@webority/mobile-core 0.91.0 → 0.93.0

package/lib/module/errors/extractApiError.js

@@ -1 +1 @@
-"use strict";export const SERVER_FAILURE_MESSAGE="Something went wrong on our side. Please try again in a moment.";export const OFFLINE_MESSAGE="You appear to be offline. Check your connection and try again.";export const TIMEOUT_MESSAGE="That took too long to respond. Check your connection and try again.";export const UNEXPECTED_MESSAGE="Something went wrong. Please try again.";export const UNREACHABLE_MESSAGE="We couldn't reach the server. Check your connection and try again.";export const REQUEST_CANCELED_CODE="request_canceled";export const CONTRACT_ERROR_CODE="contract_error";export const TIMEOUT_CODE="timeout";export const NETWORK_CODE="network";export const OFFLINE_CODE="offline";const INTERNAL_ERROR_CODE="internal_error",MAX_MESSAGE_LENGTH=300,requestFailedMessage=e=>`Request failed (${e})`,isDict=e=>"object"==typeof e&&null!==e&&!Array.isArray(e),nonEmptyString=e=>"string"==typeof e&&e.trim().length>0?e:null,looksLikeDiagnostics=e=>e.length>300||/^\s*</.test(e)||e.includes("\n   at ")||/(Exception|StackTrace):/.test(e)||/\b(System|Microsoft)\.[A-Za-z]+\.[A-Za-z]/.test(e),userSafe=e=>{const t=nonEmptyString(e);return null===t||looksLikeDiagnostics(t)?null:t};export const toFieldPath=e=>e.replace(/^\$\.?/,"").split(".").map(e=>e.charAt(0).toLowerCase()+e.slice(1)).join(".");const firstMessage=e=>{if(Array.isArray(e)){for(const t of e){const e=nonEmptyString(t);if(null!==e)return e}return null}return nonEmptyString(e)},addError=(e,t,r)=>{const n=toFieldPath(t);""===n?e.form??=r:n in e.fields||(e.fields[n]=r)},readErrors=e=>{const t={fields:{},form:null};if(Array.isArray(e)){for(const r of e){if(!isDict(r))continue;const e=nonEmptyString(r.message);null!==e&&addError(t,"string"==typeof r.field?r.field:"",e)}return t}if(!isDict(e))return t;for(const[r,n]of Object.entries(e)){const e=firstMessage(n);null!==e&&addError(t,r,e)}return t},readLegacyError=e=>{const t=e.error;return isDict(t)?nonEmptyString(t.message):nonEmptyString(t)};export const isApiError=e=>isDict(e)&&"string"==typeof e.message&&"number"==typeof e.status&&"boolean"==typeof e.offline&&isDict(e.fieldErrors);const build=e=>({code:null,fieldErrors:{},status:0,offline:!1,traceId:null,detail:null,...e}),fromNoResponse=e=>{const t=nonEmptyString(e.code),r=nonEmptyString(e.name),n=nonEmptyString(e.message);return build("CanceledError"===r||"ERR_CANCELED"===t?{code:"request_canceled",message:UNEXPECTED_MESSAGE,detail:n}:"ECONNABORTED"===t||"ETIMEDOUT"===t?{code:"timeout",message:TIMEOUT_MESSAGE,offline:!0,detail:n}:"RequestOfflineError"===r?{code:"offline",message:OFFLINE_MESSAGE,offline:!0,detail:n}:"ERR_NETWORK"===t||"Network Error"===n||"Network request failed"===n?{code:"network",message:UNREACHABLE_MESSAGE,offline:!0,detail:n}:{message:UNEXPECTED_MESSAGE,detail:n})};export function extractApiError(e){if(isApiError(e))return e;if("string"==typeof e)return build({message:userSafe(e)??UNEXPECTED_MESSAGE,detail:e||null});if(!isDict(e))return build({message:UNEXPECTED_MESSAGE,detail:null==e?null:String(e)});if(!0===e.isContractError)return build({code:"contract_error",message:userSafe(e.message)??UNEXPECTED_MESSAGE,detail:nonEmptyString(e.message)});const t=isDict(e.response)?e.response:null,r="number"==typeof t?.status?t.status:"number"==typeof e.status?e.status:0,n=t?t.data:e.body;if(0===r&&null==n)return fromNoResponse(e);const o=isDict(n)?n:null,{fields:s,form:i}=readErrors(o?.errors),E=nonEmptyString(o?.code),a=nonEmptyString(o?.traceId),l=nonEmptyString(o?.message)??nonEmptyString(o?.detail)??(o?readLegacyError(o):null)??nonEmptyString(o?.title)??nonEmptyString(n)??nonEmptyString(e.message);let c;if(r>=500){c=(null!==E&&"internal_error"!==E?userSafe(o?.message):null)??SERVER_FAILURE_MESSAGE}else c=userSafe(Object.values(s)[0])??userSafe(i)??userSafe(o?.message)??userSafe(o?.detail)??(o?userSafe(readLegacyError(o)):null)??userSafe(o?.title)??userSafe(n)??(r?requestFailedMessage(r):UNEXPECTED_MESSAGE);return build({code:E,message:c,fieldErrors:s,status:r,traceId:a,detail:l})}export const isNoResponse=e=>extractApiError(e).offline;export function apiErrorMessage(e,t){const r=extractApiError(e);if(r.offline||null!==t&&!t)return r.message;return r.message===SERVER_FAILURE_MESSAGE||"request_canceled"===r.code||r.message===UNEXPECTED_MESSAGE||r.message===requestFailedMessage(r.status)?t??null:r.message}
+"use strict";export const SERVER_FAILURE_MESSAGE="Something went wrong on our side. Please try again in a moment.";export const OFFLINE_MESSAGE="You appear to be offline. Check your connection and try again.";export const TIMEOUT_MESSAGE="That took too long to respond. Check your connection and try again.";export const UNEXPECTED_MESSAGE="Something went wrong. Please try again.";export const UNREACHABLE_MESSAGE="We couldn't reach the server. Check your connection and try again.";export const REQUEST_CANCELED_CODE="request_canceled";export const CONTRACT_ERROR_CODE="contract_error";export const TIMEOUT_CODE="timeout";export const NETWORK_CODE="network";export const OFFLINE_CODE="offline";const INTERNAL_ERROR_CODE="internal_error",MAX_MESSAGE_LENGTH=300,requestFailedMessage=e=>`Request failed (${e})`,isDict=e=>"object"==typeof e&&null!==e&&!Array.isArray(e),nonEmptyString=e=>"string"==typeof e&&e.trim().length>0?e:null,looksLikeDiagnostics=e=>e.length>300||/^\s*</.test(e)||e.includes("\n   at ")||/(Exception|StackTrace):/.test(e)||/\b(System|Microsoft)\.[A-Za-z]+\.[A-Za-z]/.test(e),userSafe=e=>{const t=nonEmptyString(e);return null===t||looksLikeDiagnostics(t)?null:t};export const toFieldPath=e=>e.replace(/^\$\.?/,"").split(".").map(e=>e.charAt(0).toLowerCase()+e.slice(1)).join(".");const firstMessage=e=>{if(Array.isArray(e)){for(const t of e){const e=nonEmptyString(t);if(null!==e)return e}return null}return nonEmptyString(e)},addError=(e,t,r)=>{const n=toFieldPath(t);""===n?e.form??=r:n in e.fields||(e.fields[n]=r)},readErrors=e=>{const t={fields:{},form:null};if(Array.isArray(e)){for(const r of e){if(!isDict(r))continue;const e=nonEmptyString(r.message);null!==e&&addError(t,"string"==typeof r.field?r.field:"",e)}return t}if(!isDict(e))return t;for(const[r,n]of Object.entries(e)){const e=firstMessage(n);null!==e&&addError(t,r,e)}return t};export const isApiError=e=>isDict(e)&&"string"==typeof e.message&&"number"==typeof e.status&&"boolean"==typeof e.offline&&isDict(e.fieldErrors);const build=e=>({code:null,fieldErrors:{},status:0,offline:!1,traceId:null,diagnostic:null,...e}),requestTraceId=e=>{const t=isDict(e.config)?e.config.headers:void 0;if(!isDict(t))return null;const r="function"==typeof t.get?t.get("traceparent"):t.traceparent??t.Traceparent,n="string"==typeof r?/^00-([0-9a-f]{32})-[0-9a-f]{16}-[0-9a-f]{2}$/.exec(r):null;return n?n[1]:null},fromNoResponse=e=>{const t=nonEmptyString(e.code),r=nonEmptyString(e.name),n=nonEmptyString(e.message),o=requestTraceId(e);return build("CanceledError"===r||"ERR_CANCELED"===t?{code:"request_canceled",message:UNEXPECTED_MESSAGE,traceId:o,diagnostic:n}:"ECONNABORTED"===t||"ETIMEDOUT"===t?{code:"timeout",message:TIMEOUT_MESSAGE,offline:!0,traceId:o,diagnostic:n}:"RequestOfflineError"===r?{code:"offline",message:OFFLINE_MESSAGE,offline:!0,traceId:o,diagnostic:n}:"ERR_NETWORK"===t||"Network Error"===n||"Network request failed"===n?{code:"network",message:UNREACHABLE_MESSAGE,offline:!0,traceId:o,diagnostic:n}:{message:UNEXPECTED_MESSAGE,traceId:o,diagnostic:n})};export function extractApiError(e){if(isApiError(e))return e;if("string"==typeof e)return build({message:userSafe(e)??UNEXPECTED_MESSAGE,diagnostic:e||null});if(!isDict(e))return build({message:UNEXPECTED_MESSAGE,diagnostic:null==e?null:String(e)});if(!0===e.isContractError)return build({code:"contract_error",message:userSafe(e.message)??UNEXPECTED_MESSAGE,diagnostic:nonEmptyString(e.message)});const t=isDict(e.response)?e.response:null,r="number"==typeof t?.status?t.status:"number"==typeof e.status?e.status:0,n=t?t.data:e.body;if(0===r&&null==n)return fromNoResponse(e);const o=isDict(n)?n:null,{fields:s,form:i}=readErrors(o?.errors),a=nonEmptyString(o?.code),E=nonEmptyString(o?.traceId)??requestTraceId(e),c=nonEmptyString(o?.detail)??nonEmptyString(o?.title)??nonEmptyString(n)??nonEmptyString(e.message);let l;if(r>=500){l=(null!==a&&"internal_error"!==a?userSafe(o?.detail):null)??SERVER_FAILURE_MESSAGE}else l=userSafe(Object.values(s)[0])??userSafe(i)??userSafe(o?.detail)??userSafe(o?.title)??userSafe(n)??(r?requestFailedMessage(r):UNEXPECTED_MESSAGE);return build({code:a,message:l,fieldErrors:s,status:r,traceId:E,diagnostic:c})}export const isNoResponse=e=>extractApiError(e).offline;export function apiErrorMessage(e,t){const r=extractApiError(e);if(r.offline||null!==t&&!t)return r.message;return r.message===SERVER_FAILURE_MESSAGE||"request_canceled"===r.code||r.message===UNEXPECTED_MESSAGE||r.message===requestFailedMessage(r.status)?t??null:r.message}

