@webority/mobile-core 0.0.25 → 0.0.27

package/lib/commonjs/utils/base64.js

@@ -0,0 +1,24 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.encodeBase64 = void 0;
+// Small enough for every engine's argument limit in `String.fromCharCode.apply`.
+const CHUNK = 0x2000;
+
+/**
+ * Base64 of raw bytes, for a `data:` URI. Builds a Latin-1 string a chunk at a
+ * time and hands it to the engine's native `btoa` (Hermes ships it), which is
+ * many times faster on the JS thread than encoding byte by byte in JS.
+ */
+const encodeBase64 = buffer => {
+  const bytes = new Uint8Array(buffer);
+  let binary = '';
+  for (let i = 0; i < bytes.length; i += CHUNK) {
+    binary += String.fromCharCode.apply(null, bytes.subarray(i, i + CHUNK));
+  }
+  return btoa(binary);
+};
+exports.encodeBase64 = encodeBase64;
+//# sourceMappingURL=base64.js.map

package/lib/module/api/publicClient.js

@@ -3,6 +3,7 @@
 import axios from 'axios';
 import { getConfigValue } from "../config/index.js";
 import { Logger } from "../logger/index.js";
+import "../types/axios.js";
 import { applyConfiguredBaseUrl } from "./baseUrl.js";
 import { logCurl } from "./curl.js";
 import { sendFormDataAsMultipart } from "./multipart.js";
@@ -54,6 +55,9 @@ publicClient.interceptors.response.use(response => {
 }, error => {
   if (axios.isAxiosError(error)) {
     const originalRequest = error.config;
+    if (originalRequest?.skipErrorLog) {
+      return Promise.reject(error);
+    }
     if (!error.response) {
       Logger.error(`Network error or no response from server: ${error.message}, URL: ${originalRequest?.url}`);
     } else {

package/lib/module/api/retry.js

@@ -11,10 +11,26 @@
  * as readily as GETs.
  */
 export const isRetryableStatus = status => typeof status === 'number' && (status === 429 || status >= 500 && status <= 599);
+const IDEMPOTENT_METHODS = new Set(['get', 'head', 'options', 'put', 'delete']);
+
+/**
+ * The same reasoning reaches status codes on a write. A 500 on a POST or PATCH
+ * can follow a partial commit, so replaying it can duplicate the record; only
+ * 429 and 503 say the server refused the request before doing the work. A
+ * request that knows its write is safe to repeat passes its own `shouldRetry`.
+ */
+const isRetryableFailure = error => {
+  const status = error.response?.status;
+  if (!isRetryableStatus(status)) {
+    return false;
+  }
+  const method = (error.config?.method ?? 'get').toLowerCase();
+  return IDEMPOTENT_METHODS.has(method) || status === 429 || status === 503;
+};
 const DEFAULT_POLICY = {
   retries: 3,
   retryDelayMs: attempt => attempt <= 1 ? 0 : 2 ** attempt * 1000,
-  shouldRetry: error => isRetryableStatus(error.response?.status),
+  shouldRetry: isRetryableFailure,
   onRetry: () => undefined
 };
 const waitOrAbort = (delay, signal) => new Promise(resolve => {

package/lib/module/api/userClient.js

@@ -4,7 +4,8 @@ import axios, { AxiosHeaders } from 'axios';
 import { ACCESS_TOKEN_KEY, getToken } from "../auth/authStore.js";
 import { getConfigValue } from "../config/index.js";
 import { Logger } from "../logger/index.js";
-import { getNetworkStatus } from "../network/networkStatus.js";
+import { getLastKnownNetworkStatus } from "../network/networkStatus.js";
+import "../types/axios.js";
 import { applyConfiguredBaseUrl } from "./baseUrl.js";
 import { logCurl } from "./curl.js";
 import { sendFormDataAsMultipart } from "./multipart.js";
@@ -25,6 +26,9 @@ export class RequestOfflineError extends Error {
   constructor(message = 'Request blocked: device is offline') {
     super(message);
     this.name = 'RequestOfflineError';
+    // Babel's class transform can drop the prototype link, which makes
+    // `instanceof RequestOfflineError` false in the transpiled build.
+    Object.setPrototypeOf(this, RequestOfflineError.prototype);
   }
 }
 
