@oxyhq/core 3.16.1 → 3.17.1

package/dist/cjs/HttpService.js

@@ -369,7 +369,14 @@ class HttpService {
                     if (response.status === 401 && !config._isAuthRetry) {
                         const refreshed = await this.refreshAccessToken('response-401');
                         if (refreshed) {
-                            return this.request({ ...config, _isAuthRetry: true, retry: false });
+                            // `deduplicate: false` is REQUIRED on the retry (mirrors the 403
+                            // CSRF retry below). This re-issue runs while the ORIGINAL request
+                            // is still in-flight under its dedupe key; the refreshed token is
+                            // for the SAME user, so the identity-scoped key is UNCHANGED — a
+                            // deduplicated retry would resolve to the still-pending original
+                            // and await itself (deadlock). Opting the retry out of dedupe makes
+                            // it a fresh request.
+                            return this.request({ ...config, _isAuthRetry: true, retry: false, deduplicate: false });
                         }
                         // Refresh failed or no token — clear tokens and stale CSRF
                         this.tokenStore.clearTokens();

package/dist/cjs/OxyServices.base.js

@@ -253,6 +253,31 @@ class OxyServicesBase {
     getAccessToken() {
         return this.httpService.getAccessToken();
     }
+    /**
+     * Decode the current access token and return its `exp` claim in SECONDS since
+     * the Unix epoch (the raw JWT `exp` unit), or `null` when there is no token,
+     * the token is opaque/undecodable, or it carries no numeric `exp`.
+     *
+     * Exposed so `@oxyhq/services` can schedule a PROACTIVE in-session refresh a
+     * fixed lead before expiry without re-importing a JWT decoder (and without
+     * duplicating the `jwt-decode` dependency in the RN bundle). HttpService keeps
+     * the per-request preflight refresh; this powers the idle/background timer.
+     */
+    getAccessTokenExpiry() {
+        const token = this.httpService.getAccessToken();
+        if (!token) {
+            return null;
+        }
+        try {
+            const decoded = (0, jwt_decode_1.jwtDecode)(token);
+            return typeof decoded.exp === 'number' ? decoded.exp : null;
+        }
+        catch {
+            // A malformed / non-JWT token has no usable expiry — fall back to the
+            // reactive 401 refresh path instead of a scheduled one.
+            return null;
+        }
+    }
     /**
      * Set the acting-as identity for managed accounts.
      *

package/dist/cjs/mixins/OxyServices.links.js

@@ -38,11 +38,15 @@ function OxyServicesLinksMixin(Base) {
          * Resolve multiple link previews via `POST /links/previews` (body `{ urls }`).
          *
          * Inputs are de-duplicated and split into chunks of {@link LINK_PREVIEWS_CHUNK_SIZE}
-         * (the server-side cap). Chunks run concurrently and their `data` maps are
+         * (the server-side cap). Chunks run concurrently and their result maps are
          * merged into a single result keyed by the REQUESTED url (the exact string
          * passed in `urls`) — matching the batch contract — so a caller can always
          * look its own input back up.
          *
+         * `makeRequest` unwraps the API's top-level `{ data }` envelope (same as
+         * `getUsersByIds`'s `makeServiceRequest<User[]>`), so each chunk response is
+         * already the `Record<url, LinkPreview>` map — merge it directly.
+         *
          * An empty / whitespace-only input resolves immediately with `{}` and
          * performs no network call. A failure in any chunk surfaces (via
          * `handleError`) rather than being swallowed.
@@ -58,7 +62,7 @@ function OxyServicesLinksMixin(Base) {
             }
             try {
                 const responses = await Promise.all(chunks.map((chunk) => this.makeRequest('POST', '/links/previews', { urls: chunk }, { cache: false })));
-                return responses.reduce((merged, response) => Object.assign(merged, response?.data ?? {}), {});
+                return responses.reduce((merged, response) => Object.assign(merged, response ?? {}), {});
             }
             catch (error) {
                 throw this.handleError(error);