@nadohq/mobile-client 0.65.0 → 0.67.0

package/src/MobileClient.ts

@@ -5,6 +5,7 @@ import {
   WalletNotProvidedError,
 } from '@nadohq/shared';
 import axios, { AxiosInstance, AxiosResponse } from 'axios';
+import { bytesToString, keccak256, zeroHash } from 'viem';
 import {
   mapMobileAvatarPreset,
   mapMobileAvatarSelectionToServer,
@@ -14,8 +15,16 @@ import {
   mapMobileFollowListPage,
   mapMobileFollowListParamsToServer,
   mapMobileFollowMutationResult,
+  mapMobileNotificationCapabilitiesToServer,
+  mapMobileNotificationInboxV2,
   mapMobileNotificationPreferences,
   mapMobileNotificationPreferencesToServer,
+  mapMobileNotificationRegistrationV2,
+  mapMobileNotificationSettingsToServer,
+  mapMobileNotificationSettingsV2,
+  mapMobileNotificationSubscriptions,
+  mapMobileNotificationSubscriptionsUpdateToServer,
+  mapMobileProductEventToServer,
   mapMobileProfileSearchPage,
   mapMobileProfileSearchParamsToServer,
   mapMobileProfilesIncludeToServer,
@@ -36,16 +45,18 @@ import {
   mapMobileSocialFeedPositionHistory,
   mapMobileSocialFeedPositionResolutionResult,
   mapMobileSocialFeedPositionsPage,
+  mapMobileSocialFeedPositionThoughts,
   mapMobileSocialFeedPresence,
   mapMobileSocialFeedRankedPage,
   mapMobileSocialFeedReadParamsToServer,
   mapMobileSocialFeedTopTradersPage,
   mapMobileSocialFeedUpdates,
-  mapMobileSocialFeedViewsResult,
+  mapMobileSocialFeedUploadedImage,
   mapMobileSocialFeedWatchers,
 } from './dataMappers';
 import {
   buildSignedMobileRequest,
+  getMobileNonce,
   MobileSignedInner,
   MobileSignedInnerByType,
   MobileSignedInnerParams,
@@ -54,6 +65,8 @@ import {
 import {
   GetMobileFeedChartDrawingParams,
   GetMobileFeedCommentsParams,
+  GetMobileFeedImageBytesParams,
+  GetMobileFeedImageRequestParams,
   GetMobileFeedItemParams,
   GetMobileFeedParams,
   GetMobileFeedUpdatesParams,
@@ -62,10 +75,16 @@ import {
   GetMobileForYouFeedParams,
   GetMobileFriendsFeedParams,
   GetMobileMarketFeedParams,
+  GetMobileNotificationInboxV2Params,
   GetMobileNotificationPreferencesParams,
+  GetMobileNotificationRegistrationV2Params,
+  GetMobileNotificationSettingsV2Params,
+  GetMobileNotificationSubscriptionsParams,
   GetMobilePositionChartParams,
   GetMobilePositionFeedParams,
+  GetMobilePositionHistoryAllParams,
   GetMobilePositionHistoryParams,
+  GetMobilePositionThoughtsParams,
   GetMobilePositionWatchersParams,
   GetMobileProfileFeedParams,
   GetMobileProfilesParams,
@@ -77,19 +96,27 @@ import {
   MobileAvatarUpload,
   MobileCreateAvatarUploadParams,
   MobileCreateFeedCommentParams,
+  MobileCreateFeedImageUploadParams,
   MobileCreateFeedPostParams,
   MobileFeedChartDrawingParams,
+  MobileFeedImageRequest,
   MobileFeedPage,
   MobileFollowBatchResultItem,
   MobileFollowListPage,
   MobileFollowMutationResult,
+  MobileNotificationInboxV2,
   MobileNotificationPreferences,
+  MobileNotificationRegistrationV2,
+  MobileNotificationSettingsV2,
+  MobileNotificationSubscriptions,
   MobilePositionPresenceParams,
   MobileProfileSearchPage,
   MobilePublicProfile,
   MobileRecordFeedViewsParams,
+  MobileRecordProductEventsParams,
   MobileRegisteredWallet,
   MobileRegisterExpoTokenParams,
+  MobileRegisterExpoTokenV2Params,
   MobileSetAvatarParams,
   MobileSetBioParams,
   MobileSetFeedLikeParams,
@@ -111,14 +138,17 @@ import {
   MobileSocialFeedPositionHistory,
   MobileSocialFeedPositionResolutionResult,
   MobileSocialFeedPositionsPage,
