@attlaz/client 1.96.0 → 1.98.0

package/dist/DataQuality/Service/QualityEndpoint.js

@@ -1,9 +1,14 @@
+import { path } from '../../Http/Data/Path.js';
+import { HttpStatus } from '../../Http/HttpStatus.js';
 import { QueryString } from '../../Http/Data/QueryString.js';
+import { ApiError } from '../../Model/Error/ApiError.js';
 import { QualityDataset } from '../Model/QualityDataset.js';
 import { QualityEntity } from '../Model/QualityEntity.js';
 import { QualityProblem } from '../Model/QualityProblem.js';
 import { QualityProblemDefinition } from '../Model/QualityProblemDefinition.js';
 import { QualityProblemEvent } from '../Model/QualityProblemEvent.js';
+import { QualityReportResult } from '../Model/QualityReportResult.js';
+import { QualityScan } from '../Model/QualityScan.js';
 import { QualityEntityProblemSuppression } from '../Model/QualityEntityProblemSuppression.js';
 import { Endpoint } from '../../Service/Endpoint.js';
 /**
@@ -18,7 +23,7 @@ export class QualityEndpoint extends Endpoint {
         return await this.requestCollection(queryString, QualityDataset.parse);
     }
     async getDataset(datasetId) {
-        const result = await this.requestObject('/data-quality/datasets/' + datasetId, null, QualityDataset.parse, 'GET');
+        const result = await this.requestObject(path('/data-quality/datasets/:datasetId', { datasetId }), null, QualityDataset.parse, 'GET');
         return result.getData();
     }
     async createDataset(projectId, name, autoCloseMode = null) {
@@ -31,14 +36,14 @@ export class QualityEndpoint extends Endpoint {
     }
     async updateDataset(datasetId, changes) {
         // camelCase keys are snake_cased by the base Endpoint (autoCloseMode -> auto_close_mode).
-        const result = await this.requestObject('/data-quality/datasets/' + datasetId, changes, QualityDataset.parse, 'PATCH');
+        const result = await this.requestObject(path('/data-quality/datasets/:datasetId', { datasetId }), changes, QualityDataset.parse, 'PATCH');
         return result.getData();
     }
     async deleteDataset(datasetId) {
-        await this.requestObject('/data-quality/datasets/' + datasetId, null, (raw) => raw, 'DELETE');
+        await this.requestObject(path('/data-quality/datasets/:datasetId', { datasetId }), null, (raw) => raw, 'DELETE');
     }
     async getEntities(datasetId, pagination = null, filters = {}) {
-        const queryString = new QueryString('/data-quality/datasets/' + datasetId + '/entities');
+        const queryString = new QueryString(path('/data-quality/datasets/:datasetId/entities', { datasetId }));
         if (filters.entityType) {
             queryString.set('entity_type', filters.entityType);
         }
@@ -62,9 +67,7 @@ export class QualityEndpoint extends Endpoint {
     }
     /** Suppressed problems are hidden unless `includeSuppressed` is set. */
     async getEntityProblems(datasetId, entityType, entityId, includeSuppressed = false) {
-        const queryString = new QueryString('/data-quality/datasets/' + datasetId
-            + '/entities/' + encodeURIComponent(entityType)
-            + '/' + encodeURIComponent(entityId) + '/problems');
+        const queryString = new QueryString(path('/data-quality/datasets/:datasetId/entities/:entityType/:entityId/problems', { datasetId, entityType, entityId }));
         if (includeSuppressed) {
             queryString.set('include_suppressed', 'true');
         }
@@ -72,22 +75,105 @@ export class QualityEndpoint extends Endpoint {
     }
     /** The transition timeline for one problem, oldest first. */
     async getProblemEvents(datasetId, entityType, entityId, code) {
-        const path = '/data-quality/datasets/' + datasetId
-            + '/entities/' + encodeURIComponent(entityType)
-            + '/' + encodeURIComponent(entityId)
-            + '/problems/' + encodeURIComponent(code) + '/events';
-        return await this.requestCollection(path, QualityProblemEvent.parse);
+        const requestPath = path('/data-quality/datasets/:datasetId/entities/:entityType/:entityId/problems/:code/events', { datasetId, entityType, entityId, code });
+        return await this.requestCollection(requestPath, QualityProblemEvent.parse);
+    }
+    // ---- Ingest ----
+    /**