package/lib/module/index.js

@@ -1 +1 @@
-"use strict";export{ACCOUNT_ID_HEADER,CLIENT_BUILD_HEADER,CLIENT_KIND,CLIENT_KIND_HEADER,getClientBuild}from"./api/clientHeaders.js";export{buildCurl,logCurl}from"./api/curl.js";export{addMinAppVersionListener,getMinAppVersion,MIN_APP_VERSION_HEADER}from"./api/minAppVersion.js";export{default as publicClient}from"./api/publicClient.js";export{applyRequestDefaults,newCorrelationId}from"./api/requestDefaults.js";export{attachRetry,IDEMPOTENCY_KEY_HEADER,isNeverSentError,isRetryableFailure,isRetryableStatus,retryAfterMs}from"./api/retry.js";export{refreshAccessToken}from"./api/tokenRefresh.js";export{default as userClient,injectStore,injectUserAuth,RequestOfflineError,resetRefreshState,SESSION_TERMINATION_CODES,SIGN_OUT_REASON_HEADER}from"./api/userClient.js";export{isWorkspaceChangedError,WORKSPACE_CHANGED_CODE,WorkspaceChangedError}from"./api/workspace.js";export{ACCESS_TOKEN_KEY,addSessionEndedListener,clearSession,getSessionUser,getToken,LEGACY_REFRESH_TOKEN_LIFETIME_MS,REFRESH_TOKEN_KEY,removeSessionUser,removeToken,SESSION_USER_KEY,setKeychainImplementation,setLegacyTokenKeys,storeSessionUser,storeToken}from"./auth/authStore.js";export{decodeJWT,getJWTExpiry,isJWTExpired}from"./auth/jwt.js";export{getConfig,getConfigValue,resetConfig,setConfig}from"./config/index.js";export{DeepLink,parseDeepLink,useDeepLink}from"./deepLink/index.js";export{apiErrorMessage,CONTRACT_ERROR_CODE,extractApiError,isApiError,isNoResponse,NETWORK_CODE,OFFLINE_CODE,OFFLINE_MESSAGE,REQUEST_CANCELED_CODE,SERVER_FAILURE_MESSAGE,TIMEOUT_CODE,TIMEOUT_MESSAGE,toFieldPath,UNEXPECTED_MESSAGE,UNREACHABLE_MESSAGE}from"./errors/index.js";export{AsYouType,addDays,clampNationalNumber,configureFormatters,countryFlagEmoji,detectPhoneCountry,diffMs,formatCompactNumber,formatCurrency,formatDate,formatDateDDMMMYYYY,formatDateISO,formatDatePattern,formatDateTime,formatMinor,formatNumber,formatPercent,formatPhone,formatPhoneAsTyped,formatRelative,formatRelativeTime,formatTime,formatTime12h,formatTimeInWindowsZone,formatTimeInZone,getCountries,getCountryCallingCode,getFormatterConfig,getInitials,getPhoneCountries,isDateAfter,isDateBefore,isSameDay,isSupportedCountry,isValidNationalNumber,isValidPhoneNumber,maxNationalNumberLength,normalizePhone,parsePhoneNumber,parsePhoneNumberFromString,splitPhoneNumber,startOfDay,validatePhoneNumberLength}from"./formatters/index.js";export{initWebority}from"./initSDK.js";export{initUserAuth}from"./initUserAuth.js";export{configureLogger,getDeviceContext,Logger,setDeviceContext}from"./logger/index.js";export{crashlyticsRemoteLogger}from"./logger/crashlytics.js";export{addNetworkStatusListener,getNetworkStatus,setNetworkStatusImplementation,useNetworkStatus}from"./network/index.js";export{PUSH_STATUS}from"./push/status.js";export{isStorageAvailable,Storage,setStorageImplementation}from"./storage/index.js";export{encodeBase64}from"./utils/base64.js";export{isAadhaar,isAlphanumeric,isBetween,isEmail,isGstin,isHexColor,isIfsc,isIndianMobile,isIndianPincode,isInteger,isNonEmpty,isNumeric,isPan,isPhone,isStrongPassword,isUrl,maxLength,minLength}from"./validators/index.js";export{isBuildBelowMinimum,parseBuildNumber,setDeviceInfoImplementation,useVersionCheck,VersionCheck}from"./versionCheck/index.js";
+"use strict";export{ACCOUNT_ID_HEADER,CLIENT_BUILD_HEADER,CLIENT_KIND,CLIENT_KIND_HEADER,getClientBuild}from"./api/clientHeaders.js";export{buildCurl,logCurl}from"./api/curl.js";export{addMinAppVersionListener,getMinAppVersion,MIN_APP_VERSION_HEADER}from"./api/minAppVersion.js";export{default as publicClient}from"./api/publicClient.js";export{applyRequestDefaults,newTraceparent,TRACEPARENT_HEADER}from"./api/requestDefaults.js";export{attachRetry,IDEMPOTENCY_KEY_HEADER,isNeverSentError,isRetryableFailure,isRetryableStatus,retryAfterMs}from"./api/retry.js";export{refreshAccessToken}from"./api/tokenRefresh.js";export{default as userClient,injectStore,injectUserAuth,RequestOfflineError,resetRefreshState,SESSION_EXPIRED_CODE,SESSION_REVOKED_CODE}from"./api/userClient.js";export{isWorkspaceChangedError,WORKSPACE_CHANGED_CODE,WorkspaceChangedError}from"./api/workspace.js";export{ACCESS_TOKEN_KEY,addSessionEndedListener,clearSession,getSessionUser,getToken,LEGACY_REFRESH_TOKEN_LIFETIME_MS,REFRESH_TOKEN_KEY,removeSessionUser,removeToken,SESSION_USER_KEY,setKeychainImplementation,setLegacyTokenKeys,storeSessionUser,storeToken}from"./auth/authStore.js";export{decodeJWT,getJWTExpiry,isJWTExpired}from"./auth/jwt.js";export{getConfig,getConfigValue,resetConfig,setConfig}from"./config/index.js";export{DeepLink,parseDeepLink,useDeepLink}from"./deepLink/index.js";export{apiErrorMessage,CONTRACT_ERROR_CODE,extractApiError,isApiError,isNoResponse,NETWORK_CODE,OFFLINE_CODE,OFFLINE_MESSAGE,REQUEST_CANCELED_CODE,SERVER_FAILURE_MESSAGE,TIMEOUT_CODE,TIMEOUT_MESSAGE,toFieldPath,UNEXPECTED_MESSAGE,UNREACHABLE_MESSAGE}from"./errors/index.js";export{AsYouType,addDays,clampNationalNumber,configureFormatters,countryFlagEmoji,detectPhoneCountry,diffMs,formatCompactNumber,formatCurrency,formatDate,formatDateDDMMMYYYY,formatDateISO,formatDatePattern,formatDateTime,formatMinor,formatNumber,formatPercent,formatPhone,formatPhoneAsTyped,formatRelative,formatRelativeTime,formatTime,formatTime12h,formatTimeInWindowsZone,formatTimeInZone,getCountries,getCountryCallingCode,getFormatterConfig,getInitials,getPhoneCountries,isDateAfter,isDateBefore,isSameDay,isSupportedCountry,isValidNationalNumber,isValidPhoneNumber,maxNationalNumberLength,normalizePhone,parsePhoneNumber,parsePhoneNumberFromString,splitPhoneNumber,startOfDay,validatePhoneNumberLength}from"./formatters/index.js";export{initWebority}from"./initSDK.js";export{initUserAuth}from"./initUserAuth.js";export{configureLogger,getDeviceContext,Logger,setDeviceContext}from"./logger/index.js";export{crashlyticsRemoteLogger}from"./logger/crashlytics.js";export{addNetworkStatusListener,getNetworkStatus,setNetworkStatusImplementation,useNetworkStatus}from"./network/index.js";export{PUSH_STATUS}from"./push/status.js";export{isStorageAvailable,Storage,setStorageImplementation}from"./storage/index.js";export{encodeBase64}from"./utils/base64.js";export{isAadhaar,isAlphanumeric,isBetween,isEmail,isGstin,isHexColor,isIfsc,isIndianMobile,isIndianPincode,isInteger,isNonEmpty,isNumeric,isPan,isPhone,isStrongPassword,isUrl,maxLength,minLength}from"./validators/index.js";export{isBuildBelowMinimum,parseBuildNumber,setDeviceInfoImplementation,useVersionCheck,VersionCheck}from"./versionCheck/index.js";

