@bodhiapp/bodhi-js 0.0.38 → 0.0.40

package/dist/bodhi-web.cjs.js

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const r=require("@bodhiapp/bodhi-js-core");class S{async get(e){return localStorage.getItem(e)}async set(e){Object.entries(e).forEach(([t,i])=>{localStorage.setItem(t,String(i))})}async remove(e){e.forEach(t=>localStorage.removeItem(t))}}class w extends r.DirectClientBase{constructor(e,t){const i=r.createStoragePrefixWithNamespace(e.basePath,r.STORAGE_PREFIXES.WEB_DIRECT),s={authClientId:e.authClientId,authServerUrl:e.authServerUrl,storagePrefix:i,logLevel:e.logLevel,loggerPrefix:"DirectWebClient",apiTimeoutMs:e.apiTimeoutMs,storage:e.storage??new S,initialTokens:e.initialTokens};super(s,t),this.redirectUri=e.redirectUri}async login(e){const t=await this.getAuthState();if(t.status==="authenticated")return t;const i=e?.userRole??"scope_user_user",s=e?.flowType??"popup";e?.onProgress?.("requesting");const o=new r.AccessRequestBuilder(this.authClientId).requestedRole(i).flowType(s);if(e?.requested&&o.requested(e.requested),s==="redirect"){const u=e?.redirectUrl??this.redirectUri;o.redirectUrl(u)}const n=o.build(),c=await this.requestAccess(n),{id:l,review_url:a}=r.unwrapResponse(c);e?.onProgress?.("reviewing");let h;if(s==="popup"){const u=async()=>{const p=await this.getAccessRequestStatus(l);if(p.status>=400)return null;const{status:g,access_request_scope:E}=p.body;return g==="approved"?{approved:!0,accessRequestScope:E??void 0}:["denied","failed","expired"].includes(g)?{approved:!1,status:g}:null},d=await r.openPopupReview(a,u,{intervalMs:e?.pollIntervalMs??r.DEFAULT_POLL_INTERVAL_MS,timeoutMs:e?.pollTimeoutMs??r.DEFAULT_POLL_TIMEOUT_MS});d.approved||r.throwAccessRequestDenialError(d.status??"unknown"),h=d.accessRequestScope}else return await this._storageSet({[this.storageKeys.ACCESS_REQUEST_ID]:l}),window.location.href=a,new Promise(()=>{});return e?.onProgress?.("authenticating"),this.performOAuthPkce(`openid profile email roles ${h??""}`.trim())}async performOAuthPkce(e){const t=r.generateCodeVerifier(),i=await r.generateCodeChallenge(t),s=r.generateCodeVerifier();await this._storageSet({[this.storageKeys.CODE_VERIFIER]:t,[this.storageKeys.STATE]:s});const o=new URL(this.authEndpoints.authorize);throw o.searchParams.set("client_id",this.authClientId),o.searchParams.set("response_type","code"),o.searchParams.set("redirect_uri",this.redirectUri),o.searchParams.set("scope",e),o.searchParams.set("code_challenge",i),o.searchParams.set("code_challenge_method","S256"),o.searchParams.set("state",s),window.location.href=o.toString(),new Error("Redirect initiated")}async handleOAuthCallback(e,t){const i=await this._storageGet(this.storageKeys.STATE);if(!i||i!==t)throw new Error("Invalid state parameter - possible CSRF attack");await this.exchangeCodeForTokens(e);const s=await this.getAuthState();if(s.status!=="authenticated")throw new Error("Login failed");return this.setAuthState(s),s}async handleAccessRequestCallback(e){const t=await this.getAccessRequestStatus(e),{status:i,access_request_scope:s}=r.unwrapResponse(t);await this._storageRemove([this.storageKeys.ACCESS_REQUEST_ID]),i!=="approved"&&r.throwAccessRequestDenialError(i);const o=`openid profile email roles ${s??""}`.trim();return this.performOAuthPkce(o)}_getRedirectUri(){return this.redirectUri}}const m=500,_=5e3,T=3e4;class R{constructor(e,t,i){this.state=r.EXTENSION_STATE_NOT_INITIALIZED,this.bodhiext=null,this.refreshPromise=null,this.logger=new r.Logger("WindowBodhiextClient",t.logLevel),this.authClientId=e,this.config=t,this.authEndpoints=r.createOAuthEndpoints(this.config.authServerUrl),this.onStateChange=i??r.NOOP_STATE_CALLBACK;const s=r.createStoragePrefixWithNamespace(t.basePath,r.STORAGE_PREFIXES.WEB_EXT);this.storageKeys=r.createStorageKeys(s),this.apiTimeoutMs=t.apiTimeoutMs??T}setState(e){this.state=e,this.logger.info(`{state: ${JSON.stringify(e)}} - Setting client state`),this.onStateChange({type:"client-state",state:e})}setAuthState(e){this.onStateChange({type:"auth-state",state:e})}setStateCallback(e){this.onStateChange=e}ensureBodhiext(){if(!this.bodhiext&&window.bodhiext&&(this.logger.info("Acquiring window.bodhiext reference"),this.bodhiext=window.bodhiext),!this.bodhiext)throw r.createOperationError("not_initialized","Client not initialized")}async sendExtRequest(e,t){return this.ensureBodhiext(),this.bodhiext.sendExtRequest(e,t)}async sendApiRequest(e,t,i,s,o){this.ensureBodhiext();try{const n=new Promise((l,a)=>setTimeout(()=>a(new r.BodhiError("timeout_error",`[bodhi-js-sdk/web] network timeout: api request not completed within configured/default timeout of ${this.apiTimeoutMs}ms`)),this.apiTimeoutMs)),c=(async()=>{let l=s||{};if(o){const a=await this._getAccessTokenRaw();if(!a)throw new r.BodhiError("auth_error","Not authenticated. Please log in first.");l={...l,Authorization:`Bearer ${a}`}}return this.bodhiext.sendApiRequest(e,t,i,l)})();return await Promise.race([c,n])}catch(n){if(n instanceof r.BodhiApiError||n instanceof r.BodhiError)throw n;if(n instanceof Error){const c=n;throw n.name==="BodhiApiError"&&typeof c.status=="number"&&c.body!=null?new r.BodhiApiError(c.status,c.body,n.message,c.headers):n.name==="BodhiError"&&typeof c.code=="string"?new r.BodhiError(c.code,n.message):new r.BodhiError("network_error",n.message)}throw new r.BodhiError("network_error",String(n))}}getState(){return this.state}isClientInitialized(){return this.state.extension==="ready"}isServerReady(){return this.isClientInitialized()&&this.state.server.status==="ready"}async init(e={}){if(!e.testConnection&&!e.selectedConnection)return this.logger.info("No testConnection or selectedConnection, returning not-initialized state"),r.EXTENSION_STATE_NOT_INITIALIZED;if(this.bodhiext&&!e.testConnection)return this.logger.debug("Already have bodhiext handle, skipping polling"),this.state;if(!this.bodhiext){const s=e.timeoutMs??this.config.initParams?.extension?.timeoutMs??_,o=e.intervalMs??this.config.initParams?.extension?.intervalMs??m,n=Date.now();if(!await new Promise(l=>{const a=()=>{if(window.bodhiext){this.bodhiext=window.bodhiext,l(!0);return}if(Date.now()-n>=s){l(!1);return}setTimeout(a,o)};a()}))return this.logger.warn("Extension discovery timed out"),this.setState(r.EXTENSION_STATE_NOT_FOUND),this.state}const t=await this.bodhiext.getExtensionId();this.logger.info(`Extension discovered: ${t}`);const i={type:"extension",extension:"ready",extensionId:t,server:r.PENDING_EXTENSION_READY};if(e.testConnection)try{const s=await this.getServerState();this.setState({...i,server:s}),this.logger.info(`Server connectivity tested: ${s.status}`)}catch(s){this.logger.error("Failed to get server state:",s),this.setState({...i,server:r.BACKEND_SERVER_NOT_REACHABLE})}else this.setState(i);return this.state}async login(e){const t=await this.getAuthState();if(t.status==="authenticated")return t;this.ensureBodhiext();const i=e?.userRole??"scope_user_user",s=e?.flowType??"popup";e?.onProgress?.("requesting");const o=new r.AccessRequestBuilder(this.authClientId).requestedRole(i).flowType(s);if(e?.requested&&o.requested(e.requested),s==="redirect"){const u=e?.redirectUrl??this.config.redirectUri;o.redirectUrl(u)}const n=o.build(),c=await this.requestAccess(n),{id:l,review_url:a}=r.unwrapResponse(c);e?.onProgress?.("reviewing");let h;if(s==="popup"){const u=async()=>{const p=await this.getAccessRequestStatus(l);if(p.status>=400)return null;const{status:g,access_request_scope:E}=p.body;return g==="approved"?{approved:!0,accessRequestScope:E??void 0}:["denied","failed","expired"].includes(g)?{approved:!1,status:g}:null},d=await r.openPopupReview(a,u,{intervalMs:e?.pollIntervalMs??r.DEFAULT_POLL_INTERVAL_MS,timeoutMs:e?.pollTimeoutMs??r.DEFAULT_POLL_TIMEOUT_MS});d.approved||r.throwAccessRequestDenialError(d.status??"unknown"),h=d.accessRequestScope}else return localStorage.setItem(this.storageKeys.ACCESS_REQUEST_ID,l),window.location.href=a,new Promise(()=>{});return e?.onProgress?.("authenticating"),this.performOAuthPkce(`openid profile email roles ${h??""}`.trim())}async handleOAuthCallback(e,t){const i=localStorage.getItem(this.storageKeys.STATE);if(!i||i!