@oxyhq/core 1.1.0 → 1.2.1

package/dist/cjs/AuthManager.js

@@ -103,6 +103,7 @@ class AuthManager {
         this.listeners = new Set();
         this.currentUser = null;
         this.refreshTimer = null;
+        this.refreshPromise = null;
         this.oxyServices = oxyServices;
         this.config = {
             storage: config.storage ?? this.getDefaultStorage(),
@@ -203,9 +204,23 @@ class AuthManager {
         }
     }
     /**
-     * Refresh the access token.
+     * Refresh the access token. Deduplicates concurrent calls so only one
+     * refresh request is in-flight at a time.
      */
     async refreshToken() {
+        // If a refresh is already in-flight, return the same promise
+        if (this.refreshPromise) {
+            return this.refreshPromise;
+        }
+        this.refreshPromise = this._doRefreshToken();
+        try {
+            return await this.refreshPromise;
+        }
+        finally {
+            this.refreshPromise = null;
+        }
+    }
+    async _doRefreshToken() {
         const refreshToken = await this.storage.getItem(STORAGE_KEYS.REFRESH_TOKEN);
         if (!refreshToken) {
             return false;

package/dist/cjs/HttpService.js

@@ -85,6 +85,7 @@ class TokenStore {
  */
 class HttpService {
     constructor(config) {
+        this.tokenRefreshPromise = null;
         // Performance monitoring
         this.requestMetrics = {
             totalRequests: 0,
@@ -448,24 +449,17 @@ class HttpService {
             const currentTime = Math.floor(Date.now() / 1000);
             // If token expires in less than 60 seconds, refresh it
             if (decoded.exp && decoded.exp - currentTime < 60 && decoded.sessionId) {
+                // Deduplicate concurrent refresh attempts
+                if (!this.tokenRefreshPromise) {
+                    this.tokenRefreshPromise = this._refreshTokenFromSession(decoded.sessionId);
+                }
                 try {
-                    const refreshUrl = `${this.baseURL}/api/session/token/${decoded.sessionId}`;
-                    // Use AbortSignal.timeout for consistent timeout handling
-                    const response = await fetch(refreshUrl, {
-                        method: 'GET',
-                        headers: { 'Accept': 'application/json' },
-                        signal: AbortSignal.timeout(5000),
-                        credentials: 'include', // Include cookies for cross-origin requests
-                    });
-                    if (response.ok) {
-                        const { accessToken: newToken } = await response.json();
-                        this.tokenStore.setTokens(newToken);
-                        this.logger.debug('Token refreshed');
-                        return `Bearer ${newToken}`;
-                    }
+                    const result = await this.tokenRefreshPromise;
+                    if (result)
+                        return result;
                 }
-                catch (refreshError) {
-                    this.logger.warn('Token refresh failed, using current token');
+                finally {
+                    this.tokenRefreshPromise = null;
                 }
             }
             return `Bearer ${accessToken}`;
@@ -475,6 +469,27 @@ class HttpService {
             return `Bearer ${accessToken}`;
         }
     }
+    async _refreshTokenFromSession(sessionId) {
+        try {
+            const refreshUrl = `${this.baseURL}/api/session/token/${sessionId}`;
+            const response = await fetch(refreshUrl, {
+                method: 'GET',
+                headers: { 'Accept': 'application/json' },
+                signal: AbortSignal.timeout(5000),
+                credentials: 'include',
+            });
+            if (response.ok) {
+                const { accessToken: newToken } = await response.json();
+                this.tokenStore.setTokens(newToken);
+                this.logger.debug('Token refreshed');
+                return `Bearer ${newToken}`;
+            }
+        }
+        catch (refreshError) {
+            this.logger.warn('Token refresh failed, using current token');
+        }
+        return null;
+    }
     /**
      * Unwrap standardized API response format
      */

