@webority/mobile-core 0.0.29 → 0.2.0

package/README.md

@@ -32,11 +32,43 @@ import { shareFile } from '@webority/mobile-core/share';
 import { initPush, enablePush, usePush } from '@webority/mobile-core/push';
 import { definePushActionTask } from '@webority/mobile-core/push/task';
 import { compressImage } from '@webority/mobile-core/compressor';
+import { createApiBaseQuery, createAppApi, setupApiListeners } from '@webority/mobile-core/query';
 ```
 
 Metro resolves requires statically, so anything reachable from the main barrel is bundled for
 every consumer. Keeping these off it is what makes their peers genuinely optional.
 
+`/query` is the RTK Query layer; it needs `@reduxjs/toolkit` (2.6 or later) and `react-redux`,
+both optional peers. One `createApi` per app, built with `createAppApi` and the base query over
+the library's clients, so refresh, retry, the offline check and the `extractApiError` failure
+shape stay in one place. Never a `fetchBaseQuery`.
+
+```ts
+// services/api/apiSlice.ts
+import { publicClient, userClient } from '@webority/mobile-core';
+import { createApiBaseQuery, createAppApi, buildListQuery, providesPagedList,
+  type PagedDataObject } from '@webority/mobile-core/query';
+
+export const apiSlice = createAppApi({
+  reducerPath: 'api',
+  baseQuery: createApiBaseQuery({ client: userClient, publicClient }),
+  tagTypes: ['Project'],
+  endpoints: (build) => ({
+    getProjects: build.query<PagedDataObject<Project>, { page: number }>({
+      query: ({ page }) => ({ url: '/api/projects', params: buildListQuery({ page, pageSize: 20 }) }),
+      providesTags: providesPagedList('Project')
+    })
+  })
+});
+// store.ts: add apiSlice.reducer and apiSlice.middleware, then setupApiListeners(store.dispatch)
+```
+
+`setupApiListeners` maps the app returning to the foreground (`AppState`) to RTK Query's focus,
+and this library's network status to online and offline; RTK's own defaults listen to `window`
+events that never fire on a device. A call marked `silent: true`, or an endpoint with
+`extraOptions: { silent: true }`, carries `silent` on `action.meta.baseQueryMeta`, which the
+error toast middleware skips.
+
 `/push` registers the phone for push notifications. It needs `expo-notifications`, an optional
 peer, and reports `unavailable` without it or in Expo Go. Call `initPush` once at startup with
 `getInstallationId`, `register`, `unregister` and `onOpen`; `enablePush` asks permission, sends

package/lib/commonjs/api/baseUrl.js

@@ -1,34 +1 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.applyConfiguredBaseUrl = void 0;
-var _index = require("../config/index.js");
-/**
- * Resolves `baseURL` PER REQUEST rather than at module evaluation.
- *
- * `axios.create({ baseURL: getConfigValue('baseUrl') })` reads the value once,
- * when the module is first imported — which happens the moment anything touches
- * the package barrel, long before an app's startup code can call `setConfig`.
- * The result was a client permanently pinned to `undefined` and a `setConfig`
- * that appeared to do nothing, with no error anywhere: requests just went to a
- * relative URL.
- *
- * A consumer cannot fix that by ordering its own imports, because the import
- * that loses the race is usually one it never wrote. So the clients stop
- * capturing the value and ask for it per request instead.
- *
- * An explicit per-request `baseURL` still wins, which is what keeps a one-off
- * call to a different host possible.
- */
-const applyConfiguredBaseUrl = client => {
-  client.interceptors.request.use(config => {
-    if (!config.baseURL) {
-      config.baseURL = (0, _index.getConfigValue)('baseUrl') ?? undefined;
-    }
-    return config;
-  });
-};
-exports.applyConfiguredBaseUrl = applyConfiguredBaseUrl;
-//# sourceMappingURL=baseUrl.js.map
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.applyConfiguredBaseUrl=void 0;var _index=require("../config/index.js");const applyConfiguredBaseUrl=e=>{e.interceptors.request.use(e=>(e.baseURL||(e.baseURL=(0,_index.getConfigValue)("baseUrl")??void 0),e))};exports.applyConfiguredBaseUrl=applyConfiguredBaseUrl;

package/lib/commonjs/api/clientHeaders.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.getClientBuild=exports.applyClientHeaders=exports.applyAccountIdHeader=exports.CLIENT_KIND_HEADER=exports.CLIENT_KIND=exports.CLIENT_BUILD_HEADER=exports.ACCOUNT_ID_HEADER=void 0;var _index=require("../config/index.js");const CLIENT_BUILD_HEADER=exports.CLIENT_BUILD_HEADER="X-Client-Build",CLIENT_KIND_HEADER=exports.CLIENT_KIND_HEADER="X-Client-Kind",ACCOUNT_ID_HEADER=exports.ACCOUNT_ID_HEADER="X-Account-Id",CLIENT_KIND=exports.CLIENT_KIND="MobileApp",getClientBuild=()=>{const e=(0,_index.getConfigValue)("appVersion");if(!e)return null;const t=(0,_index.getConfigValue)("commit");return t?`${e}+${t}`:e};exports.getClientBuild=getClientBuild;const setIfAbsent=(e,t,s)=>{s&&!e.has(t)&&e.set(t,s)},applyClientHeaders=e=>{e.interceptors.request.use(e=>(setIfAbsent(e.headers,CLIENT_KIND_HEADER,CLIENT_KIND),setIfAbsent(e.headers,CLIENT_BUILD_HEADER,getClientBuild()),e))};exports.applyClientHeaders=applyClientHeaders;const applyAccountIdHeader=async(e,t)=>{const s=t?await t():null;s&&e.set(ACCOUNT_ID_HEADER,s)};exports.applyAccountIdHeader=applyAccountIdHeader;

package/lib/commonjs/api/curl.js

@@ -1,109 +1 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.logCurl = exports.buildCurl = void 0;
-var _index = require("../logger/index.js");
-/**
- * Header names whose VALUE is a credential. Matched case-insensitively against
- * the whole name, since `Authorization` and `authorization` are the same header
- * and axios does not normalise the case of headers a caller sets by hand.
