@webority/mobile-core 0.0.26 → 0.0.27

package/lib/commonjs/api/retry.js

@@ -16,10 +16,26 @@ exports.isRetryableStatus = exports.attachRetry = void 0;
  */
 const isRetryableStatus = status => typeof status === 'number' && (status === 429 || status >= 500 && status <= 599);
 exports.isRetryableStatus = isRetryableStatus;
+const IDEMPOTENT_METHODS = new Set(['get', 'head', 'options', 'put', 'delete']);
+
+/**
+ * The same reasoning reaches status codes on a write. A 500 on a POST or PATCH
+ * can follow a partial commit, so replaying it can duplicate the record; only
+ * 429 and 503 say the server refused the request before doing the work. A
+ * request that knows its write is safe to repeat passes its own `shouldRetry`.
+ */
+const isRetryableFailure = error => {
+  const status = error.response?.status;
+  if (!isRetryableStatus(status)) {
+    return false;
+  }
+  const method = (error.config?.method ?? 'get').toLowerCase();
+  return IDEMPOTENT_METHODS.has(method) || status === 429 || status === 503;
+};
 const DEFAULT_POLICY = {
   retries: 3,
   retryDelayMs: attempt => attempt <= 1 ? 0 : 2 ** attempt * 1000,
-  shouldRetry: error => isRetryableStatus(error.response?.status),
+  shouldRetry: isRetryableFailure,
   onRetry: () => undefined
 };
 const waitOrAbort = (delay, signal) => new Promise(resolve => {

package/lib/commonjs/api/userClient.js

@@ -157,7 +157,7 @@ userClient.interceptors.request.use(async config => {
   // Reject before any network call when the device is known to be offline.
   // Unknown connectivity (netinfo not installed, or undetermined) is treated
   // as online — never block a request on an unavailable probe.
-  const network = await (0, _networkStatus.getNetworkStatus)();
+  const network = await (0, _networkStatus.getLastKnownNetworkStatus)();
   if (network.isConnected === false) {
     _index2.Logger.warn(`Request blocked: device is offline. URL: ${config.url}`);
     return Promise.reject(new RequestOfflineError());

package/lib/commonjs/auth/authStore.js

@@ -87,6 +87,24 @@ const expoSecureStoreBackend = {
   }
 };
 const resolveBackend = () => backend ?? expoSecureStoreBackend;
+
+/**
+ * Every request reads the access token, and a secure-store read is a native
+ * keychain/keystore decrypt. Reads are therefore served from memory, written
+ * through by `storeToken` and dropped by `removeToken`. `generation` moves on
+ * every write, removal and backend swap, so a read that started before one of
+ * those cannot cache the value it saw.
+ */
+const memo = new Map();
+let generation = 0;
+const forget = key => {
+  generation += 1;
+  if (key === undefined) {
+    memo.clear();
+  } else {
+    memo.delete(key);
+  }
+};
 const requireBackend = op => {
   const b = resolveBackend();
   if (!b) {
@@ -104,6 +122,7 @@ const requireBackend = op => {
  */
 const setKeychainImplementation = impl => {
   backend = impl;
+  forget();
 };
 
 /**
@@ -114,6 +133,7 @@ const storeToken = async (key, token, expiry) => {
   // Never log the token or expiry values: Logger forwards to whatever remote
   // sink the app wired (Crashlytics/Sentry), so a token here leaves the device.
   _index.Logger.info(`Storing token for key: ${key}`);
+  forget(key);
   try {
     const data = JSON.stringify({
       token,
@@ -122,8 +142,14 @@ const storeToken = async (key, token, expiry) => {
     await requireBackend('store a token').setGenericPassword('token', data, {
       service: key
     });
+    forget(key);
+    memo.set(key, {
+      token,
+      expiry
+    });
     _index.Logger.info(`Token stored successfully for key: ${key}`);
   } catch (error) {
+    forget(key);
     // Log AND rethrow. Swallowing this told the caller the token was persisted
     // when it was not, so an app would show a signed-in user holding a token
     // that never reached the keychain — the session then dies at the next
@@ -162,6 +188,10 @@ const parseTokenData = credentials => {
  * Retrieve token and check if expired.
  */
 const getToken = async key => {
+  if (memo.has(key)) {
+    return memo.get(key) ?? null;
+  }
+  const seen = generation;
   try {
     const credentials = await requireBackend('read a token').getGenericPassword({
       service: key
@@ -170,24 +200,24 @@ const getToken = async key => {
     // token, and every authenticated request, image and download asks for one.
     // Warning here put three info lines and a warning into the log, and into the
     // remote crash sink, on every one of those calls.
-    if (!credentials) {
-      return null;
+    let value = null;
+    if (credentials) {
+      const parsedData = parseTokenData(credentials);
+      if (parsedData) {
+        value = {
+          token: parsedData.token,
+          expiry: parsedData.expiry
+        };
+      } else {
+        // Something IS stored and it is not a token. That is corruption worth
+        // hearing about, and it is a different event from having no token.
+        _index.Logger.warn(`Stored credentials for key "${key}" are not a valid token; ignoring them.`);
+      }
     }
-    const parsedData = parseTokenData(credentials);
-    if (!parsedData) {
-      // Something IS stored and it is not a token. That is corruption worth
-      // hearing about, and it is a different event from having no token.
-      _index.Logger.warn(`Stored credentials for key "${key}" are not a valid token; ignoring them.`);
-      return null;
+    if (seen === generation) {
+      memo.set(key, value);
     }
-    const {
-      token,
-      expiry
-    } = parsedData;
-    return {
-      token,
-      expiry
-    };
+    return value;
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     // Both spellings matter. Android throws "Key permanently invalidated" when
@@ -211,6 +241,7 @@ const getToken = async key => {
  */
 exports.getToken = getToken;
 const removeToken = async key => {
+  forget(key);
   try {
     await requireBackend('remove a token').resetGenericPassword({
       service: key
@@ -226,6 +257,8 @@ const removeToken = async key => {
       return;
     }
     _index.Logger.error(`Failed to remove token for key: ${key}`, error);
+  } finally {
+    forget(key);
   }
 };
 exports.removeToken = removeToken;

