@timardex/cluemart-shared 1.7.0 → 1.7.2

package/dist/apollo/index.cjs

@@ -0,0 +1,1383 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/apollo/index.ts
+var apollo_exports = {};
+__export(apollo_exports, {
+  MIN_BACKGROUND_MS: () => MIN_BACKGROUND_MS,
+  NON_RETRYABLE_REFRESH_AUTH_CODES: () => NON_RETRYABLE_REFRESH_AUTH_CODES,
+  REFETCH_DELAY_MS: () => REFETCH_DELAY_MS,
+  createApolloErrorLoggingLink: () => createApolloErrorLoggingLink,
+  createApolloManager: () => createApolloManager,
+  createAuthLink: () => createAuthLink,
+  createErrorLink: () => createErrorLink,
+  createNetworkLog: () => createNetworkLog,
+  createNetworkRecoveryLink: () => createNetworkRecoveryLink,
+  createRecoveryCore: () => createRecoveryCore,
+  createRefreshAccessToken: () => createRefreshAccessToken,
+  createWsManager: () => createWsManager,
+  decideRefreshNextStep: () => decideRefreshNextStep,
+  getRefreshErrorCode: () => getRefreshErrorCode,
+  getStatusCode: () => getStatusCode,
+  isExpectedRefreshAuthFailure: () => isExpectedRefreshAuthFailure,
+  isRefreshAuthFailureMessage: () => isRefreshAuthFailureMessage,
+  isUnauthenticatedError: () => isUnauthenticatedError,
+  isUnauthenticatedGraphQLError: () => isUnauthenticatedGraphQLError,
+  readErrorResponseFields: () => readErrorResponseFields,
+  refreshGraphqlErrorsWarrantRetry: () => refreshGraphqlErrorsWarrantRetry,
+  safeJsonStringify: () => safeJsonStringify,
+  toStructuredError: () => toStructuredError
+});
+module.exports = __toCommonJS(apollo_exports);
+
+// src/apollo/createApolloManager.ts
+function createApolloManager(adapters = {}) {
+  const { onAuthRecoveryEvent } = adapters;
+  let resetClientFn = null;
+  let pendingReset = false;
+  return {
+    resetClient() {
+      if (!resetClientFn) {
+        pendingReset = true;
+        return;
+      }
+      pendingReset = false;
+      onAuthRecoveryEvent?.({ type: "reset_client" });
+      resetClientFn();
+    },
+    setResetClient(fn) {
+      resetClientFn = fn;
+      if (fn && pendingReset) {
+        pendingReset = false;
+        onAuthRecoveryEvent?.({ type: "reset_client" });
+        fn();
+      }
+    }
+  };
+}
+
+// src/apollo/createAuthLink.ts
+var import_client = require("@apollo/client");
+function maskedTokenInfo(token) {
+  const len = token.length;
+  const start = token.slice(0, 4);
+  const end = token.slice(-4);
+  return { end, len, start };
+}
+function createAuthLink(adapters) {
+  const { awaitReady, getAccessToken, onError: onError3, onDebug } = adapters;
+  return new import_client.ApolloLink((operation, forward) => {
+    return new import_client.Observable((observer) => {
+      let innerSub = null;
+      let closed = false;
+      const teardown = () => {
+        closed = true;
+        innerSub?.unsubscribe();
+        innerSub = null;
+      };
+      void (async () => {
+        if (awaitReady) {
+          try {
+            await awaitReady();
+          } catch (err) {
+            onError3?.(err, { action: "awaitReady" });
+          }
+        }
+        if (closed) return;
+        const token = await getAccessToken();
+        if (token) {
+          operation.setContext(({ headers = {} }) => {
+            const hasAuthHeader = Object.hasOwn(headers, "Authorization") || Object.hasOwn(headers, "authorization");
+            if (hasAuthHeader) {
+              onDebug?.("Preserving existing Authorization header", {
+                operationName: operation.operationName
+              });
+              return { headers };
+            }
+            return {
+              headers: {
+                ...headers,
+                Authorization: `Bearer ${token}`
+              }
+            };
+          });
+          onDebug?.("Attached Authorization header", {
+            operationName: operation.operationName,
+            token: maskedTokenInfo(token)
+          });
+        } else {
+          onDebug?.("Proceeding without Authorization header", {
+            operationName: operation.operationName
+          });
+        }
+        if (closed) return;
+        try {
+          innerSub = forward(operation).subscribe({
+            complete: () => {
+              if (!closed) observer.complete();
+            },
+            error: (error) => {
+              if (!closed) observer.error(error);
+            },
+            next: (result) => {
+              if (!closed) observer.next(result);
+            }
+          });
+        } catch (err) {
+          if (closed) return;
+          onError3?.(err, { action: "forward" });
+          observer.error(err);
+        }
+      })();
+      return teardown;
+    });
+  });
+}
+
+// src/apollo/createErrorLink.ts
+var import_client2 = require("@apollo/client");
+var import_error = require("@apollo/client/link/error");
+
+// src/apollo/readErrorResponseFields.ts
+function readErrorResponseFields(errorResponse) {
+  const record = errorResponse;
+  return {
+    graphQLErrors: record["graphQLErrors"],
+    networkError: record["networkError"],
+    response: record["response"]
+  };
+}
+
+// src/apollo/unauthHelpers.ts
+function getStatusCode(networkError) {
+  const anyErr = networkError;
+  const status = anyErr?.["statusCode"] ?? anyErr?.["status"] ?? anyErr?.["response"]?.status;
+  return typeof status === "number" ? status : null;
+}
+function isUnauthenticatedGraphQLError(graphQLErrors) {
+  return Boolean(
+    graphQLErrors?.some(
+      (err) => err.extensions?.code === "UNAUTHENTICATED" || err.message?.includes("You must be logged in.")
