@oxyhq/services 19.1.2 → 19.1.3

package/src/ui/context/__tests__/commitSessionFlow.test.ts

@@ -0,0 +1,192 @@
+import type { User } from '@oxyhq/core';
+import { logger } from '@oxyhq/core';
+import {
+  commitDeviceSetAndResolve,
+  type CommitDeviceSetAndResolveDeps,
+} from '../commitSessionFlow';
+
+// A resolved promise chain (addCurrentAccount -> start -> syncFromClient) settles
+// entirely within the microtask queue, which is fully drained before a macrotask
+// (`setTimeout`) runs — so one tick flushes a detached reconcile task.
+const flush = (): Promise<void> => new Promise((resolve) => setTimeout(resolve, 0));
+
+const makeUser = (id: string): User => ({ id, username: id } as unknown as User);
+
+interface Deferred<T> {
+  promise: Promise<T>;
+  resolve: (value: T) => void;
+  reject: (reason?: unknown) => void;
+}
+
+const deferred = <T,>(): Deferred<T> => {
+  let resolve: (value: T) => void = () => undefined;
+  let reject: (reason?: unknown) => void = () => undefined;
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+};
+
+/**
+ * Build a deps object whose every step appends to a shared `order` log, so tests
+ * can assert both WHICH steps ran and the RELATIVE ordering between the
+ * auth-resolution gate and the device-set reconcile.
+ */
+const buildDeps = (
+  order: string[],
+  overrides: Partial<CommitDeviceSetAndResolveDeps> = {},
+): CommitDeviceSetAndResolveDeps => ({
+  activate: false,
+  userId: 'u1',
+  fallbackUser: makeUser('fallback'),
+  registerAndActivate: jest.fn(async () => {
+    order.push('registerAndActivate');
+  }),
+  addCurrentAccount: jest.fn(async () => {
+    order.push('addCurrentAccount');
+  }),
+  startSocket: jest.fn(async () => {
+    order.push('startSocket');
+  }),
+  syncFromClient: jest.fn(async () => {
+    order.push('syncFromClient');
+  }),
+  getCurrentUser: jest.fn(async () => {
+    order.push('getCurrentUser');
+    return makeUser('u1');
+  }),
+  loginSuccess: jest.fn(() => {
+    order.push('loginSuccess');
+  }),
+  onAuthStateChange: jest.fn(() => {
+    order.push('onAuthStateChange');
+  }),
+  markAuthResolved: jest.fn(() => {
+    order.push('markAuthResolved');
+  }),
+  ...overrides,
+});
+
+describe('commitDeviceSetAndResolve — cold boot (activate: false)', () => {
+  it('resolves auth from getCurrentUser BEFORE the device-set reconcile', async () => {
+    const order: string[] = [];
+    const deps = buildDeps(order);
+
+    await commitDeviceSetAndResolve(deps);
+    await flush();
+
+    // loginSuccess + onAuthStateChange + markAuthResolved fire after getCurrentUser.
+    expect(deps.loginSuccess).toHaveBeenCalledWith(makeUser('u1'));
+    expect(deps.onAuthStateChange).toHaveBeenCalledWith(makeUser('u1'));
+    expect(deps.markAuthResolved).toHaveBeenCalledTimes(1);
+
+    expect(order.indexOf('getCurrentUser')).toBeLessThan(order.indexOf('loginSuccess'));
+    expect(order.indexOf('loginSuccess')).toBeLessThan(order.indexOf('markAuthResolved'));
+
+    // The reconcile ran (via addCurrentAccount, NOT registerAndActivate) but only
+    // AFTER the auth gate flipped — proving it did not block the resolve.
+    expect(deps.addCurrentAccount).toHaveBeenCalledTimes(1);
+    expect(deps.registerAndActivate).not.toHaveBeenCalled();
+    expect(order.indexOf('markAuthResolved')).toBeLessThan(order.indexOf('addCurrentAccount'));
+    expect(order.indexOf('addCurrentAccount')).toBeLessThan(order.indexOf('startSocket'));