package/lib/module/initSDK.js

@@ -1 +1 @@
-"use strict";import{setKeychainImplementation}from"./auth/authStore.js";import{DEFAULT_CORRELATION_ID_HEADER,DEFAULT_LOG_LEVEL,DEFAULT_RETRIES,DEFAULT_TIMEOUT_MS,setConfig}from"./config/index.js";import{Logger,setRemoteLogger}from"./logger/index.js";import{setNetworkStatusImplementation}from"./network/networkStatus.js";import{setStorageImplementation}from"./storage/index.js";export const initWebority=e=>{if(!e.baseUrl)throw new Error("baseUrl is required for Webority packages initialization");if(void 0===e.remoteLogger)throw new Error("remoteLogger is required for Webority packages initialization: pass a RemoteLogger, or null for a build without crash reporting");setRemoteLogger(e.remoteLogger),setConfig({baseUrl:e.baseUrl,loggingEnabled:e.loggingEnabled??!0,logLevel:e.logLevel||DEFAULT_LOG_LEVEL,environment:e.environment||"Development",country:(e.country||"in").toLowerCase(),appId:e.appId??null,appVersion:e.appVersion??null,commit:e.commit??null,appBuild:e.appBuild??null,appStoreId:e.appStoreId??null,logCurl:e.logCurl??!1,timeoutMs:e.timeoutMs??DEFAULT_TIMEOUT_MS,retries:e.retries??DEFAULT_RETRIES,correlationIdHeader:void 0===e.correlationIdHeader?DEFAULT_CORRELATION_ID_HEADER:e.correlationIdHeader});const o=e.backends;o?.storage&&setStorageImplementation(o.storage),o?.keychain&&setKeychainImplementation(o.keychain),o?.network&&setNetworkStatusImplementation(o.network),Logger.info("[@webority/mobile-core] initialized")};
+"use strict";import{setKeychainImplementation}from"./auth/authStore.js";import{DEFAULT_LOG_LEVEL,DEFAULT_RETRIES,DEFAULT_TIMEOUT_MS,setConfig}from"./config/index.js";import{Logger,setRemoteLogger}from"./logger/index.js";import{setNetworkStatusImplementation}from"./network/networkStatus.js";import{setStorageImplementation}from"./storage/index.js";export const initWebority=e=>{if(!e.baseUrl)throw new Error("baseUrl is required for Webority packages initialization");if(void 0===e.remoteLogger)throw new Error("remoteLogger is required for Webority packages initialization: pass a RemoteLogger, or null for a build without crash reporting");setRemoteLogger(e.remoteLogger),setConfig({baseUrl:e.baseUrl,loggingEnabled:e.loggingEnabled??!0,logLevel:e.logLevel||DEFAULT_LOG_LEVEL,environment:e.environment||"Development",country:(e.country||"in").toLowerCase(),appId:e.appId??null,appVersion:e.appVersion??null,commit:e.commit??null,appBuild:e.appBuild??null,appStoreId:e.appStoreId??null,logCurl:e.logCurl??!1,timeoutMs:e.timeoutMs??DEFAULT_TIMEOUT_MS,retries:e.retries??DEFAULT_RETRIES});const o=e.backends;o?.storage&&setStorageImplementation(o.storage),o?.keychain&&setKeychainImplementation(o.keychain),o?.network&&setNetworkStatusImplementation(o.network),Logger.info("[@webority/mobile-core] initialized")};