+    )
+  );
+}
+function isUnauthenticatedError(input) {
+  const statusCode = input.networkError ? getStatusCode(input.networkError) : null;
+  return isUnauthenticatedGraphQLError(input.graphQLErrors) || statusCode === 401 || statusCode === 403;
+}
+var NON_RETRYABLE_REFRESH_AUTH_CODES = /* @__PURE__ */ new Set(["FORBIDDEN", "TOKEN_EXPIRED", "UNAUTHENTICATED"]);
+var REFRESH_AUTH_FAILURE_MESSAGE_PATTERNS = [
+  /invalid.*refresh token/i,
+  /jwt expired/i,
+  /jwt malformed/i,
+  /invalid signature/i
+];
+function isRefreshAuthFailureMessage(message) {
+  if (!message) return false;
+  return REFRESH_AUTH_FAILURE_MESSAGE_PATTERNS.some(
+    (pattern) => pattern.test(message)
+  );
+}
+function getRefreshErrorCode(errors) {
+  for (const err of errors) {
+    const code = err.extensions?.code;
+    if (typeof code === "string") return code;
+  }
+  return void 0;
+}
+function isExpectedRefreshAuthFailure(errors, errorCode) {
+  if (errorCode != null && NON_RETRYABLE_REFRESH_AUTH_CODES.has(errorCode)) {
+    return true;
+  }
+  return errors.some((err) => isRefreshAuthFailureMessage(err.message));
+}
+function refreshGraphqlErrorsWarrantRetry(errors) {
+  if (errors.some(
+    (e) => e.extensions != null && e.extensions.retryable === true
+  )) {
+    return true;
+  }
+  for (const err of errors) {
+    if (isRefreshAuthFailureMessage(err.message)) {
+      return false;
+    }
+    const code = err.extensions?.code;
+    if (typeof code === "string" && NON_RETRYABLE_REFRESH_AUTH_CODES.has(code)) {
+      return false;
+    }
+  }
+  return true;
+}
+function decideRefreshNextStep(result) {
+  if (!result.token && !result.retryable) {
+    if (result.hadRefreshToken === false) return { kind: "complete" };
+    return { kind: "logout" };
+  }
+  if (!result.token) return { kind: "complete" };
+  return { kind: "retry", token: result.token };
+}
+
+// src/apollo/createErrorLink.ts
+function handleRetryableRefreshFailure(observer) {
+  if (!observer.isClosed()) observer.complete();
+}
+function retryOperationWithToken(operation, forward, token, observer, setInnerSubscriber) {
+  operation.setContext(({ headers = {} }) => ({
+    __authRetryAttempted: true,
+    headers: {
+      ...headers,
+      Authorization: `Bearer ${token}`
+    }
+  }));
+  if (observer.isClosed()) return;
+  setInnerSubscriber(
+    forward(operation).subscribe({
+      complete: () => {
+        if (!observer.isClosed()) observer.complete();
+      },
+      error: (error) => {
+        if (!observer.isClosed()) observer.error(error);
+      },
+      next: (value) => {
+        if (!observer.isClosed()) observer.next(value);
+      }
+    })
+  );
+}
+function createErrorLink(adapters) {
+  const {
+    refreshAccessToken,
+    clearAccessToken,
+    logout,
+    onError: reportError,
+    onDebug,
+    onAuthRecoveryEvent
+  } = adapters;
+  function scheduleSessionLogout(reason) {
+    onAuthRecoveryEvent?.({ reason, type: "logout_scheduled" });
+    setTimeout(() => {
+      void logout();
+    }, 0);
+  }
+  async function handleTerminalRefreshFailure(observer) {
+    clearAccessToken?.("refresh_failed");
+    if (!observer.isClosed()) observer.complete();
+    scheduleSessionLogout("refresh_failed");
+  }
+  async function handleRefreshResult(result, operation, forward, observer, setInnerSubscriber) {
+    const decision = decideRefreshNextStep(result);
+    if (decision.kind === "logout") {
+      await handleTerminalRefreshFailure(observer);
+      return;
+    }
+    if (decision.kind === "complete") {
+      handleRetryableRefreshFailure(observer);
+      return;
+    }
+    retryOperationWithToken(
+      operation,
+      forward,
+      decision.token,
+      observer,
+      setInnerSubscriber
+    );
+  }
+  async function recoverFromAuthError(operation, forward, authContext, observer, setInnerSubscriber) {
+    const ctx = operation.getContext();
+    if (ctx.__authRetryAttempted) {
+      onDebug?.("Auth retry suppressed (already retried)", {
+        operationName: operation.operationName,
+        statusCode: authContext.statusCode
+      });
+      if (!observer.isClosed()) {
+        observer.error(
+          new Error(
+            `Auth failed after retry (status ${authContext.statusCode ?? "unknown"})`
+          )
+        );
+      }
+      return;
+    }
+    onDebug?.("Auth error detected; attempting refresh", {
+      operationName: operation.operationName,
+      statusCode: authContext.statusCode
+    });
+    const result = await refreshAccessToken();
+    if (observer.isClosed()) return;
+    await handleRefreshResult(
+      result,
+      operation,
+      forward,
+      observer,
+      setInnerSubscriber
+    );
+  }
+  async function handleAuthRecoveryError(err, observer) {
+    reportError?.(err, { action: "tokenRefresh" });
+    console.error("Token refresh failed", err);
