@webex/webex-core 3.12.0-next.32 → 3.12.0-next.34

package/dist/config.js

@@ -31,6 +31,15 @@ var _default = exports.default = {
      * @type {boolean}
      */
     useUserOnboardingServiceForActivations: false,
+    /**
+     * Maximum time (in milliseconds) to wait for the initial service catalog
+     * collection when `waitForCatalogInit` is enabled, before letting
+     * `services.ready` (and therefore `webex.ready`) fire anyway. Prevents a
+     * hung catalog request from leaving the app on a permanent spinner.
+     *
+     * @type {number}
+     */
+    catalogInitTimeout: 15000,
     /**
      * A list of services that are available prior to catalog collection.
      *

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"names":["_storage","require","_credentialsConfig","_interopRequireDefault","_default","exports","default","maxAppLevelRedirects","maxLocusRedirects","maxAuthenticationReplays","maxReconnectAttempts","onBeforeLogout","trackingIdPrefix","trackingIdSuffix","AlternateLogger","undefined","credentials","CredentialsConfig","fedramp","process","env","ENABLE_FEDRAMP","services","useUserOnboardingServiceForActivations","discovery","hydra","HYDRA_SERVICE_URL","sqdiscovery","SQDISCOVERY_SERVICE_URL","u2c","U2C_SERVICE_URL","validateDomains","servicesNotNeedValidation","allowedDomains","device","preDiscoveryServices","hydraServiceUrl","metrics","type","calling","cacheU2C","payloadTransformer","predicates","transforms","storage","boundedAdapter","MemoryStoreAdapter","unboundedAdapter"],"sources":["config.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\n/* eslint camelcase: [0] */\n\nimport {MemoryStoreAdapter} from './lib/storage';\nimport CredentialsConfig from './credentials-config';\n\nexport default {\n  maxAppLevelRedirects: 10,\n  maxLocusRedirects: 5,\n  maxAuthenticationReplays: 1,\n  maxReconnectAttempts: 1,\n  onBeforeLogout: [],\n  trackingIdPrefix: 'webex-js-sdk',\n  trackingIdSuffix: '',\n  AlternateLogger: undefined,\n  credentials: new CredentialsConfig(),\n  fedramp: process.env.ENABLE_FEDRAMP || false,\n  services: {\n    /**\n     * When true, uses the user-onboarding service for user activation.\n     * When false (default), uses the license service.\n     *\n     * @type {boolean}\n     */\n    useUserOnboardingServiceForActivations: false,\n\n    /**\n     * A list of services that are available prior to catalog collection.\n     *\n     * @type {Object}\n     */\n    discovery: {\n      /**\n       * The hydra discovery url.