@webority/mobile-core 0.91.0 → 0.93.0

package/lib/typescript/module/api/userClient.d.ts

@@ -1,7 +1,7 @@
 import { type AxiosInstance } from "axios";
 import "../types/axios.js";
 export type { RefreshableStore } from "./tokenRefresh.js";
-export { injectStore, injectUserAuth, resetRefreshState, SIGN_OUT_REASON_HEADER, } from "./tokenRefresh.js";
+export { injectStore, injectUserAuth, resetRefreshState, SESSION_EXPIRED_CODE, SESSION_REVOKED_CODE, } from "./tokenRefresh.js";
 /**
  * Thrown by the request interceptor when the device is offline, before the
  * request ever reaches the adapter (and therefore the network). Distinct from
@@ -11,28 +11,6 @@ export { injectStore, injectUserAuth, resetRefreshState, SIGN_OUT_REASON_HEADER,
 export declare class RequestOfflineError extends Error {
     constructor(message?: string);
 }
-/**
- * Sub-codes a 401 response body carries when the session itself is dead
- * (terminated by an admin, or expired server-side) rather than merely
- * out-of-date. These never warrant a refresh attempt — only logout.
- */
-export declare const SESSION_TERMINATION_CODES: {
-    readonly TERMINATED: "SESSION_TERMINATED";
-    readonly EXPIRED: "SESSION_EXPIRED";
-};
-export type SessionTerminationCode = (typeof SESSION_TERMINATION_CODES)[keyof typeof SESSION_TERMINATION_CODES];
-/**
- * The header is the AUTHORITATIVE signal, verified against the backend:
- * `WeborityJwtMiddleware.ReturnUnauthorized` answers an invalidated session with
- * `401` + `X-Security-Stamp-Invalid: true` and a body of
- * `{ error: 'Unauthorized', message: '...' }` — no code field at all, and
- * `error` is a string rather than an object. An earlier version of this checked
- * only body fields and would therefore never have fired against a real server.
- *
- * The body codes below are kept as a secondary path for any head that does send
- * an explicit sub-code; they match on exact strings, so looking is free.
- */
-export declare const SESSION_INVALID_HEADER = "x-security-stamp-invalid";
 declare const userClient: AxiosInstance;
 export default userClient;
 //# sourceMappingURL=userClient.d.ts.map

package/lib/typescript/module/auth/authStore.d.ts

@@ -33,12 +33,9 @@ export type SessionEndReason = "signedOut" | "rejected" | "terminated" | "corrup
 /** What else is known about a session end, beside its reason. */
 export interface SessionEndDetail {
     /**
-     * The server's own name for why it ended the session, from the sign-out-reason response
-     * header (`X-Sign-Out-Reason` by default, `initUserAuth({ signOutReasonHeader })`), on a
-     * terminated session or a refused refresh. `null` when the server named none, and always
-     * `null` for `signedOut` and `corrupt` unless the app passes one.
+     * The server's session code (`session_revoked`, `session_expired`) when the server ended the session; null when the app did.
      */
-    signOutReason: string | null;
+    code: string | null;
 }
 export type SessionEndedListener = (reason: SessionEndReason, detail: SessionEndDetail) => void;
 /**
@@ -148,7 +145,7 @@ export declare const addSessionEndedListener: (listener: SessionEndedListener) =
  * flow and the app's own sign-out can both call it without a double event.
  * The library calls it itself with `rejected` when the refresh endpoint refuses
  * the refresh token and `terminated` when the API reports the session dead,
- * with the server's sign-out reason in `detail`.
+ * with the server's session code in `detail`.
  */
 export declare const clearSession: (reason?: SessionEndReason, detail?: Partial<SessionEndDetail>) => Promise<void>;
 export type { KeychainLike, SecureCredentials };

package/lib/typescript/module/config/index.d.ts

@@ -27,12 +27,12 @@ export interface Config {
     appId: string | null;
     /** The app's user-visible version string, e.g. `'1.4.2'`. Same rationale as `appId`. */
     appVersion: string | null;
-    /** The short git sha stamped into the build; with `appVersion` it makes the X-Client-Build header. */
+    /** The short git sha stamped into the build; with `appVersion` it makes the Client-Build header. */
     commit: string | null;
     /**
      * The app's internal build number (`VERSION_INTERNAL`: Android versionCode,
      * iOS CFBundleVersion). The version check compares it with the API's
-     * `X-Min-App-Version`. Falls back to expo-application when unset.
+     * `Min-App-Version`. Falls back to expo-application when unset.
      */
     appBuild: number | null;
     /**
@@ -53,12 +53,6 @@ export interface Config {
     timeoutMs: number;
     /** How many times a failed request is resent under the retry rule. 0 turns retrying off. Default 3. */
     retries: number;
-    /**
-     * Header that carries a fresh id (a uuid) on every request, for tracing one request across
-     * the app, the API and its logs. A retry keeps the id it first went out with. `null`
-     * sends none. Default `'X-Correlation-Id'`.
-     */
-    correlationIdHeader: string | null;
 }
 /**
  * Info lines (each token refresh, each unauthorised URL) reach the device log
@@ -68,7 +62,6 @@ export interface Config {
 export declare const DEFAULT_LOG_LEVEL: LogLevel;
 export declare const DEFAULT_TIMEOUT_MS = 30000;
 export declare const DEFAULT_RETRIES = 3;
-export declare const DEFAULT_CORRELATION_ID_HEADER = "X-Correlation-Id";
 /**
  * Set global configuration for all Webority packages
  */