+     * Open a scan: the bracket a reporter puts around one run of checks.
+     *
+     * `pack` names the group of checks this run covers. It scopes what completing the scan is allowed
+     * to close, so a partial run cannot resolve problems it never looked at.
+     */
+    async openScan(datasetId, pack = null) {
+        const requestPath = path('/data-quality/datasets/:datasetId/scans', { datasetId });
+        const result = await this.requestObject(requestPath, { pack: pack }, QualityScan.parse, 'POST');
+        const scan = result.getData();
+        if (scan === null) {
+            throw QualityEndpoint.writeFailed(requestPath);
+        }
+        return scan;
+    }
+    /**
+     * Report what an open scan found. Safe to call repeatedly to send entities in batches.
+     *
+     * Entities are created on first report — there is nothing to register up front.
+     *
+     * **Batch size**: the API caps a request body at 512 KB (the Gateway rejects over 1 MB before it
+     * even arrives), and an entity carrying one problem is roughly 250-300 bytes of JSON — so keep
+     * batches to a low four figures of entities. An oversize request comes back as `413` with error
+     * code `payload_too_large`. Send several batches into the same scan rather than one large one.
+     */
+    async reportToScan(datasetId, scanId, entities) {
+        return await this.postReport(path('/data-quality/datasets/:datasetId/scans/:scanId/report', { datasetId, scanId }), { entities: entities.map((entity) => entity.toPayload()) });
+    }
+    /**
+     * Close the scan, resolving problems the run covered but did not re-report. Returns how many were
+     * resolved.
+     *
+     * Skipping this leaves problems open that the reporter has already stopped finding.
+     */
+    async completeScan(datasetId, scanId) {
+        const requestPath = path('/data-quality/datasets/:datasetId/scans/:scanId/complete', { datasetId, scanId });
+        const result = await this.requestObject(requestPath, {}, (raw) => ({ resolved: Number(raw.resolved ?? 0) }), 'POST');
+        const data = result.getData();
+        if (data === null) {
+            throw QualityEndpoint.writeFailed(requestPath);
+        }
+        return data.resolved;
+    }
+    /**
+     * Open a scan, report everything and complete it in one call — for a reporter that already has
+     * the full picture in memory and does not need to stream it in batches.
+     *
+     * Everything goes in one request, so this is bounded by the API's 512 KB body cap — a few
+     * thousand entities at most. Beyond that use `openScan` / `reportToScan` / `completeScan`, which
+     * can send as many batches as you like into one scan.
+     */
+    async reportProblems(datasetId, entities, pack = null) {
+        return await this.postReport(path('/data-quality/datasets/:datasetId/problems', { datasetId }), {
+            pack: pack,
+            entities: entities.map((entity) => entity.toPayload()),
+        });
+    }
+    /**
+     * Both report routes take the same already-snake_cased body and return the same counts.
+     *
+     * `_formatted: true` sends the body verbatim. Without it the client's key formatter would rewrite
+     * every key and strip the trailing `_id` from `entity_id`, which the endpoint requires.
+     */
+    async postReport(requestPath, body) {
+        const result = await this.requestObject(requestPath, { ...body, _formatted: true }, QualityReportResult.parse, 'POST');
+        const reportResult = result.getData();
+        if (reportResult === null) {
+            throw QualityEndpoint.writeFailed(requestPath);
+        }
+        return reportResult;
+    }
+    /**
+     * A write that came back with nothing — the base Endpoint maps a 404 to null data, and also
+     * returns null when the response cannot be parsed.
+     *
+     * Reads may legitimately answer "no such thing" with null, but a write cannot: returning a zero
+     * count here would be indistinguishable from a report that genuinely changed nothing, and a
+     * reporter would log success while its problems went nowhere.
+     *
+     * The message names both causes because the API cannot yet tell them apart — a missing dataset
+     * and a path that no longer exists (a reporter still on `/data_quality/`) both come back as a
