@oxy.so/services 6.2.0 → 8.0.0

package/src/ui/screens/trust/TrustCenterScreen.tsx

@@ -1,7 +1,7 @@
 import type React from 'react';
-import { useEffect, useMemo, useState } from 'react';
+import { useMemo } from 'react';
+import { useQuery } from '@tanstack/react-query';
 import { View, StyleSheet } from 'react-native';
-import type { ReputationTransaction, TrustTier } from '@oxy.so/contracts';
 import Ionicons from '../../icons/Ionicons';
 import { Chip } from '@oxy.so/bloom/chip';
 import { useTheme } from '@oxy.so/bloom/theme';
@@ -14,6 +14,7 @@ import { useI18n } from '../../hooks/useI18n';
 import { useSurfaceHeader } from '../../hooks/useSurfaceHeader';
 import { useOxy } from '../../context/OxyContext';
 import { trustTierLabel } from '@oxy.so/core';
+import { queryKeys } from '../../hooks/queries/queryKeys';
 
 const TrustCenterScreen: React.FC<BaseScreenProps> = ({
     navigate,
@@ -22,36 +23,31 @@ const TrustCenterScreen: React.FC<BaseScreenProps> = ({
     // when switched, else the personal user).
     const { user, oxyServices, isAuthenticated } = useOxy();
     const { t, locale } = useI18n();
-    const [reputationTotal, setReputationTotal] = useState<number | null>(null);
-    const [trustTier, setTrustTier] = useState<TrustTier | null>(null);
-    const [transactions, setTransactions] = useState<ReputationTransaction[]>([]);
-    const [isLoading, setIsLoading] = useState(true);
-    const [error, setError] = useState<string | null>(null);
-
     const bloomTheme = useTheme();
     const primaryColor = bloomTheme.colors.primary;
 
-    useEffect(() => {
-        if (!user) return;
-        setIsLoading(true);
-        setError(null);
-        Promise.all([
-            oxyServices.getMyReputationBalance(),
-            oxyServices.getReputationTransactions(user.id, 20, 0),
-        ])
-            .then(([balance, txns]) => {
-                setReputationTotal(balance.total);
-                setTrustTier(balance.trustTier);
-                setTransactions(Array.isArray(txns) ? txns : []);
-            })
-            .catch((err: unknown) => {
-                setError(
-                    (err instanceof Error ? err.message : null) ||
-                        (t('trust.center.loadError') || 'Failed to load reputation data'),
-                );
-            })
-            .finally(() => setIsLoading(false));
-    }, [user, oxyServices, t]);
+    // Keyed on the account id, not the `user` object: a profile write that
+    // replaces `user` must not refetch the ledger.
+    const userId = user?.id;
+    const standing = useQuery({
+        queryKey: queryKeys.reputation.transactions(userId, 20),
+        enabled: Boolean(userId),
+        queryFn: async () => {
+            const [balance, transactions] = await Promise.all([
+                oxyServices.reputation.balance(),
+                oxyServices.reputation.transactions(userId, { limit: 20, offset: 0 }),
+            ]);
+            return { balance, transactions: Array.isArray(transactions) ? transactions : [] };
+        },
+    });
+    const reputationTotal = standing.data?.balance.total ?? null;
+    const trustTier = standing.data?.balance.trustTier ?? null;
+    const transactions = standing.data?.transactions ?? [];
+    const isLoading = standing.isPending && Boolean(userId);
+    const error = standing.error
+        ? (standing.error instanceof Error ? standing.error.message : null) ||
+          (t('trust.center.loadError') || 'Failed to load reputation data')
+        : null;
 
     const resolvedTrustTierLabel = useMemo(
         () => (trustTier ? trustTierLabel(locale, trustTier) : null),

package/src/ui/screens/trust/TrustLeaderboardScreen.tsx

@@ -41,7 +41,7 @@ const TrustLeaderboardScreen: React.FC<BaseScreenProps> = ({ navigate }) => {
         setIsLoading(true);
         setError(null);
         oxyServices
-            .getReputationLeaderboard()
+            .reputation.leaderboard()
             .then((data) => setLeaderboard(Array.isArray(data) ? data : []))
             .catch((err: unknown) => {
                 logger.error(
@@ -95,7 +95,7 @@ const TrustLeaderboardScreen: React.FC<BaseScreenProps> = ({ navigate }) => {
                         {item.rank}
                     </Text>
                     <Avatar
-                        source={item.user.avatar ? oxyServices.getFileDownloadUrl(item.user.avatar, 'thumb') : undefined}
+                        source={item.user.avatar ? oxyServices.assets.publicUrl(item.user.avatar, 'thumb') : undefined}
                         name={displayName}
                         size={AVATAR_SIZE}
                     />

