@oxyhq/core 1.11.22 → 1.11.23

package/dist/esm/HttpService.js

@@ -106,6 +106,16 @@ export class HttpService {
         this.tokenRefreshPromise = null;
         this.tokenRefreshCooldownUntil = 0;
         this._onTokenRefreshed = null;
+        /**
+         * Fan-out listeners notified on EVERY access-token change on this instance:
+         * explicit `setTokens`, `clearTokens`, a successful silent refresh, and the
+         * internal 401-driven clear. Unlike the single-slot `_onTokenRefreshed`
+         * (owned by AuthManager for the refresh path only), this is a Set so multiple
+         * independent observers can mirror token state without clobbering each other.
+         *
+         * Each listener receives the resulting access token, or `null` when cleared.
+         */
+        this._tokenChangeListeners = new Set();
         // Acting-as identity for managed accounts
         this._actingAsUserId = null;
         // Performance monitoring
@@ -309,6 +319,7 @@ export class HttpService {
                         // Refresh failed or no token — clear tokens and stale CSRF
                         this.tokenStore.clearTokens();
                         this.tokenStore.clearCsrfToken();
+                        this.notifyTokenChange();
                     }
                     // On 403 with CSRF error, clear cached token and retry once
                     if (response.status === 403 && !config._isCsrfRetry) {
@@ -688,6 +699,7 @@ export class HttpService {
                 const { accessToken: newToken } = await response.json();
                 this.tokenStore.setTokens(newToken);
                 this._onTokenRefreshed?.(newToken);
+                this.notifyTokenChange();
                 this.logger.debug('Token refreshed');
                 return `Bearer ${newToken}`;
             }
@@ -753,6 +765,7 @@ export class HttpService {
     // Token management
     setTokens(accessToken, refreshToken = '') {
         this.tokenStore.setTokens(accessToken, refreshToken);
+        this.notifyTokenChange();
     }
     set onTokenRefreshed(callback) {
         this._onTokenRefreshed = callback;
@@ -760,6 +773,45 @@ export class HttpService {
     clearTokens() {
         this.tokenStore.clearTokens();
         this.tokenStore.clearCsrfToken();
+        this.notifyTokenChange();
+    }
+    /**
+     * Subscribe to access-token changes on this instance.
+     *
+     * Fires on every mutation of the access token — `setTokens`, `clearTokens`,
+     * a successful silent refresh, and the internal 401-driven clear — passing
+     * the resulting token (or `null` when cleared). Returns an unsubscribe
+     * function; call it on teardown to avoid leaks.
+     *
+     * This is the single hook downstream code (e.g. @oxyhq/services' OxyProvider)
+     * uses to keep an external token sink — such as the shared `oxyClient`
+     * singleton — in lockstep with the active session, regardless of which code
+     * path mutated the token.
+     */
+    addTokenChangeListener(listener) {
+        this._tokenChangeListeners.add(listener);
+        return () => {
+            this._tokenChangeListeners.delete(listener);
+        };
+    }
+    /**
+     * Notify all token-change listeners with the current access token.
+     * Listener exceptions are isolated so one bad subscriber cannot break token
+     * propagation to the others or to the calling auth flow.
+     * @internal
+     */
+    notifyTokenChange() {
+        if (this._tokenChangeListeners.size === 0)
+            return;
+        const accessToken = this.tokenStore.getAccessToken();
+        for (const listener of this._tokenChangeListeners) {
+            try {
+                listener(accessToken);
+            }
+            catch (error) {
+                this.logger.error('Token change listener threw:', error);
+            }
+        }
     }
     getAccessToken() {
         return this.tokenStore.getAccessToken();

package/dist/esm/OxyServices.base.js

@@ -110,6 +110,22 @@ export class OxyServicesBase {
         this._cachedUserId = undefined;
         this._cachedAccessToken = null;
     }
+    /**
+     * Subscribe to access-token changes on this client.
+     *
+     * The listener fires on every access-token mutation — explicit
+     * `setTokens`/`clearTokens`, a successful silent refresh, and the internal
+     * 401-driven clear — receiving the resulting token, or `null` when cleared.
+     * Returns an unsubscribe function.
+     *
+     * Primary use: keeping an external token sink (e.g. the shared `oxyClient`
+     * singleton) in lockstep with whichever `OxyServices` instance actually owns
+     * the session, so imperative consumers reading the singleton always observe
+     * the live token regardless of the code path that changed it.
+     */
+    onTokensChanged(listener) {
+        return this.httpService.addTokenChangeListener(listener);
+    }
     /**
      * Get the current user ID from the access token.
      * Caches the decoded value and invalidates when the token changes.