package/lib/module/logger/index.js

@@ -1 +1 @@
-"use strict";import{getConfigValue}from"../config/index.js";import{isNoResponse}from"../errors/extractApiError.js";import{configureRedaction,redact,redactError,redactString}from"./redact.js";const Colors={RESET:"",GRAY:"",BLUE:"",YELLOW:"",RED_BOLD:""},LogLevels={DEBUG:{level:"debug",color:Colors.GRAY},INFO:{level:"info",color:Colors.BLUE},WARN:{level:"warn",color:Colors.YELLOW},ERROR:{level:"error",color:Colors.RED_BOLD}},levels=["debug","info","warn","error"],isLogLevelAllowed=e=>{const r=getConfigValue("logLevel","info");return levels.indexOf(e)>=levels.indexOf(r)},isEnabled=()=>getConfigValue("loggingEnabled",!0);let remote=null;export const setRemoteLogger=e=>{remote=e};const safe=e=>{if(e)try{e()}catch{}};let deviceContext=null;const normalizeAttributeValue=e=>null==e?null:"string"==typeof e||"number"==typeof e||"boolean"==typeof e?e:String(e);export const setDeviceContext=e=>{if(deviceContext=e,e)for(const[r,o]of Object.entries(e))safe(()=>remote?.setAttribute?.(r,normalizeAttributeValue(o)))};export const getDeviceContext=()=>deviceContext;const DEFAULT_LOGGER_OPTIONS={dedupeWindowMs:5e3,dedupeMaxPerWindow:1,screenHistoryLimit:20,breadcrumbLimit:50};let loggerOptions={...DEFAULT_LOGGER_OPTIONS};export const configureLogger=e=>{const{redactKeys:r,...o}=e;void 0!==r&&configureRedaction(r),loggerOptions={...loggerOptions,...o},screenHistory.length>loggerOptions.screenHistoryLimit&&(screenHistory=screenHistory.slice(screenHistory.length-loggerOptions.screenHistoryLimit)),trimBreadcrumbs()};let currentScreen=null,screenHistory=[];const breadcrumbs=[],trimBreadcrumbs=()=>{const e=breadcrumbs.length-loggerOptions.breadcrumbLimit;e>0&&breadcrumbs.splice(0,e)},dedupeMap=new Map,MAX_DEDUPE_ENTRIES=200,dedupeKeyFor=e=>{const r=e.stack?.split("\n")[1]?.trim();return r?`${e.message}::${r}`:e.message},capDedupeMap=()=>{for(;dedupeMap.size>200;){const e=dedupeMap.keys().next().value;if(void 0===e)return;dedupeMap.delete(e)}},shouldForward=e=>{if(loggerOptions.dedupeWindowMs<=0)return{forward:!0};const r=Date.now(),o=dedupeMap.get(e);if(!o||r-o.windowStart>=loggerOptions.dedupeWindowMs){const t=o?.suppressedCount??0;return dedupeMap.set(e,{windowStart:r,count:1,suppressedCount:0}),capDedupeMap(),t>0?{forward:!0,suppressedCount:t}:{forward:!0}}return o.count+=1,o.count>loggerOptions.dedupeMaxPerWindow?(o.suppressedCount+=1,{forward:!1}):{forward:!0}},buildErrorContext=(e,r)=>{const o={...deviceContext};return null!==currentScreen&&(o.screen=currentScreen),r&&(o.suppressedCount=r),{...o,...e}},forwardErrorToRemote=(e,r)=>{const o=dedupeKeyFor(e),{forward:t,suppressedCount:s}=shouldForward(o);t&&safe(()=>remote?.recordError?.(e,buildErrorContext(r,s)))},logDebug=(e,...r)=>{isEnabled()&&isLogLevelAllowed(LogLevels.DEBUG.level)&&console.debug(`${LogLevels.DEBUG.color}[DEBUG]: ${redactString(e)}${Colors.RESET}`,...redact(r))},logInfo=(e,...r)=>{if(!isEnabled()||!isLogLevelAllowed(LogLevels.INFO.level))return;const o=redactString(e),t=redact(r);console.info(`${LogLevels.INFO.color}[INFO]: ${o}${Colors.RESET}`,...t),safe(()=>remote?.log?.("info",o,t))},logWarning=(e,...r)=>{if(!isEnabled()||!isLogLevelAllowed(LogLevels.WARN.level))return;const o=redactString(e),t=redact(r);console.warn(`${LogLevels.WARN.color}[WARNING]: ${o}${Colors.RESET}`,...t),safe(()=>remote?.log?.("warn",o,t))},logError=(e,...r)=>{const o=redactString(e),t=redact(r);isEnabled()&&isLogLevelAllowed(LogLevels.ERROR.level)&&console.error(`${LogLevels.ERROR.color}[ERROR]: ${o}${Colors.RESET}`,...t),safe(()=>remote?.log?.("error",o,t));const s=r[0];void 0===s||isNoResponse(s)||forwardErrorToRemote(redactError(s),{source:"Logger.error",message:o})},breadcrumb=(e,r)=>{const o=redactString(e),t=redact(r);breadcrumbs.push({message:o,data:t,timestampUtc:(new Date).toISOString()}),trimBreadcrumbs(),isEnabled()&&isLogLevelAllowed("info")&&console.info(`${Colors.BLUE}[BREADCRUMB]: ${o}${Colors.RESET}`,t??""),safe(()=>remote?.breadcrumb?.(o,t))},recordError=(e,r)=>{const o=redactError(e),t=redact(r);isNoResponse(e)?logInfo(`No response: ${o.message}`):(isEnabled()&&isLogLevelAllowed("error")&&console.error(`${Colors.RED_BOLD}[RECORDED]: ${o.message}${Colors.RESET}`,t??""),forwardErrorToRemote(o,t))},asDict=e=>"object"==typeof e&&null!==e?e:null,headerValue=(e,r)=>{const o=asDict(e);if(!o)return null;const t="function"==typeof o.get?o.get.call(e,r):o[r]??o[r.toLowerCase()];return"string"==typeof t&&""!==t?t:null},requestFailed=(e,r={})=>{const{label:o,expectedStatuses:t=[],...s}=r,n=asDict(e),l=asDict(n?.config),c=asDict(n?.response),i=asDict(c?.data),a="number"==typeof c?.status?c.status:null,d="string"==typeof l?.method?l.method.toUpperCase():null,u="string"==typeof l?.url?l.url.split("?")[0]??null:null,g=o??([d,u].filter(Boolean).join(" ")||"Request");if("CanceledError"===n?.name||"ERR_CANCELED"===n?.code||!0===n?.__CANCEL__)return void logInfo(`${g} canceled`);if("RequestOfflineError"===n?.name)return void logInfo(`${g} not sent (offline)`);if(isNoResponse(e))return void logInfo(`${g} got no response`);if("WorkspaceChangedError"===n?.name||"workspace_changed"===i?.code)return void logInfo(`${g} refused (another workspace)`);if(null!==a&&t.includes(a))return void logInfo(`${g} refused (${a})`);const p="string"==typeof n?.message?n.message:e instanceof Error?e.message:null,f=redactString(null===a?`${g} failed`:`${g} failed (${a})`);isEnabled()&&isLogLevelAllowed(LogLevels.ERROR.level)&&console.error(`${LogLevels.ERROR.color}[ERROR]: ${f}${Colors.RESET}`,redactString(p??"")),safe(()=>remote?.log?.("error",f,[]));const E=getConfigValue("correlationIdHeader",null),m=redact({source:"Logger.requestFailed",label:g,status:a,method:d,path:u,code:"string"==typeof i?.code?i.code:null,traceId:"string"==typeof i?.traceId?i.traceId:null,correlationId:E?headerValue(l?.headers,E):null,detail:p,...s});forwardErrorToRemote(new Error(f),m)},setUser=(e,r)=>{safe(()=>remote?.setUser?.(e,r))},setAttribute=(e,r)=>{safe(()=>remote?.setAttribute?.(e,r))},trackScreen=(e,r)=>{e!==currentScreen&&(currentScreen=e,screenHistory.push(e),screenHistory.length>loggerOptions.screenHistoryLimit&&(screenHistory=screenHistory.slice(screenHistory.length-loggerOptions.screenHistoryLimit)),breadcrumb(`Screen: ${e}`,r))},getCurrentScreen=()=>currentScreen,getScreenHistory=()=>[...screenHistory],getBreadcrumbs=()=>[...breadcrumbs];export const Logger={debug:logDebug,info:logInfo,warn:logWarning,error:logError,breadcrumb:breadcrumb,recordError:recordError,requestFailed:requestFailed,setUser:setUser,setAttribute:setAttribute,trackScreen:trackScreen,getCurrentScreen:getCurrentScreen,getScreenHistory:getScreenHistory,getBreadcrumbs:getBreadcrumbs};
+"use strict";import{TRACEPARENT_HEADER}from"../api/requestDefaults.js";import{getConfigValue}from"../config/index.js";import{isNoResponse}from"../errors/extractApiError.js";import{configureRedaction,redact,redactError,redactString}from"./redact.js";const Colors={RESET:"",GRAY:"",BLUE:"",YELLOW:"",RED_BOLD:""},LogLevels={DEBUG:{level:"debug",color:Colors.GRAY},INFO:{level:"info",color:Colors.BLUE},WARN:{level:"warn",color:Colors.YELLOW},ERROR:{level:"error",color:Colors.RED_BOLD}},levels=["debug","info","warn","error"],isLogLevelAllowed=e=>{const r=getConfigValue("logLevel","info");return levels.indexOf(e)>=levels.indexOf(r)},isEnabled=()=>getConfigValue("loggingEnabled",!0);let remote=null;export const setRemoteLogger=e=>{remote=e};const safe=e=>{if(e)try{e()}catch{}};let deviceContext=null;const normalizeAttributeValue=e=>null==e?null:"string"==typeof e||"number"==typeof e||"boolean"==typeof e?e:String(e);export const setDeviceContext=e=>{if(deviceContext=e,e)for(const[r,o]of Object.entries(e))safe(()=>remote?.setAttribute?.(r,normalizeAttributeValue(o)))};export const getDeviceContext=()=>deviceContext;const DEFAULT_LOGGER_OPTIONS={dedupeWindowMs:5e3,dedupeMaxPerWindow:1,screenHistoryLimit:20,breadcrumbLimit:50};let loggerOptions={...DEFAULT_LOGGER_OPTIONS};export const configureLogger=e=>{const{redactKeys:r,...o}=e;void 0!==r&&configureRedaction(r),loggerOptions={...loggerOptions,...o},screenHistory.length>loggerOptions.screenHistoryLimit&&(screenHistory=screenHistory.slice(screenHistory.length-loggerOptions.screenHistoryLimit)),trimBreadcrumbs()};let currentScreen=null,screenHistory=[];const breadcrumbs=[],trimBreadcrumbs=()=>{const e=breadcrumbs.length-loggerOptions.breadcrumbLimit;e>0&&breadcrumbs.splice(0,e)},dedupeMap=new Map,MAX_DEDUPE_ENTRIES=200,dedupeKeyFor=e=>{const r=e.stack?.split("\n")[1]?.trim();return r?`${e.message}::${r}`:e.message},capDedupeMap=()=>{for(;dedupeMap.size>200;){const e=dedupeMap.keys().next().value;if(void 0===e)return;dedupeMap.delete(e)}},shouldForward=e=>{if(loggerOptions.dedupeWindowMs<=0)return{forward:!0};const r=Date.now(),o=dedupeMap.get(e);if(!o||r-o.windowStart>=loggerOptions.dedupeWindowMs){const t=o?.suppressedCount??0;return dedupeMap.set(e,{windowStart:r,count:1,suppressedCount:0}),capDedupeMap(),t>0?{forward:!0,suppressedCount:t}:{forward:!0}}return o.count+=1,o.count>loggerOptions.dedupeMaxPerWindow?(o.suppressedCount+=1,{forward:!1}):{forward:!0}},buildErrorContext=(e,r)=>{const o={...deviceContext};return null!==currentScreen&&(o.screen=currentScreen),r&&(o.suppressedCount=r),{...o,...e}},forwardErrorToRemote=(e,r)=>{const o=dedupeKeyFor(e),{forward:t,suppressedCount:s}=shouldForward(o);t&&safe(()=>remote?.recordError?.(e,buildErrorContext(r,s)))},logDebug=(e,...r)=>{isEnabled()&&isLogLevelAllowed(LogLevels.DEBUG.level)&&console.debug(`${LogLevels.DEBUG.color}[DEBUG]: ${redactString(e)}${Colors.RESET}`,...redact(r))},logInfo=(e,...r)=>{if(!isEnabled()||!isLogLevelAllowed(LogLevels.INFO.level))return;const o=redactString(e),t=redact(r);console.info(`${LogLevels.INFO.color}[INFO]: ${o}${Colors.RESET}`,...t),safe(()=>remote?.log?.("info",o,t))},logWarning=(e,...r)=>{if(!isEnabled()||!isLogLevelAllowed(LogLevels.WARN.level))return;const o=redactString(e),t=redact(r);console.warn(`${LogLevels.WARN.color}[WARNING]: ${o}${Colors.RESET}`,...t),safe(()=>remote?.log?.("warn",o,t))},logError=(e,...r)=>{const o=redactString(e),t=redact(r);isEnabled()&&isLogLevelAllowed(LogLevels.ERROR.level)&&console.error(`${LogLevels.ERROR.color}[ERROR]: ${o}${Colors.RESET}`,...t),safe(()=>remote?.log?.("error",o,t));const s=r[0];void 0===s||isNoResponse(s)||forwardErrorToRemote(redactError(s),{source:"Logger.error",message:o})},breadcrumb=(e,r)=>{const o=redactString(e),t=redact(r);breadcrumbs.push({message:o,data:t,timestampUtc:(new Date).toISOString()}),trimBreadcrumbs(),isEnabled()&&isLogLevelAllowed("info")&&console.info(`${Colors.BLUE}[BREADCRUMB]: ${o}${Colors.RESET}`,t??""),safe(()=>remote?.breadcrumb?.(o,t))},recordError=(e,r)=>{const o=redactError(e),t=redact(r);isNoResponse(e)?logInfo(`No response: ${o.message}`):(isEnabled()&&isLogLevelAllowed("error")&&console.error(`${Colors.RED_BOLD}[RECORDED]: ${o.message}${Colors.RESET}`,t??""),forwardErrorToRemote(o,t))},asDict=e=>"object"==typeof e&&null!==e?e:null,traceIdOfTraceparent=e=>headerValue(e,TRACEPARENT_HEADER)?.split("-")[1]??null,headerValue=(e,r)=>{const o=asDict(e);if(!o)return null;const t="function"==typeof o.get?o.get.call(e,r):o[r]??o[r.toLowerCase()];return"string"==typeof t&&""!==t?t:null},requestFailed=(e,r={})=>{const{label:o,expectedStatuses:t=[],...s}=r,n=asDict(e),l=asDict(n?.config),c=asDict(n?.response),i=asDict(c?.data),a="number"==typeof c?.status?c.status:null,d="string"==typeof l?.method?l.method.toUpperCase():null,u="string"==typeof l?.url?l.url.split("?")[0]??null:null,g=o??([d,u].filter(Boolean).join(" ")||"Request");if("CanceledError"===n?.name||"ERR_CANCELED"===n?.code||!0===n?.__CANCEL__)return void logInfo(`${g} canceled`);if("RequestOfflineError"===n?.name)return void logInfo(`${g} not sent (offline)`);if(isNoResponse(e))return void logInfo(`${g} got no response`);if("WorkspaceChangedError"===n?.name||"workspace_changed"===i?.code)return void logInfo(`${g} refused (another workspace)`);if(null!==a&&t.includes(a))return void logInfo(`${g} refused (${a})`);const p="string"==typeof n?.message?n.message:e instanceof Error?e.message:null,f=redactString(null===a?`${g} failed`:`${g} failed (${a})`);isEnabled()&&isLogLevelAllowed(LogLevels.ERROR.level)&&console.error(`${LogLevels.ERROR.color}[ERROR]: ${f}${Colors.RESET}`,redactString(p??"")),safe(()=>remote?.log?.("error",f,[]));const E=redact({source:"Logger.requestFailed",label:g,status:a,method:d,path:u,code:"string"==typeof i?.code?i.code:null,traceId:("string"==typeof i?.traceId?i.traceId:null)??traceIdOfTraceparent(l?.headers),detail:p,...s});forwardErrorToRemote(new Error(f),E)},setUser=(e,r)=>{safe(()=>remote?.setUser?.(e,r))},setAttribute=(e,r)=>{safe(()=>remote?.setAttribute?.(e,r))},trackScreen=(e,r)=>{e!==currentScreen&&(currentScreen=e,screenHistory.push(e),screenHistory.length>loggerOptions.screenHistoryLimit&&(screenHistory=screenHistory.slice(screenHistory.length-loggerOptions.screenHistoryLimit)),breadcrumb(`Screen: ${e}`,r))},getCurrentScreen=()=>currentScreen,getScreenHistory=()=>[...screenHistory],getBreadcrumbs=()=>[...breadcrumbs];export const Logger={debug:logDebug,info:logInfo,warn:logWarning,error:logError,breadcrumb:breadcrumb,recordError:recordError,requestFailed:requestFailed,setUser:setUser,setAttribute:setAttribute,trackScreen:trackScreen,getCurrentScreen:getCurrentScreen,getScreenHistory:getScreenHistory,getBreadcrumbs:getBreadcrumbs};

