@oxyhq/core 3.16.0 → 3.17.0

package/dist/esm/HttpService.js

@@ -366,7 +366,14 @@ export class HttpService {
                     if (response.status === 401 && !config._isAuthRetry) {
                         const refreshed = await this.refreshAccessToken('response-401');
                         if (refreshed) {
-                            return this.request({ ...config, _isAuthRetry: true, retry: false });
+                            // `deduplicate: false` is REQUIRED on the retry (mirrors the 403
+                            // CSRF retry below). This re-issue runs while the ORIGINAL request
+                            // is still in-flight under its dedupe key; the refreshed token is
+                            // for the SAME user, so the identity-scoped key is UNCHANGED — a
+                            // deduplicated retry would resolve to the still-pending original
+                            // and await itself (deadlock). Opting the retry out of dedupe makes
+                            // it a fresh request.
+                            return this.request({ ...config, _isAuthRetry: true, retry: false, deduplicate: false });
                         }
                         // Refresh failed or no token — clear tokens and stale CSRF
                         this.tokenStore.clearTokens();

package/dist/esm/OxyServices.base.js

@@ -250,6 +250,31 @@ export class OxyServicesBase {
     getAccessToken() {
         return this.httpService.getAccessToken();
     }
+    /**
+     * Decode the current access token and return its `exp` claim in SECONDS since
+     * the Unix epoch (the raw JWT `exp` unit), or `null` when there is no token,
+     * the token is opaque/undecodable, or it carries no numeric `exp`.
+     *
+     * Exposed so `@oxyhq/services` can schedule a PROACTIVE in-session refresh a
+     * fixed lead before expiry without re-importing a JWT decoder (and without
+     * duplicating the `jwt-decode` dependency in the RN bundle). HttpService keeps
+     * the per-request preflight refresh; this powers the idle/background timer.
+     */
+    getAccessTokenExpiry() {
+        const token = this.httpService.getAccessToken();
+        if (!token) {
+            return null;
+        }
+        try {
+            const decoded = jwtDecode(token);
+            return typeof decoded.exp === 'number' ? decoded.exp : null;
+        }
+        catch {
+            // A malformed / non-JWT token has no usable expiry — fall back to the
+            // reactive 401 refresh path instead of a scheduled one.
+            return null;
+        }
+    }
     /**
      * Set the acting-as identity for managed accounts.
      *