package/src/ui/screens/trust/TrustRewardsScreen.tsx

@@ -1,5 +1,6 @@
 import type React from 'react';
-import { useMemo, useState, useEffect } from 'react';
+import { useMemo } from 'react';
+import { useQuery } from '@tanstack/react-query';
 import { View, StyleSheet } from 'react-native';
 import type { BaseScreenProps } from '../../types/navigation';
 import { useSurfaceHeader } from '../../hooks/useSurfaceHeader';
@@ -8,6 +9,7 @@ import { useTheme } from '@oxy.so/bloom/theme';
 import { H1, H4, H5, Text } from '@oxy.so/bloom/typography';
 import { useI18n } from '../../hooks/useI18n';
 import { useOxy } from '../../context/OxyContext';
+import { queryKeys } from '../../hooks/queries/queryKeys';
 import { darkenColor, lightenColor } from '../../utils/colorUtils';
 
 type IoniconName = React.ComponentProps<typeof Ionicons>['name'];
@@ -85,28 +87,16 @@ const TrustRewardsScreen: React.FC<BaseScreenProps> = () => {
         title: t('trust.rewards.title') || 'Trust Rewards',
         subtitle: t('trust.rewards.subtitle') || 'Unlock special features and recognition',
     });
-    const [reputationTotal, setReputationTotal] = useState<number>(0);
-    const [, setIsLoading] = useState(true);
+    const balance = useQuery({
+        queryKey: queryKeys.reputation.balance(user?.id),
+        enabled: Boolean(user?.id) && isAuthenticated,
+        queryFn: () => oxyServices.reputation.balance(),
+    });
+    const reputationTotal = balance.data?.total || 0;
 
     const bloomTheme = useTheme();
     const colors = bloomTheme.colors;
 
-    useEffect(() => {
-        if (!user || !isAuthenticated) {
-            setIsLoading(false);
-            return;
-        }
-        setIsLoading(true);
-        oxyServices.getMyReputationBalance()
-            .then((balance) => {
-                setReputationTotal(balance.total || 0);
-            })
-            .catch(() => {
-                setReputationTotal(0);
-            })
-            .finally(() => setIsLoading(false));
-    }, [user, isAuthenticated, oxyServices]);
-
     const achievements: Achievement[] = useMemo(() => [
         {
             id: 'first-step',

package/src/ui/screens/trust/TrustRulesScreen.tsx

@@ -1,5 +1,6 @@
 import type React from 'react';
-import { useEffect, useMemo, useState } from 'react';
+import { useMemo } from 'react';
+import { useQuery } from '@tanstack/react-query';
 import { View } from 'react-native';
 import { Text } from '@oxy.so/bloom/typography';
 import { SettingsListGroup, SettingsListItem } from '@oxy.so/bloom/settings-list';
@@ -12,6 +13,7 @@ import { useSurfaceHeader } from '../../hooks/useSurfaceHeader';
 import { Loading } from '@oxy.so/bloom/loading';
 import { useI18n } from '../../hooks/useI18n';
 import { useOxy } from '../../context/OxyContext';
+import { queryKeys } from '../../hooks/queries/queryKeys';
 
 /** Stable display order for rule category sections. */
 const CATEGORY_ORDER: ReputationCategory[] = [
@@ -34,18 +36,16 @@ const TrustRulesScreen: React.FC<BaseScreenProps> = () => {
     });
     const bloomTheme = useTheme();
 
