@oxyhq/core 10.2.0 → 11.0.1

package/src/mixins/__tests__/topics.test.ts

@@ -0,0 +1,156 @@
+/**
+ * Topics mixin envelope-unwrapping tests.
+ *
+ * oxy-api returns ENVELOPES for the list/collection topic routes
+ * (`{ topics, total, limit, offset }`, `{ categories }`, `{ topics }`,
+ * `{ topics: <name-keyed map> }`), while the SDK's `unwrapResponse` only unwraps
+ * the `{ data }` success shape. These tests pin the mixin's own unwrapping so the
+ * public methods genuinely return `TopicData[]` / the pagination envelope — not a
+ * raw wrapper that a caller would `.map` over and crash on.
+ *
+ * They drive the REAL `makeRequest` path by mocking `globalThis.fetch`, so the
+ * `unwrapResponse` pass-through (no `data` key) is exercised end to end.
+ */
+
+import { OxyServices } from '../../OxyServices';
+
+/** A raw JSON `Response` — the body is exactly what the topic routes return. */
+function rawResponse(body: unknown): Response {
+  return new Response(JSON.stringify(body), {
+    status: 200,
+    headers: { 'content-type': 'application/json' },
+  });
+}
+
+/**
+ * A non-verified JWT whose payload decodes to the given claims. Puts the SDK in
+ * an authenticated state so the `POST /topics/resolve` carries a bearer header
+ * and skips the CSRF-token pre-fetch (which would otherwise consume a mock).
+ */
+function makeJwt(payload: Record<string, unknown>): string {
+  const b64url = (obj: Record<string, unknown>): string =>
+    Buffer.from(JSON.stringify(obj)).toString('base64url');
+  const fullPayload = { exp: Math.floor(Date.now() / 1000) + 3600, ...payload };
+  return `${b64url({ alg: 'none', typ: 'JWT' })}.${b64url(fullPayload)}.sig`;
+}
+
+const topic = (id: string, name: string, extra: Record<string, unknown> = {}) => ({
+  _id: id,
+  name,
+  slug: name,
+  displayName: name,
+  description: '',
+  type: 'topic',
+  source: 'ai',
+  aliases: [],
+  isActive: true,
+  createdAt: '2026-01-01T00:00:00.000Z',
+  updatedAt: '2026-01-01T00:00:00.000Z',
+  ...extra,
+});
+
+describe('topics mixin envelope unwrapping', () => {
+  let originalFetch: typeof globalThis.fetch;
+  let fetchMock: jest.Mock<Promise<Response>, [RequestInfo | URL, RequestInit?]>;
+  let oxy: OxyServices;
+
+  beforeEach(() => {
+    originalFetch = globalThis.fetch;
+    fetchMock = jest.fn();
+    globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
+    oxy = new OxyServices({ baseURL: 'http://test.invalid', enableRetry: false });
+    // Authenticate so the resolve POST skips the CSRF pre-fetch. Harmless for GETs.
+    oxy.httpService.setTokens(makeJwt({ userId: 'me' }));
+  });
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+    jest.clearAllMocks();
+  });
+
+  describe('getTopicCategories', () => {
+    it('unwraps { categories } into a TopicData[]', async () => {
+      fetchMock.mockResolvedValueOnce(
+        rawResponse({ categories: [topic('c1', 'tech', { type: 'category' }), topic('c2', 'sports', { type: 'category' })] }),
+      );
+      const result = await oxy.getTopicCategories();
+      expect(Array.isArray(result)).toBe(true);
+      expect(result.map((t) => t._id)).toEqual(['c1', 'c2']);
+    });
+
+    it('returns [] when the envelope omits categories', async () => {
+      fetchMock.mockResolvedValueOnce(rawResponse({}));
+      await expect(oxy.getTopicCategories()).resolves.toEqual([]);
+    });
+  });
+
+  describe('searchTopics', () => {
+    it('unwraps { topics } into a TopicData[]', async () => {
+      fetchMock.mockResolvedValueOnce(rawResponse({ topics: [topic('t1', 'react'), topic('t2', 'reactivity')] }));
+      const result = await oxy.searchTopics('react');
+      expect(result.map((t) => t.name)).toEqual(['react', 'reactivity']);
+    });
+
+    it('returns [] when the envelope omits topics', async () => {
+      fetchMock.mockResolvedValueOnce(rawResponse({}));
+      await expect(oxy.searchTopics('nothing')).resolves.toEqual([]);
+    });
+  });
+
+  describe('listTopics', () => {
+    it('returns the full pagination envelope', async () => {
+      fetchMock.mockResolvedValueOnce(
+        rawResponse({ topics: [topic('t1', 'a'), topic('t2', 'b')], total: 42, limit: 2, offset: 10 }),
+      );
+      const result = await oxy.listTopics({ limit: 2, offset: 10 });
+      expect(result.topics.map((t) => t._id)).toEqual(['t1', 't2']);
+      expect(result.total).toBe(42);
+      expect(result.limit).toBe(2);
+      expect(result.offset).toBe(10);
+    });
+
+    it('falls back to the requested limit/offset and topics.length when the server omits them', async () => {
+      fetchMock.mockResolvedValueOnce(rawResponse({ topics: [topic('t1', 'a')] }));
+      const result = await oxy.listTopics({ limit: 5, offset: 3 });
+      expect(result.topics).toHaveLength(1);
+      expect(result.total).toBe(1);
+      expect(result.limit).toBe(5);
+      expect(result.offset).toBe(3);
+    });
+
+    it('returns an empty envelope when the server returns nothing useful', async () => {
+      fetchMock.mockResolvedValueOnce(rawResponse({}));
+      const result = await oxy.listTopics();
+      expect(result).toEqual({ topics: [], total: 0, limit: 0, offset: 0 });
+    });
+  });
+
+  describe('resolveTopicNames', () => {
+    it('flattens the name-keyed { topics } map into a TopicData[]', async () => {
+      // POST /topics/resolve returns a Record keyed by lowercased name, NOT an array.
+      fetchMock.mockResolvedValueOnce(
+        rawResponse({ topics: { react: topic('t1', 'react'), vue: topic('t2', 'vue') } }),
+      );
+      const result = await oxy.resolveTopicNames([
+        { name: 'react', type: 'topic' },
+        { name: 'vue', type: 'topic' },
+      ]);
+      expect(Array.isArray(result)).toBe(true);
+      expect(result.map((t) => t.name).sort()).toEqual(['react', 'vue']);
+    });
+
+    it('returns [] when the map is empty or missing', async () => {
+      fetchMock.mockResolvedValueOnce(rawResponse({ topics: {} }));
+      await expect(oxy.resolveTopicNames([])).resolves.toEqual([]);
+    });
+  });
+
+  describe('getTopicBySlug (single, no envelope)', () => {
+    it('returns the raw TopicData unchanged', async () => {
+      fetchMock.mockResolvedValueOnce(rawResponse(topic('t1', 'react')));
+      const result = await oxy.getTopicBySlug('react');
+      expect(result._id).toBe('t1');
+      expect(result.name).toBe('react');
+    });
+  });
+});

