@oxyhq/core 10.2.0 → 11.0.1

package/dist/esm/boot/sessionColdBoot.js

@@ -22,7 +22,7 @@
  */
 import { runColdBoot } from '../utils/coldBoot.js';
 import { isNative as detectNative } from '../utils/platform.js';
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 import { TOKEN_REFRESH_LEAD_MS, refreshDeviceSecretArm } from '../session/refresh.js';
 /**
  * Run the device-first cold boot. Resolves to the `runColdBoot` outcome and, as

package/dist/esm/crypto/keyManager.js

@@ -8,8 +8,7 @@ import _cjs_elliptic from 'elliptic';
 const { ec: EC } = _cjs_elliptic;
 import { isWeb, isIOS, isAndroid } from '../utils/platform.js';
 import { isReactNative, isNodeJS, loadExpoCrypto, loadNodeCrypto, loadSecureStore, loadSharedIdentityBridge } from '@oxyhq/protocol';
-import { logger } from '../utils/loggerUtils.js';
-import { isDev } from '../shared/utils/debugUtils.js';
+import { isDev, logger } from '../logger/index.js';
 /**
  * Thrown when an identity-mutating operation (createIdentity / importKeyPair)
  * is invoked while a valid identity already exists on the device.

package/dist/esm/crypto/signatureService.js

@@ -9,7 +9,7 @@
  */
 import { signEnvelope, signMessage, verifySignature, sha256, loadExpoCrypto, loadNodeCrypto, isReactNative, isNodeJS, } from '@oxyhq/protocol';
 import { KeyManager } from './keyManager.js';
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 export class SignatureService {
     /**
      * Generate a random challenge string (for offline use)

package/dist/esm/index.js

@@ -90,7 +90,6 @@ export { normalizeTheme, normalizeColorScheme, getOppositeTheme, systemPrefersDa
 // ---------------------------------------------------------------------------
 export { HttpStatus, getErrorStatus, getErrorMessage, isAlreadyRegisteredError, isUnauthorizedError, isForbiddenError, isNotFoundError, isRateLimitError, isServerError, isNetworkError, isRetryableError, } from './shared/utils/errorUtils.js';
 export { DEFAULT_CIRCUIT_BREAKER_CONFIG, createCircuitBreakerState, calculateBackoffInterval, recordFailure, recordSuccess, shouldAllowRequest, delay, withRetry, } from './shared/utils/networkUtils.js';
-export { isDev, debugLog, debugWarn, debugError, createDebugLogger, } from './shared/utils/debugUtils.js';
 // ---------------------------------------------------------------------------
 // i18n
 // ---------------------------------------------------------------------------
@@ -110,9 +109,9 @@ export { EMAIL_REGEX, USERNAME_REGEX, PASSWORD_REGEX, isValidEmail, isValidUsern
 // ---------------------------------------------------------------------------
 export { normalizeInlineText, normalizeMultilineText, } from './utils/textNormalization.js';
 // ---------------------------------------------------------------------------
-// Logging
+// Logging — the ecosystem-wide chokepoint (also at subpath `@oxyhq/core/logger`)
 // ---------------------------------------------------------------------------
-export { logger, LogLevel, logAuth, logApi, logSession, logUser, logDevice, logPayment, logPerformance, } from './utils/loggerUtils.js';
+export { logger, createLogger, configureLogger, getLoggerConfig, resetLoggerConfig, consoleSink, isDev, } from './logger/index.js';
 // ---------------------------------------------------------------------------
 // Avatars
 // ---------------------------------------------------------------------------
@@ -131,6 +130,10 @@ export { buildAccountsArray, createQuickAccount, getAccountDisplayName, getAccou
 // ---------------------------------------------------------------------------
 export { registrableApex } from './utils/registrableApex.js';
 export { CENTRAL_IDP_APEX } from './utils/authWebUrl.js';
+// WebAuthn relying-party origin guard (client side). Mirrors the server's
+// `isOxyApexOrigin` so consumers can decide whether to offer passkey UI on the
+// current page (first-party Oxy origin / loopback only).
+export { isOxyRpOrigin } from './utils/webauthnOrigin.js';
 export { runColdBoot } from './utils/coldBoot.js';
 // ---------------------------------------------------------------------------
 // OAuth 2.0 Authorization Code + PKCE helpers ("Sign in with Oxy" third party).

