@oxyhq/services 19.1.2 → 19.2.0

package/src/ui/context/OxyContext.tsx

@@ -23,7 +23,6 @@ import {
   installAuthRefreshHandler,
   startTokenRefreshScheduler,
   createAccountDialogController,
-  refreshPersistedSession,
   logger as loggerUtil,
   syncHubAfterSignIn,
 } from '@oxyhq/core';
@@ -64,6 +63,7 @@ import {
   type CommitInput,
 } from './oxyContextTypes';
 import { DEFAULT_SESSION_VALIDITY_MS, loadUseFollowHook } from './oxyContextHelpers';
+import { commitDeviceSetAndResolve } from './commitSessionFlow';
 import { useOxyAccountGraph } from './useOxyAccountGraph';
 
 export type { OxyContextState, PasswordSignInResult, OxyContextProviderProps } from './oxyContextTypes';
@@ -281,9 +281,16 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   if (!sessionClientPairRef.current) {
     sessionClientPairRef.current = createSessionClient(
       oxyServices,
-      authStore,
-      () => {
-        clearPersistedAuthSafe(authStore, logger);
+      (origin) => {
+        // Erase the DURABLE device credential only on a `request`-origin verdict
+        // (a REST sign-out / revocation). A `push`-origin empty state is a socket
+        // broadcast that may be a transient reconnect artifact — clearing the
+        // credential on it would strand the user signed out with no way back, so
+        // we clear only the local UI session and keep the credential (a dead one
+        // re-mints to `no_active_session` and resolves signed-out on next boot).
+        if (origin === 'request') {
+          clearPersistedAuthSafe(authStore, logger);
+        }
         void clearSessionStateRef.current().catch((clearError) => {
           logger('Failed to clear local state on remote sign-out', clearError);
         });
@@ -301,8 +308,12 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       return;
     }
     if (state.accounts.length === 0) {
+      // Clear the LOCAL UI session on any applied empty state, but NEVER the
+      // durable device credential here: `syncFromClient` runs for socket-pushed
+      // (possibly transient) states too, and wiping the credential on one would
+      // strand the user signed out. The credential wipe is gated on a
+      // `request`-origin verdict in `onUnauthenticated` above.
       sessionClientHost.setCurrentAccountId(null);
-      clearPersistedAuthSafe(authStore, logger);
       await clearSessionState();
       return;
     }
@@ -333,7 +344,6 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     oxyServices,
     sessionClient,
     sessionClientHost,
-    authStore,
     updateSessions,
     setActiveSessionId,
     loginSuccess,
@@ -526,47 +536,27 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
         setActiveSessionId(input.sessionId);
       }
 
-      // Register into the device set. A deliberate sign-in ACTIVATES the account
-      // (`registerAndActivate`); the cold boot only ensures membership and lets
-      // the server's own `activeAccountId` win (`addCurrentAccount`). Both then
-      // start the socket + project. Best-effort — a failure never fails the
-      // sign-in (cold boot re-registers on the next load).
-      try {
-        if (options.activate) {
-          await sessionClient.registerAndActivate(input.userId);
-        } else {
-          await sessionClient.addCurrentAccount();
-        }
-        await sessionClient.start();
-        await syncFromClient();
-      } catch (registrationError) {
-        loggerUtil.warn(
-          'commitSession: device-set registration failed',
-          { component: 'OxyContext', method: 'commitSession' },
-          registrationError as unknown,
-        );
-      }
-
-      // Hydrate the full user (the commit input carries only minimal data). Fall
-      // back to the minimal shape if the profile fetch fails.
-      let fullUser: User | null = null;
-      try {
-        fullUser = await oxyServices.getCurrentUser();
-      } catch (profileError) {
-        if (__DEV__) {
-          loggerUtil.debug(
-            'Failed to fetch full user on commit; using minimal fallback',
-            { component: 'OxyContext', method: 'commitSession' },
-            profileError as unknown,
-          );
-        }
-        fullUser = (input.user as unknown as User) ?? null;
-      }
-      if (fullUser) {
-        loginSuccess(fullUser);
-        onAuthStateChangeRef.current?.(fullUser);
-      }
-      markAuthResolvedRef.current();
+      // Register into the device set, hydrate the full user, and flip the
+      // auth-resolution gate. A deliberate sign-in ACTIVATES the account and
+      // BLOCKS on the reconcile (register + socket + sessions projection) before
+      // resolving — unchanged ordering. The cold boot resolves auth from the
+      // profile fetch FIRST and reconciles the device set in the background, so
+      // first paint is not held behind those extra round-trips. Reconcile is
+      // best-effort — a failure never fails the sign-in (cold boot re-registers
+      // on the next load).
+      await commitDeviceSetAndResolve({
+        activate: options.activate,
+        userId: input.userId,
+        fallbackUser: (input.user as unknown as User) ?? null,
+        registerAndActivate: (userId) => sessionClient.registerAndActivate(userId),
+        addCurrentAccount: () => sessionClient.addCurrentAccount(),
+        startSocket: () => sessionClient.start(),
+        syncFromClient,
+        getCurrentUser: () => oxyServices.getCurrentUser(),
+        loginSuccess,
+        onAuthStateChange: onAuthStateChangeRef.current,
+        markAuthResolved: markAuthResolvedRef.current,
+      });
 