package/lib/typescript/module/errors/extractApiError.d.ts

@@ -2,19 +2,13 @@
  * Normalizes any failure a thunk, a service or the RTK Query base query can see into one
  * `ApiError`. Identical source in @webority/web-core and @webority/mobile-core.
  *
- * Bodies read, newest first: the standard body `{ code, message, traceId, errors }`,
- * where `errors` is a ModelState dictionary (`{ Field: ["msg"] }`) or a list of
- * `{ field, message, reference }` (a refusal that names its fields),
- * ProblemDetails `{ title, detail, errors }` from APIs not yet moved, legacy `{ error }` and
- * `{ message }`, and a plain-text body.
+ * The body read is the RFC 9457 problem `{ type, title, status, detail, code, traceId, errors }`,
+ * where `errors` is a ModelState dictionary (`{ Field: ["msg"] }`) or a list of `{ field, message }`.
  *
- * Message precedence is fixed (react.md): first field error, then `message`, `detail`, a
- * legacy `error`, `title`, then `Request failed (<status>)`. `title` is last because it is
- * the ProblemDetails category ("Bad Request"), not the curated sentence.
- *
- * Never a `message`: anything that reads like an exception dump, and a 5xx body unless it is
- * coded (not `internal_error`) and its `message` is user-safe. The server's text goes on
- * `detail` for the logger either way.
+ * Message precedence (react.md): first field error, form error, `detail`, `title`, a plain-text
+ * body, then `Request failed (<status>)`. A 5xx shows `detail` only when it carries a code other
+ * than `internal_error`. The server's text goes on `diagnostic` for the logger, never the screen.
+ * The trace id falls back to the request's own `traceparent`, so a lost request keeps a reference.
  */
 export interface ApiError {
     /** Stable snake_case branch key from the server (`not_found`, `validation_failed`). Branch on it, never render it. */
@@ -30,7 +24,7 @@ export interface ApiError {
     /** The server's trace id, for a support reference. */
     traceId: string | null;
     /** What the server or runtime actually said. For the logger, never for the screen. */
-    detail: string | null;
+    diagnostic: string | null;
 }
 export declare const SERVER_FAILURE_MESSAGE = "Something went wrong on our side. Please try again in a moment.";
 export declare const OFFLINE_MESSAGE = "You appear to be offline. Check your connection and try again.";

package/lib/typescript/module/index.d.ts

@@ -36,12 +36,12 @@ export { buildCurl, logCurl } from "./api/curl.js";
 export type { MinAppVersionListener } from "./api/minAppVersion.js";
 export { addMinAppVersionListener, getMinAppVersion, MIN_APP_VERSION_HEADER, } from "./api/minAppVersion.js";
 export { default as publicClient } from "./api/publicClient.js";
-export { applyRequestDefaults, newCorrelationId } from "./api/requestDefaults.js";
+export { applyRequestDefaults, newTraceparent, TRACEPARENT_HEADER } from "./api/requestDefaults.js";
 export type { RetryPolicy } from "./api/retry.js";
 export { attachRetry, IDEMPOTENCY_KEY_HEADER, isNeverSentError, isRetryableFailure, isRetryableStatus, retryAfterMs, } from "./api/retry.js";
 export { refreshAccessToken } from "./api/tokenRefresh.js";
-export type { RefreshableStore, SessionTerminationCode } from "./api/userClient.js";
-export { default as userClient, injectStore, injectUserAuth, RequestOfflineError, resetRefreshState, SESSION_TERMINATION_CODES, SIGN_OUT_REASON_HEADER, } from "./api/userClient.js";
+export type { RefreshableStore } from "./api/userClient.js";
+export { default as userClient, injectStore, injectUserAuth, RequestOfflineError, resetRefreshState, SESSION_EXPIRED_CODE, SESSION_REVOKED_CODE, } from "./api/userClient.js";
 export { isWorkspaceChangedError, WORKSPACE_CHANGED_CODE, WorkspaceChangedError, } from "./api/workspace.js";
 export type { KeychainLike, LegacyTokenKeys, SecureCredentials, SessionEndDetail, SessionEndedListener, SessionEndReason, StoredToken, } from "./auth/authStore.js";
 export { ACCESS_TOKEN_KEY, addSessionEndedListener, clearSession, getSessionUser, getToken, LEGACY_REFRESH_TOKEN_LIFETIME_MS, REFRESH_TOKEN_KEY, removeSessionUser, removeToken, SESSION_USER_KEY, setKeychainImplementation, setLegacyTokenKeys, storeSessionUser, storeToken, } from "./auth/authStore.js";

