@webority/mobile-core 0.0.24 → 0.0.26

package/LICENSE.txt

@@ -0,0 +1,9 @@
+Copyright (c) Webority Technologies. All rights reserved.
+
+This software and its NuGet packages are the proprietary and confidential property
+of Webority Technologies. They are published publicly only for the convenience of
+Webority's own projects and internal consumption.
+
+No license or right to use, copy, modify, merge, publish, distribute, sublicense,
+or create derivative works is granted to any third party. Unauthorized use,
+reproduction, or distribution is prohibited.

package/README.md

@@ -47,3 +47,16 @@ keeps push on calls `enablePush` at each start.
 
 Storage and network status stay on the main barrel but load no package on their own. Wire them at
 startup with `setStorageImplementation` and `setNetworkStatusImplementation` if you want them.
+
+## Quiet requests and log redaction
+
+Both HTTP clients log a failed response through `Logger.error`. For a call whose failure the app
+handles itself, pass `skipErrorLog: true` in the axios config and the clients stay silent:
+
+```ts
+await userClient.get('/status', { skipErrorLog: true });
+```
+
+`Logger` masks secrets in every message and argument before any sink sees them: `Bearer` tokens,
+JWT-shaped strings, and the values of keys named `token`, `accessToken`, `refreshToken`,
+`password` and `authorization` (any case) in objects and JSON strings.

package/lib/commonjs/api/multipart.js

@@ -0,0 +1,21 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.sendFormDataAsMultipart = void 0;
+/**
+ * The clients default to a JSON content type, and axios then serialises a FormData body to
+ * JSON, which breaks every upload. Dropping the header for FormData lets the platform write
+ * the multipart header with its boundary.
+ */
+const sendFormDataAsMultipart = client => {
+  client.interceptors.request.use(config => {
+    if (typeof FormData !== 'undefined' && config.data instanceof FormData) {
+      config.headers?.delete?.('Content-Type');
+    }
+    return config;
+  });
+};
+exports.sendFormDataAsMultipart = sendFormDataAsMultipart;
+//# sourceMappingURL=multipart.js.map

package/lib/commonjs/api/publicClient.js

@@ -7,8 +7,10 @@ exports.default = void 0;
 var _axios = _interopRequireDefault(require("axios"));
 var _index = require("../config/index.js");
 var _index2 = require("../logger/index.js");
+require("../types/axios.js");
 var _baseUrl = require("./baseUrl.js");
 var _curl = require("./curl.js");
+var _multipart = require("./multipart.js");
 var _retry = require("./retry.js");
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 // Define timeout for requests
@@ -30,6 +32,7 @@ const publicClient = _axios.default.create({
   timeout: REQUEST_TIMEOUT
 });
 (0, _baseUrl.applyConfiguredBaseUrl)(publicClient);
+(0, _multipart.sendFormDataAsMultipart)(publicClient);
 
 // Registered before the logging interceptors below so they only ever observe
 // the final outcome of a request, not its intermediate retries. The policy
@@ -56,6 +59,9 @@ publicClient.interceptors.response.use(response => {
 }, error => {
   if (_axios.default.isAxiosError(error)) {
     const originalRequest = error.config;
+    if (originalRequest?.skipErrorLog) {
+      return Promise.reject(error);
+    }
     if (!error.response) {
       _index2.Logger.error(`Network error or no response from server: ${error.message}, URL: ${originalRequest?.url}`);
     } else {

package/lib/commonjs/api/userClient.js

@@ -27,8 +27,10 @@ var _authStore = require("../auth/authStore.js");
 var _index = require("../config/index.js");
 var _index2 = require("../logger/index.js");
 var _networkStatus = require("../network/networkStatus.js");
+require("../types/axios.js");
 var _baseUrl = require("./baseUrl.js");
 var _curl = require("./curl.js");
+var _multipart = require("./multipart.js");
 var _retry = require("./retry.js");
 var _tokenRefresh = require("./tokenRefresh.js");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
@@ -45,6 +47,9 @@ class RequestOfflineError extends Error {
   constructor(message = 'Request blocked: device is offline') {
     super(message);
     this.name = 'RequestOfflineError';
+    // Babel's class transform can drop the prototype link, which makes
+    // `instanceof RequestOfflineError` false in the transpiled build.
+    Object.setPrototypeOf(this, RequestOfflineError.prototype);
   }
 }
 