package/dist/cjs/index.js

@@ -29,8 +29,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.initPlatformFromReactNative = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.normalizeLanguageCode = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.SUPPORTED_LANGUAGES = exports.DeviceManager = exports.RecoveryPhraseService = exports.SignatureService = exports.KeyManager = exports.createCrossDomainAuth = exports.CrossDomainAuth = exports.createAuthManager = exports.AuthManager = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyServices = void 0;
-exports.logPerformance = exports.logPayment = exports.logDevice = exports.logUser = exports.logSession = exports.logApi = exports.logAuth = exports.LogLevel = exports.logger = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.packageInfo = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.translate = exports.createDebugLogger = exports.debugError = exports.debugWarn = exports.debugLog = exports.isDev = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = void 0;
+exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.normalizeLanguageCode = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.SUPPORTED_LANGUAGES = exports.DeviceManager = exports.RecoveryPhraseService = exports.SignatureService = exports.KeyManager = exports.createCrossDomainAuth = exports.CrossDomainAuth = exports.createAuthManager = exports.AuthManager = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyServices = void 0;
+exports.logPerformance = exports.logPayment = exports.logDevice = exports.logUser = exports.logSession = exports.logApi = exports.logAuth = exports.LogLevel = exports.logger = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.packageInfo = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.translate = exports.createDebugLogger = exports.debugError = exports.debugWarn = exports.debugLog = exports.isDev = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = void 0;
 // Ensure crypto polyfills are loaded before anything else
 require("./crypto/polyfill");
 // --- Core API Client ---
@@ -74,7 +74,6 @@ Object.defineProperty(exports, "isWeb", { enumerable: true, get: function () { r
 Object.defineProperty(exports, "isNative", { enumerable: true, get: function () { return platform_1.isNative; } });
 Object.defineProperty(exports, "isIOS", { enumerable: true, get: function () { return platform_1.isIOS; } });
 Object.defineProperty(exports, "isAndroid", { enumerable: true, get: function () { return platform_1.isAndroid; } });
-Object.defineProperty(exports, "initPlatformFromReactNative", { enumerable: true, get: function () { return platform_1.initPlatformFromReactNative; } });
 // --- Shared Utilities ---
 var colorUtils_1 = require("./shared/utils/colorUtils");
 Object.defineProperty(exports, "darkenColor", { enumerable: true, get: function () { return colorUtils_1.darkenColor; } });

package/dist/cjs/mixins/OxyServices.fedcm.js

@@ -380,11 +380,15 @@ function OxyServicesFedCMMixin(Base) {
              * @private
              */
             generateNonce() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
                 }
-                // Fallback for older browsers
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+                }
+                throw new Error('No secure random source available for nonce generation');
             }
             /**
              * Get the client ID for this origin

package/dist/cjs/mixins/OxyServices.popup.js

@@ -323,10 +323,15 @@ function OxyServicesPopupAuthMixin(Base) {
              * @private
              */
             generateState() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
                 }
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+                }
+                throw new Error('No secure random source available for state generation');
             }
             /**
              * Generate nonce for replay attack prevention
@@ -334,10 +339,15 @@ function OxyServicesPopupAuthMixin(Base) {
              * @private
              */
             generateNonce() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
+                }
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
                 }
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                throw new Error('No secure random source available for nonce generation');
             }
             /**
              * Store auth state in session storage

package/dist/cjs/mixins/OxyServices.redirect.js

@@ -254,10 +254,15 @@ function OxyServicesRedirectAuthMixin(Base) {
              * @private
              */
             generateState() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
                 }
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+                }
+                throw new Error('No secure random source available for state generation');
             }
             /**
              * Generate nonce for replay attack prevention
@@ -265,10 +270,15 @@ function OxyServicesRedirectAuthMixin(Base) {
              * @private
              */
             generateNonce() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
+                }
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
                 }
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                throw new Error('No secure random source available for nonce generation');
             }
             /**
              * Store auth state in session storage

package/dist/cjs/utils/deviceManager.js

@@ -171,16 +171,12 @@ class DeviceManager {
      * Generate a unique device ID
      */
     static generateDeviceId() {
-        // Use crypto.getRandomValues if available, otherwise fallback to Math.random
         if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
             const array = new Uint8Array(32);
             crypto.getRandomValues(array);
             return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('');
         }
-        else {
-            // Fallback for environments without crypto.getRandomValues
-            return 'device_' + Date.now().toString(36) + Math.random().toString(36).substr(2);
-        }
+        throw new Error('No secure random source available for device ID generation');
     }
     /**
      * Get a user-friendly device name based on platform