package/lib/typescript/commonjs/api/clientHeaders.d.ts

@@ -1,16 +1,16 @@
 import type { AxiosInstance } from "axios";
-export declare const CLIENT_BUILD_HEADER = "X-Client-Build";
-export declare const APP_BUILD_HEADER = "X-App-Build";
-export declare const CLIENT_KIND_HEADER = "X-Client-Kind";
-export declare const ACCOUNT_ID_HEADER = "X-Account-Id";
+export declare const CLIENT_BUILD_HEADER = "Client-Build";
+export declare const APP_BUILD_HEADER = "App-Build";
+export declare const CLIENT_KIND_HEADER = "Client-Kind";
+export declare const ACCOUNT_ID_HEADER = "Account-Id";
 /** The server picks session rules and the minimum version per kind; the names match its enum. */
 export type ClientKind = "Browser" | "MobileApp";
 export declare const CLIENT_KIND: ClientKind;
 /** `<appVersion>+<commit>`, `<appVersion>` when no commit was stamped, `null` before init. */
 export declare const getClientBuild: () => string | null;
 /**
- * Stamps X-Client-Kind, X-Client-Build and X-App-Build on every request.
- * X-App-Build is the whole build number the server compares with its minimum;
+ * Stamps Client-Kind, Client-Build and App-Build on every request.
+ * App-Build is the whole build number the server compares with its minimum;
  * it is left off when the build is unknown, because the server never refuses a
  * request without it and a guessed number could strand a current build. A value the app
  * already set (a default header, or a per-request one) wins, so an app that
@@ -29,7 +29,7 @@ export interface AccountStampedConfig {
     _accountId?: string | null;
 }
 /**
- * Stamps X-Account-Id once, on the first send, and records it on the config. A request must
+ * Stamps Account-Id once, on the first send, and records it on the config. A request must
  * never run in a workspace other than the one it was made in, so every resend (the retry
  * policy, a 401 replay, a refresh replay) keeps the first stamp even after the user switched.
  * A header the caller set itself (an outbox item naming its own workspace) wins over the provider.

package/lib/typescript/commonjs/api/minAppVersion.d.ts

@@ -5,7 +5,7 @@ import type { AxiosInstance } from "axios";
  * errors included; cross-origin it is readable only when the API lists it in
  * `Access-Control-Expose-Headers`.
  */
-export declare const MIN_APP_VERSION_HEADER = "X-Min-App-Version";
+export declare const MIN_APP_VERSION_HEADER = "Min-App-Version";
 export type MinAppVersionListener = (minAppVersion: number) => void;
 /** The floor the API last named, or `null` before any response carried one. */
 export declare const getMinAppVersion: () => number | null;
@@ -17,8 +17,7 @@ export declare const getMinAppVersion: () => number | null;
  */
 export declare const addMinAppVersionListener: (listener: MinAppVersionListener) => (() => void);
 /**
- * Reads the floor off every response the client receives, a rejected one too:
- * a 426 Upgrade Required is exactly the case the floor exists for.
+ * Reads the floor off every response the client receives, a rejected one too.
  */
 export declare const readMinAppVersion: (client: AxiosInstance) => void;
 //# sourceMappingURL=minAppVersion.d.ts.map

