@oxyhq/core 10.1.5 → 11.0.0

package/dist/esm/boot/sessionColdBoot.js

@@ -22,7 +22,7 @@
  */
 import { runColdBoot } from '../utils/coldBoot.js';
 import { isNative as detectNative } from '../utils/platform.js';
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 import { TOKEN_REFRESH_LEAD_MS, refreshDeviceSecretArm } from '../session/refresh.js';
 /**
  * Run the device-first cold boot. Resolves to the `runColdBoot` outcome and, as

package/dist/esm/crypto/keyManager.js

@@ -8,8 +8,7 @@ import _cjs_elliptic from 'elliptic';
 const { ec: EC } = _cjs_elliptic;
 import { isWeb, isIOS, isAndroid } from '../utils/platform.js';
 import { isReactNative, isNodeJS, loadExpoCrypto, loadNodeCrypto, loadSecureStore, loadSharedIdentityBridge } from '@oxyhq/protocol';
-import { logger } from '../utils/loggerUtils.js';
-import { isDev } from '../shared/utils/debugUtils.js';
+import { isDev, logger } from '../logger/index.js';
 /**
  * Thrown when an identity-mutating operation (createIdentity / importKeyPair)
  * is invoked while a valid identity already exists on the device.

package/dist/esm/crypto/signatureService.js

@@ -9,7 +9,7 @@
  */
 import { signEnvelope, signMessage, verifySignature, sha256, loadExpoCrypto, loadNodeCrypto, isReactNative, isNodeJS, } from '@oxyhq/protocol';
 import { KeyManager } from './keyManager.js';
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 export class SignatureService {
     /**
      * Generate a random challenge string (for offline use)

package/dist/esm/index.js

@@ -90,7 +90,6 @@ export { normalizeTheme, normalizeColorScheme, getOppositeTheme, systemPrefersDa
 // ---------------------------------------------------------------------------
 export { HttpStatus, getErrorStatus, getErrorMessage, isAlreadyRegisteredError, isUnauthorizedError, isForbiddenError, isNotFoundError, isRateLimitError, isServerError, isNetworkError, isRetryableError, } from './shared/utils/errorUtils.js';
 export { DEFAULT_CIRCUIT_BREAKER_CONFIG, createCircuitBreakerState, calculateBackoffInterval, recordFailure, recordSuccess, shouldAllowRequest, delay, withRetry, } from './shared/utils/networkUtils.js';
-export { isDev, debugLog, debugWarn, debugError, createDebugLogger, } from './shared/utils/debugUtils.js';
 // ---------------------------------------------------------------------------
 // i18n
 // ---------------------------------------------------------------------------
@@ -110,9 +109,9 @@ export { EMAIL_REGEX, USERNAME_REGEX, PASSWORD_REGEX, isValidEmail, isValidUsern
 // ---------------------------------------------------------------------------
 export { normalizeInlineText, normalizeMultilineText, } from './utils/textNormalization.js';
 // ---------------------------------------------------------------------------
-// Logging
+// Logging — the ecosystem-wide chokepoint (also at subpath `@oxyhq/core/logger`)
 // ---------------------------------------------------------------------------
-export { logger, LogLevel, logAuth, logApi, logSession, logUser, logDevice, logPayment, logPerformance, } from './utils/loggerUtils.js';
+export { logger, createLogger, configureLogger, getLoggerConfig, resetLoggerConfig, consoleSink, isDev, } from './logger/index.js';
 // ---------------------------------------------------------------------------
 // Avatars
 // ---------------------------------------------------------------------------

