@ovok/core 0.4.36 → 0.4.38

package/dist/client/auth/account-storage.d.ts

@@ -1,5 +1,6 @@
 import { IClientStorage } from "@medplum/core";
 export declare const LOGINS_STORAGE_KEY = "logins";
+export declare const ACTIVE_LOGIN_STORAGE_KEY = "activeLogin";
 export declare const EXPIRED_ACCOUNTS_STORAGE_KEY = "ovok.core.expired-accounts";
 export declare const setStoredAccountExpired: (storage: IClientStorage, accountId: string, expired: boolean) => void;
 export declare const removeStoredAccount: (storage: IClientStorage, accountId: string) => void;

package/dist/client/auth/account-storage.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.removeStoredAccount = exports.setStoredAccountExpired = exports.EXPIRED_ACCOUNTS_STORAGE_KEY = exports.LOGINS_STORAGE_KEY = void 0;
+exports.removeStoredAccount = exports.setStoredAccountExpired = exports.EXPIRED_ACCOUNTS_STORAGE_KEY = exports.ACTIVE_LOGIN_STORAGE_KEY = exports.LOGINS_STORAGE_KEY = void 0;
 exports.LOGINS_STORAGE_KEY = "logins";
+exports.ACTIVE_LOGIN_STORAGE_KEY = "activeLogin";
 exports.EXPIRED_ACCOUNTS_STORAGE_KEY = "ovok.core.expired-accounts";
 const setStoredAccountExpired = (storage, accountId, expired) => {
     var _a;

package/dist/{utils → client}/auth/exchange-code.d.ts

@@ -1,6 +1,6 @@
 import type { MedplumRequestOptions } from "@medplum/core";
-import { OvokClient } from "../../client/ovok-client";
 import { AuthResponse } from "../../types";
+import { OvokClient } from "../ovok-client";
 type ExchangeCodeProps = {
     client: OvokClient;
     sessionCode: string;

package/dist/{utils → client}/auth/generate-code-challenge-and-verifier.js

@@ -6,26 +6,16 @@ function generateRandomString(length) {
     const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
     let result = "";
     const randomValues = new Uint8Array(length);
-    if (typeof crypto !== "undefined" && crypto.getRandomValues) {
-        crypto.getRandomValues(randomValues);
-    }
-    else {
-        for (let i = 0; i < length; i++) {
-            randomValues[i] = Math.floor(Math.random() * 256);
-        }
+    // A predictable verifier defeats PKCE, so there is no Math.random fallback.
+    if (typeof crypto === "undefined" || typeof crypto.getRandomValues !== "function") {
+        throw new Error("PKCE needs crypto.getRandomValues. On React Native, install a polyfill such as react-native-get-random-values (or use @ovok/native, which provides one).");
     }
+    crypto.getRandomValues(randomValues);
     for (let i = 0; i < length; i++) {
         result += charset[randomValues[i] % charset.length];
     }
     return result;
 }
-function hexToUint8Array(hex) {
-    const bytes = new Uint8Array(hex.length / 2);
-    for (let i = 0; i < hex.length; i += 2) {
-        bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);
-    }
-    return bytes;
-}
 function base64URLEncode(data) {
     let binary = "";
     for (let i = 0; i < data.length; i++) {
@@ -35,9 +25,7 @@ function base64URLEncode(data) {
 }
 function generateCodeChallengeAndVerifier() {
     const codeVerifier = generateRandomString(128);
-    const hexHash = sha256_1.sha256.hex(codeVerifier);
-    const hashBytes = hexToUint8Array(hexHash);
-    const codeChallenge = base64URLEncode(hashBytes);
+    const codeChallenge = base64URLEncode((0, sha256_1.sha256Bytes)(codeVerifier));
     return {
         codeVerifier,
         codeChallenge,

package/dist/{utils → client}/auth/handle-tenant-code.d.ts

@@ -1,4 +1,4 @@
-import { StartLoginResponse } from "../../client/auth/types/StartLoginResponse";
+import { StartLoginResponse } from "./types/StartLoginResponse";
 export declare const handleTenantCode: ({ profiles, tenantCode, type, }: {
     profiles: StartLoginResponse["profiles"];
     tenantCode?: string;

package/dist/{utils → client}/auth/handle-tenant-code.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleTenantCode = void 0;
-const LoginError_1 = require("../../client/auth/types/LoginError");
+const LoginError_1 = require("./types/LoginError");
 const handleTenantCode = ({ profiles, tenantCode, type, }) => {
     if (type !== "Practitioner") {
         if (!tenantCode) {