package/src/mixins/__tests__/webauthnAuth.test.ts

@@ -0,0 +1,206 @@
+/**
+ * WebAuthn / passkey auth methods on OxyServices
+ * (`webauthnRegisterOptions` / `webauthnRegisterVerify` /
+ * `webauthnLoginOptions` / `webauthnLoginVerify`).
+ *
+ * Stubs `makeRequest` (HTTP-mock style, like `passwordSignIn.test.ts`) and
+ * asserts: each method hits the right endpoint with the right body; the opaque
+ * ceremony `response` is forwarded verbatim; the login/verify + register/verify
+ * (signup) paths parse the login contract and plant the access token on the
+ * session arm; register/verify (link) returns `{ success, message }` WITHOUT
+ * planting a token.
+ */
+import type { LoginResult } from '@oxyhq/contracts';
+import { OxyServices } from '../../OxyServices';
+
+const SESSION_ARM: LoginResult = {
+  sessionId: 'sess-1',
+  deviceId: 'dev-1',
+  expiresAt: '2030-01-01T00:00:00.000Z',
+  accessToken: 'access-1',
+  deviceSecret: 'ds-secret-1',
+  user: { id: 'user-1', username: 'u' },
+};
+
+const LINK_RESULT = { success: true as const, message: 'Passkey registered successfully' };
+
+// Opaque browser ceremony payloads — Oxy never inspects these, so shape is
+// irrelevant beyond "forwarded verbatim under `response`".
+const CREATE_RESPONSE = { id: 'cred-abc', rawId: 'cred-abc', response: { attestationObject: 'ao' }, type: 'public-key' };
+const GET_RESPONSE = { id: 'cred-abc', rawId: 'cred-abc', response: { signature: 'sig' }, type: 'public-key' };
+
+describe('webauthnRegisterOptions', () => {
+  let oxy: OxyServices;
+  let makeRequest: jest.SpyInstance;
+
+  beforeEach(() => {
+    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
+    makeRequest = jest.spyOn(oxy, 'makeRequest');
+  });
+  afterEach(() => jest.restoreAllMocks());
+
+  it('POSTs to /auth/webauthn/register/options with the username', async () => {
+    const options = { challenge: 'c', rp: { id: 'oxy.so' } };
+    makeRequest.mockResolvedValueOnce(options);
+    const result = await oxy.webauthnRegisterOptions('alice');
+    expect(result).toBe(options);
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/webauthn/register/options',
+      { username: 'alice' },
+      { cache: false },
+    );
+  });
+
+  it('omits username from the body when not provided (link flow)', async () => {
+    makeRequest.mockResolvedValueOnce({ challenge: 'c' });
+    await oxy.webauthnRegisterOptions();
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/webauthn/register/options',
+      {},
+      { cache: false },
+    );
+  });
+});
+
+describe('webauthnLoginOptions', () => {
+  let oxy: OxyServices;
+  let makeRequest: jest.SpyInstance;
+
+  beforeEach(() => {
+    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
+    makeRequest = jest.spyOn(oxy, 'makeRequest');
+  });
+  afterEach(() => jest.restoreAllMocks());
+
+  it('POSTs to /auth/webauthn/login/options with the username (username-first)', async () => {
+    const options = { challenge: 'c', allowCredentials: [{ id: 'cred-abc' }] };
+    makeRequest.mockResolvedValueOnce(options);
+    const result = await oxy.webauthnLoginOptions('alice');
+    expect(result).toBe(options);
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/webauthn/login/options',
+      { username: 'alice' },
+      { cache: false },
+    );
+  });
+
+  it('omits username for the usernameless / discoverable flow', async () => {
+    makeRequest.mockResolvedValueOnce({ challenge: 'c', allowCredentials: [] });
+    await oxy.webauthnLoginOptions();
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/webauthn/login/options',
+      {},
+      { cache: false },
+    );
+  });
+});
+
+describe('webauthnRegisterVerify', () => {
+  let oxy: OxyServices;
+  let makeRequest: jest.SpyInstance;
+  let setTokens: jest.SpyInstance;
+