\n       *\n       * @type {string}\n       */\n      hydra: process.env.HYDRA_SERVICE_URL || 'https://api.ciscospark.com/v1',\n\n      /**\n       * load balanced region info url\n       */\n      sqdiscovery: process.env.SQDISCOVERY_SERVICE_URL || 'https://ds.ciscospark.com/v1/region',\n\n      /**\n       * The u2c discovery url\n       *\n       * @type {string}\n       */\n      u2c: process.env.U2C_SERVICE_URL || 'https://u2c.wbx2.com/u2c/api/v1',\n    },\n\n    /**\n     * When true, considers all urls in `allowedDomains` as safe for auth tokens\n     *\n     * @type {boolean}\n     */\n    validateDomains: true,\n\n    /**\n     * services that don't need auth validation\n     */\n\n    servicesNotNeedValidation: ['webex-appapi-service'],\n\n    /**\n     * Contains a list of allowed domain host addresses.\n     *\n     * @type {Array<string>}\n     */\n    allowedDomains: [],\n  },\n  device: {\n    preDiscoveryServices: {\n      hydra: process.env.HYDRA_SERVICE_URL || 'https://api.ciscospark.com/v1',\n      hydraServiceUrl: process.env.HYDRA_SERVICE_URL || 'https://api.ciscospark.com/v1',\n    },\n    validateDomains: true,\n  },\n  metrics: {\n    type: ['behavioral', 'operational'],\n  },\n  calling: {\n    /**\n     * Controls whether U2C service catalogs should be cached and warmed from cache.\n     * When false, the services layer will skip reading and writing the U2C cache.\n     */\n    cacheU2C: false,\n  },\n  payloadTransformer: {\n    predicates: [],\n    transforms: [],\n  },\n  storage: {\n    boundedAdapter: MemoryStoreAdapter,\n    unboundedAdapter: MemoryStoreAdapter,\n  },\n};\n"],"mappings":";;;;;;;;AAMA,IAAAA,QAAA,GAAAC,OAAA;AACA,IAAAC,kBAAA,GAAAC,sBAAA,CAAAF,OAAA;AAPA;AACA;AACA;AAEA;AAAA,IAAAG,QAAA,GAAAC,OAAA,CAAAC,OAAA,GAKe;EACbC,oBAAoB,EAAE,EAAE;EACxBC,iBAAiB,EAAE,CAAC;EACpBC,wBAAwB,EAAE,CAAC;EAC3BC,oBAAoB,EAAE,CAAC;EACvBC,cAAc,EAAE,EAAE;EAClBC,gBAAgB,EAAE,cAAc;EAChCC,gBAAgB,EAAE,EAAE;EACpBC,eAAe,EAAEC,SAAS;EAC1BC,WAAW,EAAE,IAAIC,0BAAiB,CAAC,CAAC;EACpCC,OAAO,EAAEC,OAAO,CAACC,GAAG,CAACC,cAAc,IAAI,KAAK;EAC5CC,QAAQ,EAAE;IACR;AACJ;AACA;AACA;AACA;AACA;IACIC,sCAAsC,EAAE,KAAK;IAE7C;AACJ;AACA;AACA;AACA;IACIC,SAAS,EAAE;MACT;AACN;AACA;AACA;AACA;MACMC,KAAK,EAAEN,OAAO,CAACC,GAAG,CAACM,iBAAiB,IAAI,+BAA+B;MAEvE;AACN;AACA;MACMC,WAAW,EAAER,OAAO,CAACC,GAAG,CAACQ,uBAAuB,IAAI,qCAAqC;MAEzF;AACN;AACA;AACA;AACA;MACMC,GAAG,EAAEV,OAAO,CAACC,GAAG,CAACU,eAAe,IAAI;IACtC,CAAC;IAED;AACJ;AACA;AACA;AACA;IACIC,eAAe,EAAE,IAAI;IAErB;AACJ;AACA;;IAEIC,yBAAyB,EAAE,CAAC,sBAAsB,CAAC;IAEnD;AACJ;AACA;AACA;AACA;IACIC,cAAc,EAAE;EAClB,CAAC;EACDC,MAAM,EAAE;IACNC,oBAAoB,EAAE;MACpBV,KAAK,EAAEN,OAAO,CAACC,GAAG,CAACM,iBAAiB,IAAI,+BAA+B;MACvEU,eAAe,EAAEjB,OAAO,CAACC,GAAG,CAACM,iBAAiB,IAAI;IACpD,CAAC;IACDK,eAAe,EAAE;EACnB,CAAC;EACDM,OAAO,EAAE;IACPC,IAAI,EAAE,CAAC,YAAY,EAAE,aAAa;EACpC,CAAC;EACDC,OAAO,EAAE;IACP;AACJ;AACA;AACA;IACIC,QAAQ,EAAE;EACZ,CAAC;EACDC,kBAAkB,EAAE;IAClBC,UAAU,EAAE,EAAE;IACdC,UAAU,EAAE;EACd,CAAC;EACDC,OAAO,EAAE;IACPC,cAAc,EAAEC,2BAAkB;IAClCC,gBAAgB,EAAED;EACpB;AACF,CAAC","ignoreList":[]}