- */
-const SECRET_HEADERS = new Set(['authorization', 'proxy-authorization', 'cookie', 'set-cookie', 'x-api-key', 'x-auth-token', 'x-access-token', 'x-refresh-token', 'api-key']);
-
-/**
- * Body fields whose value is a credential. Matched on the key alone, so this
- * catches `password`, `newPassword` and `password_confirmation` alike.
- */
-const SECRET_BODY_PATTERN = /pass(word|code)|secret|token|otp|pin|cvv|authoriz/i;
-
-/** The axios per-method header buckets, which are config plumbing, not headers. */
-const AXIOS_METHOD_KEYS = new Set(['common', 'delete', 'get', 'head', 'post', 'put', 'patch']);
-const REDACTED = '<redacted>';
-const redactBody = (value, seen, depth = 0) => {
-  if (value === null || typeof value !== 'object') {
-    return value;
-  }
-  // Both guards are needed and they catch different shapes. `seen` breaks a
-  // true cycle, which would otherwise recurse forever AND make the eventual
-  // JSON.stringify throw. The depth bound catches a body that is merely
-  // enormous. A curl line is a debugging aid, and it must never be able to
-  // hang or fail the request it is describing.
-  if (seen.has(value)) {
-    return '<circular>';
-  }
-  if (depth > 6) {
-    return '<truncated>';
-  }
-  seen.add(value);
-  if (Array.isArray(value)) {
-    return value.map(entry => redactBody(entry, seen, depth + 1));
-  }
-  const out = {};
-  for (const [key, entry] of Object.entries(value)) {
-    out[key] = SECRET_BODY_PATTERN.test(key) ? REDACTED : redactBody(entry, seen, depth + 1);
-  }
-  return out;
-};
-const buildUrl = config => {
-  const url = config.url ?? '';
-  const base = config.baseURL ? config.baseURL.replace(/\/$/, '') : '';
-  let complete = url.startsWith('http') ? url : `${base}/${url.replace(/^\//, '')}`;
-  if (config.params) {
-    const query = new URLSearchParams(config.params).toString();
-    if (query) {
-      complete += (complete.includes('?') ? '&' : '?') + query;
-    }
-  }
-  return complete;
-};
-
-/**
- * Builds a copy-pasteable curl command for a request, with every credential
- * replaced by a placeholder.
- *
- * The redaction is the point, not a nicety. An unredacted version of this in a
- * consumer app put `Authorization: Bearer <token>` and the login request's
- * plaintext password into the device console of a *release* staging build.
- * A curl line is worth having; a curl line that has to be trusted not to be
- * enabled in the wrong build is not.
- */
-const buildCurl = config => {
-  const method = (config.method ?? 'get').toUpperCase();
-  let command = `curl -X ${method} "${buildUrl(config)}"`;
-  const headers = config.headers;
-  if (headers) {
-    for (const [key, value] of Object.entries(headers)) {
-      if (AXIOS_METHOD_KEYS.has(key)) {
-        continue;
-      }
-      if (typeof value !== 'string' && typeof value !== 'number') {
-        continue;
-      }
-      const shown = SECRET_HEADERS.has(key.toLowerCase()) ? REDACTED : value;
-      command += ` -H "${key}: ${shown}"`;
-    }
-  }
-  if (config.data !== undefined && config.data !== null) {
-    const redacted = typeof config.data === 'object' ? redactBody(config.data, new WeakSet()) : config.data;
-    const body = typeof redacted === 'object' ? JSON.stringify(redacted) : String(redacted);
-    command += ` -d '${body.replace(/'/g, "'\\''")}'`;
-  }
-  return command;
-};
-
-/**
- * Logs the curl equivalent of a request. Never throws: a failure to describe a
- * request must not be able to fail the request itself.