package/lib/commonjs/config/index.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.getConfig = void 0;
+exports.getConfig = exports.DEFAULT_LOG_LEVEL = void 0;
 exports.getConfigValue = getConfigValue;
 exports.setConfig = exports.resetConfig = void 0;
 /**
@@ -11,10 +11,16 @@ exports.setConfig = exports.resetConfig = void 0;
  * Provides a flexible way to inject configuration without hard dependencies
  */
 
+/**
+ * Info lines (each token refresh, each unauthorised URL) reach the device log
+ * and any remote sink, so a release build that sets nothing logs warnings and
+ * errors only.
+ */
+const DEFAULT_LOG_LEVEL = exports.DEFAULT_LOG_LEVEL = __DEV__ ? 'info' : 'warn';
 const DEFAULT_CONFIG = {
   baseUrl: null,
   loggingEnabled: true,
-  logLevel: 'info',
+  logLevel: DEFAULT_LOG_LEVEL,
   environment: 'Development',
   country: 'in',
   appId: null,

package/lib/commonjs/formatters/currency.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.formatCurrency = void 0;
+var _intlCache = require("./intlCache.js");
 const hasIntlNumber = () => typeof Intl !== 'undefined' && typeof Intl.NumberFormat === 'function';
 const indianGroupingFallback = (n, fractionDigits) => {
   // Indian numbering: 1,23,45,678.90 (last 3 digits, then groups of 2).
@@ -41,7 +42,7 @@ const formatCurrency = (amount, options = {}) => {
   const minFrac = minimumFractionDigits ?? (Number.isInteger(amount) ? 0 : 2);
   if (hasIntlNumber()) {
     try {
-      const formatted = new Intl.NumberFormat(locale, {
+      const formatted = (0, _intlCache.numberFormat)(locale, {
         style: 'currency',
         currency,
         minimumFractionDigits: minFrac,

package/lib/commonjs/formatters/date.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.formatTime = exports.formatRelativeTime = exports.formatDateTime = exports.formatDate = void 0;
+var _intlCache = require("./intlCache.js");
 const toDate = value => {
   if (value instanceof Date) {
     return Number.isNaN(value.getTime()) ? null : value;
@@ -52,7 +53,7 @@ const formatDate = (value, style = 'medium', locale = 'en-IN') => {
   }
   if (hasIntl()) {
     try {
-      return new Intl.DateTimeFormat(locale, {
+      return (0, _intlCache.dateTimeFormat)(locale, {
         dateStyle: style
       }).format(d);
     } catch {
@@ -73,7 +74,7 @@ const formatTime = (value, style = 'short', locale = 'en-IN') => {
   }
   if (hasIntl()) {
     try {
-      return new Intl.DateTimeFormat(locale, {
+      return (0, _intlCache.dateTimeFormat)(locale, {
         timeStyle: style
       }).format(d);
     } catch {
@@ -94,7 +95,7 @@ const formatDateTime = (value, dateStyle = 'medium', timeStyle = 'short', locale
   }
   if (hasIntl()) {
     try {
-      return new Intl.DateTimeFormat(locale, {
+      return (0, _intlCache.dateTimeFormat)(locale, {
         dateStyle,
         timeStyle
       }).format(d);
@@ -152,9 +153,7 @@ const formatRelativeTime = (value, base = new Date(), locale = 'en-IN') => {
   const Rtf = hasIntl() ? Intl.RelativeTimeFormat : undefined;
   if (typeof Rtf === 'function') {
     try {
-      return new Rtf(locale, {
-        numeric: 'auto'
-      }).format(amount, unit);
+      return (0, _intlCache.relativeTimeFormat)(Rtf, locale).format(amount, unit);
     } catch {
       /* fall through */
     }

package/lib/commonjs/formatters/dateMath.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.startOfDay = exports.isSameDay = exports.isDateBefore = exports.isDateAfter = exports.formatTimeInZone = exports.formatTimeInWindowsZone = exports.formatTime12h = exports.formatDatePattern = exports.formatDateISO = exports.formatDateDDMMMYYYY = exports.diffMs = exports.addDays = void 0;
+var _intlCache = require("./intlCache.js");
 var _windowsToIanaTable = require("./windowsToIanaTable.js");
 const toDate = value => {
   if (value instanceof Date) {
@@ -277,7 +278,7 @@ const formatTimeInZone = (value, ianaTimeZone) => {
     // answer available, not a genuine timezone conversion.
     return formatTime12h(d);
   }
-  const parts = new Intl.DateTimeFormat('en-US', {
+  const parts = (0, _intlCache.dateTimeFormat)('en-US', {
     timeZone: ianaTimeZone,
     hour: 'numeric',
     minute: '2-digit',