package/dist/esm/logger/index.js

@@ -0,0 +1,140 @@
+/**
+ * @oxyhq/core/logger — the ecosystem-wide logging chokepoint.
+ *
+ * A tiny, dependency-free, universal logger that works unchanged in React
+ * Native, browsers, Node, and Bun. Every Oxy app and package should log
+ * through here instead of calling `console.*` directly, so that level,
+ * formatting, and transport are controlled in ONE place.
+ *
+ * Design goals:
+ *  - Zero dependencies. No Node-only imports, no `process.stdout` assumptions.
+ *  - Four levels (`debug` | `info` | `warn` | `error`) plus `silent`.
+ *  - Namespaced child loggers via `createLogger('mention:feed')` / `.child()`.
+ *  - Structured context objects carried through to the sink.
+ *  - A single pluggable sink so backends can pipe to pino / CloudWatch / etc.
+ *    without touching any call site.
+ *  - Debug is off in production by default (`__DEV__` on RN, `NODE_ENV`
+ *    elsewhere); override globally with `configureLogger({ level })`.
+ *
+ * @module logger
+ */
+const LEVEL_WEIGHT = {
+    silent: 0,
+    error: 1,
+    warn: 2,
+    info: 3,
+    debug: 4,
+};
+/**
+ * True in development. Uses React Native's `__DEV__` when present, otherwise
+ * falls back to `process.env.NODE_ENV === 'development'`. Never throws.
+ */
+export function isDev() {
+    if (typeof __DEV__ !== 'undefined')
+        return __DEV__ === true;
+    try {
+        return typeof process !== 'undefined' && process.env?.NODE_ENV === 'development';
+    }
+    catch {
+        return false;
+    }
+}
+function formatPrefix(entry) {
+    const parts = [entry.timestamp, entry.level.toUpperCase()];
+    if (entry.namespace)
+        parts.push(`[${entry.namespace}]`);
+    return parts.join(' ');
+}
+/**
+ * Default sink: routes each entry to the matching `console` method. `info` and
+ * `debug` go to `console.log` (RN/browser-safe — `console.debug`/`console.info`
+ * are inconsistently surfaced across runtimes).
+ */
+export const consoleSink = (entry) => {
+    const extras = [];
+    if (entry.context && Object.keys(entry.context).length > 0)
+        extras.push(entry.context);
+    if (entry.error !== undefined)
+        extras.push(entry.error);
+    if (entry.args.length > 0)
+        extras.push(...entry.args);
+    const line = `${formatPrefix(entry)} ${entry.message}`;
+    if (entry.level === 'error')
+        console.error(line, ...extras);
+    else if (entry.level === 'warn')
+        console.warn(line, ...extras);
+    else
+        console.log(line, ...extras);
+};
+function defaultLevel() {
+    return isDev() ? 'debug' : 'info';
+}
+const config = {
+    level: defaultLevel(),
+    sink: consoleSink,
+};
+/**
+ * Update the global logger configuration. Affects every logger instance
+ * (root and children) immediately. Pass `{ level }` to gate output and/or
+ * `{ sink }` to redirect transport (pino, CloudWatch, a test capture, …).
+ */
+export function configureLogger(partial) {
+    if (partial.level !== undefined)
+        config.level = partial.level;
+    if (partial.sink !== undefined)
+        config.sink = partial.sink;
+}
+/** Read a snapshot of the current global configuration. */
+export function getLoggerConfig() {
+    return { level: config.level, sink: config.sink };
+}
+/** Restore the default level (env-derived) and the console sink. */
+export function resetLoggerConfig() {
+    config.level = defaultLevel();
+    config.sink = consoleSink;
+}
+function mergeContext(base, extra) {
+    if (!base)
+        return extra;
+    if (!extra)
+        return base;
+    return { ...base, ...extra };
+}
+function emit(level, namespace, baseContext, message, error, context, args) {
+    if (LEVEL_WEIGHT[level] > LEVEL_WEIGHT[config.level])
+        return;
+    config.sink({
+        level,
+        message,
+        namespace,
+        context: mergeContext(baseContext, context),
+        error,
+        args,
+        timestamp: new Date().toISOString(),
+    });
+}
+function makeLogger(namespace, baseContext) {
+    return {
+        namespace,
+        debug: (message, context, ...args) => emit('debug', namespace, baseContext, message, undefined, context, args),
+        info: (message, context, ...args) => emit('info', namespace, baseContext, message, undefined, context, args),
+        warn: (message, context, ...args) => emit('warn', namespace, baseContext, message, undefined, context, args),
+        error: (message, error, context, ...args) => emit('error', namespace, baseContext, message, error, context, args),
+        child: (childNamespace, childContext) => makeLogger(namespace ? `${namespace}:${childNamespace}` : childNamespace, mergeContext(baseContext, childContext)),
+    };
+}
+/** The shared root logger. Prefer a namespaced `createLogger(...)` in modules. */
+export const logger = makeLogger(undefined, undefined);
+/**
+ * Create a namespaced logger.
+ *
+ * @example
+ * ```ts
+ * const log = createLogger('mention:feed');
+ * log.info('loaded', { count: 20 });
+ * const sub = log.child('prefetch'); // namespace → 'mention:feed:prefetch'
+ * ```
+ */
+export function createLogger(namespace, context) {
+    return makeLogger(namespace, context);
+}