package/dist/client/auth/methods/appleLogin.js

@@ -1,11 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.appleLogin = appleLogin;
+const socialLogin_1 = require("./socialLogin");
 async function appleLogin(body, requestOptions) {
-    const { internalId, ...rest } = body;
-    const queryParams = new URLSearchParams({
-        client: `ClientApplication/${this.socialLoginClientId}`,
-        internalId,
-    });
-    return this.post(`auth/external/apple?${queryParams.toString()}`, rest, "application/json", requestOptions);
+    return socialLogin_1.socialLogin.call(this, "apple", body, requestOptions);
 }

package/dist/client/auth/methods/changePassword.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.changePassword = changePassword;
+const request_options_1 = require("../../request-options");
 async function changePassword(body, requestOptions) {
     const { oldPassword, newPassword } = body;
-    return this.patch("v2/auth/change-password", { oldPassword, newPassword }, ...(requestOptions === undefined ? [] : [requestOptions]));
+    return this.patch("v2/auth/change-password", { oldPassword, newPassword }, ...(0, request_options_1.optionalArg)(requestOptions));
 }

package/dist/client/auth/methods/getSessions.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getSessions = getSessions;
+const request_options_1 = require("../../request-options");
 /** Lists the server-side sessions for the current account. */
 async function getSessions(requestOptions) {
-    return this.get("auth/session", ...(requestOptions === undefined ? [] : [requestOptions]));
+    return this.get("auth/session", ...(0, request_options_1.optionalArg)(requestOptions));
 }

package/dist/client/auth/methods/googleLogin.js

@@ -1,11 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.googleLogin = googleLogin;
+const socialLogin_1 = require("./socialLogin");
 async function googleLogin(body, requestOptions) {
-    const { internalId, ...rest } = body;
-    const queryParams = new URLSearchParams({
-        client: `ClientApplication/${this.socialLoginClientId}`,
-        internalId,
-    });
-    return this.post(`auth/external/google?${queryParams.toString()}`, rest, "application/json", requestOptions);
+    return socialLogin_1.socialLogin.call(this, "google", body, requestOptions);
 }