+  MobileSocialFeedPositionThoughtsPage,
   MobileSocialFeedPresence,
   MobileSocialFeedRankedPage,
   MobileSocialFeedTopTradersPage,
   MobileSocialFeedUpdates,
-  MobileSocialFeedViewsResult,
+  MobileSocialFeedUploadedImage,
   MobileSocialFeedWatchers,
   MobileUnregisterExpoTokenParams,
   MobileUpdateNotificationPreferencesParams,
+  MobileUpdateNotificationSettingsV2Params,
+  MobileUpdateNotificationSubscriptionsParams,
   MobileUsernameAvailability,
   ResolveMobileFeedActionParams,
   ResolveMobileFeedPositionParams,
@@ -135,6 +165,7 @@ import {
 import {
   MobileServerPublicQueryRequest,
   MobileServerPublicQuerySuccessResponse,
+  MobileServerSignedQuerySuccessResponse,
 } from './types/serverQueryTypes';
 import {
   MobileServerExecuteRequestType,
@@ -142,7 +173,10 @@ import {
   MobileServerPublicExecuteRequestType,
   MobileServerPublicQueryRequestByType,
   MobileServerPublicQueryRequestType,
+  MobileServerSignedQueryRequestType,
 } from './types/serverRequestTypes';
+import { buildMobileFeedImageMultipart } from './utils/buildMobileFeedImageMultipart';
+import { MOBILE_FEED_IMAGE_MAX_REQUEST_BYTES } from './utils/feed';
 import {
   isMobileServerFailureResponse,
   isMobileServerSuccessResponse,
@@ -480,6 +514,7 @@ export class MobileClient {
   /**
    * Reads one item visible to viewAs, including that account's own hidden content.
    * Creates an item session directly when sessionId is omitted.
+   * Reading does not increment views; use {@link recordFeedViews} independently when reporting views.
    * @param params - Item UUID, preview limit, and optional existing session/read identity.
    * @returns The complete item and authorized reading session.
    * @throws {MobileServerFailureError} On inaccessible content or session mismatch/expiry.
@@ -534,6 +569,7 @@ export class MobileClient {
    *
    * @throws {MobileServerFailureError} With error code `INVALID_EXPO_TOKEN` if the token is malformed, or is
    * not currently registered to a wallet.
+   * @deprecated Use {@link getNotificationSettingsV2} instead.
    */
   async getNotificationPreferences(
     params: GetMobileNotificationPreferencesParams,
@@ -650,11 +686,55 @@ export class MobileClient {
   }
 
   /**
-   * Reads a comment thread with an optional anchor and bidirectional pagination.
+   * Resolves a backend feed image path against this client's mobile gateway URL.
+   * @param path - Backend path from image metadata, rooted at /v1/mobile or the mobile service root.
+   * @returns An absolute URL suitable for authenticated fetches.
+   */
+  resolveFeedImageUrl(path: string): string {
+    return `${this.opts.url}${path.replace(/^\/v1\/mobile(?=\/)/, '')}`;
+  }
+
+  /**
+   * Prepares a protected image request for native image components without downloading or encoding bytes.
+   * Does not increment view counts.
+   * @param params - Image path from metadata plus the original session credentials.
+   * @returns Absolute URL and headers; pass them as the image source's URI and headers.
+   */
+  getFeedImageRequest(
+    params: GetMobileFeedImageRequestParams,
+  ): MobileFeedImageRequest {
+    return {
+      url: this.resolveFeedImageUrl(params.path),
+      headers: {
+        'x-feed-session-id': params.sessionId,
+        'x-feed-viewer-token': params.viewerToken,
+      },
+    };
+  }
+
+  /**
+   * Fetches protected feed image bytes using the reading session that fully delivered the parent item.