+    clearAccessToken?.("refresh_exception");
+    if (!observer.isClosed()) observer.complete();
+    scheduleSessionLogout("refresh_exception");
+  }
+  return (0, import_error.onError)((errorResponse) => {
+    const { operation, forward } = errorResponse;
+    const { graphQLErrors, networkError } = readErrorResponseFields(errorResponse);
+    if (!isUnauthenticatedError({
+      graphQLErrors,
+      networkError
+    })) {
+      return;
+    }
+    const statusCode = networkError ? getStatusCode(networkError) : null;
+    const authContext = {
+      graphQLErrors,
+      networkError,
+      statusCode
+    };
+    return new import_client2.Observable((observer) => {
+      let innerSubscriber = null;
+      let closed = false;
+      const recoveryObserver = {
+        complete: () => {
+          if (!closed) observer.complete();
+        },
+        error: (error) => {
+          if (!closed) observer.error(error);
+        },
+        isClosed: () => closed,
+        next: (value) => {
+          if (!closed) observer.next(value);
+        }
+      };
+      const teardown = () => {
+        closed = true;
+        innerSubscriber?.unsubscribe();
+        innerSubscriber = null;
+      };
+      void recoverFromAuthError(
+        operation,
+        forward,
+        authContext,
+        recoveryObserver,
+        (subscriber) => {
+          innerSubscriber = subscriber;
+        }
+      ).catch((err) => handleAuthRecoveryError(err, recoveryObserver));
+      return teardown;
+    });
+  });
+}
+
+// src/apollo/createRefreshAccessToken.ts
+var REFRESH_TOKEN_QUERY = `
+  mutation refreshToken($input: RefreshTokenInputType!) {
+    refreshToken(input: $input) {
+      data {
+        token
+        refreshToken
+      }
+      message
+    }
+  }
+`;
+var RETRY_DELAY_MS = 1500;
+var MAX_REFRESH_ATTEMPTS = 5;
+var wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function createRefreshAccessToken(adapters) {
+  const {
+    apiUrl,
+    storage,
+    onTokensUpdated,
+    onTokensCleared,
+    onError: onError3,
+    onDebug,
+    onAuthRecoveryEvent,
+    refreshCoordination
+  } = adapters;
+  let inFlightRefresh = null;
+  async function clearRefreshCredentials(reason) {
+    await storage.clearTokens();
+    onTokensCleared?.(reason);
+  }
+  async function clearOrAdoptNewerAccessToken(reason, accessTokenAtStart, errorCode) {
+    const currentAccess = await storage.getAccessToken();
+    if (currentAccess != null && currentAccess !== accessTokenAtStart) {
+      onAuthRecoveryEvent?.({ reason, type: "stale_clear_skipped" });
+      return { hadRefreshToken: true, token: currentAccess };
+    }
+    await clearRefreshCredentials(reason);
+    onAuthRecoveryEvent?.({
+      errorCode,
+      reason,
+      type: "refresh_failed"
+    });
+    return {
+      hadRefreshToken: true,
+      token: null
+    };
+  }
+  async function abortAfterRefreshGraphqlErrors(errors, errorCode, accessTokenAtStart) {
+    const sanitizedErrors = errors.map((error) => ({
+      message: error?.message
+    }));
+    if (isExpectedRefreshAuthFailure(errors, errorCode)) {
+      console.warn(
+        "[refreshAccessToken] Refresh rejected:",
+        errorCode ?? sanitizedErrors.map((e) => e.message).join(", ")
+      );
+    } else {
+      console.error("[refreshAccessToken] GraphQL errors:", sanitizedErrors);
+      onError3?.(new Error("GraphQL errors during refresh"), {
+        action: "refresh_graphql_error",
+        errorCode,
+        errors: sanitizedErrors
+      });
+    }
+    const outcome = await clearOrAdoptNewerAccessToken(
+      "refresh_graphql_error",
+      accessTokenAtStart,
+      errorCode
+    );
+    return {
+      ...outcome,
+      errorCode
+    };
+  }
+  async function runRefreshAttempt(refreshToken, attempt) {
+    const res = await fetch(`${apiUrl}/graphql`, {
+      body: JSON.stringify({
+        query: REFRESH_TOKEN_QUERY,
+        variables: { input: { refreshToken } }
+      }),
+      headers: { "Content-Type": "application/json" },
+      method: "POST"
+    });
+    const json = await res.json();
+    if (json.errors?.length) {
+      const errors = json.errors;
+      const errorCode = getRefreshErrorCode(errors);
+      const warrantRetry = refreshGraphqlErrorsWarrantRetry(errors) && attempt < MAX_REFRESH_ATTEMPTS;
+      if (warrantRetry) {
+        onDebug?.(
+          `GraphQL errors (attempt ${attempt}/${MAX_REFRESH_ATTEMPTS}), retrying`,
+          { errorCode }
+        );
+        return { kind: "retry" };
+      }
+      return { errorCode, errors, kind: "terminal_graphql" };
+    }
+    const newToken = json?.data?.refreshToken?.data?.token;
+    const newRefreshToken = json?.data?.refreshToken?.data?.refreshToken;
+    if (newToken && newRefreshToken) {
+      await storage.setTokens(newToken, newRefreshToken);
