@webority/mobile-core 0.0.29 → 0.1.0

package/lib/module/api/baseUrl.js

@@ -1,30 +1 @@
-"use strict";
-
-import { getConfigValue } from "../config/index.js";
-
-/**
- * Resolves `baseURL` PER REQUEST rather than at module evaluation.
- *
- * `axios.create({ baseURL: getConfigValue('baseUrl') })` reads the value once,
- * when the module is first imported — which happens the moment anything touches
- * the package barrel, long before an app's startup code can call `setConfig`.
- * The result was a client permanently pinned to `undefined` and a `setConfig`
- * that appeared to do nothing, with no error anywhere: requests just went to a
- * relative URL.
- *
- * A consumer cannot fix that by ordering its own imports, because the import
- * that loses the race is usually one it never wrote. So the clients stop
- * capturing the value and ask for it per request instead.
- *
- * An explicit per-request `baseURL` still wins, which is what keeps a one-off
- * call to a different host possible.
- */
-export const applyConfiguredBaseUrl = client => {
-  client.interceptors.request.use(config => {
-    if (!config.baseURL) {
-      config.baseURL = getConfigValue('baseUrl') ?? undefined;
-    }
-    return config;
-  });
-};
-//# sourceMappingURL=baseUrl.js.map
+import{getConfigValue as e}from"../config/index.js";export const applyConfiguredBaseUrl=r=>{r.interceptors.request.use(r=>(r.baseURL||(r.baseURL=e("baseUrl")??void 0),r))};