- */
-exports.buildCurl = buildCurl;
-const logCurl = config => {
-  try {
-    _index.Logger.info('CURL Command:', buildCurl(config));
-  } catch (error) {
-    _index.Logger.warn('[api] Failed to build a curl command for the request', error);
-  }
-};
-exports.logCurl = logCurl;
-//# sourceMappingURL=curl.js.map
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.logCurl=exports.buildCurl=void 0;var _index=require("../logger/index.js");const SECRET_HEADERS=new Set(["authorization","proxy-authorization","cookie","set-cookie","x-api-key","x-auth-token","x-access-token","x-refresh-token","api-key"]),SECRET_BODY_PATTERN=/pass(word|code)|secret|token|otp|pin|cvv|authoriz/i,AXIOS_METHOD_KEYS=new Set(["common","delete","get","head","post","put","patch"]),REDACTED="<redacted>",redactBody=(e,t,r=0)=>{if(null===e||"object"!=typeof e)return e;if(t.has(e))return"<circular>";if(r>6)return"<truncated>";if(t.add(e),Array.isArray(e))return e.map(e=>redactBody(e,t,r+1));const o={};for(const[a,i]of Object.entries(e))o[a]=SECRET_BODY_PATTERN.test(a)?REDACTED:redactBody(i,t,r+1);return o},buildUrl=e=>{const t=e.url??"",r=e.baseURL?e.baseURL.replace(/\/$/,""):"";let o=t.startsWith("http")?t:`${r}/${t.replace(/^\//,"")}`;if(e.params){const t=new URLSearchParams(e.params).toString();t&&(o+=(o.includes("?")?"&":"?")+t)}return o},buildCurl=e=>{let t=`curl -X ${(e.method??"get").toUpperCase()} "${buildUrl(e)}"`;const r=e.headers;if(r)for(const[e,o]of Object.entries(r)){if(AXIOS_METHOD_KEYS.has(e))continue;if("string"!=typeof o&&"number"!=typeof o)continue;const r=SECRET_HEADERS.has(e.toLowerCase())?REDACTED:o;t+=` -H "${e}: ${r}"`}if(void 0!==e.data&&null!==e.data){const r="object"==typeof e.data?redactBody(e.data,new WeakSet):e.data;t+=` -d '${("object"==typeof r?JSON.stringify(r):String(r)).replace(/'/g,"'\\''")}'`}return t};exports.buildCurl=buildCurl;const logCurl=e=>{try{_index.Logger.info("CURL Command:",buildCurl(e))}catch(e){_index.Logger.warn("[api] Failed to build a curl command for the request",e)}};exports.logCurl=logCurl;

package/lib/commonjs/api/minAppVersion.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.readMinAppVersion=exports.getMinAppVersion=exports.addMinAppVersionListener=exports.MIN_APP_VERSION_HEADER=void 0;var _index=require("../logger/index.js");const MIN_APP_VERSION_HEADER=exports.MIN_APP_VERSION_HEADER="X-Min-App-Version";let current=null;const listeners=new Set,getMinAppVersion=()=>current;exports.getMinAppVersion=getMinAppVersion;const addMinAppVersionListener=e=>(listeners.add(e),null!==current&&e(current),()=>{listeners.delete(e)});exports.addMinAppVersionListener=addMinAppVersionListener;const readHeader=e=>{if(!e||"object"!=typeof e)return;const r=e.get;return"function"==typeof r?r.call(e,MIN_APP_VERSION_HEADER):e[MIN_APP_VERSION_HEADER.toLowerCase()]},record=e=>{const r=readHeader(e?.headers);if(null==r||""===r)return;const n=String(r).trim();if(!/^\d+$/.test(n))return void _index.Logger.warn(`[minAppVersion] ignored a non-integer ${MIN_APP_VERSION_HEADER}: ${n}`);const t=Number.parseInt(n,10);if(t!==current){current=t;for(const e of[...listeners])try{e(t)}catch(e){_index.Logger.error("[minAppVersion] a listener threw",e)}}},readMinAppVersion=e=>{e.interceptors.response.use(e=>(record(e),e),e=>(record(e?.response),Promise.reject(e)))};exports.readMinAppVersion=readMinAppVersion;

package/lib/commonjs/api/multipart.js

@@ -1,21 +1 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.sendFormDataAsMultipart = void 0;
-/**
- * The clients default to a JSON content type, and axios then serialises a FormData body to
- * JSON, which breaks every upload. Dropping the header for FormData lets the platform write
- * the multipart header with its boundary.
- */
-const sendFormDataAsMultipart = client => {
-  client.interceptors.request.use(config => {
-    if (typeof FormData !== 'undefined' && config.data instanceof FormData) {
-      config.headers?.delete?.('Content-Type');
-    }
-    return config;
-  });
-};
-exports.sendFormDataAsMultipart = sendFormDataAsMultipart;
-//# sourceMappingURL=multipart.js.map
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.sendFormDataAsMultipart=void 0;const sendFormDataAsMultipart=e=>{e.interceptors.request.use(e=>("undefined"!=typeof FormData&&e.data instanceof FormData&&e.headers?.delete?.("Content-Type"),e))};exports.sendFormDataAsMultipart=sendFormDataAsMultipart;

package/lib/commonjs/api/publicClient.js

@@ -1,79 +1 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.default = void 0;
-var _axios = _interopRequireDefault(require("axios"));
-var _index = require("../config/index.js");
-var _index2 = require("../logger/index.js");
-require("../types/axios.js");
-var _baseUrl = require("./baseUrl.js");
-var _curl = require("./curl.js");
-var _multipart = require("./multipart.js");
-var _retry = require("./retry.js");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-// Define timeout for requests
-const REQUEST_TIMEOUT = 30000; // 30 seconds
-
-/**
- * Public Axios Client
- * - Base URL: Set your public API base URL.
- * - No Authorization header is attached.
- * - Includes timeout configuration and error handling.
- * - Handles specific HTTP status codes.