@@ -131,7 +135,7 @@ userClient.interceptors.request.use(async config => {
   // Reject before any network call when the device is known to be offline.
   // Unknown connectivity (netinfo not installed, or undetermined) is treated
   // as online — never block a request on an unavailable probe.
-  const network = await getNetworkStatus();
+  const network = await getLastKnownNetworkStatus();
   if (network.isConnected === false) {
     Logger.warn(`Request blocked: device is offline. URL: ${config.url}`);
     return Promise.reject(new RequestOfflineError());
@@ -186,7 +190,9 @@ userClient.interceptors.response.use(response => response, async error => {
   const axiosError = error;
   const originalRequest = axiosError.config;
   if (!axiosError.response) {
-    Logger.error(`Network error or no response from server: ${axiosError.message}, URL: ${originalRequest?.url}`);
+    if (!originalRequest?.skipErrorLog) {
+      Logger.error(`Network error or no response from server: ${axiosError.message}, URL: ${originalRequest?.url}`);
+    }
     return Promise.reject(error);
   }
   if (axiosError.response.status === 401 && originalRequest && !originalRequest._retry) {
@@ -228,7 +234,9 @@ userClient.interceptors.response.use(response => response, async error => {
       return Promise.reject(err);
     }
   }
-  Logger.error(`Response error: ${axiosError.response?.data ?? axiosError.message}, URL: ${originalRequest?.url}, Status: ${axiosError.response.status}`);
+  if (!originalRequest?.skipErrorLog) {
+    Logger.error(`Response error: ${axiosError.response?.data ?? axiosError.message}, URL: ${originalRequest?.url}, Status: ${axiosError.response.status}`);
+  }
   return Promise.reject(error);
 });
 export default userClient;

package/lib/module/auth/authStore.js

@@ -83,6 +83,24 @@ const expoSecureStoreBackend = {
   }
 };
 const resolveBackend = () => backend ?? expoSecureStoreBackend;
+
+/**
+ * Every request reads the access token, and a secure-store read is a native
+ * keychain/keystore decrypt. Reads are therefore served from memory, written
+ * through by `storeToken` and dropped by `removeToken`. `generation` moves on
+ * every write, removal and backend swap, so a read that started before one of
+ * those cannot cache the value it saw.
+ */
+const memo = new Map();
+let generation = 0;
+const forget = key => {
+  generation += 1;
+  if (key === undefined) {
+    memo.clear();
+  } else {
+    memo.delete(key);
+  }
+};
 const requireBackend = op => {
   const b = resolveBackend();
   if (!b) {
@@ -100,6 +118,7 @@ const requireBackend = op => {
  */
 export const setKeychainImplementation = impl => {
   backend = impl;
+  forget();
 };
 