package/dist/cjs/utils/platform.js

@@ -6,39 +6,6 @@
  * This allows core modules to be used in web/Node.js environments
  * without bundlers failing on react-native imports.
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getPlatformOS = getPlatformOS;
 exports.isWeb = isWeb;
@@ -46,7 +13,6 @@ exports.isNative = isNative;
 exports.isIOS = isIOS;
 exports.isAndroid = isAndroid;
 exports.setPlatformOS = setPlatformOS;
-exports.initPlatformFromReactNative = initPlatformFromReactNative;
 /**
  * Detect the current platform without importing react-native
  *
@@ -125,21 +91,3 @@ function setPlatformOS(os) {
     cachedPlatform = os;
     globalThis.__REACT_NATIVE_PLATFORM__ = os;
 }
-/**
- * Try to initialize platform from react-native if available
- * This is called lazily when needed, avoiding top-level imports
- */
-async function initPlatformFromReactNative() {
-    if (cachedPlatform !== null && cachedPlatform !== 'unknown') {
-        return; // Already initialized
-    }
-    try {
-        // Variable indirection prevents bundlers (Vite, webpack) from statically resolving this
-        const moduleName = 'react-native';
-        const { Platform } = await Promise.resolve(`${moduleName}`).then(s => __importStar(require(s)));
-        setPlatformOS(Platform.OS);
-    }
-    catch {
-        // react-native not available, use detected platform
-    }
-}

package/dist/esm/AuthManager.js

@@ -99,6 +99,7 @@ export class AuthManager {
         this.listeners = new Set();
         this.currentUser = null;
         this.refreshTimer = null;
+        this.refreshPromise = null;
         this.oxyServices = oxyServices;
         this.config = {
             storage: config.storage ?? this.getDefaultStorage(),
@@ -199,9 +200,23 @@ export class AuthManager {
         }
     }
     /**
-     * Refresh the access token.
+     * Refresh the access token. Deduplicates concurrent calls so only one
+     * refresh request is in-flight at a time.
      */
     async refreshToken() {
+        // If a refresh is already in-flight, return the same promise
+        if (this.refreshPromise) {
+            return this.refreshPromise;
+        }
+        this.refreshPromise = this._doRefreshToken();
+        try {
+            return await this.refreshPromise;
+        }
+        finally {
+            this.refreshPromise = null;
+        }
+    }
+    async _doRefreshToken() {
         const refreshToken = await this.storage.getItem(STORAGE_KEYS.REFRESH_TOKEN);
         if (!refreshToken) {
             return false;