package/lib/commonjs/formatters/intlCache.js

@@ -0,0 +1,37 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.relativeTimeFormat = exports.numberFormat = exports.dateTimeFormat = void 0;
+/**
+ * Building an Intl formatter costs far more than using one (and on Hermes for
+ * Android it goes through ICU over JNI), while list rows and slider frames call
+ * the formatters many times with the same arguments. Formatters are therefore
+ * built once per locale and options. The limit only guards against unbounded
+ * input such as arbitrary time zones; real apps use a handful of keys.
+ */
+const LIMIT = 100;
+const cached = (cache, key, create) => {
+  let formatter = cache.get(key);
+  if (formatter === undefined) {
+    formatter = create();
+    if (cache.size >= LIMIT) {
+      cache.clear();
+    }
+    cache.set(key, formatter);
+  }
+  return formatter;
+};
+const numberFormats = new Map();
+const dateTimeFormats = new Map();
+const relativeTimeFormats = new Map();
+const numberFormat = (locale, options = {}) => cached(numberFormats, `${locale}|${JSON.stringify(options)}`, () => new Intl.NumberFormat(locale, options));
+exports.numberFormat = numberFormat;
+const dateTimeFormat = (locale, options) => cached(dateTimeFormats, `${locale}|${JSON.stringify(options)}`, () => new Intl.DateTimeFormat(locale, options));
+exports.dateTimeFormat = dateTimeFormat;
+const relativeTimeFormat = (RelativeTimeFormat, locale) => cached(relativeTimeFormats, locale, () => new RelativeTimeFormat(locale, {
+  numeric: 'auto'
+}));
+exports.relativeTimeFormat = relativeTimeFormat;
+//# sourceMappingURL=intlCache.js.map

package/lib/commonjs/formatters/number.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.formatPercent = exports.formatNumber = exports.formatCompactNumber = void 0;
+var _intlCache = require("./intlCache.js");
 const hasIntlNumber = () => typeof Intl !== 'undefined' && typeof Intl.NumberFormat === 'function';
 
 /**
@@ -20,7 +21,7 @@ const formatNumber = (value, fractionDigits, locale = 'en-IN') => {
         opts.minimumFractionDigits = fractionDigits;
         opts.maximumFractionDigits = fractionDigits;
       }
-      return new Intl.NumberFormat(locale, opts).format(value);
+      return (0, _intlCache.numberFormat)(locale, opts).format(value);
     } catch {
       /* fall through */
     }
@@ -40,7 +41,7 @@ const formatPercent = (value, fractionDigits = 0, asRatio = true, locale = 'en-I
   const ratio = asRatio ? value : value / 100;
   if (hasIntlNumber()) {
     try {
-      return new Intl.NumberFormat(locale, {
+      return (0, _intlCache.numberFormat)(locale, {
         style: 'percent',
         minimumFractionDigits: fractionDigits,
         maximumFractionDigits: fractionDigits
@@ -63,7 +64,7 @@ const formatCompactNumber = (value, locale = 'en-IN') => {
   }
   if (hasIntlNumber()) {
     try {
-      return new Intl.NumberFormat(locale, {
+      return (0, _intlCache.numberFormat)(locale, {
         notation: 'compact',
         maximumFractionDigits: 1
       }).format(value);

package/lib/commonjs/index.js

@@ -117,6 +117,12 @@ Object.defineProperty(exports, "diffMs", {
     return _index3.diffMs;
   }
 });
+Object.defineProperty(exports, "encodeBase64", {
+  enumerable: true,
+  get: function () {
+    return _base.encodeBase64;
+  }
+});
 Object.defineProperty(exports, "formatCompactNumber", {
   enumerable: true,
   get: function () {
@@ -630,6 +636,7 @@ var _initUserAuth = require("./initUserAuth.js");
 var _index4 = require("./logger/index.js");
 var _index5 = require("./network/index.js");
 var _index6 = require("./storage/index.js");
+var _base = require("./utils/base64.js");
 var _index7 = require("./validators/index.js");
 var _index8 = require("./versionCheck/index.js");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }

package/lib/commonjs/initSDK.js

@@ -39,7 +39,7 @@ const initWebority = config => {
   (0, _index.setConfig)({
     baseUrl: config.baseUrl,
     loggingEnabled: config.loggingEnabled ?? true,
-    logLevel: config.logLevel || 'info',
+    logLevel: config.logLevel || _index.DEFAULT_LOG_LEVEL,
     environment: config.environment || 'Development',
     country: (config.country || 'in').toLowerCase(),
     appId: config.appId ?? null,

package/lib/commonjs/network/networkStatus.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.useNetworkStatus = exports.setNetworkStatusImplementation = exports.getNetworkStatus = exports.addNetworkStatusListener = void 0;
+exports.useNetworkStatus = exports.setNetworkStatusImplementation = exports.getNetworkStatus = exports.getLastKnownNetworkStatus = exports.addNetworkStatusListener = void 0;
 var ExpoNetwork = _interopRequireWildcard(require("expo-network"));
 var _react = require("react");
 var _index = require("../logger/index.js");
@@ -23,6 +23,13 @@ const DEFAULT_STATUS = {
  * One backend also means one behaviour, rather than each app choosing.
  */
 let override = null;
+let lastKnown = null;
+let stopFollowing = null;
+const stopFollowingNetwork = () => {
+  stopFollowing?.();
+  stopFollowing = null;
+  lastKnown = null;
+};
 
 /**
  * Replace the backend. Intended for TESTS and for the showcase, which uses it
@@ -31,6 +38,7 @@ let override = null;
  */
 const setNetworkStatusImplementation = impl => {
   override = impl;
+  stopFollowingNetwork();
 };
 exports.setNetworkStatusImplementation = setNetworkStatusImplementation;
 const resolveNetInfo = () => override ?? expoNetworkBackend;
@@ -103,11 +111,41 @@ const addNetworkStatusListener = listener => {
   return ni.addEventListener(state => listener(normalize(state)));
 };
 