package/lib/typescript/commonjs/api/requestDefaults.d.ts

@@ -1,17 +1,20 @@
 import type { AxiosInstance } from "axios";
+export declare const TRACEPARENT_HEADER = "traceparent";
 /**
- * A fresh v4 uuid. `crypto.randomUUID` exists only in a secure context (HTTPS or localhost) and
- * not at all on Hermes, so the id falls back to `getRandomValues`, then to `Math.random`. A
- * correlation id only has to be unique enough to find one request in the logs; it is never a secret.
+ * A fresh W3C traceparent, version 00, sampled: the header value and its 32-hex trace id. The ids
+ * only have to be unique enough to find one request in the logs; they are never secrets.
  */
-export declare const newCorrelationId: () => string;
+export declare const newTraceparent: () => {
+    header: string;
+    traceId: string;
+};
 /**
- * Applies the configured timeout and the correlation id per request, read on every send so a
+ * Applies the configured timeout and the traceparent per request, read on every send so a
  * value set after import still applies (the same reason `applyConfiguredBaseUrl` exists).
  * - `timeoutMs`: used when the request carries no timeout of its own; a request's own axios
  *   `timeout` wins. 0, either way, means no timeout (axios's own meaning).
- * - `correlationIdHeader`: a fresh uuid unless the request already carries one. A retry
- *   resends the same config, so it keeps the id the first attempt went out with.
+ * - `traceparent`: a fresh one unless the request already carries one. A retry
+ *   resends the same config, so it keeps the value the first attempt went out with.
  *
  * axios fills a missing `timeout` with its own default of 0, which would make "this request
  * set none" and "this request asked for none" look alike. The client's default is therefore

package/lib/typescript/commonjs/api/retry.d.ts

@@ -20,9 +20,9 @@ export declare const IDEMPOTENCY_KEY_HEADER = "Idempotency-Key";
 export declare const isRetryableStatus: (status: number | undefined) => boolean;
 export declare const isNeverSentError: (error: AxiosError) => boolean;
 /**
- * The wait a refusal named, in milliseconds: the `Retry-After` header (seconds)
- * or a `retryAfterSeconds` body field. `null` when it named none. Cross-origin,
- * the header is readable only when the API lists it in `Access-Control-Expose-Headers`.
+ * The wait a refusal named, in milliseconds: the `Retry-After` header (seconds).
+ * `null` when it named none. Cross-origin, the header is readable only when the API
+ * lists it in `Access-Control-Expose-Headers`.
  */
 export declare const retryAfterMs: (error: AxiosError) => number | null;
 /**

package/lib/typescript/commonjs/api/tokenRefresh.d.ts

@@ -1,5 +1,9 @@
 import { type SessionEndReason } from "../auth/authStore";
 import type { UserAuthOptions } from "../initUserAuth";
+/** The 401 `code` the server sends when it revoked the session (a revoked token or a rejected cookie stamp). */
+export declare const SESSION_REVOKED_CODE = "session_revoked";
+/** The 401 `code` the server sends when the refresh token has expired. */
+export declare const SESSION_EXPIRED_CODE = "session_expired";
 /**
  * The one token-refresh flow in the library, run by userClient's interceptors.
  * The library calls the refresh endpoint itself, so it can tell a rejected
@@ -33,14 +37,13 @@ export declare const getAccountIdProvider: () => UserAuthOptions["accountId"];
 /** The refresh endpoint's path, once initUserAuth has run. */
 export declare const getRefreshPath: () => string | undefined;
 export declare const dispatchLogout: () => Promise<void>;
-export declare const SIGN_OUT_REASON_HEADER = "X-Sign-Out-Reason";
-/** The server's sign-out reason from response headers (AxiosHeaders or a plain object), or null. */
-export declare const readSignOutReason: (headers: unknown) => string | null;
 /**
  * The session is over: clear it (tokens and session user removed, listeners told why, with
- * the server's reason), then dispatch the app's logout.
+ * the server's session code), then dispatch the app's logout.
  */
-export declare const endSessionAndLogout: (reason: SessionEndReason, signOutReason: string | null) => Promise<void>;
+export declare const endSessionAndLogout: (reason: SessionEndReason, code: string | null) => Promise<void>;
+/** The server's session code in a 401 body (`session_revoked`, `session_expired`), or null. */
+export declare const sessionCodeOf: (data: unknown) => string | null;
 export declare const isRefreshInFlight: () => boolean;
 /** Opens the replacement window for one flagged request; call the returned function once it settles. */
 export declare const beginSessionReplacement: () => (() => void);

package/lib/typescript/commonjs/api/userClient.d.ts

@@ -1,7 +1,7 @@
 import { type AxiosInstance } from "axios";
 import "../types/axios";
 export type { RefreshableStore } from "./tokenRefresh";
-export { injectStore, injectUserAuth, resetRefreshState, SIGN_OUT_REASON_HEADER, } from "./tokenRefresh";
+export { injectStore, injectUserAuth, resetRefreshState, SESSION_EXPIRED_CODE, SESSION_REVOKED_CODE, } from "./tokenRefresh";
 /**
  * Thrown by the request interceptor when the device is offline, before the
  * request ever reaches the adapter (and therefore the network). Distinct from
@@ -11,28 +11,6 @@ export { injectStore, injectUserAuth, resetRefreshState, SIGN_OUT_REASON_HEADER,
 export declare class RequestOfflineError extends Error {
     constructor(message?: string);
 }
-/**
- * Sub-codes a 401 response body carries when the session itself is dead
- * (terminated by an admin, or expired server-side) rather than merely
- * out-of-date. These never warrant a refresh attempt — only logout.
- */
-export declare const SESSION_TERMINATION_CODES: {
-    readonly TERMINATED: "SESSION_TERMINATED";
-    readonly EXPIRED: "SESSION_EXPIRED";
-};
-export type SessionTerminationCode = (typeof SESSION_TERMINATION_CODES)[keyof typeof SESSION_TERMINATION_CODES];
-/**
- * The header is the AUTHORITATIVE signal, verified against the backend:
- * `WeborityJwtMiddleware.ReturnUnauthorized` answers an invalidated session with
- * `401` + `X-Security-Stamp-Invalid: true` and a body of
- * `{ error: 'Unauthorized', message: '...' }` — no code field at all, and
- * `error` is a string rather than an object. An earlier version of this checked
- * only body fields and would therefore never have fired against a real server.
- *
- * The body codes below are kept as a secondary path for any head that does send
- * an explicit sub-code; they match on exact strings, so looking is free.
- */
-export declare const SESSION_INVALID_HEADER = "x-security-stamp-invalid";
 declare const userClient: AxiosInstance;
 export default userClient;
 //# sourceMappingURL=userClient.d.ts.map

package/lib/typescript/commonjs/auth/authStore.d.ts

@@ -33,12 +33,9 @@ export type SessionEndReason = "signedOut" | "rejected" | "terminated" | "corrup
 /** What else is known about a session end, beside its reason. */
 export interface SessionEndDetail {
     /**
-     * The server's own name for why it ended the session, from the sign-out-reason response
-     * header (`X-Sign-Out-Reason` by default, `initUserAuth({ signOutReasonHeader })`), on a
-     * terminated session or a refused refresh. `null` when the server named none, and always
-     * `null` for `signedOut` and `corrupt` unless the app passes one.
+     * The server's session code (`session_revoked`, `session_expired`) when the server ended the session; null when the app did.
      */
-    signOutReason: string | null;
+    code: string | null;
 }
 export type SessionEndedListener = (reason: SessionEndReason, detail: SessionEndDetail) => void;
 /**
@@ -148,7 +145,7 @@ export declare const addSessionEndedListener: (listener: SessionEndedListener) =
  * flow and the app's own sign-out can both call it without a double event.
  * The library calls it itself with `rejected` when the refresh endpoint refuses
  * the refresh token and `terminated` when the API reports the session dead,
- * with the server's sign-out reason in `detail`.
+ * with the server's session code in `detail`.
  */
 export declare const clearSession: (reason?: SessionEndReason, detail?: Partial<SessionEndDetail>) => Promise<void>;
 export type { KeychainLike, SecureCredentials };

package/lib/typescript/commonjs/config/index.d.ts

@@ -27,12 +27,12 @@ export interface Config {
     appId: string | null;
     /** The app's user-visible version string, e.g. `'1.4.2'`. Same rationale as `appId`. */
     appVersion: string | null;
-    /** The short git sha stamped into the build; with `appVersion` it makes the X-Client-Build header. */
+    /** The short git sha stamped into the build; with `appVersion` it makes the Client-Build header. */
     commit: string | null;
     /**
      * The app's internal build number (`VERSION_INTERNAL`: Android versionCode,
      * iOS CFBundleVersion). The version check compares it with the API's
-     * `X-Min-App-Version`. Falls back to expo-application when unset.
+     * `Min-App-Version`. Falls back to expo-application when unset.
      */
     appBuild: number | null;
     /**
@@ -53,12 +53,6 @@ export interface Config {
     timeoutMs: number;
     /** How many times a failed request is resent under the retry rule. 0 turns retrying off. Default 3. */
     retries: number;
-    /**
-     * Header that carries a fresh id (a uuid) on every request, for tracing one request across
-     * the app, the API and its logs. A retry keeps the id it first went out with. `null`
-     * sends none. Default `'X-Correlation-Id'`.
-     */
-    correlationIdHeader: string | null;
 }
 /**
  * Info lines (each token refresh, each unauthorised URL) reach the device log
@@ -68,7 +62,6 @@ export interface Config {
 export declare const DEFAULT_LOG_LEVEL: LogLevel;
 export declare const DEFAULT_TIMEOUT_MS = 30000;
 export declare const DEFAULT_RETRIES = 3;
-export declare const DEFAULT_CORRELATION_ID_HEADER = "X-Correlation-Id";
 /**
  * Set global configuration for all Webority packages
  */