+  beforeEach(() => {
+    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
+    makeRequest = jest.spyOn(oxy, 'makeRequest');
+    setTokens = jest.spyOn(oxy, 'setTokens').mockImplementation(() => undefined);
+  });
+  afterEach(() => jest.restoreAllMocks());
+
+  it('signup branch: parses LoginSessionResult, plants the token, threads the envelope', async () => {
+    makeRequest.mockResolvedValueOnce(SESSION_ARM);
+    const result = await oxy.webauthnRegisterVerify(CREATE_RESPONSE, {
+      username: 'alice',
+      deviceName: 'Phone',
+      deviceFingerprint: 'fp-1',
+    });
+    expect(result).toEqual(SESSION_ARM);
+    expect('twoFactorRequired' in result).toBe(false);
+    if (!('twoFactorRequired' in result) && 'sessionId' in result) {
+      expect(result.deviceId).toBe('dev-1');
+      expect(result.deviceSecret).toBe('ds-secret-1');
+    }
+    expect(setTokens).toHaveBeenCalledWith('access-1');
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/webauthn/register/verify',
+      { response: CREATE_RESPONSE, username: 'alice', deviceName: 'Phone', deviceFingerprint: 'fp-1' },
+      { cache: false },
+    );
+  });
+
+  it('link branch: returns { success, message } WITHOUT planting a token', async () => {
+    makeRequest.mockResolvedValueOnce(LINK_RESULT);
+    const result = await oxy.webauthnRegisterVerify(CREATE_RESPONSE, { deviceName: 'Laptop' });
+    expect(result).toEqual(LINK_RESULT);
+    expect(setTokens).not.toHaveBeenCalled();
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/webauthn/register/verify',
+      { response: CREATE_RESPONSE, deviceName: 'Laptop' },
+      { cache: false },
+    );
+  });
+
+  it('throws on an unexpected response shape', async () => {
+    makeRequest.mockResolvedValueOnce({ nope: true });
+    await expect(oxy.webauthnRegisterVerify(CREATE_RESPONSE)).rejects.toThrow();
+    expect(setTokens).not.toHaveBeenCalled();
+  });
+});
+
+describe('webauthnLoginVerify', () => {
+  let oxy: OxyServices;
+  let makeRequest: jest.SpyInstance;
+  let setTokens: jest.SpyInstance;
+
+  beforeEach(() => {
+    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
+    makeRequest = jest.spyOn(oxy, 'makeRequest');
+    setTokens = jest.spyOn(oxy, 'setTokens').mockImplementation(() => undefined);
+  });
+  afterEach(() => jest.restoreAllMocks());
+
+  it('parses LoginSessionResult, plants the token, and threads the device envelope', async () => {
+    makeRequest.mockResolvedValueOnce(SESSION_ARM);
+    const result = await oxy.webauthnLoginVerify(GET_RESPONSE, {
+      deviceName: 'Phone',
+      deviceFingerprint: 'fp-1',
+      deviceId: 'dev-persisted',
+    });
+    expect(result).toEqual(SESSION_ARM);
+    expect('twoFactorRequired' in result).toBe(false);
+    if (!('twoFactorRequired' in result)) {
+      expect(result.deviceId).toBe('dev-1');
+      expect(result.deviceSecret).toBe('ds-secret-1');
+    }
+    expect(setTokens).toHaveBeenCalledWith('access-1');
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/webauthn/login/verify',
+      { response: GET_RESPONSE, deviceName: 'Phone', deviceFingerprint: 'fp-1', deviceId: 'dev-persisted' },
+      { cache: false },
+    );
+  });
+
+  it('POSTs the bare response body when no envelope is passed', async () => {
+    makeRequest.mockResolvedValueOnce(SESSION_ARM);
+    await oxy.webauthnLoginVerify(GET_RESPONSE);
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/webauthn/login/verify',
+      { response: GET_RESPONSE },
+      { cache: false },
+    );
+  });
+
+  it('throws on an unexpected response shape', async () => {
+    makeRequest.mockResolvedValueOnce({ nope: true });
+    await expect(oxy.webauthnLoginVerify(GET_RESPONSE)).rejects.toThrow();
+    expect(setTokens).not.toHaveBeenCalled();
+  });
+});

