@webority/mobile-core 0.0.29 → 0.2.0

package/lib/module/api/baseUrl.js

@@ -1,30 +1 @@
-"use strict";
-
-import { getConfigValue } from "../config/index.js";
-
-/**
- * Resolves `baseURL` PER REQUEST rather than at module evaluation.
- *
- * `axios.create({ baseURL: getConfigValue('baseUrl') })` reads the value once,
- * when the module is first imported — which happens the moment anything touches
- * the package barrel, long before an app's startup code can call `setConfig`.
- * The result was a client permanently pinned to `undefined` and a `setConfig`
- * that appeared to do nothing, with no error anywhere: requests just went to a
- * relative URL.
- *
- * A consumer cannot fix that by ordering its own imports, because the import
- * that loses the race is usually one it never wrote. So the clients stop
- * capturing the value and ask for it per request instead.
- *
- * An explicit per-request `baseURL` still wins, which is what keeps a one-off
- * call to a different host possible.
- */
-export const applyConfiguredBaseUrl = client => {
-  client.interceptors.request.use(config => {
-    if (!config.baseURL) {
-      config.baseURL = getConfigValue('baseUrl') ?? undefined;
-    }
-    return config;
-  });
-};
-//# sourceMappingURL=baseUrl.js.map
+"use strict";import{getConfigValue}from"../config/index.js";export const applyConfiguredBaseUrl=e=>{e.interceptors.request.use(e=>(e.baseURL||(e.baseURL=getConfigValue("baseUrl")??void 0),e))};

package/lib/module/api/clientHeaders.js

@@ -0,0 +1 @@
+"use strict";import{getConfigValue}from"../config/index.js";export const CLIENT_BUILD_HEADER="X-Client-Build";export const CLIENT_KIND_HEADER="X-Client-Kind";export const ACCOUNT_ID_HEADER="X-Account-Id";export const CLIENT_KIND="MobileApp";export const getClientBuild=()=>{const t=getConfigValue("appVersion");if(!t)return null;const e=getConfigValue("commit");return e?`${t}+${e}`:t};const setIfAbsent=(t,e,n)=>{n&&!t.has(e)&&t.set(e,n)};export const applyClientHeaders=t=>{t.interceptors.request.use(t=>(setIfAbsent(t.headers,"X-Client-Kind","MobileApp"),setIfAbsent(t.headers,"X-Client-Build",getClientBuild()),t))};export const applyAccountIdHeader=async(t,e)=>{const n=e?await e():null;n&&t.set("X-Account-Id",n)};