package/lib/module/api/curl.js

@@ -1,104 +1 @@
-"use strict";
-
-import { Logger } from "../logger/index.js";
-
-/**
- * Header names whose VALUE is a credential. Matched case-insensitively against
- * the whole name, since `Authorization` and `authorization` are the same header
- * and axios does not normalise the case of headers a caller sets by hand.
- */
-const SECRET_HEADERS = new Set(['authorization', 'proxy-authorization', 'cookie', 'set-cookie', 'x-api-key', 'x-auth-token', 'x-access-token', 'x-refresh-token', 'api-key']);
-
-/**
- * Body fields whose value is a credential. Matched on the key alone, so this
- * catches `password`, `newPassword` and `password_confirmation` alike.
- */
-const SECRET_BODY_PATTERN = /pass(word|code)|secret|token|otp|pin|cvv|authoriz/i;
-
-/** The axios per-method header buckets, which are config plumbing, not headers. */
-const AXIOS_METHOD_KEYS = new Set(['common', 'delete', 'get', 'head', 'post', 'put', 'patch']);
-const REDACTED = '<redacted>';
-const redactBody = (value, seen, depth = 0) => {
-  if (value === null || typeof value !== 'object') {
-    return value;
-  }
-  // Both guards are needed and they catch different shapes. `seen` breaks a
-  // true cycle, which would otherwise recurse forever AND make the eventual
-  // JSON.stringify throw. The depth bound catches a body that is merely
-  // enormous. A curl line is a debugging aid, and it must never be able to
-  // hang or fail the request it is describing.
-  if (seen.has(value)) {
-    return '<circular>';
-  }
-  if (depth > 6) {
-    return '<truncated>';
-  }
-  seen.add(value);
-  if (Array.isArray(value)) {
-    return value.map(entry => redactBody(entry, seen, depth + 1));
-  }
-  const out = {};
-  for (const [key, entry] of Object.entries(value)) {
-    out[key] = SECRET_BODY_PATTERN.test(key) ? REDACTED : redactBody(entry, seen, depth + 1);
-  }
-  return out;
-};
-const buildUrl = config => {
-  const url = config.url ?? '';
-  const base = config.baseURL ? config.baseURL.replace(/\/$/, '') : '';
-  let complete = url.startsWith('http') ? url : `${base}/${url.replace(/^\//, '')}`;
-  if (config.params) {
-    const query = new URLSearchParams(config.params).toString();
-    if (query) {
-      complete += (complete.includes('?') ? '&' : '?') + query;
-    }
-  }
-  return complete;
-};
-
-/**
- * Builds a copy-pasteable curl command for a request, with every credential
- * replaced by a placeholder.
- *
- * The redaction is the point, not a nicety. An unredacted version of this in a
- * consumer app put `Authorization: Bearer <token>` and the login request's
- * plaintext password into the device console of a *release* staging build.
- * A curl line is worth having; a curl line that has to be trusted not to be
- * enabled in the wrong build is not.