@@ -135,6 +140,7 @@ const isRefreshTokenRequest = url => {
 // registered run last. The curl line therefore describes a request that already
 // has both its baseURL and its Authorization header.
 (0, _baseUrl.applyConfiguredBaseUrl)(userClient);
+(0, _multipart.sendFormDataAsMultipart)(userClient);
 
 // Registered BEFORE the auth interceptor below deliberately. Axios builds its
 // request chain by unshifting, so the FIRST-registered request interceptor runs
@@ -206,7 +212,9 @@ userClient.interceptors.response.use(response => response, async error => {
   const axiosError = error;
   const originalRequest = axiosError.config;
   if (!axiosError.response) {
-    _index2.Logger.error(`Network error or no response from server: ${axiosError.message}, URL: ${originalRequest?.url}`);
+    if (!originalRequest?.skipErrorLog) {
+      _index2.Logger.error(`Network error or no response from server: ${axiosError.message}, URL: ${originalRequest?.url}`);
+    }
     return Promise.reject(error);
   }
   if (axiosError.response.status === 401 && originalRequest && !originalRequest._retry) {
@@ -248,7 +256,9 @@ userClient.interceptors.response.use(response => response, async error => {
       return Promise.reject(err);
     }
   }
-  _index2.Logger.error(`Response error: ${axiosError.response?.data ?? axiosError.message}, URL: ${originalRequest?.url}, Status: ${axiosError.response.status}`);
+  if (!originalRequest?.skipErrorLog) {
+    _index2.Logger.error(`Response error: ${axiosError.response?.data ?? axiosError.message}, URL: ${originalRequest?.url}, Status: ${axiosError.response.status}`);
+  }
   return Promise.reject(error);
 });
 var _default = exports.default = userClient;

package/lib/commonjs/index.js

@@ -501,6 +501,12 @@ Object.defineProperty(exports, "publicClient", {
     return _publicClient.default;
   }
 });
+Object.defineProperty(exports, "refreshAccessToken", {
+  enumerable: true,
+  get: function () {
+    return _tokenRefresh.refreshAccessToken;
+  }
+});
 Object.defineProperty(exports, "removeToken", {
   enumerable: true,
   get: function () {
@@ -612,6 +618,7 @@ Object.defineProperty(exports, "validatePhoneNumberLength", {
 var _curl = require("./api/curl.js");
 var _publicClient = _interopRequireDefault(require("./api/publicClient.js"));
 var _retry = require("./api/retry.js");
+var _tokenRefresh = require("./api/tokenRefresh.js");
 var _userClient = _interopRequireWildcard(require("./api/userClient.js"));
 var _authStore = require("./auth/authStore.js");
 var _jwt = require("./auth/jwt.js");