+    expect(order.indexOf('startSocket')).toBeLessThan(order.indexOf('syncFromClient'));
+  });
+
+  it('still resolves auth even when the device-set reconcile hangs forever', async () => {
+    const order: string[] = [];
+    const hang = deferred<void>(); // addCurrentAccount never settles
+    const deps = buildDeps(order, {
+      addCurrentAccount: jest.fn(() => {
+        order.push('addCurrentAccount');
+        return hang.promise;
+      }),
+    });
+
+    // Must resolve without waiting on the hung reconcile.
+    await commitDeviceSetAndResolve(deps);
+
+    expect(deps.markAuthResolved).toHaveBeenCalledTimes(1);
+    expect(deps.loginSuccess).toHaveBeenCalledWith(makeUser('u1'));
+    expect(deps.addCurrentAccount).toHaveBeenCalledTimes(1);
+    // The hung step gates the rest of the chain — never reached.
+    expect(deps.startSocket).not.toHaveBeenCalled();
+    expect(deps.syncFromClient).not.toHaveBeenCalled();
+  });
+
+  it('falls back to the minimal commit-input user when the profile fetch fails', async () => {
+    const order: string[] = [];
+    const deps = buildDeps(order, {
+      getCurrentUser: jest.fn(async () => {
+        throw new Error('offline');
+      }),
+    });
+
+    await commitDeviceSetAndResolve(deps);
+    await flush();
+
+    expect(deps.loginSuccess).toHaveBeenCalledWith(makeUser('fallback'));
+    expect(deps.markAuthResolved).toHaveBeenCalledTimes(1);
+  });
+
+  it('logs (never swallows) a failing background reconcile and still resolves', async () => {
+    const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
+    const order: string[] = [];
+    const failure = new Error('device-set boom');
+    const deps = buildDeps(order, {
+      addCurrentAccount: jest.fn(async () => {
+        throw failure;
+      }),
+    });
+
+    await commitDeviceSetAndResolve(deps);
+    await flush();
+
+    expect(deps.markAuthResolved).toHaveBeenCalledTimes(1);
+    expect(warnSpy).toHaveBeenCalledWith(
+      'commitSession: device-set registration failed',
+      { component: 'OxyContext', method: 'commitSession' },
+      failure,
+    );
+  });
+});
+
+describe('commitDeviceSetAndResolve — deliberate sign-in (activate: true)', () => {
+  it('BLOCKS on the device-set reconcile before resolving auth (unchanged ordering)', async () => {
+    const order: string[] = [];
+    const gate = deferred<void>(); // registerAndActivate stays pending
+    const deps = buildDeps(order, {
+      activate: true,
+      registerAndActivate: jest.fn(() => {
+        order.push('registerAndActivate');
+        return gate.promise;
+      }),
+    });
+
+    const settled = jest.fn();
+    const pending = commitDeviceSetAndResolve(deps).then(settled);
+
+    // While the reconcile is pending, auth must NOT resolve yet.
+    await flush();
+    expect(deps.registerAndActivate).toHaveBeenCalledTimes(1);
+    expect(deps.addCurrentAccount).not.toHaveBeenCalled();
+    expect(deps.getCurrentUser).not.toHaveBeenCalled();
+    expect(deps.markAuthResolved).not.toHaveBeenCalled();
+    expect(settled).not.toHaveBeenCalled();
+
+    // Complete the reconcile → hydrate + resolve now runs.
+    gate.resolve();
+    await pending;
+
+    expect(order).toEqual([
+      'registerAndActivate',
+      'startSocket',
+      'syncFromClient',
+      'getCurrentUser',
+      'loginSuccess',
+      'onAuthStateChange',
+      'markAuthResolved',
+    ]);
+    expect(settled).toHaveBeenCalledTimes(1);
+  });
+});

