@oxyhq/core 1.11.11 → 1.11.13

package/dist/esm/mixins/OxyServices.auth.js

@@ -7,6 +7,12 @@ export function OxyServicesAuthMixin(Base) {
             /** @internal */ this._serviceTokenExp = 0;
             /** @internal */ this._serviceApiKey = null;
             /** @internal */ this._serviceApiSecret = null;
+            /**
+             * In-flight promise for service token fetch. Used to deduplicate concurrent
+             * calls to getServiceToken() — pattern mirrors AuthManager.refreshToken().
+             * @internal
+             */
+            this._serviceTokenPromise = null;
         }
         /**
          * Configure service credentials for internal service-to-service communication.
@@ -27,6 +33,9 @@ export function OxyServicesAuthMixin(Base) {
          * Get a service token for internal service-to-service communication.
          * Tokens are short-lived (1h) and automatically cached/refreshed.
          *
+         * Concurrent callers share a single in-flight request to avoid hammering
+         * `/auth/service-token` when the cache is empty or expired.
+         *
          * @param apiKey - DeveloperApp API key (optional if configureServiceAuth was called)
          * @param apiSecret - DeveloperApp API secret (optional if configureServiceAuth was called)
          */
@@ -40,6 +49,24 @@ export function OxyServicesAuthMixin(Base) {
             if (this._serviceToken && this._serviceTokenExp > Date.now() + 60000) {
                 return this._serviceToken;
             }
+            // If a fetch is already in-flight, share the same promise
+            if (this._serviceTokenPromise) {
+                return this._serviceTokenPromise;
+            }
+            this._serviceTokenPromise = this._doFetchServiceToken(key, secret);
+            try {
+                return await this._serviceTokenPromise;
+            }
+            finally {
+                this._serviceTokenPromise = null;
+            }
+        }
+        /**
+         * Perform the actual /auth/service-token request and cache the result.
+         * Separated so getServiceToken() can deduplicate concurrent calls.
+         * @internal
+         */
+        async _doFetchServiceToken(key, secret) {
             const response = await this.makeRequest('POST', '/auth/service-token', { apiKey: key, apiSecret: secret }, { cache: false, retry: false });
             this._serviceToken = response.token;
             this._serviceTokenExp = Date.now() + response.expiresIn * 1000;

package/dist/esm/mixins/OxyServices.contacts.js

@@ -0,0 +1,47 @@
+/**
+ * Contact Discovery Mixin
+ *
+ * Privacy-preserving discovery of which address-book contacts are on Oxy.
+ *
+ * The client hashes emails and phones locally before calling the API.
+ * The server responds with only Oxy user IDs and the hashes that matched,
+ * so the consumer can map each match back to the local contact that
+ * produced it.
+ *
+ * Hashing rules (must match the server `utils/contactHash.ts` exactly):
+ *   - SHA-256, hex-encoded, lowercase
+ *   - Email: `value.trim().toLowerCase()` then digest
+ *   - Phone: trim → keep a single leading "+" → strip non-digits → prepend "+"
+ *     if missing → digest
+ *
+ * Mobile clients can compute these digests with `expo-crypto`'s
+ * `digestStringAsync(SHA256, value, { encoding: HEX })`. Web clients should
+ * use `SubtleCrypto.digest('SHA-256', ...)`.
+ */
+export function OxyServicesContactsMixin(Base) {
+    return class extends Base {
+        constructor(...args) {
+            super(...args);
+        }
+        /**
+         * Discover which of the caller's contacts are on Oxy.
+         *
+         * @param hashedEmails - SHA-256 hex digests of normalized emails.
+         * @param hashedPhones - SHA-256 hex digests of normalized phone numbers.
+         * @returns Matches mapping each hashed identifier to the Oxy user ID it
+         *   resolved to. Empty arrays are valid for either parameter, but at
+         *   least one must be non-empty.
+         *
+         * The server enforces a 200-hash cap per channel per request — callers
+         * should batch larger address books client-side.
+         */
+        async discoverContacts(hashedEmails, hashedPhones) {
+            try {
+                return await this.makeRequest('POST', '/contacts/discover', { hashedEmails, hashedPhones }, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+    };
+}