package/lib/commonjs/logger/index.js

@@ -5,6 +5,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.setRemoteLogger = exports.setDeviceContext = exports.getDeviceContext = exports.configureLogger = exports.Logger = void 0;
 var _index = require("../config/index.js");
+var _redact = require("./redact.js");
 // ANSI color codes
 const Colors = {
   RESET: '\x1b[0m',
@@ -209,21 +210,27 @@ const forwardErrorToRemote = (err, context) => {
   }
   safe(() => remote?.recordError?.(err, buildErrorContext(context, suppressedCount)));
 };
-const logInfo = (message, ...optionalParams) => {
+const logInfo = (rawMessage, ...rawParams) => {
+  const message = (0, _redact.redactString)(rawMessage);
+  const optionalParams = (0, _redact.redact)(rawParams);
   if (!isEnabled() || !isLogLevelAllowed(LogLevels.INFO.level)) {
     return;
   }
   console.info(`${LogLevels.INFO.color}[INFO]: ${message}${Colors.RESET}`, ...optionalParams);
   safe(() => remote?.log?.('info', message, optionalParams));
 };
-const logWarning = (message, ...optionalParams) => {
+const logWarning = (rawMessage, ...rawParams) => {
+  const message = (0, _redact.redactString)(rawMessage);
+  const optionalParams = (0, _redact.redact)(rawParams);
   if (!isEnabled() || !isLogLevelAllowed(LogLevels.WARN.level)) {
     return;
   }
   console.warn(`${LogLevels.WARN.color}[WARNING]: ${message}${Colors.RESET}`, ...optionalParams);
   safe(() => remote?.log?.('warn', message, optionalParams));
 };
-const logError = (message, ...optionalParams) => {
+const logError = (rawMessage, ...rawParams) => {
+  const message = (0, _redact.redactString)(rawMessage);
+  const optionalParams = (0, _redact.redact)(rawParams);
   if (isEnabled() && isLogLevelAllowed(LogLevels.ERROR.level)) {
     console.error(`${LogLevels.ERROR.color}[ERROR]: ${message}${Colors.RESET}`, ...optionalParams);
   }
@@ -239,14 +246,17 @@ const logError = (message, ...optionalParams) => {
     });
   }
 };
-const breadcrumb = (message, data) => {
+const breadcrumb = (rawMessage, rawData) => {
+  const message = (0, _redact.redactString)(rawMessage);
+  const data = (0, _redact.redact)(rawData);
   if (isEnabled() && isLogLevelAllowed('info')) {
     console.info(`${Colors.BLUE}[BREADCRUMB]: ${message}${Colors.RESET}`, data ?? '');
   }
   safe(() => remote?.breadcrumb?.(message, data));
 };
-const recordError = (error, context) => {
-  const err = toErrorObject(error);
+const recordError = (error, rawContext) => {
+  const err = (0, _redact.redact)(toErrorObject(error));
+  const context = (0, _redact.redact)(rawContext);
   if (isEnabled() && isLogLevelAllowed('error')) {
     console.error(`${Colors.RED_BOLD}[RECORDED]: ${err.message}${Colors.RESET}`, context ?? '');
   }

package/lib/commonjs/logger/redact.js

@@ -0,0 +1,50 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.redactString = exports.redact = void 0;
+const REDACTED = '[REDACTED]';
+const SECRET_KEYS = /^(token|accesstoken|refreshtoken|password|authorization)$/i;
+const BEARER = /\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi;
+const JWT = /\beyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/g;
+const KEYED_VALUE = /(["']?(?:token|accessToken|refreshToken|password|authorization)["']?\s*[:=]\s*)(?:"(?:[^"\\]|\\.)*"|'[^']*'|[^\s,;&}]+)/gi;
+const MAX_DEPTH = 6;
+const redactString = input => input.replace(BEARER, `Bearer ${REDACTED}`).replace(JWT, REDACTED).replace(KEYED_VALUE, (_match, prefix) => `${prefix}"${REDACTED}"`);
+exports.redactString = redactString;
+const redactInner = (value, depth, seen) => {
+  if (typeof value === 'string') {
+    return redactString(value);
+  }
+  if (value === null || typeof value !== 'object') {
+    return value;
+  }
+  if (value instanceof Error) {
+    value.message = redactString(value.message);
+    if (value.stack) {
+      value.stack = redactString(value.stack);
+    }
+    return value;
+  }
+  if (depth >= MAX_DEPTH || seen.has(value)) {
+    return value;
+  }
+  seen.add(value);
+  if (Array.isArray(value)) {
+    return value.map(item => redactInner(item, depth + 1, seen));
+  }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) {
+    return value;
+  }
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    out[key] = SECRET_KEYS.test(key) ? REDACTED : redactInner(item, depth + 1, seen);
+  }
+  return out;
+};
+
+/** Returns a copy with secrets masked; Errors are masked in place so identity and stack survive. */
+const redact = value => redactInner(value, 0, new WeakSet());
+exports.redact = redact;
+//# sourceMappingURL=redact.js.map