==t)throw new Error("Invalid state parameter - possible CSRF attack");await this.exchangeCodeForTokens(e),localStorage.removeItem(this.storageKeys.CODE_VERIFIER),localStorage.removeItem(this.storageKeys.STATE);const s=await this.getAuthState();if(s.status!=="authenticated")throw new Error("Login failed");return this.setAuthState(s),s}async exchangeCodeForTokens(e){const t=localStorage.getItem(this.storageKeys.CODE_VERIFIER);if(!t)throw new Error("Code verifier not found");const i=new URLSearchParams({grant_type:"authorization_code",client_id:this.authClientId,code:e,redirect_uri:this.config.redirectUri,code_verifier:t}),s=await fetch(this.authEndpoints.token,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i});if(!s.ok){const n=await s.text();throw new Error(`Token exchange failed: ${s.status} ${n}`)}const o=await s.json();if(!o.access_token)throw new Error("No access token received");if(localStorage.setItem(this.storageKeys.ACCESS_TOKEN,o.access_token),o.refresh_token&&localStorage.setItem(this.storageKeys.REFRESH_TOKEN,o.refresh_token),o.expires_in){const n=Date.now()+o.expires_in*1e3;localStorage.setItem(this.storageKeys.EXPIRES_AT,n.toString())}}async logout(){const e=localStorage.getItem(this.storageKeys.REFRESH_TOKEN);if(e)try{const i=new URLSearchParams({token:e,client_id:this.authClientId,token_type_hint:"refresh_token"});await fetch(this.authEndpoints.revoke,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i})}catch(i){this.logger.warn("Token revocation failed:",i)}localStorage.removeItem(this.storageKeys.ACCESS_TOKEN),localStorage.removeItem(this.storageKeys.REFRESH_TOKEN),localStorage.removeItem(this.storageKeys.EXPIRES_AT),localStorage.removeItem(this.storageKeys.CODE_VERIFIER),localStorage.removeItem(this.storageKeys.STATE);const t={status:"unauthenticated",user:null,accessToken:null,error:null,refreshToken:null,expiresAt:null,isTokenRefresh:!1};return this.setAuthState(t),t}async getAuthState(){const e=await this._getAccessTokenRaw();if(!e)return{status:"unauthenticated",user:null,accessToken:null,error:null,refreshToken:null,expiresAt:null,isTokenRefresh:!1};try{return{status:"authenticated",user:r.extractUserInfo(e),accessToken:e,error:null,refreshToken:null,expiresAt:null,isTokenRefresh:!1}}catch(t){return this.logger.error("Failed to parse token:",t),{status:"unauthenticated",user:null,accessToken:null,error:null,refreshToken:null,expiresAt:null,isTokenRefresh:!1}}}async _getAccessTokenRaw(){const e=localStorage.getItem(this.storageKeys.ACCESS_TOKEN),t=localStorage.getItem(this.storageKeys.EXPIRES_AT);if(!e)return null;if(t){const i=parseInt(t,10);if(Date.now()>=i-5*1e3){const s=localStorage.getItem(this.storageKeys.REFRESH_TOKEN);return s?this._tryRefreshToken(s):null}}return e}async _tryRefreshToken(e){if(this.refreshPromise)return this.logger.debug("Refresh already in progress, returning existing promise"),this.refreshPromise;this.refreshPromise=this._doRefreshToken(e);try{return await this.refreshPromise}finally{this.refreshPromise=null}}async _doRefreshToken(e){this.logger.debug("Refreshing access token");try{const t=await r.refreshAccessToken(this.authEndpoints.token,e,this.authClientId);if(t.success){this._storeRefreshedTokens(t.tokens);const i=r.extractUserInfo(t.tokens.access_token);return this.setAuthState({status:"authenticated",user:i,accessToken:t.tokens.access_token,error:null,refreshToken:null,expiresAt:null,isTokenRefresh:!0}),this.logger.info("Token refreshed successfully"),t.tokens.access_token}if(t.error==="invalid_grant")return this.logger.warn("Refresh token expired or revoked, clearing tokens and logging out"),this.clearAuthStorage(),this.setAuthState({status:"unauthenticated",user:null,accessToken:null,error:null,refreshToken:null,expiresAt:null,isTokenRefresh:!1}),null}catch(t){this.logger.warn("Token refresh failed:",t)}throw this.logger.warn("Token refresh failed, keeping tokens for manual retry"),r.createOperationError("auth_error","Access token expired and unable to refresh. Try logging out and logging in again.")}clearAuthStorage(){localStorage.removeItem(this.storageKeys.ACCESS_TOKEN),localStorage.removeItem(this.storageKeys.REFRESH_TOKEN),localStorage.removeItem(this.storageKeys.EXPIRES_AT)}_storeRefreshedTokens(e){const t=Date.now()+e.expires_in*1e3;localStorage.setItem(this.storageKeys.ACCESS_TOKEN,e.access_token),localStorage.setItem(this.storageKeys.EXPIRES_AT,String(t)),e.refresh_token&&localStorage.setItem(this.storageKeys.REFRESH_TOKEN,e.refresh_token)}async pingApi(){return this.sendApiRequest("GET","/ping")}async getServerState(){try{const e=await this.sendApiRequest("GET","/bodhi/v1/info");if(e.status>=400)return r.BACKEND_SERVER_NOT_REACHABLE;const t=e.body,i=t.version||"unknown";switch(t.status){case"ready":return{status:"ready",version:i,error:null,deployment:t.deployment??null,client_id:t.client_id??null};case"setup":return r.backendServerNotReady("setup",i,void 0,t.deployment,t.client_id);case"resource_admin":return r.backendServerNotReady("resource_admin",i,void 0,t.deployment,t.client_id);case"error":return r.backendServerNotReady("error",i,t.error?{message:t.error.message,type:t.error.type}:r.SERVER_ERROR_CODES.SERVER_NOT_READY,t.deployment,t.client_id);default:return r.BACKEND_SERVER_NOT_REACHABLE}}catch{return r.BACKEND_SERVER_NOT_REACHABLE}}async*stream(e,t,i,s,o=!0){this.ensureBodhiext();let n=s||{};if(o){const a=await this._getAccessTokenRaw();if(!a)throw r.createOperationError("auth_error","Not authenticated. Please log in first.");n={...n,Authorization:`Bearer ${a}`}}const l=this.bodhiext.sendStreamRequest(e,t,i,n).getReader();try{for(;;){const{value:a,done:h}=await l.read();if(h||a?.done)break;yield a.body}}catch(a){if(a instanceof r.BodhiApiError||a instanceof r.BodhiError)throw a;if(a instanceof Error){const h=a;throw a.name==="BodhiApiError"&&typeof h.status=="number"&&h.body!=null?new r.BodhiApiError(h.status,h.body,a.message,h.headers):a.name==="BodhiError"&&typeof h.code=="string"?new r.BodhiError(h.code,a.message):new r.BodhiError("extension_error",a.message)}throw a}finally{l.releaseLock()}}async streamText(e,t,i,s,o=!0){this.ensureBodhiext();let n={...s};if(o){const a=await this._getAccessTokenRaw();a&&(n={...n,Authorization:`Bearer ${a}`})}const c=await this.bodhiext.sendStreamText(e,t,i,n);async function*l(a){const h=a.getReader();try{for(;;){const{done:u,value:d}=await h.read();if(u)break;yield d}}finally{h.releaseLock()}}return{status:c.status,headers:c.headers,body:l(c.body)}}get chat(){return this._chat??=new r.Chat(this)}get models(){return this._models??=new r.Models(this)}get embeddings(){return this._embeddings??=new r.Embeddings(this)}get mcps(){return this._mcps??=new r.Mcps(this)}async requestAccess(e){return this.sendApiRequest("POST","/bodhi/v1/apps/request-access",e,{},!1)}async getAccessRequestStatus(e){return this.sendApiRequest("GET",`/bodhi/v1/apps/access-requests/${e}?app_client_id=${encodeURIComponent(this.authClientId)}`,void 0,{},!1)}async pollAccessRequestStatus(e,t){return r.pollAccessRequestUntilResolved(i=>this.getAccessRequestStatus(i),e,t)}async performOAuthPkce(e){const t=r.generateCodeVerifier(),i=await r.generateCodeChallenge(t),s=r.generateCodeVerifier();localStorage.setItem(this.storageKeys.CODE_VERIFIER,t),localStorage.setItem(this.storageKeys.STATE,s);const o=e.split(" ").filter(Boolean),n=new URLSearchParams({response_type:"code",client_id:this.authClientId,redirect_uri:this.config.redirectUri,scope:o.join(" "),state:s,code_challenge:i,code_challenge_method:"S256"});return window.location.href=`${this.authEndpoints.authorize}?${n}`,new Promise(()=>{})}async handleAccessRequestCallback(e){const t=await this.getAccessRequestStatus(e),{status:i,access_request_scope:s}=r.unwrapResponse(t);localStorage.removeItem(this.storageKeys.ACCESS_REQUEST_ID),i!=="approved"&&r.throwAccessRequestDenialError(i);const o=`openid profile email roles ${s??""}`.trim();return this.performOAuthPkce(o)}serialize(){return{extensionId:this.state.type==="extension"&&this.state.extension==="ready"?this.state.extensionId:void 0}}async debug(){return{type:"WindowBodhiextClient",state:this.state,authState:await this.getAuthState(),bodhiextAvailable:this.bodhiext!