parameters, an unregistered or rebound event
+   * (`SOCIAL_FEED_VIEW_EVENT_REBOUND`), session mismatch or expiry, or an ineligible item.
+   * Acquire a new session after expiry, re-register the same event via getFeedItem, then retry.
    */
   async recordFeedViews(
     params: MobileRecordFeedViewsParams,
@@ -805,8 +985,9 @@ export class MobileClient {
     const body: MobileServerPublicExecuteRequest<'record_feed_views'> = {
       type: 'record_feed_views',
       session_id: params.sessionId,
-      item_ids: params.itemIds,
       viewer_token: params.viewerToken,
+      view_event_id: params.viewEventId,
+      item_ids: [params.itemId],
     };
     return mapMobileSocialFeedViewsResult(await this.publicExecute(body));
   }
@@ -942,11 +1123,13 @@ export class MobileClient {
 
   /**
    * Registers an Expo push token for the wallet, transferring active ownership of the token if another
-   * wallet had registered it. Idempotent per `(wallet, token)`.
+   * wallet had registered it. Each registration advances its generation and cancels old pending deliveries.
+   * This legacy method replaces capabilities with v1; use registerExpoTokenV2 consistently after upgrading.
    *
    * @throws {MobileServerFailureError} With error code `INVALID_EXPO_TOKEN` if the token is not a valid Expo
    * push token, or `INVALID_DEVICE_METADATA` if `locale` (max 35 chars) or `appVersion` (max 64 chars) is
    * too long.
+   * @deprecated Use {@link registerExpoTokenV2} instead.
    */
   async registerExpoToken(
     params: MobileRegisterExpoTokenParams,
@@ -964,6 +1147,70 @@ export class MobileClient {
     return this.execute(signedRequest);
   }
 
+  /**
+   * Registers a device with its actual v2 capabilities; do not use repeated registration as a heartbeat.
+   * @param params - Wallet authentication, Expo token, metadata, and supported notification types/routes.
+   * @returns Success only; query registration separately for its new generation.
+   * @throws {WalletNotProvidedError} If neither a linked signer nor a default wallet is configured.
+   * @throws {MobileServerFailureError} On `INVALID_EXPO_TOKEN`, `INVALID_DEVICE_METADATA`,
+   * `NOTIFICATION_DEVICE_LIMIT` when the wallet already has 32 active devices, or authentication errors.
+   */
+  async registerExpoTokenV2(
+    params: MobileRegisterExpoTokenV2Params,
+  ): Promise<MobileServerSuccessResponse> {
+    const request = await this.getSignedRequest(
+      'register_expo_token_v2',
+      params,
+      {
+        expo_token: params.expoToken,
+        platform: params.platform,
+        locale: params.locale ?? null,
+        app_version: params.appVersion ?? null,
+        capabilities: mapMobileNotificationCapabilitiesToServer(
+          params.capabilities,
+        ),
+      },
+    );
+    return this.execute(request);
+  }
+
+  /**
+   * Applies exactly one bell, market, or one-time favorites-import operation.
+   * @param params - Wallet authentication and subscription update with the latest subscription revision.
+   * @returns Success only; re-query subscriptions for the new revision even after a repeated ON/OFF.
+   * @throws {WalletNotProvidedError} If neither a linked signer nor a default wallet is configured.
+   * @throws {MobileServerFailureError} On `NOTIFICATION_REVISION_CONFLICT`, `INVALID_NOTIFICATION_REQUEST`, or
+   * `INVALID_IDENTITY_TARGET`.
+   */
+  async updateNotificationSubscriptions(
+    params: MobileUpdateNotificationSubscriptionsParams,
+  ): Promise<MobileServerSuccessResponse> {
+    const request = await this.getSignedRequest(
+      'update_notification_subscriptions',
+      params,
+      mapMobileNotificationSubscriptionsUpdateToServer(params.update),
+    );
+    return this.execute(request);
+  }
+
+  /**
+   * Atomically records 1-50 analytics events after the user has consented to analytics.
+   * @param params - Wallet authentication and events with stable UUIDs and actual millisecond timestamps.
+   * @returns Success only; reuse event IDs on retries. Notification clicks do not mark an inbox item as read.
+   * @throws {WalletNotProvidedError} If neither a linked signer nor a default wallet is configured.
+   * @throws {MobileServerFailureError} If any event, timestamp, batch size, or notification ownership is invalid.
+   */
+  async recordProductEvents(
+    params: MobileRecordProductEventsParams,
+  ): Promise<MobileServerSuccessResponse> {
+    const request = await this.getSignedRequest(
+      'record_product_events',
+      params,
+      { events: params.events.map(mapMobileProductEventToServer) },
+    );
+    return this.execute(request);
+  }
+
   /**
    * Sets whether the signing subaccount follows a Profile. Both directions are idempotent: following again
    * keeps the original relationship creation time, so it does not move the account in recency order, and
@@ -1044,10 +1291,49 @@ export class MobileClient {
       text: params.text,
       mentions: params.mentions.map(mapMobileSocialFeedMentionToServer),
       drawing_data_json: params.drawingDataJson,
+      image_ids: params.imageIds,
     });
     return mapMobileSocialFeedItem((await this.execute(request)).item);
   }
 