+{"version":3,"names":["_storage","require","_credentialsConfig","_interopRequireDefault","_default","exports","default","maxAppLevelRedirects","maxLocusRedirects","maxAuthenticationReplays","maxReconnectAttempts","onBeforeLogout","trackingIdPrefix","trackingIdSuffix","AlternateLogger","undefined","credentials","CredentialsConfig","fedramp","process","env","ENABLE_FEDRAMP","services","useUserOnboardingServiceForActivations","catalogInitTimeout","discovery","hydra","HYDRA_SERVICE_URL","sqdiscovery","SQDISCOVERY_SERVICE_URL","u2c","U2C_SERVICE_URL","validateDomains","servicesNotNeedValidation","allowedDomains","device","preDiscoveryServices","hydraServiceUrl","metrics","type","calling","cacheU2C","payloadTransformer","predicates","transforms","storage","boundedAdapter","MemoryStoreAdapter","unboundedAdapter"],"sources":["config.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\n/* eslint camelcase: [0] */\n\nimport {MemoryStoreAdapter} from './lib/storage';\nimport CredentialsConfig from './credentials-config';\n\nexport default {\n  maxAppLevelRedirects: 10,\n  maxLocusRedirects: 5,\n  maxAuthenticationReplays: 1,\n  maxReconnectAttempts: 1,\n  onBeforeLogout: [],\n  trackingIdPrefix: 'webex-js-sdk',\n  trackingIdSuffix: '',\n  AlternateLogger: undefined,\n  credentials: new CredentialsConfig(),\n  fedramp: process.env.ENABLE_FEDRAMP || false,\n  services: {\n    /**\n     * When true, uses the user-onboarding service for user activation.\n     * When false (default), uses the license service.\n     *\n     * @type {boolean}\n     */\n    useUserOnboardingServiceForActivations: false,\n\n    /**\n     * Maximum time (in milliseconds) to wait for the initial service catalog\n     * collection when `waitForCatalogInit` is enabled, before letting\n     * `services.ready` (and therefore `webex.ready`) fire anyway. Prevents a\n     * hung catalog request from leaving the app on a permanent spinner.\n     *\n     * @type {number}\n     */\n    catalogInitTimeout: 15000,\n\n    /**\n     * A list of services that are available prior to catalog collection.\n     *\n     * @type {Object}\n     */\n    discovery: {\n      /**\n       * The hydra discovery url.\n       *\n       * @type {string}\n       */\n      hydra: process.env.HYDRA_SERVICE_URL || 'https://api.ciscospark.com/v1',\n\n      /**\n       * load balanced region info url\n       */\n      sqdiscovery: process.env.SQDISCOVERY_SERVICE_URL || 'https://ds.ciscospark.com/v1/region',\n\n      /**\n       * The u2c discovery url\n       *\n       * @type {string}\n       */\n      u2c: process.env.U2C_SERVICE_URL || 'https://u2c.wbx2.com/u2c/api/v1',\n    },\n\n    /**\n     * When true, considers all urls in `allowedDomains` as safe for auth tokens\n     *\n     * @type {boolean}\n     */\n    validateDomains: true,\n\n    /**\n     * services that don't need auth validation\n     */\n\n    servicesNotNeedValidation: ['webex-appapi-service'],\n\n    /**\n     * Contains a list of allowed domain host addresses.\n     *\n     * @type {Array<string>}\n     */\n    allowedDomains: [],\n  },\n  device: {\n    preDiscoveryServices: {\n      hydra: process.env.HYDRA_SERVICE_URL || 'https://api.ciscospark.com/v1',\n      hydraServiceUrl: process.env.HYDRA_SERVICE_URL || 'https://api.ciscospark.com/v1',\n    },\n    validateDomains: true,\n  },\n  metrics: {\n    type: ['behavioral', 'operational'],\n  },\n  calling: {\n    /**\n     * Controls whether U2C service catalogs should be cached and warmed from cache.\n     * When false, the services layer will skip reading and writing the U2C cache.\n     */\n    cacheU2C: false,\n  },\n  payloadTransformer: {\n    predicates: [],\n    transforms: [],\n  },\n  storage: {\n    boundedAdapter: MemoryStoreAdapter,\n    unboundedAdapter: MemoryStoreAdapter,\n  },\n};\n"],"mappings":";;;;;;;;AAMA,IAAAA,QAAA,GAAAC,OAAA;AACA,IAAAC,kBAAA,GAAAC,sBAAA,CAAAF,OAAA;AAPA;AACA;AACA;AAEA;AAAA,IAAAG,QAAA,GAAAC,OAAA,CAAAC,OAAA,GAKe;EACbC,oBAAoB,EAAE,EAAE;EACxBC,iBAAiB,EAAE,CAAC;EACpBC,wBAAwB,EAAE,CAAC;EAC3BC,oBAAoB,EAAE,CAAC;EACvBC,cAAc,EAAE,EAAE;EAClBC,gBAAgB,EAAE,cAAc;EAChCC,gBAAgB,EAAE,EAAE;EACpBC,eAAe,EAAEC,SAAS;EAC1BC,WAAW,EAAE,IAAIC,0BAAiB,CAAC,CAAC;EACpCC,OAAO,EAAEC,OAAO,CAACC,GAAG,CAACC,cAAc,IAAI,KAAK;EAC5CC,QAAQ,EAAE;IACR;AACJ;AACA;AACA;AACA;AACA;IACIC,sCAAsC,EAAE,KAAK;IAE7C;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;IACIC,kBAAkB,EAAE,KAAK;IAEzB;AACJ;AACA;AACA;AACA;IACIC,SAAS,EAAE;MACT;AACN;AACA;AACA;AACA;MACMC,KAAK,EAAEP,OAAO,CAACC,GAAG,CAACO,iBAAiB,IAAI,+BAA+B;MAEvE;AACN;AACA;MACMC,WAAW,EAAET,OAAO,CAACC,GAAG,CAACS,uBAAuB,IAAI,qCAAqC;MAEzF;AACN;AACA;AACA;AACA;MACMC,GAAG,EAAEX,OAAO,CAACC,GAAG,CAACW,eAAe,IAAI;IACtC,CAAC;IAED;AACJ;AACA;AACA;AACA;IACIC,eAAe,EAAE,IAAI;IAErB;AACJ;AACA;;IAEIC,yBAAyB,EAAE,CAAC,sBAAsB,CAAC;IAEnD;AACJ;AACA;AACA;AACA;IACIC,cAAc,EAAE;EAClB,CAAC;EACDC,MAAM,EAAE;IACNC,oBAAoB,EAAE;MACpBV,KAAK,EAAEP,OAAO,CAACC,GAAG,CAACO,iBAAiB,IAAI,+BAA+B;MACvEU,eAAe,EAAElB,OAAO,CAACC,GAAG,CAACO,iBAAiB,IAAI;IACpD,CAAC;IACDK,eAAe,EAAE;EACnB,CAAC;EACDM,OAAO,EAAE;IACPC,IAAI,EAAE,CAAC,YAAY,EAAE,aAAa;EACpC,CAAC;EACDC,OAAO,EAAE;IACP;AACJ;AACA;AACA;IACIC,QAAQ,EAAE;EACZ,CAAC;EACDC,kBAAkB,EAAE;IAClBC,UAAU,EAAE,EAAE;IACdC,UAAU,EAAE;EACd,CAAC;EACDC,OAAO,EAAE;IACPC,cAAc,EAAEC,2BAAkB;IAClCC,gBAAgB,EAAED;EACpB;AACF,CAAC","ignoreList":[]}