==null,authClientId:this.authClientId,authServerUrl:this.config.authServerUrl,redirectUri:this.config.redirectUri}}}function y(f){if(typeof window>"u")throw new Error("redirectUri required in non-browser environment");const e=f==="/"?"":f.replace(/\/$/,"");return`${window.location.origin}${e}/callback`}class A extends r.BaseFacadeClient{constructor(e,t,i){const s=t||{},o={basePath:s.basePath||"/",redirectUri:s.redirectUri||y(s.basePath||"/"),authServerUrl:s.authServerUrl||"https://id.getbodhi.app/realms/bodhi",logLevel:s.logLevel||"warn",apiTimeoutMs:s.apiTimeoutMs,storage:s.storage,initialTokens:s.initialTokens,initParams:s.initParams};super(e,o,i)}createLogger(e){return new r.Logger("WebUIClient",e.logLevel)}createStoragePrefix(e){return r.createStoragePrefixWithNamespace(e.basePath,r.STORAGE_PREFIXES.WEB)}createExtClient(e,t){return new R(this.authClientId,{authServerUrl:e.authServerUrl,redirectUri:e.redirectUri,basePath:e.basePath,logLevel:e.logLevel,apiTimeoutMs:e.apiTimeoutMs,initParams:e.initParams},t)}createDirectClient(e,t,i){return new w({authClientId:e,authServerUrl:t.authServerUrl,redirectUri:t.redirectUri,logLevel:t.logLevel,basePath:t.basePath,apiTimeoutMs:t.apiTimeoutMs,storage:t.storage,initialTokens:t.initialTokens},i)}async handleOAuthCallback(e,t){return this.connectionMode==="direct"?this.directClient.handleOAuthCallback(e,t):this.extClient.handleOAuthCallback(e,t)}async handleAccessRequestCallback(e){return this.connectionMode==="direct"?this.directClient.handleAccessRequestCallback(e):this.extClient.handleAccessRequestCallback(e)}}const k="production";Object.defineProperty(exports,"InMemoryStorage",{enumerable:!0,get:()=>r.InMemoryStorage});exports.DirectWebClient=w;exports.LocalStorageAdapter=S;exports.WEB_BUILD_MODE=k;exports.WebUIClient=A;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const r=require("@bodhiapp/bodhi-js-core");class E{async get(e){return localStorage.getItem(e)}async set(e){Object.entries(e).forEach(([t,i])=>{localStorage.setItem(t,String(i))})}async remove(e){e.forEach(t=>localStorage.removeItem(t))}}class f extends r.DirectClientBase{constructor(e,t){const i=r.createStoragePrefixWithNamespace(e.basePath,r.STORAGE_PREFIXES.WEB_DIRECT),s={authClientId:e.authClientId,authServerUrl:e.authServerUrl,storagePrefix:i,logLevel:e.logLevel,loggerPrefix:"DirectWebClient",apiTimeoutMs:e.apiTimeoutMs,storage:e.storage??new E,initialTokens:e.initialTokens};super(s,t),this.redirectUri=e.redirectUri}async login(e){const t=await this.getAuthState();if(t.status==="authenticated")return t;const i=e?.userRole??"scope_user_user",s=this.redirectUri;e?.onProgress?.("requesting");const a=r.generateCodeVerifier(),n=await r.generateCodeChallenge(a),h=r.generateCodeVerifier();await this._storageSet({[this.storageKeys.CODE_VERIFIER]:a,[this.storageKeys.STATE]:h});const c=r.buildAuthorizeUrl(this.authEndpoints,{clientId:this.authClientId,redirectUri:s,scope:r.BASE_OAUTH_SCOPE,state:h,codeChallenge:n}),o=r.buildErrorUrl(s),l=new r.AccessRequestBuilder(this.authClientId).requestedRole(i);e?.requested&&l.requested(e.requested);const d=await this.requestAccess(l.build()),{review_url:g}=r.unwrapResponse(d);return e?.onProgress?.("reviewing"),window.location.href=r.buildReviewUrl(g,c,o),new Promise(()=>{})}async handleOAuthCallback(e,t){const i=await this._storageGet(this.storageKeys.STATE);if(!i||i!==t)throw new Error("Invalid state parameter - possible CSRF attack");await this.exchangeCodeForTokens(e);const s=await this.getAuthState();if(s.status!=="authenticated")throw new Error("Login failed");return this.setAuthState(s),s}_getRedirectUri(){return this.redirectUri}}const S=500,w=5e3,T=3e4;class m{constructor(e,t,i){this.state=r.EXTENSION_STATE_NOT_INITIALIZED,this.bodhiext=null,this.refreshPromise=null,this.logger=new r.Logger("WindowBodhiextClient",t.logLevel),this.authClientId=e,this.config=t,this.authEndpoints=r.createOAuthEndpoints(this.config.authServerUrl),this.onStateChange=i??r.NOOP_STATE_CALLBACK;const s=r.createStoragePrefixWithNamespace(t.basePath,r.STORAGE_PREFIXES.WEB_EXT);this.storageKeys=r.createStorageKeys(s),this.apiTimeoutMs=t.apiTimeoutMs??T}setState(e){this.state=e,this.logger.info(`{state: ${JSON.stringify(e)}} - Setting client state`),this.onStateChange({type:"client-state",state:e})}setAuthState(e){this.onStateChange({type:"auth-state",state:e})}setStateCallback(e){this.onStateChange=e}ensureBodhiext(){if(!this.bodhiext&&window.bodhiext&&(this.logger.info("Acquiring window.bodhiext reference"),this.bodhiext=window.bodhiext),!this.bodhiext)throw r.createOperationError("not_initialized","Client not initialized")}async sendExtRequest(e,t){return this.ensureBodhiext(),this.bodhiext.sendExtRequest(e,t)}async sendApiRequest(e,t,i,s,a){this.ensureBodhiext();try{const n=new Promise((c,o)=>setTimeout(()=>o(new r.BodhiError("timeout_error",`[bodhi-js-sdk/web] network timeout: api request not completed within configured/default timeout of ${this.apiTimeoutMs}ms`)),this.apiTimeoutMs)),h=(async()=>{let c=s||{};if(a){const o=await this._getAccessTokenRaw();if(!o)throw new r.BodhiError("auth_error","Not authenticated. Please log in first.");c={...c,Authorization:`Bearer ${o}`}}return this.bodhiext.sendApiRequest(e,t,i,c)})();return await Promise.race([h,n])}catch(n){if(n instanceof r.BodhiApiError||n instanceof r.BodhiError)throw n;if(n instanceof Error){const h=n;throw n.name==="BodhiApiError"&&typeof h.status=="number"&&h.body!=null?new r.BodhiApiError(h.status,h.body,n.message,h.headers):n.name==="BodhiError"&&typeof h.code=="string"?new r.BodhiError(h.code,n.message):new r.BodhiError("network_error",n.message)}throw new r.BodhiError("network_error",String(n))}}getState(){return this.state}isClientInitialized(){return this.state.extension==="ready"}isServerReady(){return this.isClientInitialized()&&this.state.server.status==="ready"}async init(e={}){if(!e.testConnection&&!e.selectedConnection)return this.logger.info("No testConnection or selectedConnection, returning not-initialized state"),r.EXTENSION_STATE_NOT_INITIALIZED;if(this.bodhiext&&!e.testConnection)return this.logger.debug("Already have bodhiext handle, skipping polling"),this.state;if(!this.bodhiext){const s=e.timeoutMs??this.config.initParams?.extension?.timeoutMs??w,a=e.intervalMs??this.config.initParams?.extension?.intervalMs??S,n=Date.now();if(!await new Promise(c=>{const o=()=>{if(window.bodhiext){this.bodhiext=window.bodhiext,c(!0);return}if(Date.now()-n>=s){c(!1);return}setTimeout(o,a)};o()}))return this.logger.warn("Extension discovery timed out"),this.setState(r.EXTENSION_STATE_NOT_FOUND),this.state}const t=await this.bodhiext.getExtensionId();this.logger.info(`Extension discovered: ${t}`);const i={type:"extension",extension:"ready",extensionId:t,server:r.PENDING_EXTENSION_READY};if(e.testConnection)try{const s=await this.getServerState();this.setState({...i,server:s}),this.logger.info(`Server connectivity tested: ${s.status}`)}catch(s){this.logger.error("Failed to get server state:",s),this.setState({...i,server:r.BACKEND_SERVER_NOT_REACHABLE})}else this.setState(i);return this.state}async login(e){const t=await this.getAuthState();if(t.status==="authenticated")return t;this.ensureBodhiext();const i=e?.userRole??"scope_user_user",s=this.config.redirectUri;e?.onProgress?.("requesting");const a=r.generateCodeVerifier(),n=await r.generateCodeChallenge(a),h=r.generateCodeVerifier();localStorage.setItem(this.storageKeys.CODE_VERIFIER,a),localStorage.setItem(this.storageKeys.STATE,h);const c=r.buildAuthorizeUrl(this.authEndpoints,{clientId:this.authClientId,redirectUri:s,scope:r.BASE_OAUTH_SCOPE,state:h,codeChallenge:n}),o=r.buildErrorUrl(s),l=new r.AccessRequestBuilder(this.authClientId).requestedRole(i);e?.requested&&l.requested(e.requested);const d=await this.requestAccess(l.build()),{review_url:g}=r.unwrapResponse(d);return e?.onProgress?.("reviewing"),window.location.href=r.buildReviewUrl(g,c,o),new Promise(()=>{})}async handleOAuthCallback(e,t){const i=localStorage.getItem(this.storageKeys.STATE);if(!i||i!==t)throw new Error("Invalid state parameter - possible CSRF attack");await this.exchangeCodeForTokens(e),localStorage.removeItem(this.storageKeys.CODE_VERIFIER),localStorage.removeItem(this.storageKeys.STATE);const s=await this.getAuthState();if(s.status!