@oxyhq/core 1.6.5 → 1.7.0

package/dist/cjs/AuthManager.js

@@ -296,11 +296,12 @@ class AuthManager {
      * Sign out and clear all auth data.
      */
     async signOut() {
-        // Clear refresh timer
+        // Clear refresh timer and cancel any in-flight refresh
         if (this.refreshTimer) {
             clearTimeout(this.refreshTimer);
             this.refreshTimer = null;
         }
+        this.refreshPromise = null;
         // Invalidate current session on the server (best-effort)
         try {
             const sessionJson = await this.storage.getItem(STORAGE_KEYS.SESSION);

package/dist/cjs/HttpService.js

@@ -244,8 +244,9 @@ class HttpService {
                                 // Token decode failed, fall through to clear
                             }
                         }
-                        // Refresh failed or no token — clear tokens
+                        // Refresh failed or no token — clear tokens and stale CSRF
                         this.tokenStore.clearTokens();
+                        this.tokenStore.clearCsrfToken();
                     }
                     // On 403 with CSRF error, clear cached token and retry once
                     if (response.status === 403 && !config._isCsrfRetry) {
@@ -503,12 +504,14 @@ class HttpService {
                 const result = await this.tokenRefreshPromise;
                 if (result)
                     return result;
+                // Refresh failed — don't use the expired token (would cause 401 loop)
+                return null;
             }
             return `Bearer ${accessToken}`;
         }
         catch (error) {
             this.logger.error('Error processing token:', error);
-            return `Bearer ${accessToken}`;
+            return null;
         }
     }
     async _refreshTokenFromSession(sessionId) {

package/dist/esm/AuthManager.js

@@ -292,11 +292,12 @@ export class AuthManager {
      * Sign out and clear all auth data.
      */
     async signOut() {
-        // Clear refresh timer
+        // Clear refresh timer and cancel any in-flight refresh
         if (this.refreshTimer) {
             clearTimeout(this.refreshTimer);
             this.refreshTimer = null;
         }
+        this.refreshPromise = null;
         // Invalidate current session on the server (best-effort)
         try {
             const sessionJson = await this.storage.getItem(STORAGE_KEYS.SESSION);

package/dist/esm/HttpService.js

@@ -241,8 +241,9 @@ export class HttpService {
                                 // Token decode failed, fall through to clear
                             }
                         }
-                        // Refresh failed or no token — clear tokens
+                        // Refresh failed or no token — clear tokens and stale CSRF
                         this.tokenStore.clearTokens();
+                        this.tokenStore.clearCsrfToken();
                     }
                     // On 403 with CSRF error, clear cached token and retry once
                     if (response.status === 403 && !config._isCsrfRetry) {
@@ -500,12 +501,14 @@ export class HttpService {
                 const result = await this.tokenRefreshPromise;
                 if (result)
                     return result;
+                // Refresh failed — don't use the expired token (would cause 401 loop)
+                return null;
             }
             return `Bearer ${accessToken}`;
         }
         catch (error) {
             this.logger.error('Error processing token:', error);
-            return `Bearer ${accessToken}`;
+            return null;
         }
     }
     async _refreshTokenFromSession(sessionId) {

package/dist/esm/crypto/keyManager.js

@@ -4,7 +4,8 @@
  * Handles secure generation, storage, and retrieval of cryptographic keys.
  * Private keys are stored securely using expo-secure-store and never leave the device.
  */
-import { ec as EC } from 'elliptic';
+import _cjs_elliptic from 'elliptic';
+const { ec: EC } = _cjs_elliptic;
 import { isWeb, isIOS, isAndroid, isReactNative, isNodeJS } from '../utils/platform.js';
 import { logger } from '../utils/loggerUtils.js';
 import { isDev } from '../shared/utils/debugUtils.js';

package/dist/esm/crypto/polyfill.js

@@ -7,7 +7,8 @@
  * - Browser/Node.js: Uses native crypto
  * - React Native: Falls back to expo-crypto if native crypto unavailable
  */
-import { Buffer } from 'buffer';
+import _cjs_buffer from 'buffer';
+const { Buffer } = _cjs_buffer;
 const getGlobalObject = () => {
     if (typeof globalThis !== 'undefined')
         return globalThis;

package/dist/esm/crypto/signatureService.js

@@ -4,7 +4,8 @@
  * Handles signing and verification of messages using ECDSA secp256k1.
  * Used for authenticating requests and proving identity ownership.
  */
-import { ec as EC } from 'elliptic';
+import _cjs_elliptic from 'elliptic';
+const { ec: EC } = _cjs_elliptic;
 import { KeyManager } from './keyManager.js';
 import { isReactNative, isNodeJS } from '../utils/platform.js';
 // Lazy import for expo-crypto

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "1.6.5",
+  "version": "1.7.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/AuthManager.ts

@@ -361,11 +361,12 @@ export class AuthManager {
    * Sign out and clear all auth data.
    */
   async signOut(): Promise<void> {
-    // Clear refresh timer
+    // Clear refresh timer and cancel any in-flight refresh
     if (this.refreshTimer) {
       clearTimeout(this.refreshTimer);
       this.refreshTimer = null;
     }
+    this.refreshPromise = null;
 
     // Invalidate current session on the server (best-effort)
     try {

package/src/HttpService.ts

@@ -337,8 +337,9 @@ export class HttpService {
                 // Token decode failed, fall through to clear
               }
             }
-            // Refresh failed or no token — clear tokens
+            // Refresh failed or no token — clear tokens and stale CSRF
             this.tokenStore.clearTokens();
+            this.tokenStore.clearCsrfToken();
           }
 
           // On 403 with CSRF error, clear cached token and retry once
@@ -616,12 +617,14 @@ export class HttpService {
         }
         const result = await this.tokenRefreshPromise;
         if (result) return result;
+        // Refresh failed — don't use the expired token (would cause 401 loop)
+        return null;
       }
 
       return `Bearer ${accessToken}`;
     } catch (error) {
       this.logger.error('Error processing token:', error);
-      return `Bearer ${accessToken}`;
+      return null;
     }
   }