package/src/ui/context/commitSessionFlow.ts

@@ -0,0 +1,115 @@
+import type { User } from '@oxyhq/core';
+import { logger as loggerUtil } from '@oxyhq/core';
+
+const LOG_CONTEXT = { component: 'OxyContext', method: 'commitSession' } as const;
+
+export interface CommitDeviceSetAndResolveDeps {
+  /**
+   * Whether this commit is a deliberate sign-in on THIS device (activates the
+   * account and BLOCKS on the device-set reconcile before resolving) vs. a
+   * cold-boot restore (resolves auth from the profile fetch FIRST, then
+   * reconciles the device set in the background).
+   */
+  activate: boolean;
+  /** The committing account id (only used by `registerAndActivate`). */
+  userId?: string;
+  /** Minimal user carried by the commit input; used if the profile fetch fails. */
+  fallbackUser: User | null;
+  /** Deliberate sign-in: register + activate the account in the device set. */
+  registerAndActivate: (userId?: string) => Promise<void>;
+  /** Cold boot: ensure membership only; the server's `activeAccountId` wins. */
+  addCurrentAccount: () => Promise<void>;
+  /** Start the device-scoped socket. */
+  startSocket: () => Promise<void>;
+  /** Project the server-authoritative device state onto local sessions. */
+  syncFromClient: () => Promise<void>;
+  /** Hydrate the full profile (the commit input carries only minimal data). */
+  getCurrentUser: () => Promise<User | null>;
+  loginSuccess: (user: User) => void;
+  onAuthStateChange?: (user: User | null) => void;
+  markAuthResolved: () => void;
+}
+
+/**
+ * Device-set registration + full-user hydration + auth-resolution gate flip.
+ *
+ * On a deliberate sign-in (`activate: true`) the device-set reconcile is awaited
+ * BEFORE hydrating and resolving — unchanged legacy ordering. On a cold boot
+ * (`activate: false`) auth resolves from the profile fetch FIRST so the app can
+ * paint an authenticated shell without waiting on device-set registration, the
+ * socket connect, and the authoritative sessions projection — those reconcile in
+ * a DETACHED background task a moment later.
+ */
+export async function commitDeviceSetAndResolve(
+  deps: CommitDeviceSetAndResolveDeps,
+): Promise<void> {
+  const {
+    activate,
+    userId,
+    fallbackUser,
+    registerAndActivate,
+    addCurrentAccount,
+    startSocket,
+    syncFromClient,
+    getCurrentUser,
+    loginSuccess,
+    onAuthStateChange,
+    markAuthResolved,
+  } = deps;
+
+  // Register into the device set, start the socket, then project server truth. A
+  // deliberate sign-in ACTIVATES the account (`registerAndActivate`); the cold
+  // boot only ensures membership and lets the server's own `activeAccountId` win
+  // (`addCurrentAccount`).
+  const reconcileDeviceSet = async (): Promise<void> => {
+    if (activate) {
+      await registerAndActivate(userId);
+    } else {
+      await addCurrentAccount();
+    }
+    await startSocket();
+    await syncFromClient();
+  };
+
+  const logReconcileError = (registrationError: unknown): void => {
+    loggerUtil.warn('commitSession: device-set registration failed', LOG_CONTEXT, registrationError);
+  };
+
+  // Hydrate the full user then flip the auth-resolution gate. Falls back to the
+  // minimal commit-input shape if the profile fetch fails — never leaves auth
+  // unresolved.
+  const hydrateAndResolve = async (): Promise<void> => {
+    let fullUser: User | null = null;
+    try {
+      fullUser = await getCurrentUser();
+    } catch (profileError) {
+      if (__DEV__) {
+        loggerUtil.debug('Failed to fetch full user on commit; using minimal fallback', LOG_CONTEXT, profileError);
+      }
+      fullUser = fallbackUser;
+    }
+    if (fullUser) {
+      loginSuccess(fullUser);
+      onAuthStateChange?.(fullUser);
+    }
+    markAuthResolved();
+  };
+
+  if (activate) {
+    // Deliberate sign-in: block on the device-set reconcile (unchanged ordering)
+    // before hydrating + resolving, so the account is fully registered/active.
+    try {
+      await reconcileDeviceSet();
+    } catch (registrationError) {
+      logReconcileError(registrationError);
+    }
+    await hydrateAndResolve();
+    return;
+  }
+
+  // Cold boot: resolve auth from the profile fetch FIRST; reconcile the device
+  // set (membership + socket + sessions projection) in a DETACHED background
+  // task so first paint is not blocked behind those round-trips.
+  await hydrateAndResolve();
+  void reconcileDeviceSet().catch(logReconcileError);
+}