 /**
@@ -109,6 +128,7 @@ export const storeToken = async (key, token, expiry) => {
   // Never log the token or expiry values: Logger forwards to whatever remote
   // sink the app wired (Crashlytics/Sentry), so a token here leaves the device.
   Logger.info(`Storing token for key: ${key}`);
+  forget(key);
   try {
     const data = JSON.stringify({
       token,
@@ -117,8 +137,14 @@ export const storeToken = async (key, token, expiry) => {
     await requireBackend('store a token').setGenericPassword('token', data, {
       service: key
     });
+    forget(key);
+    memo.set(key, {
+      token,
+      expiry
+    });
     Logger.info(`Token stored successfully for key: ${key}`);
   } catch (error) {
+    forget(key);
     // Log AND rethrow. Swallowing this told the caller the token was persisted
     // when it was not, so an app would show a signed-in user holding a token
     // that never reached the keychain — the session then dies at the next
@@ -156,6 +182,10 @@ const parseTokenData = credentials => {
  * Retrieve token and check if expired.
  */
 export const getToken = async key => {
+  if (memo.has(key)) {
+    return memo.get(key) ?? null;
+  }
+  const seen = generation;
   try {
     const credentials = await requireBackend('read a token').getGenericPassword({
       service: key
@@ -164,24 +194,24 @@ export const getToken = async key => {
     // token, and every authenticated request, image and download asks for one.
     // Warning here put three info lines and a warning into the log, and into the
     // remote crash sink, on every one of those calls.
-    if (!credentials) {
-      return null;
+    let value = null;
+    if (credentials) {
+      const parsedData = parseTokenData(credentials);
+      if (parsedData) {
+        value = {
+          token: parsedData.token,
+          expiry: parsedData.expiry
+        };
+      } else {
+        // Something IS stored and it is not a token. That is corruption worth
+        // hearing about, and it is a different event from having no token.
+        Logger.warn(`Stored credentials for key "${key}" are not a valid token; ignoring them.`);
+      }
     }
-    const parsedData = parseTokenData(credentials);
-    if (!parsedData) {
-      // Something IS stored and it is not a token. That is corruption worth
-      // hearing about, and it is a different event from having no token.
-      Logger.warn(`Stored credentials for key "${key}" are not a valid token; ignoring them.`);
-      return null;
+    if (seen === generation) {
+      memo.set(key, value);
     }
-    const {
-      token,
-      expiry
-    } = parsedData;
-    return {
-      token,
-      expiry
-    };
+    return value;
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     // Both spellings matter. Android throws "Key permanently invalidated" when
@@ -204,6 +234,7 @@ export const getToken = async key => {
  * Remove token by key.
  */
 export const removeToken = async key => {
+  forget(key);
   try {
     await requireBackend('remove a token').resetGenericPassword({
       service: key
@@ -219,6 +250,8 @@ export const removeToken = async key => {
       return;
     }
     Logger.error(`Failed to remove token for key: ${key}`, error);
+  } finally {
+    forget(key);
   }
 };
 //# sourceMappingURL=authStore.js.map

package/lib/module/config/index.js

@@ -5,10 +5,16 @@
  * Provides a flexible way to inject configuration without hard dependencies
  */
 
+/**
+ * Info lines (each token refresh, each unauthorised URL) reach the device log
+ * and any remote sink, so a release build that sets nothing logs warnings and
+ * errors only.
+ */
+export const DEFAULT_LOG_LEVEL = __DEV__ ? 'info' : 'warn';
 const DEFAULT_CONFIG = {
   baseUrl: null,
   loggingEnabled: true,
-  logLevel: 'info',
+  logLevel: DEFAULT_LOG_LEVEL,
   environment: 'Development',
   country: 'in',
   appId: null,

package/lib/module/formatters/currency.js

@@ -1,5 +1,6 @@
 "use strict";
 
+import { numberFormat } from "./intlCache.js";
 const hasIntlNumber = () => typeof Intl !== 'undefined' && typeof Intl.NumberFormat === 'function';
 const indianGroupingFallback = (n, fractionDigits) => {
   // Indian numbering: 1,23,45,678.90 (last 3 digits, then groups of 2).
@@ -37,7 +38,7 @@ export const formatCurrency = (amount, options = {}) => {
   const minFrac = minimumFractionDigits ?? (Number.isInteger(amount) ? 0 : 2);
   if (hasIntlNumber()) {
     try {
-      const formatted = new Intl.NumberFormat(locale, {
+      const formatted = numberFormat(locale, {
         style: 'currency',
         currency,
         minimumFractionDigits: minFrac,

package/lib/module/formatters/date.js

@@ -1,5 +1,6 @@
 "use strict";
 