=="authenticated")throw new Error("Login failed");return this.setAuthState(s),s}async exchangeCodeForTokens(e){const t=localStorage.getItem(this.storageKeys.CODE_VERIFIER);if(!t)throw new Error("Code verifier not found");const i=new URLSearchParams({grant_type:"authorization_code",client_id:this.authClientId,code:e,redirect_uri:this.config.redirectUri,code_verifier:t}),s=await fetch(this.authEndpoints.token,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i});if(!s.ok){const n=await s.text();throw new Error(`Token exchange failed: ${s.status} ${n}`)}const a=await s.json();if(!a.access_token)throw new Error("No access token received");if(localStorage.setItem(this.storageKeys.ACCESS_TOKEN,a.access_token),a.refresh_token&&localStorage.setItem(this.storageKeys.REFRESH_TOKEN,a.refresh_token),a.expires_in){const n=Date.now()+a.expires_in*1e3;localStorage.setItem(this.storageKeys.EXPIRES_AT,n.toString())}}async logout(){const e=localStorage.getItem(this.storageKeys.REFRESH_TOKEN);if(e)try{const i=new URLSearchParams({token:e,client_id:this.authClientId,token_type_hint:"refresh_token"});await fetch(this.authEndpoints.revoke,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i})}catch(i){this.logger.warn("Token revocation failed:",i)}localStorage.removeItem(this.storageKeys.ACCESS_TOKEN),localStorage.removeItem(this.storageKeys.REFRESH_TOKEN),localStorage.removeItem(this.storageKeys.EXPIRES_AT),localStorage.removeItem(this.storageKeys.CODE_VERIFIER),localStorage.removeItem(this.storageKeys.STATE);const t={status:"unauthenticated",user:null,accessToken:null,error:null,refreshToken:null,expiresAt:null,isTokenRefresh:!1};return this.setAuthState(t),t}async getAuthState(){const e=await this._getAccessTokenRaw();if(!e)return{status:"unauthenticated",user:null,accessToken:null,error:null,refreshToken:null,expiresAt:null,isTokenRefresh:!1};try{return{status:"authenticated",user:r.extractUserInfo(e),accessToken:e,error:null,refreshToken:null,expiresAt:null,isTokenRefresh:!1}}catch(t){return this.logger.error("Failed to parse token:",t),{status:"unauthenticated",user:null,accessToken:null,error:null,refreshToken:null,expiresAt:null,isTokenRefresh:!1}}}async _getAccessTokenRaw(){const e=localStorage.getItem(this.storageKeys.ACCESS_TOKEN),t=localStorage.getItem(this.storageKeys.EXPIRES_AT);if(!e)return null;if(t){const i=parseInt(t,10);if(Date.now()>=i-5*1e3){const s=localStorage.getItem(this.storageKeys.REFRESH_TOKEN);return s?this._tryRefreshToken(s):null}}return e}async _tryRefreshToken(e){if(this.refreshPromise)return this.logger.debug("Refresh already in progress, returning existing promise"),this.refreshPromise;this.refreshPromise=this._doRefreshToken(e);try{return await this.refreshPromise}finally{this.refreshPromise=null}}async _doRefreshToken(e){this.logger.debug("Refreshing access token");try{const t=await r.refreshAccessToken(this.authEndpoints.token,e,this.authClientId);if(t.success){this._storeRefreshedTokens(t.tokens);const i=r.extractUserInfo(t.tokens.access_token);return this.setAuthState({status:"authenticated",user:i,accessToken:t.tokens.access_token,error:null,refreshToken:null,expiresAt:null,isTokenRefresh:!0}),this.logger.info("Token refreshed successfully"),t.tokens.access_token}if(t.error==="invalid_grant")return this.logger.warn("Refresh token expired or revoked, clearing tokens and logging out"),this.clearAuthStorage(),this.setAuthState({status:"unauthenticated",user:null,accessToken:null,error:null,refreshToken:null,expiresAt:null,isTokenRefresh:!1}),null}catch(t){this.logger.warn("Token refresh failed:",t)}throw this.logger.warn("Token refresh failed, keeping tokens for manual retry"),r.createOperationError("auth_error","Access token expired and unable to refresh. Try logging out and logging in again.")}clearAuthStorage(){localStorage.removeItem(this.storageKeys.ACCESS_TOKEN),localStorage.removeItem(this.storageKeys.REFRESH_TOKEN),localStorage.removeItem(this.storageKeys.EXPIRES_AT)}_storeRefreshedTokens(e){const t=Date.now()+e.expires_in*1e3;localStorage.setItem(this.storageKeys.ACCESS_TOKEN,e.access_token),localStorage.setItem(this.storageKeys.EXPIRES_AT,String(t)),e.refresh_token&&localStorage.setItem(this.storageKeys.REFRESH_TOKEN,e.refresh_token)}async pingApi(){return this.sendApiRequest("GET","/ping")}async getServerState(){try{const e=await this.sendApiRequest("GET","/bodhi/v1/info");if(e.status>=400)return r.BACKEND_SERVER_NOT_REACHABLE;const t=e.body,i=t.version||"unknown";switch(t.status){case"ready":return{status:"ready",version:i,error:null,deployment:t.deployment??null,client_id:t.client_id??null};case"setup":return r.backendServerNotReady("setup",i,void 0,t.deployment,t.client_id);case"resource_admin":return r.backendServerNotReady("resource_admin",i,void 0,t.deployment,t.client_id);case"error":return r.backendServerNotReady("error",i,t.error?{message:t.error.message,type:t.error.type}:r.SERVER_ERROR_CODES.SERVER_NOT_READY,t.deployment,t.client_id);default:return r.BACKEND_SERVER_NOT_REACHABLE}}catch{return r.BACKEND_SERVER_NOT_REACHABLE}}async*stream(e,t,i,s,a=!0){this.ensureBodhiext();let n=s||{};if(a){const o=await this._getAccessTokenRaw();if(!o)throw r.createOperationError("auth_error","Not authenticated. Please log in first.");n={...n,Authorization:`Bearer ${o}`}}const c=this.bodhiext.sendStreamRequest(e,t,i,n).getReader();try{for(;;){const{value:o,done:l}=await c.read();if(l||o?.done)break;yield o.body}}catch(o){if(o instanceof r.BodhiApiError||o instanceof r.BodhiError)throw o;if(o instanceof Error){const l=o;throw o.name==="BodhiApiError"&&typeof l.status=="number"&&l.body!=null?new r.BodhiApiError(l.status,l.body,o.message,l.headers):o.name==="BodhiError"&&typeof l.code=="string"?new r.BodhiError(l.code,o.message):new r.BodhiError("extension_error",o.message)}throw o}finally{c.releaseLock()}}async streamText(e,t,i,s,a=!0){this.ensureBodhiext();let n={...s};if(a){const o=await this._getAccessTokenRaw();o&&(n={...n,Authorization:`Bearer ${o}`})}const h=await this.bodhiext.sendStreamText(e,t,i,n);async function*c(o){const l=o.getReader();try{for(;;){const{done:d,value:g}=await l.read();if(d)break;yield g}}finally{l.releaseLock()}}return{status:h.status,headers:h.headers,body:c(h.body)}}get chat(){return this._chat??=new r.Chat(this)}get models(){return this._models??=new r.Models(this)}get embeddings(){return this._embeddings??=new r.Embeddings(this)}get mcps(){return this._mcps??=new r.Mcps(this)}async requestAccess(e){return this.sendApiRequest("POST","/bodhi/v1/apps/request-access",e,{},!1)}serialize(){return{extensionId:this.state.type==="extension"&&this.state.extension==="ready"?this.state.extensionId:void 0}}async debug(){return{type:"WindowBodhiextClient",state:this.state,authState:await this.getAuthState(),bodhiextAvailable:this.bodhiext!==null,authClientId:this.authClientId,authServerUrl:this.config.authServerUrl,redirectUri:this.config.redirectUri}}}function _(u){if(typeof window>"u")throw new Error("redirectUri required in non-browser environment");const e=u==="/"?"":u.replace(/\/$/,"");return`${window.location.origin}${e}/callback`}class y extends r.BaseFacadeClient{constructor(e,t,i){const s=t||{},a={basePath:s.basePath||"/",redirectUri:s.redirectUri||_(s.basePath||"/"),authServerUrl:s.authServerUrl||"https://id.getbodhi.app/realms/bodhi",logLevel:s.logLevel||"warn",apiTimeoutMs:s.apiTimeoutMs,storage:s.storage,initialTokens:s.initialTokens,initParams:s.initParams};super(e,a,i)}createLogger(e){return new r.Logger("WebUIClient",e.logLevel)}createStoragePrefix(e){return r.createStoragePrefixWithNamespace(e.basePath,r.STORAGE_PREFIXES.WEB)}createExtClient(e,t){return new m(this.authClientId,{authServerUrl:e.authServerUrl,redirectUri:e.redirectUri,basePath:e.basePath,logLevel:e.logLevel,apiTimeoutMs:e.apiTimeoutMs,initParams:e.initParams},t)}createDirectClient(e,t,i){return new f({authClientId:e,authServerUrl:t.authServerUrl,redirectUri:t.redirectUri,logLevel:t.logLevel,basePath:t.basePath,apiTimeoutMs:t.apiTimeoutMs,storage:t.storage,initialTokens:t.initialTokens},i)}async handleOAuthCallback(e,t){return this.connectionMode==="direct"?this.directClient.handleOAuthCallback(e,t):this.extClient.handleOAuthCallback(e,t)}}const A="production";Object.defineProperty(exports,"InMemoryStorage",{enumerable:!0,get:()=>r.InMemoryStorage});exports.DirectWebClient=f;exports.LocalStorageAdapter=E;exports.WEB_BUILD_MODE=A;exports.WebUIClient=y;