-    const [rules, setRules] = useState<ReputationRule[]>([]);
-    const [isLoading, setIsLoading] = useState(true);
-    const [error, setError] = useState<string | null>(null);
-
-    useEffect(() => {
-        setIsLoading(true);
-        setError(null);
-        oxyServices.getReputationRules()
-            .then((data) => setRules(Array.isArray(data) ? data : []))
-            .catch((err: unknown) => setError((err instanceof Error ? err.message : null) || 'Failed to load rules'))
-            .finally(() => setIsLoading(false));
-    }, [oxyServices]);
+    const rulesQuery = useQuery({
+        queryKey: queryKeys.reputation.rules(),
+        queryFn: () => oxyServices.reputation.rules(),
+        staleTime: 10 * 60 * 1000,
+    });
+    const rules: ReputationRule[] = Array.isArray(rulesQuery.data) ? rulesQuery.data : [];
+    const isLoading = rulesQuery.isPending;
+    const error = rulesQuery.error
+        ? (rulesQuery.error instanceof Error ? rulesQuery.error.message : null) || 'Failed to load rules'
+        : null;
 
     // Group rules by category, preserving a stable section order. Categories
     // with no rules are dropped; unknown categories fall back to "other".
@@ -88,7 +88,7 @@ const TrustRulesScreen: React.FC<BaseScreenProps> = () => {
                             >
                                 {items.map((rule) => (
                                     <SettingsListItem
-                                        key={rule.id}
+                                        key={rule.actionType}
                                         title={rule.description}
                                         showChevron={false}
                                         rightElement={

package/src/ui/session/__tests__/authStore.test.ts

@@ -7,7 +7,7 @@
  * background persist inside the vault can never change which session five other
  * apps boot into.
  */
-import type { AuthStateStore } from '@oxy.so/core';
+import type { AuthStateStore } from '@oxy.so/core/session';
 
 const CRED_STATE = { sessionId: 'sess-1', userId: 'user-1', deviceId: 'dev-1', deviceSecret: 'ds-1' };
 

package/src/ui/session/__tests__/backgroundSession.test.ts

@@ -45,8 +45,8 @@ function fakeOxy(
   baseURL = 'https://api.oxy.so',
 ): Parameters<typeof import('../backgroundSession').syncBackgroundSession>[0]['oxyServices'] {
   return {
-    provisionBackgroundCredential: provision,
-    getBaseURL: () => baseURL,
+    devices: { provisionBackgroundCredential: provision },
+    baseURL: baseURL,
   } as unknown as Parameters<
     typeof import('../backgroundSession').syncBackgroundSession
   >[0]['oxyServices'];
@@ -270,65 +270,6 @@ describe('syncBackgroundSession', () => {
   });
 });
 
-describe('a @oxy.so/core too old to provision', () => {
-  /**
-   * The ONE failure that must not be quiet. Every other failure here is caught and
-   * logged at warn, which is right for a flaky network — but a version skew means
-   * background refreshes never work at all, and hiding that behind a warning is how
-   * it would go unnoticed indefinitely.
-   */
-  function oxyWithoutProvisioning(): Parameters<
-    typeof import('../backgroundSession').syncBackgroundSession
-  >[0]['oxyServices'] {
-    return { getBaseURL: () => 'https://api.oxy.so' } as unknown as Parameters<
-      typeof import('../backgroundSession').syncBackgroundSession
-    >[0]['oxyServices'];
-  }
-
-  test('rejects loudly and logs at error rather than warning quietly', async () => {
-    const native = fakeNative(null);
-    const { syncBackgroundSession } = await loadModule(native);
-    const { logger } = await import('@oxy.so/core');
-    const errorSpy = jest.spyOn(logger, 'error').mockImplementation(() => undefined);
-    const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
-
-    try {
-      await expect(
-        syncBackgroundSession({
-          oxyServices: oxyWithoutProvisioning(),
-          userId: 'user-1',
-          canUsePrivateApi: true,
-          isCurrent: () => true,
-        }),
-      ).rejects.toThrow(/provisionBackgroundCredential/);
-
-      expect(errorSpy).toHaveBeenCalledTimes(1);
-      // If this ever becomes a warn, the skew is silent again.
-      expect(warnSpy).not.toHaveBeenCalled();
-      expect(native.put).not.toHaveBeenCalled();
-    } finally {
-      errorSpy.mockRestore();
-      warnSpy.mockRestore();
-    }
-  });
-
-  test('still lets a signed-out user clear, since that needs no core method', async () => {
-    const native = fakeNative({ accountId: 'user-1', expiresAt: Date.now() + 30 * DAY_MS });
-    const { syncBackgroundSession } = await loadModule(native);
-
-    // A sign-out must never be blocked by a dependency problem.
-    await expect(
-      syncBackgroundSession({
-        oxyServices: oxyWithoutProvisioning(),
-        userId: null,
-        canUsePrivateApi: false,
-        isCurrent: () => true,
-      }),
-    ).resolves.toBeUndefined();
-    expect(native.clear).toHaveBeenCalledTimes(1);
-  });
-});
-
 describe('on web', () => {
   /**
    * Web must never provision. The credential is non-rotating and long-lived, which

