@oxyhq/core 9.2.0 → 9.2.2

package/dist/cjs/boot/sessionColdBoot.js

@@ -109,6 +109,19 @@ async function runSessionColdBoot(opts) {
             if (!session?.accessToken) {
                 return { kind: 'skip' };
             }
+            // `verifyChallenge` mints a rotating deviceSecret; persist it so the next
+            // boot can use the faster device-secret-mint lane (sockets + tab-focus
+            // re-mint depend on the credential being in the store).
+            if (session.deviceId && session.deviceSecret) {
+                await store.save({
+                    sessionId: session.sessionId,
+                    userId: session.user.id,
+                    deviceId: session.deviceId,
+                    deviceSecret: session.deviceSecret,
+                    accessToken: session.accessToken,
+                    expiresAt: session.expiresAt,
+                });
+            }
             return {
                 kind: 'session',
                 session: {

package/dist/cjs/index.js

@@ -18,10 +18,10 @@
  * If a symbol does not appear here, it is NOT part of the public API.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.isRTLLocale = exports.normalizeLanguageCode = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.RecoveryPhraseService = exports.SignatureService = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyServices = void 0;
-exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.translate = exports.createDebugLogger = exports.debugError = exports.debugWarn = exports.debugLog = exports.isDev = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = void 0;
-exports.buildHubSyncUrl = exports.buildIdpHubOrigin = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.normalizeOAuthRedirectUri = exports.OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = exports.OXY_SILENT_OAUTH_ATTEMPTED_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.logPerformance = exports.logPayment = exports.logDevice = exports.logUser = exports.logSession = exports.logApi = exports.logAuth = exports.LogLevel = exports.logger = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.isValidDisplayName = void 0;
-exports.packageInfo = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshPersistedSession = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.redeemHubTicketOnHub = exports.syncHubAfterSignIn = exports.parseHubSyncReturnUrl = exports.normalizeOfficialReturnOrigin = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isIdpHubOrigin = void 0;
+exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.isRTLLocale = exports.normalizeLanguageCode = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.RecoveryPhraseService = exports.SignatureService = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.ORGANIZATION_CATEGORIES = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyServices = void 0;
+exports.isValidUsername = exports.isValidEmail = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.translate = exports.createDebugLogger = exports.debugError = exports.debugWarn = exports.debugLog = exports.isDev = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = void 0;
+exports.buildIdpHubOrigin = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.normalizeOAuthRedirectUri = exports.OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = exports.OXY_SILENT_OAUTH_ATTEMPTED_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.logPerformance = exports.logPayment = exports.logDevice = exports.logUser = exports.logSession = exports.logApi = exports.logAuth = exports.LogLevel = exports.logger = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.isValidDisplayName = exports.isValidPassword = void 0;
+exports.packageInfo = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshPersistedSession = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.redeemHubTicketOnHub = exports.syncHubAfterSignIn = exports.parseHubSyncReturnUrl = exports.normalizeOfficialReturnOrigin = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isIdpHubOrigin = exports.buildHubSyncUrl = void 0;
 // Ensure crypto polyfills are loaded before anything else
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
@@ -53,6 +53,8 @@ Object.defineProperty(exports, "getCanonicalUserHandle", { enumerable: true, get
 Object.defineProperty(exports, "getNormalizedUserHandle", { enumerable: true, get: function () { return userHandle_1.getNormalizedUserHandle; } });
 var profileLinks_1 = require("./utils/profileLinks");
 Object.defineProperty(exports, "normalizeProfileLinks", { enumerable: true, get: function () { return profileLinks_1.normalizeProfileLinks; } });
+var OxyServices_accounts_1 = require("./mixins/OxyServices.accounts");
+Object.defineProperty(exports, "ORGANIZATION_CATEGORIES", { enumerable: true, get: function () { return OxyServices_accounts_1.ORGANIZATION_CATEGORIES; } });
 // ---------------------------------------------------------------------------
 // Self-sovereign identity (DID, signed records, auth-method ↔ VM mapping,
 // verified domains). Wire shapes (DidDocument, SignedRecordEnvelope,