+      onTokensUpdated?.(newToken);
+      return { kind: "success", token: newToken };
+    }
+    if (attempt < MAX_REFRESH_ATTEMPTS) {
+      onDebug?.(
+        `Invalid refresh response (attempt ${attempt}/${MAX_REFRESH_ATTEMPTS}), retrying`
+      );
+      return { kind: "retry" };
+    }
+    return { kind: "terminal_invalid" };
+  }
+  async function refreshAccessTokenInternal() {
+    const accessTokenAtStart = await storage.getAccessToken();
+    for (let attempt = 1; attempt <= MAX_REFRESH_ATTEMPTS; attempt += 1) {
+      const refreshToken = await storage.getRefreshToken();
+      if (!refreshToken) return { hadRefreshToken: false, token: null };
+      try {
+        const result = await runRefreshAttempt(refreshToken, attempt);
+        if (result.kind === "success") {
+          onAuthRecoveryEvent?.({ type: "refresh_succeeded" });
+          return { hadRefreshToken: true, token: result.token };
+        }
+        if (result.kind === "retry") {
+          await wait(RETRY_DELAY_MS);
+          continue;
+        }
+        if (result.kind === "terminal_graphql") {
+          return abortAfterRefreshGraphqlErrors(
+            result.errors,
+            result.errorCode,
+            accessTokenAtStart
+          );
+        }
+        return clearOrAdoptNewerAccessToken(
+          "refresh_invalid_response",
+          accessTokenAtStart
+        );
+      } catch (err) {
+        if (attempt < MAX_REFRESH_ATTEMPTS) {
+          await wait(RETRY_DELAY_MS);
+          continue;
+        }
+        onError3?.(err, {
+          action: "refreshAccessToken",
+          attempt,
+          maxAttempts: MAX_REFRESH_ATTEMPTS
+        });
+        console.error("Token refresh failed:", err);
+        onAuthRecoveryEvent?.({
+          reason: "refresh_network_exhausted",
+          retryable: true,
+          type: "refresh_failed"
+        });
+        return { hadRefreshToken: true, retryable: true, token: null };
+      }
+    }
+    throw new Error("refreshAccessToken: unreachable");
+  }
+  return function refreshAccessToken() {
+    if (inFlightRefresh !== null) {
+      return inFlightRefresh;
+    }
+    const startCoalesced = () => {
+      inFlightRefresh ??= refreshAccessTokenInternal().finally(() => {
+        inFlightRefresh = null;
+      });
+      return inFlightRefresh;
+    };
+    if (refreshCoordination) {
+      return refreshCoordination.withLock(async () => {
+        if (inFlightRefresh !== null) {
+          return inFlightRefresh;
+        }
+        return startCoalesced();
+      });
+    }
+    return startCoalesced();
+  };
+}
+
+// src/apollo/createApolloErrorLoggingLink.ts
+var import_error2 = require("@apollo/client/link/error");
+
+// src/apollo/toStructuredError.ts
+function safeJsonStringify(value) {
+  const seen = /* @__PURE__ */ new WeakSet();
+  const json = JSON.stringify(
+    value,
+    (_key, v) => {
+      if (typeof v === "bigint") return v.toString();
+      if (typeof v === "function") return `[Function ${v.name || "anonymous"}]`;
+      if (v && typeof v === "object") {
+        if (seen.has(v)) return "[Circular]";
+        seen.add(v);
+      }
+      if (v instanceof Error) {
+        return {
+          message: v.message,
+          name: v.name,
+          stack: v.stack,
+          ...v
+        };
+      }
+      return v;
+    },
+    2
+  );
+  return json ?? "null";
+}
+function coerceJson(value) {
+  if (value === void 0) return void 0;
+  if (value === null) return null;
+  if (typeof value === "boolean" || typeof value === "number" || typeof value === "string") {
+    return value;
+  }
+  if (typeof value === "bigint") return value.toString();
+  if (typeof value === "symbol") return value.toString();
+  if (typeof value === "function") {
+    return `[Function ${value.name || "anonymous"}]`;
+  }
+  return value;
+}
+function pickKnownFields(src, dst) {
+  const keys = [
+    "message",
+    "code",
+    "reason",
+    "type",
+    "name",
+    "stack",
+    "status",
+    "statusCode",
+    "readyState",
+    "url",
+    "wasClean"
+  ];
+  for (const k of keys) {
+    if (k in src) {
+      const coerced = coerceJson(src[k]);
+      if (coerced !== void 0) dst[k] = coerced;
+    }
+  }
+}
+function objectToJson(anyErr) {
+  const out = {};
+  pickKnownFields(anyErr, out);
+  for (const [k, v] of Object.entries(anyErr)) {
+    if (k in out) continue;
+    const coerced = coerceJson(v);
+    if (coerced !== void 0) out[k] = coerced;
+  }
+  return out;
+}
+function toStructuredError(err) {
+  if (err == null) return null;
+  if (typeof err === "string") return { message: err };
+  if (typeof err === "number" || typeof err === "boolean")
+    return { value: err };
+  if (typeof err === "symbol") return { value: err.toString() };
+  if (err instanceof Error) {