package/src/ui/context/oxyContextTypes.ts

@@ -1,5 +1,5 @@
 import type { ReactNode } from 'react';
-import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError } from '@oxyhq/core';
+import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError, SessionClient } from '@oxyhq/core';
 import type { SecurityAlert } from '@oxyhq/contracts';
 import type { UseFollowHook } from '../hooks/useFollow.types';
 import type { useLanguageManagement } from '../hooks/useLanguageManagement';
@@ -76,6 +76,8 @@ export interface OxyContextState {
   storageKeyPrefix: string;
   clientId: string | null;
   oxyServices: OxyServices;
+  /** Server-authoritative device session client. `null` before an `OxyProvider` is mounted. */
+  sessionClient: SessionClient | null;
   useFollow?: UseFollowHook;
   showBottomSheet?: (screenOrConfig: RouteName | { screen: RouteName; props?: Record<string, unknown> }) => void;
   openAvatarPicker: () => void;

package/src/ui/hooks/useOxyEvent.ts

@@ -0,0 +1,22 @@
+import { useEffect, useRef } from 'react';
+
+import { useOxy } from '../context/OxyContext';
+
+/**
+ * Subscribe to a named server-pushed Socket.IO event (e.g. `civic:attested`)
+ * for the lifetime of the component. Payloads arrive as `unknown` — callers
+ * validate shape. Handler identity may change between renders; the latest one
+ * is always invoked.
+ */
+export function useOxyEvent(event: string, handler: (payload: unknown) => void): void {
+  const { sessionClient } = useOxy();
+  const handlerRef = useRef(handler);
+  handlerRef.current = handler;
+
+  useEffect(() => {
+    if (!sessionClient) return;
+    return sessionClient.onServerEvent(event, (payload) => {
+      handlerRef.current(payload);
+    });
+  }, [sessionClient, event]);
+}

package/src/ui/screens/FileManagementScreen.tsx

@@ -242,7 +242,6 @@ const FileManagementScreen: React.FC<FileManagementScreenProps> = ({
     const [lastSelectedFileId, setLastSelectedFileId] = useState<string | null>(null);
     const scrollViewRef = useRef<ScrollView>(null);
     const photoScrollViewRef = useRef<ScrollView>(null);
-    const itemRefs = useRef<Map<string, number>>(new Map()); // Track item positions
     const containerRef = useRef<View>(null);
     useEffect(() => {
         if (initialSelectedIds?.length) {
@@ -1003,11 +1002,6 @@ const FileManagementScreen: React.FC<FileManagementScreenProps> = ({
         // filteredFiles is already sorted, so just use it directly
         const sortedFiles = filteredFiles;
 
-        // Store file positions for scrolling
-        sortedFiles.forEach((file, index) => {
-            itemRefs.current.set(file.id, index);
-        });
-
         return sortedFiles.map((file) => {
             const isImage = file.contentType.startsWith('image/');
             const isPDF = file.contentType.includes('pdf');
@@ -1114,10 +1108,10 @@ const FileManagementScreen: React.FC<FileManagementScreenProps> = ({
     useEffect(() => {
         if (lastSelectedFileId && selectMode) {
             if (viewMode === 'all' && scrollViewRef.current) {
-                // Find the index of the selected file
-                const itemIndex = itemRefs.current.get(lastSelectedFileId);
+                // Find the index of the selected file (filteredFiles is already sorted)
+                const itemIndex = filteredFiles.findIndex(file => file.id === lastSelectedFileId);
 