package/dist/cjs/mixins/OxyServices.accounts.js

@@ -1,8 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORGANIZATION_CATEGORIES = void 0;
 exports.OxyServicesAccountsMixin = OxyServicesAccountsMixin;
 const userIdentity_1 = require("../utils/userIdentity");
 const mixinHelpers_1 = require("./mixinHelpers");
+var contracts_1 = require("@oxyhq/contracts");
+Object.defineProperty(exports, "ORGANIZATION_CATEGORIES", { enumerable: true, get: function () { return contracts_1.ORGANIZATION_CATEGORIES; } });
 function OxyServicesAccountsMixin(Base) {
     return class extends Base {
         constructor(...args) {

package/dist/cjs/mixins/OxyServices.utility.js

@@ -9,8 +9,8 @@ exports.OxyServicesUtilityMixin = OxyServicesUtilityMixin;
  */
 const jwt_decode_1 = require("jwt-decode");
 const protocol_1 = require("@oxyhq/protocol");
+const apiUtils_1 = require("../utils/apiUtils");
 const loggerUtils_1 = require("../utils/loggerUtils");
-const mixinHelpers_1 = require("./mixinHelpers");
 /**
  * Expected JWT audience for tokens issued by the Oxy auth service.
  */
@@ -111,10 +111,14 @@ function OxyServicesUtilityMixin(Base) {
          */
         async fetchLinkMetadata(url) {
             try {
-                return await this.makeRequest('GET', '/link-metadata', { url }, {
-                    cache: true,
-                    cacheTTL: mixinHelpers_1.CACHE_TIMES.EXTRA_LONG,
-                });
+                const path = (0, apiUtils_1.buildUrl)('/links/preview', { url, wait: 1 });
+                const preview = await this.makeRequest('GET', path, undefined, { cache: false });
+                return {
+                    url: preview.url,
+                    title: preview.title?.trim() || preview.url.replace(/^https?:\/\//, '').replace(/\/$/, ''),
+                    description: preview.description?.trim() || 'Link',
+                    image: preview.image,
+                };
             }
             catch (error) {
                 throw this.handleError(error);

package/dist/cjs/session/SessionClient.js

@@ -24,6 +24,10 @@ class SessionClient {
         this.started = false;
         /** Same-origin cross-tab state-propagation channel; null on platforms without BroadcastChannel. */
         this.channel = null;
+        /** App-facing subscriptions to named server-pushed socket events. */
+        this.serverEvents = new Map();
+        /** Event names already bound on the CURRENT socket instance. */
+        this.boundServerEvents = new Set();
     }
     getState() {
         return this.state;
@@ -34,6 +38,41 @@ class SessionClient {
             this.listeners.delete(listener);
         };
     }
+    /**
+     * Subscribe to a named server-pushed Socket.IO event (e.g. `civic:attested`).
+     * Listeners survive reconnects and socket re-creation; the returned function
+     * unsubscribes. Payloads are delivered as-is — callers validate shape.
+     */
+    onServerEvent(event, listener) {
+        let listeners = this.serverEvents.get(event);
+        if (!listeners) {
+            listeners = new Set();
+            this.serverEvents.set(event, listeners);
+        }
+        listeners.add(listener);
+        this.bindServerEvent(event);
+        return () => {
+            listeners.delete(listener);
+        };
+    }
+    bindServerEvent(event) {
+        if (!this.socket || this.boundServerEvents.has(event))
+            return;
+        this.boundServerEvents.add(event);
+        this.socket.on(event, (payload) => {
+            const listeners = this.serverEvents.get(event);
+            if (!listeners)
+                return;
+            for (const listener of [...listeners]) {
+                try {
+                    listener(payload);
+                }
+                catch (error) {
+                    loggerUtils_1.logger.warn('[SessionClient] server-event listener threw', { component: 'SessionClient' }, error);
+                }
+            }
+        });
+    }
     notify() {
         for (const listener of this.listeners) {
             try {
@@ -213,6 +252,7 @@ class SessionClient {
         if (this.socket) {
             this.socket.disconnect();
             this.socket = null;
+            this.boundServerEvents.clear();
         }
     }
     async connectSocket() {
@@ -267,6 +307,11 @@ class SessionClient {
             }
         });
         this.socket = socket;
+        // (Re)bind app-facing server-event subscriptions on the fresh socket.
+        this.boundServerEvents.clear();
+        for (const event of this.serverEvents.keys()) {
+            this.bindServerEvent(event);
+        }
     }
     /**
      * Open the same-origin `BroadcastChannel` (web only). A sibling tab that

