@bodhiapp/bodhi-js 0.0.15 → 0.0.17

package/dist/bodhi-js-sdk/web/src/constants.d.ts

@@ -3,3 +3,9 @@
  */
 export declare const POLL_INTERVAL = 500;
 export declare const POLL_TIMEOUT = 5000;
+/**
+ * Default API request timeout in milliseconds
+ * Used for API requests through window.bodhiext
+ * Default: 30 seconds
+ */
+export declare const DEFAULT_API_TIMEOUT_MS = 30000;

package/dist/bodhi-js-sdk/web/src/direct-client.d.ts

@@ -1,4 +1,4 @@
-import { DirectClientBase, AuthState, LogLevel, StateChangeCallback } from '../../core/src/index.ts';
+import { DirectClientBase, AuthState, LoginOptions, LogLevel, StateChangeCallback } from '../../core/src/index.ts';
 /**
  * Configuration for DirectWebClient
  */
@@ -9,6 +9,7 @@ export interface DirectWebClientConfig {
     basePath: string;
     logLevel: LogLevel;
     redirectUri: string;
+    apiTimeoutMs?: number;
 }
 /**
  * DirectWebClient - Web mode implementation using browser redirect OAuth
@@ -16,7 +17,7 @@ export interface DirectWebClientConfig {
 export declare class DirectWebClient extends DirectClientBase {
     private redirectUri;
     constructor(config: DirectWebClientConfig, onStateChange?: StateChangeCallback);
-    login(): Promise<AuthState>;
+    login(options?: LoginOptions): Promise<AuthState>;
     handleOAuthCallback(code: string, state: string): Promise<AuthState>;
     logout(): Promise<AuthState>;
     protected exchangeCodeForTokens(code: string): Promise<void>;

package/dist/bodhi-js-sdk/web/src/ext-client.d.ts

@@ -1,4 +1,4 @@
-import { Chat, Models, Embeddings, ApiResponseResult, AuthState, BackendServerState, ClientState, ExtensionState, IExtensionClient, InitParams, LogLevel, StateChangeCallback } from '../../core/src/index.ts';
+import { Chat, Models, Embeddings, ApiResponseResult, AuthState, BackendServerState, ClientState, ExtensionState, IExtensionClient, InitParams, LoginOptions, LogLevel, StateChangeCallback } from '../../core/src/index.ts';
 export type SerializedWebExtensionState = {
     extensionId?: string;
 };
@@ -12,6 +12,7 @@ export interface WindowBodhiextClientConfig {
     userScope: string;
     basePath: string;
     logLevel: LogLevel;
+    apiTimeoutMs?: number;
     initParams?: {
         extension?: {
             timeoutMs?: number;
@@ -38,6 +39,7 @@ export declare class WindowBodhiextClient implements IExtensionClient {
     private onStateChange;
     private refreshPromise;
     private storageKeys;
+    private apiTimeoutMs;
     private _chat;
     private _models;
     private _embeddings;
@@ -89,9 +91,10 @@ export declare class WindowBodhiextClient implements IExtensionClient {
     private requestResourceAccess;
     /**
      * Login via browser redirect OAuth2 + PKCE flow
+     * @param options - Optional login options (toolsetScopeIds, version)
      * @returns AuthState (though in practice, this redirects and never returns)
      */
-    login(): Promise<AuthState>;
+    login(options?: LoginOptions): Promise<AuthState>;
     /**
      * Handle OAuth callback with authorization code
      * Should be called from callback page with extracted URL params

package/dist/bodhi-js-sdk/web/src/facade-client.d.ts

@@ -11,6 +11,7 @@ export interface WebClientConfig {
     userScope: string;
     basePath: string;
     logLevel: LogLevel;
+    apiTimeoutMs?: number;
     initParams?: {
         extension?: {
             timeoutMs?: number;
@@ -28,6 +29,7 @@ export interface WebUIClientParams {
     userScope?: UserScope;
     basePath?: string;
     logLevel?: LogLevel;
+    apiTimeoutMs?: number;
     initParams?: {
         extension?: {
             timeoutMs?: number;

package/dist/bodhi-web.cjs.js

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const r=require("@bodhiapp/bodhi-js-core");class d extends r.DirectClientBase{constructor(e,t){const o=r.createStoragePrefixWithBasePath(e.basePath,r.STORAGE_PREFIXES.WEB_DIRECT),s={authClientId:e.authClientId,authServerUrl:e.authServerUrl,userScope:e.userScope,storagePrefix:o,logLevel:e.logLevel,loggerPrefix:"DirectWebClient"};super(s,t),this.redirectUri=e.redirectUri}async login(){const e=await this.getAuthState();if(e.status==="authenticated")return e;const t=await this.requestResourceAccess();if(r.isApiResultOperationError(t))throw r.createOperationError(t.error.message,t.error.type);if(r.isApiResultError(t)){const{message:n}=t.body.error;throw r.createOperationError(n,"auth_error")}if(!r.isApiResultSuccess(t))throw r.createOperationError(`Unexpected HTTP ${t.status}`,"auth_error");const o=t.body.scope;localStorage.setItem(this.storageKeys.RESOURCE_SCOPE,o);const s=`openid profile email roles ${this.userScope} ${o}`,i=r.generateCodeVerifier(),a=await r.generateCodeChallenge(i),h=r.generateCodeVerifier();localStorage.setItem(this.storageKeys.CODE_VERIFIER,i),localStorage.setItem(this.storageKeys.STATE,h);const c=new URL(this.authEndpoints.authorize);throw c.searchParams.set("client_id",this.authClientId),c.searchParams.set("response_type","code"),c.searchParams.set("redirect_uri",this.redirectUri),c.searchParams.set("scope",s),c.searchParams.set("code_challenge",a),c.searchParams.set("code_challenge_method","S256"),c.searchParams.set("state",h),window.location.href=c.toString(),new Error("Redirect initiated")}async handleOAuthCallback(e,t){const o=localStorage.getItem(this.storageKeys.STATE);if(!o||o!==t)throw new Error("Invalid state parameter - possible CSRF attack");await this.exchangeCodeForTokens(e),localStorage.removeItem(this.storageKeys.CODE_VERIFIER),localStorage.removeItem(this.storageKeys.STATE);const s=await this.getAuthState();if(s.status!=="authenticated")throw new Error("Login failed");return this.setAuthState(s),s}async logout(){const e=localStorage.getItem(this.storageKeys.REFRESH_TOKEN);if(e)try{const o=new URLSearchParams({token:e,client_id:this.authClientId,token_type_hint:"refresh_token"});await fetch(this.authEndpoints.revoke,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:o})}catch(o){this.logger.warn("Token revocation failed:",o)}localStorage.removeItem(this.storageKeys.ACCESS_TOKEN),localStorage.removeItem(this.storageKeys.REFRESH_TOKEN),localStorage.removeItem(this.storageKeys.EXPIRES_AT),localStorage.removeItem(this.storageKeys.RESOURCE_SCOPE);const t={status:"unauthenticated",user:null,accessToken:null,error:null};return this.setAuthState(t),t}async exchangeCodeForTokens(e){const t=localStorage.getItem(this.storageKeys.CODE_VERIFIER);if(!t)throw new Error("Code verifier not found");const o=await fetch(this.authEndpoints.token,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:e,redirect_uri:this.redirectUri,client_id:this.authClientId,code_verifier:t})});if(!o.ok){const i=await o.text();throw new Error(`Token exchange failed: ${o.status} ${i}`)}const s=await o.json();if(localStorage.setItem(this.storageKeys.ACCESS_TOKEN,s.access_token),s.refresh_token&&localStorage.setItem(this.storageKeys.REFRESH_TOKEN,s.refresh_token),s.expires_in){const i=Date.now()+s.expires_in*1e3;localStorage.setItem(this.storageKeys.EXPIRES_AT,i.toString())}}async _storageGet(e){return localStorage.getItem(e)}async _storageSet(e){Object.entries(e).forEach(([t,o])=>{localStorage.setItem(t,String(o))})}async _storageRemove(e){e.forEach(t=>localStorage.removeItem(t))}_getRedirectUri(){return this.redirectUri}}const g=500,S=5e3;class E{constructor(e,t,o){this.state=r.EXTENSION_STATE_NOT_INITIALIZED,this.bodhiext=null,this.refreshPromise=null,this.logger=new r.Logger("WindowBodhiextClient",t.logLevel),this.authClientId=e,this.config=t,this.authEndpoints=r.createOAuthEndpoints(this.config.authServerUrl),this.onStateChange=o??r.NOOP_STATE_CALLBACK;const s=r.createStoragePrefixWithBasePath(t.basePath,r.STORAGE_PREFIXES.WEB_EXT);this.storageKeys=r.createStorageKeys(s)}setState(e){this.state=e,this.logger.info(`{state: ${JSON.stringify(e)}} - Setting client state`),this.onStateChange({type:"client-state",state:e})}setAuthState(e){this.onStateChange({type:"auth-state",state:e})}setStateCallback(e){this.onStateChange=e}ensureBodhiext(){if(!this.bodhiext&&window.bodhiext&&(this.logger.info("Acquiring window.bodhiext reference"),this.bodhiext=window.bodhiext),!this.bodhiext)throw r.createOperationError("Client not initialized","extension_error")}async sendExtRequest(e,t){return this.ensureBodhiext(),this.bodhiext.sendExtRequest(e,t)}async sendApiRequest(e,t,o,s,i){try{this.ensureBodhiext()}catch(a){return{error:{message:a instanceof Error?a.message:String(a),type:"extension_error"}}}try{let a=s||{};if(i){const c=await this._getAccessTokenRaw();if(!c)return{error:{message:"Not authenticated. Please log in first.",type:"extension_error"}};a={...a,Authorization:`Bearer ${c}`}}return await this.bodhiext.sendApiRequest(e,t,o,a)}catch(a){const h=a?.error,c=h?.message??