+    const details = objectToJson(err);
+    if (details && typeof details === "object" && !Array.isArray(details)) {
+      return {
+        ...details,
+        message: err.message,
+        name: err.name,
+        stack: err.stack ?? null
+      };
+    }
+    return {
+      message: err.message,
+      name: err.name,
+      stack: err.stack ?? null
+    };
+  }
+  if (typeof err === "object") return objectToJson(err);
+  return { value: safeJsonStringify({ value: err }) };
+}
+
+// src/apollo/createApolloErrorLoggingLink.ts
+var SCOPE = "apollo";
+var REDACTED = "[REDACTED]";
+var MAX_DEPTH = 4;
+var MAX_ARRAY_ITEMS = 20;
+var SENSITIVE_KEY_RE = /(pass(word)?|token|secret|auth(orization)?|cookie|session|otp|pin|email|phone|ssn|credit|card|cvv|iban|refresh)/i;
+var GRAPHQL_EXTENSION_ALLOWLIST = /* @__PURE__ */ new Set(["category", "code", "httpStatus"]);
+function resolveIsDev(isDev) {
+  return typeof isDev === "function" ? isDev() : isDev;
+}
+function isSensitiveKey(key) {
+  return SENSITIVE_KEY_RE.test(key);
+}
+function isSensitiveExtensionKey(key) {
+  return isSensitiveKey(key) || /stack|trace|debug|exception|internals|snippet|query|variables|body/i.test(
+    key
+  );
+}
+function redactValue(value, depth = 0) {
+  if (value == null) return value;
+  if (depth >= MAX_DEPTH) return "[Truncated]";
+  if (Array.isArray(value)) {
+    return value.slice(0, MAX_ARRAY_ITEMS).map((item) => redactValue(item, depth + 1));
+  }
+  if (typeof value === "object") {
+    const input = value;
+    const out = {};
+    for (const [key, nested] of Object.entries(input)) {
+      out[key] = isSensitiveKey(key) ? REDACTED : redactValue(nested, depth + 1);
+    }
+    return out;
+  }
+  return value;
+}
+function pickAllowlistedExtensions(ext) {
+  const out = {};
+  for (const key of GRAPHQL_EXTENSION_ALLOWLIST) {
+    if (key in ext && ext[key] !== void 0) {
+      out[key] = ext[key];
+    }
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function redactGraphQLExtensionsForDev(ext) {
+  const out = {};
+  for (const [key, value] of Object.entries(ext)) {
+    if (GRAPHQL_EXTENSION_ALLOWLIST.has(key)) {
+      out[key] = value != null && typeof value === "object" ? redactValue(value) : value;
+      continue;
+    }
+    if (isSensitiveExtensionKey(key)) {
+      out[key] = REDACTED;
+      continue;
+    }
+    out[key] = redactValue(value);
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function safeExtensionsForLogs(extensions, isDev) {
+  if (extensions == null) return void 0;
+  if (typeof extensions !== "object" || Array.isArray(extensions)) {
+    return "[NonObjectExtensions]";
+  }
+  const ext = extensions;
+  if (!isDev) {
+    return pickAllowlistedExtensions(ext);
+  }
+  return redactGraphQLExtensionsForDev(ext);
+}
+function serializeGraphQLError(err, isDev) {
+  return {
+    extensions: safeExtensionsForLogs(err.extensions, isDev),
+    locations: err.locations,
+    message: err.message,
+    path: err.path
+  };
+}
+function safeVariablesForLogs(variables, isDev) {
+  if (!variables) return void 0;
+  if (!isDev) {
+    return {
+      keys: Object.keys(variables),
+      present: true
+    };
+  }
+  return redactValue(variables);
+}
+function safeResponseForLogs(response, isDev) {
+  if (!response) return null;
+  if (!isDev) return { present: true };
+  return redactValue(toStructuredError(response));
+}
+function createApolloErrorLoggingLink(adapters) {
+  const { isDev, onLog } = adapters;
+  return (0, import_error2.onError)((errorHandler) => {
+    const { operation } = errorHandler;
+    const { graphQLErrors, networkError, response } = readErrorResponseFields(errorHandler);
+    const dev = resolveIsDev(isDev);
+    if (graphQLErrors?.length) {
+      onLog("error", SCOPE, "GraphQL error(s)", {
+        graphQLErrors: graphQLErrors.map(
+          (err) => serializeGraphQLError(err, dev)
+        ),
+        operationName: operation.operationName,
+        variables: safeVariablesForLogs(operation.variables, dev)
+      });
+    }
+    if (networkError) {
+      onLog("error", SCOPE, "Network error", {
+        networkError: toStructuredError(networkError),
+        operationName: operation.operationName,
+        response: safeResponseForLogs(response, dev),
+        variables: safeVariablesForLogs(operation.variables, dev)
+      });
+    }
+    return void 0;
+  });
+}
+
+// src/apollo/createNetworkRecoveryLink.ts
+var import_client3 = require("@apollo/client");
+var import_utilities = require("@apollo/client/utilities");
+
+// src/utils/isTransientNetworkError.ts
+var TRANSIENT_NETWORK_PATTERNS = [
+  /network connection was lost/i,
+  /network request failed/i,
+  /fetch failed/i,
+  /failed to fetch/i,
+  /internet connection appears to be offline/i,
+  // Transport-layer timeouts only — avoid generic "timeout" (backend/query timeouts).