package/dist/cjs/session/accountDialogController.js

@@ -34,6 +34,12 @@ const authWebUrl_1 = require("../utils/authWebUrl");
 const oauthPkce_1 = require("../utils/oauthPkce");
 const accountProjection_1 = require("./accountProjection");
 const DEFAULT_POLL_INTERVAL_MS = 3000;
+/**
+ * Commons's custom URL scheme. Probed via the injected `canOpenApp` to detect an
+ * installed Commons on the same device; the `oxycommons://approve?...` deep link
+ * itself is the flow's `qrPayload`.
+ */
+const COMMONS_APP_SCHEME = 'oxycommons://';
 const IDLE_SIGN_IN = {
     phase: 'idle',
     authorizeCode: null,
@@ -76,6 +82,7 @@ class AccountDialogController {
         this.authRedirectUri = options.authRedirectUri ?? null;
         this.pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
         this.openUrl = options.openUrl;
+        this.canOpenApp = options.canOpenApp;
         this.snapshot = this.computeSnapshot();
     }
     // =========================================================================
@@ -400,11 +407,34 @@ class AccountDialogController {
                 error: null,
             });
             this.scheduleNextPoll(handle.sessionToken);
+            // Same-device convenience: if Commons is installed (native only — `canOpenApp`
+            // is undefined/false on web), deep-link straight into its approve screen with
+            // the same `oxycommons://approve?...` payload the QR encodes. The QR + polling
+            // stay live as the fallback, so a user who dismisses the app-open still
+            // completes the sign-in by scanning.
+            void this.maybeOpenCommons(handle.qrPayload);
         }
         catch (error) {
             this.setSignIn({ ...IDLE_SIGN_IN, phase: 'error', error: errorMessage(error) });
         }
     }
+    /**
+     * When a `canOpenApp` probe is injected and reports Commons installed, open the
+     * approve deep link via the injected `openUrl`. Best-effort and non-blocking: a
+     * probe/open failure is logged and swallowed — the QR/polling fallback remains.
+     */
+    async maybeOpenCommons(qrPayload) {
+        if (!this.canOpenApp || !this.openUrl)
+            return;
+        try {
+            if (await this.canOpenApp(COMMONS_APP_SCHEME)) {
+                this.openUrl(qrPayload);
+            }
+        }
+        catch (error) {
+            loggerUtils_1.logger.debug('[AccountDialogController] Commons deep-link probe failed (QR fallback active)', { component: 'AccountDialogController' }, error);
+        }
+    }
     /** Tear down the active sign-in device flow (timers + token) and reset to idle. */
     cancelSignIn() {
         this.clearPollTimer();
@@ -527,6 +557,7 @@ class AccountDialogController {
                 expiresAt: claimed.expiresAt ?? '',
                 user: minimalUser,
                 accessToken: claimed.accessToken,
+                ...(claimed.deviceSecret ? { deviceSecret: claimed.deviceSecret } : {}),
             }, minimalUser);
         }
         catch (error) {