+   * Does not increment view counts.
+   * @param params - Image path from metadata plus the original session credentials.
+   * @returns Raw image bytes.
+   * @throws {MobileServerFailureError} On session, permission, or availability errors.
+   */
+  async getFeedImageBytes(
+    params: GetMobileFeedImageBytesParams,
+  ): Promise<Uint8Array> {
+    const { url, headers } = this.getFeedImageRequest(params);
+    return this.publicGetBytes(url, headers);
+  }
+
+  /**
+   * Reads top-level comment groups with all readable descendants and bidirectional pagination.
+   * The limit counts groups, not descendants. Groups are newest first; their flat replies are oldest first,
+   * with depth then UUID breaking timestamp ties. An anchor at any depth selects its top-level group.
+   * Preview cursors open the first complete group page in the same snapshot; do not prepend preview items.
    * Independent reads create a public-only session; reused sessions retain their original scope.
-   * @param params - Root item, optional anchor or cursor (mutually exclusive), page size, and read perspective.
+   * @param params - Root item, optional anchor or cursor (mutually exclusive), group limit, and read perspective.
    * Paging requires the original session and viewer token.
-   * @returns Replies, total count, forward and backward cursors, the anchor, and the actual reading session.
+   * @returns Complete comment groups, whole-thread reply and top-level counts, cursors, anchor, and session.
    * @throws {MobileServerFailureError} On invalid parameters, session mismatch or expiry, inaccessible content,
    * or unavailable data. Restart pagination with a new session after expiry; do not reuse the old cursor.
    */
@@ -680,7 +760,8 @@ export class MobileClient {
    * the original position session and viewer token, not a feed session.
    * @returns Position metrics, ordered action/take history, summary, trading hints, cursor, and reading session.
    * @throws {MobileServerFailureError} On invalid parameters, session mismatch or expiry, inaccessible content,
-   * or unavailable source data. Restart with a new position session after expiry.
+   * unavailable source data, or SOCIAL_FEED_HISTORY_TOO_LARGE when the initial directory exceeds capacity.
+   * Restart with a new position session after expiry.
    * @throws {MobileUnsupportedFeedItemError} If a timeline entry or take has an unsupported kind.
    */
   async getPositionHistory(
@@ -698,6 +779,53 @@ export class MobileClient {
     return mapMobileSocialFeedPositionHistory(await this.publicQuery(body));
   }
 
+  /**
+   * Reads the most recent 500 lifecycle actions, without authored text, drawings, or images.
+   * Creates a new position session on every call. A null nextCursor means no pagination, not complete
+   * history; use getPositionHistory with a fresh session for the full lifecycle. takeCount is always zero.
+   * @param params - Position and read perspective; an existing viewer token may be reused.
+   * @returns Position metrics, owner, recent actions, response-scope counts, trading hints, and a new session.
+   * @throws {MobileServerFailureError} On invalid parameters, inaccessible content, unavailable data,
+   * or SOCIAL_FEED_HISTORY_TOO_LARGE when the initial directory exceeds capacity.
+   * @throws {MobileUnsupportedFeedItemError} If a timeline entry or take has an unsupported kind.
+   */
+  async getPositionHistoryAll(
+    params: GetMobilePositionHistoryAllParams,
+  ): Promise<MobileSocialFeedPositionHistory> {
+    const body: MobileServerPublicQueryRequest<'position_history_all'> = {
+      type: 'position_history_all',
+      position_id: params.positionId,
+      ...mapMobileSocialFeedReadParamsToServer(params),
+    };
+    return mapMobileSocialFeedPositionHistory(await this.publicQuery(body));
+  }
+
+  /**
+   * Reads published position thoughts with both nonblank text and a saved drawing, without signing.
+   * Keeps descending drawing creation time / item UUID order; editing a drawing does not move the item.
+   * Continue until nextCursor is null, even after an empty page. There is no 500-item total cap.
+   * Keep positionId, limit, sessionId, and viewerToken unchanged when paging; omitted viewAs inherits
+   * the session. History/feed sessions cannot be substituted. Refresh to include newly eligible content.