package/lib/commonjs/push/push.js

@@ -166,7 +166,7 @@ const initPush = next => {
       return {
         shouldShowBanner: show,
         shouldShowList: show,
-        shouldPlaySound: show,
+        shouldPlaySound: show && (config?.playSoundInForeground?.() ?? true),
         shouldSetBadge: true
       };
     }
@@ -238,12 +238,13 @@ const enablePush = async () => {
 exports.enablePush = enablePush;
 const disablePush = async () => {
   const current = requireConfig();
-  await current.unregister(await current.getInstallationId());
+  // Stop following token changes first, so a failed unregister cannot re-register the phone.
   tokenSubscription?.remove();
   tokenSubscription = null;
   setState({
     enabled: false
   });
+  await current.unregister(await current.getInstallationId());
 };
 
 /** Sets the app icon badge; a no-op where push is unavailable or the launcher has no badge. */

package/lib/commonjs/types/axios.js

@@ -0,0 +1,4 @@
+"use strict";
+
+require("axios");
+//# sourceMappingURL=axios.js.map

package/lib/module/api/multipart.js

@@ -0,0 +1,16 @@
+"use strict";
+
+/**
+ * The clients default to a JSON content type, and axios then serialises a FormData body to
+ * JSON, which breaks every upload. Dropping the header for FormData lets the platform write
+ * the multipart header with its boundary.
+ */
+export const sendFormDataAsMultipart = client => {
+  client.interceptors.request.use(config => {
+    if (typeof FormData !== 'undefined' && config.data instanceof FormData) {
+      config.headers?.delete?.('Content-Type');
+    }
+    return config;
+  });
+};
+//# sourceMappingURL=multipart.js.map

package/lib/module/api/publicClient.js

@@ -3,8 +3,10 @@
 import axios from 'axios';
 import { getConfigValue } from "../config/index.js";
 import { Logger } from "../logger/index.js";
+import "../types/axios.js";
 import { applyConfiguredBaseUrl } from "./baseUrl.js";
 import { logCurl } from "./curl.js";
+import { sendFormDataAsMultipart } from "./multipart.js";
 import { attachRetry } from "./retry.js";
 
 // Define timeout for requests
@@ -26,6 +28,7 @@ const publicClient = axios.create({
   timeout: REQUEST_TIMEOUT
 });
 applyConfiguredBaseUrl(publicClient);
+sendFormDataAsMultipart(publicClient);
 
 // Registered before the logging interceptors below so they only ever observe
 // the final outcome of a request, not its intermediate retries. The policy
@@ -52,6 +55,9 @@ publicClient.interceptors.response.use(response => {
 }, error => {
   if (axios.isAxiosError(error)) {
     const originalRequest = error.config;
+    if (originalRequest?.skipErrorLog) {
+      return Promise.reject(error);
+    }
     if (!error.response) {
       Logger.error(`Network error or no response from server: ${error.message}, URL: ${originalRequest?.url}`);
     } else {

