@oxyhq/services 19.1.1 → 19.1.3

package/src/ui/context/useOxyAccountGraph.ts

@@ -83,7 +83,7 @@ export function useOxyAccountGraph({
         {
           sessionId: result.sessionId,
           accessToken: result.accessToken,
-          deviceSecret: (result as { deviceSecret?: string }).deviceSecret,
+          deviceSecret: result.deviceSecret,
           deviceId: result.deviceId,
           expiresAt: result.expiresAt,
           userId: result.user.id,

package/src/ui/hooks/useOxyEvent.ts

@@ -0,0 +1,22 @@
+import { useEffect, useRef } from 'react';
+
+import { useOxy } from '../context/OxyContext';
+
+/**
+ * Subscribe to a named server-pushed Socket.IO event (e.g. `civic:attested`)
+ * for the lifetime of the component. Payloads arrive as `unknown` — callers
+ * validate shape. Handler identity may change between renders; the latest one
+ * is always invoked.
+ */
+export function useOxyEvent(event: string, handler: (payload: unknown) => void): void {
+  const { sessionClient } = useOxy();
+  const handlerRef = useRef(handler);
+  handlerRef.current = handler;
+
+  useEffect(() => {
+    if (!sessionClient) return;
+    return sessionClient.onServerEvent(event, (payload) => {
+      handlerRef.current(payload);
+    });
+  }, [sessionClient, event]);
+}

package/src/ui/screens/CreateAccountScreen.tsx

@@ -9,7 +9,8 @@ import {
   TouchableOpacity,
 } from 'react-native';
 import { Ionicons } from '@expo/vector-icons';
-import type { AccountKind, CreateAccountInput } from '@oxyhq/core';
+import type { AccountKind, CreateAccountInput, OrganizationCategory } from '@oxyhq/core';
+import { ORGANIZATION_CATEGORIES } from '@oxyhq/core';
 import type { BaseScreenProps } from '../types/navigation';
 import Header from '../components/Header';
 import { useI18n } from '../hooks/useI18n';
@@ -72,6 +73,24 @@ const kindDescription = (
   }
 };
 
+const organizationCategoryLabel = (
+  t: (key: string, vars?: Record<string, string | number>) => string,
+  category: OrganizationCategory,
+): string => {
+  switch (category) {
+    case 'agency':
+      return t('accounts.organizationCategory.agency') || 'Real estate agency';
+    case 'cooperative':
+      return t('accounts.organizationCategory.cooperative') || 'Housing cooperative';
+    case 'landlord':
+      return t('accounts.organizationCategory.landlord') || 'Landlord / property manager';
+    default:
+      return t('accounts.organizationCategory.other') || 'Other organization';
+  }
+};
+
+const ORGANIZATION_CATEGORY_OPTIONS: OrganizationCategory[] = [...ORGANIZATION_CATEGORIES];
+
 /**
  * Create a new account in the unified account graph (an organization, project,
  * or bot). The caller becomes its owner. Optionally nested under a parent
@@ -90,6 +109,7 @@ const CreateAccountScreen: React.FC<BaseScreenProps> = ({
   const parentId = typeof parentAccountId === 'string' ? parentAccountId : undefined;
 
   const [kind, setKind] = useState<CreatableAccountKind>('project');
+  const [organizationCategory, setOrganizationCategory] = useState<OrganizationCategory>('agency');
   const [username, setUsername] = useState('');
   const [displayName, setDisplayName] = useState('');
   const [bio, setBio] = useState('');
@@ -175,6 +195,7 @@ const CreateAccountScreen: React.FC<BaseScreenProps> = ({
         username,
         name: { first: firstName, last: lastName },
         bio: bio.trim() || undefined,
+        ...(kind === 'organization' ? { organizationCategory } : null),
         ...(parentId ? { parentAccountId: parentId } : null),
       };
       const account = await createAccount(input);
@@ -197,7 +218,7 @@ const CreateAccountScreen: React.FC<BaseScreenProps> = ({
     } finally {
       setIsCreating(false);
     }
-  }, [canCreate, kind, username, displayName, bio, parentId, createAccount, switchToAccount, onClose, t]);
+  }, [canCreate, kind, organizationCategory, username, displayName, bio, parentId, createAccount, switchToAccount, onClose, t]);
 