+   * @param params - Position, page size, read perspective, and original thoughts-session credentials for paging.
+   * @returns Complete thoughts and drawings in server order, a continuation cursor, and the reading session.
+   * @throws {MobileServerFailureError} On invalid parameters, session mismatch/expiry, inaccessible content,
+   * unavailable source data, or SOCIAL_FEED_HISTORY_TOO_LARGE when the initial directory exceeds capacity.
+   * @throws {MobileUnsupportedFeedItemError} If an item is not a post or trade card.
+   */
+  async getPositionThoughts(
+    params: GetMobilePositionThoughtsParams,
+  ): Promise<MobileSocialFeedPositionThoughtsPage> {
+    const body: MobileServerPublicQueryRequest<'position_thoughts'> = {
+      type: 'position_thoughts',
+      position_id: params.positionId,
+      limit: params.limit,
+      session_id: params.sessionId,
+      cursor: params.cursor,
+      ...mapMobileSocialFeedReadParamsToServer(params),
+    };
+    return mapMobileSocialFeedPositionThoughts(await this.publicQuery(body));
+  }
+
   /**
    * Reads candles and action markers without creating a reading session.
    * Preserve the original range, interval, and read perspective when paging with nextBeforeMs.
@@ -743,6 +871,85 @@ export class MobileClient {
     return mapMobileSocialFeedWatchers(await this.publicQuery(body));
   }
 
+  /**
+   * Reads the token's latest registration generation and saved capabilities, including legacy v1 registrations.
+   * @param params - Active Expo token credential; no wallet signature is needed.
+   * @returns Saved generation as an opaque string and the complete capability declaration.
+   * @throws {MobileServerFailureError} If the token is invalid or inactive (`INVALID_EXPO_TOKEN`).
+   */
+  async getNotificationRegistrationV2(
+    params: GetMobileNotificationRegistrationV2Params,
+  ): Promise<MobileNotificationRegistrationV2> {
+    return mapMobileNotificationRegistrationV2(
+      await this.publicQuery({
+        type: 'notification_registration_v2',
+        expo_token: params.expoToken,
+      }),
+    );
+  }
+
+  /**
+   * Reads the wallet's full v2 settings document, including legacy preference mappings.
+   * @param params - Active Expo token credential. Before displaying settings, compare the wallet returned by
+   *   {@link MobileClient.getRegisteredWallet} with the connected wallet (case-insensitively).
+   * @returns CamelCase settings with the current settings revision.
+   * @throws {MobileServerFailureError} If the token is invalid or inactive (`INVALID_EXPO_TOKEN`).
+   */
+  async getNotificationSettingsV2(
+    params: GetMobileNotificationSettingsV2Params,
+  ): Promise<MobileNotificationSettingsV2> {
+    return mapMobileNotificationSettingsV2(
+      await this.publicQuery({
+        type: 'notification_settings_v2',
+        expo_token: params.expoToken,
+      }),
+    );
+  }
+
+  /*
+  Signed queries
+   */
+
+  /**
+   * Reads wallet market subscriptions and the signing Identity's enabled trader bells.
+   * @param params - Wallet authentication context; no Expo token is needed.
+   * @returns Subscriptions, import state, and the independent subscription revision.
+   * @throws {WalletNotProvidedError} If neither a linked signer nor a default wallet is configured.
+   * @throws {MobileServerFailureError} If authentication or the query fails.
+   */
+  async getNotificationSubscriptions(
+    params: GetMobileNotificationSubscriptionsParams,
+  ): Promise<MobileNotificationSubscriptions> {
+    const request = await this.getSignedRequest(
+      'notification_subscriptions',
+      params,
+      {},
+    );
+    return mapMobileNotificationSubscriptions(await this.query(request));
+  }
+
+  /**
+   * Reads private accepted notification intents, not delivery receipts or read states.
+   * @param params - Wallet authentication and optional cursor/page size (1-50, default 20).
+   * @returns A camelCase page; discard cached pages and cursors when switching wallets.
+   * @throws {WalletNotProvidedError} If neither a linked signer nor a default wallet is configured.
+   * @throws {MobileServerFailureError} If authentication or pagination validation fails.