package/src/ui/session/__tests__/createSessionClient.test.ts

@@ -1,4 +1,4 @@
-import { SessionClient } from '@oxy.so/core';
+import { SessionClient } from '@oxy.so/core/session';
 
 type Handler = (...args: unknown[]) => void;
 class FakeSocket {
@@ -20,14 +20,12 @@ import { createSessionClient } from '../createSessionClient';
 function fakeOxy() {
   const listeners = new Set<(t: string | null) => void>();
   return {
-    makeRequest: jest.fn().mockResolvedValue(undefined),
-    getBaseURL: jest.fn().mockReturnValue('https://api.oxy.so'),
-    getAccessToken: jest.fn().mockReturnValue('bearer.jwt.token'),
-    setTokens: jest.fn(),
-    onTokensChanged: jest.fn((l: (t: string | null) => void) => {
+    request: jest.fn().mockResolvedValue(undefined),
+    baseURL: 'https://api.oxy.so',
+    session: { accessToken: 'bearer.jwt.token', setAccessToken: jest.fn(), onChange: jest.fn((l: (t: string | null) => void) => {
       listeners.add(l);
       return () => listeners.delete(l);
-    }),
+    }) },
   };
 }
 
@@ -93,7 +91,7 @@ describe('createSessionClient', () => {
     const { client } = createSessionClient(oxy as never, undefined, () => 'pinned-account');
     await client.registerAndActivate('pinned-account');
 
-    const paths = oxy.makeRequest.mock.calls.map((call) => call[1]);
+    const paths = oxy.request.mock.calls.map((call) => call[1]);
     expect(paths).toContain('/session/device/add');
     expect(paths).not.toContain('/session/device/switch');
   });
@@ -104,7 +102,7 @@ describe('createSessionClient', () => {
     const { client } = createSessionClient(oxy as never, undefined, () => null);
     await client.registerAndActivate('u1');
 
-    const paths = oxy.makeRequest.mock.calls.map((call) => call[1]);
+    const paths = oxy.request.mock.calls.map((call) => call[1]);
     expect(paths).toContain('/session/device/add');
     expect(paths).toContain('/session/device/switch');
   });

package/src/ui/session/__tests__/sharedDeviceCredentialStore.test.ts

@@ -8,7 +8,7 @@
  * explicit status. Collapsing either failure into "absent" is what would let a
  * locked device look like one that never had a session.
  */
-import type { SharedDeviceCredentialStore } from '@oxy.so/core';
+import type { SharedDeviceCredentialStore } from '@oxy.so/core/session';
 
 const CRED = { deviceId: 'dev-shared', deviceSecret: 'ds-shared' };
 const STORAGE_KEY = 'oxy_shared_device_session_v1';

package/src/ui/session/__tests__/tokenTransport.test.ts

@@ -3,7 +3,7 @@ import { logger } from '@oxy.so/core';
 import { createTokenTransport } from '../tokenTransport';
 
 // The device-first transport no longer owns a private mint single-flight: it
-// routes through the ONE shared `oxyServices.httpService.refreshAccessToken(...)`
+// routes through the ONE shared `oxyServices.http.refreshAccessToken(...)`
 // the scheduler/preflight/401 use, so concurrent lanes can never double-rotate
 // the device secret. It short-circuits ONLY when the planted bearer already
 // identifies the state's active account — a bearer for a DIFFERENT account (an
@@ -11,9 +11,11 @@ import { createTokenTransport } from '../tokenTransport';
 // that account-match contract and the transport's error/swallow behavior.
 
 function fakeOxy(currentUserId: string | null, refreshAccessToken = jest.fn(async () => 'minted-token')) {
+  const userId = jest.fn((): string | null => currentUserId);
   return {
-    getCurrentUserId: jest.fn().mockReturnValue(currentUserId),
-    httpService: { refreshAccessToken },
+    userId,
+    session: { get userId() { return userId(); } },
+    http: { refreshAccessToken },
   };
 }
 