   // Status icon + color shown alongside the username field message
   const usernameIsInvalid = usernameStatus === 'taken' || usernameStatus === 'invalid';
@@ -285,6 +306,42 @@ const CreateAccountScreen: React.FC<BaseScreenProps> = ({
             })}
           </View>
 
+          {kind === 'organization' ? (
+            <View className="gap-space-8">
+              <Text className="text-body font-bodyBold text-text">
+                {t('accounts.create.organizationCategory.label') || 'Organization type'}
+              </Text>
+              <View className="flex-row flex-wrap gap-space-8">
+                {ORGANIZATION_CATEGORY_OPTIONS.map((option) => {
+                  const selected = option === organizationCategory;
+                  return (
+                    <TouchableOpacity
+                      key={option}
+                      accessibilityRole="radio"
+                      accessibilityState={{ selected }}
+                      accessibilityLabel={organizationCategoryLabel(t, option)}
+                      onPress={() => setOrganizationCategory(option)}
+                      activeOpacity={0.7}
+                      className="px-space-12 py-space-8 rounded-radius-full"
+                      style={{
+                        backgroundColor: selected ? bloomTheme.colors.primarySubtle : bloomTheme.colors.card,
+                        borderWidth: 1,
+                        borderColor: selected ? bloomTheme.colors.primary : bloomTheme.colors.border,
+                      }}
+                    >
+                      <Text
+                        className="text-caption font-captionBold"
+                        style={{ color: selected ? bloomTheme.colors.primary : bloomTheme.colors.text }}
+                      >
+                        {organizationCategoryLabel(t, option)}
+                      </Text>
+                    </TouchableOpacity>
+                  );
+                })}
+              </View>
+            </View>
+          ) : null}
+
           {/* Form Content */}
           <View className="gap-space-16 p-space-16 rounded-radius-20 bg-fill">
             {/* Username */}

package/src/ui/screens/FileManagementScreen.tsx

@@ -242,7 +242,6 @@ const FileManagementScreen: React.FC<FileManagementScreenProps> = ({
     const [lastSelectedFileId, setLastSelectedFileId] = useState<string | null>(null);
     const scrollViewRef = useRef<ScrollView>(null);
     const photoScrollViewRef = useRef<ScrollView>(null);
-    const itemRefs = useRef<Map<string, number>>(new Map()); // Track item positions
     const containerRef = useRef<View>(null);
     useEffect(() => {
         if (initialSelectedIds?.length) {
@@ -1003,11 +1002,6 @@ const FileManagementScreen: React.FC<FileManagementScreenProps> = ({
         // filteredFiles is already sorted, so just use it directly
         const sortedFiles = filteredFiles;
 
-        // Store file positions for scrolling
-        sortedFiles.forEach((file, index) => {
-            itemRefs.current.set(file.id, index);
-        });
-
         return sortedFiles.map((file) => {
             const isImage = file.contentType.startsWith('image/');
             const isPDF = file.contentType.includes('pdf');
@@ -1114,10 +1108,10 @@ const FileManagementScreen: React.FC<FileManagementScreenProps> = ({
     useEffect(() => {
         if (lastSelectedFileId && selectMode) {
             if (viewMode === 'all' && scrollViewRef.current) {
-                // Find the index of the selected file
-                const itemIndex = itemRefs.current.get(lastSelectedFileId);
+                // Find the index of the selected file (filteredFiles is already sorted)
+                const itemIndex = filteredFiles.findIndex(file => file.id === lastSelectedFileId);
 
-                if (itemIndex !== undefined && itemIndex >= 0) {
+                if (itemIndex >= 0) {
                     // Estimate item height (GroupedItem with dense mode is approximately 60-70px)
                     // Account for description rows which add extra height
                     const baseItemHeight = 65;

package/src/ui/session/__tests__/createSessionClient.test.ts

@@ -1,4 +1,4 @@
-import { SessionClient, createMemoryAuthStateStore } from '@oxyhq/core';
+import { SessionClient } from '@oxyhq/core';
 
 type Handler = (...args: unknown[]) => void;
 class FakeSocket {
@@ -36,7 +36,7 @@ describe('createSessionClient', () => {
   test('wires a SessionClient instance backed by the host + device-first token transport', () => {
     const oxy = fakeOxy();
 