-                if (itemIndex !== undefined && itemIndex >= 0) {
+                if (itemIndex >= 0) {
                     // Estimate item height (GroupedItem with dense mode is approximately 60-70px)
                     // Account for description rows which add extra height
                     const baseItemHeight = 65;

package/src/ui/session/__tests__/createSessionClient.test.ts

@@ -1,4 +1,4 @@
-import { SessionClient, createMemoryAuthStateStore } from '@oxyhq/core';
+import { SessionClient } from '@oxyhq/core';
 
 type Handler = (...args: unknown[]) => void;
 class FakeSocket {
@@ -36,7 +36,7 @@ describe('createSessionClient', () => {
   test('wires a SessionClient instance backed by the host + device-first token transport', () => {
     const oxy = fakeOxy();
 
-    const { client, host } = createSessionClient(oxy as never, createMemoryAuthStateStore());
+    const { client, host } = createSessionClient(oxy as never);
 
     expect(client).toBeInstanceOf(SessionClient);
     expect(typeof client.bootstrap).toBe('function');
@@ -47,7 +47,7 @@ describe('createSessionClient', () => {
   test('the returned host reflects setCurrentAccountId', () => {
     const oxy = fakeOxy();
 
-    const { host } = createSessionClient(oxy as never, createMemoryAuthStateStore());
+    const { host } = createSessionClient(oxy as never);
 
     expect(host.getCurrentAccountId()).toBeNull();
     host.setCurrentAccountId('u1');
@@ -58,7 +58,7 @@ describe('createSessionClient', () => {
     ioMock.mockClear();
     const oxy = fakeOxy();
 
-    const { client } = createSessionClient(oxy as never, createMemoryAuthStateStore());
+    const { client } = createSessionClient(oxy as never);
     await client.start();
 
     // The injected `io` was used to open the session socket at the base URL.
@@ -72,7 +72,7 @@ describe('createSessionClient', () => {
     const oxy = fakeOxy();
     const onUnauthenticated = jest.fn();
 
-    const { client } = createSessionClient(oxy as never, createMemoryAuthStateStore(), onUnauthenticated);
+    const { client } = createSessionClient(oxy as never, onUnauthenticated);
 
     // The client was constructed with the callback (no direct getter is exposed;
     // constructing without throwing + wiring the socket factory is the contract

package/src/ui/session/__tests__/tokenTransport.test.ts

@@ -1,23 +1,17 @@
 import type { DeviceSessionState } from '@oxyhq/contracts';
-import { logger, createMemoryAuthStateStore, refreshPersistedSession } from '@oxyhq/core';
+import { logger } from '@oxyhq/core';
 import { createTokenTransport } from '../tokenTransport';
 
-// The device-first transport mints a fallback token from the persisted
-// zero-cookie device credential via `refreshPersistedSession` (the ONE unified
-// refresh path) — there is no `silentSignIn`/`signInWithSharedIdentity` arm
-// anymore. Mock that one core function so the transport's own coalescing /
-// logging contract can be exercised in isolation; keep the real `logger` +
-// memory store.
-jest.mock('@oxyhq/core', () => {
-  const actual = jest.requireActual('@oxyhq/core');
-  return { __esModule: true, ...actual, refreshPersistedSession: jest.fn() };
-});
-
-const mockedRefresh = refreshPersistedSession as jest.MockedFunction<typeof refreshPersistedSession>;
+// The device-first transport no longer owns a private mint single-flight: it
+// routes through the ONE shared `oxyServices.httpService.refreshAccessToken(...)`
+// the scheduler/preflight/401 use, so concurrent lanes can never double-rotate
+// the device secret. These tests exercise the transport's own no-op / error /
+// swallow contract around that single call.
 