       if (options.activate && options.hubSync && hubSync && isWebBrowser()) {
         try {
@@ -636,6 +626,12 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
         }
         void Linking.openURL(url);
       },
+      // Native-only probe so the controller can detect an installed Commons and
+      // deep-link straight into its approve screen (keeping the QR/polling live
+      // as fallback). `undefined` on web mirrors the `openUrl` split — the
+      // controller short-circuits, so `redirectToAuthorize` never runs for the
+      // `oxycommons://` payload.
+      canOpenApp: isWebBrowser() ? undefined : (url) => Linking.canOpenURL(url),
     });
   }
   const accountDialogController = accountDialogControllerRef.current;
@@ -782,7 +778,10 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       if (document.visibilityState !== 'visible') return;
       const reconcile = async (): Promise<void> => {
         if (!oxyServices.getAccessToken() && sessionClientHost.getDeviceCredential()) {
-          await refreshPersistedSession({ oxy: oxyServices, store: authStore });
+          // Route through the ONE shared single-flight the scheduler/preflight/401
+          // use — never a private mint lane — so a tab-focus reconcile can't
+          // double-rotate the device secret against them.
+          await oxyServices.httpService.refreshAccessToken('preflight');
         }
         if (!oxyServices.getAccessToken() && !sessionClientHost.getDeviceCredential()) {
           return;
@@ -794,7 +793,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     };
     document.addEventListener('visibilitychange', onVisibility);
     return () => document.removeEventListener('visibilitychange', onVisibility);
-  }, [oxyServices, sessionClient, sessionClientHost, authStore, syncFromClient]);
+  }, [oxyServices, sessionClient, sessionClientHost, syncFromClient]);
 
   // Exposed `refreshSessions`: re-bootstrap the server-authoritative device
   // state and reproject — the manual counterpart to the realtime socket.
@@ -898,6 +897,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       storageKeyPrefix,
       clientId,
       oxyServices,
+      sessionClient,
       useFollow: useFollowHook,
       showBottomSheet: showBottomSheetForContext,
       openAvatarPicker,
@@ -947,6 +947,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       storageKeyPrefix,
       clientId,
       oxyServices,
+      sessionClient,
       useFollowHook,
       showBottomSheetForContext,
       openAvatarPicker,
@@ -1016,6 +1017,7 @@ const LOADING_STATE: OxyContextState = {
   storageKeyPrefix: 'oxy_session',
   clientId: null,
   oxyServices: LOADING_STATE_OXY_SERVICES,
+  sessionClient: null,
   openAvatarPicker: () => {},
   accountDialogController: null,
   isAccountDialogOpen: false,