-    const { client, host } = createSessionClient(oxy as never, createMemoryAuthStateStore());
+    const { client, host } = createSessionClient(oxy as never);
 
     expect(client).toBeInstanceOf(SessionClient);
     expect(typeof client.bootstrap).toBe('function');
@@ -47,7 +47,7 @@ describe('createSessionClient', () => {
   test('the returned host reflects setCurrentAccountId', () => {
     const oxy = fakeOxy();
 
-    const { host } = createSessionClient(oxy as never, createMemoryAuthStateStore());
+    const { host } = createSessionClient(oxy as never);
 
     expect(host.getCurrentAccountId()).toBeNull();
     host.setCurrentAccountId('u1');
@@ -58,7 +58,7 @@ describe('createSessionClient', () => {
     ioMock.mockClear();
     const oxy = fakeOxy();
 
-    const { client } = createSessionClient(oxy as never, createMemoryAuthStateStore());
+    const { client } = createSessionClient(oxy as never);
     await client.start();
 
     // The injected `io` was used to open the session socket at the base URL.
@@ -72,7 +72,7 @@ describe('createSessionClient', () => {
     const oxy = fakeOxy();
     const onUnauthenticated = jest.fn();
 
-    const { client } = createSessionClient(oxy as never, createMemoryAuthStateStore(), onUnauthenticated);
+    const { client } = createSessionClient(oxy as never, onUnauthenticated);
 
     // The client was constructed with the callback (no direct getter is exposed;
     // constructing without throwing + wiring the socket factory is the contract

package/src/ui/session/__tests__/tokenTransport.test.ts

@@ -1,23 +1,17 @@
 import type { DeviceSessionState } from '@oxyhq/contracts';
-import { logger, createMemoryAuthStateStore, refreshPersistedSession } from '@oxyhq/core';
+import { logger } from '@oxyhq/core';
 import { createTokenTransport } from '../tokenTransport';
 
-// The device-first transport mints a fallback token from the persisted
-// zero-cookie device credential via `refreshPersistedSession` (the ONE unified
-// refresh path) — there is no `silentSignIn`/`signInWithSharedIdentity` arm
-// anymore. Mock that one core function so the transport's own coalescing /
-// logging contract can be exercised in isolation; keep the real `logger` +
-// memory store.
-jest.mock('@oxyhq/core', () => {
-  const actual = jest.requireActual('@oxyhq/core');
-  return { __esModule: true, ...actual, refreshPersistedSession: jest.fn() };
-});
-
-const mockedRefresh = refreshPersistedSession as jest.MockedFunction<typeof refreshPersistedSession>;
+// The device-first transport no longer owns a private mint single-flight: it
+// routes through the ONE shared `oxyServices.httpService.refreshAccessToken(...)`
+// the scheduler/preflight/401 use, so concurrent lanes can never double-rotate
+// the device secret. These tests exercise the transport's own no-op / error /
+// swallow contract around that single call.
 
-function fakeOxy(accessToken: string | null) {
+function fakeOxy(accessToken: string | null, refreshAccessToken = jest.fn(async () => 'minted-token')) {
   return {
     getAccessToken: jest.fn().mockReturnValue(accessToken),
+    httpService: { refreshAccessToken },
   };
 }
 
@@ -30,35 +24,33 @@ const state: DeviceSessionState = {
 };
 
 describe('createTokenTransport', () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-    mockedRefresh.mockResolvedValue('minted-token');
-  });
-
   test('no-ops when a token is already present', async () => {
-    const oxy = fakeOxy('tok');
-    const transport = createTokenTransport(oxy as never, createMemoryAuthStateStore());
+    const refreshAccessToken = jest.fn(async () => 'minted-token');
+    const oxy = fakeOxy('tok', refreshAccessToken);
+    const transport = createTokenTransport(oxy as never);
 
     await transport.ensureActiveToken(state);
 