package/src/models/Topic.ts

@@ -33,3 +33,14 @@ export interface TopicData {
   createdAt: string;
   updatedAt: string;
 }
+
+/**
+ * Paginated result of {@link OxyServices.listTopics}. Mirrors the `GET /topics`
+ * envelope so callers keep access to `total`/`offset` for pagination.
+ */
+export interface TopicListResult {
+  topics: TopicData[];
+  total: number;
+  limit: number;
+  offset: number;
+}

package/src/session/SessionClient.ts

@@ -6,7 +6,7 @@ import {
   sessionAccountsChangedEventSchema,
   type DeviceSessionState,
 } from '@oxyhq/contracts';
-import { logger } from '../utils/loggerUtils';
+import { logger } from '../logger';
 import { getSocketIO } from './socketLoader';
 import type { MinimalSocket, SocketIOFactory } from './socketLoader';
 

package/src/session/__tests__/SessionClient.diagnostics.test.ts

@@ -1,6 +1,6 @@
 import type { DeviceSessionState } from '@oxyhq/contracts';
 import { SessionClient, type SessionClientHost } from '../SessionClient';
-import { logger } from '../../utils/loggerUtils';
+import { logger } from '../../logger';
 
 const STATE = (rev: number): DeviceSessionState => ({
   deviceId: 'd1', accounts: [{ accountId: 'a1', sessionId: 's1', authuser: 0 }], activeAccountId: 'a1', revision: rev, updatedAt: 1720000000000,

package/src/session/__tests__/accountDialogController.test.ts

@@ -5,7 +5,7 @@ import type { SessionLoginResponse, MinimalUserData } from '../../models/session
 import type { AccountNode } from '../../mixins/OxyServices.accounts';
 import { SessionClient, type SessionClientHost } from '../SessionClient';
 import type { MinimalSocket, SocketIOFactory } from '../socketLoader';
-import { logger } from '../../utils/loggerUtils';
+import { logger } from '../../logger';
 import {
   AccountDialogController,
   createAccountDialogController,