- */
-export const buildCurl = config => {
-  const method = (config.method ?? 'get').toUpperCase();
-  let command = `curl -X ${method} "${buildUrl(config)}"`;
-  const headers = config.headers;
-  if (headers) {
-    for (const [key, value] of Object.entries(headers)) {
-      if (AXIOS_METHOD_KEYS.has(key)) {
-        continue;
-      }
-      if (typeof value !== 'string' && typeof value !== 'number') {
-        continue;
-      }
-      const shown = SECRET_HEADERS.has(key.toLowerCase()) ? REDACTED : value;
-      command += ` -H "${key}: ${shown}"`;
-    }
-  }
-  if (config.data !== undefined && config.data !== null) {
-    const redacted = typeof config.data === 'object' ? redactBody(config.data, new WeakSet()) : config.data;
-    const body = typeof redacted === 'object' ? JSON.stringify(redacted) : String(redacted);
-    command += ` -d '${body.replace(/'/g, "'\\''")}'`;
-  }
-  return command;
-};
-
-/**
- * Logs the curl equivalent of a request. Never throws: a failure to describe a
- * request must not be able to fail the request itself.
- */
-export const logCurl = config => {
-  try {
-    Logger.info('CURL Command:', buildCurl(config));
-  } catch (error) {
-    Logger.warn('[api] Failed to build a curl command for the request', error);
-  }
-};
-//# sourceMappingURL=curl.js.map
+import{Logger as t}from"../logger/index.js";const e=new Set(["authorization","proxy-authorization","cookie","set-cookie","x-api-key","x-auth-token","x-access-token","x-refresh-token","api-key"]),r=/pass(word|code)|secret|token|otp|pin|cvv|authoriz/i,o=new Set(["common","delete","get","head","post","put","patch"]),a="<redacted>",redactBody=(t,e,o=0)=>{if(null===t||"object"!=typeof t)return t;if(e.has(t))return"<circular>";if(o>6)return"<truncated>";if(e.add(t),Array.isArray(t))return t.map(t=>redactBody(t,e,o+1));const n={};for(const[i,c]of Object.entries(t))n[i]=r.test(i)?a:redactBody(c,e,o+1);return n};export const buildCurl=t=>{let r=`curl -X ${(t.method??"get").toUpperCase()} "${(t=>{const e=t.url??"",r=t.baseURL?t.baseURL.replace(/\/$/,""):"";let o=e.startsWith("http")?e:`${r}/${e.replace(/^\//,"")}`;if(t.params){const e=new URLSearchParams(t.params).toString();e&&(o+=(o.includes("?")?"&":"?")+e)}return o})(t)}"`;const n=t.headers;if(n)for(const[t,i]of Object.entries(n)){if(o.has(t))continue;if("string"!=typeof i&&"number"!=typeof i)continue;const n=e.has(t.toLowerCase())?a:i;r+=` -H "${t}: ${n}"`}if(void 0!==t.data&&null!==t.data){const e="object"==typeof t.data?redactBody(t.data,new WeakSet):t.data;r+=` -d '${("object"==typeof e?JSON.stringify(e):String(e)).replace(/'/g,"'\\''")}'`}return r};export const logCurl=e=>{try{t.info("CURL Command:",buildCurl(e))}catch(e){t.warn("[api] Failed to build a curl command for the request",e)}};