package/dist/esm/mixins/OxyServices.assets.js

@@ -1,5 +1,5 @@
 import { isReactNative } from '@oxyhq/protocol';
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
 /**
  * Maximum number of ids sent per `POST /assets/service/by-ids` request. Matches
@@ -359,7 +359,7 @@ export function OxyServicesAssetsMixin(Base) {
                 return response;
             }
             catch (error) {
-                console.error('File upload error:', error);
+                logger.error('File upload error', error, { component: 'OxyServices.assets' });
                 let errorMessage = 'File upload failed';
                 if (error instanceof Error) {
                     errorMessage = error.message || errorMessage;

package/dist/esm/mixins/OxyServices.auth.js

@@ -3,7 +3,7 @@ import { OxyAuthenticationError } from '../OxyServices.errors.js';
 import { KeyManager } from '../crypto/keyManager.js';
 import { SignatureService } from '../crypto/signatureService.js';
 import { loadNodeCrypto } from '@oxyhq/protocol';
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 import { normalizeUserIdentity, normalizeUserIdentityOrNull } from '../utils/userIdentity.js';
 /**
  * Default lifetime of a "Sign in with Oxy" device-flow session / authorize code.

package/dist/esm/mixins/OxyServices.language.js

@@ -3,7 +3,7 @@
  */
 import { normalizeLocale, getPrimaryLanguage, getLanguageMetadata, getLanguageName, getNativeLanguageName } from '../utils/languageUtils.js';
 import { loadAsyncStorage } from '@oxyhq/protocol';
-import { isDev } from '../shared/utils/debugUtils.js';
+import { logger } from '../logger/index.js';
 export function OxyServicesLanguageMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -28,7 +28,7 @@ export function OxyServicesLanguageMixin(Base) {
                     };
                 }
                 catch (error) {
-                    console.error('AsyncStorage not available in React Native:', error);
+                    logger.error('AsyncStorage not available in React Native', error, { component: 'OxyServices.language' });
                     throw new Error('AsyncStorage is required in React Native environment');
                 }
             }
@@ -83,9 +83,7 @@ export function OxyServicesLanguageMixin(Base) {
                 return null;
             }
             catch (error) {
-                if (isDev()) {
-                    console.warn('Failed to get current language:', error);
-                }
+                logger.warn('Failed to get current language', { component: 'OxyServices.language' }, error);
                 return null;
             }
         }

package/dist/esm/mixins/OxyServices.privacy.js

@@ -1,4 +1,4 @@
-import { isDev } from '../shared/utils/debugUtils.js';
+import { logger } from '../logger/index.js';
 export function OxyServicesPrivacyMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -26,9 +26,7 @@ export function OxyServicesPrivacyMixin(Base) {
             }
             catch (error) {
                 // If there's an error, assume not in list to avoid breaking functionality
-                if (isDev()) {
-                    console.warn('Error checking user list:', error);
-                }
+                logger.warn('Error checking user list', { component: 'OxyServices.privacy' }, error);
                 return false;
             }
         }