package/src/ui/context/__tests__/commitSessionFlow.test.ts

@@ -0,0 +1,192 @@
+import type { User } from '@oxyhq/core';
+import { logger } from '@oxyhq/core';
+import {
+  commitDeviceSetAndResolve,
+  type CommitDeviceSetAndResolveDeps,
+} from '../commitSessionFlow';
+
+// A resolved promise chain (addCurrentAccount -> start -> syncFromClient) settles
+// entirely within the microtask queue, which is fully drained before a macrotask
+// (`setTimeout`) runs — so one tick flushes a detached reconcile task.
+const flush = (): Promise<void> => new Promise((resolve) => setTimeout(resolve, 0));
+
+const makeUser = (id: string): User => ({ id, username: id } as unknown as User);
+
+interface Deferred<T> {
+  promise: Promise<T>;
+  resolve: (value: T) => void;
+  reject: (reason?: unknown) => void;
+}
+
+const deferred = <T,>(): Deferred<T> => {
+  let resolve: (value: T) => void = () => undefined;
+  let reject: (reason?: unknown) => void = () => undefined;
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+};
+
+/**
+ * Build a deps object whose every step appends to a shared `order` log, so tests
+ * can assert both WHICH steps ran and the RELATIVE ordering between the
+ * auth-resolution gate and the device-set reconcile.
+ */
+const buildDeps = (
+  order: string[],
+  overrides: Partial<CommitDeviceSetAndResolveDeps> = {},
+): CommitDeviceSetAndResolveDeps => ({
+  activate: false,
+  userId: 'u1',
+  fallbackUser: makeUser('fallback'),
+  registerAndActivate: jest.fn(async () => {
+    order.push('registerAndActivate');
+  }),
+  addCurrentAccount: jest.fn(async () => {
+    order.push('addCurrentAccount');
+  }),
+  startSocket: jest.fn(async () => {
+    order.push('startSocket');
+  }),
+  syncFromClient: jest.fn(async () => {
+    order.push('syncFromClient');
+  }),
+  getCurrentUser: jest.fn(async () => {
+    order.push('getCurrentUser');
+    return makeUser('u1');
+  }),
+  loginSuccess: jest.fn(() => {
+    order.push('loginSuccess');
+  }),
+  onAuthStateChange: jest.fn(() => {
+    order.push('onAuthStateChange');
+  }),
+  markAuthResolved: jest.fn(() => {
+    order.push('markAuthResolved');
+  }),
+  ...overrides,
+});
+
+describe('commitDeviceSetAndResolve — cold boot (activate: false)', () => {
+  it('resolves auth from getCurrentUser BEFORE the device-set reconcile', async () => {
+    const order: string[] = [];
+    const deps = buildDeps(order);
+
+    await commitDeviceSetAndResolve(deps);
+    await flush();
+
+    // loginSuccess + onAuthStateChange + markAuthResolved fire after getCurrentUser.
+    expect(deps.loginSuccess).toHaveBeenCalledWith(makeUser('u1'));
+    expect(deps.onAuthStateChange).toHaveBeenCalledWith(makeUser('u1'));
+    expect(deps.markAuthResolved).toHaveBeenCalledTimes(1);
+
+    expect(order.indexOf('getCurrentUser')).toBeLessThan(order.indexOf('loginSuccess'));
+    expect(order.indexOf('loginSuccess')).toBeLessThan(order.indexOf('markAuthResolved'));
+
+    // The reconcile ran (via addCurrentAccount, NOT registerAndActivate) but only
+    // AFTER the auth gate flipped — proving it did not block the resolve.
+    expect(deps.addCurrentAccount).toHaveBeenCalledTimes(1);
+    expect(deps.registerAndActivate).not.toHaveBeenCalled();
+    expect(order.indexOf('markAuthResolved')).toBeLessThan(order.indexOf('addCurrentAccount'));
+    expect(order.indexOf('addCurrentAccount')).toBeLessThan(order.indexOf('startSocket'));