package/dist/bodhi-web.esm.js

@@ -1,34 +1,34 @@
-import { DirectClientBase as O, createStoragePrefixWithNamespace as A, STORAGE_PREFIXES as k, AccessRequestBuilder as C, unwrapResponse as S, openPopupReview as b, DEFAULT_POLL_TIMEOUT_MS as x, DEFAULT_POLL_INTERVAL_MS as P, throwAccessRequestDenialError as E, generateCodeVerifier as _, generateCodeChallenge as U, EXTENSION_STATE_NOT_INITIALIZED as v, Logger as q, createOAuthEndpoints as K, NOOP_STATE_CALLBACK as L, createStorageKeys as M, createOperationError as y, BodhiError as u, BodhiApiError as w, EXTENSION_STATE_NOT_FOUND as D, PENDING_EXTENSION_READY as N, BACKEND_SERVER_NOT_REACHABLE as m, extractUserInfo as I, refreshAccessToken as B, backendServerNotReady as R, SERVER_ERROR_CODES as F, Chat as $, Models as z, Embeddings as V, Mcps as W, pollAccessRequestUntilResolved as H, BaseFacadeClient as X } from "@bodhiapp/bodhi-js-core";
-import { InMemoryStorage as ae } from "@bodhiapp/bodhi-js-core";
-class G {
+import { DirectClientBase as P, createStoragePrefixWithNamespace as T, STORAGE_PREFIXES as y, generateCodeVerifier as S, generateCodeChallenge as k, buildAuthorizeUrl as R, BASE_OAUTH_SCOPE as A, buildErrorUrl as I, AccessRequestBuilder as x, unwrapResponse as b, buildReviewUrl as C, EXTENSION_STATE_NOT_INITIALIZED as _, Logger as v, createOAuthEndpoints as U, NOOP_STATE_CALLBACK as O, createStorageKeys as K, createOperationError as E, BodhiError as c, BodhiApiError as f, EXTENSION_STATE_NOT_FOUND as N, PENDING_EXTENSION_READY as B, BACKEND_SERVER_NOT_REACHABLE as w, extractUserInfo as p, refreshAccessToken as q, backendServerNotReady as m, SERVER_ERROR_CODES as L, Chat as D, Models as M, Embeddings as F, Mcps as z, BaseFacadeClient as V } from "@bodhiapp/bodhi-js-core";
+import { InMemoryStorage as re } from "@bodhiapp/bodhi-js-core";
+class W {
   async get(e) {
     return localStorage.getItem(e);
   }
   async set(e) {
-    Object.entries(e).forEach(([t, r]) => {
-      localStorage.setItem(t, String(r));
+    Object.entries(e).forEach(([t, s]) => {
+      localStorage.setItem(t, String(s));
     });
   }
   async remove(e) {
     e.forEach((t) => localStorage.removeItem(t));
   }
 }
-class j extends O {
+class $ extends P {
   constructor(e, t) {
-    const r = A(
+    const s = T(
       e.basePath,
-      k.WEB_DIRECT
-    ), s = {
+      y.WEB_DIRECT
+    ), r = {
       authClientId: e.authClientId,
       authServerUrl: e.authServerUrl,
-      storagePrefix: r,
+      storagePrefix: s,
       logLevel: e.logLevel,
       loggerPrefix: "DirectWebClient",
       apiTimeoutMs: e.apiTimeoutMs,
-      storage: e.storage ?? new G(),
+      storage: e.storage ?? new W(),
       initialTokens: e.initialTokens
     };
-    super(s, t), this.redirectUri = e.redirectUri;
+    super(r, t), this.redirectUri = e.redirectUri;
   }
   // ============================================================================
   // Authentication (Browser Redirect OAuth)
@@ -37,67 +37,45 @@ class j extends O {
     const t = await this.getAuthState();
     if (t.status === "authenticated")
       return t;
-    const r = e?.userRole ?? "scope_user_user", s = e?.flowType ?? "popup";
+    const s = e?.userRole ?? "scope_user_user", r = this.redirectUri;
     e?.onProgress?.("requesting");
-    const i = new C(this.authClientId).requestedRole(r).flowType(s);
-    if (e?.requested && i.requested(e.requested), s === "redirect") {
-      const d = e?.redirectUrl ?? this.redirectUri;
-      i.redirectUrl(d);
-    }
-    const a = i.build(), n = await this.requestAccess(a), { id: c, review_url: o } = S(n);
-    e?.onProgress?.("reviewing");
-    let l;
-    if (s === "popup") {
-      const h = await b(o, async () => {
-        const p = await this.getAccessRequestStatus(c);
-        if (p.status >= 400) return null;
-        const { status: g, access_request_scope: T } = p.body;
-        return g === "approved" ? { approved: !0, accessRequestScope: T ?? void 0 } : ["denied", "failed", "expired"].includes(g) ? { approved: !1, status: g } : null;
-      }, {
-        intervalMs: e?.pollIntervalMs ?? P,
-        timeoutMs: e?.pollTimeoutMs ?? x
-      });
-      h.approved || E(h.status ?? "unknown"), l = h.accessRequestScope;
-    } else
-      return await this._storageSet({ [this.storageKeys.ACCESS_REQUEST_ID]: c }), window.location.href = o, new Promise(() => {
-      });
-    return e?.onProgress?.("authenticating"), this.performOAuthPkce(`openid profile email roles ${l ?? ""}`.trim());
-  }
-  async performOAuthPkce(e) {
-    const t = _(), r = await U(t), s = _();
+    const n = S(), o = await k(n), a = S();
     await this._storageSet({
-      [this.storageKeys.CODE_VERIFIER]: t,
-      [this.storageKeys.STATE]: s
+      [this.storageKeys.CODE_VERIFIER]: n,
+      [this.storageKeys.STATE]: a
+    });
+    const l = R(this.authEndpoints, {
+      clientId: this.authClientId,
+      redirectUri: r,
+      scope: A,
+      state: a,
+      codeChallenge: o
+    }), i = I(r), h = new x(this.authClientId).requestedRole(s);
+    e?.requested && h.requested(e.requested);
+    const d = await this.requestAccess(h.build()), { review_url: g } = b(d);
+    return e?.onProgress?.("reviewing"), window.location.href = C(g, l, i), new Promise(() => {
     });
-    const i = new URL(this.authEndpoints.authorize);
-    throw i.searchParams.set("client_id", this.authClientId), i.searchParams.set("response_type", "code"), i.searchParams.set("redirect_uri", this.redirectUri), i.searchParams.set("scope", e), i.searchParams.set("code_challenge", r), i.searchParams.set("code_challenge_method", "S256"), i.searchParams.set("state", s), window.location.href = i.toString(), new Error("Redirect initiated");
   }
   async handleOAuthCallback(e, t) {
-    const r = await this._storageGet(this.storageKeys.STATE);
-    if (!r || r !== t)
+    const s = await this._storageGet(this.storageKeys.STATE);
+    if (!s || s !== t)
       throw new Error("Invalid state parameter - possible CSRF attack");
     await this.exchangeCodeForTokens(e);
-    const s = await this.getAuthState();
-    if (s.status !== "authenticated")
+    const r = await this.getAuthState();
+    if (r.status !== "authenticated")
       throw new Error("Login failed");
-    return this.setAuthState(s), s;
-  }
-  async handleAccessRequestCallback(e) {
-    const t = await this.getAccessRequestStatus(e), { status: r, access_request_scope: s } = S(t);
-    await this._storageRemove([this.storageKeys.ACCESS_REQUEST_ID]), r !== "approved" && E(r);
-    const i = `openid profile email roles ${s ?? ""}`.trim();
-    return this.performOAuthPkce(i);
+    return this.setAuthState(r), r;
   }
   _getRedirectUri() {
     return this.redirectUri;
   }
 }
-const Q = 500, Y = 5e3, J = 3e4;
-class Z {
-  constructor(e, t, r) {
-    this.state = v, this.bodhiext = null, this.refreshPromise = null, this.logger = new q("WindowBodhiextClient", t.logLevel), this.authClientId = e, this.config = t, this.authEndpoints = K(this.config.authServerUrl), this.onStateChange = r ?? L;
-    const s = A(t.basePath, k.WEB_EXT);
-    this.storageKeys = M(s), this.apiTimeoutMs = t.apiTimeoutMs ?? J;
+const H = 500, X = 5e3, G = 3e4;
+class j {
+  constructor(e, t, s) {
+    this.state = _, this.bodhiext = null, this.refreshPromise = null, this.logger = new v("WindowBodhiextClient", t.logLevel), this.authClientId = e, this.config = t, this.authEndpoints = U(this.config.authServerUrl), this.onStateChange = s ?? O;
+    const r = T(t.basePath, y.WEB_EXT);
+    this.storageKeys = K(r), this.apiTimeoutMs = t.apiTimeoutMs ?? G;
   }
   /**
    * Set client state and notify callback
@@ -126,7 +104,7 @@ class Z {
    */
   ensureBodhiext() {
     if (!this.bodhiext && window.bodhiext && (this.logger.info("Acquiring window.bodhiext reference"), this.bodhiext = window.bodhiext), !this.bodhiext)
-      throw y("not_initialized", "Client not initialized");
+      throw E("not_initialized", "Client not initialized");
   }
   /**
    * Send extension request via window.bodhiext.sendExtRequest
@@ -138,45 +116,45 @@ class Z {