package/dist/esm/mixins/OxyServices.security.js

@@ -1,4 +1,4 @@
-import { isDev } from '../shared/utils/debugUtils.js';
+import { logger } from '../logger/index.js';
 export function OxyServicesSecurityMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -62,11 +62,9 @@ export function OxyServicesSecurityMixin(Base) {
                 await this.makeRequest('POST', '/security/activity/private-key-exported', { deviceId }, { cache: false });
             }
             catch (error) {
-                // Don't throw - logging failures shouldn't break user flow
-                // But log for monitoring
-                if (isDev()) {
-                    console.warn('[OxyServices] Failed to log private key exported event:', error);
-                }
+                // Don't throw - logging failures shouldn't break user flow, but surface
+                // for monitoring via the shared logger sink.
+                logger.warn('[OxyServices] Failed to log private key exported event', { component: 'OxyServices.security' }, error);
             }
         }
         /**
@@ -79,11 +77,9 @@ export function OxyServicesSecurityMixin(Base) {
                 await this.makeRequest('POST', '/security/activity/backup-created', { deviceId }, { cache: false });
             }
             catch (error) {
-                // Don't throw - logging failures shouldn't break user flow
-                // But log for monitoring
-                if (isDev()) {
-                    console.warn('[OxyServices] Failed to log backup created event:', error);
-                }
+                // Don't throw - logging failures shouldn't break user flow, but surface
+                // for monitoring via the shared logger sink.
+                logger.warn('[OxyServices] Failed to log backup created event', { component: 'OxyServices.security' }, error);
             }
         }
     };

package/dist/esm/mixins/OxyServices.topics.js

@@ -14,10 +14,10 @@ export function OxyServicesTopicsMixin(Base) {
                 const params = {};
                 if (locale)
                     params.locale = locale;
-                return await this.makeRequest('GET', '/topics/categories', params, {
-                    cache: true,
-                    cacheTTL: CACHE_TIMES.EXTRA_LONG,
-                });
+                // `GET /topics/categories` returns `{ categories: TopicData[] }` — the
+                // SDK's `unwrapResponse` only unwraps `{ data }`, so unwrap here.
+                const response = await this.makeRequest('GET', '/topics/categories', params, { cache: true, cacheTTL: CACHE_TIMES.EXTRA_LONG });
+                return response.categories ?? [];
             }
             catch (error) {
                 throw this.handleError(error);
@@ -34,9 +34,9 @@ export function OxyServicesTopicsMixin(Base) {
                 const params = { q: query };
                 if (limit)
                     params.limit = limit;
-                return await this.makeRequest('GET', '/topics/search', params, {
-                    cache: false,
-                });
+                // `GET /topics/search` returns `{ topics: TopicData[] }` — unwrap it.
+                const response = await this.makeRequest('GET', '/topics/search', params, { cache: false });
+                return response.topics ?? [];
             }
             catch (error) {
                 throw this.handleError(error);
@@ -45,7 +45,7 @@ export function OxyServicesTopicsMixin(Base) {
         /**
          * List topics with optional filters
          * @param options - Filter and pagination options
-         * @returns List of topics
+         * @returns Paginated topics envelope (`topics` plus `total`/`limit`/`offset`)
          */
         async listTopics(options) {
             try {
@@ -60,10 +60,18 @@ export function OxyServicesTopicsMixin(Base) {
                     params.offset = options.offset;
                 if (options?.locale)
                     params.locale = options.locale;
-                return await this.makeRequest('GET', '/topics', params, {
-                    cache: true,
-                    cacheTTL: CACHE_TIMES.SHORT,
-                });
+                // `GET /topics` returns `{ topics, total, limit, offset }`. The pagination
+                // fields matter to callers, so return the whole envelope (typed) rather
+                // than throwing them away.
+                const response = await this.makeRequest('GET', '/topics', params, { cache: true, cacheTTL: CACHE_TIMES.SHORT });
+                const requestedLimit = typeof params.limit === 'number' ? params.limit : 0;
+                const requestedOffset = typeof params.offset === 'number' ? params.offset : 0;
+                return {
+                    topics: response.topics ?? [],
+                    total: response.total ?? response.topics?.length ?? 0,
+                    limit: response.limit ?? requestedLimit,
+                    offset: response.offset ?? requestedOffset,
+                };
             }
             catch (error) {
                 throw this.handleError(error);
@@ -92,9 +100,11 @@ export function OxyServicesTopicsMixin(Base) {
          */
         async resolveTopicNames(names) {
             try {
-                return await this.makeRequest('POST', '/topics/resolve', { names }, {
-                    cache: false,
-                });
+                // `POST /topics/resolve` returns `{ topics: Record<name, TopicData> }`
+                // (a name-keyed map, not an array). Unwrap and flatten to the resolved
+                // topics; each TopicData carries its own `name` for re-keying.
+                const response = await this.makeRequest('POST', '/topics/resolve', { names }, { cache: false });
+                return Object.values(response.topics ?? {});
             }
             catch (error) {
                 throw this.handleError(error);