package/dist/lib/batcher.js

@@ -302,7 +302,7 @@ var Batcher = _webexPlugin.default.extend({
   fingerprintResponse: function fingerprintResponse(item) {
     throw new Error('fingerprintResponse() must be implemented');
   },
-  version: "3.12.0-next.32"
+  version: "3.12.0-next.34"
 });
 var _default2 = exports.default = Batcher;
 //# sourceMappingURL=batcher.js.map

package/dist/lib/credentials/credentials.js

@@ -600,7 +600,7 @@ var Credentials = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
       this.refresh();
     }
   },
-  version: "3.12.0-next.32"
+  version: "3.12.0-next.34"
 }, (0, _applyDecoratedDescriptor2.default)(_obj, "getUserToken", [_dec, _dec2], (0, _getOwnPropertyDescriptor.default)(_obj, "getUserToken"), _obj), (0, _applyDecoratedDescriptor2.default)(_obj, "initialize", [_dec3], (0, _getOwnPropertyDescriptor.default)(_obj, "initialize"), _obj), (0, _applyDecoratedDescriptor2.default)(_obj, "invalidate", [_common.oneFlight, _dec4], (0, _getOwnPropertyDescriptor.default)(_obj, "invalidate"), _obj), (0, _applyDecoratedDescriptor2.default)(_obj, "refresh", [_common.oneFlight, _dec5, _dec6], (0, _getOwnPropertyDescriptor.default)(_obj, "refresh"), _obj), _obj));
 var _default = exports.default = Credentials;
 //# sourceMappingURL=credentials.js.map

package/dist/lib/credentials/token.js

@@ -532,7 +532,7 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
       return res.body;
     });
   },
-  version: "3.12.0-next.32"
+  version: "3.12.0-next.34"
 }, (0, _applyDecoratedDescriptor2.default)(_obj, "downscope", [_dec], (0, _getOwnPropertyDescriptor.default)(_obj, "downscope"), _obj), (0, _applyDecoratedDescriptor2.default)(_obj, "refresh", [_common.oneFlight], (0, _getOwnPropertyDescriptor.default)(_obj, "refresh"), _obj), (0, _applyDecoratedDescriptor2.default)(_obj, "revoke", [_common.oneFlight], (0, _getOwnPropertyDescriptor.default)(_obj, "revoke"), _obj), _obj));
 var _default = exports.default = Token;
 //# sourceMappingURL=token.js.map

package/dist/lib/services/services.js

@@ -73,6 +73,21 @@ var Services = _webexPlugin.default.extend({
     validateDomains: ['boolean', false, true],
     initFailed: ['boolean', false, false]
   },
+  session: {
+    /**
+     * Becomes `true` once the initial catalog collection has completed
+     * (successfully or otherwise) and any in-flight credentials refresh has
+     * settled. Blocks `webex.ready` so consumers can rely on `webex.ready`
+     * implying "catalogs populated AND credential state stable".
+     * @instance
+     * @memberof Services
+     * @type {boolean}
+     */
+    ready: {
+      default: false,
+      type: 'boolean'
+    }
+  },
   _catalogs: new _weakMap.default(),
   _serviceUrls: null,
   _hostCatalog: null,
@@ -1350,6 +1365,7 @@ var Services = _webexPlugin.default.extend({
 
     // Destructure the credentials plugin.
     var credentials = this.webex.credentials;
+    var catalog = this._getCatalog();
 