package/lib/module/api/multipart.js

@@ -1,16 +1 @@
-"use strict";
-
-/**
- * The clients default to a JSON content type, and axios then serialises a FormData body to
- * JSON, which breaks every upload. Dropping the header for FormData lets the platform write
- * the multipart header with its boundary.
- */
-export const sendFormDataAsMultipart = client => {
-  client.interceptors.request.use(config => {
-    if (typeof FormData !== 'undefined' && config.data instanceof FormData) {
-      config.headers?.delete?.('Content-Type');
-    }
-    return config;
-  });
-};
-//# sourceMappingURL=multipart.js.map
+export const sendFormDataAsMultipart=e=>{e.interceptors.request.use(e=>("undefined"!=typeof FormData&&e.data instanceof FormData&&e.headers?.delete?.("Content-Type"),e))};

package/lib/module/api/publicClient.js

@@ -1,75 +1 @@
-"use strict";
-
-import axios from 'axios';
-import { getConfigValue } from "../config/index.js";
-import { Logger } from "../logger/index.js";
-import "../types/axios.js";
-import { applyConfiguredBaseUrl } from "./baseUrl.js";
-import { logCurl } from "./curl.js";
-import { sendFormDataAsMultipart } from "./multipart.js";
-import { attachRetry } from "./retry.js";
-
-// Define timeout for requests
-const REQUEST_TIMEOUT = 30000; // 30 seconds
-
-/**
- * Public Axios Client
- * - Base URL: Set your public API base URL.
- * - No Authorization header is attached.
- * - Includes timeout configuration and error handling.
- * - Handles specific HTTP status codes.
- */
-const publicClient = axios.create({
-  headers: {
-    'Content-Type': 'application/json',
-    Accept: 'application/json',
-    'Accept-Encoding': 'gzip, deflate, br'
-  },
-  timeout: REQUEST_TIMEOUT
-});
-applyConfiguredBaseUrl(publicClient);
-sendFormDataAsMultipart(publicClient);
-
-// Registered before the logging interceptors below so they only ever observe
-// the final outcome of a request, not its intermediate retries. The policy
-// itself, and why a bare network error is never retried, lives in ./retry.
-attachRetry(publicClient);
-
-// Add request interceptor for logging
-publicClient.interceptors.request.use(config => {
-  Logger.info(`Request: ${config.method?.toUpperCase()} ${config.url}`);
-  if (getConfigValue('logCurl')) {
-    logCurl(config);
-  }
-  return config;
-}, error => {
-  const message = error instanceof Error ? error.message : String(error);
-  Logger.error('Request error:', message);
-  return Promise.reject(error);
-});
-
-// Add response interceptor for error handling
-publicClient.interceptors.response.use(response => {
-  Logger.info(`Response: ${response.status} from ${response.config.url}`);
-  return response;
-}, error => {
-  if (axios.isAxiosError(error)) {
-    const originalRequest = error.config;
-    if (originalRequest?.skipErrorLog) {
-      return Promise.reject(error);
-    }
-    if (!error.response) {
-      Logger.error(`Network error or no response from server: ${error.message}, URL: ${originalRequest?.url}`);
-    } else {
-      const body = error.response.data;
-      const bodyText = body instanceof ArrayBuffer ? `binary response (${body.byteLength} bytes)` : typeof Blob !== 'undefined' && body instanceof Blob ? `binary response (${body.size} bytes)` : body ?? error.message;
-      Logger.error(`Response error: ${bodyText}, URL: ${originalRequest?.url}, Status: ${error.response.status}`);
-    }
-  } else {
-    const message = error instanceof Error ? error.message : String(error);
-    Logger.error(`Unknown response error: ${message}`);
-  }
-  return Promise.reject(error);
-});
-export default publicClient;
-//# sourceMappingURL=publicClient.js.map
+import r from"axios";import{getConfigValue as e}from"../config/index.js";import{Logger as o}from"../logger/index.js";import"../types/axios.js";import{applyConfiguredBaseUrl as s}from"./baseUrl.js";import{logCurl as t}from"./curl.js";import{sendFormDataAsMultipart as n}from"./multipart.js";import{responseBodyText as i}from"./responseBodyText.js";import{attachRetry as p}from"./retry.js";const m=r.create({headers:{"Content-Type":"application/json",Accept:"application/json"},timeout:3e4});s(m),n(m),p(m),m.interceptors.request.use(r=>(o.info(`Request: ${r.method?.toUpperCase()} ${r.url}`),e("logCurl")&&t(r),r),r=>{const e=r instanceof Error?r.message:String(r);return o.error("Request error:",e),Promise.reject(r)}),m.interceptors.response.use(r=>(o.info(`Response: ${r.status} from ${r.config.url}`),r),e=>{if(r.isAxiosError(e)){const r=e.config;if(r?.skipErrorLog)return Promise.reject(e);e.response?o.error(`Response error: ${i(e.response.data,e.message)}, URL: ${r?.url}, Status: ${e.response.status}`):o.error(`Network error or no response from server: ${e.message}, URL: ${r?.url}`)}else{const r=e instanceof Error?e.message:String(e);o.error(`Unknown response error: ${r}`)}return Promise.reject(e)});export default m;