@@ -49,7 +51,7 @@ describe('createTokenTransport', () => {
     expect(refreshAccessToken).toHaveBeenCalledWith('preflight');
   });
 
-  test('mints via the shared httpService.refreshAccessToken single-flight when no bearer is present', async () => {
+  test('mints via the shared http.refreshAccessToken single-flight when no bearer is present', async () => {
     const refreshAccessToken = jest.fn(async () => 'minted-token');
     const oxy = fakeOxy(null, refreshAccessToken);
     const transport = createTokenTransport(oxy as never);
@@ -90,7 +92,7 @@ describe('createTokenTransport', () => {
 
   test('delegates concurrent calls to the shared single-flight (no private guard of its own)', async () => {
     // The transport keeps NO local coalescing — it forwards each call to the
-    // shared `httpService.refreshAccessToken`, which owns the single-flight that
+    // shared `http.refreshAccessToken`, which owns the single-flight that
     // collapses concurrent mints into one server rotation (covered in core).
     const refreshAccessToken = jest.fn(async () => 'minted-token');
     const oxy = fakeOxy(null, refreshAccessToken);
@@ -126,7 +128,7 @@ describe('createTokenTransport', () => {
     });
 
     expect(refreshAccessToken).not.toHaveBeenCalled();
-    expect(oxy.getCurrentUserId).not.toHaveBeenCalled();
+    expect(oxy.userId).not.toHaveBeenCalled();
   });
 
   test('a resolver reporting no pin (every account-mode provider) behaves exactly as an absent one', async () => {
@@ -143,7 +145,7 @@ describe('createTokenTransport', () => {
   test('treats a throwing bearer-account check as a mismatch and still mints', async () => {
     const refreshAccessToken = jest.fn(async () => 'minted-token');
     const oxy = fakeOxy(null, refreshAccessToken);
-    oxy.getCurrentUserId.mockImplementation(() => {
+    oxy.userId.mockImplementation(() => {
       throw new Error('storage unavailable');
     });
     const transport = createTokenTransport(oxy as never);

package/src/ui/session/authStore.ts

@@ -19,13 +19,7 @@
  * for the Commons identity key. The mirror is additive — it can neither change
  * nor fail the app's own durable write.
  */
-import {
-  createWebAuthStateStore,
-  createNativeAuthStateStore,
-  createSharedMirroringAuthStateStore,
-  type AuthStateStore,
-  type SessionMode,
-} from '@oxy.so/core';
+import { createWebAuthStateStore, createNativeAuthStateStore, createSharedMirroringAuthStateStore, type AuthStateStore, type SessionMode } from '@oxy.so/core/session';
 import { isReactNative } from '../utils/storageHelpers';
 import { createNativeSecureKeyValueStorage } from './nativeSecureStorage';
 import { createPlatformSharedDeviceCredentialStore } from './sharedDeviceCredentialStore';

package/src/ui/session/backgroundSession.ts

@@ -181,34 +181,6 @@ export interface BackgroundSessionSyncInput {
   isCurrent: () => boolean;
 }
 
-/**
- * Fail LOUDLY when the installed `@oxy.so/core` predates
- * `provisionBackgroundCredential`.
- *
- * This is the one failure here that is a build/dependency mistake rather than a
- * runtime condition, and it is the one that must never be quiet. Everything else
- * in `syncBackgroundSession` is caught and logged at warn, which is right for a
- * flaky network — but applying that to a version skew would leave background
- * refreshes permanently non-functional behind a warning nobody reads. So this
- * throws, and logs at ERROR first so it is still visible in a release build whose
- * rejection handler is silent.
- *
- * Reachable only through a runtime skew: the declared `@oxy.so/core` range covers
- * the method, so a correctly-resolved install cannot get here, and TypeScript
- * rules it out at compile time.
- */
-function assertProvisioningAvailable(oxyServices: OxyServices): void {
-  if (typeof oxyServices.provisionBackgroundCredential === 'function') {
-    return;
-  }
-  const message =
-    '[backgroundSession] the installed @oxy.so/core has no provisionBackgroundCredential, ' +
-    'so no background credential can be provisioned and native background refreshes will ' +
-    'never authenticate. Install a @oxy.so/core that satisfies this package\'s declared range.';
-  logger.error(message, undefined, { component: 'backgroundSession' });
-  throw new Error(message);
-}
-
 /**
  * Bring the native credential in line with the session JS currently holds.
  *
@@ -220,10 +192,9 @@ function assertProvisioningAvailable(oxyServices: OxyServices): void {
  * account), so this is the fast local half of a belt-and-braces pair, not the only
  * guard.
  *
- * Throws for exactly one thing — a `@oxy.so/core` too old to provision (see
- * {@link assertProvisioningAvailable}). Every other failure is caught and logged:
- * a background credential is an enhancement, and failing to provision one must
- * not disturb the session that is working.
+ * Every failure is caught and logged: a background credential is an
+ * enhancement, and failing to provision one must not disturb the session that
+ * is working.
  */
 export async function syncBackgroundSession(input: BackgroundSessionSyncInput): Promise<void> {
   const native = loadNativeModule();
@@ -232,13 +203,6 @@ export async function syncBackgroundSession(input: BackgroundSessionSyncInput):
   }
   const { oxyServices, userId, canUsePrivateApi, isCurrent } = input;
 