    * Send API message via window.bodhiext.sendApiRequest
    * @throws BodhiError on operational errors (extension not ready, auth, network, timeout)
    */
-  async sendApiRequest(e, t, r, s, i) {
+  async sendApiRequest(e, t, s, r, n) {
     this.ensureBodhiext();
     try {
-      const a = new Promise(
-        (c, o) => setTimeout(
-          () => o(
-            new u(
+      const o = new Promise(
+        (l, i) => setTimeout(
+          () => i(
+            new c(
               "timeout_error",
               `[bodhi-js-sdk/web] network timeout: api request not completed within configured/default timeout of ${this.apiTimeoutMs}ms`
             )
           ),
           this.apiTimeoutMs
         )
-      ), n = (async () => {
-        let c = s || {};
-        if (i) {
-          const o = await this._getAccessTokenRaw();
-          if (!o)
-            throw new u("auth_error", "Not authenticated. Please log in first.");
-          c = {
-            ...c,
-            Authorization: `Bearer ${o}`
+      ), a = (async () => {
+        let l = r || {};
+        if (n) {
+          const i = await this._getAccessTokenRaw();
+          if (!i)
+            throw new c("auth_error", "Not authenticated. Please log in first.");
+          l = {
+            ...l,
+            Authorization: `Bearer ${i}`
           };
         }
-        return this.bodhiext.sendApiRequest(e, t, r, c);
+        return this.bodhiext.sendApiRequest(e, t, s, l);
       })();
-      return await Promise.race([n, a]);
-    } catch (a) {
-      if (a instanceof w || a instanceof u) throw a;
-      if (a instanceof Error) {
-        const n = a;
-        throw a.name === "BodhiApiError" && typeof n.status == "number" && n.body != null ? new w(
-          n.status,
-          n.body,
-          a.message,
-          n.headers
-        ) : a.name === "BodhiError" && typeof n.code == "string" ? new u(n.code, a.message) : new u("network_error", a.message);
+      return await Promise.race([a, o]);
+    } catch (o) {
+      if (o instanceof f || o instanceof c) throw o;
+      if (o instanceof Error) {
+        const a = o;
+        throw o.name === "BodhiApiError" && typeof a.status == "number" && a.body != null ? new f(
+          a.status,
+          a.body,
+          o.message,
+          a.headers
+        ) : o.name === "BodhiError" && typeof a.code == "string" ? new c(a.code, o.message) : new c("network_error", o.message);
       }
-      throw new u("network_error", String(a));
+      throw new c("network_error", String(o));
     }
   }
   /**
@@ -200,44 +178,44 @@ class Z {
    */
   async init(e = {}) {
     if (!e.testConnection && !e.selectedConnection)
-      return this.logger.info("No testConnection or selectedConnection, returning not-initialized state"), v;
+      return this.logger.info("No testConnection or selectedConnection, returning not-initialized state"), _;
     if (this.bodhiext && !e.testConnection)
       return this.logger.debug("Already have bodhiext handle, skipping polling"), this.state;
     if (!this.bodhiext) {
-      const s = e.timeoutMs ?? this.config.initParams?.extension?.timeoutMs ?? Y, i = e.intervalMs ?? this.config.initParams?.extension?.intervalMs ?? Q, a = Date.now();
-      if (!await new Promise((c) => {
-        const o = () => {
+      const r = e.timeoutMs ?? this.config.initParams?.extension?.timeoutMs ?? X, n = e.intervalMs ?? this.config.initParams?.extension?.intervalMs ?? H, o = Date.now();
+      if (!await new Promise((l) => {
+        const i = () => {
           if (window.bodhiext) {
-            this.bodhiext = window.bodhiext, c(!0);
+            this.bodhiext = window.bodhiext, l(!0);
             return;
           }
-          if (Date.now() - a >= s) {
-            c(!1);
+          if (Date.now() - o >= r) {
+            l(!1);
             return;
           }
-          setTimeout(o, i);
+          setTimeout(i, n);
         };
-        o();
+        i();
       }))
-        return this.logger.warn("Extension discovery timed out"), this.setState(D), this.state;
+        return this.logger.warn("Extension discovery timed out"), this.setState(N), this.state;
     }
     const t = await this.bodhiext.getExtensionId();
     this.logger.info(`Extension discovered: ${t}`);
-    const r = {
+    const s = {
       type: "extension",
       extension: "ready",
       extensionId: t,
-      server: N
+      server: B
     };
     if (e.testConnection)
       try {
-        const s = await this.getServerState();
-        this.setState({ ...r, server: s }), this.logger.info(`Server connectivity tested: ${s.status}`);
-      } catch (s) {
-        this.logger.error("Failed to get server state:", s), this.setState({ ...r, server: m });
+        const r = await this.getServerState();
+        this.setState({ ...s, server: r }), this.logger.info(`Server connectivity tested: ${r.status}`);
+      } catch (r) {
+        this.logger.error("Failed to get server state:", r), this.setState({ ...s, server: w });
       }
     else
-      this.setState(r);
+      this.setState(s);
     return this.state;
   }
   // ============================================================================
@@ -253,31 +231,21 @@ class Z {
     if (t.status === "authenticated")
       return t;
     this.ensureBodhiext();
-    const r = e?.userRole ?? "scope_user_user", s = e?.flowType ?? "popup";
+    const s = e?.userRole ?? "scope_user_user", r = this.config.redirectUri;
     e?.onProgress?.("requesting");
-    const i = new C(this.authClientId).requestedRole(r).flowType(s);
-    if (e?.requested && i.requested(e.requested), s === "redirect") {
-      const d = e?.redirectUrl ?? this.config.redirectUri;
-      i.redirectUrl(d);
-    }
-    const a = i.build(), n = await this.requestAccess(a), { id: c, review_url: o } = S(n);
-    e?.onProgress?.("reviewing");
-    let l;
-    if (s === "popup") {
-      const h = await b(o, async () => {
-        const p = await this.getAccessRequestStatus(c);
-        if (p.status >= 400) return null;
-        const { status: g, access_request_scope: T } = p.body;
-        return g === "approved" ? { approved: !0, accessRequestScope: T ?? void 0 } : ["denied", "failed", "expired"].includes(g) ? { approved: !1, status: g } : null;
-      }, {
-        intervalMs: e?.pollIntervalMs ?? P,
-        timeoutMs: e?.pollTimeoutMs ?? x
-      });
-      h.approved || E(h.status ?? "unknown"), l = h.accessRequestScope;
-    } else
-      return localStorage.setItem(this.storageKeys.ACCESS_REQUEST_ID, c), window.location.href = o, new Promise(() => {
-      });
-    return e?.onProgress?.("authenticating"), this.performOAuthPkce(`openid profile email roles ${l ?? ""}`.trim());
+    const n = S(), o = await k(n), a = S();
+    localStorage.setItem(this.storageKeys.CODE_VERIFIER, n), localStorage.setItem(this.storageKeys.STATE, a);
+    const l = R(this.authEndpoints, {
+      clientId: this.authClientId,
+      redirectUri: r,
+      scope: A,
+      state: a,
+      codeChallenge: o
+    }), i = I(r), h = new x(this.authClientId).requestedRole(s);
+    e?.requested && h.requested(e.requested);
+    const d = await this.requestAccess(h.build()), { review_url: g } = b(d);
+    return e?.onProgress?.("reviewing"), window.location.href = C(g, l, i), new Promise(() => {
+    });
   }
   /**
    * Handle OAuth callback with authorization code
@@ -285,14 +253,14 @@ class Z {
    * @returns AuthState with login state and user info
    */
   async handleOAuthCallback(e, t) {
-    const r = localStorage.getItem(this.storageKeys.STATE);
-    if (!r || r !== t)
+    const s = localStorage.getItem(this.storageKeys.STATE);
+    if (!s || s !== t)
       throw new Error("Invalid state parameter - possible CSRF attack");
     await this.exchangeCodeForTokens(e), localStorage.removeItem(this.storageKeys.CODE_VERIFIER), localStorage.removeItem(this.storageKeys.STATE);
-    const s = await this.getAuthState();
-    if (s.status !== "authenticated")
+    const r = await this.getAuthState();
+    if (r.status !== "authenticated")
       throw new Error("Login failed");
-    return this.setAuthState(s), s;
+    return this.setAuthState(r), r;
   }
   /**
    * Exchange authorization code for tokens
