@webority/mobile-core 0.0.23

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Webority Technologies
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,39 @@
+# @webority/mobile-core
+
+The platform layer for Webority React Native apps: HTTP clients, auth and token storage, config,
+logging, formatters, validators, network status, permissions, storage, image compression and
+version checks. **No UI** — components live in
+[`@webority/mobile-ui`](https://www.npmjs.com/package/@webority/mobile-ui).
+
+```bash
+npm install @webority/mobile-core
+```
+
+Runtime dependencies: `axios` and `libphonenumber-js`. The required peers are `expo`,
+`expo-application`, `expo-network`, `expo-secure-store` (the HTTP client reads the bearer token from
+it) and `expo-sqlite`. Every other native peer is optional and reached only through its own import
+path below, so the package installs and runs without any of them. `react-native-keychain` is no
+longer used; token storage moved to `expo-secure-store`.
+
+Full documentation lives in the repository's `docs/` directory.
+
+
+## Import paths
+
+Anything needing a native package lives behind its own path, so an app only bundles what it
+imports:
+
+```ts
+import { Permissions } from '@webority/mobile-core/permissions';
+import { Geolocation } from '@webority/mobile-core/geolocation';
+import { openDatabase } from '@webority/mobile-core/sqlite';
+import { downloadFile } from '@webority/mobile-core/download';
+import { shareFile } from '@webority/mobile-core/share';
+import { compressImage } from '@webority/mobile-core/compressor';
+```
+
+Metro resolves requires statically, so anything reachable from the main barrel is bundled for
+every consumer. Keeping these off it is what makes their peers genuinely optional.
+
+Storage and network status stay on the main barrel but load no package on their own. Wire them at
+startup with `setStorageImplementation` and `setNetworkStatusImplementation` if you want them.

package/android/build.gradle

@@ -0,0 +1,65 @@
+buildscript {
+    ext.safeExtGet = { prop, fallback ->
+        rootProject.ext.has(prop) ? rootProject.ext.get(prop) : fallback
+    }
+    repositories {
+        google()
+        gradlePluginPortal()
+    }
+    dependencies {
+        classpath("org.jetbrains.kotlin:kotlin-gradle-plugin:${safeExtGet("kotlinVersion", "2.1.20")}")
+    }
+}
+
+def isNewArchitectureEnabled() {
+    return project.hasProperty("newArchEnabled") && project.newArchEnabled == "true"
+}
+
+apply plugin: "com.android.library"
+apply plugin: "kotlin-android"
+
+if (isNewArchitectureEnabled()) {
+    apply plugin: "com.facebook.react"
+}
+
+android {
+    namespace "com.webority.mobilecore.smsretriever"
+
+    buildToolsVersion safeExtGet("buildToolsVersion", "36.0.0")
+    compileSdkVersion safeExtGet("compileSdkVersion", 36)
+
+    buildFeatures {
+        buildConfig true
+    }
+    defaultConfig {
+        buildConfigField("boolean", "IS_NEW_ARCHITECTURE_ENABLED", isNewArchitectureEnabled().toString())
+        minSdkVersion safeExtGet("minSdkVersion", 24)
+        targetSdkVersion safeExtGet("targetSdkVersion", 36)
+    }
+    lintOptions {
+        abortOnError false
+    }
+    sourceSets {
+        main {
+            if (isNewArchitectureEnabled()) {
+                java.srcDirs += ["src/newarch"]
+            } else {
+                java.srcDirs += ["src/oldarch"]
+            }
+        }
+    }
+}
+
+repositories {
+    maven {
+        url("$rootDir/../node_modules/react-native/android")
+    }
+    google()
+    mavenCentral()
+}
+
+dependencies {
+    //noinspection GradleDynamicVersion
+    implementation "com.facebook.react:react-native:+"
+    implementation "com.google.android.gms:play-services-auth-api-phone:18.3.0"
+}

package/android/src/newarch/java/com/webority/mobilecore/smsretriever/AppSignatureHelper.kt