package/dist/esm/mixins/OxyServices.user.js

@@ -3,7 +3,7 @@ import { buildSearchParams, buildPaginationParams } from '../utils/apiUtils.js';
 import { KeyManager } from '../crypto/keyManager.js';
 import { SignatureService } from '../crypto/signatureService.js';
 import { normalizeUserIdentity, normalizeUserIdentityOrNull } from '../utils/userIdentity.js';
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
 /**
  * Maximum number of ids sent per `POST /users/by-ids` request. Matches the

package/dist/esm/mixins/OxyServices.utility.js

@@ -7,7 +7,7 @@
 import { jwtDecode } from 'jwt-decode';
 import { loadNodeCrypto } from '@oxyhq/protocol';
 import { buildUrl } from '../utils/apiUtils.js';
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 /**
  * Expected JWT audience for tokens issued by the Oxy auth service.
  */

package/dist/esm/server/rateLimit.js

@@ -1,3 +1,5 @@
+import { createHmac } from 'node:crypto';
+import { isIPv4, isIPv6 } from 'node:net';
 import rateLimit from 'express-rate-limit';
 /**
  * Built-in exemptions. A media app's cover-art/avatar fan-out and HLS
@@ -15,9 +17,98 @@ function isBuiltInExempt(req) {
         path === '/health' ||
         path.endsWith('/health'));
 }
-/** IPv6-safe IP key generator (replaces colons to avoid Redis namespace issues). */
-function ipKeyGenerator(ip) {
-    return ip.replace(/:/g, '_');
+/**
+ * Anonymous rate-limit keys must be PRIVACY-PRESERVING: the raw client IP must
+ * never reach a store at rest (in-memory or Redis). We therefore HMAC-hash the
+ * IP into a short, transient-only bucket key. Two IPv6-specific concerns shape
+ * the pre-hash normalization:
+ *
+ *  - IPv6 hosts are typically handed an entire /64 (often a /56), so a single
+ *    host can rotate through an enormous address space and evade a per-address
+ *    limit. We bucket IPv6 to its /56 prefix BEFORE hashing.
+ *  - express-rate-limit only exposes an `ipKeyGenerator` /56 helper from v8
+ *    onwards; `@oxyhq/core` pins v7 (peer `^7.0.0`), so the masking is
+ *    implemented here rather than pulling a major-version bump of a
+ *    security-critical dependency (and its rate-limit-redis compatibility) into
+ *    an unrelated privacy change. This mirrors `packages/api/src/utils/ipKey.ts`.
+ */
+const IPV6_SUBNET_BITS = 56;
+/** Expand an IPv6 literal (handling `::` and embedded IPv4) to 8 numeric hextets, or null if unparseable. */
+function ipv6Hextets(ip) {
+    let addr = ip;
+    const zone = addr.indexOf('%');
+    if (zone !== -1) {
+        addr = addr.slice(0, zone);
+    }
+    // Embedded IPv4 tail (e.g. `::ffff:203.0.113.7`) → fold the dotted quad into two hextets.
+    const lastColon = addr.lastIndexOf(':');
+    if (lastColon !== -1 && addr.slice(lastColon + 1).includes('.')) {
+        const v4 = addr.slice(lastColon + 1);
+        if (!isIPv4(v4)) {
+            return null;
+        }
+        const octets = v4.split('.').map((part) => Number.parseInt(part, 10));
+        const high = ((octets[0] << 8) | octets[1]).toString(16);
+        const low = ((octets[2] << 8) | octets[3]).toString(16);
+        addr = `${addr.slice(0, lastColon + 1)}${high}:${low}`;
+    }
+    const halves = addr.split('::');