package/lib/module/api/curl.js

@@ -1,104 +1 @@
-"use strict";
-
-import { Logger } from "../logger/index.js";
-
-/**
- * Header names whose VALUE is a credential. Matched case-insensitively against
- * the whole name, since `Authorization` and `authorization` are the same header
- * and axios does not normalise the case of headers a caller sets by hand.
- */
-const SECRET_HEADERS = new Set(['authorization', 'proxy-authorization', 'cookie', 'set-cookie', 'x-api-key', 'x-auth-token', 'x-access-token', 'x-refresh-token', 'api-key']);
-
-/**
- * Body fields whose value is a credential. Matched on the key alone, so this
- * catches `password`, `newPassword` and `password_confirmation` alike.
- */
-const SECRET_BODY_PATTERN = /pass(word|code)|secret|token|otp|pin|cvv|authoriz/i;
-
-/** The axios per-method header buckets, which are config plumbing, not headers. */
-const AXIOS_METHOD_KEYS = new Set(['common', 'delete', 'get', 'head', 'post', 'put', 'patch']);
-const REDACTED = '<redacted>';
-const redactBody = (value, seen, depth = 0) => {
-  if (value === null || typeof value !== 'object') {
-    return value;
-  }
-  // Both guards are needed and they catch different shapes. `seen` breaks a
-  // true cycle, which would otherwise recurse forever AND make the eventual
-  // JSON.stringify throw. The depth bound catches a body that is merely
-  // enormous. A curl line is a debugging aid, and it must never be able to
-  // hang or fail the request it is describing.
-  if (seen.has(value)) {
-    return '<circular>';
-  }
-  if (depth > 6) {
-    return '<truncated>';
-  }
-  seen.add(value);
-  if (Array.isArray(value)) {
-    return value.map(entry => redactBody(entry, seen, depth + 1));
-  }
-  const out = {};
-  for (const [key, entry] of Object.entries(value)) {
-    out[key] = SECRET_BODY_PATTERN.test(key) ? REDACTED : redactBody(entry, seen, depth + 1);
-  }
-  return out;
-};
-const buildUrl = config => {
-  const url = config.url ?? '';
-  const base = config.baseURL ? config.baseURL.replace(/\/$/, '') : '';
-  let complete = url.startsWith('http') ? url : `${base}/${url.replace(/^\//, '')}`;
-  if (config.params) {
-    const query = new URLSearchParams(config.params).toString();
-    if (query) {
-      complete += (complete.includes('?') ? '&' : '?') + query;
-    }
-  }
-  return complete;
-};
-
-/**
- * Builds a copy-pasteable curl command for a request, with every credential
- * replaced by a placeholder.
- *
- * The redaction is the point, not a nicety. An unredacted version of this in a
- * consumer app put `Authorization: Bearer <token>` and the login request's
- * plaintext password into the device console of a *release* staging build.
- * A curl line is worth having; a curl line that has to be trusted not to be
- * enabled in the wrong build is not.
- */
-export const buildCurl = config => {
-  const method = (config.method ?? 'get').toUpperCase();
-  let command = `curl -X ${method} "${buildUrl(config)}"`;
-  const headers = config.headers;
-  if (headers) {
-    for (const [key, value] of Object.entries(headers)) {
-      if (AXIOS_METHOD_KEYS.has(key)) {
-        continue;
-      }
-      if (typeof value !== 'string' && typeof value !== 'number') {
-        continue;
-      }
-      const shown = SECRET_HEADERS.has(key.toLowerCase()) ? REDACTED : value;
-      command += ` -H "${key}: ${shown}"`;
-    }
-  }
-  if (config.data !== undefined && config.data !== null) {
-    const redacted = typeof config.data === 'object' ? redactBody(config.data, new WeakSet()) : config.data;
-    const body = typeof redacted === 'object' ? JSON.stringify(redacted) : String(redacted);
-    command += ` -d '${body.replace(/'/g, "'\\''")}'`;
-  }
-  return command;
-};
-
-/**
- * Logs the curl equivalent of a request. Never throws: a failure to describe a
- * request must not be able to fail the request itself.
- */
-export const logCurl = config => {
-  try {
-    Logger.info('CURL Command:', buildCurl(config));
-  } catch (error) {
-    Logger.warn('[api] Failed to build a curl command for the request', error);
-  }
-};
-//# sourceMappingURL=curl.js.map
+"use strict";import{Logger}from"../logger/index.js";const SECRET_HEADERS=new Set(["authorization","proxy-authorization","cookie","set-cookie","x-api-key","x-auth-token","x-access-token","x-refresh-token","api-key"]),SECRET_BODY_PATTERN=/pass(word|code)|secret|token|otp|pin|cvv|authoriz/i,AXIOS_METHOD_KEYS=new Set(["common","delete","get","head","post","put","patch"]),REDACTED="<redacted>",redactBody=(t,e,r=0)=>{if(null===t||"object"!=typeof t)return t;if(e.has(t))return"<circular>";if(r>6)return"<truncated>";if(e.add(t),Array.isArray(t))return t.map(t=>redactBody(t,e,r+1));const o={};for(const[a,n]of Object.entries(t))o[a]=SECRET_BODY_PATTERN.test(a)?REDACTED:redactBody(n,e,r+1);return o},buildUrl=t=>{const e=t.url??"",r=t.baseURL?t.baseURL.replace(/\/$/,""):"";let o=e.startsWith("http")?e:`${r}/${e.replace(/^\//,"")}`;if(t.params){const e=new URLSearchParams(t.params).toString();e&&(o+=(o.includes("?")?"&":"?")+e)}return o};export const buildCurl=t=>{let e=`curl -X ${(t.method??"get").toUpperCase()} "${buildUrl(t)}"`;const r=t.headers;if(r)for(const[t,o]of Object.entries(r)){if(AXIOS_METHOD_KEYS.has(t))continue;if("string"!=typeof o&&"number"!=typeof o)continue;const r=SECRET_HEADERS.has(t.toLowerCase())?REDACTED:o;e+=` -H "${t}: ${r}"`}if(void 0!==t.data&&null!==t.data){const r="object"==typeof t.data?redactBody(t.data,new WeakSet):t.data;e+=` -d '${("object"==typeof r?JSON.stringify(r):String(r)).replace(/'/g,"'\\''")}'`}return e};export const logCurl=t=>{try{Logger.info("CURL Command:",buildCurl(t))}catch(t){Logger.warn("[api] Failed to build a curl command for the request",t)}};