package/lib/module/api/responseBodyText.js

@@ -0,0 +1 @@
+export const responseBodyText=(e,n)=>{if(null==e||""===e)return n;if(e instanceof ArrayBuffer)return`binary response (${e.byteLength} bytes)`;if("undefined"!=typeof Blob&&e instanceof Blob)return`binary response (${e.size} bytes)`;const r="string"==typeof e?e:JSON.stringify(e);return r.length>500?`${r.slice(0,500)}...`:r};

package/lib/module/api/retry.js

@@ -1,85 +1 @@
-"use strict";
-
-/**
- * Status-based ONLY, deliberately: a bare network error (no `error.response`)
- * is never retryable. Both clients carry non-idempotent requests, login and OTP
- * on the public one and every write on the user one, and a broken connection
- * says nothing about whether the request reached the server. Retrying can
- * therefore create a second session, or a duplicate record, that the user never
- * sees. A generic network-error retry rule is not a substitute: it decides on
- * the transport alone and never looks at the HTTP method, so it retries POSTs
- * as readily as GETs.
- */
-export const isRetryableStatus = status => typeof status === 'number' && (status === 429 || status >= 500 && status <= 599);
-const IDEMPOTENT_METHODS = new Set(['get', 'head', 'options', 'put', 'delete']);
-
-/**
- * The same reasoning reaches status codes on a write. A 500 on a POST or PATCH
- * can follow a partial commit, so replaying it can duplicate the record; only
- * 429 and 503 say the server refused the request before doing the work. A
- * request that knows its write is safe to repeat passes its own `shouldRetry`.
- */
-const isRetryableFailure = error => {
-  const status = error.response?.status;
-  if (!isRetryableStatus(status)) {
-    return false;
-  }
-  const method = (error.config?.method ?? 'get').toLowerCase();
-  return IDEMPOTENT_METHODS.has(method) || status === 429 || status === 503;
-};
-const DEFAULT_POLICY = {
-  retries: 3,
-  retryDelayMs: attempt => attempt <= 1 ? 0 : 2 ** attempt * 1000,
-  shouldRetry: isRetryableFailure,
-  onRetry: () => undefined
-};
-const waitOrAbort = (delay, signal) => new Promise(resolve => {
-  const onAbort = () => {
-    clearTimeout(timer);
-    resolve(false);
-  };
-  const timer = setTimeout(() => {
-    signal?.removeEventListener?.('abort', onAbort);
-    resolve(true);
-  }, delay);
-  signal?.addEventListener?.('abort', onAbort, {
-    once: true
-  });
-});
-export const attachRetry = (client, policy = {}) => {
-  client.interceptors.response.use(undefined, async error => {
-    const axiosError = error;
-    const config = axiosError?.config;
-    if (!config || config.retry === false) {
-      return Promise.reject(error);
-    }
-    const perRequest = typeof config.retry === 'object' ? config.retry : {};
-    const effective = {
-      ...DEFAULT_POLICY,
-      ...policy,
-      ...perRequest
-    };
-    const attempt = (config.__retryAttempt ?? 0) + 1;
-    if (attempt > effective.retries || !effective.shouldRetry(axiosError)) {
-      return Promise.reject(error);
-    }
-    if (config.signal?.aborted) {
-      return Promise.reject(error);
-    }
-
-    // The attempt count rides on the config, which axios copies onto the config
-    // of the retried request, so nested attempts continue the same count and
-    // separate requests never share one.
-    config.__retryAttempt = attempt;
-    // The body was serialised by the first pass; transforming it again would
-    // JSON-encode the already-encoded string.
-    config.transformRequest = [data => data];
-    effective.onRetry(attempt, axiosError);
-    const proceed = await waitOrAbort(effective.retryDelayMs(attempt), config.signal);
-    if (!proceed) {
-      return Promise.reject(error);
-    }
-    return client.request(config);
-  });
-};
-//# sourceMappingURL=retry.js.map
+export const isRetryableStatus=e=>"number"==typeof e&&(429===e||e>=500&&e<=599);const e=new Set(["get","head","options","put","delete"]),t={retries:3,retryDelayMs:e=>e<=1?0:2**e*1e3,shouldRetry:t=>{const r=t.response?.status;if(!isRetryableStatus(r))return!1;const s=(t.config?.method??"get").toLowerCase();return e.has(s)||429===r||503===r},onRetry:()=>{}};export const attachRetry=(e,r={})=>{e.interceptors.response.use(void 0,async s=>{const o=s,n=o?.config;if(!n||!1===n.retry)return Promise.reject(s);const i="object"==typeof n.retry?n.retry:{},a={...t,...r,...i},c=(n.__retryAttempt??0)+1;if(c>a.retries||!a.shouldRetry(o))return Promise.reject(s);if(n.signal?.aborted)return Promise.reject(s);n.__retryAttempt=c,n.transformRequest=[e=>e],a.onRetry(c,o);var y,u;return await(y=a.retryDelayMs(c),u=n.signal,new Promise(e=>{const onAbort=()=>{clearTimeout(t),e(!1)},t=setTimeout(()=>{u?.removeEventListener?.("abort",onAbort),e(!0)},y);u?.addEventListener?.("abort",onAbort,{once:!0})}))?e.request(n):Promise.reject(s)})};