+    if (halves.length > 2) {
+        return null;
+    }
+    const head = halves[0] ? halves[0].split(':') : [];
+    const tail = halves.length === 2 && halves[1] ? halves[1].split(':') : [];
+    let groups;
+    if (halves.length === 1) {
+        groups = head;
+    }
+    else {
+        const missing = 8 - (head.length + tail.length);
+        if (missing < 0) {
+            return null;
+        }
+        groups = [...head, ...new Array(missing).fill('0'), ...tail];
+    }
+    if (groups.length !== 8) {
+        return null;
+    }
+    const hextets = groups.map((group) => Number.parseInt(group || '0', 16));
+    if (hextets.some((value) => Number.isNaN(value) || value < 0 || value > 0xffff)) {
+        return null;
+    }
+    return hextets;
+}
+/** Mask an IPv6 address to its /{bits} prefix, returned as a canonical hex string. */
+function maskIPv6(ip, bits) {
+    const hextets = ipv6Hextets(ip);
+    if (!hextets) {
+        return ip;
+    }
+    const masked = hextets.map((hextet, index) => {
+        const groupStart = index * 16;
+        if (groupStart >= bits) {
+            return 0;
+        }
+        const keepBits = Math.min(16, bits - groupStart);
+        const mask = keepBits >= 16 ? 0xffff : (0xffff << (16 - keepBits)) & 0xffff;
+        return hextet & mask;
+    });
+    return `${masked.map((hextet) => hextet.toString(16)).join(':')}/${bits}`;
+}
+/**
+ * Hash a client IP into a privacy-preserving bucket key. IPv6 is bucketed to its
+ * /56 prefix first (so a single v6 host can't rotate through its allocation to
+ * mint fresh keys), then HMAC'd with the server-side salt. The salt is resolved
+ * at CALL time (`IP_HASH_SALT`, else `DEVICE_ID_SALT`, else empty) — an empty
+ * salt still hashes, which beats storing a raw IP; backends SHOULD set one of
+ * those envs. The `rl|` namespace ensures a rate-limit key can never collide
+ * with, or be correlated against, a deviceId derivation that reuses the same
+ * salt. The result is a short hex digest with no colons, so it is Redis-safe.
+ */
+function hashAnonymousIp(ip) {
+    const normalized = isIPv6(ip) && !ip.startsWith('::ffff:') ? maskIPv6(ip, IPV6_SUBNET_BITS) : ip;
+    const salt = process.env.IP_HASH_SALT || process.env.DEVICE_ID_SALT || '';
+    return createHmac('sha256', salt).update(`rl|${normalized}`).digest('hex').slice(0, 24);
 }
 /**
  * Resolve the trusted authenticated rate-limit key.
@@ -43,14 +134,17 @@ function resolveTrustedAuthenticatedKey(req) {
     }
     return null;
 }
-/** Resolve the rate-limit key: per trusted authenticated identity, else per (IPv6-safe) IP. */
+/** Resolve the rate-limit key: per trusted authenticated identity, else per hashed (IPv6-bucketed) IP. */
 function resolveKey(req) {
     const authenticatedKey = resolveTrustedAuthenticatedKey(req);
     if (authenticatedKey) {
         return authenticatedKey;
     }
-    const ip = req.ip || req.socket.remoteAddress || 'unknown';
-    return ipKeyGenerator(ip);
+    const ip = req.ip || req.socket.remoteAddress;
+    if (!ip) {
+        return 'unknown';
+    }
+    return hashAnonymousIp(ip);
 }
 /**
  * Build the composed Oxy rate-limit middleware. See module docs for rationale.