-function fakeOxy(accessToken: string | null) {
+function fakeOxy(accessToken: string | null, refreshAccessToken = jest.fn(async () => 'minted-token')) {
   return {
     getAccessToken: jest.fn().mockReturnValue(accessToken),
+    httpService: { refreshAccessToken },
   };
 }
 
@@ -30,35 +24,33 @@ const state: DeviceSessionState = {
 };
 
 describe('createTokenTransport', () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-    mockedRefresh.mockResolvedValue('minted-token');
-  });
-
   test('no-ops when a token is already present', async () => {
-    const oxy = fakeOxy('tok');
-    const transport = createTokenTransport(oxy as never, createMemoryAuthStateStore());
+    const refreshAccessToken = jest.fn(async () => 'minted-token');
+    const oxy = fakeOxy('tok', refreshAccessToken);
+    const transport = createTokenTransport(oxy as never);
 
     await transport.ensureActiveToken(state);
 
-    expect(mockedRefresh).not.toHaveBeenCalled();
+    expect(refreshAccessToken).not.toHaveBeenCalled();
   });
 
-  test('mints via refreshPersistedSession when no token is present', async () => {
-    const oxy = fakeOxy(null);
-    const store = createMemoryAuthStateStore();
-    const transport = createTokenTransport(oxy as never, store);
+  test('mints via the shared httpService.refreshAccessToken single-flight when no token is present', async () => {
+    const refreshAccessToken = jest.fn(async () => 'minted-token');
+    const oxy = fakeOxy(null, refreshAccessToken);
+    const transport = createTokenTransport(oxy as never);
 
     await transport.ensureActiveToken(state);
 
-    expect(mockedRefresh).toHaveBeenCalledTimes(1);
-    expect(mockedRefresh).toHaveBeenCalledWith({ oxy, store });
+    expect(refreshAccessToken).toHaveBeenCalledTimes(1);
+    expect(refreshAccessToken).toHaveBeenCalledWith('preflight');
   });
 
   test('resolves (never rejects) and logs a warning when the refresh throws', async () => {
-    const oxy = fakeOxy(null);
-    mockedRefresh.mockRejectedValue(new Error('mint boom'));
-    const transport = createTokenTransport(oxy as never, createMemoryAuthStateStore());
+    const refreshAccessToken = jest.fn(async () => {
+      throw new Error('mint boom');
+    });
+    const oxy = fakeOxy(null, refreshAccessToken);
+    const transport = createTokenTransport(oxy as never);
     const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
 
     await expect(transport.ensureActiveToken(state)).resolves.toBeUndefined();
@@ -73,48 +65,39 @@ describe('createTokenTransport', () => {
   });
 
   test('resolves cleanly when the refresh produces no session', async () => {
-    const oxy = fakeOxy(null);
-    mockedRefresh.mockResolvedValue(null);
-    const transport = createTokenTransport(oxy as never, createMemoryAuthStateStore());
+    const refreshAccessToken = jest.fn(async () => null);
+    const oxy = fakeOxy(null, refreshAccessToken);
+    const transport = createTokenTransport(oxy as never);
 
     await expect(transport.ensureActiveToken(state)).resolves.toBeUndefined();
-    expect(mockedRefresh).toHaveBeenCalledTimes(1);
+    expect(refreshAccessToken).toHaveBeenCalledTimes(1);
   });
 
-  test('coalesces concurrent calls into a single mint', async () => {
-    const oxy = fakeOxy(null);
-    let resolveMint: ((value: string | null) => void) | null = null;
-    mockedRefresh.mockImplementation(
-      () =>
-        new Promise<string | null>((resolve) => {
-          resolveMint = resolve;
-        }),
-    );
-    const transport = createTokenTransport(oxy as never, createMemoryAuthStateStore());
+  test('delegates concurrent calls to the shared single-flight (no private guard of its own)', async () => {
+    // The transport keeps NO local coalescing — it forwards each call to the
+    // shared `httpService.refreshAccessToken`, which owns the single-flight that
+    // collapses concurrent mints into one server rotation (covered in core).
+    const refreshAccessToken = jest.fn(async () => 'minted-token');
+    const oxy = fakeOxy(null, refreshAccessToken);
+    const transport = createTokenTransport(oxy as never);
 
     const first = transport.ensureActiveToken(state);
     const second = transport.ensureActiveToken(state);
+    // Both concurrent callers reached the shared entry point synchronously — the
+    // transport does not swallow the second behind a private guard; dedup is the
+    // shared single-flight's job.
+    expect(refreshAccessToken).toHaveBeenCalledTimes(2);
 