@@ -301,29 +269,29 @@ class Z {
     const t = localStorage.getItem(this.storageKeys.CODE_VERIFIER);
     if (!t)
       throw new Error("Code verifier not found");
-    const r = new URLSearchParams({
+    const s = new URLSearchParams({
       grant_type: "authorization_code",
       client_id: this.authClientId,
       code: e,
       redirect_uri: this.config.redirectUri,
       code_verifier: t
-    }), s = await fetch(this.authEndpoints.token, {
+    }), r = await fetch(this.authEndpoints.token, {
       method: "POST",
       headers: {
         "Content-Type": "application/x-www-form-urlencoded"
       },
-      body: r
+      body: s
     });
-    if (!s.ok) {
-      const a = await s.text();
-      throw new Error(`Token exchange failed: ${s.status} ${a}`);
+    if (!r.ok) {
+      const o = await r.text();
+      throw new Error(`Token exchange failed: ${r.status} ${o}`);
     }
-    const i = await s.json();
-    if (!i.access_token)
+    const n = await r.json();
+    if (!n.access_token)
       throw new Error("No access token received");
-    if (localStorage.setItem(this.storageKeys.ACCESS_TOKEN, i.access_token), i.refresh_token && localStorage.setItem(this.storageKeys.REFRESH_TOKEN, i.refresh_token), i.expires_in) {
-      const a = Date.now() + i.expires_in * 1e3;
-      localStorage.setItem(this.storageKeys.EXPIRES_AT, a.toString());
+    if (localStorage.setItem(this.storageKeys.ACCESS_TOKEN, n.access_token), n.refresh_token && localStorage.setItem(this.storageKeys.REFRESH_TOKEN, n.refresh_token), n.expires_in) {
+      const o = Date.now() + n.expires_in * 1e3;
+      localStorage.setItem(this.storageKeys.EXPIRES_AT, o.toString());
     }
   }
   /**
@@ -334,7 +302,7 @@ class Z {
     const e = localStorage.getItem(this.storageKeys.REFRESH_TOKEN);
     if (e)
       try {
-        const r = new URLSearchParams({
+        const s = new URLSearchParams({
           token: e,
           client_id: this.authClientId,
           token_type_hint: "refresh_token"
@@ -344,10 +312,10 @@ class Z {
           headers: {
             "Content-Type": "application/x-www-form-urlencoded"
           },
-          body: r
+          body: s
         });
-      } catch (r) {
-        this.logger.warn("Token revocation failed:", r);
+      } catch (s) {
+        this.logger.warn("Token revocation failed:", s);
       }
     localStorage.removeItem(this.storageKeys.ACCESS_TOKEN), localStorage.removeItem(this.storageKeys.REFRESH_TOKEN), localStorage.removeItem(this.storageKeys.EXPIRES_AT), localStorage.removeItem(this.storageKeys.CODE_VERIFIER), localStorage.removeItem(this.storageKeys.STATE);
     const t = {
@@ -379,7 +347,7 @@ class Z {
     try {
       return {
         status: "authenticated",
-        user: I(e),
+        user: p(e),
         accessToken: e,
         error: null,
         refreshToken: null,
@@ -407,10 +375,10 @@ class Z {
     if (!e)
       return null;
     if (t) {
-      const r = parseInt(t, 10);
-      if (Date.now() >= r - 5 * 1e3) {
-        const s = localStorage.getItem(this.storageKeys.REFRESH_TOKEN);
-        return s ? this._tryRefreshToken(s) : null;
+      const s = parseInt(t, 10);
+      if (Date.now() >= s - 5 * 1e3) {
+        const r = localStorage.getItem(this.storageKeys.REFRESH_TOKEN);
+        return r ? this._tryRefreshToken(r) : null;
       }
     }
     return e;
@@ -435,17 +403,17 @@ class Z {
   async _doRefreshToken(e) {
     this.logger.debug("Refreshing access token");
     try {
-      const t = await B(
+      const t = await q(
         this.authEndpoints.token,
         e,
         this.authClientId
       );
       if (t.success) {
         this._storeRefreshedTokens(t.tokens);
-        const r = I(t.tokens.access_token);
+        const s = p(t.tokens.access_token);
         return this.setAuthState({
           status: "authenticated",
-          user: r,
+          user: s,
           accessToken: t.tokens.access_token,
           error: null,
           refreshToken: null,
@@ -466,7 +434,7 @@ class Z {
     } catch (t) {
       this.logger.warn("Token refresh failed:", t);
     }
-    throw this.logger.warn("Token refresh failed, keeping tokens for manual retry"), y(
+    throw this.logger.warn("Token refresh failed, keeping tokens for manual retry"), E(
       "auth_error",
       "Access token expired and unable to refresh. Try logging out and logging in again."
     );
@@ -495,86 +463,86 @@ class Z {
     try {
       const e = await this.sendApiRequest("GET", "/bodhi/v1/info");
       if (e.status >= 400)
-        return m;
-      const t = e.body, r = t.version || "unknown";
+        return w;
+      const t = e.body, s = t.version || "unknown";
       switch (t.status) {
         case "ready":
           return {
             status: "ready",
-            version: r,
+            version: s,
             error: null,
             deployment: t.deployment ?? null,
             client_id: t.client_id ?? null
           };
         case "setup":
-          return R(
+          return m(
             "setup",
-            r,
+            s,
             void 0,
             t.deployment,
             t.client_id
           );
         case "resource_admin":
-          return R(
+          return m(
             "resource_admin",
-            r,
+            s,
             void 0,
             t.deployment,
             t.client_id
           );
         case "error":
-          return R(
+          return m(
             "error",
-            r,
-            t.error ? { message: t.error.message, type: t.error.type } : F.SERVER_NOT_READY,
+            s,
+            t.error ? { message: t.error.message, type: t.error.type } : L.SERVER_NOT_READY,
             t.deployment,
             t.client_id
           );
         default:
-          return m;
+          return w;
       }
     } catch {
-      return m;
+      return w;
     }
   }
   /**
    * Generic streaming via window.bodhiext.sendStreamRequest
    * Wraps ReadableStream as AsyncGenerator
    */
-  async *stream(e, t, r, s, i = !0) {
+  async *stream(e, t, s, r, n = !0) {
     this.ensureBodhiext();
-    let a = s || {};
-    if (i) {
-      const o = await this._getAccessTokenRaw();
-      if (!o)
-        throw y("auth_error", "Not authenticated. Please log in first.");
-      a = {
-        ...a,
-        Authorization: `Bearer ${o}`
+    let o = r || {};
+    if (n) {
+      const i = await this._getAccessTokenRaw();
+      if (!i)
+        throw E("auth_error", "Not authenticated. Please log in first.");
+      o = {
+        ...o,
+        Authorization: `Bearer ${i}`
       };
     }
-    const c = this.bodhiext.sendStreamRequest(e, t, r, a).getReader();
+    const l = this.bodhiext.sendStreamRequest(e, t, s, o).getReader();
     try {
       for (; ; ) {
-        const { value: o, done: l } = await c.read();
-        if (l || o?.done)
+        const { value: i, done: h } = await l.read();
+        if (h || i?.done)
           break;
-        yield o.body;
+        yield i.body;
       }
-    } catch (o) {
-      if (o instanceof w || o instanceof u) throw o;
-      if (o instanceof Error) {
-        const l = o;
-        throw o.name === "BodhiApiError" && typeof l.status == "number" && l.body != null ? new w(
-          l.status,
-          l.body,
-          o.message,
-          l.headers
-        ) : o.name === "BodhiError" && typeof l.code == "string" ? new u(l.code, o.message) : new u("extension_error", o.message);
+    } catch (i) {
+      if (i instanceof f || i instanceof c) throw i;
+      if (i instanceof Error) {
+        const h = i;
+        throw i.name === "BodhiApiError" && typeof h.status == "number" && h.body != null ? new f(
+          h.status,
+          h.body,
+          i.message,
+          h.headers
+        ) : i.name === "BodhiError" && typeof h.code == "string" ? new c(h.code, i.message) : new c("extension_error", i.message);
       }
-      throw o;
+      throw i;
     } finally {
-      c.releaseLock();
+      l.releaseLock();
     }
   }
   /**
@@ -582,49 +550,49 @@ class Z {
    * Returns status, headers, and async generator of raw text chunks.
    * No SSE/JSON parsing. Non-2xx responses are returned as data (not thrown).