package/dist/esm/mixins/OxyServices.features.js

@@ -291,16 +291,5 @@ export function OxyServicesFeaturesMixin(Base) {
                 throw this.handleError(error);
             }
         }
-        // ==================
-        // ACCOUNT
-        // ==================
-        /**
-         * Delete user account (requires password confirmation)
-         */
-        async deleteAccount(password) {
-            return this.withAuthRetry(async () => {
-                await this.makeRequest('DELETE', '/account', { password }, { cache: false });
-            }, 'deleteAccount');
-        }
     };
 }

package/dist/esm/mixins/OxyServices.fedcm.js

@@ -311,10 +311,11 @@ export function OxyServicesFedCMMixin(Base) {
                                     {
                                         configURL: options.configURL,
                                         clientId: options.clientId,
-                                        // Send nonce at both levels for backward compatibility
-                                        nonce: options.nonce, // For older browsers
+                                        // Older browsers read `nonce` at the top level; Chrome 145+
+                                        // expects it inside `params`. Send both for full coverage.
+                                        nonce: options.nonce,
                                         params: {
-                                            nonce: options.nonce, // For Chrome 145+
+                                            nonce: options.nonce,
                                         },
                                         ...(options.loginHint && { loginHint: options.loginHint }),
                                     },

package/dist/esm/mixins/OxyServices.language.js

@@ -2,6 +2,7 @@
  * Language Methods Mixin
  */
 import { normalizeLanguageCode, getLanguageMetadata, getLanguageName, getNativeLanguageName } from '../utils/languageUtils.js';
+import { loadAsyncStorage } from '../utils/platformCrypto.js';
 import { isDev } from '../shared/utils/debugUtils.js';
 export function OxyServicesLanguageMixin(Base) {
     return class extends Base {
@@ -15,9 +16,10 @@ export function OxyServicesLanguageMixin(Base) {
             const isReactNative = typeof navigator !== 'undefined' && navigator.product === 'ReactNative';
             if (isReactNative) {
                 try {
-                    // Variable indirection prevents bundlers (Vite, webpack) from statically resolving this
-                    const moduleName = '@react-native-async-storage/async-storage';
-                    const asyncStorageModule = await import(moduleName);
+                    // `loadAsyncStorage` is per-platform: the RN variant statically imports
+                    // @react-native-async-storage/async-storage, the default variant throws
+                    // (never called outside RN because of the `isReactNative` gate above).
+                    const asyncStorageModule = await loadAsyncStorage();
                     const storage = asyncStorageModule.default;
                     return {
                         getItem: storage.getItem.bind(storage),

package/dist/esm/mixins/OxyServices.redirect.js

@@ -149,12 +149,16 @@ export function OxyServicesRedirectAuthMixin(Base) {
                 // Store tokens
                 this.storeTokens(accessToken, sessionId);
                 this.httpService.setTokens(accessToken);
-                // Build session response (minimal - we'll fetch full user data separately)
+                // Build session response (minimal — full user data is fetched separately
+                // by the caller via getCurrentUser() once tokens are stored).
                 const session = {
                     sessionId,
                     deviceId: '', // Not available in redirect flow
                     expiresAt: expiresAt || new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString(),
-                    user: {}, // Will be fetched separately
+                    // Placeholder user — caller MUST fetch real user data via getCurrentUser()
+                    // before exposing this session to the application. The empty id signals
+                    // that the user payload has not yet been populated.
+                    user: { id: '', username: '' },
                 };
                 // Clean up URL (remove auth parameters)
                 this.cleanAuthCallbackUrl(url);