(a instanceof Error?a.message:String(a)),n=h?.type||"extension_error";return{error:{message:c,type:n}}}}getState(){return this.state}isClientInitialized(){return this.state.extension==="ready"}isServerReady(){return this.isClientInitialized()&&this.state.server.status==="ready"}async init(e={}){if(!e.testConnection&&!e.selectedConnection)return this.logger.info("No testConnection or selectedConnection, returning not-initialized state"),r.EXTENSION_STATE_NOT_INITIALIZED;if(this.bodhiext&&!e.testConnection)return this.logger.debug("Already have bodhiext handle, skipping polling"),this.state;if(!this.bodhiext){const s=e.timeoutMs??this.config.initParams?.extension?.timeoutMs??S,i=e.intervalMs??this.config.initParams?.extension?.intervalMs??g,a=Date.now();if(!await new Promise(c=>{const n=()=>{if(window.bodhiext){this.bodhiext=window.bodhiext,c(!0);return}if(Date.now()-a>=s){c(!1);return}setTimeout(n,i)};n()}))return this.logger.warn("Extension discovery timed out"),this.setState(r.EXTENSION_STATE_NOT_FOUND),this.state}const t=await this.bodhiext.getExtensionId();this.logger.info(`Extension discovered: ${t}`);const o={type:"extension",extension:"ready",extensionId:t,server:r.PENDING_EXTENSION_READY};if(e.testConnection)try{const s=await this.getServerState();this.setState({...o,server:s}),this.logger.info(`Server connectivity tested: ${s.status}`)}catch(s){this.logger.error("Failed to get server state:",s),this.setState({...o,server:r.BACKEND_SERVER_NOT_REACHABLE})}else this.setState(o);return this.state}async requestResourceAccess(){return this.ensureBodhiext(),this.bodhiext.sendApiRequest("POST","/bodhi/v1/apps/request-access",{app_client_id:this.authClientId})}async login(){const e=await this.getAuthState();if(e.status==="authenticated")return e;this.ensureBodhiext();const t=await this.requestResourceAccess();if(r.isApiResultOperationError(t))throw r.createOperationError(t.error.message,t.error.type);if(r.isApiResultError(t)){const{message:l}=t.body.error;throw r.createOperationError(l,"auth_error")}if(!r.isApiResultSuccess(t))throw r.createOperationError(`Unexpected HTTP ${t.status}`,"auth_error");const o=t.body.scope;localStorage.setItem(this.storageKeys.RESOURCE_SCOPE,o);const s=r.generateCodeVerifier(),i=await r.generateCodeChallenge(s),a=r.generateCodeVerifier();localStorage.setItem(this.storageKeys.CODE_VERIFIER,s),localStorage.setItem(this.storageKeys.STATE,a);const h=["openid","profile","email","roles",this.config.userScope,o],c=new URLSearchParams({response_type:"code",client_id:this.authClientId,redirect_uri:this.config.redirectUri,scope:h.join(" "),state:a,code_challenge:i,code_challenge_method:"S256"}),n=`${this.authEndpoints.authorize}?${c}`;return window.location.href=n,new Promise(()=>{})}async handleOAuthCallback(e,t){const o=localStorage.getItem(this.storageKeys.STATE);if(!o||o!==t)throw new Error("Invalid state parameter - possible CSRF attack");await this.exchangeCodeForTokens(e),localStorage.removeItem(this.storageKeys.CODE_VERIFIER),localStorage.removeItem(this.storageKeys.STATE);const s=await this.getAuthState();if(s.status!=="authenticated")throw new Error("Login failed");return this.setAuthState(s),s}async exchangeCodeForTokens(e){const t=localStorage.getItem(this.storageKeys.CODE_VERIFIER);if(!t)throw new Error("Code verifier not found");const o=new URLSearchParams({grant_type:"authorization_code",client_id:this.authClientId,code:e,redirect_uri:this.config.redirectUri,code_verifier:t}),s=await fetch(this.authEndpoints.token,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:o});if(!s.ok){const a=await s.text();throw new Error(`Token exchange failed: ${s.status} ${a}`)}const i=await s.json();if(!i.access_token)throw new Error("No access token received");if(localStorage.setItem(this.storageKeys.ACCESS_TOKEN,i.access_token),i.refresh_token&&localStorage.setItem(this.storageKeys.REFRESH_TOKEN,i.refresh_token),i.expires_in){const a=Date.now()+i.expires_in*1e3;localStorage.setItem(this.storageKeys.EXPIRES_AT,a.toString())}}async logout(){const e=localStorage.getItem(this.storageKeys.REFRESH_TOKEN);if(e)try{const o=new URLSearchParams({token:e,client_id:this.authClientId,token_type_hint:"refresh_token"});await fetch(this.authEndpoints.revoke,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:o})}catch(o){this.logger.warn("Token revocation failed:",o)}localStorage.removeItem(this.storageKeys.ACCESS_TOKEN),localStorage.removeItem(this.storageKeys.REFRESH_TOKEN),localStorage.removeItem(this.storageKeys.EXPIRES_AT),localStorage.removeItem(this.storageKeys.CODE_VERIFIER),localStorage.removeItem(this.storageKeys.STATE),localStorage.removeItem(this.storageKeys.RESOURCE_SCOPE);const t={status:"unauthenticated",user:null,accessToken:null,error:null};return this.setAuthState(t),t}async getAuthState(){const e=await this._getAccessTokenRaw();if(!e)return{status:"unauthenticated",user:null,accessToken:null,error:null};try{return{status:"authenticated",user:r.extractUserInfo(e),accessToken:e,error:null}}catch(t){return this.logger.error("Failed to parse token:",t),{status:"unauthenticated",user:null,accessToken:null,error:null}}}async _getAccessTokenRaw(){const e=localStorage.getItem(this.storageKeys.ACCESS_TOKEN),t=localStorage.getItem(this.storageKeys.EXPIRES_AT);if(!e)return null;if(t){const o=parseInt(t,10);if(Date.now()>=o-5*1e3){const s=localStorage.getItem(this.storageKeys.REFRESH_TOKEN);return s?this._tryRefreshToken(s):null}}return e}async _tryRefreshToken(e){if(this.refreshPromise)return this.logger.debug("Refresh already in progress, returning existing promise"),this.refreshPromise;this.refreshPromise=this._doRefreshToken(e);try{return await this.refreshPromise}finally{this.refreshPromise=null}}async _doRefreshToken(e){this.logger.debug("Refreshing access token");try{const t=await r.refreshAccessToken(this.authEndpoints.token,e,this.authClientId);if(t.success){this._storeRefreshedTokens(t.tokens);const o=r.extractUserInfo(t.tokens.access_token);return this.setAuthState({status:"authenticated",user:o,accessToken:t.tokens.access_token,error:null}),this.logger.info("Token refreshed successfully"),t.tokens.access_token}if(t.error==="invalid_grant")return this.logger.warn("Refresh token expired or revoked, clearing tokens and logging out"),this.clearAuthStorage(),this.setAuthState({status:"unauthenticated",user:null,accessToken:null,error:null}),null}catch(t){this.logger.warn("Token refresh failed:",t)}throw this.logger.warn("Token refresh failed, keeping tokens for manual retry"),r.createOperationError("Access token expired and unable to refresh. Try logging out and logging in again.","token_refresh_failed")}clearAuthStorage(){localStorage.removeItem(this.storageKeys.ACCESS_TOKEN),localStorage.removeItem(this.storageKeys.REFRESH_TOKEN),localStorage.removeItem(this.storageKeys.EXPIRES_AT),localStorage.removeItem(this.storageKeys.RESOURCE_SCOPE)}_storeRefreshedTokens(e){const t=Date.now()+e.expires_in*1e3;localStorage.setItem(this.storageKeys.ACCESS_TOKEN,e.access_token),localStorage.setItem(this.storageKeys.EXPIRES_AT,String(t)),e.refresh_token&&localStorage.setItem(this.storageKeys.REFRESH_TOKEN,e.refresh_token)}async pingApi(){return this.sendApiRequest("GET","/ping")}async getServerState(){const e=await this.sendApiRequest("GET","/bodhi/v1/info");if(r.isApiResultOperationError(e)||!r.isApiResultSuccess(e))return r.BACKEND_SERVER_NOT_REACHABLE;const t=e.body;switch(t.status){case"ready":return{status:"ready",version:t.version||"unknown",error:null};case"setup":return r.backendServerNotReady("setup",t.version||"unknown");case"resource-admin":return r.backendServerNotReady("resource-admin",t.version||"unknown");case"error":return r.backendServerNotReady("error",t.version||"unknown",t.error?