    */
-  async streamText(e, t, r, s, i = !0) {
+  async streamText(e, t, s, r, n = !0) {
     this.ensureBodhiext();
-    let a = { ...s };
-    if (i) {
-      const o = await this._getAccessTokenRaw();
-      o && (a = {
-        ...a,
-        Authorization: `Bearer ${o}`
+    let o = { ...r };
+    if (n) {
+      const i = await this._getAccessTokenRaw();
+      i && (o = {
+        ...o,
+        Authorization: `Bearer ${i}`
       });
     }
-    const n = await this.bodhiext.sendStreamText(e, t, r, a);
-    async function* c(o) {
-      const l = o.getReader();
+    const a = await this.bodhiext.sendStreamText(e, t, s, o);
+    async function* l(i) {
+      const h = i.getReader();
       try {
         for (; ; ) {
-          const { done: d, value: h } = await l.read();
+          const { done: d, value: g } = await h.read();
           if (d) break;
-          yield h;
+          yield g;
         }
       } finally {
-        l.releaseLock();
+        h.releaseLock();
       }
     }
     return {
-      status: n.status,
-      headers: n.headers,
-      body: c(n.body)
+      status: a.status,
+      headers: a.headers,
+      body: l(a.body)
     };
   }
   // ============================================================================
   // OpenAI-Compatible Namespaced API
   // ============================================================================
   get chat() {
-    return this._chat ??= new $(this);
+    return this._chat ??= new D(this);
   }
   get models() {
-    return this._models ??= new z(this);
+    return this._models ??= new M(this);
   }
   get embeddings() {
-    return this._embeddings ??= new V(this);
+    return this._embeddings ??= new F(this);
   }
   get mcps() {
-    return this._mcps ??= new W(this);
+    return this._mcps ??= new z(this);
   }
   // ============================================================================
   // Access Request Methods
@@ -638,43 +606,6 @@ class Z {
       !1
     );
   }
-  async getAccessRequestStatus(e) {
-    return this.sendApiRequest(
-      "GET",
-      `/bodhi/v1/apps/access-requests/${e}?app_client_id=${encodeURIComponent(this.authClientId)}`,
-      void 0,
-      {},
-      !1
-    );
-  }
-  async pollAccessRequestStatus(e, t) {
-    return H(
-      (r) => this.getAccessRequestStatus(r),
-      e,
-      t
-    );
-  }
-  async performOAuthPkce(e) {
-    const t = _(), r = await U(t), s = _();
-    localStorage.setItem(this.storageKeys.CODE_VERIFIER, t), localStorage.setItem(this.storageKeys.STATE, s);
-    const i = e.split(" ").filter(Boolean), a = new URLSearchParams({
-      response_type: "code",
-      client_id: this.authClientId,
-      redirect_uri: this.config.redirectUri,
-      scope: i.join(" "),
-      state: s,
-      code_challenge: r,
-      code_challenge_method: "S256"
-    });
-    return window.location.href = `${this.authEndpoints.authorize}?${a}`, new Promise(() => {
-    });
-  }
-  async handleAccessRequestCallback(e) {
-    const t = await this.getAccessRequestStatus(e), { status: r, access_request_scope: s } = S(t);
-    localStorage.removeItem(this.storageKeys.ACCESS_REQUEST_ID), r !== "approved" && E(r);
-    const i = `openid profile email roles ${s ?? ""}`.trim();
-    return this.performOAuthPkce(i);
-  }
   /**
    * Serialize web extension client state (all transient, nothing to persist)
    */
@@ -698,34 +629,34 @@ class Z {
     };
   }
 }
-function ee(f) {
+function Y(u) {
   if (typeof window > "u")
     throw new Error("redirectUri required in non-browser environment");
-  const e = f === "/" ? "" : f.replace(/\/$/, "");
+  const e = u === "/" ? "" : u.replace(/\/$/, "");
   return `${window.location.origin}${e}/callback`;
 }
-class se extends X {
-  constructor(e, t, r) {
-    const s = t || {}, i = {
-      basePath: s.basePath || "/",
-      redirectUri: s.redirectUri || ee(s.basePath || "/"),
-      authServerUrl: s.authServerUrl || "https://id.getbodhi.app/realms/bodhi",
-      logLevel: s.logLevel || "warn",
-      apiTimeoutMs: s.apiTimeoutMs,
-      storage: s.storage,
-      initialTokens: s.initialTokens,
-      initParams: s.initParams
+class Z extends V {
+  constructor(e, t, s) {
+    const r = t || {}, n = {
+      basePath: r.basePath || "/",
+      redirectUri: r.redirectUri || Y(r.basePath || "/"),
+      authServerUrl: r.authServerUrl || "https://id.getbodhi.app/realms/bodhi",
+      logLevel: r.logLevel || "warn",
+      apiTimeoutMs: r.apiTimeoutMs,
+      storage: r.storage,
+      initialTokens: r.initialTokens,
+      initParams: r.initParams
     };
-    super(e, i, r);
+    super(e, n, s);
   }
   createLogger(e) {
-    return new q("WebUIClient", e.logLevel);
+    return new v("WebUIClient", e.logLevel);
   }
   createStoragePrefix(e) {
-    return A(e.basePath, k.WEB);
+    return T(e.basePath, y.WEB);
   }
   createExtClient(e, t) {
-    return new Z(
+    return new j(
       this.authClientId,
       {
         authServerUrl: e.authServerUrl,
@@ -738,8 +669,8 @@ class se extends X {
       t
     );
   }
-  createDirectClient(e, t, r) {
-    return new j(
+  createDirectClient(e, t, s) {
+    return new $(
       {
         authClientId: e,
         authServerUrl: t.authServerUrl,
@@ -750,7 +681,7 @@ class se extends X {
         storage: t.storage,
         initialTokens: t.initialTokens
       },
-      r
+      s
     );
   }
   // ============================================================================
@@ -759,15 +690,12 @@ class se extends X {
   async handleOAuthCallback(e, t) {
     return this.connectionMode === "direct" ? this.directClient.handleOAuthCallback(e, t) : this.extClient.handleOAuthCallback(e, t);
   }
-  async handleAccessRequestCallback(e) {
-    return this.connectionMode === "direct" ? this.directClient.handleAccessRequestCallback(e) : this.extClient.handleAccessRequestCallback(e);
-  }
 }
-const re = "production";
+const Q = "production";
 export {
-  j as DirectWebClient,
-  ae as InMemoryStorage,
-  G as LocalStorageAdapter,
-  re as WEB_BUILD_MODE,
-  se as WebUIClient
+  $ as DirectWebClient,
+  re as InMemoryStorage,
+  W as LocalStorageAdapter,
+  Q as WEB_BUILD_MODE,
+  Z as WebUIClient
 };

package/dist/direct-client.d.ts

@@ -19,8 +19,6 @@ export declare class DirectWebClient extends DirectClientBase {
     private redirectUri;
     constructor(config: DirectWebClientConfig, onStateChange?: StateChangeCallback);
     login(options?: LoginOptions): Promise<AuthState>;
-    protected performOAuthPkce(scope: string): Promise<AuthState>;
     handleOAuthCallback(code: string, state: string): Promise<AuthState>;
-    handleAccessRequestCallback(requestId: string): Promise<AuthState>;
     protected _getRedirectUri(): string;
 }

package/dist/ext-client.d.ts

@@ -1,4 +1,4 @@
-import { AccessRequestStatusResponse, CreateAccessRequest, CreateAccessRequestResponse, PingResponse } from '@bodhiapp/ts-client';
+import { CreateAccessRequest, CreateAccessRequestResponse, PingResponse } from '@bodhiapp/ts-client';
 import { Chat, Models, Embeddings, Mcps, AuthState, BackendServerState, ClientState, ExtensionState, IExtensionClient, InitParams, LoginOptions, LogLevel, StateChangeCallback, StreamTextResult } from '@bodhiapp/bodhi-js-core';
 import { ApiResponse } from '@bodhiapp/bodhi-browser-types';
 export type SerializedWebExtensionState = {
@@ -155,13 +155,6 @@ export declare class WindowBodhiextClient implements IExtensionClient {
     get embeddings(): Embeddings;
     get mcps(): Mcps;
     requestAccess(body: CreateAccessRequest): Promise<ApiResponse<CreateAccessRequestResponse>>;
-    getAccessRequestStatus(requestId: string): Promise<ApiResponse<AccessRequestStatusResponse>>;
-    pollAccessRequestStatus(requestId: string, options?: {
-        intervalMs?: number;
-        timeoutMs?: number;
-    }): Promise<AccessRequestStatusResponse>;
-    private performOAuthPkce;
-    handleAccessRequestCallback(requestId: string): Promise<AuthState>;
     /**
      * Serialize web extension client state (all transient, nothing to persist)
      */

package/dist/facade-client.d.ts

@@ -52,5 +52,4 @@ export declare class WebUIClient extends BaseFacadeClient<WebClientConfig, Windo
     protected createExtClient(config: WebClientConfig, onStateChange: (change: StateChange) => void): WindowBodhiextClient;
     protected createDirectClient(authClientId: string, config: WebClientConfig, onStateChange: (change: StateChange) => void): DirectWebClient;
     handleOAuthCallback(code: string, state: string): Promise<AuthState>;
-    handleAccessRequestCallback(requestId: string): Promise<AuthState>;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bodhiapp/bodhi-js",
-  "version": "0.0.38",
+  "version": "0.0.40",
   "description": "Web SDK for Bodhi Browser - window.bodhiext communication",
   "type": "module",
   "main": "dist/bodhi-web.cjs.js",
@@ -37,9 +37,9 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@bodhiapp/bodhi-browser-types": "0.0.38",
-    "@bodhiapp/bodhi-js-core": "0.0.38",
-    "@bodhiapp/ts-client": "0.1.32"
+    "@bodhiapp/bodhi-browser-types": "0.0.40",
+    "@bodhiapp/bodhi-js-core": "0.0.40",
+    "@bodhiapp/ts-client": "0.1.35"
   },
   "devDependencies": {
     "@eslint/js": "^9.23.0",