package/src/session/accountDialogController.ts

@@ -29,7 +29,7 @@
 import type { OxyServices } from '../OxyServices';
 import type { SessionLoginResponse, MinimalUserData } from '../models/session';
 import type { User } from '../models/interfaces';
-import { logger } from '../utils/loggerUtils';
+import { logger } from '../logger';
 import { extractErrorStatus } from '../utils/errorUtils';
 import { CENTRAL_IDP_APEX } from '../utils/authWebUrl';
 import {

package/src/session/authStateStore.ts

@@ -17,7 +17,7 @@
  * ESM-safe (no `require()`).
  */
 
-import { logger } from '../utils/loggerUtils';
+import { logger } from '../logger';
 
 /**
  * The persisted session credential set for a single origin.

package/src/session/refresh.ts

@@ -26,7 +26,7 @@ import type { AuthRefreshHandler, AuthRefreshReason } from '../HttpService';
 import type { AuthStateStore, PersistedAuthState } from './authStateStore';
 import { isNative } from '../utils/platform';
 import { extractErrorStatus } from '../utils/errorUtils';
-import { logger } from '../utils/loggerUtils';
+import { logger } from '../logger';
 
 /**
  * Lead time (ms) before access-token expiry at which the proactive scheduler

package/src/session/socketLoader.ts

@@ -1,4 +1,4 @@
-import { logger } from '../utils/loggerUtils';
+import { logger } from '../logger';
 
 export interface MinimalSocket {
   connected: boolean;

package/src/utils/__tests__/webauthnOrigin.test.ts

@@ -0,0 +1,83 @@
+/**
+ * `isOxyRpOrigin()` — client-side WebAuthn relying-party origin guard.
+ *
+ * Runs under the `node` test environment, where `globalThis.location` is
+ * genuinely absent by default (mirroring native/SSR). Each case defines a fake
+ * `location` with the host under test and restores the original afterwards.
+ */
+import { isOxyRpOrigin } from '../webauthnOrigin';
+
+describe('isOxyRpOrigin', () => {
+  const originalLocation = globalThis.location;
+
+  const setHostname = (hostname: unknown): void => {
+    Object.defineProperty(globalThis, 'location', {
+      configurable: true,
+      value: hostname === undefined ? undefined : { hostname },
+    });
+  };
+
+  afterEach(() => {
+    Object.defineProperty(globalThis, 'location', {
+      configurable: true,
+      value: originalLocation,
+    });
+  });
+
+  it('returns true on the apex oxy.so', () => {
+    setHostname('oxy.so');
+    expect(isOxyRpOrigin()).toBe(true);
+  });
+
+  it('returns true on an oxy.so subdomain', () => {
+    setHostname('accounts.oxy.so');
+    expect(isOxyRpOrigin()).toBe(true);
+  });
+
+  it('returns true on a deep oxy.so subdomain', () => {
+    setHostname('sub.accounts.oxy.so');
+    expect(isOxyRpOrigin()).toBe(true);
+  });
+
+  it('returns true on loopback hosts', () => {
+    for (const host of ['localhost', '127.0.0.1', '[::1]']) {
+      setHostname(host);
+      expect(isOxyRpOrigin()).toBe(true);
+    }
+  });
+
+  it('is case-insensitive on the host', () => {
+    setHostname('Accounts.OXY.So');
+    expect(isOxyRpOrigin()).toBe(true);
+  });
+
+  it('returns false on an unrelated origin', () => {
+    setHostname('evil.com');
+    expect(isOxyRpOrigin()).toBe(false);
+  });
+
+  it('returns false on a look-alike suffix without the dot boundary', () => {
+    setHostname('evil-oxy.so');
+    expect(isOxyRpOrigin()).toBe(false);
+  });
+
+  it('returns false when oxy.so is only a subdomain label of an attacker apex', () => {
+    setHostname('oxy.so.evil.com');
+    expect(isOxyRpOrigin()).toBe(false);
+  });
+
+  it('returns false when there is no location (native / SSR)', () => {
+    setHostname(undefined);
+    expect(isOxyRpOrigin()).toBe(false);
+  });
+
+  it('returns false when the hostname is not a string', () => {
+    setHostname(123);
+    expect(isOxyRpOrigin()).toBe(false);
+  });
+
+  it('returns false when the hostname is empty', () => {
+    setHostname('');
+    expect(isOxyRpOrigin()).toBe(false);
+  });
+});

package/src/utils/asyncUtils.ts

@@ -2,7 +2,7 @@
  * Async utilities for common asynchronous patterns and error handling
  */
 