package/dist/client/auth/methods/login.js

@@ -2,11 +2,20 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.startTenantLogin = startTenantLogin;
 exports.login = login;
-const exchange_code_1 = require("../../../utils/auth/exchange-code");
-const generate_code_challenge_and_verifier_1 = require("../../../utils/auth/generate-code-challenge-and-verifier");
-const handle_tenant_code_1 = require("../../../utils/auth/handle-tenant-code");
-const start_login_1 = require("../../../utils/auth/start-login");
+const request_options_1 = require("../../request-options");
+const exchange_code_1 = require("../exchange-code");
+const generate_code_challenge_and_verifier_1 = require("../generate-code-challenge-and-verifier");
+const handle_tenant_code_1 = require("../handle-tenant-code");
+const start_login_1 = require("../start-login");
 const LoginError_1 = require("../types/LoginError");
+/** The MFA step: verifying the code yields a session code that `exchange` turns into a session. */
+const mfaStep = (client, type, loginId, exchange, requestOptions) => ({
+    nextStep: "mfa",
+    verify: async (code) => {
+        const { sessionCode } = await client.post(`auth/tenant/${type}/login/mfa`, { loginId, mfaToken: code }, "application/json", requestOptions);
+        return exchange(sessionCode);
+    },
+});
 /** Starts practitioner sign-in and lets the app choose among returned projects. */
 async function startTenantLogin(body, requestOptions) {
     const { codeVerifier, codeChallenge } = (0, generate_code_challenge_and_verifier_1.generateCodeChallengeAndVerifier)();
@@ -23,36 +32,23 @@ async function startTenantLogin(body, requestOptions) {
             if (!tenantCode) {
                 throw new LoginError_1.LoginError("tenant_code_required", "Choose a project before completing sign-in.", profiles);
             }
-            if (startResponse.nextStep === "mfa") {
-                return {
-                    nextStep: "mfa",
-                    verify: async (code) => {
-                        const mfaResponse = await this.post("auth/tenant/Practitioner/login/mfa", { loginId: startResponse.loginId, mfaToken: code }, "application/json", requestOptions);
-                        return (0, exchange_code_1.exchangeCode)({
-                            client: this,
-                            type: "Practitioner",
-                            sessionCode: mfaResponse.sessionCode,
-                            codeVerifier,
-                            tenantCode,
-                            requestOptions,
-                        });
-                    },
-                };
-            }
-            return (0, exchange_code_1.exchangeCode)({
+            const exchange = (sessionCode) => (0, exchange_code_1.exchangeCode)({
                 client: this,
                 type: "Practitioner",
-                sessionCode: startResponse.sessionCode,
+                sessionCode,
                 codeVerifier,
                 tenantCode,
                 requestOptions,
             });
+            return startResponse.nextStep === "mfa"
+                ? mfaStep(this, "Practitioner", startResponse.loginId, exchange, requestOptions)
+                : exchange(startResponse.sessionCode);
         },
     };
 }
 async function login(body, requestOptions) {
     if (body.type === "Practitioner") {
-        const start = await startTenantLogin.call(this, body, ...(requestOptions === undefined ? [] : [requestOptions]));
+        const start = await startTenantLogin.call(this, body, ...(0, request_options_1.optionalArg)(requestOptions));
         return start.exchange(body.tenantCode);
     }
     const { codeVerifier, codeChallenge } = (0, generate_code_challenge_and_verifier_1.generateCodeChallengeAndVerifier)();
@@ -62,30 +58,16 @@ async function login(body, requestOptions) {
         codeChallenge,
         requestOptions,
     });
-    if (startResponse.nextStep === "mfa") {
-        return {
-            nextStep: "mfa",
-            verify: async (code) => {
-                const mfaResponse = await this.post(`auth/tenant/${body.type}/login/mfa`, {
-                    loginId: startResponse.loginId,
-                    mfaToken: code,
-                }, "application/json", requestOptions);
-                return (0, exchange_code_1.exchangeCode)({
-                    client: this,
-                    type: "Patient",
-                    sessionCode: mfaResponse.sessionCode,
-                    codeVerifier,
-                    requestOptions,
-                });
-            },
-        };
-    }
-    (0, handle_tenant_code_1.handleTenantCode)({ profiles: startResponse.profiles, tenantCode: body.tenantCode, type: "Patient" });
-    return (0, exchange_code_1.exchangeCode)({
+    const exchange = (sessionCode) => (0, exchange_code_1.exchangeCode)({
         client: this,
         type: "Patient",
-        sessionCode: startResponse.sessionCode,
+        sessionCode,
         codeVerifier,
         requestOptions,
     });
+    if (startResponse.nextStep === "mfa") {
+        return mfaStep(this, body.type, startResponse.loginId, exchange, requestOptions);
+    }
+    (0, handle_tenant_code_1.handleTenantCode)({ profiles: startResponse.profiles, tenantCode: body.tenantCode, type: "Patient" });
+    return exchange(startResponse.sessionCode);
 }

package/dist/client/auth/methods/logout.js

@@ -1,13 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.logout = logout;
+const request_options_1 = require("../../request-options");
 const account_storage_1 = require("../account-storage");
 /** Revokes the current server session and always removes its local account. */
 async function logout(requestOptions) {
     var _a, _b;
     const accountId = (_b = (_a = this.getActiveLogin()) === null || _a === void 0 ? void 0 : _a.profile) === null || _b === void 0 ? void 0 : _b.reference;
     try {
-        await this.delete("auth/session/current", ...(requestOptions === undefined ? [] : [requestOptions]));
+        await this.delete("auth/session/current", ...(0, request_options_1.optionalArg)(requestOptions));
     }
     finally {
         this.clearActiveLogin();

package/dist/client/auth/methods/requestDeleteUser.js

@@ -9,8 +9,9 @@ exports.requestDeleteUser = requestDeleteUser;
  * @returns {Promise<RequestDeleteUserResponse>} Response containing scheduled deletion status and user information
  */
 async function requestDeleteUser(body, requestOptions) {
-    return this.delete("auth/delete", { ...{
-            body: JSON.stringify(body),
-            headers: { "Content-Type": "application/json" },
-        }, ...requestOptions });
+    return this.delete("auth/delete", {
+        body: JSON.stringify(body),
+        headers: { "Content-Type": "application/json" },
+        ...requestOptions,
+    });
 }