@@ -0,0 +1,57 @@
+package com.webority.mobilecore.smsretriever
+
+import android.content.pm.PackageManager
+import android.util.Base64
+import android.util.Log
+import com.facebook.react.bridge.ReactApplicationContext
+import java.security.MessageDigest
+
+/**
+ * The 11-character app-signature hash the SMS Retriever API matches against
+ * an incoming message — the backend appends this same hash so Play Services
+ * knows which app to hand the SMS to, with no SMS permission granted.
+ * Algorithm is Google's own (SHA-256 of "<packageName> <signature>", first 9
+ * bytes, base64 NO_PADDING/NO_WRAP, first 11 chars) — not our own scheme.
+ */
+class AppSignatureHelper(private val context: ReactApplicationContext) {
+  companion object {
+    private const val HASH_TYPE = "SHA-256"
+    private const val NUM_HASHED_BYTES = 9
+    private const val NUM_BASE64_CHAR = 11
+    private const val TAG = "AppSignatureHelper"
+  }
+
+  fun getAppSignatures(): List<String> {
+    val appCodes = mutableListOf<String>()
+    try {
+      val packageName = context.packageName
+      val packageManager = context.packageManager
+      @Suppress("DEPRECATION")
+      val signatures = packageManager.getPackageInfo(
+        packageName,
+        PackageManager.GET_SIGNATURES
+      ).signatures
+
+      for (signature in signatures ?: emptyArray()) {
+        hash(packageName, signature.toCharsString())?.let { appCodes.add(it) }
+      }
+    } catch (e: Exception) {
+      Log.e(TAG, "Error getting app signature", e)
+    }
+    return appCodes
+  }
+
+  private fun hash(packageName: String, signature: String): String? {
+    val appInfo = "$packageName $signature"
+    return try {
+      val digest = MessageDigest.getInstance(HASH_TYPE)
+      digest.update(appInfo.toByteArray())
+      val truncated = digest.digest().copyOfRange(0, NUM_HASHED_BYTES)
+      Base64.encodeToString(truncated, Base64.NO_PADDING or Base64.NO_WRAP)
+        .substring(0, NUM_BASE64_CHAR)
+    } catch (e: Exception) {
+      Log.e(TAG, "Hash generation failed", e)
+      null
+    }
+  }
+}

package/android/src/newarch/java/com/webority/mobilecore/smsretriever/SmsRetrieverModule.kt

@@ -0,0 +1,20 @@
+package com.webority.mobilecore.smsretriever
+
+import com.facebook.react.bridge.Promise
+import com.facebook.react.bridge.ReactApplicationContext
+
+class SmsRetrieverModule(reactContext: ReactApplicationContext) :
+  NativeSmsRetrieverSpec(reactContext) {
+
+  companion object {
+    const val NAME = "WeborityMobileCoreSmsRetriever"
+  }
+
+  private val impl = SmsRetrieverModuleImpl(reactContext)
+
+  override fun startSMSListener() = impl.startSMSListener()
+
+  override fun stopSMSListener() = impl.stopSMSListener()
+
+  override fun getAppHash(promise: Promise) = impl.getAppHash(promise)
+}

package/android/src/newarch/java/com/webority/mobilecore/smsretriever/SmsRetrieverModuleImpl.kt