-import { logger } from './loggerUtils';
+import { logger } from '../logger';
 
 /**
  * Wrapper for async operations with automatic error handling

package/src/utils/avatarUtils.ts

@@ -1,3 +1,5 @@
+import { logger } from '../logger';
+
 /**
  * Minimal interface for services that can update asset visibility.
  * Kept loose to avoid mixin type-inference issues with the OxyServices class.
@@ -31,7 +33,7 @@ export async function updateAvatarVisibility(
       ? (visError as Error & { status: number }).status
       : undefined;
     if (status !== 404) {
-      console.error(`[${contextName}] Failed to update avatar visibility for ${fileId}:`, visError);
+      logger.error(`[${contextName}] Failed to update avatar visibility for ${fileId}`, visError, { component: contextName });
     }
   }
 }

package/src/utils/deviceManager.ts

@@ -1,4 +1,7 @@
 import { loadAsyncStorage } from '@oxyhq/protocol';
+import { createLogger } from '../logger';
+
+const log = createLogger('DeviceManager');
 
 export interface DeviceFingerprint {
   userAgent: string;
@@ -55,7 +58,7 @@ export class DeviceManager {
           removeItem: storage.removeItem.bind(storage),
         };
       } catch (error) {
-        console.error('AsyncStorage not available in React Native:', error);
+        log.error('AsyncStorage not available in React Native', error);
         throw new Error('AsyncStorage is required in React Native environment');
       }
     } else {
@@ -112,7 +115,7 @@ export class DeviceManager {
       // Create new device info
       return await this.createNewDeviceInfo();
     } catch (error) {
-      console.error('Error getting device info:', error);
+      log.error('Error getting device info', error);
       return await this.createNewDeviceInfo();
     }
   }
@@ -140,7 +143,7 @@ export class DeviceManager {
       const storage = await this.getStorage();
       await storage.setItem(this.DEVICE_KEY, JSON.stringify(deviceInfo));
     } catch (error) {
-      console.error('Error saving device info:', error);
+      log.error('Error saving device info', error);
     }
   }
 
@@ -153,7 +156,7 @@ export class DeviceManager {
       deviceInfo.deviceName = deviceName;
       await this.saveDeviceInfo(deviceInfo);
     } catch (error) {
-      console.error('Error updating device name:', error);
+      log.error('Error updating device name', error);
     }
   }
 
@@ -165,7 +168,7 @@ export class DeviceManager {
       const storage = await this.getStorage();
       await storage.removeItem(this.DEVICE_KEY);
     } catch (error) {
-      console.error('Error clearing device info:', error);
+      log.error('Error clearing device info', error);
     }
   }
 

package/src/utils/errorUtils.ts

@@ -1,5 +1,5 @@
 import type { ApiError } from '../models/interfaces';
-import { logger } from './loggerUtils';
+import { logger } from '../logger';
 
 /**
  * Error handling utilities for consistent error processing

package/src/utils/oauthPkce.ts

@@ -17,7 +17,7 @@
  */
 
 import { isNodeJS, isReactNative, loadExpoCrypto, loadNodeCrypto, sha256 } from '@oxyhq/protocol';
-import { logger } from './loggerUtils';
+import { logger } from '../logger';
 
 /** The central Oxy IdP authorization endpoint used by default. */
 export const OXY_AUTHORIZE_URL = 'https://auth.oxy.so/authorize';

package/src/utils/requestUtils.ts

@@ -169,7 +169,7 @@ export type LogLevel = 'none' | 'error' | 'warn' | 'info' | 'debug';
  * Simple logger with level support
  *
  * Lightweight logger for HTTP clients and utilities.
- * For more advanced logging, use loggerUtils.ts
+ * For structured, namespaced, level-gated logging, use `@oxyhq/core/logger`.
  *
  * @example
  * ```typescript