-    expect(mockedRefresh).not.toHaveBeenCalled();
+    expect(refreshAccessToken).not.toHaveBeenCalled();
   });
 
-  test('mints via refreshPersistedSession when no token is present', async () => {
-    const oxy = fakeOxy(null);
-    const store = createMemoryAuthStateStore();
-    const transport = createTokenTransport(oxy as never, store);
+  test('mints via the shared httpService.refreshAccessToken single-flight when no token is present', async () => {
+    const refreshAccessToken = jest.fn(async () => 'minted-token');
+    const oxy = fakeOxy(null, refreshAccessToken);
+    const transport = createTokenTransport(oxy as never);
 
     await transport.ensureActiveToken(state);
 
-    expect(mockedRefresh).toHaveBeenCalledTimes(1);
-    expect(mockedRefresh).toHaveBeenCalledWith({ oxy, store });
+    expect(refreshAccessToken).toHaveBeenCalledTimes(1);
+    expect(refreshAccessToken).toHaveBeenCalledWith('preflight');
   });
 
   test('resolves (never rejects) and logs a warning when the refresh throws', async () => {
-    const oxy = fakeOxy(null);
-    mockedRefresh.mockRejectedValue(new Error('mint boom'));
-    const transport = createTokenTransport(oxy as never, createMemoryAuthStateStore());
+    const refreshAccessToken = jest.fn(async () => {
+      throw new Error('mint boom');
+    });
+    const oxy = fakeOxy(null, refreshAccessToken);
+    const transport = createTokenTransport(oxy as never);
     const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
 
     await expect(transport.ensureActiveToken(state)).resolves.toBeUndefined();
@@ -73,48 +65,39 @@ describe('createTokenTransport', () => {
   });
 
   test('resolves cleanly when the refresh produces no session', async () => {
-    const oxy = fakeOxy(null);
-    mockedRefresh.mockResolvedValue(null);
-    const transport = createTokenTransport(oxy as never, createMemoryAuthStateStore());
+    const refreshAccessToken = jest.fn(async () => null);
+    const oxy = fakeOxy(null, refreshAccessToken);
+    const transport = createTokenTransport(oxy as never);
 
     await expect(transport.ensureActiveToken(state)).resolves.toBeUndefined();
-    expect(mockedRefresh).toHaveBeenCalledTimes(1);
+    expect(refreshAccessToken).toHaveBeenCalledTimes(1);
   });
 
-  test('coalesces concurrent calls into a single mint', async () => {
-    const oxy = fakeOxy(null);
-    let resolveMint: ((value: string | null) => void) | null = null;
-    mockedRefresh.mockImplementation(
-      () =>
-        new Promise<string | null>((resolve) => {
-          resolveMint = resolve;
-        }),
-    );
-    const transport = createTokenTransport(oxy as never, createMemoryAuthStateStore());
+  test('delegates concurrent calls to the shared single-flight (no private guard of its own)', async () => {
+    // The transport keeps NO local coalescing — it forwards each call to the
+    // shared `httpService.refreshAccessToken`, which owns the single-flight that
+    // collapses concurrent mints into one server rotation (covered in core).
+    const refreshAccessToken = jest.fn(async () => 'minted-token');
+    const oxy = fakeOxy(null, refreshAccessToken);
+    const transport = createTokenTransport(oxy as never);
 
     const first = transport.ensureActiveToken(state);
     const second = transport.ensureActiveToken(state);
+    // Both concurrent callers reached the shared entry point synchronously — the
+    // transport does not swallow the second behind a private guard; dedup is the
+    // shared single-flight's job.
+    expect(refreshAccessToken).toHaveBeenCalledTimes(2);
 