package/dist/esm/logger/index.js

@@ -0,0 +1,140 @@
+/**
+ * @oxyhq/core/logger — the ecosystem-wide logging chokepoint.
+ *
+ * A tiny, dependency-free, universal logger that works unchanged in React
+ * Native, browsers, Node, and Bun. Every Oxy app and package should log
+ * through here instead of calling `console.*` directly, so that level,
+ * formatting, and transport are controlled in ONE place.
+ *
+ * Design goals:
+ *  - Zero dependencies. No Node-only imports, no `process.stdout` assumptions.
+ *  - Four levels (`debug` | `info` | `warn` | `error`) plus `silent`.
+ *  - Namespaced child loggers via `createLogger('mention:feed')` / `.child()`.
+ *  - Structured context objects carried through to the sink.
+ *  - A single pluggable sink so backends can pipe to pino / CloudWatch / etc.
+ *    without touching any call site.
+ *  - Debug is off in production by default (`__DEV__` on RN, `NODE_ENV`
+ *    elsewhere); override globally with `configureLogger({ level })`.
+ *
+ * @module logger
+ */
+const LEVEL_WEIGHT = {
+    silent: 0,
+    error: 1,
+    warn: 2,
+    info: 3,
+    debug: 4,
+};
+/**
+ * True in development. Uses React Native's `__DEV__` when present, otherwise
+ * falls back to `process.env.NODE_ENV === 'development'`. Never throws.
+ */
+export function isDev() {
+    if (typeof __DEV__ !== 'undefined')
+        return __DEV__ === true;
+    try {
+        return typeof process !== 'undefined' && process.env?.NODE_ENV === 'development';
+    }
+    catch {
+        return false;
+    }
+}
+function formatPrefix(entry) {
+    const parts = [entry.timestamp, entry.level.toUpperCase()];
+    if (entry.namespace)
+        parts.push(`[${entry.namespace}]`);
+    return parts.join(' ');
+}
+/**
+ * Default sink: routes each entry to the matching `console` method. `info` and
+ * `debug` go to `console.log` (RN/browser-safe — `console.debug`/`console.info`
+ * are inconsistently surfaced across runtimes).
+ */
+export const consoleSink = (entry) => {
+    const extras = [];
+    if (entry.context && Object.keys(entry.context).length > 0)
+        extras.push(entry.context);
+    if (entry.error !== undefined)
+        extras.push(entry.error);
+    if (entry.args.length > 0)
+        extras.push(...entry.args);
+    const line = `${formatPrefix(entry)} ${entry.message}`;
+    if (entry.level === 'error')
+        console.error(line, ...extras);
+    else if (entry.level === 'warn')
+        console.warn(line, ...extras);
+    else
+        console.log(line, ...extras);
+};
+function defaultLevel() {
+    return isDev() ? 'debug' : 'info';
+}
+const config = {
+    level: defaultLevel(),
+    sink: consoleSink,
+};
+/**
+ * Update the global logger configuration. Affects every logger instance
+ * (root and children) immediately. Pass `{ level }` to gate output and/or
+ * `{ sink }` to redirect transport (pino, CloudWatch, a test capture, …).
+ */
+export function configureLogger(partial) {
+    if (partial.level !== undefined)
+        config.level = partial.level;
+    if (partial.sink !== undefined)
+        config.sink = partial.sink;
+}
+/** Read a snapshot of the current global configuration. */
+export function getLoggerConfig() {
+    return { level: config.level, sink: config.sink };
+}
+/** Restore the default level (env-derived) and the console sink. */
+export function resetLoggerConfig() {
+    config.level = defaultLevel();
+    config.sink = consoleSink;
+}
+function mergeContext(base, extra) {
+    if (!base)
+        return extra;
+    if (!extra)
+        return base;
+    return { ...base, ...extra };
+}
+function emit(level, namespace, baseContext, message, error, context, args) {
+    if (LEVEL_WEIGHT[level] > LEVEL_WEIGHT[config.level])
+        return;
+    config.sink({
+        level,
+        message,
+        namespace,
+        context: mergeContext(baseContext, context),
+        error,
+        args,
+        timestamp: new Date().toISOString(),
+    });
+}
+function makeLogger(namespace, baseContext) {
+    return {
+        namespace,
+        debug: (message, context, ...args) => emit('debug', namespace, baseContext, message, undefined, context, args),
+        info: (message, context, ...args) => emit('info', namespace, baseContext, message, undefined, context, args),
+        warn: (message, context, ...args) => emit('warn', namespace, baseContext, message, undefined, context, args),
+        error: (message, error, context, ...args) => emit('error', namespace, baseContext, message, error, context, args),
+        child: (childNamespace, childContext) => makeLogger(namespace ? `${namespace}:${childNamespace}` : childNamespace, mergeContext(baseContext, childContext)),
+    };
+}
+/** The shared root logger. Prefer a namespaced `createLogger(...)` in modules. */
+export const logger = makeLogger(undefined, undefined);
+/**
+ * Create a namespaced logger.
+ *
+ * @example
+ * ```ts
+ * const log = createLogger('mention:feed');
+ * log.info('loaded', { count: 20 });
+ * const sub = log.child('prefetch'); // namespace → 'mention:feed:prefetch'
+ * ```
+ */
+export function createLogger(namespace, context) {
+    return makeLogger(namespace, context);
+}

