@aifabrix/miso-client 4.10.0 → 4.13.0

package/CHANGELOG.md

@@ -5,6 +5,46 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.13.0] - 2026-05-13
+
+### Added
+
+- **`joinApiRoot(root, path)` and `normalizeRootUrl(root)` URL helpers** - Single, exported helper for joining a full base URL with a relative API path. Same code for every mount: `/`, `/miso`, `/data`, `/myapp`, or any custom virtual directory. `normalizeRootUrl` validates http/https and trims trailing slashes; `joinApiRoot` enforces leading-`/` paths and rejects absolute URLs as the path argument. Both are exported from `@aifabrix/miso-client` (see `src/sdk-exports.ts`).
+- **`mergeRootUrlWithBasePath(root, basePath?)`** - Optional compatibility merge for an origin-only root plus a virtual-directory path; avoids applying the same path twice when the root already contains it. Exported from `@aifabrix/miso-client` with `joinApiRoot` and `normalizeRootUrl`.
+- **Optional `controllerBasePath` on `MisoClientConfig`** - Applied when resolving the controller URL (browser/server) so split config (`https://domain.com` + `/miso`) matches full-URL behavior without double-prefix.
+- **Optional `basePath` on `DataClientConfig`** - Merged once in `createDefaultConfig` into `baseUrl` with the same rules as `controllerBasePath`.
+
+### Changed
+
+- **All backend HTTP URL building goes through `joinApiRoot`** - DataClient request URLs (`data-client-core.ts`), browser environment-token fetch (`data-client-auth.ts`), auto-init config fetch (`data-client-auto-init.ts`), and login/logout redirects (`data-client-redirect.ts`) now build URLs with `joinApiRoot`. `internal-http-client.ts` and `client-token-manager.ts` normalize the axios `baseURL` via `normalizeRootUrl`. There is now exactly one URL-join code path for the SDK.
+- **`resolveControllerUrl` / `getControllerUrl`** - Apply `mergeRootUrlWithBasePath` with `controllerBasePath` after choosing public/private/fallback URL (before localhost normalization in the resolver).
+- **Full-URL convention for `controllerUrl` / `controllerPublicUrl` / `controllerPrivateUrl` and `DataClientConfigResponse.baseUrl`** - These fields are documented as full URLs that may include a virtual-directory path (e.g. `https://domain.com/miso`). The **server** `DataClientConfigResponse` payload still has no `basePath` field; optional split-URL fields apply to **client** `MisoClientConfig` / `DataClientConfig` only.
+
+### Docs
+
+- **URL strategy guidance** - `docs/configuration.md` "Full URLs and virtual directories" covers preferred full roots, optional `controllerBasePath`, exported `mergeRootUrlWithBasePath`, and server vs client config. `docs/dataclient.md` documents optional `basePath` and clarifies double-prefix avoidance. `docs/troubleshooting.md` distinguishes host duplication vs SDK compatibility fields. `docs/README.md` URL strategy row updated.
+
+### Technical
+
+- **Tests** - `tests/unit/url-join.test.ts` covers `joinApiRoot`, `normalizeRootUrl`, `isDoublePrefix`, `mergeRootUrlWithBasePath`, and `normalizeOptionalBasePath`; `tests/unit/url-join-integration.test.ts` covers end-to-end `joinApiRoot` flows for multiple mounts.
+- **Validation gates** - `pnpm run lint` (zero warnings), `pnpm run build`, `pnpm run tests:typecheck`, and `pnpm run test` all clean.
+
+## [4.12.0] - 2026-05-05
+
+### Added
+
+- **Enterprise auth token lifecycle utilities** - Added compatibility-oriented helpers for access/refresh token key handling, expiration normalization, adaptive refresh scheduling, and a `UserTokenRefreshManager` utility.
+- **Cookie-first browser auth recovery hooks** - Added DataClient config support for `onSessionRestore`, `preferCookieSessionRestore`, and `clearCachedBrowserAuthState` to enable enterprise SSO recovery flow before token refresh.
+
+### Changed
+
+- **DataClient default token key compatibility** - Default token keys now include `miso_token` alongside existing keys for migration-safe interoperability.
+- **401 auth recovery behavior** - DataClient now attempts session restore first (when configured), then token refresh, then stale browser auth cleanup before redirect.
+
+### Technical
+
+- **Release preparation and validation** - Completed release validation gates with silent logs (`tests:typecheck`, `lint:fix`, `lint`, `test`) and aligned SDK release metadata for `4.12.0`.
+
 ## [4.10.0] - 2026-04-15
 
 ### Added