package/lib/module/api/minAppVersion.js

@@ -0,0 +1 @@
+"use strict";import{Logger}from"../logger/index.js";export const MIN_APP_VERSION_HEADER="X-Min-App-Version";let current=null;const listeners=new Set;export const getMinAppVersion=()=>current;export const addMinAppVersionListener=e=>(listeners.add(e),null!==current&&e(current),()=>{listeners.delete(e)});const readHeader=e=>{if(!e||"object"!=typeof e)return;const r=e.get;return"function"==typeof r?r.call(e,"X-Min-App-Version"):e["X-Min-App-Version".toLowerCase()]},record=e=>{const r=readHeader(e?.headers);if(null==r||""===r)return;const n=String(r).trim();if(!/^\d+$/.test(n))return void Logger.warn(`[minAppVersion] ignored a non-integer X-Min-App-Version: ${n}`);const t=Number.parseInt(n,10);if(t!==current){current=t;for(const e of[...listeners])try{e(t)}catch(e){Logger.error("[minAppVersion] a listener threw",e)}}};export const readMinAppVersion=e=>{e.interceptors.response.use(e=>(record(e),e),e=>(record(e?.response),Promise.reject(e)))};

package/lib/module/api/multipart.js

@@ -1,16 +1 @@
-"use strict";
-
-/**
- * The clients default to a JSON content type, and axios then serialises a FormData body to
- * JSON, which breaks every upload. Dropping the header for FormData lets the platform write
- * the multipart header with its boundary.
- */
-export const sendFormDataAsMultipart = client => {
-  client.interceptors.request.use(config => {
-    if (typeof FormData !== 'undefined' && config.data instanceof FormData) {
-      config.headers?.delete?.('Content-Type');
-    }
-    return config;
-  });
-};
-//# sourceMappingURL=multipart.js.map
+"use strict";export const sendFormDataAsMultipart=e=>{e.interceptors.request.use(e=>("undefined"!=typeof FormData&&e.data instanceof FormData&&e.headers?.delete?.("Content-Type"),e))};