package/lib/module/api/userClient.js

@@ -5,8 +5,10 @@ import { ACCESS_TOKEN_KEY, getToken } from "../auth/authStore.js";
 import { getConfigValue } from "../config/index.js";
 import { Logger } from "../logger/index.js";
 import { getNetworkStatus } from "../network/networkStatus.js";
+import "../types/axios.js";
 import { applyConfiguredBaseUrl } from "./baseUrl.js";
 import { logCurl } from "./curl.js";
+import { sendFormDataAsMultipart } from "./multipart.js";
 import { attachRetry } from "./retry.js";
 import { dispatchLogout, getErrorMessage, getRefreshPath, isRefreshInFlight, queueBehindRefresh, refreshAccessToken, resetRefreshState } from "./tokenRefresh.js";
 export { injectStore, injectUserAuth, resetRefreshState } from "./tokenRefresh.js";
@@ -24,6 +26,9 @@ export class RequestOfflineError extends Error {
   constructor(message = 'Request blocked: device is offline') {
     super(message);
     this.name = 'RequestOfflineError';
+    // Babel's class transform can drop the prototype link, which makes
+    // `instanceof RequestOfflineError` false in the transpiled build.
+    Object.setPrototypeOf(this, RequestOfflineError.prototype);
   }
 }
 
@@ -113,6 +118,7 @@ const isRefreshTokenRequest = url => {
 // registered run last. The curl line therefore describes a request that already
 // has both its baseURL and its Authorization header.
 applyConfiguredBaseUrl(userClient);
+sendFormDataAsMultipart(userClient);
 
 // Registered BEFORE the auth interceptor below deliberately. Axios builds its
 // request chain by unshifting, so the FIRST-registered request interceptor runs
@@ -184,7 +190,9 @@ userClient.interceptors.response.use(response => response, async error => {
   const axiosError = error;
   const originalRequest = axiosError.config;
   if (!axiosError.response) {
-    Logger.error(`Network error or no response from server: ${axiosError.message}, URL: ${originalRequest?.url}`);
+    if (!originalRequest?.skipErrorLog) {
+      Logger.error(`Network error or no response from server: ${axiosError.message}, URL: ${originalRequest?.url}`);
+    }
     return Promise.reject(error);
   }
   if (axiosError.response.status === 401 && originalRequest && !originalRequest._retry) {
@@ -226,7 +234,9 @@ userClient.interceptors.response.use(response => response, async error => {
       return Promise.reject(err);
     }
   }
-  Logger.error(`Response error: ${axiosError.response?.data ?? axiosError.message}, URL: ${originalRequest?.url}, Status: ${axiosError.response.status}`);
+  if (!originalRequest?.skipErrorLog) {
+    Logger.error(`Response error: ${axiosError.response?.data ?? axiosError.message}, URL: ${originalRequest?.url}, Status: ${axiosError.response.status}`);
+  }
   return Promise.reject(error);
 });
 export default userClient;

package/lib/module/index.js

@@ -27,6 +27,7 @@
 export { buildCurl, logCurl } from "./api/curl.js";
 export { default as publicClient } from "./api/publicClient.js";
 export { attachRetry, isRetryableStatus } from "./api/retry.js";
+export { refreshAccessToken } from "./api/tokenRefresh.js";
 export { default as userClient, injectStore, injectUserAuth, RequestOfflineError, resetRefreshState, SESSION_TERMINATION_CODES } from "./api/userClient.js";
 // Auth / token storage
 export { ACCESS_TOKEN_KEY, getToken, REFRESH_TOKEN_KEY, removeToken, setKeychainImplementation, storeToken } from "./auth/authStore.js";

package/lib/module/logger/index.js

@@ -1,6 +1,7 @@
 "use strict";
 
 import { getConfigValue } from "../config/index.js";
+import { redact, redactString } from "./redact.js";
 