package/lib/typescript/module/initSDK.d.ts

@@ -31,14 +31,14 @@ export interface InitConfig {
      * user-visible version and its internal build number (`VERSION_INTERNAL`).
      * Every Webority app already has them in `appsettings.Compiled.json`, which
      * is why they come from config rather than across the native bridge. The
-     * version check compares `appBuild` with the API's `X-Min-App-Version`.
+     * version check compares `appBuild` with the API's `Min-App-Version`.
      */
     appId?: string;
     appVersion?: string;
     appBuild?: number;
     /** The numeric Apple App Store id; the iOS update button needs it. */
     appStoreId?: string;
-    /** The build's short git sha (`COMMIT` in appsettings); sent as `X-Client-Build: <appVersion>+<commit>`. */
+    /** The build's short git sha (`COMMIT` in appsettings); sent as `Client-Build: <appVersion>+<commit>`. */
     commit?: string;
     /**
      * Log a redacted curl line per request. Off by default; it is a debugging
@@ -49,8 +49,6 @@ export interface InitConfig {
     timeoutMs?: number;
     /** Retries under the retry rule. Defaults to 3; 0 turns retrying off. */
     retries?: number;
-    /** Header for the per-request correlation id. Defaults to `'X-Correlation-Id'`; `null` sends none. */
-    correlationIdHeader?: string | null;
     /**
      * The native modules that fill the seams the library does not import.
      *

package/lib/typescript/module/initUserAuth.d.ts

@@ -36,20 +36,13 @@ export interface UserAuthOptions {
     logout: () => unknown;
     refresh: TokenRefreshConfig;
     /**
-     * The account the signed-in user is working in, sent as `X-Account-Id` on
+     * The account the signed-in user is working in, sent as `Account-Id` on
      * every userClient request. Read when a request is first sent and kept for its
      * resends, so a request never runs in a workspace the user switched to after
      * making it; a request that sets the header itself keeps its own value.
      * Omit it in a product whose API takes the account from the token alone.
      */
     accountId?: AccountIdProvider;
-    /**
-     * The response header in which the API names why it ended a session. A 401 carrying it is a
-     * revoked session: no refresh is tried, the session is cleared as `terminated`, and the
-     * value reaches every `addSessionEndedListener` listener as `detail.signOutReason`. It is
-     * read from a refused refresh too. Default `'X-Sign-Out-Reason'`; `null` turns it off.
-     */
-    signOutReasonHeader?: string | null;
     /**
      * The secure-store keys the app kept its session under before this library. The first token
      * read that finds the library's keys empty moves a session found there and deletes the old

package/lib/typescript/module/versionCheck/buildNumber.d.ts

@@ -2,7 +2,7 @@
  * Build-number arithmetic for the server-driven update check, shared word for
  * word by web-core and mobile-core.
  *
- * The API's `X-Min-App-Version` is the lowest internal build number it still
+ * The API's `Min-App-Version` is the lowest internal build number it still
  * supports for the calling client kind, and the app's own build number is an
  * integer too (`VERSION_INTERNAL` on mobile, `appBuild` on web). The comparison
  * is integer against integer, never semver against semver.

package/lib/typescript/module/versionCheck/index.d.ts

@@ -20,7 +20,7 @@ export interface ParsedVersion {
     patch: number;
     prerelease: string;
 }
-/** @deprecated The store is no longer read; the minimum comes from `X-Min-App-Version`. */
+/** @deprecated The store is no longer read; the minimum comes from `Min-App-Version`. */
 export interface VersionData {
     version: string | null;
     released?: string | null;
@@ -30,7 +30,7 @@ export interface VersionData {
     country?: string;
     lastChecked: string;
 }
-/** @deprecated The store is no longer read; the minimum comes from `X-Min-App-Version`. */
+/** @deprecated The store is no longer read; the minimum comes from `Min-App-Version`. */
 export interface VersionComparison {
     needsUpdate: boolean;
     updateType: UpdateType;
@@ -48,7 +48,7 @@ export interface UpdateInfo {
 export interface VersionCheckType {
     /**
      * Whether this build is below the minimum the API last sent in
-     * `X-Min-App-Version`. Resolves "no update" until a reply carried one, and
+     * `Min-App-Version`. Resolves "no update" until a reply carried one, and
      * rejects only when the app's build number is unknown.
      */
     isNewVersionAvailable: () => Promise<VersionCheckResult>;
@@ -63,7 +63,7 @@ export interface VersionCheckType {
 export declare const VersionCheck: VersionCheckType;
 /**
  * Whether this build must update, from the minimum the API sends in
- * `X-Min-App-Version`. Re-renders the moment a reply raises the minimum, so a
+ * `Min-App-Version`. Re-renders the moment a reply raises the minimum, so a
  * minimum raised mid-session opens the ForceUpdateDialog without a restart.
  *
  * @param isAppReady - Whether the app is ready to show the prompt

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webority/mobile-core",
-  "version": "0.91.0",
+  "version": "0.93.0",
   "description": "Platform layer for Webority React Native apps: HTTP clients, auth/token storage, config, logging, formatters, validators, network status, permissions, storage, version checks and over-the-air updates. No UI.",
   "keywords": [
     "react-native",