+     * bare 404. Once the API sets an error `code`, branch on that instead.
+     */
+    static writeFailed(requestPath) {
+        return new ApiError('Data Quality write to `' + requestPath + '` returned nothing. Either the dataset or scan does not exist, '
+            + 'or the endpoint does not — check the id, and that the client version matches the API.', HttpStatus.HTTP_NOTFOUND);
     }
     /** Clear an entity's problems so the next scan starts from scratch; returns how many were removed. */
     async resetEntity(datasetId, entityType, entityId) {
-        const path = '/data-quality/datasets/' + datasetId
-            + '/entities/' + encodeURIComponent(entityType)
-            + '/' + encodeURIComponent(entityId) + '/reset';
-        const result = await this.requestObject(path, {}, (raw) => ({ deleted: raw.deleted ?? 0 }), 'POST');
+        const requestPath = path('/data-quality/datasets/:datasetId/entities/:entityType/:entityId/reset', { datasetId, entityType, entityId });
+        const result = await this.requestObject(requestPath, {}, (raw) => ({ deleted: raw.deleted ?? 0 }), 'POST');
         return result.getData()?.deleted ?? 0;
     }
     async getFilterOptions(datasetId) {
-        const result = await this.requestObject('/data-quality/datasets/' + datasetId + '/filter-options', null, (raw) => ({
+        const result = await this.requestObject(path('/data-quality/datasets/:datasetId/filter-options', { datasetId }), null, (raw) => ({
             entityTypes: raw.entity_types ?? [],
             properties: raw.properties ?? [],
             codes: (raw.codes ?? []).map((row) => ({
@@ -100,7 +186,7 @@ export class QualityEndpoint extends Endpoint {
     }
     /** Both groupings in one call: `counts` by (property, severity) and `codes` for the fix cards. */
     async getSummary(datasetId) {
-        const result = await this.requestObject('/data-quality/datasets/' + datasetId + '/summary', null, (raw) => ({
+        const result = await this.requestObject(path('/data-quality/datasets/:datasetId/summary', { datasetId }), null, (raw) => ({
             counts: (raw.counts ?? []).map((row) => ({
                 property: row.property,
                 severity: row.severity,
@@ -134,7 +220,7 @@ export class QualityEndpoint extends Endpoint {
     }
     // ---- Suppressions ----
     async getEntityProblemSuppressions(datasetId) {
-        return await this.requestCollection('/data-quality/datasets/' + datasetId + '/entity-problem-suppressions', QualityEntityProblemSuppression.parse);
+        return await this.requestCollection(path('/data-quality/datasets/:datasetId/entity-problem-suppressions', { datasetId }), QualityEntityProblemSuppression.parse);
     }
     /**
      * Suppress a code, either on one entity or — with both entity fields omitted — across the whole
@@ -154,7 +240,7 @@ export class QualityEndpoint extends Endpoint {
             entity: suppression.entityId ?? null,
             reason: suppression.reason ?? null,
         };
-        const result = await this.requestObject('/data-quality/datasets/' + datasetId + '/entity-problem-suppressions', body, (raw) => ({
+        const result = await this.requestObject(path('/data-quality/datasets/:datasetId/entity-problem-suppressions', { datasetId }), body, (raw) => ({
             suppression: raw.id ? QualityEntityProblemSuppression.parse(raw) : null,
             muted: Number(raw.muted ?? 0),
         }), 'POST');
@@ -162,7 +248,7 @@ export class QualityEndpoint extends Endpoint {
     }
     /** Lift a suppression; returns how many muted problems were returned to the open list. */
     async deleteEntityProblemSuppression(datasetId, entityProblemSuppressionId) {
-        const result = await this.requestObject('/data-quality/datasets/' + datasetId + '/entity-problem-suppressions/' + entityProblemSuppressionId, null, (raw) => ({ reopened: Number(raw.reopened ?? 0) }), 'DELETE');
+        const result = await this.requestObject(path('/data-quality/datasets/:datasetId/entity-problem-suppressions/:entityProblemSuppressionId', { datasetId, entityProblemSuppressionId }), null, (raw) => ({ reopened: Number(raw.reopened ?? 0) }), 'DELETE');
         return result.getData()?.reopened ?? 0;
     }
 }