package/lib/module/api/publicClient.js

@@ -1,75 +1 @@
-"use strict";
-
-import axios from 'axios';
-import { getConfigValue } from "../config/index.js";
-import { Logger } from "../logger/index.js";
-import "../types/axios.js";
-import { applyConfiguredBaseUrl } from "./baseUrl.js";
-import { logCurl } from "./curl.js";
-import { sendFormDataAsMultipart } from "./multipart.js";
-import { attachRetry } from "./retry.js";
-
-// Define timeout for requests
-const REQUEST_TIMEOUT = 30000; // 30 seconds
-
-/**
- * Public Axios Client
- * - Base URL: Set your public API base URL.
- * - No Authorization header is attached.
- * - Includes timeout configuration and error handling.
- * - Handles specific HTTP status codes.
- */
-const publicClient = axios.create({
-  headers: {
-    'Content-Type': 'application/json',
-    Accept: 'application/json',
-    'Accept-Encoding': 'gzip, deflate, br'
-  },
-  timeout: REQUEST_TIMEOUT
-});
-applyConfiguredBaseUrl(publicClient);
-sendFormDataAsMultipart(publicClient);
-
-// Registered before the logging interceptors below so they only ever observe
-// the final outcome of a request, not its intermediate retries. The policy
-// itself, and why a bare network error is never retried, lives in ./retry.
-attachRetry(publicClient);
-
-// Add request interceptor for logging
-publicClient.interceptors.request.use(config => {
-  Logger.info(`Request: ${config.method?.toUpperCase()} ${config.url}`);
-  if (getConfigValue('logCurl')) {
-    logCurl(config);
-  }
-  return config;
-}, error => {
-  const message = error instanceof Error ? error.message : String(error);
-  Logger.error('Request error:', message);
-  return Promise.reject(error);
-});
-
-// Add response interceptor for error handling
-publicClient.interceptors.response.use(response => {
-  Logger.info(`Response: ${response.status} from ${response.config.url}`);
-  return response;
-}, error => {
-  if (axios.isAxiosError(error)) {
-    const originalRequest = error.config;
-    if (originalRequest?.skipErrorLog) {
-      return Promise.reject(error);
-    }
-    if (!error.response) {
-      Logger.error(`Network error or no response from server: ${error.message}, URL: ${originalRequest?.url}`);
-    } else {
-      const body = error.response.data;
-      const bodyText = body instanceof ArrayBuffer ? `binary response (${body.byteLength} bytes)` : typeof Blob !== 'undefined' && body instanceof Blob ? `binary response (${body.size} bytes)` : body ?? error.message;
-      Logger.error(`Response error: ${bodyText}, URL: ${originalRequest?.url}, Status: ${error.response.status}`);
-    }
-  } else {
-    const message = error instanceof Error ? error.message : String(error);
-    Logger.error(`Unknown response error: ${message}`);
-  }
-  return Promise.reject(error);
-});
-export default publicClient;
-//# sourceMappingURL=publicClient.js.map
+"use strict";import axios from"axios";import{getConfigValue}from"../config/index.js";import{Logger}from"../logger/index.js";import"../types/axios.js";import{applyConfiguredBaseUrl}from"./baseUrl.js";import{applyClientHeaders}from"./clientHeaders.js";import{logCurl}from"./curl.js";import{readMinAppVersion}from"./minAppVersion.js";import{sendFormDataAsMultipart}from"./multipart.js";import{applyRequestDefaults}from"./requestDefaults.js";import{responseBodyText}from"./responseBodyText.js";import{attachRetry}from"./retry.js";const publicClient=axios.create({headers:{"Content-Type":"application/json",Accept:"application/json"}});applyConfiguredBaseUrl(publicClient),applyRequestDefaults(publicClient),sendFormDataAsMultipart(publicClient),readMinAppVersion(publicClient),attachRetry(publicClient),publicClient.interceptors.request.use(e=>(Logger.info(`Request: ${e.method?.toUpperCase()} ${e.url}`),getConfigValue("logCurl")&&logCurl(e),e),e=>{const r=e instanceof Error?e.message:String(e);return Logger.error("Request error:",r),Promise.reject(e)}),applyClientHeaders(publicClient),publicClient.interceptors.response.use(e=>(Logger.info(`Response: ${e.status} from ${e.config.url}`),e),e=>{if(axios.isAxiosError(e)){const r=e.config;if(r?.skipErrorLog)return Promise.reject(e);e.response?Logger.error(`Response error: ${responseBodyText(e.response.data,e.message)}, URL: ${r?.url}, Status: ${e.response.status}`):Logger.error(`Network error or no response from server: ${e.message}, URL: ${r?.url}`)}else{const r=e instanceof Error?e.message:String(e);Logger.error(`Unknown response error: ${r}`)}return Promise.reject(e)});export default publicClient;

package/lib/module/api/requestDefaults.js

@@ -0,0 +1 @@
+"use strict";import{getConfigValue}from"../config/index.js";export const newCorrelationId=()=>{const e=globalThis.crypto;if("function"==typeof e?.randomUUID)return e.randomUUID();const t=new Uint8Array(16);if("function"==typeof e?.getRandomValues)e.getRandomValues(t);else for(let e=0;e<t.length;e+=1)t[e]=Math.floor(256*Math.random());t[6]=15&(t[6]??0)|64,t[8]=63&(t[8]??0)|128;const o=Array.from(t,e=>e.toString(16).padStart(2,"0")).join("");return`${o.slice(0,8)}-${o.slice(8,12)}-${o.slice(12,16)}-${o.slice(16,20)}-${o.slice(20)}`};export const applyRequestDefaults=e=>{e.defaults.timeout=void 0,e.interceptors.request.use(e=>{void 0===e.timeout&&(e.timeout=getConfigValue("timeoutMs"));const t=getConfigValue("correlationIdHeader");return t&&!e.headers.has(t)&&e.headers.set(t,newCorrelationId()),e})};

package/lib/module/api/responseBodyText.js

@@ -0,0 +1 @@
+"use strict";const MAX_LENGTH=500;export const responseBodyText=(e,n)=>{if(null==e||""===e)return n;if(e instanceof ArrayBuffer)return`binary response (${e.byteLength} bytes)`;if("undefined"!=typeof Blob&&e instanceof Blob)return`binary response (${e.size} bytes)`;const t="string"==typeof e?e:JSON.stringify(e);return t.length>500?`${t.slice(0,500)}...`:t};