- */
-const publicClient = _axios.default.create({
-  headers: {
-    'Content-Type': 'application/json',
-    Accept: 'application/json',
-    'Accept-Encoding': 'gzip, deflate, br'
-  },
-  timeout: REQUEST_TIMEOUT
-});
-(0, _baseUrl.applyConfiguredBaseUrl)(publicClient);
-(0, _multipart.sendFormDataAsMultipart)(publicClient);
-
-// Registered before the logging interceptors below so they only ever observe
-// the final outcome of a request, not its intermediate retries. The policy
-// itself, and why a bare network error is never retried, lives in ./retry.
-(0, _retry.attachRetry)(publicClient);
-
-// Add request interceptor for logging
-publicClient.interceptors.request.use(config => {
-  _index2.Logger.info(`Request: ${config.method?.toUpperCase()} ${config.url}`);
-  if ((0, _index.getConfigValue)('logCurl')) {
-    (0, _curl.logCurl)(config);
-  }
-  return config;
-}, error => {
-  const message = error instanceof Error ? error.message : String(error);
-  _index2.Logger.error('Request error:', message);
-  return Promise.reject(error);
-});
-
-// Add response interceptor for error handling
-publicClient.interceptors.response.use(response => {
-  _index2.Logger.info(`Response: ${response.status} from ${response.config.url}`);
-  return response;
-}, error => {
-  if (_axios.default.isAxiosError(error)) {
-    const originalRequest = error.config;
-    if (originalRequest?.skipErrorLog) {
-      return Promise.reject(error);
-    }
-    if (!error.response) {
-      _index2.Logger.error(`Network error or no response from server: ${error.message}, URL: ${originalRequest?.url}`);
-    } else {
-      const body = error.response.data;
-      const bodyText = body instanceof ArrayBuffer ? `binary response (${body.byteLength} bytes)` : typeof Blob !== 'undefined' && body instanceof Blob ? `binary response (${body.size} bytes)` : body ?? error.message;
-      _index2.Logger.error(`Response error: ${bodyText}, URL: ${originalRequest?.url}, Status: ${error.response.status}`);
-    }
-  } else {
-    const message = error instanceof Error ? error.message : String(error);
-    _index2.Logger.error(`Unknown response error: ${message}`);
-  }
-  return Promise.reject(error);
-});
-var _default = exports.default = publicClient;
-//# sourceMappingURL=publicClient.js.map
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.default=void 0;var _axios=_interopRequireDefault(require("axios")),_index=require("../config/index.js"),_index2=require("../logger/index.js");require("../types/axios.js");var _baseUrl=require("./baseUrl.js"),_clientHeaders=require("./clientHeaders.js"),_curl=require("./curl.js"),_minAppVersion=require("./minAppVersion.js"),_multipart=require("./multipart.js"),_requestDefaults=require("./requestDefaults.js"),_responseBodyText=require("./responseBodyText.js"),_retry=require("./retry.js");function _interopRequireDefault(e){return e&&e.__esModule?e:{default:e}}const publicClient=_axios.default.create({headers:{"Content-Type":"application/json",Accept:"application/json"}});(0,_baseUrl.applyConfiguredBaseUrl)(publicClient),(0,_requestDefaults.applyRequestDefaults)(publicClient),(0,_multipart.sendFormDataAsMultipart)(publicClient),(0,_minAppVersion.readMinAppVersion)(publicClient),(0,_retry.attachRetry)(publicClient),publicClient.interceptors.request.use(e=>(_index2.Logger.info(`Request: ${e.method?.toUpperCase()} ${e.url}`),(0,_index.getConfigValue)("logCurl")&&(0,_curl.logCurl)(e),e),e=>{const r=e instanceof Error?e.message:String(e);return _index2.Logger.error("Request error:",r),Promise.reject(e)}),(0,_clientHeaders.applyClientHeaders)(publicClient),publicClient.interceptors.response.use(e=>(_index2.Logger.info(`Response: ${e.status} from ${e.config.url}`),e),e=>{if(_axios.default.isAxiosError(e)){const r=e.config;if(r?.skipErrorLog)return Promise.reject(e);e.response?_index2.Logger.error(`Response error: ${(0,_responseBodyText.responseBodyText)(e.response.data,e.message)}, URL: ${r?.url}, Status: ${e.response.status}`):_index2.Logger.error(`Network error or no response from server: ${e.message}, URL: ${r?.url}`)}else{const r=e instanceof Error?e.message:String(e);_index2.Logger.error(`Unknown response error: ${r}`)}return Promise.reject(e)});var _default=exports.default=publicClient;