package/dist/cjs/session/authStateStore.js

@@ -18,16 +18,38 @@
  * ESM-safe (no `require()`).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTH_STATE_STORAGE_KEY = void 0;
+exports.AUTH_STATE_TOKEN_STORAGE_KEY = exports.AUTH_STATE_STORAGE_KEY = void 0;
 exports.createMemoryAuthStateStore = createMemoryAuthStateStore;
 exports.createWebAuthStateStore = createWebAuthStateStore;
 exports.createNativeAuthStateStore = createNativeAuthStateStore;
+const loggerUtils_1 = require("../utils/loggerUtils");
 /**
- * Versioned storage key. The `.v1` suffix lets a future shape change ship a
- * `.v2` key without reading a stale/incompatible `.v1` blob. Distinct from the
- * `oxy_shared_*` keychain keys in `KeyManager`, so it never collides.
+ * Versioned DURABLE storage key. Holds ONLY the small, re-mint-critical fields
+ * (`sessionId`, `userId`, `deviceId`, `deviceSecret`) — never the large JWT
+ * `accessToken`. Keeping this blob small (<2KB) matters on Android
+ * `expo-secure-store`, whose backing store can silently fail to persist an
+ * oversize value; bundling the token here previously took the mint credential
+ * down with it on every write, losing the session on cold restart.
+ *
+ * The `.v1` suffix lets a future shape change ship a `.v2` key without reading a
+ * stale/incompatible `.v1` blob. Distinct from the `oxy_shared_*` keychain keys
+ * in `KeyManager`, so it never collides.
+ *
+ * BACK-COMPAT: pre-split builds wrote the WHOLE state (including `accessToken` /
+ * `expiresAt`) into this single key. `load()` still reads those token fields
+ * from here when the warm key ({@link AUTH_STATE_TOKEN_STORAGE_KEY}) is absent,
+ * so upgrading users are not signed out; the next `save()` splits them apart.
  */
 exports.AUTH_STATE_STORAGE_KEY = 'oxy.auth.v1';
+/**
+ * Versioned BEST-EFFORT warm-token storage key. Holds the short-lived
+ * `{ accessToken, expiresAt }` pair only. Its write is genuinely non-fatal — a
+ * failure (quota / oversize keychain value) is swallowed because the session is
+ * fully re-mintable from the durable `deviceSecret`. Kept separate from
+ * {@link AUTH_STATE_STORAGE_KEY} so a failed token write can NEVER abort or
+ * corrupt the durable credential write.
+ */
+exports.AUTH_STATE_TOKEN_STORAGE_KEY = 'oxy.auth.token.v1';
 /**
  * Parse + shape-validate a stored blob. Returns `null` for anything that is
  * not a well-formed {@link PersistedAuthState} (absent, malformed JSON, wrong
@@ -78,6 +100,95 @@ function deserialize(raw) {
     }
     return state;
 }
+/**
+ * Parse the best-effort warm-token blob. Returns `null` for anything not a
+ * well-formed object so a corrupt warm entry simply forgoes the warm-boot
+ * optimization (the durable credential re-mints a fresh token).
+ */
+function parseWarmToken(raw) {
+    if (!raw) {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== 'object') {
+        return null;
+    }
+    const candidate = parsed;
+    const warm = {};
+    if (typeof candidate.accessToken === 'string' && candidate.accessToken.length > 0) {
+        warm.accessToken = candidate.accessToken;
+    }
+    if (typeof candidate.expiresAt === 'string' && candidate.expiresAt.length > 0) {
+        warm.expiresAt = candidate.expiresAt;
+    }
+    return warm;
+}
+/** Serialize ONLY the small, re-mint-critical fields for the durable key. */
+function serializeDurable(state) {
+    const durable = {
+        sessionId: state.sessionId,
+        userId: state.userId,
+    };
+    if (state.deviceId) {
+        durable.deviceId = state.deviceId;
+    }
+    if (state.deviceSecret) {
+        durable.deviceSecret = state.deviceSecret;
+    }
+    return JSON.stringify(durable);
+}
+/**
+ * Serialize the warm-token blob, or `null` when there is no token to persist
+ * (so the caller clears the warm key rather than writing an empty object).
+ */
+function serializeWarmToken(state) {
+    const warm = {};
+    if (state.accessToken) {
+        warm.accessToken = state.accessToken;
+    }
+    if (state.expiresAt) {
+        warm.expiresAt = state.expiresAt;
+    }
+    if (!warm.accessToken && !warm.expiresAt) {
+        return null;
+    }
+    return JSON.stringify(warm);
+}
+/**
+ * Compose the unchanged {@link PersistedAuthState} return shape from the two
+ * on-disk keys. `accessToken` / `expiresAt` come from the warm key when it is
+ * present; when the warm key is ABSENT the token fields fall back to whatever
+ * the durable blob carried — the pre-split combined `oxy.auth.v1` blob (BACK-COMPAT).
+ */
+function composeState(durableRaw, warmRaw) {