+/**
+ * The connectivity the HTTP client checks before every request. One listener,
+ * attached on first use, keeps it current, so a request costs no native probe:
+ * one probe seeds the value and the listener's events replace it.
+ */
+exports.addNetworkStatusListener = addNetworkStatusListener;
+const getLastKnownNetworkStatus = async () => {
+  if (!stopFollowing) {
+    try {
+      stopFollowing = addNetworkStatusListener(status => {
+        lastKnown = status;
+      });
+    } catch (error) {
+      _index.Logger.error('[network] could not follow network changes', error);
+      return getNetworkStatus();
+    }
+  }
+  if (lastKnown) {
+    return lastKnown;
+  }
+  const following = stopFollowing;
+  const probed = await getNetworkStatus();
+  if (stopFollowing !== following) {
+    return probed;
+  }
+  // An event that arrived during the probe is newer than the probe.
+  lastKnown ??= probed;
+  return lastKnown;
+};
+
 /**
  * React hook that returns the current network status and re-renders on change.
  * Reports an optimistic online default when NetInfo is not installed.
  */
-exports.addNetworkStatusListener = addNetworkStatusListener;
+exports.getLastKnownNetworkStatus = getLastKnownNetworkStatus;
 const useNetworkStatus = () => {
   const [status, setStatus] = (0, _react.useState)(DEFAULT_STATUS);
   (0, _react.useEffect)(() => {

package/lib/commonjs/utils/base64.js

@@ -0,0 +1,24 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.encodeBase64 = void 0;
+// Small enough for every engine's argument limit in `String.fromCharCode.apply`.
+const CHUNK = 0x2000;
+
+/**
+ * Base64 of raw bytes, for a `data:` URI. Builds a Latin-1 string a chunk at a
+ * time and hands it to the engine's native `btoa` (Hermes ships it), which is
+ * many times faster on the JS thread than encoding byte by byte in JS.
+ */
+const encodeBase64 = buffer => {
+  const bytes = new Uint8Array(buffer);
+  let binary = '';
+  for (let i = 0; i < bytes.length; i += CHUNK) {
+    binary += String.fromCharCode.apply(null, bytes.subarray(i, i + CHUNK));
+  }
+  return btoa(binary);
+};
+exports.encodeBase64 = encodeBase64;
+//# sourceMappingURL=base64.js.map

package/lib/module/api/retry.js

@@ -11,10 +11,26 @@
  * as readily as GETs.
  */
 export const isRetryableStatus = status => typeof status === 'number' && (status === 429 || status >= 500 && status <= 599);
+const IDEMPOTENT_METHODS = new Set(['get', 'head', 'options', 'put', 'delete']);
+
+/**
+ * The same reasoning reaches status codes on a write. A 500 on a POST or PATCH
+ * can follow a partial commit, so replaying it can duplicate the record; only
+ * 429 and 503 say the server refused the request before doing the work. A
+ * request that knows its write is safe to repeat passes its own `shouldRetry`.
+ */
+const isRetryableFailure = error => {
+  const status = error.response?.status;
+  if (!isRetryableStatus(status)) {
+    return false;
+  }
+  const method = (error.config?.method ?? 'get').toLowerCase();
+  return IDEMPOTENT_METHODS.has(method) || status === 429 || status === 503;
+};
 const DEFAULT_POLICY = {
   retries: 3,
   retryDelayMs: attempt => attempt <= 1 ? 0 : 2 ** attempt * 1000,
-  shouldRetry: error => isRetryableStatus(error.response?.status),
+  shouldRetry: isRetryableFailure,
   onRetry: () => undefined
 };
 const waitOrAbort = (delay, signal) => new Promise(resolve => {

package/lib/module/api/userClient.js

@@ -4,7 +4,7 @@ import axios, { AxiosHeaders } from 'axios';
 import { ACCESS_TOKEN_KEY, getToken } from "../auth/authStore.js";
 import { getConfigValue } from "../config/index.js";
 import { Logger } from "../logger/index.js";
-import { getNetworkStatus } from "../network/networkStatus.js";
+import { getLastKnownNetworkStatus } from "../network/networkStatus.js";
 import "../types/axios.js";
 import { applyConfiguredBaseUrl } from "./baseUrl.js";
 import { logCurl } from "./curl.js";
@@ -135,7 +135,7 @@ userClient.interceptors.request.use(async config => {
   // Reject before any network call when the device is known to be offline.
   // Unknown connectivity (netinfo not installed, or undetermined) is treated
   // as online — never block a request on an unavailable probe.
-  const network = await getNetworkStatus();
+  const network = await getLastKnownNetworkStatus();
   if (network.isConnected === false) {
     Logger.warn(`Request blocked: device is offline. URL: ${config.url}`);
     return Promise.reject(new RequestOfflineError());

package/lib/module/auth/authStore.js

@@ -83,6 +83,24 @@ const expoSecureStoreBackend = {
   }
 };
 const resolveBackend = () => backend ?? expoSecureStoreBackend;
+
+/**
+ * Every request reads the access token, and a secure-store read is a native
+ * keychain/keystore decrypt. Reads are therefore served from memory, written
+ * through by `storeToken` and dropped by `removeToken`. `generation` moves on
+ * every write, removal and backend swap, so a read that started before one of
+ * those cannot cache the value it saw.
+ */
+const memo = new Map();
+let generation = 0;
+const forget = key => {
+  generation += 1;
+  if (key === undefined) {
+    memo.clear();
+  } else {
+    memo.delete(key);
+  }
+};
 const requireBackend = op => {
   const b = resolveBackend();
   if (!b) {
@@ -100,6 +118,7 @@ const requireBackend = op => {
  */
 export const setKeychainImplementation = impl => {
   backend = impl;
+  forget();
 };
 