package/dist/FeedManagement/Service/CatalogFeedEndpoint.js

@@ -1,3 +1,4 @@
+import { path } from '../../Http/Data/Path.js';
 import { QueryString } from '../../Http/Data/QueryString.js';
 import { Endpoint } from '../../Service/Endpoint.js';
 import { CatalogFeed } from '../Model/CatalogFeed.js';
@@ -9,7 +10,7 @@ import { CatalogFeed } from '../Model/CatalogFeed.js';
  */
 export class CatalogFeedEndpoint extends Endpoint {
     async getByCatalog(catalogId, pagination = null, expand = []) {
-        const queryString = new QueryString('/catalogs/' + catalogId.toString() + '/feeds');
+        const queryString = new QueryString(path('/catalogs/:catalogId/feeds', { catalogId: catalogId.toString() }));
         if (expand.length > 0) {
             queryString.set('expand', expand);
         }

package/dist/Flow/Service/FlowEndpoint.js

@@ -1,3 +1,4 @@
+import { path } from '../../Http/Data/Path.js';
 import { QueryString } from '../../Http/Data/QueryString.js';
 import { HttpStatus } from '../../Http/HttpStatus.js';
 import { Flow } from '../Model/Flow.js';
@@ -7,7 +8,7 @@ import { Endpoint } from '../../Service/Endpoint.js';
 export class FlowEndpoint extends Endpoint {
     async getByProject(projectId, pagination) {
         try {
-            const queryString = new QueryString('/projects/' + projectId + '/flows');
+            const queryString = new QueryString(path('/projects/:projectId/flows', { projectId }));
             queryString.addPagination(pagination);
             const result = await this.requestCollection(queryString, Flow.parse);
             return result;
@@ -21,7 +22,7 @@ export class FlowEndpoint extends Endpoint {
     }
     async getById(flowId) {
         try {
-            const result = await this.requestObject('/flows/' + flowId, null, Flow.parse);
+            const result = await this.requestObject(path('/flows/:flowId', { flowId }), null, Flow.parse);
             return result.getData();
         }
         catch (error) {
@@ -39,7 +40,7 @@ export class FlowEndpoint extends Endpoint {
         if (!Utils.isNullOrUndefined(projectEnvironmentId)) {
             parameters = { environment: projectEnvironmentId };
         }
-        const queryString = new QueryString('projects/' + projectId + '/flowsummaries');
+        const queryString = new QueryString(path('projects/:projectId/flowsummaries', { projectId }));
         if (pagination !== null) {
             queryString.addPagination(pagination);
         }
@@ -51,7 +52,7 @@ export class FlowEndpoint extends Endpoint {
             parameters = { environment: projectEnvironmentId };
         }
         try {
-            const rawFlowSummaries = await this.requestObject('flows/' + flowId + '/summaries', parameters, FlowSummary.parse);
+            const rawFlowSummaries = await this.requestObject(path('flows/:flowId/summaries', { flowId }), parameters, FlowSummary.parse);
             if (rawFlowSummaries.getData() === null) {
                 return null;
             }
@@ -66,7 +67,7 @@ export class FlowEndpoint extends Endpoint {
     }
     async save(flow) {
         try {
-            const url = '/projects/' + flow.projectId + '/flows';
+            const url = path('/projects/:projectId/flows', { projectId: flow.projectId });
             const result = await this.requestObject(url, flow, Flow.parse, 'POST');
             const updatedFlow = result.getData();
             if (updatedFlow === null) {