package/lib/module/api/retry.js

@@ -1,85 +1 @@
-"use strict";
-
-/**
- * Status-based ONLY, deliberately: a bare network error (no `error.response`)
- * is never retryable. Both clients carry non-idempotent requests, login and OTP
- * on the public one and every write on the user one, and a broken connection
- * says nothing about whether the request reached the server. Retrying can
- * therefore create a second session, or a duplicate record, that the user never
- * sees. A generic network-error retry rule is not a substitute: it decides on
- * the transport alone and never looks at the HTTP method, so it retries POSTs
- * as readily as GETs.
- */
-export const isRetryableStatus = status => typeof status === 'number' && (status === 429 || status >= 500 && status <= 599);
-const IDEMPOTENT_METHODS = new Set(['get', 'head', 'options', 'put', 'delete']);
-
-/**
- * The same reasoning reaches status codes on a write. A 500 on a POST or PATCH
- * can follow a partial commit, so replaying it can duplicate the record; only
- * 429 and 503 say the server refused the request before doing the work. A
- * request that knows its write is safe to repeat passes its own `shouldRetry`.
- */
-const isRetryableFailure = error => {
-  const status = error.response?.status;
-  if (!isRetryableStatus(status)) {
-    return false;
-  }
-  const method = (error.config?.method ?? 'get').toLowerCase();
-  return IDEMPOTENT_METHODS.has(method) || status === 429 || status === 503;
-};
-const DEFAULT_POLICY = {
-  retries: 3,
-  retryDelayMs: attempt => attempt <= 1 ? 0 : 2 ** attempt * 1000,
-  shouldRetry: isRetryableFailure,
-  onRetry: () => undefined
-};
-const waitOrAbort = (delay, signal) => new Promise(resolve => {
-  const onAbort = () => {
-    clearTimeout(timer);
-    resolve(false);
-  };
-  const timer = setTimeout(() => {
-    signal?.removeEventListener?.('abort', onAbort);
-    resolve(true);
-  }, delay);
-  signal?.addEventListener?.('abort', onAbort, {
-    once: true
-  });
-});
-export const attachRetry = (client, policy = {}) => {
-  client.interceptors.response.use(undefined, async error => {
-    const axiosError = error;
-    const config = axiosError?.config;
-    if (!config || config.retry === false) {
-      return Promise.reject(error);
-    }
-    const perRequest = typeof config.retry === 'object' ? config.retry : {};
-    const effective = {
-      ...DEFAULT_POLICY,
-      ...policy,
-      ...perRequest
-    };
-    const attempt = (config.__retryAttempt ?? 0) + 1;
-    if (attempt > effective.retries || !effective.shouldRetry(axiosError)) {
-      return Promise.reject(error);
-    }
-    if (config.signal?.aborted) {
-      return Promise.reject(error);
-    }
-
-    // The attempt count rides on the config, which axios copies onto the config
-    // of the retried request, so nested attempts continue the same count and
-    // separate requests never share one.
-    config.__retryAttempt = attempt;
-    // The body was serialised by the first pass; transforming it again would
-    // JSON-encode the already-encoded string.
-    config.transformRequest = [data => data];
-    effective.onRetry(attempt, axiosError);
-    const proceed = await waitOrAbort(effective.retryDelayMs(attempt), config.signal);
-    if (!proceed) {
-      return Promise.reject(error);
-    }
-    return client.request(config);
-  });
-};
-//# sourceMappingURL=retry.js.map
+"use strict";import axios from"axios";import{getConfigValue}from"../config/index.js";export const IDEMPOTENCY_KEY_HEADER="Idempotency-Key";export const isRetryableStatus=e=>"number"==typeof e&&(429===e||e>=500&&e<=599);const IDEMPOTENT_METHODS=new Set(["get","head","options","put","delete"]),NEVER_SENT_CODES=new Set(["ECONNREFUSED","ENOTFOUND","EAI_AGAIN","ENETUNREACH","EHOSTUNREACH"]);export const isNeverSentError=e=>!e.response&&"string"==typeof e.code&&NEVER_SENT_CODES.has(e.code);const MAX_RETRY_AFTER_MS=3e4;export const retryAfterMs=e=>{const t=e.response;if(!t)return null;const r=t.data,o=t.headers,s="function"==typeof o?.get?o.get("retry-after"):o?.["retry-after"];for(const e of[r?.retryAfterSeconds,s]){const t=Number(e);if(null!=e&&Number.isFinite(t)&&t>0)return 1e3*t}return null};const hasIdempotencyKey=e=>{const t=e?.headers,r="function"==typeof t?.get?t.get("Idempotency-Key"):t?.["Idempotency-Key"];return"string"==typeof r&&""!==r};export const isRetryableFailure=e=>{if(axios.isCancel(e)||"ERR_CANCELED"===e.code)return!1;if(isNeverSentError(e))return!0;const t=(e.config?.method??"get").toLowerCase(),r=IDEMPOTENT_METHODS.has(t),o=e.response?.status;if(void 0===o)return r;if(!isRetryableStatus(o))return!1;const s=retryAfterMs(e);return!(null!==s&&s>3e4)&&(r||(429===o||503===o)&&hasIdempotencyKey(e.config))};const DEFAULT_POLICY={retryDelayMs:e=>e<=1?0:2**e*1e3,shouldRetry:isRetryableFailure,onRetry:()=>{}},waitOrAbort=(e,t)=>new Promise(r=>{const onAbort=()=>{clearTimeout(o),r(!1)},o=setTimeout(()=>{t?.removeEventListener?.("abort",onAbort),r(!0)},e);t?.addEventListener?.("abort",onAbort,{once:!0})});export const attachRetry=(e,t={})=>{e.interceptors.response.use(void 0,async r=>{const o=r,s=o?.config;if(!s||!1===s.retry)return Promise.reject(r);const n="object"==typeof s.retry?s.retry:{},i={...DEFAULT_POLICY,retries:getConfigValue("retries"),...t,...n},c=(s.__retryAttempt??0)+1;if(c>i.retries||!i.shouldRetry(o))return Promise.reject(r);if(s.signal?.aborted)return Promise.reject(r);s.__retryAttempt=c,s.transformRequest=[e=>e],i.onRetry(c,o);const a=retryAfterMs(o)??i.retryDelayMs(c);return await waitOrAbort(a,s.signal)?e.request(s):Promise.reject(r)})};