package/dist/esm/session/SessionClient.js

@@ -1,5 +1,5 @@
 import { deviceSessionStateSchema, deviceSessionSyncSchema, safeParseContract, SESSION_ACCOUNTS_CHANGED_EVENT, sessionAccountsChangedEventSchema, } from '@oxyhq/contracts';
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 import { getSocketIO } from './socketLoader.js';
 /**
  * Same-origin `BroadcastChannel` name for instant, network-free session-state

package/dist/esm/session/accountDialogController.js

@@ -25,7 +25,7 @@
  * (auth.oxy.so). {@link AccountDialogController.openPasswordAtOxyAuth} only
  * builds the hand-off URL; device-first convergence syncs the session back.
  */
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
 import { CENTRAL_IDP_APEX } from '../utils/authWebUrl.js';
 import { generateOAuthState, generatePkcePair, normalizeOAuthRedirectUri, persistOAuthHandshake, } from '../utils/oauthPkce.js';

package/dist/esm/session/authStateStore.js

@@ -16,7 +16,7 @@
  *
  * ESM-safe (no `require()`).
  */
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 /**
  * Versioned DURABLE storage key. Holds ONLY the small, re-mint-critical fields
  * (`sessionId`, `userId`, `deviceId`, `deviceSecret`) — never the large JWT

package/dist/esm/session/refresh.js

@@ -1,6 +1,6 @@
 import { isNative } from '../utils/platform.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 /**
  * Lead time (ms) before access-token expiry at which the proactive scheduler
  * re-mints. Mirrors `HttpService`'s per-request `TOKEN_REFRESH_LEAD_SECONDS`

package/dist/esm/session/socketLoader.js

@@ -1,4 +1,4 @@
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 let cachedFactory = null;
 let loadAttempted = false;
 export async function getSocketIO() {

package/dist/esm/utils/asyncUtils.js

@@ -1,7 +1,7 @@
 /**
  * Async utilities for common asynchronous patterns and error handling
  */
-import { logger } from './loggerUtils.js';
+import { logger } from '../logger/index.js';
 /**
  * Wrapper for async operations with automatic error handling
  * Returns null on error instead of throwing

package/dist/esm/utils/avatarUtils.js

@@ -1,3 +1,4 @@
+import { logger } from '../logger/index.js';
 /**
  * Updates file visibility to public for avatar use.
  * Logs non-404 errors to help debug upload issues.
@@ -19,7 +20,7 @@ export async function updateAvatarVisibility(fileId, oxyServices, contextName =
             ? visError.status
             : undefined;
         if (status !== 404) {
-            console.error(`[${contextName}] Failed to update avatar visibility for ${fileId}:`, visError);
+            logger.error(`[${contextName}] Failed to update avatar visibility for ${fileId}`, visError, { component: contextName });
         }
     }
 }

package/dist/esm/utils/deviceManager.js

@@ -1,4 +1,6 @@
 import { loadAsyncStorage } from '@oxyhq/protocol';
+import { createLogger } from '../logger/index.js';
+const log = createLogger('DeviceManager');
 /**
  * Client-side device management utility
  * Handles persistent device identification across app sessions
@@ -28,7 +30,7 @@ export class DeviceManager {
                 };
             }
             catch (error) {
-                console.error('AsyncStorage not available in React Native:', error);
+                log.error('AsyncStorage not available in React Native', error);
                 throw new Error('AsyncStorage is required in React Native environment');
             }
         }
@@ -79,7 +81,7 @@ export class DeviceManager {
             return await this.createNewDeviceInfo();
         }
         catch (error) {
-            console.error('Error getting device info:', error);
+            log.error('Error getting device info', error);
             return await this.createNewDeviceInfo();
         }
     }
@@ -105,7 +107,7 @@ export class DeviceManager {
             await storage.setItem(this.DEVICE_KEY, JSON.stringify(deviceInfo));
         }
         catch (error) {
-            console.error('Error saving device info:', error);
+            log.error('Error saving device info', error);
         }
     }
     /**
@@ -118,7 +120,7 @@ export class DeviceManager {
             await this.saveDeviceInfo(deviceInfo);
         }
         catch (error) {
-            console.error('Error updating device name:', error);
+            log.error('Error updating device name', error);
         }
     }
     /**
@@ -130,7 +132,7 @@ export class DeviceManager {
             await storage.removeItem(this.DEVICE_KEY);
         }
         catch (error) {
-            console.error('Error clearing device info:', error);
+            log.error('Error clearing device info', error);
         }
     }
     /**