-  // Before the try, so the catch below cannot turn a dependency skew into a
-  // warning. Signed-out is exempt: clearing needs no core method, and a sign-out
-  // must never be blocked by one.
-  if (userId) {
-    assertProvisioningAvailable(oxyServices);
-  }
-
   try {
     if (!userId) {
       // Signed out. Local-only, so it works with no bearer and no network.
@@ -266,7 +230,7 @@ export async function syncBackgroundSession(input: BackgroundSessionSyncInput):
       return;
     }
 
-    const provisioned = await oxyServices.provisionBackgroundCredential();
+    const provisioned = await oxyServices.devices.provisionBackgroundCredential();
     if (!provisioned) {
       // `null` means the endpoint is not deployed yet. Expected during the
       // rollout window (api leads the SDK) and deliberately quiet.
@@ -292,7 +256,7 @@ export async function syncBackgroundSession(input: BackgroundSessionSyncInput):
     }
 
     const persisted = await native.put(
-      oxyServices.getBaseURL(),
+      oxyServices.baseURL,
       provisioned.deviceId,
       provisioned.secret,
       provisioned.accountId,

package/src/ui/session/createSessionClient.ts

@@ -1,9 +1,5 @@
-import {
-  SessionClient,
-  createSessionClientHost,
-  type OxyServices,
-  type SessionStateOrigin,
-} from '@oxy.so/core';
+import { SessionClient, createSessionClientHost, type SessionStateOrigin } from '@oxy.so/core/session';
+import type { OxyServices } from '@oxy.so/core';
 import { createTokenTransport } from './tokenTransport';
 
 /**

package/src/ui/session/deviceCredentialTracker.ts

@@ -0,0 +1,49 @@
+/**
+ * A synchronous answer to "does this origin hold a device credential?".
+ *
+ * The browser bridge (ADR 0029 D2) must decide INSIDE the sign-in press whether
+ * to open its window — a window opened after an `await` is blocked by every
+ * browser — but the auth store is async. This wrapper remembers the credential
+ * every load, save and clear passes through, so the press can read it at once.
+ * The cold boot loads the store on mount, long before anyone presses sign-in.
+ */
+import type { AuthStateStore } from '@oxy.so/core/session';
+
+export interface HeldDeviceCredential {
+  deviceId: string;
+  deviceSecret: string;
+}
+
+export interface CredentialTrackingAuthStateStore extends AuthStateStore {
+  /**
+   * The credential last seen through this store; `undefined` until the store has
+   * been read at least once (unknown — the caller should not guess).
+   */
+  heldDeviceCredential(): HeldDeviceCredential | null | undefined;
+}
+
+function credentialOf(state: { deviceId?: string; deviceSecret?: string } | null): HeldDeviceCredential | null {
+  return state?.deviceId && state.deviceSecret
+    ? { deviceId: state.deviceId, deviceSecret: state.deviceSecret }
+    : null;
+}
+
+export function trackDeviceCredential(store: AuthStateStore): CredentialTrackingAuthStateStore {
+  let held: HeldDeviceCredential | null | undefined;
+  return {
+    load: async () => {
+      const state = await store.load();
+      held = credentialOf(state);
+      return state;
+    },
+    save: async (state) => {
+      held = credentialOf(state);
+      return store.save(state);
+    },
+    clear: async () => {
+      held = null;
+      await store.clear();
+    },
+    heldDeviceCredential: () => held,
+  };
+}