 /**
@@ -109,6 +128,7 @@ export const storeToken = async (key, token, expiry) => {
   // Never log the token or expiry values: Logger forwards to whatever remote
   // sink the app wired (Crashlytics/Sentry), so a token here leaves the device.
   Logger.info(`Storing token for key: ${key}`);
+  forget(key);
   try {
     const data = JSON.stringify({
       token,
@@ -117,8 +137,14 @@ export const storeToken = async (key, token, expiry) => {
     await requireBackend('store a token').setGenericPassword('token', data, {
       service: key
     });
+    forget(key);
+    memo.set(key, {
+      token,
+      expiry
+    });
     Logger.info(`Token stored successfully for key: ${key}`);
   } catch (error) {
+    forget(key);
     // Log AND rethrow. Swallowing this told the caller the token was persisted
     // when it was not, so an app would show a signed-in user holding a token
     // that never reached the keychain — the session then dies at the next
@@ -156,6 +182,10 @@ const parseTokenData = credentials => {
  * Retrieve token and check if expired.
  */
 export const getToken = async key => {
+  if (memo.has(key)) {
+    return memo.get(key) ?? null;
+  }
+  const seen = generation;
   try {
     const credentials = await requireBackend('read a token').getGenericPassword({
       service: key
@@ -164,24 +194,24 @@ export const getToken = async key => {
     // token, and every authenticated request, image and download asks for one.
     // Warning here put three info lines and a warning into the log, and into the
     // remote crash sink, on every one of those calls.
-    if (!credentials) {
-      return null;
+    let value = null;
+    if (credentials) {
+      const parsedData = parseTokenData(credentials);
+      if (parsedData) {
+        value = {
+          token: parsedData.token,
+          expiry: parsedData.expiry
+        };
+      } else {
+        // Something IS stored and it is not a token. That is corruption worth
+        // hearing about, and it is a different event from having no token.
+        Logger.warn(`Stored credentials for key "${key}" are not a valid token; ignoring them.`);
+      }
     }
-    const parsedData = parseTokenData(credentials);
-    if (!parsedData) {
-      // Something IS stored and it is not a token. That is corruption worth
-      // hearing about, and it is a different event from having no token.
-      Logger.warn(`Stored credentials for key "${key}" are not a valid token; ignoring them.`);
-      return null;
+    if (seen === generation) {
+      memo.set(key, value);
     }
-    const {
-      token,
-      expiry
-    } = parsedData;
-    return {
-      token,
-      expiry
-    };
+    return value;
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     // Both spellings matter. Android throws "Key permanently invalidated" when
@@ -204,6 +234,7 @@ export const getToken = async key => {
  * Remove token by key.
  */
 export const removeToken = async key => {
+  forget(key);
   try {
     await requireBackend('remove a token').resetGenericPassword({
       service: key
@@ -219,6 +250,8 @@ export const removeToken = async key => {
       return;
     }
     Logger.error(`Failed to remove token for key: ${key}`, error);
+  } finally {
+    forget(key);
   }
 };
 //# sourceMappingURL=authStore.js.map

package/lib/module/config/index.js

@@ -5,10 +5,16 @@
  * Provides a flexible way to inject configuration without hard dependencies
  */
 
+/**
+ * Info lines (each token refresh, each unauthorised URL) reach the device log
+ * and any remote sink, so a release build that sets nothing logs warnings and
+ * errors only.
+ */
+export const DEFAULT_LOG_LEVEL = __DEV__ ? 'info' : 'warn';
 const DEFAULT_CONFIG = {
   baseUrl: null,
   loggingEnabled: true,
-  logLevel: 'info',
+  logLevel: DEFAULT_LOG_LEVEL,
   environment: 'Development',
   country: 'in',
   appId: null,

package/lib/module/formatters/currency.js

@@ -1,5 +1,6 @@
 "use strict";
 
+import { numberFormat } from "./intlCache.js";
 const hasIntlNumber = () => typeof Intl !== 'undefined' && typeof Intl.NumberFormat === 'function';
 const indianGroupingFallback = (n, fractionDigits) => {
   // Indian numbering: 1,23,45,678.90 (last 3 digits, then groups of 2).
@@ -37,7 +38,7 @@ export const formatCurrency = (amount, options = {}) => {
   const minFrac = minimumFractionDigits ?? (Number.isInteger(amount) ? 0 : 2);
   if (hasIntlNumber()) {
     try {
-      const formatted = new Intl.NumberFormat(locale, {
+      const formatted = numberFormat(locale, {
         style: 'currency',
         currency,
         minimumFractionDigits: minFrac,

package/lib/module/formatters/date.js

@@ -1,5 +1,6 @@
 "use strict";
 
+import { dateTimeFormat, relativeTimeFormat } from "./intlCache.js";
 const toDate = value => {
   if (value instanceof Date) {
     return Number.isNaN(value.getTime()) ? null : value;
@@ -48,7 +49,7 @@ export const formatDate = (value, style = 'medium', locale = 'en-IN') => {
   }
   if (hasIntl()) {
     try {
-      return new Intl.DateTimeFormat(locale, {
+      return dateTimeFormat(locale, {
         dateStyle: style
       }).format(d);
     } catch {
@@ -68,7 +69,7 @@ export const formatTime = (value, style = 'short', locale = 'en-IN') => {
   }
   if (hasIntl()) {
     try {
-      return new Intl.DateTimeFormat(locale, {
+      return dateTimeFormat(locale, {
         timeStyle: style
       }).format(d);
     } catch {
@@ -88,7 +89,7 @@ export const formatDateTime = (value, dateStyle = 'medium', timeStyle = 'short',
   }
   if (hasIntl()) {
     try {
-      return new Intl.DateTimeFormat(locale, {
+      return dateTimeFormat(locale, {
         dateStyle,
         timeStyle
       }).format(d);
@@ -145,9 +146,7 @@ export const formatRelativeTime = (value, base = new Date(), locale = 'en-IN') =
   const Rtf = hasIntl() ? Intl.RelativeTimeFormat : undefined;
   if (typeof Rtf === 'function') {
     try {
-      return new Rtf(locale, {
-        numeric: 'auto'
-      }).format(amount, unit);
+      return relativeTimeFormat(Rtf, locale).format(amount, unit);
     } catch {
       /* fall through */
     }