+  /\b(request|connection|network)\s+timed\s+out\b/i,
+  /\b(connect|read|write|socket)\s+timeout\b/i,
+  /\bsocket\s+timed\s+out\b/i,
+  /\betimedout\b/i,
+  /\benotfound\b/i,
+  /\beconnreset\b/i,
+  /\beconnrefused\b/i
+];
+function extractErrorMessage(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  if (err && typeof err === "object") {
+    const obj = err;
+    if (typeof obj.message === "string") return obj.message;
+    if (obj.networkError) return extractErrorMessage(obj.networkError);
+    try {
+      return JSON.stringify(err);
+    } catch {
+      return "[object]";
+    }
+  }
+  if (err == null) return "";
+  if (typeof err === "number" || typeof err === "boolean" || typeof err === "bigint") {
+    return String(err);
+  }
+  if (typeof err === "symbol") return err.toString();
+  return "";
+}
+function isTransientNetworkError(err) {
+  const message = extractErrorMessage(err);
+  return TRANSIENT_NETWORK_PATTERNS.some((pattern) => pattern.test(message));
+}
+
+// src/apollo/createNetworkRecoveryLink.ts
+var MAX_RETRIES = 4;
+var BACKOFF_MS = [500, 1500, 3e3, 4e3];
+function emitNext(state, value) {
+  if (state.unsubscribed) return;
+  state.observer.next(value);
+}
+function emitComplete(state) {
+  if (state.unsubscribed) return;
+  state.observer.complete();
+}
+function emitError(state, err) {
+  if (state.unsubscribed) return;
+  state.observer.error(err);
+}
+function isQueryOperation(op) {
+  const def = (0, import_utilities.getMainDefinition)(op.query);
+  return def.kind === "OperationDefinition" && def.operation === "query";
+}
+function wait2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function isRetryableNetworkFailure(err) {
+  if (isTransientNetworkError(err)) return true;
+  const networkError = err && typeof err === "object" ? err.networkError : void 0;
+  if (!networkError) return false;
+  if (typeof networkError === "object" && networkError !== null && !(networkError instanceof Error) && Object.keys(networkError).length === 0) {
+    return false;
+  }
+  return isTransientNetworkError(networkError);
+}
+function waitForOnline(adapters, aborted) {
+  return new Promise((resolve) => {
+    if (aborted()) {
+      resolve();
+      return;
+    }
+    let intervalId = null;
+    const unsub = adapters.subscribeIsOnline((online) => {
+      if (aborted()) {
+        if (intervalId !== null) {
+          clearInterval(intervalId);
+          intervalId = null;
+        }
+        unsub();
+        resolve();
+        return;
+      }
+      if (online) {
+        if (intervalId !== null) {
+          clearInterval(intervalId);
+          intervalId = null;
+        }
+        unsub();
+        resolve();
+      }
+    });
+    intervalId = setInterval(() => {
+      if (aborted()) {
+        if (intervalId !== null) {
+          clearInterval(intervalId);
+          intervalId = null;
+        }
+        unsub();
+        resolve();
+      }
+    }, 500);
+  });
+}
+function cleanupRecoveryState(state) {
+  state.innerSub?.unsubscribe();
+  state.innerSub = null;
+}
+async function ensureOnlineOrWait(state) {
+  const online = await state.adapters.forceRefreshIsOnline();
+  if (online) return !state.unsubscribed;
+  await waitForOnline(state.adapters, () => state.unsubscribed);
+  return !state.unsubscribed;
+}
+async function handleQueryNetworkError(state, err, attempt) {
+  if (state.unsubscribed) return;
+  if (!isRetryableNetworkFailure(err)) {
+    emitError(state, err);
+    return;
+  }
+  const nowOnline = await state.adapters.forceRefreshIsOnline();
+  if (state.unsubscribed) return;
+  if (!nowOnline) {
+    await waitForOnline(state.adapters, () => state.unsubscribed);
+    if (state.unsubscribed) return;
+    cleanupRecoveryState(state);
+    void runQueryAttempt(state, attempt);
+    return;
+  }
+  if (attempt >= MAX_RETRIES) {
+    emitError(state, err);
+    return;
+  }
+  await wait2(BACKOFF_MS[attempt] ?? 4e3);
+  if (state.unsubscribed) return;
+  cleanupRecoveryState(state);
+  void runQueryAttempt(state, attempt + 1);
+}
+async function runQueryAttempt(state, attempt) {
+  if (state.unsubscribed) return;
+  const canContinue = await ensureOnlineOrWait(state);
+  if (!canContinue) return;
+  try {
+    state.innerSub = state.forward(state.operation).subscribe({
+      complete: () => emitComplete(state),
+      error: (err) => {
+        if (!isRetryableNetworkFailure(err)) {
+          emitError(state, err);
+          return;
+        }
+        void handleQueryNetworkError(state, err, attempt);
+      },
+      next: (value) => emitNext(state, value)
+    });
+  } catch (e) {
+    emitError(state, e);
+  }
+}
+function createNetworkRecoveryLink(adapters) {
+  return new import_client3.ApolloLink((operation, forward) => {
+    if (!forward) {
+      return null;
+    }
+    if (!isQueryOperation(operation)) {
+      return forward(operation);
+    }
+    return new import_client3.Observable((observer) => {
+      const state = {
+        adapters,
+        forward,
+        innerSub: null,
+        observer,
+        operation,
+        unsubscribed: false
+      };
+      void runQueryAttempt(state, 0);
+      return () => {
+        state.unsubscribed = true;
+        cleanupRecoveryState(state);
+      };
+    });
+  });
+}
+
+// src/apollo/createNetworkLog.ts
+function resolveEnabled(enabled) {
+  return typeof enabled === "function" ? enabled() : enabled;
+}
+function createNetworkLog(adapters) {
+  const { enabled } = adapters;
+  return function networkLog(level, scope, message, details) {
+    if (!resolveEnabled(enabled)) return;
+    const payload = details ? safeJsonStringify(details) : "";