package/dist/esm/HttpService.js

@@ -82,6 +82,7 @@ class TokenStore {
  */
 export class HttpService {
     constructor(config) {
+        this.tokenRefreshPromise = null;
         // Performance monitoring
         this.requestMetrics = {
             totalRequests: 0,
@@ -445,24 +446,17 @@ export class HttpService {
             const currentTime = Math.floor(Date.now() / 1000);
             // If token expires in less than 60 seconds, refresh it
             if (decoded.exp && decoded.exp - currentTime < 60 && decoded.sessionId) {
+                // Deduplicate concurrent refresh attempts
+                if (!this.tokenRefreshPromise) {
+                    this.tokenRefreshPromise = this._refreshTokenFromSession(decoded.sessionId);
+                }
                 try {
-                    const refreshUrl = `${this.baseURL}/api/session/token/${decoded.sessionId}`;
-                    // Use AbortSignal.timeout for consistent timeout handling
-                    const response = await fetch(refreshUrl, {
-                        method: 'GET',
-                        headers: { 'Accept': 'application/json' },
-                        signal: AbortSignal.timeout(5000),
-                        credentials: 'include', // Include cookies for cross-origin requests
-                    });
-                    if (response.ok) {
-                        const { accessToken: newToken } = await response.json();
-                        this.tokenStore.setTokens(newToken);
-                        this.logger.debug('Token refreshed');
-                        return `Bearer ${newToken}`;
-                    }
+                    const result = await this.tokenRefreshPromise;
+                    if (result)
+                        return result;
                 }
-                catch (refreshError) {
-                    this.logger.warn('Token refresh failed, using current token');
+                finally {
+                    this.tokenRefreshPromise = null;
                 }
             }
             return `Bearer ${accessToken}`;
@@ -472,6 +466,27 @@ export class HttpService {
             return `Bearer ${accessToken}`;
         }
     }
+    async _refreshTokenFromSession(sessionId) {
+        try {
+            const refreshUrl = `${this.baseURL}/api/session/token/${sessionId}`;
+            const response = await fetch(refreshUrl, {
+                method: 'GET',
+                headers: { 'Accept': 'application/json' },
+                signal: AbortSignal.timeout(5000),
+                credentials: 'include',
+            });
+            if (response.ok) {
+                const { accessToken: newToken } = await response.json();
+                this.tokenStore.setTokens(newToken);
+                this.logger.debug('Token refreshed');
+                return `Bearer ${newToken}`;
+            }
+        }
+        catch (refreshError) {
+            this.logger.warn('Token refresh failed, using current token');
+        }
+        return null;
+    }
     /**
      * Unwrap standardized API response format
      */

package/dist/esm/index.js

@@ -31,7 +31,7 @@ export { DeviceManager } from './utils/deviceManager';
 // --- Language Utilities ---
 export { SUPPORTED_LANGUAGES, getLanguageMetadata, getLanguageName, getNativeLanguageName, normalizeLanguageCode, } from './utils/languageUtils';
 // --- Platform Detection ---
-export { getPlatformOS, setPlatformOS, isWeb, isNative, isIOS, isAndroid, initPlatformFromReactNative, } from './utils/platform';
+export { getPlatformOS, setPlatformOS, isWeb, isNative, isIOS, isAndroid, } from './utils/platform';
 // --- Shared Utilities ---
 export { darkenColor, lightenColor, hexToRgb, rgbToHex, withOpacity, isLightColor, getContrastTextColor, } from './shared/utils/colorUtils';
 export { normalizeTheme, normalizeColorScheme, getOppositeTheme, systemPrefersDarkMode, getSystemColorScheme, } from './shared/utils/themeUtils';

package/dist/esm/mixins/OxyServices.fedcm.js

@@ -376,11 +376,15 @@ export function OxyServicesFedCMMixin(Base) {
              * @private
              */
             generateNonce() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
                 }
-                // Fallback for older browsers
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+                }
+                throw new Error('No secure random source available for nonce generation');
             }
             /**
              * Get the client ID for this origin

package/dist/esm/mixins/OxyServices.popup.js

@@ -319,10 +319,15 @@ export function OxyServicesPopupAuthMixin(Base) {
              * @private
              */
             generateState() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
                 }
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+                }
+                throw new Error('No secure random source available for state generation');
             }
             /**
              * Generate nonce for replay attack prevention
@@ -330,10 +335,15 @@ export function OxyServicesPopupAuthMixin(Base) {
              * @private
              */
             generateNonce() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
+                }
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
                 }
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                throw new Error('No secure random source available for nonce generation');
             }
             /**
              * Store auth state in session storage

package/dist/esm/mixins/OxyServices.redirect.js

@@ -250,10 +250,15 @@ export function OxyServicesRedirectAuthMixin(Base) {
              * @private
              */
             generateState() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
                 }
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+                }
+                throw new Error('No secure random source available for state generation');
             }
             /**
              * Generate nonce for replay attack prevention
@@ -261,10 +266,15 @@ export function OxyServicesRedirectAuthMixin(Base) {
              * @private
              */
             generateNonce() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
+                }
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
                 }
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                throw new Error('No secure random source available for nonce generation');
             }
             /**
              * Store auth state in session storage