{message:t.error.message,type:t.error.type}:r.SERVER_ERROR_CODES.SERVER_NOT_READY);default:return r.BACKEND_SERVER_NOT_REACHABLE}}async*stream(e,t,o,s,i=!0){this.ensureBodhiext();let a=s||{};if(i){const n=await this._getAccessTokenRaw();if(!n)throw r.createOperationError("Not authenticated. Please log in first.","auth_error");a={...a,Authorization:`Bearer ${n}`}}const c=this.bodhiext.sendStreamRequest(e,t,o,a).getReader();try{for(;;){const{value:n,done:l}=await c.read();if(l||n?.done)break;yield n.body}}catch(n){if(n instanceof Error){if("response"in n){const l=n;throw r.createApiError(n.message,l.response.status,l.response.body)}throw"error"in n,r.createOperationError(n.message,"extension_error")}throw n}finally{c.releaseLock()}}get chat(){return this._chat??=new r.Chat(this)}get models(){return this._models??=new r.Models(this)}get embeddings(){return this._embeddings??=new r.Embeddings(this)}serialize(){return{extensionId:this.state.type==="extension"&&this.state.extension==="ready"?this.state.extensionId:void 0}}async debug(){return{type:"WindowBodhiextClient",state:this.state,authState:await this.getAuthState(),bodhiextAvailable:this.bodhiext!==null,authClientId:this.authClientId,authServerUrl:this.config.authServerUrl,redirectUri:this.config.redirectUri,userScope:this.config.userScope}}}function f(u){if(typeof window>"u")throw new Error("redirectUri required in non-browser environment");const e=u==="/"?"":u.replace(/\/$/,"");return`${window.location.origin}${e}/callback`}class _ extends r.BaseFacadeClient{constructor(e,t,o){const s=t||{},i={basePath:s.basePath||"/",redirectUri:s.redirectUri||f(s.basePath||"/"),authServerUrl:s.authServerUrl||"https://id.getbodhi.app/realms/bodhi",userScope:s.userScope||"scope_user_user",logLevel:s.logLevel||"warn",initParams:s.initParams};super(e,i,o)}createLogger(e){return new r.Logger("WebUIClient",e.logLevel)}createStoragePrefix(e){return r.createStoragePrefixWithBasePath(e.basePath,r.STORAGE_PREFIXES.WEB)}createExtClient(e,t){return new E(this.authClientId,{authServerUrl:e.authServerUrl,redirectUri:e.redirectUri,userScope:e.userScope,basePath:e.basePath,logLevel:e.logLevel,initParams:e.initParams},t)}createDirectClient(e,t,o){return new d({authClientId:e,authServerUrl:t.authServerUrl,redirectUri:t.redirectUri,userScope:t.userScope,logLevel:t.logLevel,basePath:t.basePath},o)}async handleOAuthCallback(e,t){return this.connectionMode==="direct"?this.directClient.handleOAuthCallback(e,t):this.extClient.handleOAuthCallback(e,t)}}const p="production";exports.WEB_BUILD_MODE=p;exports.WebUIClient=_;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const s=require("@bodhiapp/bodhi-js-core");class p extends s.DirectClientBase{constructor(e,t){const r=s.createStoragePrefixWithBasePath(e.basePath,s.STORAGE_PREFIXES.WEB_DIRECT),o={authClientId:e.authClientId,authServerUrl:e.authServerUrl,userScope:e.userScope,storagePrefix:r,logLevel:e.logLevel,loggerPrefix:"DirectWebClient",apiTimeoutMs:e.apiTimeoutMs};super(o,t),this.redirectUri=e.redirectUri}async login(e){const t=await this.getAuthState();if(t.status==="authenticated")return t;const r=await this.requestResourceAccess(e?.toolsetScopeIds,e?.version);if(s.isApiResultOperationError(r))throw s.createOperationError(r.error.message,r.error.type);if(s.isApiResultError(r)){const{message:S}=r.body.error;throw s.createOperationError(S,"auth_error")}if(!s.isApiResultSuccess(r))throw s.createOperationError(`Unexpected HTTP ${r.status}`,"auth_error");const o=r.body.scope;localStorage.setItem(this.storageKeys.RESOURCE_SCOPE,o);const n=r.body.toolsets||[],a=s.getMissingToolsetScopeIds(e?.toolsetScopeIds,n);if(a.length>0)throw s.createOperationError(`toolsetScopeIds not received back from request-access call: [${a.join(", ")}], check developer console on configuring the toolset scopes correctly`,"auth_error");const h=s.getRequestedToolsetScopes(e?.toolsetScopeIds,n),c=`openid profile email roles ${this.userScope} ${o} ${h}`.trim(),i=s.generateCodeVerifier(),u=await s.generateCodeChallenge(i),g=s.generateCodeVerifier();localStorage.setItem(this.storageKeys.CODE_VERIFIER,i),localStorage.setItem(this.storageKeys.STATE,g);const l=new URL(this.authEndpoints.authorize);throw l.searchParams.set("client_id",this.authClientId),l.searchParams.set("response_type","code"),l.searchParams.set("redirect_uri",this.redirectUri),l.searchParams.set("scope",c),l.searchParams.set("code_challenge",u),l.searchParams.set("code_challenge_method","S256"),l.searchParams.set("state",g),window.location.href=l.toString(),new Error("Redirect initiated")}async handleOAuthCallback(e,t){const r=localStorage.getItem(this.storageKeys.STATE);if(!r||r!==t)throw new Error("Invalid state parameter - possible CSRF attack");await this.exchangeCodeForTokens(e),localStorage.removeItem(this.storageKeys.CODE_VERIFIER),localStorage.removeItem(this.storageKeys.STATE);const o=await this.getAuthState();if(o.status!=="authenticated")throw new Error("Login failed");return this.setAuthState(o),o}async logout(){const e=localStorage.getItem(this.storageKeys.REFRESH_TOKEN);if(e)try{const r=new URLSearchParams({token:e,client_id:this.authClientId,token_type_hint:"refresh_token"});await fetch(this.authEndpoints.revoke,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:r})}catch(r){this.logger.warn("Token revocation failed:",r)}localStorage.removeItem(this.storageKeys.ACCESS_TOKEN),localStorage.removeItem(this.storageKeys.REFRESH_TOKEN),localStorage.removeItem(this.storageKeys.EXPIRES_AT),localStorage.removeItem(this.storageKeys.RESOURCE_SCOPE);const t={status:"unauthenticated",user:null,accessToken:null,error:null};return this.setAuthState(t),t}async exchangeCodeForTokens(e){const t=localStorage.getItem(this.storageKeys.CODE_VERIFIER);if(!t)throw new Error("Code verifier not found");const r=await fetch(this.authEndpoints.token,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:e,redirect_uri:this.redirectUri,client_id:this.authClientId,code_verifier:t})});if(!r.ok){const n=await r.text();throw new Error(`Token exchange failed: ${r.status} ${n}`)}const o=await r.json();if(localStorage.setItem(this.storageKeys.ACCESS_TOKEN,o.access_token),o.refresh_token&&localStorage.setItem(this.storageKeys.REFRESH_TOKEN,o.refresh_token),o.expires_in){const n=Date.now()+o.expires_in*1e3;localStorage.setItem(this.storageKeys.EXPIRES_AT,n.toString())}}async _storageGet(e){return localStorage.getItem(e)}async _storageSet(e){Object.entries(e).forEach(([t,r])=>{localStorage.setItem(t,String(r))})}async _storageRemove(e){e.forEach(t=>localStorage.removeItem(t))}_getRedirectUri(){return this.redirectUri}}const m=500,_=5e3,f=3e4;class y{constructor(e,t,r){this.state=s.EXTENSION_STATE_NOT_INITIALIZED,this.bodhiext=null,this.refreshPromise=null,this.logger=new s.Logger("WindowBodhiextClient",t.logLevel),this.authClientId=e,this.config=t,this.authEndpoints=s.createOAuthEndpoints(this.config.authServerUrl),this.onStateChange=r??s.NOOP_STATE_CALLBACK;const o=s.createStoragePrefixWithBasePath(t.basePath,s.STORAGE_PREFIXES.WEB_EXT);this.storageKeys=s.createStorageKeys(o),this.apiTimeoutMs=t.apiTimeoutMs??f}setState(e){this.state=e,this.logger.info(`{state: ${JSON.stringify(e)}} - Setting client state`),this.onStateChange({type:"client-state",state:e})}setAuthState(e){this.onStateChange({type:"auth-state",state:e})}setStateCallback(e){this.onStateChange=e}ensureBodhiext(){if(!this.bodhiext&&window.bodhiext&&(this.logger.info("Acquiring window.bodhiext reference"),this.bodhiext=window.bodhiext),!this.bodhiext)throw s.createOperationError("Client not initialized","extension_error")}async sendExtRequest(e,t){return this.ensureBodhiext(),this.bodhiext.sendExtRequest(e,t)}async sendApiRequest(e,t,r,o,n){try{this.ensureBodhiext()}catch(a){return{error:{message:a instanceof Error?a.message:String(a),type:"extension_error"}}}try{const a=new Promise((c,i)=>setTimeout(()=>i(new Error(`[bodhi-js-sdk/web] network timeout: api request not completed within configured/default timeout of ${this.apiTimeoutMs}ms`)),this.apiTimeoutMs)),h=(async()=>{let c=o||{};if(n){const i=await this._getAccessTokenRaw();if(!i)return{error:{message:"Not authenticated. Please log in first.",type:"extension_error"}};c={...c,Authorization:`Bearer ${i}`}}return this.bodhiext.sendApiRequest(e,t,r,c)})();return await Promise.race([h,a])}catch(a){const h=a?.error,c=h?.message??