 // ANSI color codes
 const Colors = {
@@ -203,21 +204,27 @@ const forwardErrorToRemote = (err, context) => {
   }
   safe(() => remote?.recordError?.(err, buildErrorContext(context, suppressedCount)));
 };
-const logInfo = (message, ...optionalParams) => {
+const logInfo = (rawMessage, ...rawParams) => {
+  const message = redactString(rawMessage);
+  const optionalParams = redact(rawParams);
   if (!isEnabled() || !isLogLevelAllowed(LogLevels.INFO.level)) {
     return;
   }
   console.info(`${LogLevels.INFO.color}[INFO]: ${message}${Colors.RESET}`, ...optionalParams);
   safe(() => remote?.log?.('info', message, optionalParams));
 };
-const logWarning = (message, ...optionalParams) => {
+const logWarning = (rawMessage, ...rawParams) => {
+  const message = redactString(rawMessage);
+  const optionalParams = redact(rawParams);
   if (!isEnabled() || !isLogLevelAllowed(LogLevels.WARN.level)) {
     return;
   }
   console.warn(`${LogLevels.WARN.color}[WARNING]: ${message}${Colors.RESET}`, ...optionalParams);
   safe(() => remote?.log?.('warn', message, optionalParams));
 };
-const logError = (message, ...optionalParams) => {
+const logError = (rawMessage, ...rawParams) => {
+  const message = redactString(rawMessage);
+  const optionalParams = redact(rawParams);
   if (isEnabled() && isLogLevelAllowed(LogLevels.ERROR.level)) {
     console.error(`${LogLevels.ERROR.color}[ERROR]: ${message}${Colors.RESET}`, ...optionalParams);
   }
@@ -233,14 +240,17 @@ const logError = (message, ...optionalParams) => {
     });
   }
 };
-const breadcrumb = (message, data) => {
+const breadcrumb = (rawMessage, rawData) => {
+  const message = redactString(rawMessage);
+  const data = redact(rawData);
   if (isEnabled() && isLogLevelAllowed('info')) {
     console.info(`${Colors.BLUE}[BREADCRUMB]: ${message}${Colors.RESET}`, data ?? '');
   }
   safe(() => remote?.breadcrumb?.(message, data));
 };
-const recordError = (error, context) => {
-  const err = toErrorObject(error);
+const recordError = (error, rawContext) => {
+  const err = redact(toErrorObject(error));
+  const context = redact(rawContext);
   if (isEnabled() && isLogLevelAllowed('error')) {
     console.error(`${Colors.RED_BOLD}[RECORDED]: ${err.message}${Colors.RESET}`, context ?? '');
   }

package/lib/module/logger/redact.js

@@ -0,0 +1,44 @@
+"use strict";
+
+const REDACTED = '[REDACTED]';
+const SECRET_KEYS = /^(token|accesstoken|refreshtoken|password|authorization)$/i;
+const BEARER = /\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi;
+const JWT = /\beyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/g;
+const KEYED_VALUE = /(["']?(?:token|accessToken|refreshToken|password|authorization)["']?\s*[:=]\s*)(?:"(?:[^"\\]|\\.)*"|'[^']*'|[^\s,;&}]+)/gi;
+const MAX_DEPTH = 6;
+export const redactString = input => input.replace(BEARER, `Bearer ${REDACTED}`).replace(JWT, REDACTED).replace(KEYED_VALUE, (_match, prefix) => `${prefix}"${REDACTED}"`);
+const redactInner = (value, depth, seen) => {
+  if (typeof value === 'string') {
+    return redactString(value);
+  }
+  if (value === null || typeof value !== 'object') {
+    return value;
+  }
+  if (value instanceof Error) {
+    value.message = redactString(value.message);
+    if (value.stack) {
+      value.stack = redactString(value.stack);
+    }
+    return value;
+  }
+  if (depth >= MAX_DEPTH || seen.has(value)) {
+    return value;
+  }
+  seen.add(value);
+  if (Array.isArray(value)) {
+    return value.map(item => redactInner(item, depth + 1, seen));
+  }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) {
+    return value;
+  }
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    out[key] = SECRET_KEYS.test(key) ? REDACTED : redactInner(item, depth + 1, seen);
+  }
+  return out;
+};
+
+/** Returns a copy with secrets masked; Errors are masked in place so identity and stack survive. */
+export const redact = value => redactInner(value, 0, new WeakSet());
+//# sourceMappingURL=redact.js.map

