Optional ReadonlyauthStatuses the wire answers an expired or rejected credential with —
the ONE spelling of that vocabulary: AuthRetryPolicy owns it (the
reactive re-auth), and the protected toAuthFailure helper (the
sign-in normalization) consults the policy rather than a second
copy. Defaults to [401]; a wire that reports an invalid token as
400 passes both.
ReadonlydefaultSubclass default for SessionAPIConfig.syncIntervalMinutes.
Optional ReadonlyisNarrows authFailureStatuses by the response itself, for a
wire that answers several failures with one status — Gizwits
answers an invalid token AND a server error with 400, told apart
only by the body's error_code, and reading every 400 as an
expired token cleared a valid session on a server hiccup (field
report 2026-11-07). Consulted wherever the vocabulary is — the
reactive re-auth and toAuthFailure alike — so it keeps one
spelling. Omit it to own every listed status.
Optional ReadonlylogLabel prefixed to every log line (e.g. [Classic]). Omit it when a
single client per host makes disambiguation pointless — the raw
logger is then used unwrapped. Clients that emit identically-worded
lifecycle logs ("Session resume failed", "Automatic sign-ins
paused") from two dialects need it: without one, a host running
both cannot tell which account a diagnostics report is about.
Optional ReadonlyrateSliding-window length the rate-limit gate observes. Omit it to build NO rate-limit rung at all — a wire that has never surfaced a 429 gains nothing from the gate.
Optional ReadonlyredactionRedaction engine bound to the SDK's sensitive-key vocabulary,
applied to every request/response log line this class emits —
without it those lines redact through the base vocabulary only, and
a protocol credential key (x-gizwits-user-token, contextkey)
prints in clear into the diagnostic reports users paste into
issues. Defaults to the base engine, so a forgotten parameter
degrades to generic-carrier coverage, never to zero coverage.
ReadonlytransportThe transport, ALREADY BUILT by the SDK. Resolving it — deciding
whether a host-supplied object is a usable client or a bag of
build options — stays in each SDK on purpose: the SDK's own
HttpClient subclass is what seats its redaction vocabulary, and
an instanceof check written against the core's base class would
accept a bare core client carrying only base redaction where the
SDK discards it today.
Subclass-internal options injected into the SessionAPI constructor. Distinct from SessionAPIConfig (the user-facing surface) — these capture what the subclass knows that the user doesn't pick: the built transport, the sync cadence default, the sync runner closure, and the protocol's rate-limit / auth-failure vocabulary.