+  /**
+   * Uploads one static JPEG/PNG for a later {@link createFeedPost} via multipart execute.
+   * The whole HTTP request must stay within 2 MiB including signature overhead; upload one file per call
+   * and bind up to nine ready IDs at publication. There is no complete/PUT step — success means ready.
+   * @param params - Author subaccount and signing options, plus the original file bytes.
+   * @returns Ready image metadata, including original and thumbnail paths.
+   * @throws {WalletNotProvidedError} If neither a linked signer nor a default wallet is configured.
+   * @throws {RangeError} If the complete multipart request exceeds {@link MOBILE_FEED_IMAGE_MAX_REQUEST_BYTES}.
+   * @throws {MobileServerFailureError} On authentication, format/size/hash errors (`INVALID_SOCIAL_FEED_IMAGE`),
+   * or when publishing is disabled (`SERVICE_UNAVAILABLE`), or image storage is unavailable
+   * (`SOCIAL_FEED_DATA_UNAVAILABLE`, 6320, HTTP 503).
+   */
+  async createFeedPostImageUpload(
+    params: MobileCreateFeedImageUploadParams,
+  ): Promise<MobileSocialFeedImage> {
+    return this.createFeedImageUpload('create_feed_post_image_uploads', params);
+  }
+
+  /**
+   * Uploads one static JPEG/PNG for a later {@link createFeedComment} via multipart execute.
+   * Same size and readiness rules as {@link createFeedPostImageUpload}; comment text remains required.
+   * @param params - Author subaccount and signing options, plus the original file bytes.
+   * @returns Ready image metadata, including original and thumbnail paths.
+   * @throws {WalletNotProvidedError} If neither a linked signer nor a default wallet is configured.
+   * @throws {RangeError} If the complete multipart request exceeds {@link MOBILE_FEED_IMAGE_MAX_REQUEST_BYTES}.
+   * @throws {MobileServerFailureError} On authentication, format/size/hash errors (`INVALID_SOCIAL_FEED_IMAGE`),
+   * or when comments are disabled (`SERVICE_UNAVAILABLE`), or image storage is unavailable
+   * (`SOCIAL_FEED_DATA_UNAVAILABLE`, 6320, HTTP 503).
+   */
+  async createFeedCommentImageUpload(
+    params: MobileCreateFeedImageUploadParams,
+  ): Promise<MobileSocialFeedImage> {
+    return this.createFeedImageUpload(
+      'create_feed_comment_image_uploads',
+      params,
+    );
+  }
+
   /**
    * First attaches a drawing to an owned post or trade card while the author still holds its position.
    * The original JSON is signed unchanged; false and zero are valid drawing documents.
@@ -1119,6 +1405,7 @@ export class MobileClient {
       text: params.text,
       mentions: params.mentions.map(mapMobileSocialFeedMentionToServer),
       attached_position_id: params.attachedPositionId,
+      image_ids: params.imageIds,
     });
     return mapMobileSocialFeedCommentResult(await this.execute(request));
   }
@@ -1188,6 +1475,27 @@ export class MobileClient {
     return response.data as MobileServerPublicQuerySuccessResponse<T>;
   }
 