@@ -0,0 +1,146 @@
+package com.webority.mobilecore.smsretriever
+
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
+import android.os.Build
+import android.util.Log
+import androidx.core.content.ContextCompat
+import com.facebook.react.bridge.Arguments
+import com.facebook.react.bridge.Promise
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.modules.core.DeviceEventManagerModule
+import com.google.android.gms.auth.api.phone.SmsRetriever
+import com.google.android.gms.auth.api.phone.SmsRetrieverClient
+import com.google.android.gms.common.api.CommonStatusCodes
+import com.google.android.gms.common.api.Status
+
+private enum class SmsErrorType { TIMEOUT, SERVICE_UNAVAILABLE, UNKNOWN_ERROR }
+
+/**
+ * Wraps the Play Services SMS Retriever API. Emits the raw SMS text on
+ * success — OTP extraction is a JS-side concern (see smsRetriever/index.ts),
+ * since the expected format varies per backend and this module's only job
+ * is retrieving the message with no SMS permission required.
+ */
+class SmsRetrieverModuleImpl(private val reactContext: ReactApplicationContext) {
+  companion object {
+    const val NAME = "WeborityMobileCoreSmsRetriever"
+    private const val TAG = "SmsRetrieverModuleImpl"
+    private const val OTP_EVENT = "WeborityMobileCoreSmsRetrieved"
+    private const val ERROR_EVENT = "WeborityMobileCoreSmsRetrieverError"
+  }
+
+  private var isRegistered = false
+  private var isListening = false
+
+  private val receiver = object : BroadcastReceiver() {
+    override fun onReceive(context: Context, intent: Intent) {
+      if (SmsRetriever.SMS_RETRIEVED_ACTION != intent.action) {
+        return
+      }
+      val status = intent.extras?.getParcelable<Status>(SmsRetriever.EXTRA_STATUS)
+      if (status == null) {
+        emitError(SmsErrorType.UNKNOWN_ERROR, "Invalid SMS status")
+        return
+      }
+      when (status.statusCode) {
+        CommonStatusCodes.SUCCESS -> {
+          val message = intent.extras?.getString(SmsRetriever.EXTRA_SMS_MESSAGE)
+          if (message.isNullOrBlank()) {
+            emitError(SmsErrorType.UNKNOWN_ERROR, "Empty SMS message")
+          } else {
+            emitMessage(message)
+          }
+        }
+        CommonStatusCodes.TIMEOUT ->
+          emitError(SmsErrorType.TIMEOUT, "SMS retrieval timeout")
+        else ->
+          emitError(SmsErrorType.SERVICE_UNAVAILABLE, "SMS Retriever status ${status.statusCode}")
+      }
+    }
+  }
+
+  private fun emitMessage(message: String) {
+    isListening = false
+    val payload = Arguments.createMap().apply { putString("message", message) }
+    reactContext.getJSModule(DeviceEventManagerModule.RCTDeviceEventEmitter::class.java)
+      .emit(OTP_EVENT, payload)
+  }
+
+  private fun emitError(type: SmsErrorType, message: String) {
+    Log.w(TAG, "$type: $message")
+    isListening = false
+    val payload = Arguments.createMap().apply {
+      putString("type", type.name)
+      putString("message", message)
+    }
+    reactContext.getJSModule(DeviceEventManagerModule.RCTDeviceEventEmitter::class.java)
+      .emit(ERROR_EVENT, payload)
+  }
+
+  fun startSMSListener() {
+    if (isListening) {
+      return
+    }
+    try {
+      val client: SmsRetrieverClient = SmsRetriever.getClient(reactContext)
+      client.startSmsRetriever()
+        .addOnSuccessListener {
+          registerReceiver()
+          isListening = true
+        }
+        .addOnFailureListener { exception ->
+          emitError(SmsErrorType.SERVICE_UNAVAILABLE, exception.message ?: "startSmsRetriever failed")
+        }
+    } catch (e: Exception) {
+      emitError(SmsErrorType.UNKNOWN_ERROR, e.message ?: "startSMSListener threw")
+    }
+  }
+
+  private fun registerReceiver() {
+    if (isRegistered) {
+      return
+    }
+    try {
+      val filter = IntentFilter(SmsRetriever.SMS_RETRIEVED_ACTION)
+      if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+        ContextCompat.registerReceiver(reactContext, receiver, filter, ContextCompat.RECEIVER_EXPORTED)
+      } else {
+        ContextCompat.registerReceiver(reactContext, receiver, filter, ContextCompat.RECEIVER_NOT_EXPORTED)
+      }
+      isRegistered = true
+    } catch (e: Exception) {
+      emitError(SmsErrorType.UNKNOWN_ERROR, e.message ?: "Failed to register SMS receiver")
+    }
+  }
+
+  fun stopSMSListener() {
+    if (!isRegistered) {
+      isListening = false
+      return
+    }
+    try {
+      reactContext.unregisterReceiver(receiver)
+    } catch (e: IllegalArgumentException) {
+      // Already unregistered — not an error, the OS may have torn it down first.
+    } finally {
+      isRegistered = false
+      isListening = false
+    }
+  }
+
+  fun getAppHash(promise: Promise) {
+    try {
+      val hash = AppSignatureHelper(reactContext).getAppSignatures().firstOrNull()
+      if (hash == null) {
+        promise.reject("NO_SIGNATURES", "No app signatures found")
+      } else {
+        promise.resolve(hash)
+      }
+    } catch (e: Exception) {
+      promise.reject("HASH_ERROR", "Failed to get app hash: ${e.message}")
+    }
+  }
+}

package/android/src/newarch/java/com/webority/mobilecore/smsretriever/SmsRetrieverPackage.kt