-    expect(mockedRefresh).toHaveBeenCalledTimes(1);
-
-    resolveMint?.(null);
-    await Promise.all([first, second]);
-
-    expect(mockedRefresh).toHaveBeenCalledTimes(1);
-
-    // A later call after the in-flight mint settled starts a fresh mint.
-    const third = transport.ensureActiveToken(state);
-    expect(mockedRefresh).toHaveBeenCalledTimes(2);
-    resolveMint?.(null);
-    await third;
+    await expect(Promise.all([first, second])).resolves.toEqual([undefined, undefined]);
   });
 
   test('treats a throwing getAccessToken as no-token and still mints', async () => {
-    const oxy = fakeOxy(null);
+    const refreshAccessToken = jest.fn(async () => 'minted-token');
+    const oxy = fakeOxy(null, refreshAccessToken);
     oxy.getAccessToken.mockImplementation(() => {
       throw new Error('storage unavailable');
     });
-    const transport = createTokenTransport(oxy as never, createMemoryAuthStateStore());
+    const transport = createTokenTransport(oxy as never);
     const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
 
     await expect(transport.ensureActiveToken(state)).resolves.toBeUndefined();
@@ -124,7 +107,7 @@ describe('createTokenTransport', () => {
       { component: 'TokenTransport' },
       expect.any(Error),
     );
-    expect(mockedRefresh).toHaveBeenCalledTimes(1);
+    expect(refreshAccessToken).toHaveBeenCalledTimes(1);
 
     warnSpy.mockRestore();
   });

package/src/ui/session/createSessionClient.ts

@@ -2,8 +2,8 @@ import { io } from 'socket.io-client';
 import {
   SessionClient,
   createSessionClientHost,
-  type AuthStateStore,
   type OxyServices,
+  type SessionStateOrigin,
 } from '@oxyhq/core';
 import { createTokenTransport } from './tokenTransport';
 
@@ -19,27 +19,30 @@ import { createTokenTransport } from './tokenTransport';
  *    core's lazy dynamic import of a bare specifier — bundler-fragile in
  *    Metro/Expo-web against the published core dist.
  *  - the device-first {@link createTokenTransport}, which mints a fallback token
- *    from the persisted device credential (`store` → `deviceId` + `deviceSecret`).
+ *    through the ONE shared `httpService.refreshAccessToken` single-flight (it
+ *    reads the persisted `deviceId` + `deviceSecret` via the installed handler,
+ *    so it takes no `store` of its own).
  *
- * `onUnauthenticated` fires when an applied device state has zero accounts (a
- * device signout-all): the provider clears the persisted store + local state so
- * a reload does not try to restore a dead session. The host is returned
- * alongside the client so the caller can call `host.setCurrentAccountId(...)`
- * as the active account changes.
+ * `onUnauthenticated` fires when an applied device state has zero accounts. It
+ * receives the {@link SessionStateOrigin} so the provider can gate the
+ * destructive credential wipe: a `request`-origin verdict (a REST sign-out /
+ * revocation) clears the persisted store; a `push`-origin verdict (a possibly
+ * transient socket broadcast) clears only the local UI session and KEEPS the
+ * durable device credential. The host is returned alongside the client so the
+ * caller can call `host.setCurrentAccountId(...)` as the active account changes.
  *
  * The realtime socket uses bearer when authenticated, or deviceId+deviceSecret
  * when signed out (after the one-shot join redirect).
  */
 export function createSessionClient(
   oxyServices: OxyServices,
-  store: AuthStateStore,
-  onUnauthenticated?: () => void,
+  onUnauthenticated?: (origin: SessionStateOrigin) => void,
 ): {
   client: SessionClient;
   host: ReturnType<typeof createSessionClientHost>;
 } {
   const host = createSessionClientHost(oxyServices);
-  const transport = createTokenTransport(oxyServices, store);
+  const transport = createTokenTransport(oxyServices);
   const client = new SessionClient(host, { transport, socketFactory: io, onUnauthenticated });
   return { client, host };
 }

package/src/ui/session/tokenTransport.ts

@@ -1,10 +1,4 @@
-import {
-  refreshPersistedSession,
-  logger,
-  type AuthStateStore,
-  type OxyServices,
-  type TokenTransport,
-} from '@oxyhq/core';
+import { logger, type OxyServices, type TokenTransport } from '@oxyhq/core';
 import type { DeviceSessionState } from '@oxyhq/contracts';
 