-    expect(mockedRefresh).toHaveBeenCalledTimes(1);
-
-    resolveMint?.(null);
-    await Promise.all([first, second]);
-
-    expect(mockedRefresh).toHaveBeenCalledTimes(1);
-
-    // A later call after the in-flight mint settled starts a fresh mint.
-    const third = transport.ensureActiveToken(state);
-    expect(mockedRefresh).toHaveBeenCalledTimes(2);
-    resolveMint?.(null);
-    await third;
+    await expect(Promise.all([first, second])).resolves.toEqual([undefined, undefined]);
   });
 
   test('treats a throwing getAccessToken as no-token and still mints', async () => {
-    const oxy = fakeOxy(null);
+    const refreshAccessToken = jest.fn(async () => 'minted-token');
+    const oxy = fakeOxy(null, refreshAccessToken);
     oxy.getAccessToken.mockImplementation(() => {
       throw new Error('storage unavailable');
     });
-    const transport = createTokenTransport(oxy as never, createMemoryAuthStateStore());
+    const transport = createTokenTransport(oxy as never);
     const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
 
     await expect(transport.ensureActiveToken(state)).resolves.toBeUndefined();
@@ -124,7 +107,7 @@ describe('createTokenTransport', () => {
       { component: 'TokenTransport' },
       expect.any(Error),
     );
-    expect(mockedRefresh).toHaveBeenCalledTimes(1);
+    expect(refreshAccessToken).toHaveBeenCalledTimes(1);
 
     warnSpy.mockRestore();
   });

package/src/ui/session/createSessionClient.ts

@@ -2,8 +2,8 @@ import { io } from 'socket.io-client';
 import {
   SessionClient,
   createSessionClientHost,
-  type AuthStateStore,
   type OxyServices,
+  type SessionStateOrigin,
 } from '@oxyhq/core';
 import { createTokenTransport } from './tokenTransport';
 
@@ -19,27 +19,30 @@ import { createTokenTransport } from './tokenTransport';
  *    core's lazy dynamic import of a bare specifier — bundler-fragile in
  *    Metro/Expo-web against the published core dist.
  *  - the device-first {@link createTokenTransport}, which mints a fallback token
- *    from the persisted device credential (`store` → `deviceId` + `deviceSecret`).
+ *    through the ONE shared `httpService.refreshAccessToken` single-flight (it
+ *    reads the persisted `deviceId` + `deviceSecret` via the installed handler,
+ *    so it takes no `store` of its own).
  *
- * `onUnauthenticated` fires when an applied device state has zero accounts (a
- * device signout-all): the provider clears the persisted store + local state so
- * a reload does not try to restore a dead session. The host is returned
- * alongside the client so the caller can call `host.setCurrentAccountId(...)`
- * as the active account changes.
+ * `onUnauthenticated` fires when an applied device state has zero accounts. It
+ * receives the {@link SessionStateOrigin} so the provider can gate the
+ * destructive credential wipe: a `request`-origin verdict (a REST sign-out /
+ * revocation) clears the persisted store; a `push`-origin verdict (a possibly
+ * transient socket broadcast) clears only the local UI session and KEEPS the
+ * durable device credential. The host is returned alongside the client so the
+ * caller can call `host.setCurrentAccountId(...)` as the active account changes.
  *
  * The realtime socket uses bearer when authenticated, or deviceId+deviceSecret
  * when signed out (after the one-shot join redirect).
  */
 export function createSessionClient(
   oxyServices: OxyServices,
-  store: AuthStateStore,
-  onUnauthenticated?: () => void,
+  onUnauthenticated?: (origin: SessionStateOrigin) => void,
 ): {
   client: SessionClient;
   host: ReturnType<typeof createSessionClientHost>;
 } {
   const host = createSessionClientHost(oxyServices);
-  const transport = createTokenTransport(oxyServices, store);
+  const transport = createTokenTransport(oxyServices);
   const client = new SessionClient(host, { transport, socketFactory: io, onUnauthenticated });
   return { client, host };
 }