@@ -0,0 +1,33 @@
+package com.webority.mobilecore.smsretriever
+
+import com.facebook.react.TurboReactPackage
+import com.facebook.react.bridge.NativeModule
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.module.model.ReactModuleInfo
+import com.facebook.react.module.model.ReactModuleInfoProvider
+
+class SmsRetrieverPackage : TurboReactPackage() {
+
+  override fun getModule(name: String, reactContext: ReactApplicationContext): NativeModule? {
+    return if (name == SmsRetrieverModule.NAME) {
+      SmsRetrieverModule(reactContext)
+    } else {
+      null
+    }
+  }
+
+  override fun getReactModuleInfoProvider(): ReactModuleInfoProvider {
+    return ReactModuleInfoProvider {
+      mapOf(
+          SmsRetrieverModule.NAME to
+              ReactModuleInfo(
+                  SmsRetrieverModule.NAME,
+                  SmsRetrieverModule.NAME,
+                  false, // canOverrideExistingModule
+                  false, // needsEagerInit
+                  false, // isCxxModule
+                  true // isTurboModule
+                  ))
+    }
+  }
+}

package/lib/commonjs/api/baseUrl.js

@@ -0,0 +1,34 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.applyConfiguredBaseUrl = void 0;
+var _index = require("../config/index.js");
+/**
+ * Resolves `baseURL` PER REQUEST rather than at module evaluation.
+ *
+ * `axios.create({ baseURL: getConfigValue('baseUrl') })` reads the value once,
+ * when the module is first imported — which happens the moment anything touches
+ * the package barrel, long before an app's startup code can call `setConfig`.
+ * The result was a client permanently pinned to `undefined` and a `setConfig`
+ * that appeared to do nothing, with no error anywhere: requests just went to a
+ * relative URL.
+ *
+ * A consumer cannot fix that by ordering its own imports, because the import
+ * that loses the race is usually one it never wrote. So the clients stop
+ * capturing the value and ask for it per request instead.
+ *
+ * An explicit per-request `baseURL` still wins, which is what keeps a one-off
+ * call to a different host possible.
+ */
+const applyConfiguredBaseUrl = client => {
+  client.interceptors.request.use(config => {
+    if (!config.baseURL) {
+      config.baseURL = (0, _index.getConfigValue)('baseUrl') ?? undefined;
+    }
+    return config;
+  });
+};
+exports.applyConfiguredBaseUrl = applyConfiguredBaseUrl;
+//# sourceMappingURL=baseUrl.js.map