package/lib/module/formatters/dateMath.js

@@ -1,5 +1,6 @@
 "use strict";
 
+import { dateTimeFormat } from "./intlCache.js";
 import { WINDOWS_TO_IANA } from "./windowsToIanaTable.js";
 const toDate = value => {
   if (value instanceof Date) {
@@ -263,7 +264,7 @@ export const formatTimeInZone = (value, ianaTimeZone) => {
     // answer available, not a genuine timezone conversion.
     return formatTime12h(d);
   }
-  const parts = new Intl.DateTimeFormat('en-US', {
+  const parts = dateTimeFormat('en-US', {
     timeZone: ianaTimeZone,
     hour: 'numeric',
     minute: '2-digit',

package/lib/module/formatters/intlCache.js

@@ -0,0 +1,30 @@
+"use strict";
+
+/**
+ * Building an Intl formatter costs far more than using one (and on Hermes for
+ * Android it goes through ICU over JNI), while list rows and slider frames call
+ * the formatters many times with the same arguments. Formatters are therefore
+ * built once per locale and options. The limit only guards against unbounded
+ * input such as arbitrary time zones; real apps use a handful of keys.
+ */
+const LIMIT = 100;
+const cached = (cache, key, create) => {
+  let formatter = cache.get(key);
+  if (formatter === undefined) {
+    formatter = create();
+    if (cache.size >= LIMIT) {
+      cache.clear();
+    }
+    cache.set(key, formatter);
+  }
+  return formatter;
+};
+const numberFormats = new Map();
+const dateTimeFormats = new Map();
+const relativeTimeFormats = new Map();
+export const numberFormat = (locale, options = {}) => cached(numberFormats, `${locale}|${JSON.stringify(options)}`, () => new Intl.NumberFormat(locale, options));
+export const dateTimeFormat = (locale, options) => cached(dateTimeFormats, `${locale}|${JSON.stringify(options)}`, () => new Intl.DateTimeFormat(locale, options));
+export const relativeTimeFormat = (RelativeTimeFormat, locale) => cached(relativeTimeFormats, locale, () => new RelativeTimeFormat(locale, {
+  numeric: 'auto'
+}));
+//# sourceMappingURL=intlCache.js.map

package/lib/module/formatters/number.js

@@ -1,5 +1,6 @@
 "use strict";
 
+import { numberFormat } from "./intlCache.js";
 const hasIntlNumber = () => typeof Intl !== 'undefined' && typeof Intl.NumberFormat === 'function';
 
 /**
@@ -16,7 +17,7 @@ export const formatNumber = (value, fractionDigits, locale = 'en-IN') => {
         opts.minimumFractionDigits = fractionDigits;
         opts.maximumFractionDigits = fractionDigits;
       }
-      return new Intl.NumberFormat(locale, opts).format(value);
+      return numberFormat(locale, opts).format(value);
     } catch {
       /* fall through */
     }
@@ -35,7 +36,7 @@ export const formatPercent = (value, fractionDigits = 0, asRatio = true, locale
   const ratio = asRatio ? value : value / 100;
   if (hasIntlNumber()) {
     try {
-      return new Intl.NumberFormat(locale, {
+      return numberFormat(locale, {
         style: 'percent',
         minimumFractionDigits: fractionDigits,
         maximumFractionDigits: fractionDigits
@@ -57,7 +58,7 @@ export const formatCompactNumber = (value, locale = 'en-IN') => {
   }
   if (hasIntlNumber()) {
     try {
-      return new Intl.NumberFormat(locale, {
+      return numberFormat(locale, {
         notation: 'compact',
         maximumFractionDigits: 1
       }).format(value);

package/lib/module/index.js

@@ -48,6 +48,8 @@ export { addNetworkStatusListener, getNetworkStatus, setNetworkStatusImplementat
 // Storage: the API and the seam. No native package is required; wire one with
 // setStorageImplementation to get persistence.
 export { isStorageAvailable, Storage, setStorageImplementation } from "./storage/index.js";
+// Bytes
+export { encodeBase64 } from "./utils/base64.js";
 // Validators
 export { isAadhaar, isAlphanumeric, isBetween, isEmail, isGstin, isHexColor, isIfsc, isIndianMobile, isIndianPincode, isInteger, isNonEmpty, isNumeric, isPan, isPhone, isStrongPassword, isUrl, maxLength, minLength } from "./validators/index.js";
 // Version check (the ForceUpdateDialog UI lives in @webority/mobile-ui)