package/dist/esm/utils/deviceManager.js

@@ -135,16 +135,12 @@ export class DeviceManager {
      * Generate a unique device ID
      */
     static generateDeviceId() {
-        // Use crypto.getRandomValues if available, otherwise fallback to Math.random
         if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
             const array = new Uint8Array(32);
             crypto.getRandomValues(array);
             return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('');
         }
-        else {
-            // Fallback for environments without crypto.getRandomValues
-            return 'device_' + Date.now().toString(36) + Math.random().toString(36).substr(2);
-        }
+        throw new Error('No secure random source available for device ID generation');
     }
     /**
      * Get a user-friendly device name based on platform

package/dist/esm/utils/platform.js

@@ -83,21 +83,3 @@ export function setPlatformOS(os) {
     cachedPlatform = os;
     globalThis.__REACT_NATIVE_PLATFORM__ = os;
 }
-/**
- * Try to initialize platform from react-native if available
- * This is called lazily when needed, avoiding top-level imports
- */
-export async function initPlatformFromReactNative() {
-    if (cachedPlatform !== null && cachedPlatform !== 'unknown') {
-        return; // Already initialized
-    }
-    try {
-        // Variable indirection prevents bundlers (Vite, webpack) from statically resolving this
-        const moduleName = 'react-native';
-        const { Platform } = await import(moduleName);
-        setPlatformOS(Platform.OS);
-    }
-    catch {
-        // react-native not available, use detected platform
-    }
-}

package/dist/types/AuthManager.d.ts

@@ -66,6 +66,7 @@ export declare class AuthManager {
     private listeners;
     private currentUser;
     private refreshTimer;
+    private refreshPromise;
     private config;
     constructor(oxyServices: OxyServices, config?: AuthManagerConfig);
     /**
@@ -95,9 +96,11 @@ export declare class AuthManager {
      */
     private setupTokenRefresh;
     /**
-     * Refresh the access token.
+     * Refresh the access token. Deduplicates concurrent calls so only one
+     * refresh request is in-flight at a time.
      */
     refreshToken(): Promise<boolean>;
+    private _doRefreshToken;
     /**
      * Sign out and clear all auth data.
      */

package/dist/types/HttpService.d.ts

@@ -43,6 +43,7 @@ export declare class HttpService {
     private requestQueue;
     private logger;
     private config;
+    private tokenRefreshPromise;
     private requestMetrics;
     constructor(config: OxyConfig);
     /**
@@ -72,6 +73,7 @@ export declare class HttpService {
      * Get auth header with automatic token refresh
      */
     private getAuthHeader;
+    private _refreshTokenFromSession;
     /**
      * Unwrap standardized API response format
      */

package/dist/types/index.d.ts

@@ -31,7 +31,7 @@ export { DeviceManager } from './utils/deviceManager';
 export type { DeviceFingerprint, StoredDeviceInfo } from './utils/deviceManager';
 export { SUPPORTED_LANGUAGES, getLanguageMetadata, getLanguageName, getNativeLanguageName, normalizeLanguageCode, } from './utils/languageUtils';
 export type { LanguageMetadata } from './utils/languageUtils';
-export { getPlatformOS, setPlatformOS, isWeb, isNative, isIOS, isAndroid, initPlatformFromReactNative, } from './utils/platform';
+export { getPlatformOS, setPlatformOS, isWeb, isNative, isIOS, isAndroid, } from './utils/platform';
 export type { PlatformOS } from './utils/platform';
 export { darkenColor, lightenColor, hexToRgb, rgbToHex, withOpacity, isLightColor, getContrastTextColor, } from './shared/utils/colorUtils';
 export { normalizeTheme, normalizeColorScheme, getOppositeTheme, systemPrefersDarkMode, getSystemColorScheme, } from './shared/utils/themeUtils';

package/dist/types/utils/platform.d.ts

@@ -33,8 +33,3 @@ export declare function isAndroid(): boolean;
  * This allows lazy detection in environments where react-native is available
  */
 export declare function setPlatformOS(os: PlatformOS): void;
-/**
- * Try to initialize platform from react-native if available
- * This is called lazily when needed, avoiding top-level imports
- */
-export declare function initPlatformFromReactNative(): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/AuthManager.ts