package/dist/Flow/Service/FlowRunEndpoint.js

@@ -1,3 +1,4 @@
+import { path } from '../../Http/Data/Path.js';
 import { FlowRun } from '../Model/FlowRun.js';
 import { FlowRunSummary } from '../Model/FlowRunSummary.js';
 import { FlowRunHistory } from '../Model/FlowRunHistory.js';
@@ -6,12 +7,12 @@ import { QueryString } from '../../Http/Data/QueryString.js';
 import { Endpoint } from '../../Service/Endpoint.js';
 export class FlowRunEndpoint extends Endpoint {
     async getFlowRuns(flowId) {
-        const result = await this.requestCollection('/flows/' + flowId + '/runs', FlowRun.parse);
+        const result = await this.requestCollection(path('/flows/:flowId/runs', { flowId }), FlowRun.parse);
         return result;
     }
     async getFlowRunSummaries(flowId, flowRunStatuses = null, pagination = null, projectEnvironmentId = null) {
         try {
-            const queryString = new QueryString('/flows/' + flowId + '/runsummaries');
+            const queryString = new QueryString(path('/flows/:flowId/runsummaries', { flowId }));
             queryString.addPagination(pagination);
             // if (from !== null && from !== undefined) {
             //
@@ -49,7 +50,7 @@ export class FlowRunEndpoint extends Endpoint {
     }
     async getFlowRunSummary(flowRunId) {
         try {
-            const result = await this.requestObject('/flowruns/' + flowRunId + '/summaries', null, FlowRunSummary.parse);
+            const result = await this.requestObject(path('/flowruns/:flowRunId/summaries', { flowRunId }), null, FlowRunSummary.parse);
             return result.getData();
         }
         catch (error) {
@@ -67,7 +68,7 @@ export class FlowRunEndpoint extends Endpoint {
      */
     async getFlowRun(flowRunId) {
         try {
-            const result = await this.requestObject('/flowruns/' + flowRunId + '/summaries', null, FlowRun.parse);
+            const result = await this.requestObject(path('/flowruns/:flowRunId/summaries', { flowRunId }), null, FlowRun.parse);
             return result.getData();
         }
         catch (error) {
@@ -78,7 +79,7 @@ export class FlowRunEndpoint extends Endpoint {
         }
     }
     async getFlowRunHistory(flowRunId) {
-        const result = await this.requestCollection('/flowruns/' + flowRunId + '/history', FlowRunHistory.parse);
+        const result = await this.requestCollection(path('/flowruns/:flowRunId/history', { flowRunId }), FlowRunHistory.parse);
         return result;
     }
     /**
@@ -87,7 +88,7 @@ export class FlowRunEndpoint extends Endpoint {
      * reflects the eventually-consistent index projection which can lag the history.
      */
     async getFlowRunLifecycle(flowRunId) {
-        const result = await this.requestObject('/flowruns/' + flowRunId + '/lifecycle', null, FlowRunLifecycle.parse);
+        const result = await this.requestObject(path('/flowruns/:flowRunId/lifecycle', { flowRunId }), null, FlowRunLifecycle.parse);
         return result.getData();
     }
     async updateFlowRun(flowRunId, status, time = null) {
@@ -101,7 +102,7 @@ export class FlowRunEndpoint extends Endpoint {
         if (time !== null && time !== undefined) {
             params.time = time;
         }
-        const result = await this.requestObject('/flowruns/' + flowRunId + '', params, FlowRun.parse, 'POST');
+        const result = await this.requestObject(path('/flowruns/:flowRunId', { flowRunId }), params, FlowRun.parse, 'POST');
         const updatedFlowRun = result.getData();
         if (updatedFlowRun === null) {
             throw new Error('FlowRun not updated');

package/dist/Flow/Service/FlowRunRequestEndpoint.js

@@ -1,8 +1,9 @@
+import { path } from '../../Http/Data/Path.js';
 import { FlowRunResponse } from '../Model/FlowRunResponse.js';
 import { Endpoint } from '../../Service/Endpoint.js';
 export class FlowRunRequestEndpoint extends Endpoint {
     async requestFlowRun(flowId, params, wait = false) {
-        let url = '/flows/' + flowId + '/flowrunrequests';
+        let url = path('/flows/:flowId/flowrunrequests', { flowId });
         if (wait) {
             url += '?wait=true';
         }