package/dist/esm/mixins/OxyServices.assets.js

@@ -1,5 +1,5 @@
 import { isReactNative } from '@oxyhq/protocol';
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
 /**
  * Maximum number of ids sent per `POST /assets/service/by-ids` request. Matches
@@ -359,7 +359,7 @@ export function OxyServicesAssetsMixin(Base) {
                 return response;
             }
             catch (error) {
-                console.error('File upload error:', error);
+                logger.error('File upload error', error, { component: 'OxyServices.assets' });
                 let errorMessage = 'File upload failed';
                 if (error instanceof Error) {
                     errorMessage = error.message || errorMessage;

package/dist/esm/mixins/OxyServices.auth.js

@@ -3,7 +3,7 @@ import { OxyAuthenticationError } from '../OxyServices.errors.js';
 import { KeyManager } from '../crypto/keyManager.js';
 import { SignatureService } from '../crypto/signatureService.js';
 import { loadNodeCrypto } from '@oxyhq/protocol';
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 import { normalizeUserIdentity, normalizeUserIdentityOrNull } from '../utils/userIdentity.js';
 /**
  * Default lifetime of a "Sign in with Oxy" device-flow session / authorize code.
@@ -847,6 +847,108 @@ export function OxyServicesAuthMixin(Base) {
                 throw this.handleError(error);
             }
         }
+        /**
+         * Begin a WebAuthn / passkey REGISTRATION ceremony. Requests the
+         * `PublicKeyCredentialCreationOptions` the browser's `navigator.credentials
+         * .create()` (or `@simplewebauthn/browser`'s `startRegistration`) needs.
+         *
+         * With a bearer token planted this links a passkey to the signed-in account
+         * (`username` ignored); without one it is a prospective signup and `username`
+         * is the desired handle. The returned options are OPAQUE — Oxy does not own
+         * their shape (the browser / `@simplewebauthn` does), so they pass through
+         * as `unknown` for the caller to hand straight to the ceremony.
+         */
+        async webauthnRegisterOptions(username) {
+            try {
+                return await this.makeRequest('POST', '/auth/webauthn/register/options', { ...(username !== undefined ? { username } : {}) }, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Finish a WebAuthn / passkey REGISTRATION ceremony. Forwards the opaque
+         * browser `RegistrationResponseJSON` (`response`) alongside the Oxy envelope
+         * (desired `username` for signup + the device-session naming fields).
+         *
+         * Two server branches, disambiguated by the response shape:
+         *  - **Signup** (no bearer): the account is created and a session minted —
+         *    the response carries `sessionId`, is the SAME {@link LoginResult}
+         *    contract as `POST /auth/verify`, and its access token is planted here.
+         *  - **Link** (bearer present): the passkey is attached to the signed-in
+         *    account and the server returns `{ success, message }` with no session,
+         *    which is returned verbatim (no token planting).
+         */
+        async webauthnRegisterVerify(response, envelope = {}) {
+            try {
+                const res = await this.makeRequest('POST', '/auth/webauthn/register/verify', { response, ...envelope }, { cache: false });
+                if (res && typeof res === 'object') {