package/lib/module/initSDK.js

@@ -6,7 +6,7 @@
  */
 
 import { setKeychainImplementation } from "./auth/authStore.js";
-import { setConfig } from "./config/index.js";
+import { DEFAULT_LOG_LEVEL, setConfig } from "./config/index.js";
 import { Logger } from "./logger/index.js";
 import { setNetworkStatusImplementation } from "./network/networkStatus.js";
 import { setStorageImplementation } from "./storage/index.js";
@@ -35,7 +35,7 @@ export const initWebority = config => {
   setConfig({
     baseUrl: config.baseUrl,
     loggingEnabled: config.loggingEnabled ?? true,
-    logLevel: config.logLevel || 'info',
+    logLevel: config.logLevel || DEFAULT_LOG_LEVEL,
     environment: config.environment || 'Development',
     country: (config.country || 'in').toLowerCase(),
     appId: config.appId ?? null,

package/lib/module/network/networkStatus.js

@@ -18,6 +18,13 @@ const DEFAULT_STATUS = {
  * One backend also means one behaviour, rather than each app choosing.
  */
 let override = null;
+let lastKnown = null;
+let stopFollowing = null;
+const stopFollowingNetwork = () => {
+  stopFollowing?.();
+  stopFollowing = null;
+  lastKnown = null;
+};
 
 /**
  * Replace the backend. Intended for TESTS and for the showcase, which uses it
@@ -26,6 +33,7 @@ let override = null;
  */
 export const setNetworkStatusImplementation = impl => {
   override = impl;
+  stopFollowingNetwork();
 };
 const resolveNetInfo = () => override ?? expoNetworkBackend;
 
@@ -96,6 +104,35 @@ export const addNetworkStatusListener = listener => {
   return ni.addEventListener(state => listener(normalize(state)));
 };
 
+/**
+ * The connectivity the HTTP client checks before every request. One listener,
+ * attached on first use, keeps it current, so a request costs no native probe:
+ * one probe seeds the value and the listener's events replace it.
+ */
+export const getLastKnownNetworkStatus = async () => {
+  if (!stopFollowing) {
+    try {
+      stopFollowing = addNetworkStatusListener(status => {
+        lastKnown = status;
+      });
+    } catch (error) {
+      Logger.error('[network] could not follow network changes', error);
+      return getNetworkStatus();
+    }
+  }
+  if (lastKnown) {
+    return lastKnown;
+  }
+  const following = stopFollowing;
+  const probed = await getNetworkStatus();
+  if (stopFollowing !== following) {
+    return probed;
+  }
+  // An event that arrived during the probe is newer than the probe.
+  lastKnown ??= probed;
+  return lastKnown;
+};
+
 /**
  * React hook that returns the current network status and re-renders on change.
  * Reports an optimistic online default when NetInfo is not installed.

package/lib/module/utils/base64.js

@@ -0,0 +1,19 @@
+"use strict";
+
+// Small enough for every engine's argument limit in `String.fromCharCode.apply`.
+const CHUNK = 0x2000;
+
+/**
+ * Base64 of raw bytes, for a `data:` URI. Builds a Latin-1 string a chunk at a
+ * time and hands it to the engine's native `btoa` (Hermes ships it), which is
+ * many times faster on the JS thread than encoding byte by byte in JS.
+ */
+export const encodeBase64 = buffer => {
+  const bytes = new Uint8Array(buffer);
+  let binary = '';
+  for (let i = 0; i < bytes.length; i += CHUNK) {
+    binary += String.fromCharCode.apply(null, bytes.subarray(i, i + CHUNK));
+  }
+  return btoa(binary);
+};
+//# sourceMappingURL=base64.js.map

package/lib/typescript/commonjs/config/index.d.ts

@@ -34,6 +34,12 @@ export interface Config {
      */
     logCurl: boolean;
 }
+/**
+ * Info lines (each token refresh, each unauthorised URL) reach the device log
+ * and any remote sink, so a release build that sets nothing logs warnings and
+ * errors only.
+ */
+export declare const DEFAULT_LOG_LEVEL: LogLevel;
 /**
  * Set global configuration for all Webority packages
  */

package/lib/typescript/commonjs/formatters/intlCache.d.ts

@@ -0,0 +1,6 @@
+export declare const numberFormat: (locale: string, options?: Intl.NumberFormatOptions) => Intl.NumberFormat;
+export declare const dateTimeFormat: (locale: string, options: Intl.DateTimeFormatOptions) => Intl.DateTimeFormat;
+export declare const relativeTimeFormat: (RelativeTimeFormat: new (locale: string, options?: {
+    numeric?: "always" | "auto";
+}) => Intl.RelativeTimeFormat, locale: string) => Intl.RelativeTimeFormat;
+//# sourceMappingURL=intlCache.d.ts.map

package/lib/typescript/commonjs/index.d.ts

@@ -48,6 +48,7 @@ export type { NetworkConnectionType, NetworkStatus, NetworkStatusLike, NetworkSt
 export { addNetworkStatusListener, getNetworkStatus, setNetworkStatusImplementation, useNetworkStatus } from './network';
 export type { AsyncStorageLike, StorageApi } from './storage';
 export { isStorageAvailable, Storage, setStorageImplementation } from './storage';
+export { encodeBase64 } from './utils/base64';
 export type { PasswordRules } from './validators';
 export { isAadhaar, isAlphanumeric, isBetween, isEmail, isGstin, isHexColor, isIfsc, isIndianMobile, isIndianPincode, isInteger, isNonEmpty, isNumeric, isPan, isPhone, isStrongPassword, isUrl, maxLength, minLength } from './validators';
 export type { DeviceInfoLike, ParsedVersion, Platform, UpdateInfo, UpdateType, VersionCheckResult, VersionCheckType, VersionComparison, VersionData } from './versionCheck';