(a instanceof Error?a.message:String(a)),i=h?.type||"network_error";return{error:{message:c,type:i}}}}getState(){return this.state}isClientInitialized(){return this.state.extension==="ready"}isServerReady(){return this.isClientInitialized()&&this.state.server.status==="ready"}async init(e={}){if(!e.testConnection&&!e.selectedConnection)return this.logger.info("No testConnection or selectedConnection, returning not-initialized state"),s.EXTENSION_STATE_NOT_INITIALIZED;if(this.bodhiext&&!e.testConnection)return this.logger.debug("Already have bodhiext handle, skipping polling"),this.state;if(!this.bodhiext){const o=e.timeoutMs??this.config.initParams?.extension?.timeoutMs??_,n=e.intervalMs??this.config.initParams?.extension?.intervalMs??m,a=Date.now();if(!await new Promise(c=>{const i=()=>{if(window.bodhiext){this.bodhiext=window.bodhiext,c(!0);return}if(Date.now()-a>=o){c(!1);return}setTimeout(i,n)};i()}))return this.logger.warn("Extension discovery timed out"),this.setState(s.EXTENSION_STATE_NOT_FOUND),this.state}const t=await this.bodhiext.getExtensionId();this.logger.info(`Extension discovered: ${t}`);const r={type:"extension",extension:"ready",extensionId:t,server:s.PENDING_EXTENSION_READY};if(e.testConnection)try{const o=await this.getServerState();this.setState({...r,server:o}),this.logger.info(`Server connectivity tested: ${o.status}`)}catch(o){this.logger.error("Failed to get server state:",o),this.setState({...r,server:s.BACKEND_SERVER_NOT_REACHABLE})}else this.setState(r);return this.state}async requestResourceAccess(e,t){this.ensureBodhiext();const r={app_client_id:this.authClientId,...e&&{toolset_scope_ids:e},...t&&{version:t}};return this.bodhiext.sendApiRequest("POST","/bodhi/v1/apps/request-access",r)}async login(e){const t=await this.getAuthState();if(t.status==="authenticated")return t;this.ensureBodhiext();const r=await this.requestResourceAccess(e?.toolsetScopeIds,e?.version);if(s.isApiResultOperationError(r))throw s.createOperationError(r.error.message,r.error.type);if(s.isApiResultError(r)){const{message:E}=r.body.error;throw s.createOperationError(E,"auth_error")}if(!s.isApiResultSuccess(r))throw s.createOperationError(`Unexpected HTTP ${r.status}`,"auth_error");const o=r.body.scope;localStorage.setItem(this.storageKeys.RESOURCE_SCOPE,o);const n=r.body.toolsets||[],a=s.getMissingToolsetScopeIds(e?.toolsetScopeIds,n);if(a.length>0)throw s.createOperationError(`toolsetScopeIds not received back from request-access call: [${a.join(", ")}], check developer console on configuring the toolset scopes correctly`,"auth_error");const h=s.getRequestedToolsetScopes(e?.toolsetScopeIds,n),c=s.generateCodeVerifier(),i=await s.generateCodeChallenge(c),u=s.generateCodeVerifier();localStorage.setItem(this.storageKeys.CODE_VERIFIER,c),localStorage.setItem(this.storageKeys.STATE,u);const g=["openid","profile","email","roles",this.config.userScope,o,...h?h.split(" "):[]],l=new URLSearchParams({response_type:"code",client_id:this.authClientId,redirect_uri:this.config.redirectUri,scope:g.join(" "),state:u,code_challenge:i,code_challenge_method:"S256"}),S=`${this.authEndpoints.authorize}?${l}`;return window.location.href=S,new Promise(()=>{})}async handleOAuthCallback(e,t){const r=localStorage.getItem(this.storageKeys.STATE);if(!r||r!==t)throw new Error("Invalid state parameter - possible CSRF attack");await this.exchangeCodeForTokens(e),localStorage.removeItem(this.storageKeys.CODE_VERIFIER),localStorage.removeItem(this.storageKeys.STATE);const o=await this.getAuthState();if(o.status!=="authenticated")throw new Error("Login failed");return this.setAuthState(o),o}async exchangeCodeForTokens(e){const t=localStorage.getItem(this.storageKeys.CODE_VERIFIER);if(!t)throw new Error("Code verifier not found");const r=new URLSearchParams({grant_type:"authorization_code",client_id:this.authClientId,code:e,redirect_uri:this.config.redirectUri,code_verifier:t}),o=await fetch(this.authEndpoints.token,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:r});if(!o.ok){const a=await o.text();throw new Error(`Token exchange failed: ${o.status} ${a}`)}const n=await o.json();if(!n.access_token)throw new Error("No access token received");if(localStorage.setItem(this.storageKeys.ACCESS_TOKEN,n.access_token),n.refresh_token&&localStorage.setItem(this.storageKeys.REFRESH_TOKEN,n.refresh_token),n.expires_in){const a=Date.now()+n.expires_in*1e3;localStorage.setItem(this.storageKeys.EXPIRES_AT,a.toString())}}async logout(){const e=localStorage.getItem(this.storageKeys.REFRESH_TOKEN);if(e)try{const r=new URLSearchParams({token:e,client_id:this.authClientId,token_type_hint:"refresh_token"});await fetch(this.authEndpoints.revoke,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:r})}catch(r){this.logger.warn("Token revocation failed:",r)}localStorage.removeItem(this.storageKeys.ACCESS_TOKEN),localStorage.removeItem(this.storageKeys.REFRESH_TOKEN),localStorage.removeItem(this.storageKeys.EXPIRES_AT),localStorage.removeItem(this.storageKeys.CODE_VERIFIER),localStorage.removeItem(this.storageKeys.STATE),localStorage.removeItem(this.storageKeys.RESOURCE_SCOPE);const t={status:"unauthenticated",user:null,accessToken:null,error:null};return this.setAuthState(t),t}async getAuthState(){const e=await this._getAccessTokenRaw();if(!e)return{status:"unauthenticated",user:null,accessToken:null,error:null};try{return{status:"authenticated",user:s.extractUserInfo(e),accessToken:e,error:null}}catch(t){return this.logger.error("Failed to parse token:",t),{status:"unauthenticated",user:null,accessToken:null,error:null}}}async _getAccessTokenRaw(){const e=localStorage.getItem(this.storageKeys.ACCESS_TOKEN),t=localStorage.getItem(this.storageKeys.EXPIRES_AT);if(!e)return null;if(t){const r=parseInt(t,10);if(Date.now()>=r-5*1e3){const o=localStorage.getItem(this.storageKeys.REFRESH_TOKEN);return o?this._tryRefreshToken(o):null}}return e}async _tryRefreshToken(e){if(this.refreshPromise)return this.logger.debug("Refresh already in progress, returning existing promise"),this.refreshPromise;this.refreshPromise=this._doRefreshToken(e);try{return await this.refreshPromise}finally{this.refreshPromise=null}}async _doRefreshToken(e){this.logger.debug("Refreshing access token");try{const t=await s.refreshAccessToken(this.authEndpoints.token,e,this.authClientId);if(t.success){this._storeRefreshedTokens(t.tokens);const r=s.extractUserInfo(t.tokens.access_token);return this.setAuthState({status:"authenticated",user:r,accessToken:t.tokens.access_token,error:null}),this.logger.info("Token refreshed successfully"),t.tokens.access_token}if(t.error==="invalid_grant")return this.logger.warn("Refresh token expired or revoked, clearing tokens and logging out"),this.clearAuthStorage(),this.setAuthState({status:"unauthenticated",user:null,accessToken:null,error:null}),null}catch(t){this.logger.warn("Token refresh failed:",t)}throw this.logger.warn("Token refresh failed, keeping tokens for manual retry"),s.createOperationError("Access token expired and unable to refresh. Try logging out and logging in again.","token_refresh_failed")}clearAuthStorage(){localStorage.removeItem(this.storageKeys.ACCESS_TOKEN),localStorage.removeItem(this.storageKeys.REFRESH_TOKEN),localStorage.removeItem(this.storageKeys.EXPIRES_AT),localStorage.removeItem(this.storageKeys.RESOURCE_SCOPE)}_storeRefreshedTokens(e){const t=Date.now()+e.expires_in*1e3;localStorage.setItem(this.storageKeys.ACCESS_TOKEN,e.access_token),localStorage.setItem(this.storageKeys.EXPIRES_AT,String(t)),e.refresh_token&&localStorage.setItem(this.storageKeys.REFRESH_TOKEN,e.refresh_token)}async pingApi(){return this.sendApiRequest("GET","/ping")}async getServerState(){const e=await this.sendApiRequest("GET","/bodhi/v1/info");if(s.isApiResultOperationError(e)||!s.isApiResultSuccess(e))return s.BACKEND_SERVER_NOT_REACHABLE;const t=e.body;switch(t.status){case"ready":return{status:"ready",version:t.version||"unknown",error:null};case"setup":return s.backendServerNotReady("setup",t.version||"unknown");case"resource-admin":return s.backendServerNotReady("resource-admin",t.version||"unknown");case"error":return s.backendServerNotReady("error",t.version||"unknown",t.error?