+   * @throws {MobileUnsupportedNotificationRouteError} If a notification has an unsupported route name.
+   */
+  async getNotificationInboxV2(
+    params: GetMobileNotificationInboxV2Params,
+  ): Promise<MobileNotificationInboxV2> {
+    const request = await this.getSignedRequest(
+      'notification_inbox_v2',
+      params,
+      {
+        cursor: params.cursor ?? null,
+        limit: params.limit ?? null,
+      },
+    );
+    return mapMobileNotificationInboxV2(await this.query(request));
+  }
+
   /*
   Public executes
    */
@@ -778,6 +985,7 @@ export class MobileClient {
    *
    * @throws {MobileServerFailureError} With error code `INVALID_PREFERENCES` if those rules are violated, or
    * `INVALID_EXPO_TOKEN` if the token is malformed or is not currently registered to a wallet.
+   * @deprecated Use {@link updateNotificationSettingsV2} instead.
    */
   async updateNotificationPreferences(
     params: MobileUpdateNotificationPreferencesParams,
@@ -791,24 +999,43 @@ export class MobileClient {
   }
 
   /**
-   * Reports qualified exposures without signing. Ordinary reads and root previews do not count as exposures.
-   * The caller must satisfy the session's viewTracking requirements before reporting an item.
-   * @param params - Original reading session and viewer token, plus one to fifty fully delivered, readable,
-   * interactive item IDs. The service deduplicates repeated exposures.
-   * @returns Separate lists of newly accepted and already-counted item IDs.
-   * @throws {MobileServerFailureError} On invalid parameters, session mismatch or expiry, or any ineligible item.
-   * A rejected batch is not partially counted. Acquire a new session after expiry and re-evaluate exposure eligibility.
+   * Replaces all v2 settings fields using optimistic concurrency; legacy overlapping preferences are synced.
+   * @param params - Active Expo token, latest settings revision, and complete replacement settings.
+   * @returns The saved settings document with its incremented revision.
+   * @throws {MobileServerFailureError} On invalid token/settings or revision conflict (`NOTIFICATION_REVISION_CONFLICT`). Re-read and
+   * merge only the user's current change before retrying; never blindly replay a stale document.
+   */
+  async updateNotificationSettingsV2(
+    params: MobileUpdateNotificationSettingsV2Params,
+  ): Promise<MobileNotificationSettingsV2> {
+    return mapMobileNotificationSettingsV2(
+      await this.publicExecute({
+        type: 'update_notification_settings_v2',
+        expo_token: params.expoToken,
+        expected_revision: params.expectedRevision,
+        settings: mapMobileNotificationSettingsToServer(params.settings),
+      }),
+    );
+  }
+
+  /**
+   * Reports views for posts, trade cards, comments, and replies without signing or a reading session.
+   * Duplicate IDs count once within a request; another request increments them again. Only supplied IDs
+   * count, not their parents. Missing, deleted, unpublished, excluded, or unsupported targets are skipped.
+   * A successful response does not identify skipped items. Read interaction.viewCount for current counts.
+   * This operation is not idempotent: retrying an uncertain result may count twice. No automatic retry is made.
+   * @param params - itemIds: 1–50 canonical lowercase item UUIDs, including any same-request duplicates.
+   * @returns Only the success status, even when every target was skipped.
+   * @throws {MobileServerFailureError} On invalid parameters, disabled writes, rate limiting, or unavailable data.
    */
   async recordFeedViews(
     params: MobileRecordFeedViewsParams,
-  ): Promise<MobileSocialFeedViewsResult> {
+  ): Promise<MobileServerSuccessResponse> {
     const body: MobileServerPublicExecuteRequest<'record_feed_views'> = {
       type: 'record_feed_views',
-      session_id: params.sessionId,
       item_ids: params.itemIds,
-      viewer_token: params.viewerToken,
     };
-    return mapMobileSocialFeedViewsResult(await this.publicExecute(body));
+    return this.publicExecute(body);
   }
 
   /**
@@ -942,11 +1169,13 @@ export class MobileClient {
 
   /**
    * Registers an Expo push token for the wallet, transferring active ownership of the token if another
-   * wallet had registered it. Idempotent per `(wallet, token)`.