+  protected async publicGetBytes(
+    url: string,
+    headers: Record<string, string>,
+  ): Promise<Uint8Array> {
+    const response = await this.axiosInstance.get<ArrayBuffer>(url, {
+      responseType: 'arraybuffer',
+      headers,
+    });
+    if (response.status < 200 || response.status >= 300) {
+      const responseText = bytesToString(new Uint8Array(response.data));
+      let errorData: unknown;
+      try {
+        errorData = JSON.parse(responseText);
+      } catch {
+        errorData = responseText;
+      }
+      this.checkResponseStatus({ ...response, data: errorData });
+    }
+    return new Uint8Array(response.data);
+  }
+
   protected async publicExecute<T extends MobileServerPublicExecuteRequestType>(
     body: { type: T } & MobileServerPublicExecuteRequestByType[T],
   ): Promise<MobileServerPublicExecuteSuccessResponse<T>> {
@@ -1203,14 +1511,43 @@ export class MobileClient {
     return response.data as MobileServerPublicExecuteSuccessResponse<T>;
   }
 
+  /**
+   * Sends an authenticated read through the signed query route.
+   * @param body - Canonical inner payload with its signature, sender, and nonce.
+   * @returns The successful query envelope and its type-specific payload.
+   * @throws {MobileServerFailureError} For a structured service failure, including non-2xx responses.
+   */
+  protected async query<T extends MobileServerSignedQueryRequestType>(
+    body: MobileSignedRequest & { type: T },
+  ): Promise<MobileServerSignedQuerySuccessResponse<T>> {
+    const response = await this.axiosInstance.post<unknown>(
+      `${this.opts.url}/query`,
+      body,
+    );
+    this.checkResponseStatus(response);
+    this.checkServerStatus(response);
+    return response.data as MobileServerSignedQuerySuccessResponse<T>;
+  }
+
   // `T` is inferred from the body's `type` rather than declared by the caller, for the same reason
   // `publicQuery` spells its body out as an intersection: an indexed access is not an inference site.
   protected async execute<T extends MobileServerExecuteRequestType>(
     body: MobileSignedRequest & { type: T },
+    fileBytes?: Uint8Array,
   ): Promise<MobileServerExecuteSuccessResponse<T>> {
+    const multipart =
+      fileBytes == null
+        ? undefined
+        : buildMobileFeedImageMultipart(JSON.stringify(body), fileBytes);
+    if (multipart) {
+      this.checkFeedImageRequestSize(multipart.body.byteLength);
+    }
     const response = await this.axiosInstance.post<MobileServerExecuteResult>(
       `${this.opts.url}/execute`,
-      body,
+      multipart?.body ?? body,
+      multipart
+        ? { headers: { 'Content-Type': multipart.contentType } }
+        : undefined,
     );
 
     this.checkResponseStatus(response);
@@ -1220,6 +1557,46 @@ export class MobileClient {
     return response.data as MobileServerExecuteSuccessResponse<T>;
   }
 
+  private async createFeedImageUpload(
+    type:
+      | 'create_feed_post_image_uploads'
+      | 'create_feed_comment_image_uploads',
+    params: MobileCreateFeedImageUploadParams,
+  ): Promise<MobileSocialFeedImage> {
+    const nonce = params.nonce ?? getMobileNonce();
+    // Match the signed body's field lengths so oversized requests fail before prompting the wallet.
+    const sizePayload = {
+      type,
+      content_hash: zeroHash,
+      signature: `0x${'00'.repeat(65)}`,
+      sender: subaccountToHex(params),
+      nonce: nonce.toString(),
+    };
+    const overhead = buildMobileFeedImageMultipart(
+      JSON.stringify(sizePayload),
+      new Uint8Array(),
+    ).body.byteLength;
+    this.checkFeedImageRequestSize(overhead + params.fileBytes.byteLength);
+    const contentHash = keccak256(params.fileBytes);
+    const request = await this.getSignedRequest(
+      type,
+      { ...params, nonce },
+      {
+        content_hash: contentHash,
+      },
+    );
+    const data = await this.execute(request, params.fileBytes);
+    return mapMobileSocialFeedImage(data.image);
+  }
+
+  private checkFeedImageRequestSize(byteLength: number): void {
+    if (byteLength > MOBILE_FEED_IMAGE_MAX_REQUEST_BYTES) {
+      throw new RangeError(
+        `Feed image upload request exceeds ${MOBILE_FEED_IMAGE_MAX_REQUEST_BYTES} bytes (2 MiB).`,
+      );
+    }
+  }
+
   /**
    * Validates the HTTP status before interpreting the body. Unlike the engine, the mobile backend returns
    * failure envelopes with non-2xx statuses (e.g. 404 for `PROFILE_NOT_FOUND`), so a non-2xx response with a