package/dist/Flow/Service/FlowRunStatsEndpoint.js

@@ -1,8 +1,9 @@
+import { path } from '../../Http/Data/Path.js';
 import { FlowRunStats } from '../Model/FlowRunStats.js';
 import { Endpoint } from '../../Service/Endpoint.js';
 export class FlowRunStatsEndpoint extends Endpoint {
     async create(flowRunStats) {
-        const url = '/flowruns/' + flowRunStats.flowRunId + '/stats';
+        const url = path('/flowruns/:flowRunId/stats', { flowRunId: flowRunStats.flowRunId });
         try {
             const result = await this.requestObject(url, flowRunStats, FlowRunStats.parse, 'POST');
             const createdFlowRunStat = result.getData();

package/dist/Helper/LoadAllHelper.js

@@ -10,7 +10,13 @@ export class LoadAllHelper {
             firstPagination.startingAfter = lastRef;
             const data = await call(firstPagination);
             const records = data.getData();
-            // Spread is faster than a per-element loop but can exceed the call stack for very large collections (50k+)
+            // An empty page that still claims hasMore cannot be paged past: the cursor advances from
+            // the last record, so the next call would repeat this one forever. The server contradicted
+            // itself — say so rather than spin.
+            if (records.length === 0 && data.hasMore) {
+                throw new Error('loadAll stopped after ' + totalResult.length + ' records: the API reported more results but returned an empty page, so paging cannot continue.');
+            }
+            // Spread one page at a time (bounded by `limit`), so the argument count stays small.
             if (totalResult.length + records.length > 50_000) {
                 throw new Error('loadAll exceeded 50,000 records (' + (totalResult.length + records.length) + '). This method is not intended for large datasets.');
             }

package/dist/Http/Data/Path.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Build a request path from a template, encoding every value that goes into it.
+ *
+ *     path('/data-quality/datasets/:datasetId/scans', {datasetId})
+ *
+ * Ids are opaque strings supplied by the caller. Concatenating them straight into a URL means a
+ * value containing `/`, `?` or `#` silently changes which endpoint is called; an empty one produces
+ * a path that quietly addresses the collection instead of the item. Encoding here makes the request
+ * mean what it says, and an empty value an error rather than a surprise.
+ */
+export declare function path(template: string, parameters?: Record<string, string | number>): string;

package/dist/Http/Data/Path.js

@@ -0,0 +1,31 @@
+/**
+ * Build a request path from a template, encoding every value that goes into it.
+ *
+ *     path('/data-quality/datasets/:datasetId/scans', {datasetId})
+ *
+ * Ids are opaque strings supplied by the caller. Concatenating them straight into a URL means a
+ * value containing `/`, `?` or `#` silently changes which endpoint is called; an empty one produces
+ * a path that quietly addresses the collection instead of the item. Encoding here makes the request
+ * mean what it says, and an empty value an error rather than a surprise.
+ */
+export function path(template, parameters = {}) {
+    const used = new Set();
+    const built = template.replace(/:([A-Za-z][A-Za-z0-9_]*)/g, (_match, name) => {
+        if (!Object.prototype.hasOwnProperty.call(parameters, name)) {
+            throw new Error('Unable to build path "' + template + '": no value for ":' + name + '"');
+        }
+        used.add(name);
+        const value = String(parameters[name]);
+        if (value === '') {
+            throw new Error('Unable to build path "' + template + '": ":' + name + '" is empty');
+        }
+        return encodeURIComponent(value);
+    });
+    // A value with no matching placeholder is a typo that would otherwise vanish silently.
+    for (const name of Object.keys(parameters)) {
+        if (!used.has(name)) {
+            throw new Error('Unable to build path "' + template + '": no placeholder for "' + name + '"');
+        }
+    }
+    return built;
+}

package/dist/Http/HttpClient.d.ts

@@ -1,5 +1,12 @@
 import { HttpClientRequest } from './HttpClientRequest.js';
 import { HttpClientResponse } from './HttpClientResponse.js';
 export declare class HttpClient {
-    static request(request: HttpClientRequest): Promise<HttpClientResponse>;
+    /**
+     * Overall budget for one request, in milliseconds. Matches the Stripe SDKs (80s), which is
+     * generous enough for a large payload and bounded enough that an unresponsive API surfaces as an
+     * error instead of hanging the caller. `fetch` applies no timeout of its own in the browser, and
+     * only bounds response headers in Node.
+     */
+    static readonly DEFAULT_TIMEOUT_MS: number;
+    static request(request: HttpClientRequest, timeoutMs?: number): Promise<HttpClientResponse>;
 }