+   * wallet had registered it. Each registration advances its generation and cancels old pending deliveries.
+   * This legacy method replaces capabilities with v1; use registerExpoTokenV2 consistently after upgrading.
    *
    * @throws {MobileServerFailureError} With error code `INVALID_EXPO_TOKEN` if the token is not a valid Expo
    * push token, or `INVALID_DEVICE_METADATA` if `locale` (max 35 chars) or `appVersion` (max 64 chars) is
    * too long.
+   * @deprecated Use {@link registerExpoTokenV2} instead.
    */
   async registerExpoToken(
     params: MobileRegisterExpoTokenParams,
@@ -964,6 +1193,70 @@ export class MobileClient {
     return this.execute(signedRequest);
   }
 
+  /**
+   * Registers a device with its actual v2 capabilities; do not use repeated registration as a heartbeat.
+   * @param params - Wallet authentication, Expo token, metadata, and supported notification types/routes.
+   * @returns Success only; query registration separately for its new generation.
+   * @throws {WalletNotProvidedError} If neither a linked signer nor a default wallet is configured.
+   * @throws {MobileServerFailureError} On `INVALID_EXPO_TOKEN`, `INVALID_DEVICE_METADATA`,
+   * `NOTIFICATION_DEVICE_LIMIT` when the wallet already has 32 active devices, or authentication errors.
+   */
+  async registerExpoTokenV2(
+    params: MobileRegisterExpoTokenV2Params,
+  ): Promise<MobileServerSuccessResponse> {
+    const request = await this.getSignedRequest(
+      'register_expo_token_v2',
+      params,
+      {
+        expo_token: params.expoToken,
+        platform: params.platform,
+        locale: params.locale ?? null,
+        app_version: params.appVersion ?? null,
+        capabilities: mapMobileNotificationCapabilitiesToServer(
+          params.capabilities,
+        ),
+      },
+    );
+    return this.execute(request);
+  }
+
+  /**
+   * Applies exactly one bell, market, or one-time favorites-import operation.
+   * @param params - Wallet authentication and subscription update with the latest subscription revision.
+   * @returns Success only; re-query subscriptions for the new revision even after a repeated ON/OFF.
+   * @throws {WalletNotProvidedError} If neither a linked signer nor a default wallet is configured.
+   * @throws {MobileServerFailureError} On `NOTIFICATION_REVISION_CONFLICT`, `INVALID_NOTIFICATION_REQUEST`, or
+   * `INVALID_IDENTITY_TARGET`.
+   */
+  async updateNotificationSubscriptions(
+    params: MobileUpdateNotificationSubscriptionsParams,
+  ): Promise<MobileServerSuccessResponse> {
+    const request = await this.getSignedRequest(
+      'update_notification_subscriptions',
+      params,
+      mapMobileNotificationSubscriptionsUpdateToServer(params.update),
+    );
+    return this.execute(request);
+  }
+
+  /**
+   * Atomically records 1-50 analytics events after the user has consented to analytics.
+   * @param params - Wallet authentication and events with stable UUIDs and actual millisecond timestamps.
+   * @returns Success only; reuse event IDs on retries. Notification clicks do not mark an inbox item as read.
+   * @throws {WalletNotProvidedError} If neither a linked signer nor a default wallet is configured.
+   * @throws {MobileServerFailureError} If any event, timestamp, batch size, or notification ownership is invalid.
+   */
+  async recordProductEvents(
+    params: MobileRecordProductEventsParams,
+  ): Promise<MobileServerSuccessResponse> {
+    const request = await this.getSignedRequest(
+      'record_product_events',
+      params,
+      { events: params.events.map(mapMobileProductEventToServer) },
+    );
+    return this.execute(request);
+  }
+
   /**
    * Sets whether the signing subaccount follows a Profile. Both directions are idempotent: following again
    * keeps the original relationship creation time, so it does not move the account in recency order, and
@@ -1044,10 +1337,50 @@ export class MobileClient {
       text: params.text,
       mentions: params.mentions.map(mapMobileSocialFeedMentionToServer),
       drawing_data_json: params.drawingDataJson,
+      image_ids: params.imageIds,
+      image_urls: params.imageUrls,
     });
     return mapMobileSocialFeedItem((await this.execute(request)).item);
   }
 
+  /**
+   * Uploads one static JPEG/PNG for a later {@link createFeedPost} via multipart execute.