+                    const record = res;
+                    // Signup branch: mints a session (LoginSessionResult, carries
+                    // `sessionId`). Parse against the login contract and plant the token.
+                    if ('sessionId' in record) {
+                        const parsed = safeParseContract(loginResultSchema, record);
+                        if (!parsed) {
+                            throw new Error('auth/webauthn/register/verify returned an unexpected response shape');
+                        }
+                        if (!('twoFactorRequired' in parsed) && parsed.accessToken) {
+                            this.setTokens(parsed.accessToken);
+                        }
+                        return parsed;
+                    }
+                    // Link branch: passkey attached to the signed-in account, no session.
+                    if (record.success === true && typeof record.message === 'string') {
+                        return { success: true, message: record.message };
+                    }
+                }
+                throw new Error('auth/webauthn/register/verify returned an unexpected response shape');
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Begin a WebAuthn / passkey AUTHENTICATION ceremony. Requests the
+         * `PublicKeyCredentialRequestOptions` the browser's `navigator.credentials
+         * .get()` (or `@simplewebauthn/browser`'s `startAuthentication`) needs.
+         *
+         * When `username` is present the server scopes `allowCredentials` to that
+         * user's passkeys (username-first); when omitted it returns an empty
+         * allow-list for the usernameless / discoverable-credential flow. The
+         * returned options are OPAQUE and pass through as `unknown`.
+         */
+        async webauthnLoginOptions(username) {
+            try {
+                return await this.makeRequest('POST', '/auth/webauthn/login/options', { ...(username !== undefined ? { username } : {}) }, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Finish a WebAuthn / passkey AUTHENTICATION ceremony. Forwards the opaque
+         * browser `AuthenticationResponseJSON` (`response`) alongside the
+         * device-session envelope. Resolves to the SAME {@link LoginResult} contract
+         * as `POST /auth/verify`; on the session arm the access token is planted
+         * immediately (mirroring {@link passwordSignIn}), and the response's
+         * `deviceId` + `deviceSecret` are the zero-cookie restore credential.
+         */
+        async webauthnLoginVerify(response, envelope = {}) {
+            try {
+                const res = await this.makeRequest('POST', '/auth/webauthn/login/verify', { response, ...envelope }, { cache: false });
+                const parsed = safeParseContract(loginResultSchema, res);
+                if (!parsed) {
+                    throw new Error('auth/webauthn/login/verify returned an unexpected response shape');
+                }
+                if (!('twoFactorRequired' in parsed) && parsed.accessToken) {
+                    this.setTokens(parsed.accessToken);
+                }
+                return parsed;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
         /**
          * Exchange an OAuth authorization code (returned to the RP redirect URI
          * after password sign-in at auth.oxy.so) for a device-first session.