package/lib/module/api/tokenRefresh.js

@@ -1,192 +1 @@
-"use strict";
-
-import axios from 'axios';
-import { ACCESS_TOKEN_KEY, getToken, REFRESH_TOKEN_KEY, storeToken } from "../auth/authStore.js";
-import { Logger } from "../logger/index.js";
-import publicClient from "./publicClient.js";
-
-/**
- * The one token-refresh flow in the library, run by userClient's interceptors.
- * The library calls the refresh endpoint itself, so it can tell a rejected
- * refresh token (400 or 401: the session is over) from a transient failure
- * (network, timeout, 5xx: the session is kept and the caller sees the error).
- * A refresh is single flight. A download goes through the app's client, so it
- * reaches this only when that client is userClient.
- */
-
-/**
- * Minimal Redux-store shape required by the user client to dispatch logout.
- */
-
-let store;
-let auth;
-export const injectStore = _store => {
-  store = _store;
-};
-export const injectUserAuth = options => {
-  auth = options;
-};
-
-// Single promise to track token refresh
-let refreshTokenPromise = null;
-
-// Queue for failed requests
-let failedQueue = [];
-
-/**
- * Processes the queue of failed requests.
- */
-const processQueue = (error, token = null) => {
-  failedQueue.forEach(({
-    resolve,
-    reject
-  }) => {
-    if (error) {
-      reject(error);
-    } else if (token !== null) {
-      resolve(token);
-    }
-  });
-  failedQueue = [];
-};
-
-/**
- * Clear any in-flight token refresh and reject everything queued behind it.
- * Call this on logout.
- *
- * Without it, a refresh that was already in flight when the user logged out
- * resolves afterwards and replays every queued request with a token for a
- * session that has ended. The queue is module state, so it survives the logout
- * entirely: nothing else clears it. A consumer app hit this and hand-wrote the
- * same function locally, which is how it was found.
- */
-export const resetRefreshState = () => {
-  refreshTokenPromise = null;
-  processQueue(new Error('[@webority/mobile-core] Session ended'));
-};
-export const getErrorMessage = error => {
-  if (error instanceof Error) {
-    return error.message;
-  }
-  if (typeof error === 'string') {
-    return error;
-  }
-  return 'Unknown error';
-};
-const requireAuth = () => {
-  if (!store || !auth) {
-    throw new Error('User package store is not initialized. Call initUserAuth first.');
-  }
-  return {
-    store,
-    auth
-  };
-};
-
-/** The refresh endpoint's path, once initUserAuth has run. */
-export const getRefreshPath = () => auth?.refresh.path;
-export const dispatchLogout = async () => {
-  const wired = requireAuth();
-  await wired.store.dispatch(wired.auth.logout());
-};
-export const isRefreshInFlight = () => refreshTokenPromise !== null;
-
-/** Wait for the in-flight refresh without joining it: resolved or rejected by processQueue. */
-export const queueBehindRefresh = () => new Promise((resolve, reject) => {
-  failedQueue.push({
-    resolve,
-    reject
-  });
-});
-
-/** A failure that proves the session is over, as opposed to one worth retrying later. */
-class SessionEndedError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = 'SessionEndedError';
-    // Babel's class transform can drop the prototype link, which makes
-    // `instanceof SessionEndedError` false in the transpiled build.
-    Object.setPrototypeOf(this, SessionEndedError.prototype);
-  }
-}