+import { dateTimeFormat, relativeTimeFormat } from "./intlCache.js";
 const toDate = value => {
   if (value instanceof Date) {
     return Number.isNaN(value.getTime()) ? null : value;
@@ -48,7 +49,7 @@ export const formatDate = (value, style = 'medium', locale = 'en-IN') => {
   }
   if (hasIntl()) {
     try {
-      return new Intl.DateTimeFormat(locale, {
+      return dateTimeFormat(locale, {
         dateStyle: style
       }).format(d);
     } catch {
@@ -68,7 +69,7 @@ export const formatTime = (value, style = 'short', locale = 'en-IN') => {
   }
   if (hasIntl()) {
     try {
-      return new Intl.DateTimeFormat(locale, {
+      return dateTimeFormat(locale, {
         timeStyle: style
       }).format(d);
     } catch {
@@ -88,7 +89,7 @@ export const formatDateTime = (value, dateStyle = 'medium', timeStyle = 'short',
   }
   if (hasIntl()) {
     try {
-      return new Intl.DateTimeFormat(locale, {
+      return dateTimeFormat(locale, {
         dateStyle,
         timeStyle
       }).format(d);
@@ -145,9 +146,7 @@ export const formatRelativeTime = (value, base = new Date(), locale = 'en-IN') =
   const Rtf = hasIntl() ? Intl.RelativeTimeFormat : undefined;
   if (typeof Rtf === 'function') {
     try {
-      return new Rtf(locale, {
-        numeric: 'auto'
-      }).format(amount, unit);
+      return relativeTimeFormat(Rtf, locale).format(amount, unit);
     } catch {
       /* fall through */
     }

package/lib/module/formatters/dateMath.js

@@ -1,5 +1,6 @@
 "use strict";
 
+import { dateTimeFormat } from "./intlCache.js";
 import { WINDOWS_TO_IANA } from "./windowsToIanaTable.js";
 const toDate = value => {
   if (value instanceof Date) {
@@ -263,7 +264,7 @@ export const formatTimeInZone = (value, ianaTimeZone) => {
     // answer available, not a genuine timezone conversion.
     return formatTime12h(d);
   }
-  const parts = new Intl.DateTimeFormat('en-US', {
+  const parts = dateTimeFormat('en-US', {
     timeZone: ianaTimeZone,
     hour: 'numeric',
     minute: '2-digit',

package/lib/module/formatters/intlCache.js

@@ -0,0 +1,30 @@
+"use strict";
+
+/**
+ * Building an Intl formatter costs far more than using one (and on Hermes for
+ * Android it goes through ICU over JNI), while list rows and slider frames call
+ * the formatters many times with the same arguments. Formatters are therefore
+ * built once per locale and options. The limit only guards against unbounded
+ * input such as arbitrary time zones; real apps use a handful of keys.
+ */
+const LIMIT = 100;
+const cached = (cache, key, create) => {
+  let formatter = cache.get(key);
+  if (formatter === undefined) {
+    formatter = create();
+    if (cache.size >= LIMIT) {
+      cache.clear();
+    }
+    cache.set(key, formatter);
+  }
+  return formatter;
+};
+const numberFormats = new Map();
+const dateTimeFormats = new Map();
+const relativeTimeFormats = new Map();
+export const numberFormat = (locale, options = {}) => cached(numberFormats, `${locale}|${JSON.stringify(options)}`, () => new Intl.NumberFormat(locale, options));
+export const dateTimeFormat = (locale, options) => cached(dateTimeFormats, `${locale}|${JSON.stringify(options)}`, () => new Intl.DateTimeFormat(locale, options));
+export const relativeTimeFormat = (RelativeTimeFormat, locale) => cached(relativeTimeFormats, locale, () => new RelativeTimeFormat(locale, {
+  numeric: 'auto'
+}));
+//# sourceMappingURL=intlCache.js.map

package/lib/module/formatters/number.js

@@ -1,5 +1,6 @@
 "use strict";
 
+import { numberFormat } from "./intlCache.js";
 const hasIntlNumber = () => typeof Intl !== 'undefined' && typeof Intl.NumberFormat === 'function';
 
