@cardog/api 0.1.2 → 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,17 @@
+# Changelog
+
+## 0.2.0 (2026-03-31)
+
+### Breaking Changes
+- Replaced axios with native fetch. If you were accessing the internal axios instance directly, that no longer exists.
+
+### Security
+- Removed axios dependency in response to supply chain compromise (axios@1.14.1, axios@0.30.4)
+
+### Changed
+- `APIError` now wraps fetch Response errors instead of AxiosError (same public interface)
+- DELETE requests now support request body via `{ body }` option
+
+## 0.1.3
+
+- Initial public release

package/README.md

@@ -291,7 +291,7 @@ queryKeys.recalls.search(params)
 ```typescript
 const client = new CardogClient({
   apiKey: "your-api-key",
-  baseUrl: "https://api.cardog.io", // Default
+  baseUrl: "https://api.cardog.app", // Default
 });
 
 // Update config at runtime

package/dist/index.d.mts

@@ -1,7 +1,6 @@
 import * as _cardog_contracts from '@cardog/contracts';
 import { VinDecodeResponse, VinCorgiResponse, VinImageResponse, MarketAnalysis, MarketOverview, MarketPricing, BreakdownResponse, MarketOdometer, MarketGeography, MarketTrends, MarketPosition, MarketPulse, LocalMarketResponse, DemandMatrixResponse, ListingQuery, ListingSearchResponse, ListingCountResponse, Listing as Listing$1, ListingFacetsResponse, ListingFilters, LocationSearchParams, LocationResult, ChargingParams, ChargingStationResponse, ChargingStation, FuelTypeString, FuelStationResponse, LineupQuery, LineupResponse, VariantArrayResponse, VariantResponse, ResearchImageArray, ColorData, RecallSearchParams, RecallResponse, EfficiencySearchParams } from '@cardog/contracts';
 export { BreakdownResponse, ChargingParams, ChargingStation, ChargingStationResponse, ColorData, ColorInfo, DemandMatrixResponse, FuelStation, FuelStationResponse, FuelType, LineupQuery, LineupResponse, LocalMarketResponse, MarketAnalysis, MarketGeography, MarketOdometer, MarketOverview, MarketPosition, MarketPricing, MarketPulse, MarketTrends, RecallDetail, RecallResponse, RecallSearchParams, ResearchImage, ResearchImageArray, Variant, VariantArrayResponse, VariantResponse, VinDecodeResponse, VinImageResponse, listingSchema } from '@cardog/contracts';
-import { AxiosInstance } from 'axios';
 import { z } from 'zod';
 
 interface ClientConfig {
@@ -19,16 +18,20 @@ declare class APIError extends Error {
     constructor(message: string, status: number, code: string, data?: any | undefined);
 }
 declare class BaseClient {
-    protected client: AxiosInstance;
+    protected baseUrl: string;
     protected config: ClientConfig;
     constructor(config: ClientConfig);
     setConfig(config: ClientConfig): void;
-    private setupInterceptors;
+    private getHeaders;
+    private buildUrl;
+    private request;
     protected get<T>(path: string, options?: RequestOptions): Promise<T>;
     protected post<T>(path: string, data: any, options?: RequestOptions): Promise<T>;
     protected put<T>(path: string, data: any, options?: RequestOptions): Promise<T>;
     protected patch<T>(path: string, data: any, options?: RequestOptions): Promise<T>;
-    protected delete<T>(path: string, options?: RequestOptions): Promise<T>;
+    protected delete<T>(path: string, options?: RequestOptions & {
+        body?: any;
+    }): Promise<T>;
 }
 
 declare const vinKeys: {

package/dist/index.d.ts

@@ -1,7 +1,6 @@
 import * as _cardog_contracts from '@cardog/contracts';
 import { VinDecodeResponse, VinCorgiResponse, VinImageResponse, MarketAnalysis, MarketOverview, MarketPricing, BreakdownResponse, MarketOdometer, MarketGeography, MarketTrends, MarketPosition, MarketPulse, LocalMarketResponse, DemandMatrixResponse, ListingQuery, ListingSearchResponse, ListingCountResponse, Listing as Listing$1, ListingFacetsResponse, ListingFilters, LocationSearchParams, LocationResult, ChargingParams, ChargingStationResponse, ChargingStation, FuelTypeString, FuelStationResponse, LineupQuery, LineupResponse, VariantArrayResponse, VariantResponse, ResearchImageArray, ColorData, RecallSearchParams, RecallResponse, EfficiencySearchParams } from '@cardog/contracts';