package/dist/esm/mixins/OxyServices.security.js

@@ -20,8 +20,19 @@ export function OxyServicesSecurityMixin(Base) {
                     params.offset = offset;
                 if (eventType)
                     params.eventType = eventType;
-                const response = await this.makeRequest('GET', '/security/activity', params, { cache: false });
-                return response;
+                // The API responds with the standard paginated envelope:
+                //   { data: SecurityActivity[], pagination: { total, limit, offset, hasMore } }
+                // SecurityActivityResponse is the flattened shape consumers expect.
+                const raw = await this.makeRequest('GET', '/security/activity', params, { cache: false });
+                const requestedLimit = typeof params.limit === 'number' ? params.limit : 0;
+                const requestedOffset = typeof params.offset === 'number' ? params.offset : 0;
+                return {
+                    data: raw.data ?? [],
+                    total: raw.pagination?.total ?? raw.data?.length ?? 0,
+                    limit: raw.pagination?.limit ?? requestedLimit,
+                    offset: raw.pagination?.offset ?? requestedOffset,
+                    hasMore: raw.pagination?.hasMore ?? false,
+                };
             }
             catch (error) {
                 throw this.handleError(error);

package/dist/esm/mixins/OxyServices.user.js

@@ -1,4 +1,6 @@
 import { buildSearchParams, buildPaginationParams } from '../utils/apiUtils.js';
+import { KeyManager } from '../crypto/keyManager.js';
+import { SignatureService } from '../crypto/signatureService.js';
 export function OxyServicesUserMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -18,6 +20,17 @@ export function OxyServicesUserMixin(Base) {
                 throw this.handleError(error);
             }
         }
+        /**
+         * Lightweight username lookup for login flows.
+         * Returns minimal public info: exists, color, avatar, displayName.
+         * Faster than getProfileByUsername — no stats, no formatting.
+         */
+        async lookupUsername(username) {
+            return await this.makeRequest('GET', `/auth/lookup/${encodeURIComponent(username)}`, undefined, {
+                cache: true,
+                cacheTTL: 60 * 1000, // 1 minute cache
+            });
+        }
         /**
          * Search user profiles
          */
@@ -30,37 +43,22 @@ export function OxyServicesUserMixin(Base) {
                     cache: true,
                     cacheTTL: 2 * 60 * 1000, // 2 minutes cache
                 });
-                // New API shape: { data: User[], pagination: {...} }
-                const isSearchProfilesResponse = (payload) => typeof payload === 'object' &&
-                    payload !== null &&
-                    Array.isArray(payload.data);
-                if (isSearchProfilesResponse(response)) {
-                    const typedResponse = response;
-                    const paginationInfo = typedResponse.pagination ?? {
-                        total: typedResponse.data.length,
-                        limit: pagination?.limit ?? typedResponse.data.length,
-                        offset: pagination?.offset ?? 0,
-                        hasMore: typedResponse.data.length === (pagination?.limit ?? typedResponse.data.length) &&
-                            (pagination?.limit ?? typedResponse.data.length) > 0,
-                    };
-                    return {
-                        data: typedResponse.data,
-                        pagination: paginationInfo,
-                    };
-                }
-                // Legacy API shape: returns raw User[]
-                if (Array.isArray(response)) {
-                    const fallbackLimit = pagination?.limit ?? response.length;
-                    const fallbackPagination = {
-                        total: response.length,
-                        limit: fallbackLimit,
-                        offset: pagination?.offset ?? 0,
-                        hasMore: fallbackLimit > 0 && response.length === fallbackLimit,
-                    };
-                    return { data: response, pagination: fallbackPagination };
+                if (typeof response !== 'object' ||
+                    response === null ||
+                    !Array.isArray(response.data)) {