 /**
@@ -16,7 +17,7 @@ export const formatNumber = (value, fractionDigits, locale = 'en-IN') => {
         opts.minimumFractionDigits = fractionDigits;
         opts.maximumFractionDigits = fractionDigits;
       }
-      return new Intl.NumberFormat(locale, opts).format(value);
+      return numberFormat(locale, opts).format(value);
     } catch {
       /* fall through */
     }
@@ -35,7 +36,7 @@ export const formatPercent = (value, fractionDigits = 0, asRatio = true, locale
   const ratio = asRatio ? value : value / 100;
   if (hasIntlNumber()) {
     try {
-      return new Intl.NumberFormat(locale, {
+      return numberFormat(locale, {
         style: 'percent',
         minimumFractionDigits: fractionDigits,
         maximumFractionDigits: fractionDigits
@@ -57,7 +58,7 @@ export const formatCompactNumber = (value, locale = 'en-IN') => {
   }
   if (hasIntlNumber()) {
     try {
-      return new Intl.NumberFormat(locale, {
+      return numberFormat(locale, {
         notation: 'compact',
         maximumFractionDigits: 1
       }).format(value);

package/lib/module/index.js

@@ -27,6 +27,7 @@
 export { buildCurl, logCurl } from "./api/curl.js";
 export { default as publicClient } from "./api/publicClient.js";
 export { attachRetry, isRetryableStatus } from "./api/retry.js";
+export { refreshAccessToken } from "./api/tokenRefresh.js";
 export { default as userClient, injectStore, injectUserAuth, RequestOfflineError, resetRefreshState, SESSION_TERMINATION_CODES } from "./api/userClient.js";
 // Auth / token storage
 export { ACCESS_TOKEN_KEY, getToken, REFRESH_TOKEN_KEY, removeToken, setKeychainImplementation, storeToken } from "./auth/authStore.js";
@@ -47,6 +48,8 @@ export { addNetworkStatusListener, getNetworkStatus, setNetworkStatusImplementat
 // Storage: the API and the seam. No native package is required; wire one with
 // setStorageImplementation to get persistence.
 export { isStorageAvailable, Storage, setStorageImplementation } from "./storage/index.js";
+// Bytes
+export { encodeBase64 } from "./utils/base64.js";
 // Validators
 export { isAadhaar, isAlphanumeric, isBetween, isEmail, isGstin, isHexColor, isIfsc, isIndianMobile, isIndianPincode, isInteger, isNonEmpty, isNumeric, isPan, isPhone, isStrongPassword, isUrl, maxLength, minLength } from "./validators/index.js";
 // Version check (the ForceUpdateDialog UI lives in @webority/mobile-ui)

package/lib/module/initSDK.js

@@ -6,7 +6,7 @@
  */
 
 import { setKeychainImplementation } from "./auth/authStore.js";
-import { setConfig } from "./config/index.js";
+import { DEFAULT_LOG_LEVEL, setConfig } from "./config/index.js";
 import { Logger } from "./logger/index.js";
 import { setNetworkStatusImplementation } from "./network/networkStatus.js";
 import { setStorageImplementation } from "./storage/index.js";
@@ -35,7 +35,7 @@ export const initWebority = config => {
   setConfig({
     baseUrl: config.baseUrl,
     loggingEnabled: config.loggingEnabled ?? true,
-    logLevel: config.logLevel || 'info',
+    logLevel: config.logLevel || DEFAULT_LOG_LEVEL,
     environment: config.environment || 'Development',
     country: (config.country || 'in').toLowerCase(),
     appId: config.appId ?? null,

package/lib/module/logger/index.js

@@ -1,6 +1,7 @@
 "use strict";
 
 import { getConfigValue } from "../config/index.js";
+import { redact, redactString } from "./redact.js";
 