     // Init a promise chain. Must be done as a Promise.resolve() to allow
     // credentials#getOrgId() to properly throw.
@@ -1366,9 +1382,13 @@ var Services = _webexPlugin.default.extend({
     }).then(function () {
       // Validate if the token is authorized.
       if (credentials.canAuthorize) {
-        // Attempt to collect the postauth catalog.
-
-        return _this0.updateServices().catch(function () {
+        // Attempt to collect the postauth catalog, then mark the catalog
+        // ready. Setting `isReady` here - rather than only in the init
+        // callers - means a slow postauth fetch that loses the gated-init
+        // timeout race still marks the catalog ready once it completes.
+        return _this0.updateServices().then(function () {
+          catalog.isReady = true;
+        }).catch(function () {
           _this0.initFailed = true;
           _this0.logger.warn('services: cannot retrieve postauth catalog');
         });
@@ -1378,6 +1398,42 @@ var Services = _webexPlugin.default.extend({
       return _promise.default.resolve();
     });
   },
+  /**
+   * Await any in-flight credentials refresh, then flip `services.ready` so
+   * `webex.ready` can fire. Closes the parallel-refresh window: if a credential
+   * refresh is in flight when initial catalog collection settles, we must not
+   * signal ready until the refresh has resolved - otherwise downstream
+   * consumers may observe `canAuthorize`/token state that is about to change
+   * under them.
+   *
+   * @private
+   * @returns {Promise<void>}
+   */
+  _finalizeReady: function _finalizeReady() {
+    var _this1 = this;
+    return (0, _asyncToGenerator2.default)(/*#__PURE__*/_regenerator.default.mark(function _callee4() {
+      var credentials;
+      return _regenerator.default.wrap(function (_context4) {
+        while (1) switch (_context4.prev = _context4.next) {
+          case 0:
+            credentials = _this1.webex.credentials;
+            if (!(credentials && credentials.isRefreshing)) {
+              _context4.next = 1;
+              break;
+            }
+            _context4.next = 1;
+            return new _promise.default(function (resolve) {
+              credentials.once('change:isRefreshing', resolve);
+            });
+          case 1:
+            _this1.ready = true;
+          case 2:
+          case "end":
+            return _context4.stop();
+        }
+      }, _callee4);
+    }))();
+  },
   /**
    * Initializer
    *
@@ -1386,7 +1442,7 @@ var Services = _webexPlugin.default.extend({
    * @returns {Services}
    */
   initialize: function initialize() {
-    var _this1 = this;
+    var _this10 = this;
     var catalog = new _serviceCatalog.default();
     var registry = new _serviceRegistry.default();
     var state = new _serviceState.default();
@@ -1394,56 +1450,168 @@ var Services = _webexPlugin.default.extend({
     this.registries.set(this.webex, registry);
     this.states.set(this.webex, state);
 
-    // Listen for configuration changes once.
+    // Listen for configuration changes once. The config is not populated on the
+    // webex instance until the `change:config` event fires, so any decision that
+    // depends on config values (such as the gated-vs-ungated init below) must be
+    // made from within this handler rather than synchronously in `initialize()`.
     this.listenToOnce(this.webex, 'change:config', function () {
-      _this1.initConfig();
-    });
+      var _this10$webex$config, _this10$webex$config$;
+      _this10.initConfig();
 