+                    throw new Error('Unexpected search response format');
                 }
-                // If response is unexpected, throw an error
-                throw new Error('Unexpected search response format');
+                const paginationInfo = response.pagination ?? {
+                    total: response.data.length,
+                    limit: pagination?.limit ?? response.data.length,
+                    offset: pagination?.offset ?? 0,
+                    hasMore: response.data.length === (pagination?.limit ?? response.data.length) &&
+                        (pagination?.limit ?? response.data.length) > 0,
+                };
+                return {
+                    data: response.data,
+                    pagination: paginationInfo,
+                };
             }
             catch (error) {
                 throw this.handleError(error);
@@ -142,12 +140,31 @@ export function OxyServicesUserMixin(Base) {
             }, 'getCurrentUser');
         }
         /**
-         * Update user profile
-         * TanStack Query handles offline queuing automatically
+         * Update user profile.
+         *
+         * Invalidates the SDK-side response cache for every endpoint that
+         * returns the current user (`GET /users/me`, `GET /session/user/*`,
+         * `GET /users/<id>`, `GET /profiles/username/*`) so the next read
+         * doesn't return a stale snapshot. Without this, a follow-up
+         * `getUserBySession` call inside the 2-minute cache window can return
+         * the pre-update user — most visibly during onboarding, where it
+         * causes the username step to flicker back as if nothing was saved.
+         *
+         * TanStack Query handles offline queuing automatically.
          */
         async updateProfile(updates) {
             try {
-                return await this.makeRequest('PUT', '/users/me', updates, { cache: false });
+                const result = await this.makeRequest('PUT', '/users/me', updates, { cache: false });
+                // Bust every cached representation of the current user. We use a
+                // prefix sweep rather than an enumeration because the SDK never
+                // tracks the set of active session IDs centrally.
+                this.clearCacheByPrefix('GET:/session/user/');
+                this.clearCacheByPrefix('GET:/users/me');
+                this.clearCacheByPrefix('GET:/profiles/username/');
+                if (result?.id) {
+                    this.clearCacheEntry(`GET:/users/${result.id}`);
+                }
+                return result;
             }
             catch (error) {
                 const errorAny = error;
@@ -231,14 +248,29 @@ export function OxyServicesUserMixin(Base) {
             }
         }
         /**
-         * Delete account permanently
-         * @param password - User password for confirmation
-         * @param confirmText - Confirmation text (usually username)
+         * Delete account permanently.
+         *
+         * Signs `delete:{publicKey}:{timestamp}` with the locally-stored identity
+         * private key and submits the signature alongside the confirmation text
+         * (must equal the user's username). The signature is the cryptographic
+         * proof of ownership — only the device holding the private key can issue
+         * a valid signature, so no password is required.
+         *
+         * @param confirmText - Must equal the user's username (verified server-side)
+         * @throws If no identity is stored on this device, or signing fails
          */
-        async deleteAccount(password, confirmText) {
+        async deleteAccount(confirmText) {
             try {
+                const publicKey = await KeyManager.getPublicKey();
+                if (!publicKey) {
+                    throw new Error('No identity found on this device. Account deletion requires the device that holds your identity key.');
+                }
+                const timestamp = Date.now();
+                const message = `delete:${publicKey}:${timestamp}`;
+                const signature = await SignatureService.sign(message);
                 return await this.makeRequest('DELETE', '/users/me', {
-                    password,
+                    signature,
+                    timestamp,
                     confirmText,
                 }, { cache: false });
             }