 // ANSI color codes
 const Colors = {
@@ -203,21 +204,27 @@ const forwardErrorToRemote = (err, context) => {
   }
   safe(() => remote?.recordError?.(err, buildErrorContext(context, suppressedCount)));
 };
-const logInfo = (message, ...optionalParams) => {
+const logInfo = (rawMessage, ...rawParams) => {
+  const message = redactString(rawMessage);
+  const optionalParams = redact(rawParams);
   if (!isEnabled() || !isLogLevelAllowed(LogLevels.INFO.level)) {
     return;
   }
   console.info(`${LogLevels.INFO.color}[INFO]: ${message}${Colors.RESET}`, ...optionalParams);
   safe(() => remote?.log?.('info', message, optionalParams));
 };
-const logWarning = (message, ...optionalParams) => {
+const logWarning = (rawMessage, ...rawParams) => {
+  const message = redactString(rawMessage);
+  const optionalParams = redact(rawParams);
   if (!isEnabled() || !isLogLevelAllowed(LogLevels.WARN.level)) {
     return;
   }
   console.warn(`${LogLevels.WARN.color}[WARNING]: ${message}${Colors.RESET}`, ...optionalParams);
   safe(() => remote?.log?.('warn', message, optionalParams));
 };
-const logError = (message, ...optionalParams) => {
+const logError = (rawMessage, ...rawParams) => {
+  const message = redactString(rawMessage);
+  const optionalParams = redact(rawParams);
   if (isEnabled() && isLogLevelAllowed(LogLevels.ERROR.level)) {
     console.error(`${LogLevels.ERROR.color}[ERROR]: ${message}${Colors.RESET}`, ...optionalParams);
   }
@@ -233,14 +240,17 @@ const logError = (message, ...optionalParams) => {
     });
   }
 };
-const breadcrumb = (message, data) => {
+const breadcrumb = (rawMessage, rawData) => {
+  const message = redactString(rawMessage);
+  const data = redact(rawData);
   if (isEnabled() && isLogLevelAllowed('info')) {
     console.info(`${Colors.BLUE}[BREADCRUMB]: ${message}${Colors.RESET}`, data ?? '');
   }
   safe(() => remote?.breadcrumb?.(message, data));
 };
-const recordError = (error, context) => {
-  const err = toErrorObject(error);
+const recordError = (error, rawContext) => {
+  const err = redact(toErrorObject(error));
+  const context = redact(rawContext);
   if (isEnabled() && isLogLevelAllowed('error')) {
     console.error(`${Colors.RED_BOLD}[RECORDED]: ${err.message}${Colors.RESET}`, context ?? '');
   }

package/lib/module/logger/redact.js

@@ -0,0 +1,44 @@
+"use strict";
+
+const REDACTED = '[REDACTED]';
+const SECRET_KEYS = /^(token|accesstoken|refreshtoken|password|authorization)$/i;
+const BEARER = /\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi;
+const JWT = /\beyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/g;
+const KEYED_VALUE = /(["']?(?:token|accessToken|refreshToken|password|authorization)["']?\s*[:=]\s*)(?:"(?:[^"\\]|\\.)*"|'[^']*'|[^\s,;&}]+)/gi;
+const MAX_DEPTH = 6;
+export const redactString = input => input.replace(BEARER, `Bearer ${REDACTED}`).replace(JWT, REDACTED).replace(KEYED_VALUE, (_match, prefix) => `${prefix}"${REDACTED}"`);
+const redactInner = (value, depth, seen) => {
+  if (typeof value === 'string') {
+    return redactString(value);
+  }
+  if (value === null || typeof value !== 'object') {
+    return value;
+  }
+  if (value instanceof Error) {
+    value.message = redactString(value.message);
+    if (value.stack) {
+      value.stack = redactString(value.stack);
+    }
+    return value;
+  }
+  if (depth >= MAX_DEPTH || seen.has(value)) {
+    return value;
+  }
+  seen.add(value);
+  if (Array.isArray(value)) {
+    return value.map(item => redactInner(item, depth + 1, seen));
+  }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) {
+    return value;
+  }
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    out[key] = SECRET_KEYS.test(key) ? REDACTED : redactInner(item, depth + 1, seen);
+  }
+  return out;
+};
+
+/** Returns a copy with secrets masked; Errors are masked in place so identity and stack survive. */
+export const redact = value => redactInner(value, 0, new WeakSet());
+//# sourceMappingURL=redact.js.map

package/lib/module/network/networkStatus.js

@@ -18,6 +18,13 @@ const DEFAULT_STATUS = {
  * One backend also means one behaviour, rather than each app choosing.
  */
 let override = null;
+let lastKnown = null;
+let stopFollowing = null;
+const stopFollowingNetwork = () => {
+  stopFollowing?.();
+  stopFollowing = null;
+  lastKnown = null;
+};
 