+    expect(order.indexOf('startSocket')).toBeLessThan(order.indexOf('syncFromClient'));
+  });
+
+  it('still resolves auth even when the device-set reconcile hangs forever', async () => {
+    const order: string[] = [];
+    const hang = deferred<void>(); // addCurrentAccount never settles
+    const deps = buildDeps(order, {
+      addCurrentAccount: jest.fn(() => {
+        order.push('addCurrentAccount');
+        return hang.promise;
+      }),
+    });
+
+    // Must resolve without waiting on the hung reconcile.
+    await commitDeviceSetAndResolve(deps);
+
+    expect(deps.markAuthResolved).toHaveBeenCalledTimes(1);
+    expect(deps.loginSuccess).toHaveBeenCalledWith(makeUser('u1'));
+    expect(deps.addCurrentAccount).toHaveBeenCalledTimes(1);
+    // The hung step gates the rest of the chain — never reached.
+    expect(deps.startSocket).not.toHaveBeenCalled();
+    expect(deps.syncFromClient).not.toHaveBeenCalled();
+  });
+
+  it('falls back to the minimal commit-input user when the profile fetch fails', async () => {
+    const order: string[] = [];
+    const deps = buildDeps(order, {
+      getCurrentUser: jest.fn(async () => {
+        throw new Error('offline');
+      }),
+    });
+
+    await commitDeviceSetAndResolve(deps);
+    await flush();
+
+    expect(deps.loginSuccess).toHaveBeenCalledWith(makeUser('fallback'));
+    expect(deps.markAuthResolved).toHaveBeenCalledTimes(1);
+  });
+
+  it('logs (never swallows) a failing background reconcile and still resolves', async () => {
+    const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
+    const order: string[] = [];
+    const failure = new Error('device-set boom');
+    const deps = buildDeps(order, {
+      addCurrentAccount: jest.fn(async () => {
+        throw failure;
+      }),
+    });
+
+    await commitDeviceSetAndResolve(deps);
+    await flush();
+
+    expect(deps.markAuthResolved).toHaveBeenCalledTimes(1);
+    expect(warnSpy).toHaveBeenCalledWith(
+      'commitSession: device-set registration failed',
+      { component: 'OxyContext', method: 'commitSession' },
+      failure,
+    );
+  });
+});
+
+describe('commitDeviceSetAndResolve — deliberate sign-in (activate: true)', () => {
+  it('BLOCKS on the device-set reconcile before resolving auth (unchanged ordering)', async () => {
+    const order: string[] = [];
+    const gate = deferred<void>(); // registerAndActivate stays pending
+    const deps = buildDeps(order, {
+      activate: true,
+      registerAndActivate: jest.fn(() => {
+        order.push('registerAndActivate');
+        return gate.promise;
+      }),
+    });
+
+    const settled = jest.fn();
+    const pending = commitDeviceSetAndResolve(deps).then(settled);
+
+    // While the reconcile is pending, auth must NOT resolve yet.
+    await flush();
+    expect(deps.registerAndActivate).toHaveBeenCalledTimes(1);
+    expect(deps.addCurrentAccount).not.toHaveBeenCalled();
+    expect(deps.getCurrentUser).not.toHaveBeenCalled();
+    expect(deps.markAuthResolved).not.toHaveBeenCalled();
+    expect(settled).not.toHaveBeenCalled();
+
+    // Complete the reconcile → hydrate + resolve now runs.
+    gate.resolve();
+    await pending;
+
+    expect(order).toEqual([
+      'registerAndActivate',
+      'startSocket',
+      'syncFromClient',
+      'getCurrentUser',
+      'loginSuccess',
+      'onAuthStateChange',
+      'markAuthResolved',
+    ]);
+    expect(settled).toHaveBeenCalledTimes(1);
+  });
+});