+      // Feature flag: when enabled, `webex.ready` is blocked until the initial
+      // catalog collection has settled AND any in-flight credentials refresh has
+      // completed. When disabled (the default), preserves the pre-existing
+      // behavior where `webex.ready` fires as soon as `webex.loaded` does and
+      // the catalog is collected out-of-band.
+      var waitForCatalogInit = ((_this10$webex$config = _this10.webex.config) === null || _this10$webex$config === void 0 ? void 0 : (_this10$webex$config$ = _this10$webex$config.services) === null || _this10$webex$config$ === void 0 ? void 0 : _this10$webex$config$.waitForCatalogInit) === true;
+      if (waitForCatalogInit) {
+        _this10._initializeCatalogsGated(catalog);
+      } else {
+        // Not gating - immediately mark ready so we do not block webex.ready.
+        _this10.ready = true;
+        _this10._initializeCatalogsUngated(catalog);
+      }
+    });
+  },
+  /**
+   * Original (pre-verified-ready) initialization path. Runs on `webex.ready`
+   * and collects catalogs opportunistically without blocking anything.
+   *
+   * @private
+   * @param {ServiceCatalog} catalog
+   * @returns {void}
+   */
+  _initializeCatalogsUngated: function _initializeCatalogsUngated(catalog) {
+    var _this11 = this;
     // wait for webex instance to be ready before attempting
     // to update the service catalogs
     // this can cause a race condition because credentials may
     // not be valid when services is initialized
-    this.listenToOnce(this.webex, 'ready', /*#__PURE__*/(0, _asyncToGenerator2.default)(/*#__PURE__*/_regenerator.default.mark(function _callee4() {
+    this.listenToOnce(this.webex, 'ready', /*#__PURE__*/(0, _asyncToGenerator2.default)(/*#__PURE__*/_regenerator.default.mark(function _callee5() {
       var cachedCatalog, supertoken, email;
-      return _regenerator.default.wrap(function (_context4) {
-        while (1) switch (_context4.prev = _context4.next) {
+      return _regenerator.default.wrap(function (_context5) {
+        while (1) switch (_context5.prev = _context5.next) {
           case 0:
-            _context4.next = 1;
-            return _this1._loadCatalogFromCache();
+            _context5.next = 1;
+            return _this11._loadCatalogFromCache();
           case 1:
-            cachedCatalog = _context4.sent;
+            cachedCatalog = _context5.sent;
             if (!cachedCatalog) {
-              _context4.next = 2;
+              _context5.next = 2;
               break;
             }
             catalog.isReady = true;
-            return _context4.abrupt("return");
+            return _context5.abrupt("return");
           case 2:
-            supertoken = _this1.webex.credentials.supertoken; // Validate if the supertoken exists.
+            supertoken = _this11.webex.credentials.supertoken; // Validate if the supertoken exists.
             if (supertoken && supertoken.access_token) {
-              _this1.initServiceCatalogs().then(function () {
-                catalog.isReady = true;
-              }).catch(function (error) {
-                _this1.initFailed = true;
-                _this1.logger.error("services: failed to init initial services when credentials available, ".concat(error === null || error === void 0 ? void 0 : error.message));
+              // `initServiceCatalogs` marks the catalog ready internally once the
+              // postauth catalog is collected.
+              _this11.initServiceCatalogs().catch(function (error) {
+                _this11.initFailed = true;
+                _this11.logger.error("services: failed to init initial services when credentials available, ".concat(error === null || error === void 0 ? void 0 : error.message));
               });
             } else {
-              email = _this1.webex.config.email;
-              _this1.collectPreauthCatalog(email ? {
+              email = _this11.webex.config.email;
+              _this11.collectPreauthCatalog(email ? {
                 email: email
               } : undefined).catch(function (error) {
-                _this1.initFailed = true;
-                _this1.logger.error("services: failed to init initial services when no credentials available, ".concat(error === null || error === void 0 ? void 0 : error.message));
+                _this11.initFailed = true;
+                _this11.logger.error("services: failed to init initial services when no credentials available, ".concat(error === null || error === void 0 ? void 0 : error.message));
               });
             }
           case 3:
           case "end":
-            return _context4.stop();
+            return _context5.stop();
         }
-      }, _callee4);
+      }, _callee5);
+    })));
+  },
+  /**
+   * Verified-ready initialization path. Blocks `webex.ready` until the initial