+    const state = deserialize(durableRaw);
+    if (!state) {
+        return null;
+    }
+    if (warmRaw !== null) {
+        // New split layout: the warm key is authoritative for the token fields.
+        // Drop anything the durable blob may have carried, then overlay the warm
+        // values (a warm key with no token → the session simply has no warm token).
+        delete state.accessToken;
+        delete state.expiresAt;
+        const warm = parseWarmToken(warmRaw);
+        if (warm?.accessToken) {
+            state.accessToken = warm.accessToken;
+        }
+        if (warm?.expiresAt) {
+            state.expiresAt = warm.expiresAt;
+        }
+    }
+    // else: BACK-COMPAT — the warm key is absent, so `deserialize` already applied
+    // any `accessToken` / `expiresAt` from the old combined blob.
+    return state;
+}
 /**
  * A process-lifetime, in-memory {@link AuthStateStore}. Used directly for
  * tests/SSR and as the degraded fallback of the web store when `localStorage`
@@ -115,8 +226,9 @@ function safeGetLocalStorage() {
     }
 }
 /**
- * A `localStorage`-backed {@link AuthStateStore} under the versioned
- * {@link AUTH_STATE_STORAGE_KEY}.
+ * A `localStorage`-backed {@link AuthStateStore} split across the durable
+ * {@link AUTH_STATE_STORAGE_KEY} (mint credential) and the best-effort
+ * {@link AUTH_STATE_TOKEN_STORAGE_KEY} (warm access token).
  *
  * Resilience:
  *  - If `localStorage` is unreachable (sandboxed-iframe `SecurityError`, SSR),
@@ -143,7 +255,7 @@ function createWebAuthStateStore() {
                 return sessionMirror;
             }
             try {
-                return deserialize(storage.getItem(exports.AUTH_STATE_STORAGE_KEY));
+                return composeState(storage.getItem(exports.AUTH_STATE_STORAGE_KEY), storage.getItem(exports.AUTH_STATE_TOKEN_STORAGE_KEY));
             }
             catch {
                 return null;
@@ -151,12 +263,35 @@ function createWebAuthStateStore() {
         },
         save: async (state) => {
             sessionMirror = state; // mirror FIRST — authoritative even if persist fails
+            // Durable credential FIRST, then VERIFY it landed. The in-memory mirror
+            // keeps the session live for this page, but a failed DURABLE write means
+            // the mint credential will NOT survive a reload — surface it, never swallow.
+            let durablePersisted = false;
+            try {
+                const durableJson = serializeDurable(state);
+                storage.setItem(exports.AUTH_STATE_STORAGE_KEY, durableJson);
+                durablePersisted = storage.getItem(exports.AUTH_STATE_STORAGE_KEY) === durableJson;
+                if (!durablePersisted) {
+                    loggerUtils_1.logger.error('[authStateStore] durable credential read-back mismatch after save — the device credential did not persist; the session survives this process via the in-memory mirror but will be lost on reload', undefined, { component: 'authStateStore' });
+                }
+            }
+            catch (error) {
+                loggerUtils_1.logger.error('[authStateStore] durable credential persist threw — the device credential did not persist; the session survives this process via the in-memory mirror but will be lost on reload', error, { component: 'authStateStore' });
+            }
+            // Warm token AFTER, best-effort. Its failure is genuinely non-fatal (the
+            // durable credential re-mints a fresh token) and must never abort or
+            // corrupt the durable write above.
             try {
-                storage.setItem(exports.AUTH_STATE_STORAGE_KEY, JSON.stringify(state));
+                const warmJson = serializeWarmToken(state);
+                if (warmJson) {
+                    storage.setItem(exports.AUTH_STATE_TOKEN_STORAGE_KEY, warmJson);
+                }
+                else {
+                    storage.removeItem(exports.AUTH_STATE_TOKEN_STORAGE_KEY);
+                }
             }
             catch {
-                // Quota / private-mode / disabled storage — non-fatal. The session
-                // stays live via the in-memory mirror; only reload durability is lost.
+                // Quota / private-mode / disabled storage — non-fatal warm-boot loss only.
             }
         },
         clear: async () => {
@@ -167,6 +302,12 @@ function createWebAuthStateStore() {
             catch {
                 // Non-fatal — see save().
             }
+            try {