 /**
@@ -12,21 +6,18 @@ import type { DeviceSessionState } from '@oxyhq/contracts';
  *
  * `ensureActiveToken` is the fallback the client uses when a `session_state`
  * push arrived WITHOUT an embedded `activeToken` and the app currently holds no
- * bearer. It mints one through the ONE unified refresh path
- * (`refreshPersistedSession`), which presents the persisted zero-cookie device
- * credential (`deviceId` + `deviceSecret`) at `POST /session/device/token`. The
- * persisted device credential is the sole durable restore credential.
+ * bearer. It mints one through the ONE unified single-flight the scheduler, the
+ * request-time preflight, and the 401 retry all use —
+ * `oxyServices.httpService.refreshAccessToken(...)` — which runs the installed
+ * refresh handler (present the persisted zero-cookie `deviceId` + `deviceSecret`
+ * at `POST /session/device/token`). Routing through the SAME entry point means
+ * this lane can never double-rotate the device secret against the others: it has
+ * NO private single-flight of its own.
  *
- * Concurrent pushes coalesce onto one in-flight mint. A failure is logged and
- * swallowed: this method must never throw out (it runs inside the socket state
- * handler).
+ * A failure is logged and swallowed: this method must never throw out (it runs
+ * inside the socket state handler).
  */
-export function createTokenTransport(
-  oxyServices: OxyServices,
-  store: AuthStateStore,
-): TokenTransport {
-  let inFlightMint: Promise<void> | null = null;
-
+export function createTokenTransport(oxyServices: OxyServices): TokenTransport {
   return {
     async ensureActiveToken(state: DeviceSessionState): Promise<void> {
       try {
@@ -37,28 +28,18 @@ export function createTokenTransport(
         logger.warn('ensureActiveToken: getAccessToken threw', { component: 'TokenTransport' }, error);
       }
 
-      if (inFlightMint) {
-        return inFlightMint;
-      }
-
-      inFlightMint = (async () => {
-        try {
-          const token = await refreshPersistedSession({ oxy: oxyServices, store });
-          if (!token) {
-            logger.debug('ensureActiveToken: refresh produced no session', {
-              component: 'TokenTransport',
-              deviceId: state.deviceId,
-            });
-          }
-        } catch (error) {
-          logger.warn('ensureActiveToken: refresh failed', { component: 'TokenTransport' }, error);
-        }
-      })();
-
       try {
-        await inFlightMint;
-      } finally {
-        inFlightMint = null;
+        // The shared HttpService single-flight coalesces concurrent callers onto
+        // one in-flight mint; no local `inFlightMint` guard is needed.
+        const token = await oxyServices.httpService.refreshAccessToken('preflight');
+        if (!token) {
+          logger.debug('ensureActiveToken: refresh produced no session', {
+            component: 'TokenTransport',
+            deviceId: state.deviceId,
+          });
+        }
+      } catch (error) {
+        logger.warn('ensureActiveToken: refresh failed', { component: 'TokenTransport' }, error);
       }
     },
   };

package/src/ui/utils/oauthReturn.ts

@@ -97,5 +97,34 @@ function stripOAuthParamsFromUrl(): void {
   const url = new URL(location.href);
   url.searchParams.delete('code');
   url.searchParams.delete('state');
+  url.searchParams.delete('error');
+  url.searchParams.delete('error_description');
+  url.searchParams.delete('hub_sync');
   history.replaceState(history.state, '', `${url.pathname}${url.search}${url.hash}`);
 }
+
+/**
+ * When auth.oxy.so hub-sync redeem fails, the IdP redirects back with
+ * `?hub_sync=failed`. Strip the param and log so cold boot can continue
+ * without leaving a stale query string.
+ */
+export function consumeHubSyncFailure(): boolean {
+  if (!isWebBrowser()) return false;
+  const location = (globalThis as { location?: Location; history?: History }).location;
+  const history = (globalThis as { history?: History }).history;
+  if (!location) return false;
+
+  const params = new URLSearchParams(location.search);
+  if (params.get('hub_sync') !== 'failed') return false;
+
+  logger.warn('Hub sync failed — IdP device session may be out of sync', {
+    component: 'hubSync',
+  });
+
+  if (history?.replaceState) {
+    const url = new URL(location.href);
+    url.searchParams.delete('hub_sync');
+    history.replaceState(history.state, '', `${url.pathname}${url.search}${url.hash}`);
+  }
+  return true;
+}