package/dist/Http/HttpClient.js

@@ -1,11 +1,21 @@
 import { HttpClientResponse } from './HttpClientResponse.js';
 import { ClientError } from './ClientError.js';
 export class HttpClient {
-    static async request(request) {
+    /**
+     * Overall budget for one request, in milliseconds. Matches the Stripe SDKs (80s), which is
+     * generous enough for a large payload and bounded enough that an unresponsive API surfaces as an
+     * error instead of hanging the caller. `fetch` applies no timeout of its own in the browser, and
+     * only bounds response headers in Node.
+     */
+    static DEFAULT_TIMEOUT_MS = 80_000;
+    static async request(request, timeoutMs = HttpClient.DEFAULT_TIMEOUT_MS) {
         const init = {
             method: request.method,
             headers: request.headers,
         };
+        if (timeoutMs > 0) {
+            init.signal = AbortSignal.timeout(timeoutMs);
+        }
         // Node's fetch (undici) throws TypeError when GET/HEAD carry a body. Axios used to silently drop it,
         // so callers may still set body on GET — skip it here instead of propagating a confusing network error.
         const method = request.method.toUpperCase();
@@ -48,6 +58,16 @@ export class HttpClient {
             if (error instanceof ClientError) {
                 throw error;
             }
+            // AbortSignal.timeout rejects with a TimeoutError DOMException, whose message ("The
+            // operation was aborted due to timeout") says nothing about what was being called. Name
+            // the url and the budget instead.
+            //
+            // Matched on `name` rather than `instanceof`: a DOMException raised in another realm — a
+            // test runner's VM context, an iframe — is not an instance of this realm's Error, so an
+            // instanceof check passes locally and quietly fails everywhere else.
+            if (typeof error === 'object' && error !== null && error.name === 'TimeoutError') {
+                throw new ClientError('Request to `' + request.getFullUrl() + '` timed out after ' + timeoutMs + 'ms');
+            }
             throw ClientError.fromError(error);
         }
     }

package/dist/Http/OAuthClientOptions.d.ts

@@ -7,5 +7,7 @@ export declare class OAuthClientOptions {
     redirectUri: string;
     scopes: string[];
     state: string;
+    /** Overall budget for one request, in milliseconds. Set 0 to disable (not recommended). */
+    timeoutMs: number;
     constructor(apiEndpoint: string, clientId?: string | null, clientSecret?: string | null);
 }

package/dist/Http/OAuthClientOptions.js

@@ -1,3 +1,4 @@
+import { HttpClient } from './HttpClient.js';
 export class OAuthClientOptions {
     apiEndpoint;
     clientId;
@@ -7,6 +8,8 @@ export class OAuthClientOptions {
     redirectUri = 'https://example.com/auth/github/callback';
     scopes = [];
     state = '';
+    /** Overall budget for one request, in milliseconds. Set 0 to disable (not recommended). */
+    timeoutMs = HttpClient.DEFAULT_TIMEOUT_MS;
     constructor(apiEndpoint, 
     // Mutable so client credentials can be updated in place (see OAuthClient.setClientCredentials)
     // without recreating the client and losing its token.

package/dist/Http/Transport/OAuthClient.d.ts

@@ -49,6 +49,13 @@ export declare class OAuthClient implements ITransport {
     setParseErrorHandler(handler: ParseErrorHandler | null): void;
     reportParseError(message: string, context: Record<string, unknown>): void;
     private defaultHeaders;
+    /**
+     * A copy, not the live object. Returning the internal map let callers mutate it by accident: a
+     * request assigned it and then set its own headers, so `Authorization` (and `Attlaz-API-Version`)
+     * were written into the shared defaults and sent on every later request — including the ones that
+     * deliberately pass `signWithOauthToken: false` (password reset, email confirmation, invite
+     * lookup, health). {@link addDefaultHeader} is the only way to add a real default.
+     */
     getDefaultHeaders(): Headers;
     private initDefaultHeaders;
     addDefaultHeader(header: string, value: string): void;