{message:t.error.message,type:t.error.type}:s.SERVER_ERROR_CODES.SERVER_NOT_READY);default:return s.BACKEND_SERVER_NOT_REACHABLE}}async*stream(e,t,r,o,n=!0){this.ensureBodhiext();let a=o||{};if(n){const i=await this._getAccessTokenRaw();if(!i)throw s.createOperationError("Not authenticated. Please log in first.","auth_error");a={...a,Authorization:`Bearer ${i}`}}const c=this.bodhiext.sendStreamRequest(e,t,r,a).getReader();try{for(;;){const{value:i,done:u}=await c.read();if(u||i?.done)break;yield i.body}}catch(i){if(i instanceof Error){if("response"in i){const u=i;throw s.createApiError(i.message,u.response.status,u.response.body)}throw"error"in i,s.createOperationError(i.message,"extension_error")}throw i}finally{c.releaseLock()}}get chat(){return this._chat??=new s.Chat(this)}get models(){return this._models??=new s.Models(this)}get embeddings(){return this._embeddings??=new s.Embeddings(this)}serialize(){return{extensionId:this.state.type==="extension"&&this.state.extension==="ready"?this.state.extensionId:void 0}}async debug(){return{type:"WindowBodhiextClient",state:this.state,authState:await this.getAuthState(),bodhiextAvailable:this.bodhiext!==null,authClientId:this.authClientId,authServerUrl:this.config.authServerUrl,redirectUri:this.config.redirectUri,userScope:this.config.userScope}}}function T(d){if(typeof window>"u")throw new Error("redirectUri required in non-browser environment");const e=d==="/"?"":d.replace(/\/$/,"");return`${window.location.origin}${e}/callback`}class w extends s.BaseFacadeClient{constructor(e,t,r){const o=t||{},n={basePath:o.basePath||"/",redirectUri:o.redirectUri||T(o.basePath||"/"),authServerUrl:o.authServerUrl||"https://id.getbodhi.app/realms/bodhi",userScope:o.userScope||"scope_user_user",logLevel:o.logLevel||"warn",apiTimeoutMs:o.apiTimeoutMs,initParams:o.initParams};super(e,n,r)}createLogger(e){return new s.Logger("WebUIClient",e.logLevel)}createStoragePrefix(e){return s.createStoragePrefixWithBasePath(e.basePath,s.STORAGE_PREFIXES.WEB)}createExtClient(e,t){return new y(this.authClientId,{authServerUrl:e.authServerUrl,redirectUri:e.redirectUri,userScope:e.userScope,basePath:e.basePath,logLevel:e.logLevel,apiTimeoutMs:e.apiTimeoutMs,initParams:e.initParams},t)}createDirectClient(e,t,r){return new p({authClientId:e,authServerUrl:t.authServerUrl,redirectUri:t.redirectUri,userScope:t.userScope,logLevel:t.logLevel,basePath:t.basePath,apiTimeoutMs:t.apiTimeoutMs},r)}async handleOAuthCallback(e,t){return this.connectionMode==="direct"?this.directClient.handleOAuthCallback(e,t):this.extClient.handleOAuthCallback(e,t)}}const I="production";exports.WEB_BUILD_MODE=I;exports.WebUIClient=w;

package/dist/bodhi-web.esm.js

@@ -1,57 +1,64 @@
-import { DirectClientBase as R, createStoragePrefixWithBasePath as m, STORAGE_PREFIXES as _, isApiResultOperationError as E, createOperationError as h, isApiResultError as p, isApiResultSuccess as f, generateCodeVerifier as g, generateCodeChallenge as T, EXTENSION_STATE_NOT_INITIALIZED as w, Logger as I, createOAuthEndpoints as C, NOOP_STATE_CALLBACK as k, createStorageKeys as x, EXTENSION_STATE_NOT_FOUND as A, PENDING_EXTENSION_READY as v, BACKEND_SERVER_NOT_REACHABLE as d, extractUserInfo as y, refreshAccessToken as b, backendServerNotReady as S, SERVER_ERROR_CODES as O, createApiError as P, Chat as K, Models as U, Embeddings as N, BaseFacadeClient as L } from "@bodhiapp/bodhi-js-core";
-class D extends R {
+import { DirectClientBase as b, createStoragePrefixWithBasePath as w, STORAGE_PREFIXES as y, isApiResultOperationError as f, createOperationError as c, isApiResultError as R, isApiResultSuccess as _, getMissingToolsetScopeIds as C, getRequestedToolsetScopes as k, generateCodeVerifier as E, generateCodeChallenge as x, EXTENSION_STATE_NOT_INITIALIZED as T, Logger as v, createOAuthEndpoints as P, NOOP_STATE_CALLBACK as O, createStorageKeys as K, EXTENSION_STATE_NOT_FOUND as U, PENDING_EXTENSION_READY as N, BACKEND_SERVER_NOT_REACHABLE as S, extractUserInfo as I, refreshAccessToken as L, backendServerNotReady as p, SERVER_ERROR_CODES as D, createApiError as F, Chat as M, Models as B, Embeddings as $, BaseFacadeClient as q } from "@bodhiapp/bodhi-js-core";
+class V extends b {
   constructor(e, t) {
-    const s = m(
+    const r = w(
       e.basePath,
-      _.WEB_DIRECT
-    ), r = {
+      y.WEB_DIRECT
+    ), s = {
       authClientId: e.authClientId,
       authServerUrl: e.authServerUrl,
       userScope: e.userScope,
-      storagePrefix: s,
+      storagePrefix: r,
       logLevel: e.logLevel,
-      loggerPrefix: "DirectWebClient"
+      loggerPrefix: "DirectWebClient",
+      apiTimeoutMs: e.apiTimeoutMs
     };
-    super(r, t), this.redirectUri = e.redirectUri;
+    super(s, t), this.redirectUri = e.redirectUri;
   }
   // ============================================================================
   // Authentication (Browser Redirect OAuth)
   // ============================================================================
-  async login() {
-    const e = await this.getAuthState();
-    if (e.status === "authenticated")
-      return e;
-    const t = await this.requestResourceAccess();
-    if (E(t))
-      throw h(t.error.message, t.error.type);
-    if (p(t)) {
-      const { message: i } = t.body.error;
-      throw h(i, "auth_error");
+  async login(e) {
+    const t = await this.getAuthState();
+    if (t.status === "authenticated")
+      return t;
+    const r = await this.requestResourceAccess(e?.toolsetScopeIds, e?.version);
+    if (f(r))
+      throw c(r.error.message, r.error.type);
+    if (R(r)) {
+      const { message: m } = r.body.error;
+      throw c(m, "auth_error");
     }
-    if (!f(t))
-      throw h(`Unexpected HTTP ${t.status}`, "auth_error");
-    const s = t.body.scope;
+    if (!_(r))
+      throw c(`Unexpected HTTP ${r.status}`, "auth_error");
+    const s = r.body.scope;
     localStorage.setItem(this.storageKeys.RESOURCE_SCOPE, s);
-    const r = `openid profile email roles ${this.userScope} ${s}`, a = g(), o = await T(a), c = g();
-    localStorage.setItem(this.storageKeys.CODE_VERIFIER, a), localStorage.setItem(this.storageKeys.STATE, c);
-    const n = new URL(this.authEndpoints.authorize);
-    throw n.searchParams.set("client_id", this.authClientId), n.searchParams.set("response_type", "code"), n.searchParams.set("redirect_uri", this.redirectUri), n.searchParams.set("scope", r), n.searchParams.set("code_challenge", o), n.searchParams.set("code_challenge_method", "S256"), n.searchParams.set("state", c), window.location.href = n.toString(), new Error("Redirect initiated");
+    const a = r.body.toolsets || [], i = C(e?.toolsetScopeIds, a);
+    if (i.length > 0)
+      throw c(
+        `toolsetScopeIds not received back from request-access call: [${i.join(", ")}], check developer console on configuring the toolset scopes correctly`,
+        "auth_error"
+      );
+    const h = k(e?.toolsetScopeIds, a), n = `openid profile email roles ${this.userScope} ${s} ${h}`.trim(), o = E(), u = await x(o), g = E();
+    localStorage.setItem(this.storageKeys.CODE_VERIFIER, o), localStorage.setItem(this.storageKeys.STATE, g);
+    const l = new URL(this.authEndpoints.authorize);
+    throw l.searchParams.set("client_id", this.authClientId), l.searchParams.set("response_type", "code"), l.searchParams.set("redirect_uri", this.redirectUri), l.searchParams.set("scope", n), l.searchParams.set("code_challenge", u), l.searchParams.set("code_challenge_method", "S256"), l.searchParams.set("state", g), window.location.href = l.toString(), new Error("Redirect initiated");
   }
   async handleOAuthCallback(e, t) {
-    const s = localStorage.getItem(this.storageKeys.STATE);
-    if (!s || s !== t)
+    const r = localStorage.getItem(this.storageKeys.STATE);