package/src/ui/context/commitSessionFlow.ts

@@ -0,0 +1,115 @@
+import type { User } from '@oxyhq/core';
+import { logger as loggerUtil } from '@oxyhq/core';
+
+const LOG_CONTEXT = { component: 'OxyContext', method: 'commitSession' } as const;
+
+export interface CommitDeviceSetAndResolveDeps {
+  /**
+   * Whether this commit is a deliberate sign-in on THIS device (activates the
+   * account and BLOCKS on the device-set reconcile before resolving) vs. a
+   * cold-boot restore (resolves auth from the profile fetch FIRST, then
+   * reconciles the device set in the background).
+   */
+  activate: boolean;
+  /** The committing account id (only used by `registerAndActivate`). */
+  userId?: string;
+  /** Minimal user carried by the commit input; used if the profile fetch fails. */
+  fallbackUser: User | null;
+  /** Deliberate sign-in: register + activate the account in the device set. */
+  registerAndActivate: (userId?: string) => Promise<void>;
+  /** Cold boot: ensure membership only; the server's `activeAccountId` wins. */
+  addCurrentAccount: () => Promise<void>;
+  /** Start the device-scoped socket. */
+  startSocket: () => Promise<void>;
+  /** Project the server-authoritative device state onto local sessions. */
+  syncFromClient: () => Promise<void>;
+  /** Hydrate the full profile (the commit input carries only minimal data). */
+  getCurrentUser: () => Promise<User | null>;
+  loginSuccess: (user: User) => void;
+  onAuthStateChange?: (user: User | null) => void;
+  markAuthResolved: () => void;
+}
+
+/**
+ * Device-set registration + full-user hydration + auth-resolution gate flip.
+ *
+ * On a deliberate sign-in (`activate: true`) the device-set reconcile is awaited
+ * BEFORE hydrating and resolving — unchanged legacy ordering. On a cold boot
+ * (`activate: false`) auth resolves from the profile fetch FIRST so the app can
+ * paint an authenticated shell without waiting on device-set registration, the
+ * socket connect, and the authoritative sessions projection — those reconcile in
+ * a DETACHED background task a moment later.
+ */
+export async function commitDeviceSetAndResolve(
+  deps: CommitDeviceSetAndResolveDeps,
+): Promise<void> {
+  const {
+    activate,
+    userId,
+    fallbackUser,
+    registerAndActivate,
+    addCurrentAccount,
+    startSocket,
+    syncFromClient,
+    getCurrentUser,
+    loginSuccess,
+    onAuthStateChange,
+    markAuthResolved,
+  } = deps;
+
+  // Register into the device set, start the socket, then project server truth. A
+  // deliberate sign-in ACTIVATES the account (`registerAndActivate`); the cold
+  // boot only ensures membership and lets the server's own `activeAccountId` win
+  // (`addCurrentAccount`).
+  const reconcileDeviceSet = async (): Promise<void> => {
+    if (activate) {
+      await registerAndActivate(userId);
+    } else {
+      await addCurrentAccount();
+    }
+    await startSocket();
+    await syncFromClient();
+  };
+
+  const logReconcileError = (registrationError: unknown): void => {
+    loggerUtil.warn('commitSession: device-set registration failed', LOG_CONTEXT, registrationError);
+  };
+
+  // Hydrate the full user then flip the auth-resolution gate. Falls back to the
+  // minimal commit-input shape if the profile fetch fails — never leaves auth
+  // unresolved.
+  const hydrateAndResolve = async (): Promise<void> => {
+    let fullUser: User | null = null;
+    try {
+      fullUser = await getCurrentUser();
+    } catch (profileError) {
+      if (__DEV__) {
+        loggerUtil.debug('Failed to fetch full user on commit; using minimal fallback', LOG_CONTEXT, profileError);
+      }
+      fullUser = fallbackUser;
+    }
+    if (fullUser) {
+      loginSuccess(fullUser);
+      onAuthStateChange?.(fullUser);
+    }
+    markAuthResolved();
+  };
+
+  if (activate) {
+    // Deliberate sign-in: block on the device-set reconcile (unchanged ordering)
+    // before hydrating + resolving, so the account is fully registered/active.
+    try {
+      await reconcileDeviceSet();
+    } catch (registrationError) {
+      logReconcileError(registrationError);
+    }
+    await hydrateAndResolve();
+    return;
+  }
+
+  // Cold boot: resolve auth from the profile fetch FIRST; reconcile the device
+  // set (membership + socket + sessions projection) in a DETACHED background
+  // task so first paint is not blocked behind those round-trips.
+  await hydrateAndResolve();
+  void reconcileDeviceSet().catch(logReconcileError);
+}

package/src/ui/context/oxyContextTypes.ts

@@ -1,5 +1,5 @@
 import type { ReactNode } from 'react';
-import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError } from '@oxyhq/core';
+import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError, SessionClient } from '@oxyhq/core';
 import type { SecurityAlert } from '@oxyhq/contracts';
 import type { UseFollowHook } from '../hooks/useFollow.types';
 import type { useLanguageManagement } from '../hooks/useLanguageManagement';
@@ -76,6 +76,8 @@ export interface OxyContextState {
   storageKeyPrefix: string;
   clientId: string | null;
   oxyServices: OxyServices;
+  /** Server-authoritative device session client. `null` before an `OxyProvider` is mounted. */
+  sessionClient: SessionClient | null;
   useFollow?: UseFollowHook;
   showBottomSheet?: (screenOrConfig: RouteName | { screen: RouteName; props?: Record<string, unknown> }) => void;
   openAvatarPicker: () => void;

package/src/ui/hooks/useOxyEvent.ts

@@ -0,0 +1,22 @@
+import { useEffect, useRef } from 'react';
+
+import { useOxy } from '../context/OxyContext';
+
+/**
+ * Subscribe to a named server-pushed Socket.IO event (e.g. `civic:attested`)
+ * for the lifetime of the component. Payloads arrive as `unknown` — callers
+ * validate shape. Handler identity may change between renders; the latest one
+ * is always invoked.
+ */
+export function useOxyEvent(event: string, handler: (payload: unknown) => void): void {
+  const { sessionClient } = useOxy();
+  const handlerRef = useRef(handler);
+  handlerRef.current = handler;
+
+  useEffect(() => {
+    if (!sessionClient) return;
+    return sessionClient.onServerEvent(event, (payload) => {
+      handlerRef.current(payload);
+    });
+  }, [sessionClient, event]);
+}