+                storage.removeItem(exports.AUTH_STATE_TOKEN_STORAGE_KEY);
+            }
+            catch {
+                // Non-fatal — see save().
+            }
         },
     };
 }
@@ -174,9 +315,12 @@ function createWebAuthStateStore() {
  * A native {@link AuthStateStore} over an injected async key/value store.
  *
  * `@oxyhq/core` never imports `expo-secure-store`; `@oxyhq/services` constructs
- * the SecureStore-backed adapter and passes it here. Every operation is wrapped
- * so a storage exception degrades gracefully (read → `null`, write → swallowed)
- * exactly like the web store.
+ * the SecureStore-backed adapter and passes it here. Persistence is split across
+ * the durable {@link AUTH_STATE_STORAGE_KEY} (mint credential) and the
+ * best-effort {@link AUTH_STATE_TOKEN_STORAGE_KEY} (warm access token) — the
+ * durable write is read-back-verified and its failure surfaced (not swallowed),
+ * while the warm-token write and all reads degrade gracefully exactly like the
+ * web store.
  */
 function createNativeAuthStateStore(storage) {
     // Same in-memory mirror as the web store — a locked/failed SecureStore write
@@ -188,7 +332,11 @@ function createNativeAuthStateStore(storage) {
                 return sessionMirror;
             }
             try {
-                return deserialize(await storage.getItem(exports.AUTH_STATE_STORAGE_KEY));
+                const [durableRaw, warmRaw] = await Promise.all([
+                    storage.getItem(exports.AUTH_STATE_STORAGE_KEY),
+                    storage.getItem(exports.AUTH_STATE_TOKEN_STORAGE_KEY),
+                ]);
+                return composeState(durableRaw, warmRaw);
             }
             catch {
                 return null;
@@ -196,11 +344,37 @@ function createNativeAuthStateStore(storage) {
         },
         save: async (state) => {
             sessionMirror = state;
+            // Durable credential FIRST, then VERIFY. On Android SecureStore an
+            // oversize/failed write can resolve WITHOUT throwing, so a read-back is the
+            // only reliable proof. The mirror keeps the session live for this app run,
+            // but a failed DURABLE write means the mint credential will NOT survive a
+            // cold restart — surface it, never swallow.
+            let durablePersisted = false;
             try {
-                await storage.setItem(exports.AUTH_STATE_STORAGE_KEY, JSON.stringify(state));
+                const durableJson = serializeDurable(state);
+                await storage.setItem(exports.AUTH_STATE_STORAGE_KEY, durableJson);
+                durablePersisted = (await storage.getItem(exports.AUTH_STATE_STORAGE_KEY)) === durableJson;
+                if (!durablePersisted) {
+                    loggerUtils_1.logger.error('[authStateStore] durable credential read-back mismatch after save — the device credential did not persist (likely oversize SecureStore value); the session survives this app run via the in-memory mirror but will be lost on cold restart', undefined, { component: 'authStateStore' });
+                }
+            }
+            catch (error) {
+                loggerUtils_1.logger.error('[authStateStore] durable credential persist threw — the device credential did not persist; the session survives this app run via the in-memory mirror but will be lost on cold restart', error, { component: 'authStateStore' });
+            }
+            // Warm token AFTER, best-effort. Its failure is genuinely non-fatal (the
+            // durable credential re-mints a fresh token) and must never abort or
+            // corrupt the durable write above.
+            try {
+                const warmJson = serializeWarmToken(state);
+                if (warmJson) {
+                    await storage.setItem(exports.AUTH_STATE_TOKEN_STORAGE_KEY, warmJson);
+                }
+                else {
+                    await storage.removeItem(exports.AUTH_STATE_TOKEN_STORAGE_KEY);
+                }
             }
             catch {
-                // Non-fatal — session stays live via the in-memory mirror.
+                // Locked / oversize keychain — non-fatal warm-boot loss only.
             }
         },
         clear: async () => {
@@ -211,6 +385,12 @@ function createNativeAuthStateStore(storage) {
             catch {
                 // Non-fatal.
             }
+            try {
+                await storage.removeItem(exports.AUTH_STATE_TOKEN_STORAGE_KEY);
+            }
+            catch {
+                // Non-fatal.
+            }
         },
     };
 }