package/lib/commonjs/api/requestDefaults.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.newCorrelationId=exports.applyRequestDefaults=void 0;var _index=require("../config/index.js");const newCorrelationId=()=>{const e=globalThis.crypto;if("function"==typeof e?.randomUUID)return e.randomUUID();const t=new Uint8Array(16);if("function"==typeof e?.getRandomValues)e.getRandomValues(t);else for(let e=0;e<t.length;e+=1)t[e]=Math.floor(256*Math.random());t[6]=15&(t[6]??0)|64,t[8]=63&(t[8]??0)|128;const o=Array.from(t,e=>e.toString(16).padStart(2,"0")).join("");return`${o.slice(0,8)}-${o.slice(8,12)}-${o.slice(12,16)}-${o.slice(16,20)}-${o.slice(20)}`};exports.newCorrelationId=newCorrelationId;const applyRequestDefaults=e=>{e.defaults.timeout=void 0,e.interceptors.request.use(e=>{void 0===e.timeout&&(e.timeout=(0,_index.getConfigValue)("timeoutMs"));const t=(0,_index.getConfigValue)("correlationIdHeader");return t&&!e.headers.has(t)&&e.headers.set(t,newCorrelationId()),e})};exports.applyRequestDefaults=applyRequestDefaults;

package/lib/commonjs/api/responseBodyText.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.responseBodyText=void 0;const MAX_LENGTH=500,responseBodyText=(e,s)=>{if(null==e||""===e)return s;if(e instanceof ArrayBuffer)return`binary response (${e.byteLength} bytes)`;if("undefined"!=typeof Blob&&e instanceof Blob)return`binary response (${e.size} bytes)`;const t="string"==typeof e?e:JSON.stringify(e);return t.length>500?`${t.slice(0,500)}...`:t};exports.responseBodyText=responseBodyText;

package/lib/commonjs/api/retry.js

@@ -1,91 +1 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.isRetryableStatus = exports.attachRetry = void 0;
-/**
- * Status-based ONLY, deliberately: a bare network error (no `error.response`)
- * is never retryable. Both clients carry non-idempotent requests, login and OTP
- * on the public one and every write on the user one, and a broken connection
- * says nothing about whether the request reached the server. Retrying can
- * therefore create a second session, or a duplicate record, that the user never
- * sees. A generic network-error retry rule is not a substitute: it decides on
- * the transport alone and never looks at the HTTP method, so it retries POSTs
- * as readily as GETs.
- */
-const isRetryableStatus = status => typeof status === 'number' && (status === 429 || status >= 500 && status <= 599);
-exports.isRetryableStatus = isRetryableStatus;
-const IDEMPOTENT_METHODS = new Set(['get', 'head', 'options', 'put', 'delete']);
-
-/**
- * The same reasoning reaches status codes on a write. A 500 on a POST or PATCH
- * can follow a partial commit, so replaying it can duplicate the record; only
- * 429 and 503 say the server refused the request before doing the work. A
- * request that knows its write is safe to repeat passes its own `shouldRetry`.
- */
-const isRetryableFailure = error => {
-  const status = error.response?.status;
-  if (!isRetryableStatus(status)) {
-    return false;
-  }
-  const method = (error.config?.method ?? 'get').toLowerCase();
-  return IDEMPOTENT_METHODS.has(method) || status === 429 || status === 503;
-};
-const DEFAULT_POLICY = {
-  retries: 3,
-  retryDelayMs: attempt => attempt <= 1 ? 0 : 2 ** attempt * 1000,
-  shouldRetry: isRetryableFailure,
-  onRetry: () => undefined
-};
-const waitOrAbort = (delay, signal) => new Promise(resolve => {
-  const onAbort = () => {
-    clearTimeout(timer);
-    resolve(false);
-  };
-  const timer = setTimeout(() => {
-    signal?.removeEventListener?.('abort', onAbort);
-    resolve(true);
-  }, delay);
-  signal?.addEventListener?.('abort', onAbort, {
-    once: true
-  });
-});
-const attachRetry = (client, policy = {}) => {
-  client.interceptors.response.use(undefined, async error => {
-    const axiosError = error;
-    const config = axiosError?.config;
-    if (!config || config.retry === false) {
-      return Promise.reject(error);
-    }
-    const perRequest = typeof config.retry === 'object' ? config.retry : {};
-    const effective = {
-      ...DEFAULT_POLICY,
-      ...policy,
-      ...perRequest
-    };
-    const attempt = (config.__retryAttempt ?? 0) + 1;
-    if (attempt > effective.retries || !effective.shouldRetry(axiosError)) {
-      return Promise.reject(error);
-    }
-    if (config.signal?.aborted) {
-      return Promise.reject(error);
-    }
-
-    // The attempt count rides on the config, which axios copies onto the config
-    // of the retried request, so nested attempts continue the same count and
-    // separate requests never share one.
-    config.__retryAttempt = attempt;
-    // The body was serialised by the first pass; transforming it again would
-    // JSON-encode the already-encoded string.