package/lib/commonjs/api/curl.js

@@ -0,0 +1,109 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.logCurl = exports.buildCurl = void 0;
+var _index = require("../logger/index.js");
+/**
+ * Header names whose VALUE is a credential. Matched case-insensitively against
+ * the whole name, since `Authorization` and `authorization` are the same header
+ * and axios does not normalise the case of headers a caller sets by hand.
+ */
+const SECRET_HEADERS = new Set(['authorization', 'proxy-authorization', 'cookie', 'set-cookie', 'x-api-key', 'x-auth-token', 'x-access-token', 'x-refresh-token', 'api-key']);
+
+/**
+ * Body fields whose value is a credential. Matched on the key alone, so this
+ * catches `password`, `newPassword` and `password_confirmation` alike.
+ */
+const SECRET_BODY_PATTERN = /pass(word|code)|secret|token|otp|pin|cvv|authoriz/i;
+
+/** The axios per-method header buckets, which are config plumbing, not headers. */
+const AXIOS_METHOD_KEYS = new Set(['common', 'delete', 'get', 'head', 'post', 'put', 'patch']);
+const REDACTED = '<redacted>';
+const redactBody = (value, seen, depth = 0) => {
+  if (value === null || typeof value !== 'object') {
+    return value;
+  }
+  // Both guards are needed and they catch different shapes. `seen` breaks a
+  // true cycle, which would otherwise recurse forever AND make the eventual
+  // JSON.stringify throw. The depth bound catches a body that is merely
+  // enormous. A curl line is a debugging aid, and it must never be able to
+  // hang or fail the request it is describing.
+  if (seen.has(value)) {
+    return '<circular>';
+  }
+  if (depth > 6) {
+    return '<truncated>';
+  }
+  seen.add(value);
+  if (Array.isArray(value)) {
+    return value.map(entry => redactBody(entry, seen, depth + 1));
+  }
+  const out = {};
+  for (const [key, entry] of Object.entries(value)) {
+    out[key] = SECRET_BODY_PATTERN.test(key) ? REDACTED : redactBody(entry, seen, depth + 1);
+  }
+  return out;
+};
+const buildUrl = config => {
+  const url = config.url ?? '';
+  const base = config.baseURL ? config.baseURL.replace(/\/$/, '') : '';
+  let complete = url.startsWith('http') ? url : `${base}/${url.replace(/^\//, '')}`;
+  if (config.params) {
+    const query = new URLSearchParams(config.params).toString();
+    if (query) {
+      complete += (complete.includes('?') ? '&' : '?') + query;
+    }
+  }
+  return complete;
+};
+
+/**
+ * Builds a copy-pasteable curl command for a request, with every credential
+ * replaced by a placeholder.
+ *
+ * The redaction is the point, not a nicety. An unredacted version of this in a
+ * consumer app put `Authorization: Bearer <token>` and the login request's
+ * plaintext password into the device console of a *release* staging build.
+ * A curl line is worth having; a curl line that has to be trusted not to be
+ * enabled in the wrong build is not.
+ */
+const buildCurl = config => {
+  const method = (config.method ?? 'get').toUpperCase();
+  let command = `curl -X ${method} "${buildUrl(config)}"`;
+  const headers = config.headers;
+  if (headers) {
+    for (const [key, value] of Object.entries(headers)) {
+      if (AXIOS_METHOD_KEYS.has(key)) {
+        continue;
+      }
+      if (typeof value !== 'string' && typeof value !== 'number') {
+        continue;
+      }
+      const shown = SECRET_HEADERS.has(key.toLowerCase()) ? REDACTED : value;
+      command += ` -H "${key}: ${shown}"`;
+    }
+  }
+  if (config.data !== undefined && config.data !== null) {
+    const redacted = typeof config.data === 'object' ? redactBody(config.data, new WeakSet()) : config.data;
+    const body = typeof redacted === 'object' ? JSON.stringify(redacted) : String(redacted);
+    command += ` -d '${body.replace(/'/g, "'\\''")}'`;
+  }
+  return command;
+};
+
+/**
+ * Logs the curl equivalent of a request. Never throws: a failure to describe a
+ * request must not be able to fail the request itself.
+ */
+exports.buildCurl = buildCurl;
+const logCurl = config => {
+  try {
+    _index.Logger.info('CURL Command:', buildCurl(config));
+  } catch (error) {
+    _index.Logger.warn('[api] Failed to build a curl command for the request', error);
+  }
+};
+exports.logCurl = logCurl;
+//# sourceMappingURL=curl.js.map

package/lib/commonjs/api/publicClient.js

@@ -0,0 +1,73 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = void 0;
+var _axios = _interopRequireDefault(require("axios"));
+var _index = require("../config/index.js");
+var _index2 = require("../logger/index.js");
+var _baseUrl = require("./baseUrl.js");
+var _curl = require("./curl.js");
+var _retry = require("./retry.js");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+// Define timeout for requests
+const REQUEST_TIMEOUT = 30000; // 30 seconds
+
+/**
+ * Public Axios Client
+ * - Base URL: Set your public API base URL.
+ * - No Authorization header is attached.
+ * - Includes timeout configuration and error handling.
+ * - Handles specific HTTP status codes.
+ */
+const publicClient = _axios.default.create({
+  headers: {
+    'Content-Type': 'application/json',
+    Accept: 'application/json',
+    'Accept-Encoding': 'gzip, deflate, br'
+  },
+  timeout: REQUEST_TIMEOUT
+});
+(0, _baseUrl.applyConfiguredBaseUrl)(publicClient);
+
+// Registered before the logging interceptors below so they only ever observe
+// the final outcome of a request, not its intermediate retries. The policy
+// itself, and why a bare network error is never retried, lives in ./retry.
+(0, _retry.attachRetry)(publicClient);
+
+// Add request interceptor for logging
+publicClient.interceptors.request.use(config => {
+  _index2.Logger.info(`Request: ${config.method?.toUpperCase()} ${config.url}`);
+  if ((0, _index.getConfigValue)('logCurl')) {
+    (0, _curl.logCurl)(config);
+  }
+  return config;
+}, error => {
+  const message = error instanceof Error ? error.message : String(error);
+  _index2.Logger.error('Request error:', message);
+  return Promise.reject(error);
+});
+
+// Add response interceptor for error handling
+publicClient.interceptors.response.use(response => {
+  _index2.Logger.info(`Response: ${response.status} from ${response.config.url}`);
+  return response;
+}, error => {
+  if (_axios.default.isAxiosError(error)) {
+    const originalRequest = error.config;
+    if (!error.response) {
+      _index2.Logger.error(`Network error or no response from server: ${error.message}, URL: ${originalRequest?.url}`);
+    } else {
+      const body = error.response.data;
+      const bodyText = body instanceof ArrayBuffer ? `binary response (${body.byteLength} bytes)` : typeof Blob !== 'undefined' && body instanceof Blob ? `binary response (${body.size} bytes)` : body ?? error.message;
+      _index2.Logger.error(`Response error: ${bodyText}, URL: ${originalRequest?.url}, Status: ${error.response.status}`);
+    }
+  } else {
+    const message = error instanceof Error ? error.message : String(error);
+    _index2.Logger.error(`Unknown response error: ${message}`);
+  }
+  return Promise.reject(error);
+});
+var _default = exports.default = publicClient;
+//# sourceMappingURL=publicClient.js.map