package/lib/typescript/commonjs/errors/extractApiError.d.ts

@@ -2,19 +2,13 @@
  * Normalizes any failure a thunk, a service or the RTK Query base query can see into one
  * `ApiError`. Identical source in @webority/web-core and @webority/mobile-core.
  *
- * Bodies read, newest first: the standard body `{ code, message, traceId, errors }`,
- * where `errors` is a ModelState dictionary (`{ Field: ["msg"] }`) or a list of
- * `{ field, message, reference }` (a refusal that names its fields),
- * ProblemDetails `{ title, detail, errors }` from APIs not yet moved, legacy `{ error }` and
- * `{ message }`, and a plain-text body.
+ * The body read is the RFC 9457 problem `{ type, title, status, detail, code, traceId, errors }`,
+ * where `errors` is a ModelState dictionary (`{ Field: ["msg"] }`) or a list of `{ field, message }`.
  *
- * Message precedence is fixed (react.md): first field error, then `message`, `detail`, a
- * legacy `error`, `title`, then `Request failed (<status>)`. `title` is last because it is
- * the ProblemDetails category ("Bad Request"), not the curated sentence.
- *
- * Never a `message`: anything that reads like an exception dump, and a 5xx body unless it is
- * coded (not `internal_error`) and its `message` is user-safe. The server's text goes on
- * `detail` for the logger either way.
+ * Message precedence (react.md): first field error, form error, `detail`, `title`, a plain-text
+ * body, then `Request failed (<status>)`. A 5xx shows `detail` only when it carries a code other
+ * than `internal_error`. The server's text goes on `diagnostic` for the logger, never the screen.
+ * The trace id falls back to the request's own `traceparent`, so a lost request keeps a reference.
  */
 export interface ApiError {
     /** Stable snake_case branch key from the server (`not_found`, `validation_failed`). Branch on it, never render it. */
@@ -30,7 +24,7 @@ export interface ApiError {
     /** The server's trace id, for a support reference. */
     traceId: string | null;
     /** What the server or runtime actually said. For the logger, never for the screen. */
-    detail: string | null;
+    diagnostic: string | null;
 }
 export declare const SERVER_FAILURE_MESSAGE = "Something went wrong on our side. Please try again in a moment.";
 export declare const OFFLINE_MESSAGE = "You appear to be offline. Check your connection and try again.";

package/lib/typescript/commonjs/index.d.ts

@@ -36,12 +36,12 @@ export { buildCurl, logCurl } from "./api/curl";
 export type { MinAppVersionListener } from "./api/minAppVersion";
 export { addMinAppVersionListener, getMinAppVersion, MIN_APP_VERSION_HEADER, } from "./api/minAppVersion";
 export { default as publicClient } from "./api/publicClient";
-export { applyRequestDefaults, newCorrelationId } from "./api/requestDefaults";
+export { applyRequestDefaults, newTraceparent, TRACEPARENT_HEADER } from "./api/requestDefaults";
 export type { RetryPolicy } from "./api/retry";
 export { attachRetry, IDEMPOTENCY_KEY_HEADER, isNeverSentError, isRetryableFailure, isRetryableStatus, retryAfterMs, } from "./api/retry";
 export { refreshAccessToken } from "./api/tokenRefresh";
-export type { RefreshableStore, SessionTerminationCode } from "./api/userClient";
-export { default as userClient, injectStore, injectUserAuth, RequestOfflineError, resetRefreshState, SESSION_TERMINATION_CODES, SIGN_OUT_REASON_HEADER, } from "./api/userClient";
+export type { RefreshableStore } from "./api/userClient";
+export { default as userClient, injectStore, injectUserAuth, RequestOfflineError, resetRefreshState, SESSION_EXPIRED_CODE, SESSION_REVOKED_CODE, } from "./api/userClient";
 export { isWorkspaceChangedError, WORKSPACE_CHANGED_CODE, WorkspaceChangedError, } from "./api/workspace";
 export type { KeychainLike, LegacyTokenKeys, SecureCredentials, SessionEndDetail, SessionEndedListener, SessionEndReason, StoredToken, } from "./auth/authStore";
 export { ACCESS_TOKEN_KEY, addSessionEndedListener, clearSession, getSessionUser, getToken, LEGACY_REFRESH_TOKEN_LIFETIME_MS, REFRESH_TOKEN_KEY, removeSessionUser, removeToken, SESSION_USER_KEY, setKeychainImplementation, setLegacyTokenKeys, storeSessionUser, storeToken, } from "./auth/authStore";

package/lib/typescript/commonjs/initSDK.d.ts

@@ -31,14 +31,14 @@ export interface InitConfig {
      * user-visible version and its internal build number (`VERSION_INTERNAL`).
      * Every Webority app already has them in `appsettings.Compiled.json`, which
      * is why they come from config rather than across the native bridge. The
-     * version check compares `appBuild` with the API's `X-Min-App-Version`.
+     * version check compares `appBuild` with the API's `Min-App-Version`.
      */
     appId?: string;
     appVersion?: string;
     appBuild?: number;
     /** The numeric Apple App Store id; the iOS update button needs it. */
     appStoreId?: string;
-    /** The build's short git sha (`COMMIT` in appsettings); sent as `X-Client-Build: <appVersion>+<commit>`. */
+    /** The build's short git sha (`COMMIT` in appsettings); sent as `Client-Build: <appVersion>+<commit>`. */
     commit?: string;
     /**
      * Log a redacted curl line per request. Off by default; it is a debugging
@@ -49,8 +49,6 @@ export interface InitConfig {
     timeoutMs?: number;
     /** Retries under the retry rule. Defaults to 3; 0 turns retrying off. */
     retries?: number;
-    /** Header for the per-request correlation id. Defaults to `'X-Correlation-Id'`; `null` sends none. */
-    correlationIdHeader?: string | null;
     /**
      * The native modules that fill the seams the library does not import.
      *

package/lib/typescript/commonjs/initUserAuth.d.ts

@@ -36,20 +36,13 @@ export interface UserAuthOptions {
     logout: () => unknown;
     refresh: TokenRefreshConfig;
     /**
-     * The account the signed-in user is working in, sent as `X-Account-Id` on
+     * The account the signed-in user is working in, sent as `Account-Id` on
      * every userClient request. Read when a request is first sent and kept for its
      * resends, so a request never runs in a workspace the user switched to after
      * making it; a request that sets the header itself keeps its own value.
      * Omit it in a product whose API takes the account from the token alone.
      */
     accountId?: AccountIdProvider;
-    /**
-     * The response header in which the API names why it ended a session. A 401 carrying it is a
-     * revoked session: no refresh is tried, the session is cleared as `terminated`, and the
-     * value reaches every `addSessionEndedListener` listener as `detail.signOutReason`. It is
-     * read from a refused refresh too. Default `'X-Sign-Out-Reason'`; `null` turns it off.
-     */
-    signOutReasonHeader?: string | null;
     /**
      * The secure-store keys the app kept its session under before this library. The first token
      * read that finds the library's keys empty moves a session found there and deletes the old

package/lib/typescript/commonjs/versionCheck/buildNumber.d.ts

@@ -2,7 +2,7 @@
  * Build-number arithmetic for the server-driven update check, shared word for
  * word by web-core and mobile-core.
  *
- * The API's `X-Min-App-Version` is the lowest internal build number it still
+ * The API's `Min-App-Version` is the lowest internal build number it still
  * supports for the calling client kind, and the app's own build number is an
  * integer too (`VERSION_INTERNAL` on mobile, `appBuild` on web). The comparison
  * is integer against integer, never semver against semver.