+    if (!r || r !== t)
       throw new Error("Invalid state parameter - possible CSRF attack");
     await this.exchangeCodeForTokens(e), localStorage.removeItem(this.storageKeys.CODE_VERIFIER), localStorage.removeItem(this.storageKeys.STATE);
-    const r = await this.getAuthState();
-    if (r.status !== "authenticated")
+    const s = await this.getAuthState();
+    if (s.status !== "authenticated")
       throw new Error("Login failed");
-    return this.setAuthState(r), r;
+    return this.setAuthState(s), s;
   }
   async logout() {
     const e = localStorage.getItem(this.storageKeys.REFRESH_TOKEN);
     if (e)
       try {
-        const s = new URLSearchParams({
+        const r = new URLSearchParams({
           token: e,
           client_id: this.authClientId,
           token_type_hint: "refresh_token"
@@ -61,10 +68,10 @@ class D extends R {
           headers: {
             "Content-Type": "application/x-www-form-urlencoded"
           },
-          body: s
+          body: r
         });
-      } catch (s) {
-        this.logger.warn("Token revocation failed:", s);
+      } catch (r) {
+        this.logger.warn("Token revocation failed:", r);
       }
     localStorage.removeItem(this.storageKeys.ACCESS_TOKEN), localStorage.removeItem(this.storageKeys.REFRESH_TOKEN), localStorage.removeItem(this.storageKeys.EXPIRES_AT), localStorage.removeItem(this.storageKeys.RESOURCE_SCOPE);
     const t = {
@@ -82,7 +89,7 @@ class D extends R {
     const t = localStorage.getItem(this.storageKeys.CODE_VERIFIER);
     if (!t)
       throw new Error("Code verifier not found");
-    const s = await fetch(this.authEndpoints.token, {
+    const r = await fetch(this.authEndpoints.token, {
       method: "POST",
       headers: {
         "Content-Type": "application/x-www-form-urlencoded"
@@ -95,13 +102,13 @@ class D extends R {
         code_verifier: t
       })
     });
-    if (!s.ok) {
-      const a = await s.text();
-      throw new Error(`Token exchange failed: ${s.status} ${a}`);
+    if (!r.ok) {
+      const a = await r.text();
+      throw new Error(`Token exchange failed: ${r.status} ${a}`);
     }
-    const r = await s.json();
-    if (localStorage.setItem(this.storageKeys.ACCESS_TOKEN, r.access_token), r.refresh_token && localStorage.setItem(this.storageKeys.REFRESH_TOKEN, r.refresh_token), r.expires_in) {
-      const a = Date.now() + r.expires_in * 1e3;
+    const s = await r.json();
+    if (localStorage.setItem(this.storageKeys.ACCESS_TOKEN, s.access_token), s.refresh_token && localStorage.setItem(this.storageKeys.REFRESH_TOKEN, s.refresh_token), s.expires_in) {
+      const a = Date.now() + s.expires_in * 1e3;
       localStorage.setItem(this.storageKeys.EXPIRES_AT, a.toString());
     }
   }
@@ -112,8 +119,8 @@ class D extends R {
     return localStorage.getItem(e);
   }
   async _storageSet(e) {
-    Object.entries(e).forEach(([t, s]) => {
-      localStorage.setItem(t, String(s));
+    Object.entries(e).forEach(([t, r]) => {
+      localStorage.setItem(t, String(r));
     });
   }
   async _storageRemove(e) {
@@ -123,12 +130,12 @@ class D extends R {
     return this.redirectUri;
   }
 }
-const F = 500, B = 5e3;
-class $ {
-  constructor(e, t, s) {
-    this.state = w, this.bodhiext = null, this.refreshPromise = null, this.logger = new I("WindowBodhiextClient", t.logLevel), this.authClientId = e, this.config = t, this.authEndpoints = C(this.config.authServerUrl), this.onStateChange = s ?? k;
-    const r = m(t.basePath, _.WEB_EXT);
-    this.storageKeys = x(r);
+const H = 500, z = 5e3, W = 3e4;
+class X {
+  constructor(e, t, r) {
+    this.state = T, this.bodhiext = null, this.refreshPromise = null, this.logger = new v("WindowBodhiextClient", t.logLevel), this.authClientId = e, this.config = t, this.authEndpoints = P(this.config.authServerUrl), this.onStateChange = r ?? O;
+    const s = w(t.basePath, y.WEB_EXT);
+    this.storageKeys = K(s), this.apiTimeoutMs = t.apiTimeoutMs ?? W;
   }
   /**
    * Set client state and notify callback
@@ -157,7 +164,7 @@ class $ {
    */
   ensureBodhiext() {
     if (!this.bodhiext && window.bodhiext && (this.logger.info("Acquiring window.bodhiext reference"), this.bodhiext = window.bodhiext), !this.bodhiext)
-      throw h("Client not initialized", "extension_error");
+      throw c("Client not initialized", "extension_error");
   }
   /**
    * Send extension request via window.bodhiext.sendExtRequest
@@ -169,45 +176,52 @@ class $ {
    * Send API message via window.bodhiext.sendApiRequest
    * Converts ApiResponse to ApiResponseResult
    */
-  async sendApiRequest(e, t, s, r, a) {
+  async sendApiRequest(e, t, r, s, a) {
     try {
       this.ensureBodhiext();
-    } catch (o) {
+    } catch (i) {
       return {
         error: {
-          message: o instanceof Error ? o.message : String(o),
+          message: i instanceof Error ? i.message : String(i),
           type: "extension_error"
         }
       };
     }
     try {
-      let o = r || {};
-      if (a) {
-        const n = await this._getAccessTokenRaw();
-        if (!n)
-          return {
-            error: {
-              message: "Not authenticated. Please log in first.",
-              type: "extension_error"
-            }
+      const i = new Promise(
+        (n, o) => setTimeout(
+          () => o(
+            new Error(
+              `[bodhi-js-sdk/web] network timeout: api request not completed within configured/default timeout of ${this.apiTimeoutMs}ms`
+            )
+          ),
+          this.apiTimeoutMs
+        )
+      ), h = (async () => {
+        let n = s || {};
+        if (a) {
+          const o = await this._getAccessTokenRaw();
+          if (!o)
+            return {
+              error: {
+                message: "Not authenticated. Please log in first.",
+                type: "extension_error"
+              }
+            };
+          n = {
+            ...n,
+            Authorization: `Bearer ${o}`
           };
-        o = {
-          ...o,
-          Authorization: `Bearer ${n}`
-        };
-      }
-      return await this.bodhiext.sendApiRequest(
-        e,
-        t,
-        s,
-        o
-      );
-    } catch (o) {
-      const c = o?.error, n = c?.message ?? (o instanceof Error ? o.message : String(o)), i = c?.type || "extension_error";
+        }
+        return this.bodhiext.sendApiRequest(e, t, r, n);
+      })();
+      return await Promise.race([h, i]);
+    } catch (i) {
+      const h = i?.error, n = h?.message ?? (i instanceof Error ? i.message : String(i)), o = h?.type || "network_error";
       return {
         error: {
           message: n,
-          type: i
+          type: o
         }
       };
     }
@@ -233,44 +247,44 @@ class $ {
    */
   async init(e = {}) {
     if (!e.testConnection && !e.selectedConnection)
-      return this.logger.info("No testConnection or selectedConnection, returning not-initialized state"), w;
+      return this.logger.info("No testConnection or selectedConnection, returning not-initialized state"), T;
     if (this.bodhiext && !e.testConnection)
       return this.logger.debug("Already have bodhiext handle, skipping polling"), this.state;
     if (!this.bodhiext) {
-      const r = e.timeoutMs ?? this.config.initParams?.extension?.timeoutMs ?? B, a = e.intervalMs ?? this.config.initParams?.extension?.intervalMs ?? F, o = Date.now();
+      const s = e.timeoutMs ?? this.config.initParams?.extension?.timeoutMs ?? z, a = e.intervalMs ?? this.config.initParams?.extension?.intervalMs ?? H, i = Date.now();
       if (!await new Promise((n) => {
-        const i = () => {
+        const o = () => {
           if (window.bodhiext) {
             this.bodhiext = window.bodhiext, n(!0);
             return;
           }
-          if (Date.now() - o >= r) {
+          if (Date.now() - i >= s) {
             n(!1);
             return;
           }
-          setTimeout(i, a);
+          setTimeout(o, a);
         };
-        i();
+        o();
       }))
-        return this.logger.warn("Extension discovery timed out"), this.setState(A), this.state;
+        return this.logger.warn("Extension discovery timed out"), this.setState(U), this.state;