-    config.transformRequest = [data => data];
-    effective.onRetry(attempt, axiosError);
-    const proceed = await waitOrAbort(effective.retryDelayMs(attempt), config.signal);
-    if (!proceed) {
-      return Promise.reject(error);
-    }
-    return client.request(config);
-  });
-};
-exports.attachRetry = attachRetry;
-//# sourceMappingURL=retry.js.map
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.retryAfterMs=exports.isRetryableStatus=exports.isRetryableFailure=exports.isNeverSentError=exports.attachRetry=exports.IDEMPOTENCY_KEY_HEADER=void 0;var _axios=_interopRequireDefault(require("axios")),_index=require("../config/index.js");function _interopRequireDefault(e){return e&&e.__esModule?e:{default:e}}const IDEMPOTENCY_KEY_HEADER=exports.IDEMPOTENCY_KEY_HEADER="Idempotency-Key",isRetryableStatus=e=>"number"==typeof e&&(429===e||e>=500&&e<=599);exports.isRetryableStatus=isRetryableStatus;const IDEMPOTENT_METHODS=new Set(["get","head","options","put","delete"]),NEVER_SENT_CODES=new Set(["ECONNREFUSED","ENOTFOUND","EAI_AGAIN","ENETUNREACH","EHOSTUNREACH"]),isNeverSentError=e=>!e.response&&"string"==typeof e.code&&NEVER_SENT_CODES.has(e.code);exports.isNeverSentError=isNeverSentError;const MAX_RETRY_AFTER_MS=3e4,retryAfterMs=e=>{const t=e.response;if(!t)return null;const r=t.data,s=t.headers,o="function"==typeof s?.get?s.get("retry-after"):s?.["retry-after"];for(const e of[r?.retryAfterSeconds,o]){const t=Number(e);if(null!=e&&Number.isFinite(t)&&t>0)return 1e3*t}return null};exports.retryAfterMs=retryAfterMs;const hasIdempotencyKey=e=>{const t=e?.headers,r="function"==typeof t?.get?t.get(IDEMPOTENCY_KEY_HEADER):t?.[IDEMPOTENCY_KEY_HEADER];return"string"==typeof r&&""!==r},isRetryableFailure=e=>{if(_axios.default.isCancel(e)||"ERR_CANCELED"===e.code)return!1;if(isNeverSentError(e))return!0;const t=(e.config?.method??"get").toLowerCase(),r=IDEMPOTENT_METHODS.has(t),s=e.response?.status;if(void 0===s)return r;if(!isRetryableStatus(s))return!1;const o=retryAfterMs(e);return!(null!==o&&o>3e4)&&(r||(429===s||503===s)&&hasIdempotencyKey(e.config))};exports.isRetryableFailure=isRetryableFailure;const DEFAULT_POLICY={retryDelayMs:e=>e<=1?0:2**e*1e3,shouldRetry:isRetryableFailure,onRetry:()=>{}},waitOrAbort=(e,t)=>new Promise(r=>{const onAbort=()=>{clearTimeout(s),r(!1)},s=setTimeout(()=>{t?.removeEventListener?.("abort",onAbort),r(!0)},e);t?.addEventListener?.("abort",onAbort,{once:!0})}),attachRetry=(e,t={})=>{e.interceptors.response.use(void 0,async r=>{const s=r,o=s?.config;if(!o||!1===o.retry)return Promise.reject(r);const n="object"==typeof o.retry?o.retry:{},i={...DEFAULT_POLICY,retries:(0,_index.getConfigValue)("retries"),...t,...n},a=(o.__retryAttempt??0)+1;if(a>i.retries||!i.shouldRetry(s))return Promise.reject(r);if(o.signal?.aborted)return Promise.reject(r);o.__retryAttempt=a,o.transformRequest=[e=>e],i.onRetry(a,s);const E=retryAfterMs(s)??i.retryDelayMs(a);return await waitOrAbort(E,o.signal)?e.request(o):Promise.reject(r)})};exports.attachRetry=attachRetry;

package/lib/commonjs/api/tokenRefresh.js

@@ -1,205 +1 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.resetRefreshState = exports.refreshAccessToken = exports.queueBehindRefresh = exports.isRefreshInFlight = exports.injectUserAuth = exports.injectStore = exports.getRefreshPath = exports.getErrorMessage = exports.dispatchLogout = void 0;
-var _axios = _interopRequireDefault(require("axios"));
-var _authStore = require("../auth/authStore.js");
-var _index = require("../logger/index.js");
-var _publicClient = _interopRequireDefault(require("./publicClient.js"));
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-/**
- * The one token-refresh flow in the library, run by userClient's interceptors.
- * The library calls the refresh endpoint itself, so it can tell a rejected
- * refresh token (400 or 401: the session is over) from a transient failure
- * (network, timeout, 5xx: the session is kept and the caller sees the error).
- * A refresh is single flight. A download goes through the app's client, so it
- * reaches this only when that client is userClient.
- */
-
-/**
- * Minimal Redux-store shape required by the user client to dispatch logout.
- */
-
-let store;
-let auth;
-const injectStore = _store => {
-  store = _store;
-};
-exports.injectStore = injectStore;
-const injectUserAuth = options => {
-  auth = options;
-};
-
-// Single promise to track token refresh
-exports.injectUserAuth = injectUserAuth;
-let refreshTokenPromise = null;
-
-// Queue for failed requests
-let failedQueue = [];
-
-/**
- * Processes the queue of failed requests.
- */
-const processQueue = (error, token = null) => {
-  failedQueue.forEach(({
-    resolve,
-    reject
-  }) => {
-    if (error) {
-      reject(error);
-    } else if (token !== null) {
-      resolve(token);
-    }
-  });
-  failedQueue = [];
-};
-
-/**
- * Clear any in-flight token refresh and reject everything queued behind it.
- * Call this on logout.
- *
- * Without it, a refresh that was already in flight when the user logged out
- * resolves afterwards and replays every queued request with a token for a
- * session that has ended. The queue is module state, so it survives the logout
- * entirely: nothing else clears it. A consumer app hit this and hand-wrote the
- * same function locally, which is how it was found.