@@ -142,6 +142,7 @@ export class AuthManager {
   private listeners: Set<AuthStateChangeCallback> = new Set();
   private currentUser: MinimalUserData | null = null;
   private refreshTimer: ReturnType<typeof setTimeout> | null = null;
+  private refreshPromise: Promise<boolean> | null = null;
   private config: Required<AuthManagerConfig>;
 
   constructor(oxyServices: OxyServices, config: AuthManagerConfig = {}) {
@@ -261,9 +262,24 @@ export class AuthManager {
   }
 
   /**
-   * Refresh the access token.
+   * Refresh the access token. Deduplicates concurrent calls so only one
+   * refresh request is in-flight at a time.
    */
   async refreshToken(): Promise<boolean> {
+    // If a refresh is already in-flight, return the same promise
+    if (this.refreshPromise) {
+      return this.refreshPromise;
+    }
+
+    this.refreshPromise = this._doRefreshToken();
+    try {
+      return await this.refreshPromise;
+    } finally {
+      this.refreshPromise = null;
+    }
+  }
+
+  private async _doRefreshToken(): Promise<boolean> {
     const refreshToken = await this.storage.getItem(STORAGE_KEYS.REFRESH_TOKEN);
     if (!refreshToken) {
       return false;

package/src/HttpService.ts

@@ -131,6 +131,7 @@ export class HttpService {
   private requestQueue: RequestQueue;
   private logger: SimpleLogger;
   private config: OxyConfig;
+  private tokenRefreshPromise: Promise<string | null> | null = null;
 
   // Performance monitoring
   private requestMetrics = {
@@ -563,25 +564,15 @@ export class HttpService {
 
       // If token expires in less than 60 seconds, refresh it
       if (decoded.exp && decoded.exp - currentTime < 60 && decoded.sessionId) {
+        // Deduplicate concurrent refresh attempts
+        if (!this.tokenRefreshPromise) {
+          this.tokenRefreshPromise = this._refreshTokenFromSession(decoded.sessionId);
+        }
         try {
-          const refreshUrl = `${this.baseURL}/api/session/token/${decoded.sessionId}`;
-          
-          // Use AbortSignal.timeout for consistent timeout handling
-          const response = await fetch(refreshUrl, {
-            method: 'GET',
-            headers: { 'Accept': 'application/json' },
-            signal: AbortSignal.timeout(5000),
-            credentials: 'include', // Include cookies for cross-origin requests
-          });
-
-          if (response.ok) {
-            const { accessToken: newToken } = await response.json();
-            this.tokenStore.setTokens(newToken);
-            this.logger.debug('Token refreshed');
-            return `Bearer ${newToken}`;
-          }
-        } catch (refreshError) {
-          this.logger.warn('Token refresh failed, using current token');
+          const result = await this.tokenRefreshPromise;
+          if (result) return result;
+        } finally {
+          this.tokenRefreshPromise = null;
         }
       }
 
@@ -592,6 +583,28 @@ export class HttpService {
     }
   }
 
+  private async _refreshTokenFromSession(sessionId: string): Promise<string | null> {
+    try {
+      const refreshUrl = `${this.baseURL}/api/session/token/${sessionId}`;
+      const response = await fetch(refreshUrl, {
+        method: 'GET',
+        headers: { 'Accept': 'application/json' },
+        signal: AbortSignal.timeout(5000),
+        credentials: 'include',
+      });
+
+      if (response.ok) {
+        const { accessToken: newToken } = await response.json();
+        this.tokenStore.setTokens(newToken);
+        this.logger.debug('Token refreshed');
+        return `Bearer ${newToken}`;
+      }
+    } catch (refreshError) {
+      this.logger.warn('Token refresh failed, using current token');
+    }
+    return null;
+  }
+
   /**
    * Unwrap standardized API response format
    */

package/src/index.ts

@@ -61,7 +61,6 @@ export {
   isNative,
   isIOS,
   isAndroid,
-  initPlatformFromReactNative,
 } from './utils/platform';
 export type { PlatformOS } from './utils/platform';
 

package/src/mixins/OxyServices.fedcm.ts

@@ -439,11 +439,15 @@ export function OxyServicesFedCMMixin<T extends typeof OxyServicesBase>(Base: T)
    * @private
    */
   public generateNonce(): string {
-    if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-      return window.crypto.randomUUID();
+    if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+      return crypto.randomUUID();
     }
-    // Fallback for older browsers
-    return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+    if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+      const bytes = new Uint8Array(16);
+      crypto.getRandomValues(bytes);
+      return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+    }
+    throw new Error('No secure random source available for nonce generation');
   }
 