+   * The whole HTTP request must stay within 2 MiB including signature overhead; upload one file per call
+   * and bind up to nine ready IDs at publication. There is no complete/PUT step — success means ready.
+   * @param params - Author subaccount and signing options, plus the original file bytes.
+   * @returns Ready image metadata, including original and thumbnail paths.
+   * @throws {WalletNotProvidedError} If neither a linked signer nor a default wallet is configured.
+   * @throws {RangeError} If the complete multipart request exceeds {@link MOBILE_FEED_IMAGE_MAX_REQUEST_BYTES}.
+   * @throws {MobileServerFailureError} On authentication, format/size/hash errors (`INVALID_SOCIAL_FEED_IMAGE`),
+   * or when publishing is disabled (`SERVICE_UNAVAILABLE`), or image storage is unavailable
+   * (`SOCIAL_FEED_DATA_UNAVAILABLE`, 6320, HTTP 503).
+   */
+  async createFeedPostImageUpload(
+    params: MobileCreateFeedImageUploadParams,
+  ): Promise<MobileSocialFeedUploadedImage> {
+    return this.createFeedImageUpload('create_feed_post_image_uploads', params);
+  }
+
+  /**
+   * Uploads one static JPEG/PNG for a later {@link createFeedComment} via multipart execute.
+   * Same size and readiness rules as {@link createFeedPostImageUpload}; comment text remains required.
+   * @param params - Author subaccount and signing options, plus the original file bytes.
+   * @returns Ready image metadata, including original and thumbnail paths.
+   * @throws {WalletNotProvidedError} If neither a linked signer nor a default wallet is configured.
+   * @throws {RangeError} If the complete multipart request exceeds {@link MOBILE_FEED_IMAGE_MAX_REQUEST_BYTES}.
+   * @throws {MobileServerFailureError} On authentication, format/size/hash errors (`INVALID_SOCIAL_FEED_IMAGE`),
+   * or when comments are disabled (`SERVICE_UNAVAILABLE`), or image storage is unavailable
+   * (`SOCIAL_FEED_DATA_UNAVAILABLE`, 6320, HTTP 503).
+   */
+  async createFeedCommentImageUpload(
+    params: MobileCreateFeedImageUploadParams,
+  ): Promise<MobileSocialFeedUploadedImage> {
+    return this.createFeedImageUpload(
+      'create_feed_comment_image_uploads',
+      params,
+    );
+  }
+
   /**
    * First attaches a drawing to an owned post or trade card while the author still holds its position.
    * The original JSON is signed unchanged; false and zero are valid drawing documents.
@@ -1119,6 +1452,8 @@ export class MobileClient {
       text: params.text,
       mentions: params.mentions.map(mapMobileSocialFeedMentionToServer),
       attached_position_id: params.attachedPositionId,
+      image_ids: params.imageIds,
+      image_urls: params.imageUrls,
     });
     return mapMobileSocialFeedCommentResult(await this.execute(request));
   }
@@ -1188,6 +1523,27 @@ export class MobileClient {
     return response.data as MobileServerPublicQuerySuccessResponse<T>;
   }
 
+  protected async publicGetBytes(
+    url: string,
+    headers: Record<string, string>,
+  ): Promise<Uint8Array> {
+    const response = await this.axiosInstance.get<ArrayBuffer>(url, {
+      responseType: 'arraybuffer',
+      headers,
+    });
+    if (response.status < 200 || response.status >= 300) {
+      const responseText = bytesToString(new Uint8Array(response.data));
+      let errorData: unknown;
+      try {
+        errorData = JSON.parse(responseText);
+      } catch {
+        errorData = responseText;
+      }
+      this.checkResponseStatus({ ...response, data: errorData });
+    }
+    return new Uint8Array(response.data);
+  }
+
   protected async publicExecute<T extends MobileServerPublicExecuteRequestType>(
     body: { type: T } & MobileServerPublicExecuteRequestByType[T],
   ): Promise<MobileServerPublicExecuteSuccessResponse<T>> {
@@ -1203,14 +1559,43 @@ export class MobileClient {
     return response.data as MobileServerPublicExecuteSuccessResponse<T>;
   }
 
+  /**
+   * Sends an authenticated read through the signed query route.