- */
-const resetRefreshState = () => {
-  refreshTokenPromise = null;
-  processQueue(new Error('[@webority/mobile-core] Session ended'));
-};
-exports.resetRefreshState = resetRefreshState;
-const getErrorMessage = error => {
-  if (error instanceof Error) {
-    return error.message;
-  }
-  if (typeof error === 'string') {
-    return error;
-  }
-  return 'Unknown error';
-};
-exports.getErrorMessage = getErrorMessage;
-const requireAuth = () => {
-  if (!store || !auth) {
-    throw new Error('User package store is not initialized. Call initUserAuth first.');
-  }
-  return {
-    store,
-    auth
-  };
-};
-
-/** The refresh endpoint's path, once initUserAuth has run. */
-const getRefreshPath = () => auth?.refresh.path;
-exports.getRefreshPath = getRefreshPath;
-const dispatchLogout = async () => {
-  const wired = requireAuth();
-  await wired.store.dispatch(wired.auth.logout());
-};
-exports.dispatchLogout = dispatchLogout;
-const isRefreshInFlight = () => refreshTokenPromise !== null;
-
-/** Wait for the in-flight refresh without joining it: resolved or rejected by processQueue. */
-exports.isRefreshInFlight = isRefreshInFlight;
-const queueBehindRefresh = () => new Promise((resolve, reject) => {
-  failedQueue.push({
-    resolve,
-    reject
-  });
-});
-
-/** A failure that proves the session is over, as opposed to one worth retrying later. */
-exports.queueBehindRefresh = queueBehindRefresh;
-class SessionEndedError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = 'SessionEndedError';
-    // Babel's class transform can drop the prototype link, which makes
-    // `instanceof SessionEndedError` false in the transpiled build.
-    Object.setPrototypeOf(this, SessionEndedError.prototype);
-  }
-}
-const endsSession = error => error instanceof SessionEndedError || _axios.default.isAxiosError(error) && (error.response?.status === 400 || error.response?.status === 401);
-const asString = (value, field) => {
-  if (typeof value !== 'string' || value === '') {
-    throw new Error(`The refresh response has no "${field}".`);
-  }
-  return value;
-};
-
-/** The Webority API's refresh response. */
-const readWeborityTokens = data => {
-  const body = data ?? {};
-  return {
-    accessToken: asString(body.accessToken, 'accessToken'),
-    accessTokenExpiry: asString(body.accessTokenExpiration, 'accessTokenExpiration'),
-    refreshToken: asString(body.refreshToken, 'refreshToken'),
-    refreshTokenExpiry: asString(body.refreshTokenExpiration, 'refreshTokenExpiration')
-  };
-};
-const callRefreshEndpoint = async refresh => {
-  const refreshToken = await (0, _authStore.getToken)(_authStore.REFRESH_TOKEN_KEY);
-  if (!refreshToken?.token) {
-    throw new SessionEndedError('No refresh token available');
-  }
-  // An expired refresh token would only earn a 401 from the endpoint before the same logout.
-  if (Date.parse(refreshToken.expiry) <= Date.now()) {
-    throw new SessionEndedError('Refresh token expired');
-  }
-  const accessToken = await (0, _authStore.getToken)(_authStore.ACCESS_TOKEN_KEY);
-  const tokens = {
-    accessToken: accessToken?.token ?? null,
-    refreshToken: refreshToken.token
-  };
-  const body = refresh.body ? await refresh.body(tokens) : tokens;
-  _index.Logger.info('Refreshing the access token');
-  const {
-    data
-  } = await _publicClient.default.post(refresh.path, body);
-  const next = (refresh.readTokens ?? readWeborityTokens)(data);
-  await (0, _authStore.storeToken)(_authStore.ACCESS_TOKEN_KEY, next.accessToken, next.accessTokenExpiry);
-  await (0, _authStore.storeToken)(_authStore.REFRESH_TOKEN_KEY, next.refreshToken, next.refreshTokenExpiry);
-  _index.Logger.info('Access token refreshed');
-  return next.accessToken;
-};
-
-/**
- * Refresh the access token, joining a refresh already in flight rather than
- * starting a second one. Every request queued behind it is replayed on success
- * and rejected on failure. Logs out only when the failure proves the session
- * is over; a network error, timeout or 5xx keeps it and rejects.
- */
-const refreshAccessToken = () => {
-  if (refreshTokenPromise) {
-    return refreshTokenPromise;
-  }
-  const run = async () => {
-    try {
-      const token = await callRefreshEndpoint(requireAuth().auth.refresh);
-      processQueue(null, token);
-      return token;
-    } catch (error) {
-      const responseData = _axios.default.isAxiosError(error) ? error.response?.data : undefined;
-      _index.Logger.error('Token refresh failed:', responseData ?? getErrorMessage(error));
-      processQueue(error, null);
-      if (endsSession(error)) {
-        await dispatchLogout();
-      }
-      throw error;
-    }
-  };
-  // Cleared in a chained finally, not inside run: a failure before run's first
-  // await would otherwise clear the slot before it was assigned, leaving a
-  // rejected promise that every later refresh joins.