   /**

package/src/mixins/OxyServices.popup.ts

@@ -397,10 +397,15 @@ export function OxyServicesPopupAuthMixin<T extends typeof OxyServicesBase>(Base
    * @private
    */
   public generateState(): string {
-    if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-      return window.crypto.randomUUID();
+    if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+      return crypto.randomUUID();
     }
-    return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+    if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+      const bytes = new Uint8Array(16);
+      crypto.getRandomValues(bytes);
+      return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+    }
+    throw new Error('No secure random source available for state generation');
   }
 
   /**
@@ -409,10 +414,15 @@ export function OxyServicesPopupAuthMixin<T extends typeof OxyServicesBase>(Base
    * @private
    */
   public generateNonce(): string {
-    if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-      return window.crypto.randomUUID();
+    if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+      return crypto.randomUUID();
+    }
+    if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+      const bytes = new Uint8Array(16);
+      crypto.getRandomValues(bytes);
+      return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
     }
-    return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+    throw new Error('No secure random source available for nonce generation');
   }
 
   /**

package/src/mixins/OxyServices.redirect.ts

@@ -299,10 +299,15 @@ export function OxyServicesRedirectAuthMixin<T extends typeof OxyServicesBase>(B
    * @private
    */
   public generateState(): string {
-    if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-      return window.crypto.randomUUID();
+    if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+      return crypto.randomUUID();
     }
-    return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+    if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+      const bytes = new Uint8Array(16);
+      crypto.getRandomValues(bytes);
+      return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+    }
+    throw new Error('No secure random source available for state generation');
   }
 
   /**
@@ -311,10 +316,15 @@ export function OxyServicesRedirectAuthMixin<T extends typeof OxyServicesBase>(B
    * @private
    */
   public generateNonce(): string {
-    if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-      return window.crypto.randomUUID();
+    if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+      return crypto.randomUUID();
+    }
+    if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+      const bytes = new Uint8Array(16);
+      crypto.getRandomValues(bytes);
+      return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
     }
-    return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+    throw new Error('No secure random source available for nonce generation');
   }
 
   /**

package/src/utils/deviceManager.ts

@@ -170,15 +170,12 @@ export class DeviceManager {
    * Generate a unique device ID
    */
   private static generateDeviceId(): string {
-    // Use crypto.getRandomValues if available, otherwise fallback to Math.random
     if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
       const array = new Uint8Array(32);
       crypto.getRandomValues(array);
       return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('');
-    } else {
-      // Fallback for environments without crypto.getRandomValues
-      return 'device_' + Date.now().toString(36) + Math.random().toString(36).substr(2);
     }
+    throw new Error('No secure random source available for device ID generation');
   }
 
   /**

package/src/utils/platform.ts

@@ -98,21 +98,3 @@ export function setPlatformOS(os: PlatformOS): void {
   (globalThis as any).__REACT_NATIVE_PLATFORM__ = os;
 }
 
-/**
- * Try to initialize platform from react-native if available
- * This is called lazily when needed, avoiding top-level imports
- */
-export async function initPlatformFromReactNative(): Promise<void> {
-  if (cachedPlatform !== null && cachedPlatform !== 'unknown') {
-    return; // Already initialized
-  }
-
-  try {
-    // Variable indirection prevents bundlers (Vite, webpack) from statically resolving this
-    const moduleName = 'react-native';
-    const { Platform } = await import(moduleName);
-    setPlatformOS(Platform.OS as PlatformOS);
-  } catch {
-    // react-native not available, use detected platform
-  }
-}