 export { BreakdownResponse, ChargingParams, ChargingStation, ChargingStationResponse, ColorData, ColorInfo, DemandMatrixResponse, FuelStation, FuelStationResponse, FuelType, LineupQuery, LineupResponse, LocalMarketResponse, MarketAnalysis, MarketGeography, MarketOdometer, MarketOverview, MarketPosition, MarketPricing, MarketPulse, MarketTrends, RecallDetail, RecallResponse, RecallSearchParams, ResearchImage, ResearchImageArray, Variant, VariantArrayResponse, VariantResponse, VinDecodeResponse, VinImageResponse, listingSchema } from '@cardog/contracts';
-import { AxiosInstance } from 'axios';
 import { z } from 'zod';
 
 interface ClientConfig {
@@ -19,16 +18,20 @@ declare class APIError extends Error {
     constructor(message: string, status: number, code: string, data?: any | undefined);
 }
 declare class BaseClient {
-    protected client: AxiosInstance;
+    protected baseUrl: string;
     protected config: ClientConfig;
     constructor(config: ClientConfig);
     setConfig(config: ClientConfig): void;
-    private setupInterceptors;
+    private getHeaders;
+    private buildUrl;
+    private request;
     protected get<T>(path: string, options?: RequestOptions): Promise<T>;
     protected post<T>(path: string, data: any, options?: RequestOptions): Promise<T>;
     protected put<T>(path: string, data: any, options?: RequestOptions): Promise<T>;
     protected patch<T>(path: string, data: any, options?: RequestOptions): Promise<T>;
-    protected delete<T>(path: string, options?: RequestOptions): Promise<T>;
+    protected delete<T>(path: string, options?: RequestOptions & {
+        body?: any;
+    }): Promise<T>;
 }
 
 declare const vinKeys: {

package/dist/index.js

@@ -2,14 +2,11 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var axios = require('axios');
 var zod = require('zod');
 
-function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
-
-var axios__default = /*#__PURE__*/_interopDefault(axios);
-
 // src/base.ts
+var CLIENT_VERSION = "0.2.0";
+var DEFAULT_BASE_URL = "https://api.cardog.app/v1";
 var APIError = class extends Error {
   constructor(message, status, code, data) {
     super(message);
@@ -22,69 +19,65 @@ var APIError = class extends Error {
 var BaseClient = class {
   constructor(config) {
     this.config = config;
-    this.client = axios__default.default.create({
-      baseURL: config.baseUrl || "https://api.cardog.io",
-      headers: {
-        "Content-Type": "application/json",
-        ...config.apiKey && { Authorization: `Bearer ${config.apiKey}` }
-      }
-    });
-    this.setupInterceptors();
+    this.baseUrl = config.baseUrl || DEFAULT_BASE_URL;
   }
   setConfig(config) {
     this.config = config;
-    if (config.apiKey) {
-      this.client.defaults.headers.Authorization = `Bearer ${config.apiKey}`;
-    } else {
-      delete this.client.defaults.headers.Authorization;
+    if (config.baseUrl) {
+      this.baseUrl = config.baseUrl;
     }
   }
-  setupInterceptors() {
-    this.client.interceptors.response.use(
-      (response) => response.data,
-      (error) => {
-        if (error.response) {
-          const { status, data } = error.response;
-          throw new APIError(
-            error.message,
-            status,
-            data?.code || "unknown_error",
-            data
-          );
+  getHeaders(extra) {
+    return {
+      "Content-Type": "application/json",
+      "User-Agent": `@cardog/api/${CLIENT_VERSION}`,
+      ...this.config.apiKey && { Authorization: `Bearer ${this.config.apiKey}` },
+      ...extra
+    };
+  }
+  buildUrl(path, params) {
+    const url = new URL(path, this.baseUrl);
+    if (params) {
+      for (const [key, value] of Object.entries(params)) {
+        if (value !== void 0 && value !== null) {
+          url.searchParams.set(key, String(value));
         }
-        throw error;
       }
-    );
+    }
+    return url.toString();
   }
-  async get(path, options = {}) {
-    return this.client.get(path, {
-      headers: options.headers,
-      params: options.params
+  async request(method, path, options = {}) {
+    const url = this.buildUrl(path, options.params);
+    const response = await fetch(url, {
+      method,
+      headers: this.getHeaders(options.headers),