+   * catalog fetch has settled (or timed out) AND any in-flight credentials
+   * refresh has completed. Also handles the fresh-login case where OAuth
+   * completes after `loaded` fires.
+   *
+   * @private
+   * @param {ServiceCatalog} catalog
+   * @returns {void}
+   */
+  _initializeCatalogsGated: function _initializeCatalogsGated(catalog) {
+    var _this12 = this;
+    // Wait for storage to be loaded before attempting to update the service
+    // catalogs. We listen for 'loaded' instead of 'ready' because `services.ready`
+    // now blocks `webex.ready` - listening to 'ready' would deadlock.
+    this.listenToOnce(this.webex, 'loaded', /*#__PURE__*/(0, _asyncToGenerator2.default)(/*#__PURE__*/_regenerator.default.mark(function _callee6() {
+      var _this12$webex$config, _this12$webex$config$;
+      var cachedCatalog, supertoken, initTimeoutMs, initServiceCatalogsTimeout, email;
+      return _regenerator.default.wrap(function (_context6) {
+        while (1) switch (_context6.prev = _context6.next) {
+          case 0:
+            _context6.next = 1;
+            return _this12._loadCatalogFromCache();
+          case 1:
+            cachedCatalog = _context6.sent;
+            if (!cachedCatalog) {
+              _context6.next = 3;
+              break;
+            }
+            catalog.isReady = true;
+            _context6.next = 2;
+            return _this12._finalizeReady();
+          case 2:
+            return _context6.abrupt("return");
+          case 3:
+            supertoken = _this12.webex.credentials.supertoken; // Race init against a hard timeout so a hung request never leaves
+            // `services.ready` false forever - that would stall `webex.ready` and
+            // leave consumers waiting on it indefinitely. Timeout is configurable via
+            // `config.services.catalogInitTimeout` (defaults to 15s in config).
+            initTimeoutMs = (_this12$webex$config = _this12.webex.config) === null || _this12$webex$config === void 0 ? void 0 : (_this12$webex$config$ = _this12$webex$config.services) === null || _this12$webex$config$ === void 0 ? void 0 : _this12$webex$config$.catalogInitTimeout;
+            initServiceCatalogsTimeout = new _promise.default(function (_, reject) {
+              setTimeout(function () {
+                return reject(new Error("services: init timed out after ".concat(initTimeoutMs, "ms")));
+              }, initTimeoutMs);
+            }); // Validate if the supertoken exists.
+            if (supertoken && supertoken.access_token) {
+              // `initServiceCatalogs` marks the catalog ready internally once the
+              // postauth catalog is collected - even if it loses the timeout race
+              // above, so a slow fetch still eventually flips `catalog.isReady`.
+              _promise.default.race([_this12.initServiceCatalogs(), initServiceCatalogsTimeout]).catch(function (error) {
+                _this12.initFailed = true;
+                _this12.logger.error("services: failed to init initial services when credentials available, ".concat(error === null || error === void 0 ? void 0 : error.message));
+              }).finally(function () {
+                return _this12._finalizeReady();
+              });
+            } else {
+              email = _this12.webex.config.email;
+              _promise.default.race([_this12.collectPreauthCatalog(email ? {
+                email: email
+              } : undefined), initServiceCatalogsTimeout]).catch(function (error) {
+                _this12.initFailed = true;
+                _this12.logger.error("services: failed to init initial services when no credentials available, ".concat(error === null || error === void 0 ? void 0 : error.message));
+              }).finally(function () {
+                return _this12._finalizeReady();
+              });
+
+              // Handle fresh login: 'loaded' fires before OAuth completes, so listen
+              // for `canAuthorize` flipping true and then collect the postauth catalog.
+              _this12.listenToOnce(_this12.webex, 'change:canAuthorize', function () {
+                if (_this12.webex.canAuthorize && !catalog.status.postauth.ready) {
+                  // `initServiceCatalogs` marks the catalog ready internally.
+                  _this12.initServiceCatalogs().catch(function (error) {
+                    _this12.logger.error("services: failed to init service catalogs after auth, ".concat(error === null || error === void 0 ? void 0 : error.message));
+                  });
+                }
+              });
+            }
+          case 4:
+          case "end":
+            return _context6.stop();
+        }
+      }, _callee6);
     })));
   },
-  version: "3.12.0-next.32"
+  version: "3.12.0-next.34"
 });
 /* eslint-enable no-underscore-dangle */
 var _default = exports.default = Services;