-const endsSession = error => error instanceof SessionEndedError || axios.isAxiosError(error) && (error.response?.status === 400 || error.response?.status === 401);
-const asString = (value, field) => {
-  if (typeof value !== 'string' || value === '') {
-    throw new Error(`The refresh response has no "${field}".`);
-  }
-  return value;
-};
-
-/** The Webority API's refresh response. */
-const readWeborityTokens = data => {
-  const body = data ?? {};
-  return {
-    accessToken: asString(body.accessToken, 'accessToken'),
-    accessTokenExpiry: asString(body.accessTokenExpiration, 'accessTokenExpiration'),
-    refreshToken: asString(body.refreshToken, 'refreshToken'),
-    refreshTokenExpiry: asString(body.refreshTokenExpiration, 'refreshTokenExpiration')
-  };
-};
-const callRefreshEndpoint = async refresh => {
-  const refreshToken = await getToken(REFRESH_TOKEN_KEY);
-  if (!refreshToken?.token) {
-    throw new SessionEndedError('No refresh token available');
-  }
-  // An expired refresh token would only earn a 401 from the endpoint before the same logout.
-  if (Date.parse(refreshToken.expiry) <= Date.now()) {
-    throw new SessionEndedError('Refresh token expired');
-  }
-  const accessToken = await getToken(ACCESS_TOKEN_KEY);
-  const tokens = {
-    accessToken: accessToken?.token ?? null,
-    refreshToken: refreshToken.token
-  };
-  const body = refresh.body ? await refresh.body(tokens) : tokens;
-  Logger.info('Refreshing the access token');
-  const {
-    data
-  } = await publicClient.post(refresh.path, body);
-  const next = (refresh.readTokens ?? readWeborityTokens)(data);
-  await storeToken(ACCESS_TOKEN_KEY, next.accessToken, next.accessTokenExpiry);
-  await storeToken(REFRESH_TOKEN_KEY, next.refreshToken, next.refreshTokenExpiry);
-  Logger.info('Access token refreshed');
-  return next.accessToken;
-};
-
-/**
- * Refresh the access token, joining a refresh already in flight rather than
- * starting a second one. Every request queued behind it is replayed on success
- * and rejected on failure. Logs out only when the failure proves the session
- * is over; a network error, timeout or 5xx keeps it and rejects.
- */
-export const refreshAccessToken = () => {
-  if (refreshTokenPromise) {
-    return refreshTokenPromise;
-  }
-  const run = async () => {
-    try {
-      const token = await callRefreshEndpoint(requireAuth().auth.refresh);
-      processQueue(null, token);
-      return token;
-    } catch (error) {
-      const responseData = axios.isAxiosError(error) ? error.response?.data : undefined;
-      Logger.error('Token refresh failed:', responseData ?? getErrorMessage(error));
-      processQueue(error, null);
-      if (endsSession(error)) {
-        await dispatchLogout();
-      }
-      throw error;
-    }
-  };
-  // Cleared in a chained finally, not inside run: a failure before run's first
-  // await would otherwise clear the slot before it was assigned, leaving a
-  // rejected promise that every later refresh joins.
-  const promise = run().finally(() => {
-    if (refreshTokenPromise === promise) {
-      refreshTokenPromise = null;
-    }
-  });
-  refreshTokenPromise = promise;
-  return promise;
-};
-//# sourceMappingURL=tokenRefresh.js.map