package/lib/typescript/commonjs/initSDK.d.ts

@@ -11,7 +11,7 @@ export interface InitConfig {
     baseUrl: string;
     /** Enable/disable logging. Defaults to `true`. */
     loggingEnabled?: boolean;
-    /** Log level. Defaults to `'info'`. */
+    /** Log level. Defaults to `'info'` in development and `'warn'` in a release build. */
     logLevel?: LogLevel;
     /** Environment. Defaults to `'Development'`. */
     environment?: Environment;

package/lib/typescript/commonjs/network/networkStatus.d.ts

@@ -34,6 +34,12 @@ export declare const getNetworkStatus: () => Promise<NetworkStatus>;
  * Subscribe to network status changes. Returns an unsubscribe function.
  */
 export declare const addNetworkStatusListener: (listener: NetworkStatusListener) => (() => void);
+/**
+ * The connectivity the HTTP client checks before every request. One listener,
+ * attached on first use, keeps it current, so a request costs no native probe:
+ * one probe seeds the value and the listener's events replace it.
+ */
+export declare const getLastKnownNetworkStatus: () => Promise<NetworkStatus>;
 /**
  * React hook that returns the current network status and re-renders on change.
  * Reports an optimistic online default when NetInfo is not installed.

package/lib/typescript/commonjs/utils/base64.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Base64 of raw bytes, for a `data:` URI. Builds a Latin-1 string a chunk at a
+ * time and hands it to the engine's native `btoa` (Hermes ships it), which is
+ * many times faster on the JS thread than encoding byte by byte in JS.
+ */
+export declare const encodeBase64: (buffer: ArrayBuffer) => string;
+//# sourceMappingURL=base64.d.ts.map

package/lib/typescript/module/config/index.d.ts

@@ -34,6 +34,12 @@ export interface Config {
      */
     logCurl: boolean;
 }
+/**
+ * Info lines (each token refresh, each unauthorised URL) reach the device log
+ * and any remote sink, so a release build that sets nothing logs warnings and
+ * errors only.
+ */
+export declare const DEFAULT_LOG_LEVEL: LogLevel;
 /**
  * Set global configuration for all Webority packages
  */

package/lib/typescript/module/formatters/intlCache.d.ts

@@ -0,0 +1,6 @@
+export declare const numberFormat: (locale: string, options?: Intl.NumberFormatOptions) => Intl.NumberFormat;
+export declare const dateTimeFormat: (locale: string, options: Intl.DateTimeFormatOptions) => Intl.DateTimeFormat;
+export declare const relativeTimeFormat: (RelativeTimeFormat: new (locale: string, options?: {
+    numeric?: "always" | "auto";
+}) => Intl.RelativeTimeFormat, locale: string) => Intl.RelativeTimeFormat;
+//# sourceMappingURL=intlCache.d.ts.map

package/lib/typescript/module/index.d.ts

@@ -48,6 +48,7 @@ export type { NetworkConnectionType, NetworkStatus, NetworkStatusLike, NetworkSt
 export { addNetworkStatusListener, getNetworkStatus, setNetworkStatusImplementation, useNetworkStatus } from './network/index.js';
 export type { AsyncStorageLike, StorageApi } from './storage/index.js';
 export { isStorageAvailable, Storage, setStorageImplementation } from './storage/index.js';
+export { encodeBase64 } from './utils/base64.js';
 export type { PasswordRules } from './validators/index.js';
 export { isAadhaar, isAlphanumeric, isBetween, isEmail, isGstin, isHexColor, isIfsc, isIndianMobile, isIndianPincode, isInteger, isNonEmpty, isNumeric, isPan, isPhone, isStrongPassword, isUrl, maxLength, minLength } from './validators/index.js';
 export type { DeviceInfoLike, ParsedVersion, Platform, UpdateInfo, UpdateType, VersionCheckResult, VersionCheckType, VersionComparison, VersionData } from './versionCheck/index.js';

package/lib/typescript/module/initSDK.d.ts

@@ -11,7 +11,7 @@ export interface InitConfig {
     baseUrl: string;
     /** Enable/disable logging. Defaults to `true`. */
     loggingEnabled?: boolean;
-    /** Log level. Defaults to `'info'`. */
+    /** Log level. Defaults to `'info'` in development and `'warn'` in a release build. */
     logLevel?: LogLevel;
     /** Environment. Defaults to `'Development'`. */
     environment?: Environment;

package/lib/typescript/module/network/networkStatus.d.ts

@@ -34,6 +34,12 @@ export declare const getNetworkStatus: () => Promise<NetworkStatus>;
  * Subscribe to network status changes. Returns an unsubscribe function.
  */
 export declare const addNetworkStatusListener: (listener: NetworkStatusListener) => (() => void);
+/**
+ * The connectivity the HTTP client checks before every request. One listener,
+ * attached on first use, keeps it current, so a request costs no native probe:
+ * one probe seeds the value and the listener's events replace it.
+ */
+export declare const getLastKnownNetworkStatus: () => Promise<NetworkStatus>;
 /**
  * React hook that returns the current network status and re-renders on change.
  * Reports an optimistic online default when NetInfo is not installed.

package/lib/typescript/module/utils/base64.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Base64 of raw bytes, for a `data:` URI. Builds a Latin-1 string a chunk at a
+ * time and hands it to the engine's native `btoa` (Hermes ships it), which is
+ * many times faster on the JS thread than encoding byte by byte in JS.
+ */
+export declare const encodeBase64: (buffer: ArrayBuffer) => string;
+//# sourceMappingURL=base64.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webority/mobile-core",
-  "version": "0.0.26",
+  "version": "0.0.27",
   "description": "Platform layer for Webority React Native apps: HTTP clients, auth/token storage, config, logging, formatters, validators, network status, permissions, storage and version checks. No UI.",
   "keywords": [
     "react-native",