package/src/ui/screens/FileManagementScreen.tsx

@@ -242,7 +242,6 @@ const FileManagementScreen: React.FC<FileManagementScreenProps> = ({
     const [lastSelectedFileId, setLastSelectedFileId] = useState<string | null>(null);
     const scrollViewRef = useRef<ScrollView>(null);
     const photoScrollViewRef = useRef<ScrollView>(null);
-    const itemRefs = useRef<Map<string, number>>(new Map()); // Track item positions
     const containerRef = useRef<View>(null);
     useEffect(() => {
         if (initialSelectedIds?.length) {
@@ -1003,11 +1002,6 @@ const FileManagementScreen: React.FC<FileManagementScreenProps> = ({
         // filteredFiles is already sorted, so just use it directly
         const sortedFiles = filteredFiles;
 
-        // Store file positions for scrolling
-        sortedFiles.forEach((file, index) => {
-            itemRefs.current.set(file.id, index);
-        });
-
         return sortedFiles.map((file) => {
             const isImage = file.contentType.startsWith('image/');
             const isPDF = file.contentType.includes('pdf');
@@ -1114,10 +1108,10 @@ const FileManagementScreen: React.FC<FileManagementScreenProps> = ({
     useEffect(() => {
         if (lastSelectedFileId && selectMode) {
             if (viewMode === 'all' && scrollViewRef.current) {
-                // Find the index of the selected file
-                const itemIndex = itemRefs.current.get(lastSelectedFileId);
+                // Find the index of the selected file (filteredFiles is already sorted)
+                const itemIndex = filteredFiles.findIndex(file => file.id === lastSelectedFileId);
 
-                if (itemIndex !== undefined && itemIndex >= 0) {
+                if (itemIndex >= 0) {
                     // Estimate item height (GroupedItem with dense mode is approximately 60-70px)
                     // Account for description rows which add extra height
                     const baseItemHeight = 65;

package/src/ui/session/__tests__/createSessionClient.test.ts

@@ -1,4 +1,4 @@
-import { SessionClient, createMemoryAuthStateStore } from '@oxyhq/core';
+import { SessionClient } from '@oxyhq/core';
 
 type Handler = (...args: unknown[]) => void;
 class FakeSocket {
@@ -36,7 +36,7 @@ describe('createSessionClient', () => {
   test('wires a SessionClient instance backed by the host + device-first token transport', () => {
     const oxy = fakeOxy();
 
-    const { client, host } = createSessionClient(oxy as never, createMemoryAuthStateStore());
+    const { client, host } = createSessionClient(oxy as never);
 
     expect(client).toBeInstanceOf(SessionClient);
     expect(typeof client.bootstrap).toBe('function');
@@ -47,7 +47,7 @@ describe('createSessionClient', () => {
   test('the returned host reflects setCurrentAccountId', () => {
     const oxy = fakeOxy();
 
-    const { host } = createSessionClient(oxy as never, createMemoryAuthStateStore());
+    const { host } = createSessionClient(oxy as never);
 
     expect(host.getCurrentAccountId()).toBeNull();
     host.setCurrentAccountId('u1');
@@ -58,7 +58,7 @@ describe('createSessionClient', () => {
     ioMock.mockClear();
     const oxy = fakeOxy();
 
-    const { client } = createSessionClient(oxy as never, createMemoryAuthStateStore());
+    const { client } = createSessionClient(oxy as never);
     await client.start();
 
     // The injected `io` was used to open the session socket at the base URL.
@@ -72,7 +72,7 @@ describe('createSessionClient', () => {
     const oxy = fakeOxy();
     const onUnauthenticated = jest.fn();
 
-    const { client } = createSessionClient(oxy as never, createMemoryAuthStateStore(), onUnauthenticated);
+    const { client } = createSessionClient(oxy as never, onUnauthenticated);
 
     // The client was constructed with the callback (no direct getter is exposed;
     // constructing without throwing + wiring the socket factory is the contract