+"use strict";import axios from"axios";import{ACCESS_TOKEN_KEY,clearSession,getToken,REFRESH_TOKEN_KEY,storeToken}from"../auth/authStore.js";import{Logger}from"../logger/index.js";import publicClient from"./publicClient.js";let store,auth;export const injectStore=e=>{store=e};export const injectUserAuth=e=>{auth=e};let refreshTokenPromise=null,failedQueue=[];const processQueue=(e,r=null)=>{failedQueue.forEach(({resolve:o,reject:s})=>{e?s(e):null!==r&&o(r)}),failedQueue=[]};export const resetRefreshState=()=>{refreshTokenPromise=null,processQueue(new Error("[@webority/mobile-core] Session ended"))};export const getErrorMessage=e=>e instanceof Error?e.message:"string"==typeof e?e:"Unknown error";const requireAuth=()=>{if(!store||!auth)throw new Error("User package store is not initialized. Call initUserAuth first.");return{store:store,auth:auth}};export const getAccountIdProvider=()=>auth?.accountId;export const getRefreshPath=()=>auth?.refresh.path;export const dispatchLogout=async()=>{const e=requireAuth();await e.store.dispatch(e.auth.logout())};export const SIGN_OUT_REASON_HEADER="X-Sign-Out-Reason";export const readSignOutReason=e=>{const r=void 0===auth?.signOutReasonHeader?"X-Sign-Out-Reason":auth.signOutReasonHeader;if(!r||!e||"object"!=typeof e)return null;const o=e.get,s="function"==typeof o?o.call(e,r):e[r.toLowerCase()];return"string"==typeof s&&""!==s.trim()?s.trim():null};export const endSessionAndLogout=async(e,r)=>{await clearSession(e,{signOutReason:r}),await dispatchLogout()};export const isRefreshInFlight=()=>null!==refreshTokenPromise;export const queueBehindRefresh=()=>new Promise((e,r)=>{failedQueue.push({resolve:e,reject:r})});class SessionEndedError extends Error{constructor(e){super(e),this.name="SessionEndedError",Object.setPrototypeOf(this,SessionEndedError.prototype)}}const endsSession=e=>e instanceof SessionEndedError||axios.isAxiosError(e)&&(400===e.response?.status||401===e.response?.status),asString=(e,r)=>{if("string"!=typeof e||""===e)throw new Error(`The refresh response has no "${r}".`);return e},readWeborityTokens=e=>{const r=e??{};return{accessToken:asString(r.accessToken,"accessToken"),accessTokenExpiry:asString(r.accessTokenExpiration,"accessTokenExpiration"),refreshToken:asString(r.refreshToken,"refreshToken"),refreshTokenExpiry:asString(r.refreshTokenExpiration,"refreshTokenExpiration")}},callRefreshEndpoint=async e=>{const r=await getToken(REFRESH_TOKEN_KEY);if(!r?.token)throw new SessionEndedError("No refresh token available");if(Date.parse(r.expiry)<=Date.now())throw new SessionEndedError("Refresh token expired");const o=await getToken(ACCESS_TOKEN_KEY),s={accessToken:o?.token??null,refreshToken:r.token},t=e.body?await e.body(s):s,n=e.headers?await e.headers():void 0;Logger.info("Refreshing the access token");const{data:i}=await publicClient.post(e.path,t,n?{headers:n}:void 0),a=(e.readTokens??readWeborityTokens)(i);return await storeToken(ACCESS_TOKEN_KEY,a.accessToken,a.accessTokenExpiry),await storeToken(REFRESH_TOKEN_KEY,a.refreshToken,a.refreshTokenExpiry),Logger.info("Access token refreshed"),a.accessToken};export const refreshAccessToken=()=>{if(refreshTokenPromise)return refreshTokenPromise;const e=(async()=>{try{const e=await callRefreshEndpoint(requireAuth().auth.refresh);return processQueue(null,e),e}catch(e){const r=axios.isAxiosError(e)?e.response?.data:void 0;throw Logger.error("Token refresh failed:",r??getErrorMessage(e)),processQueue(e,null),endsSession(e)&&await endSessionAndLogout("rejected",axios.isAxiosError(e)?readSignOutReason(e.response?.headers):null),e}})().finally(()=>{refreshTokenPromise===e&&(refreshTokenPromise=null)});return refreshTokenPromise=e,e};