package/dist/esm/mixins/OxyServices.language.js

@@ -3,7 +3,7 @@
  */
 import { normalizeLocale, getPrimaryLanguage, getLanguageMetadata, getLanguageName, getNativeLanguageName } from '../utils/languageUtils.js';
 import { loadAsyncStorage } from '@oxyhq/protocol';
-import { isDev } from '../shared/utils/debugUtils.js';
+import { logger } from '../logger/index.js';
 export function OxyServicesLanguageMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -28,7 +28,7 @@ export function OxyServicesLanguageMixin(Base) {
                     };
                 }
                 catch (error) {
-                    console.error('AsyncStorage not available in React Native:', error);
+                    logger.error('AsyncStorage not available in React Native', error, { component: 'OxyServices.language' });
                     throw new Error('AsyncStorage is required in React Native environment');
                 }
             }
@@ -83,9 +83,7 @@ export function OxyServicesLanguageMixin(Base) {
                 return null;
             }
             catch (error) {
-                if (isDev()) {
-                    console.warn('Failed to get current language:', error);
-                }
+                logger.warn('Failed to get current language', { component: 'OxyServices.language' }, error);
                 return null;
             }
         }

package/dist/esm/mixins/OxyServices.privacy.js

@@ -1,4 +1,4 @@
-import { isDev } from '../shared/utils/debugUtils.js';
+import { logger } from '../logger/index.js';
 export function OxyServicesPrivacyMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -26,9 +26,7 @@ export function OxyServicesPrivacyMixin(Base) {
             }
             catch (error) {
                 // If there's an error, assume not in list to avoid breaking functionality
-                if (isDev()) {
-                    console.warn('Error checking user list:', error);
-                }
+                logger.warn('Error checking user list', { component: 'OxyServices.privacy' }, error);
                 return false;
             }
         }

package/dist/esm/mixins/OxyServices.security.js

@@ -1,4 +1,4 @@
-import { isDev } from '../shared/utils/debugUtils.js';
+import { logger } from '../logger/index.js';
 export function OxyServicesSecurityMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -62,11 +62,9 @@ export function OxyServicesSecurityMixin(Base) {
                 await this.makeRequest('POST', '/security/activity/private-key-exported', { deviceId }, { cache: false });
             }
             catch (error) {
-                // Don't throw - logging failures shouldn't break user flow
-                // But log for monitoring
-                if (isDev()) {
-                    console.warn('[OxyServices] Failed to log private key exported event:', error);
-                }
+                // Don't throw - logging failures shouldn't break user flow, but surface
+                // for monitoring via the shared logger sink.
+                logger.warn('[OxyServices] Failed to log private key exported event', { component: 'OxyServices.security' }, error);
             }
         }
         /**
@@ -79,11 +77,9 @@ export function OxyServicesSecurityMixin(Base) {
                 await this.makeRequest('POST', '/security/activity/backup-created', { deviceId }, { cache: false });
             }
             catch (error) {
-                // Don't throw - logging failures shouldn't break user flow
-                // But log for monitoring
-                if (isDev()) {
-                    console.warn('[OxyServices] Failed to log backup created event:', error);
-                }
+                // Don't throw - logging failures shouldn't break user flow, but surface
+                // for monitoring via the shared logger sink.
+                logger.warn('[OxyServices] Failed to log backup created event', { component: 'OxyServices.security' }, error);
             }
         }
     };