package/dist/Http/Transport/OAuthClient.js

@@ -156,11 +156,31 @@ export class OAuthClient {
      * server's HTTP status and, when the body is JSON, its structured error message.
      */
     async requestToken(params) {
-        const response = await fetch(this.getApiEndpointUrl(this.options.accessTokenUri), {
+        // The token endpoint bypasses HttpClient, so it does not inherit its timeout. Without one an
+        // unresponsive token endpoint hangs authenticate()/refreshToken() forever — and that is the
+        // one call every client makes before it can do anything else.
+        const timeoutMs = this.options.timeoutMs;
+        const init = {
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
             body: new URLSearchParams(params).toString(),
-        });
+        };
+        if (timeoutMs > 0) {
+            init.signal = AbortSignal.timeout(timeoutMs);
+        }
+        const tokenUrl = this.getApiEndpointUrl(this.options.accessTokenUri);
+        let response;
+        try {
+            response = await fetch(tokenUrl, init);
+        }
+        catch (error) {
+            // Matched on `name`, not instanceof: a DOMException from another realm (a test runner's VM
+            // context, an iframe) is not an instance of this realm's Error. Same reasoning as HttpClient.
+            if (typeof error === 'object' && error !== null && error.name === 'TimeoutError') {
+                throw new ClientError('Token request to `' + tokenUrl + '` timed out after ' + timeoutMs + 'ms');
+            }
+            throw ClientError.fromError(error);
+        }
         if (!response.ok) {
             const clientError = new ClientError(response.statusText || 'Token request failed', response.status);
             // The token endpoint bypasses HttpClient (and authenticate() bypasses Endpoint.toApiError),
@@ -208,7 +228,7 @@ export class OAuthClient {
             console.debug('[OAuthClient] Request: ' + requestData.method.toUpperCase() + ' ' + requestData.getFullUrl(), { headers: requestData.headers });
         }
         try {
-            const response = await HttpClient.request(requestData);
+            const response = await HttpClient.request(requestData, this.options.timeoutMs);
             return response.body;
         }
         catch (error) {
@@ -258,8 +278,15 @@ export class OAuthClient {
         console.error(message, context);
     }
     defaultHeaders = {};
+    /**
+     * A copy, not the live object. Returning the internal map let callers mutate it by accident: a
+     * request assigned it and then set its own headers, so `Authorization` (and `Attlaz-API-Version`)
+     * were written into the shared defaults and sent on every later request — including the ones that
+     * deliberately pass `signWithOauthToken: false` (password reset, email confirmation, invite
+     * lookup, health). {@link addDefaultHeader} is the only way to add a real default.
+     */
     getDefaultHeaders() {
-        return this.defaultHeaders;
+        return { ...this.defaultHeaders };
     }
     initDefaultHeaders() {
         const userAgentInfo = {

package/dist/Logging/Service/LogEndpoint.d.ts

@@ -11,7 +11,11 @@ export declare class LogEndpoint extends Endpoint {
     getLogs(logQuery: LogQuery): Promise<CollectionResult<Log>>;
     getCursoredLogEntries(logStreamId: LogStreamId, pagination: CursorPagination | null, filter: FilterNode | null): Promise<CollectionResult<Log>>;
     save(log: Log): Promise<Log>;
-    delete(logId: string): Promise<boolean>;
+    /**
+     * The stream id was missing here: the path was built with the literal text `:streamId`, so every
+     * call requested `/logstreams/:streamId/logs/<id>` and could never have matched the route.
+     */
+    delete(logStreamId: string, logId: string): Promise<boolean>;
     clear(logStreamId: LogStreamId): Promise<boolean>;
     getInformation(logStreamId: LogStreamId): Promise<LogStreamInformation | null>;
     getByProject(projectId: string, pagination?: CursorPagination | null): Promise<CollectionResult<LogStream>>;