package/lib/module/api/tokenRefresh.js

@@ -1,192 +1 @@
-"use strict";
-
-import axios from 'axios';
-import { ACCESS_TOKEN_KEY, getToken, REFRESH_TOKEN_KEY, storeToken } from "../auth/authStore.js";
-import { Logger } from "../logger/index.js";
-import publicClient from "./publicClient.js";
-
-/**
- * The one token-refresh flow in the library, run by userClient's interceptors.
- * The library calls the refresh endpoint itself, so it can tell a rejected
- * refresh token (400 or 401: the session is over) from a transient failure
- * (network, timeout, 5xx: the session is kept and the caller sees the error).
- * A refresh is single flight. A download goes through the app's client, so it
- * reaches this only when that client is userClient.
- */
-
-/**
- * Minimal Redux-store shape required by the user client to dispatch logout.
- */
-
-let store;
-let auth;
-export const injectStore = _store => {
-  store = _store;
-};
-export const injectUserAuth = options => {
-  auth = options;
-};
-
-// Single promise to track token refresh
-let refreshTokenPromise = null;
-
-// Queue for failed requests
-let failedQueue = [];
-
-/**
- * Processes the queue of failed requests.
- */
-const processQueue = (error, token = null) => {
-  failedQueue.forEach(({
-    resolve,
-    reject
-  }) => {
-    if (error) {
-      reject(error);
-    } else if (token !== null) {
-      resolve(token);
-    }
-  });
-  failedQueue = [];
-};
-
-/**
- * Clear any in-flight token refresh and reject everything queued behind it.
- * Call this on logout.
- *
- * Without it, a refresh that was already in flight when the user logged out
- * resolves afterwards and replays every queued request with a token for a
- * session that has ended. The queue is module state, so it survives the logout
- * entirely: nothing else clears it. A consumer app hit this and hand-wrote the
- * same function locally, which is how it was found.
- */
-export const resetRefreshState = () => {
-  refreshTokenPromise = null;
-  processQueue(new Error('[@webority/mobile-core] Session ended'));
-};
-export const getErrorMessage = error => {
-  if (error instanceof Error) {
-    return error.message;
-  }
-  if (typeof error === 'string') {
-    return error;
-  }
-  return 'Unknown error';
-};
-const requireAuth = () => {
-  if (!store || !auth) {
-    throw new Error('User package store is not initialized. Call initUserAuth first.');
-  }
-  return {
-    store,
-    auth
-  };
-};
-
-/** The refresh endpoint's path, once initUserAuth has run. */
-export const getRefreshPath = () => auth?.refresh.path;
-export const dispatchLogout = async () => {
-  const wired = requireAuth();
-  await wired.store.dispatch(wired.auth.logout());
-};
-export const isRefreshInFlight = () => refreshTokenPromise !== null;
-
-/** Wait for the in-flight refresh without joining it: resolved or rejected by processQueue. */
-export const queueBehindRefresh = () => new Promise((resolve, reject) => {
-  failedQueue.push({
-    resolve,
-    reject
-  });
-});
-
-/** A failure that proves the session is over, as opposed to one worth retrying later. */
-class SessionEndedError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = 'SessionEndedError';
-    // Babel's class transform can drop the prototype link, which makes
-    // `instanceof SessionEndedError` false in the transpiled build.
-    Object.setPrototypeOf(this, SessionEndedError.prototype);
-  }
-}
-const endsSession = error => error instanceof SessionEndedError || axios.isAxiosError(error) && (error.response?.status === 400 || error.response?.status === 401);
-const asString = (value, field) => {
-  if (typeof value !== 'string' || value === '') {
-    throw new Error(`The refresh response has no "${field}".`);
-  }
-  return value;
-};
-
-/** The Webority API's refresh response. */
-const readWeborityTokens = data => {
-  const body = data ?? {};
-  return {
-    accessToken: asString(body.accessToken, 'accessToken'),
-    accessTokenExpiry: asString(body.accessTokenExpiration, 'accessTokenExpiration'),
-    refreshToken: asString(body.refreshToken, 'refreshToken'),
-    refreshTokenExpiry: asString(body.refreshTokenExpiration, 'refreshTokenExpiration')
-  };
-};
-const callRefreshEndpoint = async refresh => {
-  const refreshToken = await getToken(REFRESH_TOKEN_KEY);
-  if (!refreshToken?.token) {
-    throw new SessionEndedError('No refresh token available');
-  }
-  // An expired refresh token would only earn a 401 from the endpoint before the same logout.
-  if (Date.parse(refreshToken.expiry) <= Date.now()) {
-    throw new SessionEndedError('Refresh token expired');
-  }
-  const accessToken = await getToken(ACCESS_TOKEN_KEY);