     }
     const t = await this.bodhiext.getExtensionId();
     this.logger.info(`Extension discovered: ${t}`);
-    const s = {
+    const r = {
       type: "extension",
       extension: "ready",
       extensionId: t,
-      server: v
+      server: N
     };
     if (e.testConnection)
       try {
-        const r = await this.getServerState();
-        this.setState({ ...s, server: r }), this.logger.info(`Server connectivity tested: ${r.status}`);
-      } catch (r) {
-        this.logger.error("Failed to get server state:", r), this.setState({ ...s, server: d });
+        const s = await this.getServerState();
+        this.setState({ ...r, server: s }), this.logger.info(`Server connectivity tested: ${s.status}`);
+      } catch (s) {
+        this.logger.error("Failed to get server state:", s), this.setState({ ...r, server: S });
       }
     else
-      this.setState(s);
+      this.setState(r);
     return this.state;
   }
   // ============================================================================
@@ -280,45 +294,66 @@ class $ {
    * Request resource access scope from backend
    * Required for authenticated API access
    */
-  async requestResourceAccess() {
-    return this.ensureBodhiext(), this.bodhiext.sendApiRequest(
+  async requestResourceAccess(e, t) {
+    this.ensureBodhiext();
+    const r = {
+      app_client_id: this.authClientId,
+      ...e && { toolset_scope_ids: e },
+      ...t && { version: t }
+    };
+    return this.bodhiext.sendApiRequest(
       "POST",
       "/bodhi/v1/apps/request-access",
-      { app_client_id: this.authClientId }
+      r
     );
   }
   /**
    * Login via browser redirect OAuth2 + PKCE flow
+   * @param options - Optional login options (toolsetScopeIds, version)
    * @returns AuthState (though in practice, this redirects and never returns)
    */
-  async login() {
-    const e = await this.getAuthState();
-    if (e.status === "authenticated")
-      return e;
+  async login(e) {
+    const t = await this.getAuthState();
+    if (t.status === "authenticated")
+      return t;
     this.ensureBodhiext();
-    const t = await this.requestResourceAccess();
-    if (E(t))
-      throw h(t.error.message, t.error.type);
-    if (p(t)) {
-      const { message: l } = t.body.error;
-      throw h(l, "auth_error");
+    const r = await this.requestResourceAccess(e?.toolsetScopeIds, e?.version);
+    if (f(r))
+      throw c(r.error.message, r.error.type);
+    if (R(r)) {
+      const { message: A } = r.body.error;
+      throw c(A, "auth_error");
     }
-    if (!f(t))
-      throw h(`Unexpected HTTP ${t.status}`, "auth_error");
-    const s = t.body.scope;
+    if (!_(r))
+      throw c(`Unexpected HTTP ${r.status}`, "auth_error");
+    const s = r.body.scope;
     localStorage.setItem(this.storageKeys.RESOURCE_SCOPE, s);
-    const r = g(), a = await T(r), o = g();
-    localStorage.setItem(this.storageKeys.CODE_VERIFIER, r), localStorage.setItem(this.storageKeys.STATE, o);
-    const c = ["openid", "profile", "email", "roles", this.config.userScope, s], n = new URLSearchParams({
+    const a = r.body.toolsets || [], i = C(e?.toolsetScopeIds, a);
+    if (i.length > 0)
+      throw c(
+        `toolsetScopeIds not received back from request-access call: [${i.join(", ")}], check developer console on configuring the toolset scopes correctly`,
+        "auth_error"
+      );
+    const h = k(e?.toolsetScopeIds, a), n = E(), o = await x(n), u = E();
+    localStorage.setItem(this.storageKeys.CODE_VERIFIER, n), localStorage.setItem(this.storageKeys.STATE, u);
+    const g = [
+      "openid",
+      "profile",
+      "email",
+      "roles",
+      this.config.userScope,
+      s,
+      ...h ? h.split(" ") : []
+    ], l = new URLSearchParams({
       response_type: "code",
       client_id: this.authClientId,
       redirect_uri: this.config.redirectUri,
-      scope: c.join(" "),
-      state: o,
-      code_challenge: a,
+      scope: g.join(" "),
+      state: u,
+      code_challenge: o,
       code_challenge_method: "S256"
-    }), i = `${this.authEndpoints.authorize}?${n}`;
-    return window.location.href = i, new Promise(() => {
+    }), m = `${this.authEndpoints.authorize}?${l}`;
+    return window.location.href = m, new Promise(() => {
     });
   }
   /**
@@ -327,14 +362,14 @@ class $ {
    * @returns AuthState with login state and user info
    */
   async handleOAuthCallback(e, t) {
-    const s = localStorage.getItem(this.storageKeys.STATE);
-    if (!s || s !== t)
+    const r = localStorage.getItem(this.storageKeys.STATE);
+    if (!r || r !== t)
       throw new Error("Invalid state parameter - possible CSRF attack");
     await this.exchangeCodeForTokens(e), localStorage.removeItem(this.storageKeys.CODE_VERIFIER), localStorage.removeItem(this.storageKeys.STATE);
-    const r = await this.getAuthState();
-    if (r.status !== "authenticated")
+    const s = await this.getAuthState();
+    if (s.status !== "authenticated")
       throw new Error("Login failed");
-    return this.setAuthState(r), r;
+    return this.setAuthState(s), s;
   }
   /**
    * Exchange authorization code for tokens
@@ -343,29 +378,29 @@ class $ {
     const t = localStorage.getItem(this.storageKeys.CODE_VERIFIER);
     if (!t)
       throw new Error("Code verifier not found");
-    const s = new URLSearchParams({
+    const r = new URLSearchParams({
       grant_type: "authorization_code",
       client_id: this.authClientId,
       code: e,
       redirect_uri: this.config.redirectUri,
       code_verifier: t
-    }), r = await fetch(this.authEndpoints.token, {
+    }), s = await fetch(this.authEndpoints.token, {
       method: "POST",
       headers: {
         "Content-Type": "application/x-www-form-urlencoded"
       },
-      body: s
+      body: r
     });
-    if (!r.ok) {
-      const o = await r.text();
-      throw new Error(`Token exchange failed: ${r.status} ${o}`);
+    if (!s.ok) {
+      const i = await s.text();
+      throw new Error(`Token exchange failed: ${s.status} ${i}`);
     }
-    const a = await r.json();
+    const a = await s.json();
     if (!a.access_token)
       throw new Error("No access token received");
     if (localStorage.setItem(this.storageKeys.ACCESS_TOKEN, a.access_token), a.refresh_token && localStorage.setItem(this.storageKeys.REFRESH_TOKEN, a.refresh_token), a.expires_in) {
-      const o = Date.now() + a.expires_in * 1e3;
-      localStorage.setItem(this.storageKeys.EXPIRES_AT, o.toString());
+      const i = Date.now() + a.expires_in * 1e3;
+      localStorage.setItem(this.storageKeys.EXPIRES_AT, i.toString());
     }
   }
   /**
@@ -376,7 +411,7 @@ class $ {
     const e = localStorage.getItem(this.storageKeys.REFRESH_TOKEN);
     if (e)
       try {
-        const s = new URLSearchParams({
+        const r = new URLSearchParams({
           token: e,
           client_id: this.authClientId,
           token_type_hint: "refresh_token"
@@ -386,10 +421,10 @@ class $ {
           headers: {
             "Content-Type": "application/x-www-form-urlencoded"
           },
-          body: s
+          body: r
         });
-      } catch (s) {
-        this.logger.warn("Token revocation failed:", s);
+      } catch (r) {
+        this.logger.warn("Token revocation failed:", r);
       }
     localStorage.removeItem(this.storageKeys.ACCESS_TOKEN), localStorage.removeItem(this.storageKeys.REFRESH_TOKEN), localStorage.removeItem(this.storageKeys.EXPIRES_AT), localStorage.removeItem(this.storageKeys.CODE_VERIFIER), localStorage.removeItem(this.storageKeys.STATE), localStorage.removeItem(this.storageKeys.RESOURCE_SCOPE);
     const t = {
@@ -408,7 +443,7 @@ class $ {
     if (!e)
       return { status: "unauthenticated", user: null, accessToken: null, error: null };
     try {
-      return { status: "authenticated", user: y(e), accessToken: e, error: null };
+      return { status: "authenticated", user: I(e), accessToken: e, error: null };
     } catch (t) {
       return this.logger.error("Failed to parse token:", t), { status: "unauthenticated", user: null, accessToken: null, error: null };