package/lib/module/push/push.js

@@ -162,7 +162,7 @@ export const initPush = next => {
       return {
         shouldShowBanner: show,
         shouldShowList: show,
-        shouldPlaySound: show,
+        shouldPlaySound: show && (config?.playSoundInForeground?.() ?? true),
         shouldSetBadge: true
       };
     }
@@ -232,12 +232,13 @@ export const enablePush = async () => {
  */
 export const disablePush = async () => {
   const current = requireConfig();
-  await current.unregister(await current.getInstallationId());
+  // Stop following token changes first, so a failed unregister cannot re-register the phone.
   tokenSubscription?.remove();
   tokenSubscription = null;
   setState({
     enabled: false
   });
+  await current.unregister(await current.getInstallationId());
 };
 
 /** Sets the app icon badge; a no-op where push is unavailable or the launcher has no badge. */

package/lib/module/types/axios.js

@@ -0,0 +1,4 @@
+"use strict";
+
+import 'axios';
+//# sourceMappingURL=axios.js.map

package/lib/typescript/commonjs/api/multipart.d.ts

@@ -0,0 +1,8 @@
+import type { AxiosInstance } from 'axios';
+/**
+ * The clients default to a JSON content type, and axios then serialises a FormData body to
+ * JSON, which breaks every upload. Dropping the header for FormData lets the platform write
+ * the multipart header with its boundary.
+ */
+export declare const sendFormDataAsMultipart: (client: AxiosInstance) => void;
+//# sourceMappingURL=multipart.d.ts.map

package/lib/typescript/commonjs/api/publicClient.d.ts

@@ -1,4 +1,5 @@
 import { type AxiosInstance } from 'axios';
+import '../types/axios';
 /**
  * Public Axios Client
  * - Base URL: Set your public API base URL.

package/lib/typescript/commonjs/api/userClient.d.ts

@@ -1,4 +1,5 @@
 import { type AxiosInstance } from 'axios';
+import '../types/axios';
 export type { RefreshableStore } from './tokenRefresh';
 export { injectStore, injectUserAuth, resetRefreshState } from './tokenRefresh';
 /**

package/lib/typescript/commonjs/index.d.ts

@@ -25,6 +25,7 @@ export { buildCurl, logCurl } from './api/curl';
 export { default as publicClient } from './api/publicClient';
 export type { RetryPolicy } from './api/retry';
 export { attachRetry, isRetryableStatus } from './api/retry';
+export { refreshAccessToken } from './api/tokenRefresh';
 export type { RefreshableStore, SessionTerminationCode } from './api/userClient';
 export { default as userClient, injectStore, injectUserAuth, RequestOfflineError, resetRefreshState, SESSION_TERMINATION_CODES } from './api/userClient';
 export type { KeychainLike, SecureCredentials, StoredToken } from './auth/authStore';

package/lib/typescript/commonjs/logger/redact.d.ts

@@ -0,0 +1,4 @@
+export declare const redactString: (input: string) => string;
+/** Returns a copy with secrets masked; Errors are masked in place so identity and stack survive. */
+export declare const redact: <T>(value: T) => T;
+//# sourceMappingURL=redact.d.ts.map

package/lib/typescript/commonjs/push/push.d.ts

@@ -23,6 +23,8 @@ export interface PushConfig {
     androidChannels?: PushAndroidChannel[];
     /** Whether a notification arriving while the app is open is shown. Defaults to true. */
     showInForeground?: () => boolean;
+    /** Whether a notification shown while the app is open plays its sound. Defaults to true. */
+    playSoundInForeground?: () => boolean;
 }
 export type PushStatus = 'unknown' | 'granted' | 'denied' | 'unavailable';
 export interface PushState {