package/dist/client/auth/methods/revokeSessions.js

@@ -1,9 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.revokeSessions = revokeSessions;
+const request_options_1 = require("../../request-options");
 /** Revokes the selected server-side session or session group. */
 async function revokeSessions(option, requestOptions) {
-    await this.delete(`auth/session/${encodeURIComponent(option)}`, ...(requestOptions === undefined ? [] : [requestOptions]));
+    await this.delete(`auth/session/${encodeURIComponent(option)}`, ...(0, request_options_1.optionalArg)(requestOptions));
     if (option === "current") {
         this.clearActiveLogin();
     }

package/dist/client/auth/methods/socialLogin.d.ts

@@ -0,0 +1,7 @@
+import type { MedplumRequestOptions } from "@medplum/core";
+import { OvokClient } from "../../ovok-client";
+import { AppleLoginBody } from "../types/AppleLoginBody";
+import { AuthResponse } from "../types/AuthResponse";
+import { GoogleLoginBody } from "../types/GoogleLoginBody";
+/** Signs in with a provider token through the social-login client. Not bound onto OvokClient itself. */
+export declare function socialLogin(this: OvokClient, provider: "apple" | "google", { internalId, ...rest }: AppleLoginBody | GoogleLoginBody, requestOptions?: MedplumRequestOptions): Promise<AuthResponse>;

package/dist/client/auth/methods/socialLogin.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.socialLogin = socialLogin;
+/** Signs in with a provider token through the social-login client. Not bound onto OvokClient itself. */
+function socialLogin(provider, { internalId, ...rest }, requestOptions) {
+    const queryParams = new URLSearchParams({
+        client: `ClientApplication/${this.socialLoginClientId}`,
+        internalId,
+    });
+    return this.post(`auth/external/${provider}?${queryParams.toString()}`, rest, "application/json", requestOptions);
+}

package/dist/client/auth/session-fetch.d.ts

@@ -0,0 +1,35 @@
+import { IClientStorage } from "@medplum/core";
+import type { OvokClientOptions } from "../ovok-client";
+export type OvokUnauthenticatedReason = {
+    type: "refresh-rejected";
+    status: 400 | 401 | 403;
+} | {
+    type: "refresh-unavailable";
+    status?: number;
+} | {
+    type: "authentication-rejected";
+    status: number;
+} | {
+    type: "request-unauthorized";
+    status: 401;
+};
+type SessionFetchContext = {
+    config: OvokClientOptions;
+    storage: IClientStorage;
+    fetchImplementation: (url: string, options?: RequestInit) => Promise<Response>;
+    normalizedBaseUrl: string;
+    tokenUrl: string;
+};
+/**
+ * The client's `fetch`: request timeouts, token-refresh retries within the access token's
+ * lifetime, and tracking why a session ended, which `onUnauthenticated` reports.
+ */
+export declare function createSessionFetch({ config, storage, fetchImplementation, normalizedBaseUrl, tokenUrl }: SessionFetchContext): {
+    fetch: (url: string, options: RequestInit | undefined) => Promise<Response>;
+    onUnauthenticated: () => void;
+    refreshState: {
+        unavailable: boolean;
+    };
+    setClearActiveLogin: (clear: () => void) => void;
+};
+export {};