     }
@@ -422,10 +457,10 @@ class $ {
     if (!e)
       return null;
     if (t) {
-      const s = parseInt(t, 10);
-      if (Date.now() >= s - 5 * 1e3) {
-        const r = localStorage.getItem(this.storageKeys.REFRESH_TOKEN);
-        return r ? this._tryRefreshToken(r) : null;
+      const r = parseInt(t, 10);
+      if (Date.now() >= r - 5 * 1e3) {
+        const s = localStorage.getItem(this.storageKeys.REFRESH_TOKEN);
+        return s ? this._tryRefreshToken(s) : null;
       }
     }
     return e;
@@ -450,17 +485,17 @@ class $ {
   async _doRefreshToken(e) {
     this.logger.debug("Refreshing access token");
     try {
-      const t = await b(
+      const t = await L(
         this.authEndpoints.token,
         e,
         this.authClientId
       );
       if (t.success) {
         this._storeRefreshedTokens(t.tokens);
-        const s = y(t.tokens.access_token);
+        const r = I(t.tokens.access_token);
         return this.setAuthState({
           status: "authenticated",
-          user: s,
+          user: r,
           accessToken: t.tokens.access_token,
           error: null
         }), this.logger.info("Token refreshed successfully"), t.tokens.access_token;
@@ -475,7 +510,7 @@ class $ {
     } catch (t) {
       this.logger.warn("Token refresh failed:", t);
     }
-    throw this.logger.warn("Token refresh failed, keeping tokens for manual retry"), h(
+    throw this.logger.warn("Token refresh failed, keeping tokens for manual retry"), c(
       "Access token expired and unable to refresh. Try logging out and logging in again.",
       "token_refresh_failed"
     );
@@ -502,61 +537,61 @@ class $ {
    */
   async getServerState() {
     const e = await this.sendApiRequest("GET", "/bodhi/v1/info");
-    if (E(e))
-      return d;
-    if (!f(e))
-      return d;
+    if (f(e))
+      return S;
+    if (!_(e))
+      return S;
     const t = e.body;
     switch (t.status) {
       case "ready":
         return { status: "ready", version: t.version || "unknown", error: null };
       case "setup":
-        return S("setup", t.version || "unknown");
+        return p("setup", t.version || "unknown");
       case "resource-admin":
-        return S("resource-admin", t.version || "unknown");
+        return p("resource-admin", t.version || "unknown");
       case "error":
-        return S(
+        return p(
           "error",
           t.version || "unknown",
-          t.error ? { message: t.error.message, type: t.error.type } : O.SERVER_NOT_READY
+          t.error ? { message: t.error.message, type: t.error.type } : D.SERVER_NOT_READY
         );
       default:
-        return d;
+        return S;
     }
   }
   /**
    * Generic streaming via window.bodhiext.sendStreamRequest
    * Wraps ReadableStream as AsyncGenerator
    */
-  async *stream(e, t, s, r, a = !0) {
+  async *stream(e, t, r, s, a = !0) {
     this.ensureBodhiext();
-    let o = r || {};
+    let i = s || {};
     if (a) {
-      const i = await this._getAccessTokenRaw();
-      if (!i)
-        throw h("Not authenticated. Please log in first.", "auth_error");
-      o = {
-        ...o,
-        Authorization: `Bearer ${i}`
+      const o = await this._getAccessTokenRaw();
+      if (!o)
+        throw c("Not authenticated. Please log in first.", "auth_error");
+      i = {
+        ...i,
+        Authorization: `Bearer ${o}`
       };
     }
-    const n = this.bodhiext.sendStreamRequest(e, t, s, o).getReader();
+    const n = this.bodhiext.sendStreamRequest(e, t, r, i).getReader();
     try {
       for (; ; ) {
-        const { value: i, done: l } = await n.read();
-        if (l || i?.done)
+        const { value: o, done: u } = await n.read();
+        if (u || o?.done)
           break;
-        yield i.body;
+        yield o.body;
       }
-    } catch (i) {
-      if (i instanceof Error) {
-        if ("response" in i) {
-          const l = i;
-          throw P(i.message, l.response.status, l.response.body);
+    } catch (o) {
+      if (o instanceof Error) {
+        if ("response" in o) {
+          const u = o;
+          throw F(o.message, u.response.status, u.response.body);
         }
-        throw "error" in i ? h(i.message, "extension_error") : h(i.message, "extension_error");
+        throw "error" in o ? c(o.message, "extension_error") : c(o.message, "extension_error");
       }
-      throw i;
+      throw o;
     } finally {
       n.releaseLock();
     }
@@ -565,13 +600,13 @@ class $ {
   // OpenAI-Compatible Namespaced API
   // ============================================================================
   get chat() {
-    return this._chat ??= new K(this);
+    return this._chat ??= new M(this);
   }
   get models() {
-    return this._models ??= new U(this);
+    return this._models ??= new B(this);
   }
   get embeddings() {
-    return this._embeddings ??= new N(this);
+    return this._embeddings ??= new $(this);
   }
   /**
    * Serialize web extension client state (all transient, nothing to persist)
@@ -597,32 +632,33 @@ class $ {
     };
   }
 }
-function q(u) {
+function j(d) {
   if (typeof window > "u")
     throw new Error("redirectUri required in non-browser environment");
-  const e = u === "/" ? "" : u.replace(/\/$/, "");
+  const e = d === "/" ? "" : d.replace(/\/$/, "");
   return `${window.location.origin}${e}/callback`;
 }
-class H extends L {
-  constructor(e, t, s) {
-    const r = t || {}, a = {
-      basePath: r.basePath || "/",
-      redirectUri: r.redirectUri || q(r.basePath || "/"),
-      authServerUrl: r.authServerUrl || "https://id.getbodhi.app/realms/bodhi",
-      userScope: r.userScope || "scope_user_user",
-      logLevel: r.logLevel || "warn",
-      initParams: r.initParams
+class Y extends q {
+  constructor(e, t, r) {
+    const s = t || {}, a = {
+      basePath: s.basePath || "/",
+      redirectUri: s.redirectUri || j(s.basePath || "/"),
+      authServerUrl: s.authServerUrl || "https://id.getbodhi.app/realms/bodhi",
+      userScope: s.userScope || "scope_user_user",
+      logLevel: s.logLevel || "warn",
+      apiTimeoutMs: s.apiTimeoutMs,
+      initParams: s.initParams
     };
-    super(e, a, s);
+    super(e, a, r);
   }
   createLogger(e) {
-    return new I("WebUIClient", e.logLevel);
+    return new v("WebUIClient", e.logLevel);
   }
   createStoragePrefix(e) {
-    return m(e.basePath, _.WEB);
+    return w(e.basePath, y.WEB);
   }
   createExtClient(e, t) {
-    return new $(
+    return new X(
       this.authClientId,
       {
         authServerUrl: e.authServerUrl,
@@ -630,22 +666,24 @@ class H extends L {
         userScope: e.userScope,
         basePath: e.basePath,
         logLevel: e.logLevel,
+        apiTimeoutMs: e.apiTimeoutMs,
         initParams: e.initParams
       },
       t
     );
   }
-  createDirectClient(e, t, s) {
-    return new D(
+  createDirectClient(e, t, r) {
+    return new V(
       {
         authClientId: e,
         authServerUrl: t.authServerUrl,
         redirectUri: t.redirectUri,
         userScope: t.userScope,
         logLevel: t.logLevel,
-        basePath: t.basePath
+        basePath: t.basePath,
+        apiTimeoutMs: t.apiTimeoutMs
       },
-      s
+      r
     );
   }
   // ============================================================================
@@ -655,8 +693,8 @@ class H extends L {
     return this.connectionMode === "direct" ? this.directClient.handleOAuthCallback(e, t) : this.extClient.handleOAuthCallback(e, t);
   }
 }
-const z = "production";
+const J = "production";
 export {
-  z as WEB_BUILD_MODE,
-  H as WebUIClient
+  J as WEB_BUILD_MODE,
+  Y as WebUIClient
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bodhiapp/bodhi-js",
-  "version": "0.0.15",
+  "version": "0.0.17",
   "description": "Web SDK for Bodhi Browser - window.bodhiext communication",
   "type": "module",
   "main": "dist/bodhi-web.cjs.js",
@@ -37,8 +37,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@bodhiapp/bodhi-js-core": "0.0.15",
-    "@bodhiapp/ts-client": "0.1.9"
+    "@bodhiapp/bodhi-js-core": "0.0.17",
+    "@bodhiapp/ts-client": "0.1.14"
   },
   "devDependencies": {
     "@eslint/js": "^9.23.0",