-  const tokens = {
-    accessToken: accessToken?.token ?? null,
-    refreshToken: refreshToken.token
-  };
-  const body = refresh.body ? await refresh.body(tokens) : tokens;
-  Logger.info('Refreshing the access token');
-  const {
-    data
-  } = await publicClient.post(refresh.path, body);
-  const next = (refresh.readTokens ?? readWeborityTokens)(data);
-  await storeToken(ACCESS_TOKEN_KEY, next.accessToken, next.accessTokenExpiry);
-  await storeToken(REFRESH_TOKEN_KEY, next.refreshToken, next.refreshTokenExpiry);
-  Logger.info('Access token refreshed');
-  return next.accessToken;
-};
-
-/**
- * Refresh the access token, joining a refresh already in flight rather than
- * starting a second one. Every request queued behind it is replayed on success
- * and rejected on failure. Logs out only when the failure proves the session
- * is over; a network error, timeout or 5xx keeps it and rejects.
- */
-export const refreshAccessToken = () => {
-  if (refreshTokenPromise) {
-    return refreshTokenPromise;
-  }
-  const run = async () => {
-    try {
-      const token = await callRefreshEndpoint(requireAuth().auth.refresh);
-      processQueue(null, token);
-      return token;
-    } catch (error) {
-      const responseData = axios.isAxiosError(error) ? error.response?.data : undefined;
-      Logger.error('Token refresh failed:', responseData ?? getErrorMessage(error));
-      processQueue(error, null);
-      if (endsSession(error)) {
-        await dispatchLogout();
-      }
-      throw error;
-    }
-  };
-  // Cleared in a chained finally, not inside run: a failure before run's first
-  // await would otherwise clear the slot before it was assigned, leaving a
-  // rejected promise that every later refresh joins.
-  const promise = run().finally(() => {
-    if (refreshTokenPromise === promise) {
-      refreshTokenPromise = null;
-    }
-  });
-  refreshTokenPromise = promise;
-  return promise;
-};
-//# sourceMappingURL=tokenRefresh.js.map
+import e from"axios";import{ACCESS_TOKEN_KEY as r,getToken as o,REFRESH_TOKEN_KEY as s,storeToken as t}from"../auth/authStore.js";import{Logger as n}from"../logger/index.js";import i from"./publicClient.js";let a,c;export const injectStore=e=>{a=e};export const injectUserAuth=e=>{c=e};let h=null,p=[];const processQueue=(e,r=null)=>{p.forEach(({resolve:o,reject:s})=>{e?s(e):null!==r&&o(r)}),p=[]};export const resetRefreshState=()=>{h=null,processQueue(new Error("[@webority/mobile-core] Session ended"))};export const getErrorMessage=e=>e instanceof Error?e.message:"string"==typeof e?e:"Unknown error";const requireAuth=()=>{if(!a||!c)throw new Error("User package store is not initialized. Call initUserAuth first.");return{store:a,auth:c}};export const getRefreshPath=()=>c?.refresh.path;export const dispatchLogout=async()=>{const e=requireAuth();await e.store.dispatch(e.auth.logout())};export const isRefreshInFlight=()=>null!==h;export const queueBehindRefresh=()=>new Promise((e,r)=>{p.push({resolve:e,reject:r})});class SessionEndedError extends Error{constructor(e){super(e),this.name="SessionEndedError",Object.setPrototypeOf(this,SessionEndedError.prototype)}}const asString=(e,r)=>{if("string"!=typeof e||""===e)throw new Error(`The refresh response has no "${r}".`);return e},readWeborityTokens=e=>{const r=e??{};return{accessToken:asString(r.accessToken,"accessToken"),accessTokenExpiry:asString(r.accessTokenExpiration,"accessTokenExpiration"),refreshToken:asString(r.refreshToken,"refreshToken"),refreshTokenExpiry:asString(r.refreshTokenExpiration,"refreshTokenExpiration")}},callRefreshEndpoint=async e=>{const a=await o(s);if(!a?.token)throw new SessionEndedError("No refresh token available");if(Date.parse(a.expiry)<=Date.now())throw new SessionEndedError("Refresh token expired");const c=await o(r),h={accessToken:c?.token??null,refreshToken:a.token},p=e.body?await e.body(h):h;n.info("Refreshing the access token");const{data:f}=await i.post(e.path,p),l=(e.readTokens??readWeborityTokens)(f);return await t(r,l.accessToken,l.accessTokenExpiry),await t(s,l.refreshToken,l.refreshTokenExpiry),n.info("Access token refreshed"),l.accessToken};export const refreshAccessToken=()=>{if(h)return h;const r=(async()=>{try{const e=await callRefreshEndpoint(requireAuth().auth.refresh);return processQueue(null,e),e}catch(r){const o=e.isAxiosError(r)?r.response?.data:void 0;throw n.error("Token refresh failed:",o??getErrorMessage(r)),processQueue(r,null),(r=>r instanceof SessionEndedError||e.isAxiosError(r)&&(400===r.response?.status||401===r.response?.status))(r)&&await dispatchLogout(),r}})().finally(()=>{h===r&&(h=null)});return h=r,r};