package/dist/esm/mixins/OxyServices.utility.js

@@ -5,6 +5,7 @@
  * and Express.js authentication middleware
  */
 import { jwtDecode } from 'jwt-decode';
+import { loadNodeCrypto } from '../utils/platformCrypto.js';
 import { CACHE_TIMES } from './mixinHelpers.js';
 export function OxyServicesUtilityMixin(Base) {
     return class extends Base {
@@ -218,9 +219,15 @@ export function OxyServicesUtilityMixin(Base) {
                                 return onError(error);
                             return res.status(403).json(error);
                         }
-                        // Verify JWT signature (not just decode)
+                        // Verify JWT signature (not just decode).
+                        // This middleware only runs on a Node Express server, but the file
+                        // is bundled by Metro/Vite for RN/web consumers. `loadNodeCrypto`
+                        // is per-platform: the RN variant throws (and is never called
+                        // because service-token middleware is only mounted by Node hosts),
+                        // so Metro never bundles a reference to Node's built-in.
                         try {
-                            const { createHmac } = await import('crypto');
+                            const nodeCrypto = await loadNodeCrypto();
+                            const { createHmac, timingSafeEqual } = nodeCrypto;
                             const [headerB64, payloadB64, signatureB64] = token.split('.');
                             if (!headerB64 || !payloadB64 || !signatureB64) {
                                 throw new Error('Invalid token structure');
@@ -234,7 +241,6 @@ export function OxyServicesUtilityMixin(Base) {
                             // Timing-safe comparison
                             const sigBuf = Buffer.from(signatureB64);
                             const expectedBuf = Buffer.from(expectedSig);
-                            const { timingSafeEqual } = await import('crypto');
                             if (sigBuf.length !== expectedBuf.length || !timingSafeEqual(sigBuf, expectedBuf)) {
                                 throw new Error('Invalid signature');
                             }
@@ -259,8 +265,8 @@ export function OxyServicesUtilityMixin(Base) {
                                 return onError(error);
                             return res.status(401).json(error);
                         }
-                        // Check expiration
-                        if (decoded.exp && decoded.exp < Math.floor(Date.now() / 1000)) {
+                        // Check expiration — reject tokens at exact expiry second (use <=)
+                        if (decoded.exp && decoded.exp <= Math.floor(Date.now() / 1000)) {
                             if (optional) {
                                 req.userId = null;
                                 req.user = null;
@@ -315,7 +321,8 @@ export function OxyServicesUtilityMixin(Base) {
                         return res.status(401).json(error);
                     }
                     // Check token expiration locally first (fast path)
-                    if (decoded.exp && decoded.exp < Math.floor(Date.now() / 1000)) {
+                    // Reject tokens at exact expiry second (use <=)
+                    if (decoded.exp && decoded.exp <= Math.floor(Date.now() / 1000)) {
                         if (optional) {
                             req.userId = null;
                             req.user = null;
@@ -482,8 +489,8 @@ export function OxyServicesUtilityMixin(Base) {
                     if (!userId) {
                         return next(new Error('Invalid token payload'));
                     }
-                    // Check expiration
-                    if (decoded.exp && decoded.exp < Math.floor(Date.now() / 1000)) {
+                    // Check expiration — reject tokens at exact expiry second (use <=)
+                    if (decoded.exp && decoded.exp <= Math.floor(Date.now() / 1000)) {
                         return next(new Error('Token expired'));
                     }
                     // Validate session if available
@@ -500,12 +507,14 @@ export function OxyServicesUtilityMixin(Base) {
                             return next(new Error('Session validation failed'));
                         }
                     }
-                    // Attach user data to socket
+                    // Attach user data to socket. We expose BOTH `socket.data.userId`
+                    // (the official Socket.IO data slot) and `socket.user` because
+                    // every consumer in this ecosystem (Mention, Allo, api/server.ts)
+                    // reads from `socket.user.id`.
                     socket.data = socket.data || {};
                     socket.data.userId = userId;
                     socket.data.sessionId = decoded.sessionId || null;
                     socket.data.token = token;
-                    // Also set on socket.user for backward compatibility
                     socket.user = { id: userId, userId, sessionId: decoded.sessionId };
                     if (debug) {
                         console.log(`[oxy.authSocket] OK user=${userId}`);