+    const prefix = `[${scope}] ${message}`;
+    let logger;
+    switch (level) {
+      case "debug":
+        logger = console.debug;
+        break;
+      case "info":
+        logger = console.info;
+        break;
+      case "warn":
+        logger = console.warn;
+        break;
+      case "error":
+      default:
+        logger = console.error;
+        break;
+    }
+    logger(payload ? `${prefix}
+${payload}` : prefix);
+  };
+}
+
+// src/apollo/createWsManager.ts
+var import_graphql_ws = require("graphql-ws");
+var WS_SCOPE = "ws";
+var MIN_RECONNECT_MS = 1e3;
+var MAX_RECONNECT_MS = 1e4;
+var WS_CLIENT_RESTART_CODE = 4205;
+var MAX_WS_RETRY_ATTEMPTS = 30;
+var WS_READY_STATE_OPEN = 1;
+var WS_READY_STATE_CONNECTING = 0;
+function resolveIsDev2(isDev) {
+  if (isDev == null) return false;
+  return typeof isDev === "function" ? isDev() : isDev;
+}
+function maskedTokenInfo2(token) {
+  const len = token.length;
+  const start = token.slice(0, 4);
+  const end = token.slice(-4);
+  return { end, len, start };
+}
+function computeBackoffMs(attempt) {
+  const exp = Math.min(MIN_RECONNECT_MS * 2 ** attempt, MAX_RECONNECT_MS);
+  const jitter = (attempt * 37 + 17) % 250;
+  return Math.min(exp + jitter, MAX_RECONNECT_MS);
+}
+function wsCloseReason(reason) {
+  const trimmed = reason.trim().slice(0, 100);
+  return trimmed || "restart";
+}
+function createWsManager(adapters) {
+  const {
+    getWsUrl,
+    awaitReady,
+    getAccessToken,
+    isActive,
+    subscribeLifecycle,
+    onLog,
+    isDev
+  } = adapters;
+  const log = (level, message, details) => {
+    onLog?.(level, WS_SCOPE, message, details);
+  };
+  let client = null;
+  let activeSocket = null;
+  let unsubscribeLifecycle = null;
+  const ensureConnectedRef = {
+    current: () => void 0
+  };
+  const close = (reason) => {
+    activeSocket = null;
+    if (client) {
+      try {
+        log("debug", "Disposing WS client", { reason });
+        client.dispose();
+      } catch (e) {
+        log("warn", "Error while disposing WS client", {
+          error: toStructuredError(e),
+          reason
+        });
+      }
+    }
+    client = null;
+  };
+  const createNewClient = () => {
+    const url = getWsUrl();
+    return (0, import_graphql_ws.createClient)({
+      connectionParams: async () => {
+        try {
+          await awaitReady();
+        } catch (e) {
+          log("error", "WS auth params: awaitReady failed", {
+            error: toStructuredError(e)
+          });
+          return {};
+        }
+        const token = getAccessToken();
+        if (!token) {
+          if (resolveIsDev2(isDev)) {
+            log("warn", "WS auth params: missing token", {});
+          }
+          return {};
+        }
+        if (resolveIsDev2(isDev)) {
+          log("debug", "WS connecting with token", {
+            token: maskedTokenInfo2(token)
+          });
+        }
+        const bearer = `Bearer ${token}`;
+        return { Authorization: bearer, authorization: bearer };
+      },
+      keepAlive: 2e4,
+      lazy: true,
+      on: {
+        closed: (ev) => {
+          activeSocket = null;
+          log("warn", "WS closed", {
+            close: toStructuredError(ev),
+            url
+          });
+        },
+        connected: (socket) => {
+          activeSocket = socket;
+          log("info", "WS connected", { url });
+        },
+        connecting: () => {
+          log("debug", "WS connecting", { url });
+        },
+        error: (err) => {
+          const structuredError = toStructuredError(err);
+          const hasStructuredDetails = structuredError != null && (typeof structuredError !== "object" || Array.isArray(structuredError) || Object.keys(structuredError).length > 0);
+          const logLevel = hasStructuredDetails ? "error" : "warn";
+          const logMessage = hasStructuredDetails ? "WS error" : "WS error (empty payload)";
+          log(
+            logLevel,
+            logMessage,
+            hasStructuredDetails ? { error: structuredError, url } : { url }
+          );
+        }
+      },
+      retryAttempts: MAX_WS_RETRY_ATTEMPTS,
+      retryWait: async (retries) => {
+        await new Promise(
+          (resolve) => setTimeout(resolve, computeBackoffMs(retries))
+        );
+      },
+      url
+    });
+  };
+  const initLifecycleListener = () => {
+    if (unsubscribeLifecycle) return;
+    unsubscribeLifecycle = subscribeLifecycle({
+      onActive: () => {
+        log("debug", "Lifecycle active; allowing reconnect", {});
+        ensureConnectedRef.current("lifecycle_active");
+      },
+      onInactive: () => {
+        log("debug", "Lifecycle inactive; closing WS", {});
+        close("lifecycle_inactive");
+      }
+    });
+  };
+  const getClient = () => {
+    initLifecycleListener();
+    if (!client) {
+      client = createNewClient();
+    }
+    return client;
+  };
+  const nudgeSocketReconnect = (reason) => {
+    if (!isActive()) return;
+    const token = getAccessToken();
+    if (!token) {
+      if (resolveIsDev2(isDev)) {
+        log("warn", "WS restart blocked (missing token)", { reason });
+      }
+      close(`blocked_missing_token:${reason}`);
+      return;
+    }
+    if (client === null) {
+      client = createNewClient();
+      log("debug", "WS client created", { reason });
+      return;
+    }
+    const socket = activeSocket;
+    if (socket !== null) {
+      const { readyState } = socket;
+      if (readyState === WS_READY_STATE_OPEN || readyState === WS_READY_STATE_CONNECTING) {
+        try {
+          socket.close(WS_CLIENT_RESTART_CODE, wsCloseReason(reason));