+   * @param body - Canonical inner payload with its signature, sender, and nonce.
+   * @returns The successful query envelope and its type-specific payload.
+   * @throws {MobileServerFailureError} For a structured service failure, including non-2xx responses.
+   */
+  protected async query<T extends MobileServerSignedQueryRequestType>(
+    body: MobileSignedRequest & { type: T },
+  ): Promise<MobileServerSignedQuerySuccessResponse<T>> {
+    const response = await this.axiosInstance.post<unknown>(
+      `${this.opts.url}/query`,
+      body,
+    );
+    this.checkResponseStatus(response);
+    this.checkServerStatus(response);
+    return response.data as MobileServerSignedQuerySuccessResponse<T>;
+  }
+
   // `T` is inferred from the body's `type` rather than declared by the caller, for the same reason
   // `publicQuery` spells its body out as an intersection: an indexed access is not an inference site.
   protected async execute<T extends MobileServerExecuteRequestType>(
     body: MobileSignedRequest & { type: T },
+    fileBytes?: Uint8Array,
   ): Promise<MobileServerExecuteSuccessResponse<T>> {
+    const multipart =
+      fileBytes == null
+        ? undefined
+        : buildMobileFeedImageMultipart(JSON.stringify(body), fileBytes);
+    if (multipart) {
+      this.checkFeedImageRequestSize(multipart.body.byteLength);
+    }
     const response = await this.axiosInstance.post<MobileServerExecuteResult>(
       `${this.opts.url}/execute`,
-      body,
+      multipart?.body ?? body,
+      multipart
+        ? { headers: { 'Content-Type': multipart.contentType } }
+        : undefined,
     );
 
     this.checkResponseStatus(response);
@@ -1220,6 +1605,46 @@ export class MobileClient {
     return response.data as MobileServerExecuteSuccessResponse<T>;
   }
 
+  private async createFeedImageUpload(
+    type:
+      | 'create_feed_post_image_uploads'
+      | 'create_feed_comment_image_uploads',
+    params: MobileCreateFeedImageUploadParams,
+  ): Promise<MobileSocialFeedUploadedImage> {
+    const nonce = params.nonce ?? getMobileNonce();
+    // Match the signed body's field lengths so oversized requests fail before prompting the wallet.
+    const sizePayload = {
+      type,
+      content_hash: zeroHash,
+      signature: `0x${'00'.repeat(65)}`,
+      sender: subaccountToHex(params),
+      nonce: nonce.toString(),
+    };
+    const overhead = buildMobileFeedImageMultipart(
+      JSON.stringify(sizePayload),
+      new Uint8Array(),
+    ).body.byteLength;
+    this.checkFeedImageRequestSize(overhead + params.fileBytes.byteLength);
+    const contentHash = keccak256(params.fileBytes);
+    const request = await this.getSignedRequest(
+      type,
+      { ...params, nonce },
+      {
+        content_hash: contentHash,
+      },
+    );
+    const data = await this.execute(request, params.fileBytes);
+    return mapMobileSocialFeedUploadedImage(data.image);
+  }
+
+  private checkFeedImageRequestSize(byteLength: number): void {
+    if (byteLength > MOBILE_FEED_IMAGE_MAX_REQUEST_BYTES) {
+      throw new RangeError(
+        `Feed image upload request exceeds ${MOBILE_FEED_IMAGE_MAX_REQUEST_BYTES} bytes (2 MiB).`,
+      );
+    }
+  }
+
   /**
    * Validates the HTTP status before interpreting the body. Unlike the engine, the mobile backend returns
    * failure envelopes with non-2xx statuses (e.g. 404 for `PROFILE_NOT_FOUND`), so a non-2xx response with a