package/lib/typescript/commonjs/versionCheck/index.d.ts

@@ -20,7 +20,7 @@ export interface ParsedVersion {
     patch: number;
     prerelease: string;
 }
-/** @deprecated The store is no longer read; the minimum comes from `X-Min-App-Version`. */
+/** @deprecated The store is no longer read; the minimum comes from `Min-App-Version`. */
 export interface VersionData {
     version: string | null;
     released?: string | null;
@@ -30,7 +30,7 @@ export interface VersionData {
     country?: string;
     lastChecked: string;
 }
-/** @deprecated The store is no longer read; the minimum comes from `X-Min-App-Version`. */
+/** @deprecated The store is no longer read; the minimum comes from `Min-App-Version`. */
 export interface VersionComparison {
     needsUpdate: boolean;
     updateType: UpdateType;
@@ -48,7 +48,7 @@ export interface UpdateInfo {
 export interface VersionCheckType {
     /**
      * Whether this build is below the minimum the API last sent in
-     * `X-Min-App-Version`. Resolves "no update" until a reply carried one, and
+     * `Min-App-Version`. Resolves "no update" until a reply carried one, and
      * rejects only when the app's build number is unknown.
      */
     isNewVersionAvailable: () => Promise<VersionCheckResult>;
@@ -63,7 +63,7 @@ export interface VersionCheckType {
 export declare const VersionCheck: VersionCheckType;
 /**
  * Whether this build must update, from the minimum the API sends in
- * `X-Min-App-Version`. Re-renders the moment a reply raises the minimum, so a
+ * `Min-App-Version`. Re-renders the moment a reply raises the minimum, so a
  * minimum raised mid-session opens the ForceUpdateDialog without a restart.
  *
  * @param isAppReady - Whether the app is ready to show the prompt

package/lib/typescript/module/api/clientHeaders.d.ts

@@ -1,16 +1,16 @@
 import type { AxiosInstance } from "axios";
-export declare const CLIENT_BUILD_HEADER = "X-Client-Build";
-export declare const APP_BUILD_HEADER = "X-App-Build";
-export declare const CLIENT_KIND_HEADER = "X-Client-Kind";
-export declare const ACCOUNT_ID_HEADER = "X-Account-Id";
+export declare const CLIENT_BUILD_HEADER = "Client-Build";
+export declare const APP_BUILD_HEADER = "App-Build";
+export declare const CLIENT_KIND_HEADER = "Client-Kind";
+export declare const ACCOUNT_ID_HEADER = "Account-Id";
 /** The server picks session rules and the minimum version per kind; the names match its enum. */
 export type ClientKind = "Browser" | "MobileApp";
 export declare const CLIENT_KIND: ClientKind;
 /** `<appVersion>+<commit>`, `<appVersion>` when no commit was stamped, `null` before init. */
 export declare const getClientBuild: () => string | null;
 /**
- * Stamps X-Client-Kind, X-Client-Build and X-App-Build on every request.
- * X-App-Build is the whole build number the server compares with its minimum;
+ * Stamps Client-Kind, Client-Build and App-Build on every request.
+ * App-Build is the whole build number the server compares with its minimum;
  * it is left off when the build is unknown, because the server never refuses a
  * request without it and a guessed number could strand a current build. A value the app
  * already set (a default header, or a per-request one) wins, so an app that
@@ -29,7 +29,7 @@ export interface AccountStampedConfig {
     _accountId?: string | null;
 }
 /**
- * Stamps X-Account-Id once, on the first send, and records it on the config. A request must
+ * Stamps Account-Id once, on the first send, and records it on the config. A request must
  * never run in a workspace other than the one it was made in, so every resend (the retry
  * policy, a 401 replay, a refresh replay) keeps the first stamp even after the user switched.
  * A header the caller set itself (an outbox item naming its own workspace) wins over the provider.

package/lib/typescript/module/api/minAppVersion.d.ts

@@ -5,7 +5,7 @@ import type { AxiosInstance } from "axios";
  * errors included; cross-origin it is readable only when the API lists it in
  * `Access-Control-Expose-Headers`.
  */
-export declare const MIN_APP_VERSION_HEADER = "X-Min-App-Version";
+export declare const MIN_APP_VERSION_HEADER = "Min-App-Version";
 export type MinAppVersionListener = (minAppVersion: number) => void;
 /** The floor the API last named, or `null` before any response carried one. */
 export declare const getMinAppVersion: () => number | null;
@@ -17,8 +17,7 @@ export declare const getMinAppVersion: () => number | null;
  */
 export declare const addMinAppVersionListener: (listener: MinAppVersionListener) => (() => void);
 /**
- * Reads the floor off every response the client receives, a rejected one too:
- * a 426 Upgrade Required is exactly the case the floor exists for.
+ * Reads the floor off every response the client receives, a rejected one too.
  */
 export declare const readMinAppVersion: (client: AxiosInstance) => void;
 //# sourceMappingURL=minAppVersion.d.ts.map

package/lib/typescript/module/api/requestDefaults.d.ts

@@ -1,17 +1,20 @@
 import type { AxiosInstance } from "axios";
+export declare const TRACEPARENT_HEADER = "traceparent";
 /**
- * A fresh v4 uuid. `crypto.randomUUID` exists only in a secure context (HTTPS or localhost) and
- * not at all on Hermes, so the id falls back to `getRandomValues`, then to `Math.random`. A
- * correlation id only has to be unique enough to find one request in the logs; it is never a secret.
+ * A fresh W3C traceparent, version 00, sampled: the header value and its 32-hex trace id. The ids
+ * only have to be unique enough to find one request in the logs; they are never secrets.
  */
-export declare const newCorrelationId: () => string;
+export declare const newTraceparent: () => {
+    header: string;
+    traceId: string;
+};
 /**
- * Applies the configured timeout and the correlation id per request, read on every send so a
+ * Applies the configured timeout and the traceparent per request, read on every send so a
  * value set after import still applies (the same reason `applyConfiguredBaseUrl` exists).
  * - `timeoutMs`: used when the request carries no timeout of its own; a request's own axios
  *   `timeout` wins. 0, either way, means no timeout (axios's own meaning).
- * - `correlationIdHeader`: a fresh uuid unless the request already carries one. A retry
- *   resends the same config, so it keeps the id the first attempt went out with.
+ * - `traceparent`: a fresh one unless the request already carries one. A retry
+ *   resends the same config, so it keeps the value the first attempt went out with.
  *
  * axios fills a missing `timeout` with its own default of 0, which would make "this request
  * set none" and "this request asked for none" look alike. The client's default is therefore

package/lib/typescript/module/api/retry.d.ts

@@ -20,9 +20,9 @@ export declare const IDEMPOTENCY_KEY_HEADER = "Idempotency-Key";
 export declare const isRetryableStatus: (status: number | undefined) => boolean;
 export declare const isNeverSentError: (error: AxiosError) => boolean;
 /**
- * The wait a refusal named, in milliseconds: the `Retry-After` header (seconds)
- * or a `retryAfterSeconds` body field. `null` when it named none. Cross-origin,
- * the header is readable only when the API lists it in `Access-Control-Expose-Headers`.
+ * The wait a refusal named, in milliseconds: the `Retry-After` header (seconds).
+ * `null` when it named none. Cross-origin, the header is readable only when the API
+ * lists it in `Access-Control-Expose-Headers`.
  */
 export declare const retryAfterMs: (error: AxiosError) => number | null;
 /**

package/lib/typescript/module/api/tokenRefresh.d.ts

@@ -1,5 +1,9 @@
 import { type SessionEndReason } from "../auth/authStore.js";
 import type { UserAuthOptions } from "../initUserAuth.js";
+/** The 401 `code` the server sends when it revoked the session (a revoked token or a rejected cookie stamp). */
+export declare const SESSION_REVOKED_CODE = "session_revoked";
+/** The 401 `code` the server sends when the refresh token has expired. */
+export declare const SESSION_EXPIRED_CODE = "session_expired";
 /**
  * The one token-refresh flow in the library, run by userClient's interceptors.
  * The library calls the refresh endpoint itself, so it can tell a rejected
@@ -33,14 +37,13 @@ export declare const getAccountIdProvider: () => UserAuthOptions["accountId"];
 /** The refresh endpoint's path, once initUserAuth has run. */
 export declare const getRefreshPath: () => string | undefined;
 export declare const dispatchLogout: () => Promise<void>;
-export declare const SIGN_OUT_REASON_HEADER = "X-Sign-Out-Reason";
-/** The server's sign-out reason from response headers (AxiosHeaders or a plain object), or null. */
-export declare const readSignOutReason: (headers: unknown) => string | null;
 /**
  * The session is over: clear it (tokens and session user removed, listeners told why, with
- * the server's reason), then dispatch the app's logout.
+ * the server's session code), then dispatch the app's logout.
  */
-export declare const endSessionAndLogout: (reason: SessionEndReason, signOutReason: string | null) => Promise<void>;
+export declare const endSessionAndLogout: (reason: SessionEndReason, code: string | null) => Promise<void>;
+/** The server's session code in a 401 body (`session_revoked`, `session_expired`), or null. */
+export declare const sessionCodeOf: (data: unknown) => string | null;
 export declare const isRefreshInFlight: () => boolean;
 /** Opens the replacement window for one flagged request; call the returned function once it settles. */
 export declare const beginSessionReplacement: () => (() => void);