 /**
  * Replace the backend. Intended for TESTS and for the showcase, which uses it
@@ -26,6 +33,7 @@ let override = null;
  */
 export const setNetworkStatusImplementation = impl => {
   override = impl;
+  stopFollowingNetwork();
 };
 const resolveNetInfo = () => override ?? expoNetworkBackend;
 
@@ -96,6 +104,35 @@ export const addNetworkStatusListener = listener => {
   return ni.addEventListener(state => listener(normalize(state)));
 };
 
+/**
+ * The connectivity the HTTP client checks before every request. One listener,
+ * attached on first use, keeps it current, so a request costs no native probe:
+ * one probe seeds the value and the listener's events replace it.
+ */
+export const getLastKnownNetworkStatus = async () => {
+  if (!stopFollowing) {
+    try {
+      stopFollowing = addNetworkStatusListener(status => {
+        lastKnown = status;
+      });
+    } catch (error) {
+      Logger.error('[network] could not follow network changes', error);
+      return getNetworkStatus();
+    }
+  }
+  if (lastKnown) {
+    return lastKnown;
+  }
+  const following = stopFollowing;
+  const probed = await getNetworkStatus();
+  if (stopFollowing !== following) {
+    return probed;
+  }
+  // An event that arrived during the probe is newer than the probe.
+  lastKnown ??= probed;
+  return lastKnown;
+};
+
 /**
  * React hook that returns the current network status and re-renders on change.
  * Reports an optimistic online default when NetInfo is not installed.

package/lib/module/types/axios.js

@@ -0,0 +1,4 @@
+"use strict";
+
+import 'axios';
+//# sourceMappingURL=axios.js.map

package/lib/module/utils/base64.js

@@ -0,0 +1,19 @@
+"use strict";
+
+// Small enough for every engine's argument limit in `String.fromCharCode.apply`.
+const CHUNK = 0x2000;
+
+/**
+ * Base64 of raw bytes, for a `data:` URI. Builds a Latin-1 string a chunk at a
+ * time and hands it to the engine's native `btoa` (Hermes ships it), which is
+ * many times faster on the JS thread than encoding byte by byte in JS.
+ */
+export const encodeBase64 = buffer => {
+  const bytes = new Uint8Array(buffer);
+  let binary = '';
+  for (let i = 0; i < bytes.length; i += CHUNK) {
+    binary += String.fromCharCode.apply(null, bytes.subarray(i, i + CHUNK));
+  }
+  return btoa(binary);
+};
+//# sourceMappingURL=base64.js.map

package/lib/typescript/commonjs/api/publicClient.d.ts

@@ -1,4 +1,5 @@
 import { type AxiosInstance } from 'axios';
+import '../types/axios';
 /**
  * Public Axios Client
  * - Base URL: Set your public API base URL.

package/lib/typescript/commonjs/api/userClient.d.ts

@@ -1,4 +1,5 @@
 import { type AxiosInstance } from 'axios';
+import '../types/axios';
 export type { RefreshableStore } from './tokenRefresh';
 export { injectStore, injectUserAuth, resetRefreshState } from './tokenRefresh';
 /**

package/lib/typescript/commonjs/config/index.d.ts

@@ -34,6 +34,12 @@ export interface Config {
      */
     logCurl: boolean;
 }
+/**
+ * Info lines (each token refresh, each unauthorised URL) reach the device log
+ * and any remote sink, so a release build that sets nothing logs warnings and
+ * errors only.
+ */
+export declare const DEFAULT_LOG_LEVEL: LogLevel;
 /**
  * Set global configuration for all Webority packages
  */

package/lib/typescript/commonjs/formatters/intlCache.d.ts

@@ -0,0 +1,6 @@
+export declare const numberFormat: (locale: string, options?: Intl.NumberFormatOptions) => Intl.NumberFormat;
+export declare const dateTimeFormat: (locale: string, options: Intl.DateTimeFormatOptions) => Intl.DateTimeFormat;
+export declare const relativeTimeFormat: (RelativeTimeFormat: new (locale: string, options?: {
+    numeric?: "always" | "auto";
+}) => Intl.RelativeTimeFormat, locale: string) => Intl.RelativeTimeFormat;
+//# sourceMappingURL=intlCache.d.ts.map