package/dist/esm/mixins/OxyServices.topics.js

@@ -14,10 +14,10 @@ export function OxyServicesTopicsMixin(Base) {
                 const params = {};
                 if (locale)
                     params.locale = locale;
-                return await this.makeRequest('GET', '/topics/categories', params, {
-                    cache: true,
-                    cacheTTL: CACHE_TIMES.EXTRA_LONG,
-                });
+                // `GET /topics/categories` returns `{ categories: TopicData[] }` — the
+                // SDK's `unwrapResponse` only unwraps `{ data }`, so unwrap here.
+                const response = await this.makeRequest('GET', '/topics/categories', params, { cache: true, cacheTTL: CACHE_TIMES.EXTRA_LONG });
+                return response.categories ?? [];
             }
             catch (error) {
                 throw this.handleError(error);
@@ -34,9 +34,9 @@ export function OxyServicesTopicsMixin(Base) {
                 const params = { q: query };
                 if (limit)
                     params.limit = limit;
-                return await this.makeRequest('GET', '/topics/search', params, {
-                    cache: false,
-                });
+                // `GET /topics/search` returns `{ topics: TopicData[] }` — unwrap it.
+                const response = await this.makeRequest('GET', '/topics/search', params, { cache: false });
+                return response.topics ?? [];
             }
             catch (error) {
                 throw this.handleError(error);
@@ -45,7 +45,7 @@ export function OxyServicesTopicsMixin(Base) {
         /**
          * List topics with optional filters
          * @param options - Filter and pagination options
-         * @returns List of topics
+         * @returns Paginated topics envelope (`topics` plus `total`/`limit`/`offset`)
          */
         async listTopics(options) {
             try {
@@ -60,10 +60,18 @@ export function OxyServicesTopicsMixin(Base) {
                     params.offset = options.offset;
                 if (options?.locale)
                     params.locale = options.locale;
-                return await this.makeRequest('GET', '/topics', params, {
-                    cache: true,
-                    cacheTTL: CACHE_TIMES.SHORT,
-                });
+                // `GET /topics` returns `{ topics, total, limit, offset }`. The pagination
+                // fields matter to callers, so return the whole envelope (typed) rather
+                // than throwing them away.
+                const response = await this.makeRequest('GET', '/topics', params, { cache: true, cacheTTL: CACHE_TIMES.SHORT });
+                const requestedLimit = typeof params.limit === 'number' ? params.limit : 0;
+                const requestedOffset = typeof params.offset === 'number' ? params.offset : 0;
+                return {
+                    topics: response.topics ?? [],
+                    total: response.total ?? response.topics?.length ?? 0,
+                    limit: response.limit ?? requestedLimit,
+                    offset: response.offset ?? requestedOffset,
+                };
             }
             catch (error) {
                 throw this.handleError(error);
@@ -92,9 +100,11 @@ export function OxyServicesTopicsMixin(Base) {
          */
         async resolveTopicNames(names) {
             try {
-                return await this.makeRequest('POST', '/topics/resolve', { names }, {
-                    cache: false,
-                });
+                // `POST /topics/resolve` returns `{ topics: Record<name, TopicData> }`
+                // (a name-keyed map, not an array). Unwrap and flatten to the resolved
+                // topics; each TopicData carries its own `name` for re-keying.
+                const response = await this.makeRequest('POST', '/topics/resolve', { names }, { cache: false });
+                return Object.values(response.topics ?? {});
             }
             catch (error) {
                 throw this.handleError(error);

package/dist/esm/mixins/OxyServices.user.js

@@ -3,7 +3,7 @@ import { buildSearchParams, buildPaginationParams } from '../utils/apiUtils.js';
 import { KeyManager } from '../crypto/keyManager.js';
 import { SignatureService } from '../crypto/signatureService.js';
 import { normalizeUserIdentity, normalizeUserIdentityOrNull } from '../utils/userIdentity.js';
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
 /**
  * Maximum number of ids sent per `POST /users/by-ids` request. Matches the

package/dist/esm/mixins/OxyServices.utility.js

@@ -7,7 +7,7 @@
 import { jwtDecode } from 'jwt-decode';
 import { loadNodeCrypto } from '@oxyhq/protocol';
 import { buildUrl } from '../utils/apiUtils.js';
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 /**
  * Expected JWT audience for tokens issued by the Oxy auth service.
  */

package/dist/esm/session/SessionClient.js

@@ -1,5 +1,5 @@
 import { deviceSessionStateSchema, deviceSessionSyncSchema, safeParseContract, SESSION_ACCOUNTS_CHANGED_EVENT, sessionAccountsChangedEventSchema, } from '@oxyhq/contracts';
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 import { getSocketIO } from './socketLoader.js';
 /**
  * Same-origin `BroadcastChannel` name for instant, network-free session-state

package/dist/esm/session/accountDialogController.js

@@ -25,7 +25,7 @@
  * (auth.oxy.so). {@link AccountDialogController.openPasswordAtOxyAuth} only
  * builds the hand-off URL; device-first convergence syncs the session back.
  */
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
 import { CENTRAL_IDP_APEX } from '../utils/authWebUrl.js';
 import { generateOAuthState, generatePkcePair, normalizeOAuthRedirectUri, persistOAuthHandshake, } from '../utils/oauthPkce.js';