package/lib/commonjs/api/retry.js

@@ -0,0 +1,75 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.isRetryableStatus = exports.attachRetry = void 0;
+/**
+ * Status-based ONLY, deliberately: a bare network error (no `error.response`)
+ * is never retryable. Both clients carry non-idempotent requests, login and OTP
+ * on the public one and every write on the user one, and a broken connection
+ * says nothing about whether the request reached the server. Retrying can
+ * therefore create a second session, or a duplicate record, that the user never
+ * sees. A generic network-error retry rule is not a substitute: it decides on
+ * the transport alone and never looks at the HTTP method, so it retries POSTs
+ * as readily as GETs.
+ */
+const isRetryableStatus = status => typeof status === 'number' && (status === 429 || status >= 500 && status <= 599);
+exports.isRetryableStatus = isRetryableStatus;
+const DEFAULT_POLICY = {
+  retries: 3,
+  retryDelayMs: attempt => attempt <= 1 ? 0 : 2 ** attempt * 1000,
+  shouldRetry: error => isRetryableStatus(error.response?.status),
+  onRetry: () => undefined
+};
+const waitOrAbort = (delay, signal) => new Promise(resolve => {
+  const onAbort = () => {
+    clearTimeout(timer);
+    resolve(false);
+  };
+  const timer = setTimeout(() => {
+    signal?.removeEventListener?.('abort', onAbort);
+    resolve(true);
+  }, delay);
+  signal?.addEventListener?.('abort', onAbort, {
+    once: true
+  });
+});
+const attachRetry = (client, policy = {}) => {
+  client.interceptors.response.use(undefined, async error => {
+    const axiosError = error;
+    const config = axiosError?.config;
+    if (!config || config.retry === false) {
+      return Promise.reject(error);
+    }
+    const perRequest = typeof config.retry === 'object' ? config.retry : {};
+    const effective = {
+      ...DEFAULT_POLICY,
+      ...policy,
+      ...perRequest
+    };
+    const attempt = (config.__retryAttempt ?? 0) + 1;
+    if (attempt > effective.retries || !effective.shouldRetry(axiosError)) {
+      return Promise.reject(error);
+    }
+    if (config.signal?.aborted) {
+      return Promise.reject(error);
+    }
+
+    // The attempt count rides on the config, which axios copies onto the config
+    // of the retried request, so nested attempts continue the same count and
+    // separate requests never share one.
+    config.__retryAttempt = attempt;
+    // The body was serialised by the first pass; transforming it again would
+    // JSON-encode the already-encoded string.
+    config.transformRequest = [data => data];
+    effective.onRetry(attempt, axiosError);
+    const proceed = await waitOrAbort(effective.retryDelayMs(attempt), config.signal);
+    if (!proceed) {
+      return Promise.reject(error);
+    }
+    return client.request(config);
+  });
+};
+exports.attachRetry = attachRetry;
+//# sourceMappingURL=retry.js.map