package/lib/typescript/commonjs/types/axios.d.ts

@@ -0,0 +1,8 @@
+import 'axios';
+declare module 'axios' {
+    interface AxiosRequestConfig {
+        /** When true, the library's response-error interceptors do not log this request's failure. */
+        skipErrorLog?: boolean;
+    }
+}
+//# sourceMappingURL=axios.d.ts.map

package/lib/typescript/module/api/multipart.d.ts

@@ -0,0 +1,8 @@
+import type { AxiosInstance } from 'axios';
+/**
+ * The clients default to a JSON content type, and axios then serialises a FormData body to
+ * JSON, which breaks every upload. Dropping the header for FormData lets the platform write
+ * the multipart header with its boundary.
+ */
+export declare const sendFormDataAsMultipart: (client: AxiosInstance) => void;
+//# sourceMappingURL=multipart.d.ts.map

package/lib/typescript/module/api/publicClient.d.ts

@@ -1,4 +1,5 @@
 import { type AxiosInstance } from 'axios';
+import '../types/axios.js';
 /**
  * Public Axios Client
  * - Base URL: Set your public API base URL.

package/lib/typescript/module/api/userClient.d.ts

@@ -1,4 +1,5 @@
 import { type AxiosInstance } from 'axios';
+import '../types/axios.js';
 export type { RefreshableStore } from './tokenRefresh.js';
 export { injectStore, injectUserAuth, resetRefreshState } from './tokenRefresh.js';
 /**

package/lib/typescript/module/index.d.ts

@@ -25,6 +25,7 @@ export { buildCurl, logCurl } from './api/curl.js';
 export { default as publicClient } from './api/publicClient.js';
 export type { RetryPolicy } from './api/retry.js';
 export { attachRetry, isRetryableStatus } from './api/retry.js';
+export { refreshAccessToken } from './api/tokenRefresh.js';
 export type { RefreshableStore, SessionTerminationCode } from './api/userClient.js';
 export { default as userClient, injectStore, injectUserAuth, RequestOfflineError, resetRefreshState, SESSION_TERMINATION_CODES } from './api/userClient.js';
 export type { KeychainLike, SecureCredentials, StoredToken } from './auth/authStore.js';

package/lib/typescript/module/logger/redact.d.ts

@@ -0,0 +1,4 @@
+export declare const redactString: (input: string) => string;
+/** Returns a copy with secrets masked; Errors are masked in place so identity and stack survive. */
+export declare const redact: <T>(value: T) => T;
+//# sourceMappingURL=redact.d.ts.map

package/lib/typescript/module/push/push.d.ts

@@ -23,6 +23,8 @@ export interface PushConfig {
     androidChannels?: PushAndroidChannel[];
     /** Whether a notification arriving while the app is open is shown. Defaults to true. */
     showInForeground?: () => boolean;
+    /** Whether a notification shown while the app is open plays its sound. Defaults to true. */
+    playSoundInForeground?: () => boolean;
 }
 export type PushStatus = 'unknown' | 'granted' | 'denied' | 'unavailable';
 export interface PushState {

package/lib/typescript/module/types/axios.d.ts

@@ -0,0 +1,8 @@
+import 'axios';
+declare module 'axios' {
+    interface AxiosRequestConfig {
+        /** When true, the library's response-error interceptors do not log this request's failure. */
+        skipErrorLog?: boolean;
+    }
+}
+//# sourceMappingURL=axios.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webority/mobile-core",
-  "version": "0.0.24",
+  "version": "0.0.26",
   "description": "Platform layer for Webority React Native apps: HTTP clients, auth/token storage, config, logging, formatters, validators, network status, permissions, storage and version checks. No UI.",
   "keywords": [
     "react-native",
@@ -14,7 +14,7 @@
     "webority"
   ],
   "homepage": "https://www.webority.com",
-  "license": "MIT",
+  "license": "SEE LICENSE IN LICENSE.txt",
   "author": {
     "name": "Webority Technologies",
     "email": "contact@webority.com",

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2025 Webority Technologies
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.