package/dist/client/auth/session-fetch.js

@@ -0,0 +1,206 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSessionFetch = createSessionFetch;
+/* eslint-disable max-lines -- one refresh state machine; splitting it would scatter its shared session state. */
+const core_1 = require("@medplum/core");
+const account_storage_1 = require("./account-storage");
+const session_http_1 = require("./session-http");
+/**
+ * The client's `fetch`: request timeouts, token-refresh retries within the access token's
+ * lifetime, and tracking why a session ended, which `onUnauthenticated` reports.
+ */
+function createSessionFetch({ config, storage, fetchImplementation, normalizedBaseUrl, tokenUrl }) {
+    let unauthenticatedReason;
+    let clearActiveLogin = () => undefined;
+    let terminalRefreshToken;
+    let terminalRefreshError;
+    const refreshState = { unavailable: false };
+    const isTokenRefresh = (url, options) => new URL(url, normalizedBaseUrl).href === tokenUrl &&
+        (options === null || options === void 0 ? void 0 : options.method) === "POST" &&
+        typeof options.body === "string" &&
+        new URLSearchParams(options.body).get("grant_type") === "refresh_token";
+    const activeAccountId = () => { var _a, _b; return (_b = (_a = storage.getObject(account_storage_1.ACTIVE_LOGIN_STORAGE_KEY)) === null || _a === void 0 ? void 0 : _a.profile) === null || _b === void 0 ? void 0 : _b.reference; };
+    const markActiveAccountExpired = () => {
+        const accountId = activeAccountId();
+        if (accountId) {
+            (0, account_storage_1.setStoredAccountExpired)(storage, accountId, true);
+        }
+    };
+    const fetchOnce = async (url, options) => {
+        const response = await (0, session_http_1.fetchWithTimeout)(fetchImplementation, url, options, config.requestTimeoutMs);
+        const requestUrl = new URL(url, normalizedBaseUrl);
+        if (isTokenRefresh(url, options)) {
+            if (response.status === 400) {
+                let invalidGrant = false;
+                try {
+                    invalidGrant = (await response.clone().json()).error === "invalid_grant";
+                }
+                catch (_a) {
+                    // Do not sign out unless the response confirms that the refresh token was revoked.
+                }
+                if (!invalidGrant) {
+                    throw (0, session_http_1.refreshResponseError)(response);
+                }
+            }
+            if ([400, 401, 403].includes(response.status)) {
+                unauthenticatedReason = {
+                    type: "refresh-rejected",
+                    status: response.status,
+                };
+                markActiveAccountExpired();
+            }
+            else if (response.ok) {
+                const accountId = activeAccountId();
+                if (accountId) {
+                    (0, account_storage_1.setStoredAccountExpired)(storage, accountId, false);
+                }
+                unauthenticatedReason = undefined;
+            }
+        }
+        else if (requestUrl.href === tokenUrl && !response.ok) {
+            unauthenticatedReason = {
+                type: "authentication-rejected",
+                status: response.status,
+            };
+        }
+        else if (response.status === 401) {
+            unauthenticatedReason = { type: "request-unauthorized", status: 401 };
+        }
+        return isTokenRefresh(url, options)
+            ? response
+            : (0, session_http_1.withHttpErrorMetadata)(response);
+    };
+    const fetchWithRefreshRetry = async (url, options) => {
+        var _a, _b, _c, _d;
+        const requestUrl = new URL(url, normalizedBaseUrl);
+        if (!isTokenRefresh(url, options)) {
+            const response = await fetchOnce(url, options);
+            const sessionEnded = requestUrl.pathname.endsWith("/auth/session/current") && response.status === 401;
+            if (sessionEnded) {
+                markActiveAccountExpired();
+            }
+            return response;
+        }
+        const login = storage.getObject(account_storage_1.ACTIVE_LOGIN_STORAGE_KEY);
+        if (terminalRefreshError) {
+            if ((login === null || login === void 0 ? void 0 : login.accessToken) && login.accessToken !== terminalRefreshToken) {
+                terminalRefreshToken = undefined;
+                terminalRefreshError = undefined;
+            }
+            else {
+                throw terminalRefreshError;
+            }
+        }
+        const expiresAt = (login === null || login === void 0 ? void 0 : login.accessToken) ? (0, core_1.tryGetJwtExpiration)(login.accessToken) : undefined;
+        const signal = options === null || options === void 0 ? void 0 : options.signal;
+        if (expiresAt !== undefined && options) {
+            const tokenRequestOptions = options;
+            tokenRequestOptions.maxRetries = 0;
+            tokenRequestOptions.maxRetryTime = 0;
+        }
+        if (expiresAt === undefined) {
+            const response = await fetchOnce(url, options);
+            if ((0, session_http_1.isTemporaryRefreshFailure)(response.status)) {
+                void ((_a = response.body) === null || _a === void 0 ? void 0 : _a.cancel().catch(() => undefined));
+                if (config.keepSessionOnRefreshUnavailable) {
+                    refreshState.unavailable = true;