package/dist/esm/session/authStateStore.js

@@ -16,7 +16,7 @@
  *
  * ESM-safe (no `require()`).
  */
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 /**
  * Versioned DURABLE storage key. Holds ONLY the small, re-mint-critical fields
  * (`sessionId`, `userId`, `deviceId`, `deviceSecret`) — never the large JWT

package/dist/esm/session/refresh.js

@@ -1,6 +1,6 @@
 import { isNative } from '../utils/platform.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 /**
  * Lead time (ms) before access-token expiry at which the proactive scheduler
  * re-mints. Mirrors `HttpService`'s per-request `TOKEN_REFRESH_LEAD_SECONDS`

package/dist/esm/session/socketLoader.js

@@ -1,4 +1,4 @@
-import { logger } from '../utils/loggerUtils.js';
+import { logger } from '../logger/index.js';
 let cachedFactory = null;
 let loadAttempted = false;
 export async function getSocketIO() {

package/dist/esm/utils/asyncUtils.js

@@ -1,7 +1,7 @@
 /**
  * Async utilities for common asynchronous patterns and error handling
  */
-import { logger } from './loggerUtils.js';
+import { logger } from '../logger/index.js';
 /**
  * Wrapper for async operations with automatic error handling
  * Returns null on error instead of throwing

package/dist/esm/utils/avatarUtils.js

@@ -1,3 +1,4 @@
+import { logger } from '../logger/index.js';
 /**
  * Updates file visibility to public for avatar use.
  * Logs non-404 errors to help debug upload issues.
@@ -19,7 +20,7 @@ export async function updateAvatarVisibility(fileId, oxyServices, contextName =
             ? visError.status
             : undefined;
         if (status !== 404) {
-            console.error(`[${contextName}] Failed to update avatar visibility for ${fileId}:`, visError);
+            logger.error(`[${contextName}] Failed to update avatar visibility for ${fileId}`, visError, { component: contextName });
         }
     }
 }

package/dist/esm/utils/deviceManager.js

@@ -1,4 +1,6 @@
 import { loadAsyncStorage } from '@oxyhq/protocol';
+import { createLogger } from '../logger/index.js';
+const log = createLogger('DeviceManager');
 /**
  * Client-side device management utility
  * Handles persistent device identification across app sessions
@@ -28,7 +30,7 @@ export class DeviceManager {
                 };
             }
             catch (error) {
-                console.error('AsyncStorage not available in React Native:', error);
+                log.error('AsyncStorage not available in React Native', error);
                 throw new Error('AsyncStorage is required in React Native environment');
             }
         }
@@ -79,7 +81,7 @@ export class DeviceManager {
             return await this.createNewDeviceInfo();
         }
         catch (error) {
-            console.error('Error getting device info:', error);
+            log.error('Error getting device info', error);
             return await this.createNewDeviceInfo();
         }
     }
@@ -105,7 +107,7 @@ export class DeviceManager {
             await storage.setItem(this.DEVICE_KEY, JSON.stringify(deviceInfo));
         }
         catch (error) {
-            console.error('Error saving device info:', error);
+            log.error('Error saving device info', error);
         }
     }
     /**
@@ -118,7 +120,7 @@ export class DeviceManager {
             await this.saveDeviceInfo(deviceInfo);
         }
         catch (error) {
-            console.error('Error updating device name:', error);
+            log.error('Error updating device name', error);
         }
     }
     /**
@@ -130,7 +132,7 @@ export class DeviceManager {
             await storage.removeItem(this.DEVICE_KEY);
         }
         catch (error) {
-            console.error('Error clearing device info:', error);
+            log.error('Error clearing device info', error);
         }
     }
     /**

package/dist/esm/utils/errorUtils.js

@@ -1,4 +1,4 @@
-import { logger } from './loggerUtils.js';
+import { logger } from '../logger/index.js';
 /**
  * Error handling utilities for consistent error processing
  */