+          log("debug", "WS socket restart (same client)", { reason });
+        } catch (e) {
+          log("warn", "WS socket close failed", {
+            error: toStructuredError(e),
+            reason
+          });
+        }
+      }
+      return;
+    }
+    if (resolveIsDev2(isDev)) {
+      log("debug", "WS nudge: no open socket (library retry)", { reason });
+    }
+  };
+  const ensureConnected = (reason) => {
+    initLifecycleListener();
+    if (!isActive()) {
+      log("debug", "Skip ensureConnected while inactive", { reason });
+      return;
+    }
+    awaitReady().then(() => {
+      const token = getAccessToken();
+      if (!token) {
+        if (resolveIsDev2(isDev)) {
+          log("warn", "WS blocked (missing token)", { reason });
+        }
+        return;
+      }
+      getClient();
+    }).catch((e) => {
+      log("error", "WS ensureConnected failed", {
+        error: toStructuredError(e),
+        reason
+      });
+    });
+  };
+  ensureConnectedRef.current = ensureConnected;
+  const onAuthTokenChanged = (reason) => {
+    if (resolveIsDev2(isDev)) {
+      log("debug", "Auth token changed; reconnecting WS", { reason });
+    }
+    nudgeSocketReconnect(`auth_token_changed:${reason}`);
+  };
+  const dispose = () => {
+    close("dispose");
+    if (unsubscribeLifecycle) {
+      unsubscribeLifecycle();
+      unsubscribeLifecycle = null;
+    }
+  };
+  return {
+    close,
+    dispose,
+    ensureConnected,
+    getClient,
+    initLifecycleListener,
+    onAuthTokenChanged
+  };
+}
+
+// src/apollo/recoveryConstants.ts
+var MIN_BACKGROUND_MS = 3e4;
+var REFETCH_DELAY_MS = 500;
+
+// src/apollo/createRecoveryCore.ts
+var DEFAULT_SHORT_BG_REASON = "short_background";
+var DEFAULT_RECOVER_REASON = "apollo_recover";
+function createRecoveryCore(adapters) {
+  const {
+    refreshSession,
+    ensureWsConnected,
+    disposeWs,
+    refetchActiveQueries,
+    isActive,
+    isOnline,
+    subscribeLifecycle,
+    shortBackgroundWsReason = DEFAULT_SHORT_BG_REASON,
+    recoverWsReason = DEFAULT_RECOVER_REASON,
+    now = () => Date.now(),
+    schedule = (fn, ms) => setTimeout(fn, ms),
+    cancelSchedule = (id) => clearTimeout(id)
+  } = adapters;
+  let recovering = false;
+  let resetGeneration = 0;
+  let backgroundTime = null;
+  let wsDisposeTimer = null;
+  let refetchTimer = null;
+  let unsubscribeLifecycle = null;
+  const clearRefetchTimer = () => {
+    if (refetchTimer !== null) {
+      cancelSchedule(refetchTimer);
+      refetchTimer = null;
+    }
+  };
+  const clearWsDisposeTimer = () => {
+    if (wsDisposeTimer !== null) {
+      cancelSchedule(wsDisposeTimer);
+      wsDisposeTimer = null;
+    }
+  };
+  const canUseNetwork = () => isOnline?.() ?? true;
+  const scheduleActiveQueryRefetch = (generationAtStart) => {
+    clearRefetchTimer();
+    refetchTimer = schedule(() => {
+      refetchTimer = null;
+      if (!isActive()) return;
+      if (generationAtStart !== resetGeneration) return;
+      if (!canUseNetwork()) return;
+      refetchActiveQueries();
+    }, REFETCH_DELAY_MS);
+  };
+  const handleMovedToBackground = () => {
+    clearRefetchTimer();
+    backgroundTime = now();
+    clearWsDisposeTimer();
+    wsDisposeTimer = schedule(() => {
+      wsDisposeTimer = null;
+      disposeWs();
+    }, MIN_BACKGROUND_MS);
+  };
+  async function recoverApollo() {
+    if (recovering) return;
+    recovering = true;
+    const generationAtStart = resetGeneration;
+    try {
+      const shouldRefetch = await refreshSession();
+      if (generationAtStart !== resetGeneration) return;
+      ensureWsConnected(recoverWsReason);
+      if (!isActive()) return;
+      if (shouldRefetch) {
+        scheduleActiveQueryRefetch(generationAtStart);
+      }
+    } finally {
+      if (generationAtStart === resetGeneration) {
+        recovering = false;
+      }
+    }
+  }
+  const handleReturnedToForeground = () => {
+    clearWsDisposeTimer();
+    const bgTime = backgroundTime;
+    const elapsed = bgTime != null ? now() - bgTime : MIN_BACKGROUND_MS;
+    backgroundTime = null;
+    if (elapsed >= MIN_BACKGROUND_MS) {
+      void recoverApollo();
+      return;
+    }
+    ensureWsConnected(shortBackgroundWsReason);
+  };
+  return {
+    prepareClientReset() {
+      clearRefetchTimer();
+      clearWsDisposeTimer();
+      backgroundTime = null;
+      recovering = false;
+      resetGeneration += 1;
+    },
+    recoverApollo,
+    start() {
+      if (unsubscribeLifecycle) return;
+      unsubscribeLifecycle = subscribeLifecycle({
+        onActive: handleReturnedToForeground,
+        onInactive: handleMovedToBackground
+      });
+    },
+    stop() {
+      if (unsubscribeLifecycle) {
+        unsubscribeLifecycle();
+        unsubscribeLifecycle = null;
+      }
+      clearRefetchTimer();
+      clearWsDisposeTimer();
+      backgroundTime = null;
+      recovering = false;
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  MIN_BACKGROUND_MS,
+  NON_RETRYABLE_REFRESH_AUTH_CODES,
+  REFETCH_DELAY_MS,
+  createApolloErrorLoggingLink,
+  createApolloManager,
+  createAuthLink,
+  createErrorLink,
+  createNetworkLog,
+  createNetworkRecoveryLink,
+  createRecoveryCore,
+  createRefreshAccessToken,
+  createWsManager,
+  decideRefreshNextStep,
+  getRefreshErrorCode,
+  getStatusCode,
+  isExpectedRefreshAuthFailure,
+  isRefreshAuthFailureMessage,
+  isUnauthenticatedError,
+  isUnauthenticatedGraphQLError,
+  readErrorResponseFields,
+  refreshGraphqlErrorsWarrantRetry,
+  safeJsonStringify,
+  toStructuredError
+});
+//# sourceMappingURL=index.cjs.map