+                }
+                throw (0, session_http_1.refreshUnavailableError)(response);
+            }
+            return response;
+        }
+        let attempt = 0;
+        let firstAttempt = true;
+        let lastResponse;
+        let lastNetworkError;
+        while (firstAttempt || Date.now() < expiresAt) {
+            firstAttempt = false;
+            try {
+                lastResponse = await fetchOnce(url, options);
+            }
+            catch (error) {
+                if ((signal === null || signal === void 0 ? void 0 : signal.aborted) || !(0, session_http_1.isNetworkError)(error)) {
+                    throw error;
+                }
+                if (config.keepSessionOnRefreshUnavailable) {
+                    refreshState.unavailable = true;
+                    lastNetworkError = error;
+                    break;
+                }
+                if (Date.now() >= expiresAt) {
+                    lastNetworkError = error;
+                    break;
+                }
+                lastNetworkError = error;
+                const remainingMs = expiresAt - Date.now();
+                const backoffMs = (0, session_http_1.refreshBackoffMs)(attempt);
+                await (0, session_http_1.waitForRetry)(Math.min(backoffMs, remainingMs), signal);
+                attempt += 1;
+                continue;
+            }
+            if (!(0, session_http_1.isTemporaryRefreshFailure)(lastResponse.status)) {
+                return lastResponse;
+            }
+            if (config.keepSessionOnRefreshUnavailable) {
+                refreshState.unavailable = true;
+                break;
+            }
+            const remainingMs = expiresAt - Date.now();
+            if (remainingMs <= 0) {
+                break;
+            }
+            const backoffMs = (0, session_http_1.refreshBackoffMs)(attempt);
+            const waitMs = Math.min(Math.max((_b = (0, session_http_1.retryAfterMs)(lastResponse)) !== null && _b !== void 0 ? _b : 0, backoffMs), remainingMs);
+            if (waitMs >= remainingMs) {
+                await (0, session_http_1.waitForRetry)(remainingMs, signal);
+                break;
+            }
+            void ((_c = lastResponse.body) === null || _c === void 0 ? void 0 : _c.cancel().catch(() => undefined));
+            await (0, session_http_1.waitForRetry)(waitMs, signal);
+            attempt += 1;
+        }
+        const status = lastResponse === null || lastResponse === void 0 ? void 0 : lastResponse.status;
+        const reason = {
+            type: "refresh-unavailable",
+            ...(status === undefined ? {} : { status }),
+        };
+        if (config.keepSessionOnRefreshUnavailable) {
+            refreshState.unavailable = true;
+            if (lastResponse) {
+                return lastResponse;
+            }
+            throw lastNetworkError !== null && lastNetworkError !== void 0 ? lastNetworkError : (0, session_http_1.refreshUnavailableError)(undefined);
+        }
+        unauthenticatedReason = reason;
+        markActiveAccountExpired();
+        if (lastResponse) {
+            return lastResponse;
+        }
+        terminalRefreshToken = login === null || login === void 0 ? void 0 : login.accessToken;
+        terminalRefreshError = lastNetworkError !== null && lastNetworkError !== void 0 ? lastNetworkError : (0, session_http_1.refreshUnavailableError)(undefined);
+        clearActiveLogin();
+        (_d = config.onUnauthenticated) === null || _d === void 0 ? void 0 : _d.call(config, reason);
+        unauthenticatedReason = undefined;
+        throw terminalRefreshError;
+    };
+    const onUnauthenticated = () => {
+        var _a;
+        if (refreshState.unavailable) {
+            return;
+        }
+        const reason = unauthenticatedReason !== null && unauthenticatedReason !== void 0 ? unauthenticatedReason : {
+            type: "request-unauthorized",
+            status: 401,
+        };
+        unauthenticatedReason = undefined;
+        (_a = config.onUnauthenticated) === null || _a === void 0 ? void 0 : _a.call(config, reason);
+    };
+    return {
+        fetch: fetchWithRefreshRetry,
+        onUnauthenticated,
+        refreshState,
+        setClearActiveLogin: (clear) => {
+            clearActiveLogin = clear;
+        },
+    };
+}

package/dist/client/auth/session-http.d.ts

@@ -0,0 +1,11 @@
+export declare const retryAfterMs: (response: Response) => number | undefined;
+export declare const withHttpErrorMetadata: (response: Response) => Promise<Response>;
+export declare const waitForRetry: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
+export declare const isTemporaryRefreshFailure: (status: number) => boolean;
+export declare const refreshUnavailableError: (response?: Response) => Error;
+export declare const refreshResponseError: (response: Response) => Error;
+export declare const isNetworkError: (error: unknown) => boolean;
+/** Fetches with an upper time bound, still honouring the caller's own abort signal. */
+export declare const fetchWithTimeout: (fetchImplementation: (url: string, options?: RequestInit) => Promise<Response>, url: string, options: RequestInit | undefined, requestTimeoutMs: number | undefined) => Promise<Response>;
+/** Exponential refresh backoff: 500 ms doubling per attempt, capped at 30 s. */
+export declare const refreshBackoffMs: (attempt: number) => number;