-  const promise = run().finally(() => {
-    if (refreshTokenPromise === promise) {
-      refreshTokenPromise = null;
-    }
-  });
-  refreshTokenPromise = promise;
-  return promise;
-};
-exports.refreshAccessToken = refreshAccessToken;
-//# sourceMappingURL=tokenRefresh.js.map
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.resetRefreshState=exports.refreshAccessToken=exports.readSignOutReason=exports.queueBehindRefresh=exports.isRefreshInFlight=exports.injectUserAuth=exports.injectStore=exports.getRefreshPath=exports.getErrorMessage=exports.getAccountIdProvider=exports.endSessionAndLogout=exports.dispatchLogout=exports.SIGN_OUT_REASON_HEADER=void 0;var _axios=_interopRequireDefault(require("axios")),_authStore=require("../auth/authStore.js"),_index=require("../logger/index.js"),_publicClient=_interopRequireDefault(require("./publicClient.js"));function _interopRequireDefault(e){return e&&e.__esModule?e:{default:e}}let store,auth;const injectStore=e=>{store=e};exports.injectStore=injectStore;const injectUserAuth=e=>{auth=e};exports.injectUserAuth=injectUserAuth;let refreshTokenPromise=null,failedQueue=[];const processQueue=(e,r=null)=>{failedQueue.forEach(({resolve:s,reject:t})=>{e?t(e):null!==r&&s(r)}),failedQueue=[]},resetRefreshState=()=>{refreshTokenPromise=null,processQueue(new Error("[@webority/mobile-core] Session ended"))};exports.resetRefreshState=resetRefreshState;const getErrorMessage=e=>e instanceof Error?e.message:"string"==typeof e?e:"Unknown error";exports.getErrorMessage=getErrorMessage;const requireAuth=()=>{if(!store||!auth)throw new Error("User package store is not initialized. Call initUserAuth first.");return{store:store,auth:auth}},getAccountIdProvider=()=>auth?.accountId;exports.getAccountIdProvider=getAccountIdProvider;const getRefreshPath=()=>auth?.refresh.path;exports.getRefreshPath=getRefreshPath;const dispatchLogout=async()=>{const e=requireAuth();await e.store.dispatch(e.auth.logout())};exports.dispatchLogout=dispatchLogout;const SIGN_OUT_REASON_HEADER=exports.SIGN_OUT_REASON_HEADER="X-Sign-Out-Reason",readSignOutReason=e=>{const r=void 0===auth?.signOutReasonHeader?SIGN_OUT_REASON_HEADER:auth.signOutReasonHeader;if(!r||!e||"object"!=typeof e)return null;const s=e.get,t="function"==typeof s?s.call(e,r):e[r.toLowerCase()];return"string"==typeof t&&""!==t.trim()?t.trim():null};exports.readSignOutReason=readSignOutReason;const endSessionAndLogout=async(e,r)=>{await(0,_authStore.clearSession)(e,{signOutReason:r}),await dispatchLogout()};exports.endSessionAndLogout=endSessionAndLogout;const isRefreshInFlight=()=>null!==refreshTokenPromise;exports.isRefreshInFlight=isRefreshInFlight;const queueBehindRefresh=()=>new Promise((e,r)=>{failedQueue.push({resolve:e,reject:r})});exports.queueBehindRefresh=queueBehindRefresh;class SessionEndedError extends Error{constructor(e){super(e),this.name="SessionEndedError",Object.setPrototypeOf(this,SessionEndedError.prototype)}}const endsSession=e=>e instanceof SessionEndedError||_axios.default.isAxiosError(e)&&(400===e.response?.status||401===e.response?.status),asString=(e,r)=>{if("string"!=typeof e||""===e)throw new Error(`The refresh response has no "${r}".`);return e},readWeborityTokens=e=>{const r=e??{};return{accessToken:asString(r.accessToken,"accessToken"),accessTokenExpiry:asString(r.accessTokenExpiration,"accessTokenExpiration"),refreshToken:asString(r.refreshToken,"refreshToken"),refreshTokenExpiry:asString(r.refreshTokenExpiration,"refreshTokenExpiration")}},callRefreshEndpoint=async e=>{const r=await(0,_authStore.getToken)(_authStore.REFRESH_TOKEN_KEY);if(!r?.token)throw new SessionEndedError("No refresh token available");if(Date.parse(r.expiry)<=Date.now())throw new SessionEndedError("Refresh token expired");const s=await(0,_authStore.getToken)(_authStore.ACCESS_TOKEN_KEY),t={accessToken:s?.token??null,refreshToken:r.token},o=e.body?await e.body(t):t,n=e.headers?await e.headers():void 0;_index.Logger.info("Refreshing the access token");const{data:i}=await _publicClient.default.post(e.path,o,n?{headers:n}:void 0),a=(e.readTokens??readWeborityTokens)(i);return await(0,_authStore.storeToken)(_authStore.ACCESS_TOKEN_KEY,a.accessToken,a.accessTokenExpiry),await(0,_authStore.storeToken)(_authStore.REFRESH_TOKEN_KEY,a.refreshToken,a.refreshTokenExpiry),_index.Logger.info("Access token refreshed"),a.accessToken},refreshAccessToken=()=>{if(refreshTokenPromise)return refreshTokenPromise;const e=(async()=>{try{const e=await callRefreshEndpoint(requireAuth().auth.refresh);return processQueue(null,e),e}catch(e){const r=_axios.default.isAxiosError(e)?e.response?.data:void 0;throw _index.Logger.error("Token refresh failed:",r??getErrorMessage(e)),processQueue(e,null),endsSession(e)&&await endSessionAndLogout("rejected",_axios.default.isAxiosError(e)?readSignOutReason(e.response?.headers):null),e}})().finally(()=>{refreshTokenPromise===e&&(refreshTokenPromise=null)});return refreshTokenPromise=e,e};exports.refreshAccessToken=refreshAccessToken;