package/dist/esm/mixins/index.js

@@ -24,6 +24,7 @@ import { OxyServicesUtilityMixin } from './OxyServices.utility.js';
 import { OxyServicesFeaturesMixin } from './OxyServices.features.js';
 import { OxyServicesTopicsMixin } from './OxyServices.topics.js';
 import { OxyServicesManagedAccountsMixin } from './OxyServices.managedAccounts.js';
+import { OxyServicesContactsMixin } from './OxyServices.contacts.js';
 /**
  * Mixin pipeline - applied in order from first to last.
  *
@@ -62,6 +63,7 @@ const MIXIN_PIPELINE = [
     OxyServicesFeaturesMixin,
     OxyServicesTopicsMixin,
     OxyServicesManagedAccountsMixin,
+    OxyServicesContactsMixin,
     // Utility (last, can use all above)
     OxyServicesUtilityMixin,
 ];
@@ -69,12 +71,18 @@ const MIXIN_PIPELINE = [
  * Composes all OxyServices mixins using a pipeline pattern.
  *
  * This is equivalent to the nested calls but more readable and maintainable.
- * Adding a new mixin: just add it to MIXIN_PIPELINE at the appropriate position.
+ * Adding a new mixin: add it to MIXIN_PIPELINE at the appropriate position
+ * AND extend `AllMixinInstances` so its methods are visible to consumers.
  *
- * @returns The fully composed OxyServices class with all mixins applied
+ * The cast through `unknown` carries the runtime augmentation chain into the
+ * static type system. `Array.reduce` cannot track each mixin's generic
+ * refinement, so we assert the final shape exposed by all mixins together.
+ *
+ * @returns The fully composed OxyServices constructor with all mixins applied
  */
 export function composeOxyServices() {
-    return MIXIN_PIPELINE.reduce((Base, mixin) => mixin(Base), OxyServicesBase);
+    const composed = MIXIN_PIPELINE.reduce((Base, mixin) => mixin(Base), OxyServicesBase);
+    return composed;
 }
 // Export the pipeline for testing/debugging
 export { MIXIN_PIPELINE };

package/dist/esm/utils/accountUtils.js

@@ -2,6 +2,72 @@
  * Shared account types and pure helper functions.
  * Used by both @oxyhq/services (React Native) and @oxyhq/auth (Web) account stores.
  */
+import { translate } from '../i18n/index.js';
+/**
+ * Truncate a long public key for display, e.g. `0x12345678…`.
+ * Falls back to the raw key if it's too short to truncate.
+ */
+export const formatPublicKeyHandle = (publicKey) => {
+    const cleaned = publicKey.startsWith('0x') ? publicKey.slice(2) : publicKey;
+    if (cleaned.length <= 8)
+        return `0x${cleaned}`;
+    return `0x${cleaned.slice(0, 8)}…`;
+};
+/**
+ * Resolve a friendly display name for a user.
+ *
+ * Order of preference:
+ *  1. `name.full`, or composed `name.first name.last`
+ *  2. `name` (when stored as a plain string)
+ *  3. `username`
+ *  4. `Account 0x12345678…` (derived from publicKey, when present)
+ *  5. Translated fallback (e.g. "Unnamed")
+ *
+ * The translation key `common.unnamed` is used for the final fallback. If the
+ * caller does not pass a locale, the default English translation is used.
+ */
+export const getAccountDisplayName = (user, locale) => {
+    if (!user)
+        return translate(locale, 'common.unnamed');
+    const { name, username, publicKey } = user;
+    if (name && typeof name === 'object') {
+        if (typeof name.full === 'string' && name.full.trim())
+            return name.full.trim();
+        const first = typeof name.first === 'string' ? name.first.trim() : '';
+        const last = typeof name.last === 'string' ? name.last.trim() : '';
+        const composed = [first, last].filter(Boolean).join(' ').trim();
+        if (composed)
+            return composed;
+    }
+    else if (typeof name === 'string' && name.trim()) {
+        return name.trim();
+    }
+    if (typeof username === 'string' && username.trim())
+        return username.trim();
+    if (typeof publicKey === 'string' && publicKey.length > 0) {
+        return translate(locale, 'common.accountFallback', {
+            handle: formatPublicKeyHandle(publicKey),
+        });
+    }
+    return translate(locale, 'common.unnamed');
+};
+/**
+ * Resolve a `@handle` style identifier for a user.
+ *
+ * Returns the bare username when present (without the `@`), otherwise a
+ * truncated public-key handle (`0x12345678…`), or `undefined` when neither is
+ * available — callers can decide whether to hide the line entirely.
+ */
+export const getAccountFallbackHandle = (user) => {
+    if (!user)
+        return undefined;
+    if (typeof user.username === 'string' && user.username.trim())
+        return user.username.trim();
+    if (typeof user.publicKey === 'string' && user.publicKey.length > 0) {
+        return formatPublicKeyHandle(user.publicKey);
+    }
+    return undefined;
+};
 /**
  * Build an ordered array of QuickAccounts from a map and order list.
  */
@@ -23,7 +89,7 @@ export const buildAccountsArray = (accounts, order) => {
  * @param getFileDownloadUrl - Function to generate avatar download URL from file ID
  */
 export const createQuickAccount = (sessionId, userData, existingAccount, getFileDownloadUrl) => {
-    const displayName = userData.name?.full || userData.name?.first || userData.username || 'Account';
+    const displayName = getAccountDisplayName(userData);
     const userId = userData.id || (typeof userData._id === 'string' ? userData._id : userData._id?.toString());
     // Preserve existing avatarUrl if avatar hasn't changed (prevents image reload)
     let avatarUrl;