package/src/ui/session/identityBinding.ts

@@ -16,12 +16,7 @@
  * resolves it before the cold boot and after every (re-)established identity
  * session; every read after that is free.
  */
-import {
-  createNativeIdentityPinStore,
-  createWebIdentityPinStore,
-  resolveIdentityPin,
-  type IdentityBinding,
-} from '@oxy.so/core';
+import { createNativeIdentityPinStore, createWebIdentityPinStore, resolveIdentityPin, type IdentityBinding } from '@oxy.so/core/session';
 import { isReactNative } from '../utils/storageHelpers';
 import { createNativeSecureKeyValueStorage } from './nativeSecureStorage';
 

package/src/ui/session/index.ts

@@ -22,4 +22,4 @@ export {
   activeSessionIdOf,
   activeUserOf,
   deviceStateToClientSessions,
-} from '@oxy.so/core';
+} from '@oxy.so/core/session';

package/src/ui/session/nativeSecureStorage.ts

@@ -14,7 +14,7 @@
  * controller), so the web bundle never pulls it and a device without it falls
  * back to AsyncStorage rather than crashing.
  */
-import type { NativeKeyValueStorage } from '@oxy.so/core';
+import type { NativeKeyValueStorage } from '@oxy.so/core/session';
 import { createPlatformStorage } from '../utils/storageHelpers';
 
 // Variable indirection so Metro's static analyzer never traces expo-secure-store

package/src/ui/session/sharedDeviceCredentialStore.ts

@@ -39,12 +39,7 @@
  */
 import { Platform } from 'react-native';
 import { requireOptionalNativeModule } from 'expo-modules-core';
-import {
-  normalizeSharedDeviceSessionRead,
-  type SharedDeviceCredential,
-  type SharedDeviceCredentialRead,
-  type SharedDeviceCredentialStore,
-} from '@oxy.so/core';
+import { normalizeSharedDeviceSessionRead, type SharedDeviceCredential, type SharedDeviceCredentialRead, type SharedDeviceCredentialStore } from '@oxy.so/core/session';
 
 /**
  * The iOS Keychain Access Group every official Oxy app declares in its

package/src/ui/session/tokenTransport.ts

@@ -1,4 +1,5 @@
-import { logger, type OxyServices, type TokenTransport } from '@oxy.so/core';
+import { logger, type OxyServices } from '@oxy.so/core';
+import type { TokenTransport } from '@oxy.so/core/session';
 import type { DeviceSessionState } from '@oxy.so/contracts';
 
 /**
@@ -8,7 +9,7 @@ import type { DeviceSessionState } from '@oxy.so/contracts';
  * push arrived WITHOUT an embedded `activeToken` and the planted bearer does not
  * already belong to the state's active account. It mints one through the ONE
  * unified single-flight the scheduler, the request-time preflight, and the 401
- * retry all use — `oxyServices.httpService.refreshAccessToken(...)` — which runs
+ * retry all use — `oxyServices.http.refreshAccessToken(...)` — which runs
  * the installed refresh handler (present the persisted zero-cookie `deviceId` +
  * `deviceSecret` at `POST /session/device/token`, which mints for the device's
  * CURRENT active account). Routing through the SAME entry point means this lane
@@ -45,7 +46,7 @@ export function createTokenTransport(
         // active account. `getCurrentUserId()` decodes the bearer's `userId`/`id`
         // (null when absent/opaque), directly comparable to the account id.
         const activeAccountId = state.activeAccountId;
-        if (activeAccountId !== null && oxyServices.getCurrentUserId() === activeAccountId) {
+        if (activeAccountId !== null && oxyServices.session.userId === activeAccountId) {
           return;
         }
       } catch (error) {
@@ -55,7 +56,7 @@ export function createTokenTransport(
       try {
         // The shared HttpService single-flight coalesces concurrent callers onto
         // one in-flight mint; no local `inFlightMint` guard is needed.
-        const token = await oxyServices.httpService.refreshAccessToken('preflight');
+        const token = await oxyServices.http.refreshAccessToken('preflight');
         if (!token) {
           logger.debug('ensureActiveToken: refresh produced no session', {
             component: 'TokenTransport',