package/dist/esm/utils/asyncUtils.js

@@ -30,18 +30,47 @@ export async function parallelWithErrorHandling(operations, errorHandler) {
     const results = await Promise.allSettled(operations.map((op, index) => withErrorHandling(op, error => errorHandler?.(error, index))));
     return results.map(result => result.status === 'fulfilled' ? result.value : null);
 }
+/**
+ * Extract an HTTP status code from an error value, tolerating both the
+ * axios-style nested shape (`error.response.status`) and the flat shape
+ * produced by {@link handleHttpError} / fetch-based clients (`error.status`).
+ *
+ * Centralising this lookup prevents retry predicates from silently falling
+ * through when one of the two shapes is missing, which previously caused
+ * @oxyhq/core to retry 4xx responses and turn sub-10ms failures into
+ * multi-second stalls for every missing-resource lookup.
+ */
+function extractHttpStatus(error) {
+    if (!error || typeof error !== 'object')
+        return undefined;
+    const candidate = error;
+    const flat = candidate.status;
+    if (typeof flat === 'number' && Number.isFinite(flat))
+        return flat;
+    const nested = candidate.response?.status;
+    if (typeof nested === 'number' && Number.isFinite(nested))
+        return nested;
+    return undefined;
+}
 /**
  * Retry an async operation with exponential backoff
  *
- * By default, does not retry on 4xx errors (client errors).
- * Use shouldRetry callback to customize retry behavior.
+ * By default, does not retry on 4xx errors (client errors). The default
+ * predicate accepts both the axios-style `error.response.status` and the
+ * flat `error.status` shape produced by {@link handleHttpError}, so callers
+ * never accidentally retry a deterministic client failure.
+ *
+ * Use the `shouldRetry` callback to customize retry behavior.
  */
 export async function retryAsync(operation, maxRetries = 3, baseDelay = 1000, shouldRetry) {
     let lastError;
-    // Default shouldRetry: don't retry on 4xx errors
+    // Default shouldRetry: don't retry on 4xx errors (client errors).
+    // Checks BOTH `error.status` (flat shape from handleHttpError / fetch
+    // clients) AND `error.response.status` (axios-style shape) so neither
+    // representation can leak a client error into the retry loop.
     const defaultShouldRetry = (error) => {
-        // Don't retry on 4xx errors (client errors)
-        if (error?.response?.status >= 400 && error?.response?.status < 500) {
+        const status = extractHttpStatus(error);
+        if (status !== undefined && status >= 400 && status < 500) {
             return false;
         }
         return true;

package/dist/esm/utils/deviceManager.js

@@ -1,3 +1,4 @@
+import { loadAsyncStorage } from './platformCrypto.js';
 /**
  * Client-side device management utility
  * Handles persistent device identification across app sessions
@@ -15,9 +16,10 @@ export class DeviceManager {
     static async getStorage() {
         if (this.isReactNative()) {
             try {
-                // Variable indirection prevents bundlers (Vite, webpack) from statically resolving this
-                const moduleName = '@react-native-async-storage/async-storage';
-                const asyncStorageModule = await import(moduleName);
+                // `loadAsyncStorage` is per-platform: the RN variant statically imports
+                // @react-native-async-storage/async-storage, the default variant throws
+                // (never called outside RN because of the `isReactNative()` gate above).
+                const asyncStorageModule = await loadAsyncStorage();
                 const storage = asyncStorageModule.default;
                 return {
                     getItem: storage.getItem.bind(storage),