+      body: options.body ? JSON.stringify(options.body) : void 0
     });
+    const data = await response.json().catch(() => null);
+    if (!response.ok) {
+      throw new APIError(
+        data?.message || response.statusText,
+        response.status,
+        data?.code || "unknown_error",
+        data
+      );
+    }
+    return data;
+  }
+  async get(path, options = {}) {
+    return this.request("GET", path, options);
   }
   async post(path, data, options = {}) {
-    return this.client.post(path, data, {
-      headers: options.headers,
-      params: options.params
-    });
+    return this.request("POST", path, { ...options, body: data });
   }
   async put(path, data, options = {}) {
-    return this.client.put(path, data, {
-      headers: options.headers,
-      params: options.params
-    });
+    return this.request("PUT", path, { ...options, body: data });
   }
   async patch(path, data, options = {}) {
-    return this.client.patch(path, data, {
-      headers: options.headers,
-      params: options.params
-    });
+    return this.request("PATCH", path, { ...options, body: data });
   }
   async delete(path, options = {}) {
-    return this.client.delete(path, {
-      headers: options.headers,
-      params: options.params
-    });
+    return this.request("DELETE", path, options);
   }
 };
 var MAX_PAGE_SIZE = 250;

package/dist/index.mjs

@@ -1,7 +1,8 @@
-import axios from 'axios';
 import { z } from 'zod';
 
 // src/base.ts
+var CLIENT_VERSION = "0.2.0";
+var DEFAULT_BASE_URL = "https://api.cardog.app/v1";
 var APIError = class extends Error {
   constructor(message, status, code, data) {
     super(message);
@@ -14,69 +15,65 @@ var APIError = class extends Error {
 var BaseClient = class {
   constructor(config) {
     this.config = config;
-    this.client = axios.create({
-      baseURL: config.baseUrl || "https://api.cardog.io",
-      headers: {
-        "Content-Type": "application/json",
-        ...config.apiKey && { Authorization: `Bearer ${config.apiKey}` }
-      }
-    });
-    this.setupInterceptors();
+    this.baseUrl = config.baseUrl || DEFAULT_BASE_URL;
   }
   setConfig(config) {
     this.config = config;
-    if (config.apiKey) {
-      this.client.defaults.headers.Authorization = `Bearer ${config.apiKey}`;
-    } else {
-      delete this.client.defaults.headers.Authorization;
+    if (config.baseUrl) {
+      this.baseUrl = config.baseUrl;
     }
   }
-  setupInterceptors() {
-    this.client.interceptors.response.use(
-      (response) => response.data,
-      (error) => {
-        if (error.response) {
-          const { status, data } = error.response;
-          throw new APIError(
-            error.message,
-            status,
-            data?.code || "unknown_error",
-            data
-          );
+  getHeaders(extra) {
+    return {
+      "Content-Type": "application/json",
+      "User-Agent": `@cardog/api/${CLIENT_VERSION}`,
+      ...this.config.apiKey && { Authorization: `Bearer ${this.config.apiKey}` },
+      ...extra
+    };
+  }
+  buildUrl(path, params) {
+    const url = new URL(path, this.baseUrl);
+    if (params) {
+      for (const [key, value] of Object.entries(params)) {
+        if (value !== void 0 && value !== null) {
+          url.searchParams.set(key, String(value));
         }
-        throw error;
       }
-    );
+    }
+    return url.toString();
   }
-  async get(path, options = {}) {
-    return this.client.get(path, {
-      headers: options.headers,
-      params: options.params
+  async request(method, path, options = {}) {
+    const url = this.buildUrl(path, options.params);
+    const response = await fetch(url, {
+      method,
+      headers: this.getHeaders(options.headers),
+      body: options.body ? JSON.stringify(options.body) : void 0
     });
+    const data = await response.json().catch(() => null);
+    if (!response.ok) {
+      throw new APIError(
+        data?.message || response.statusText,
+        response.status,
+        data?.code || "unknown_error",
+        data
+      );
+    }
+    return data;
+  }
+  async get(path, options = {}) {
+    return this.request("GET", path, options);
   }
   async post(path, data, options = {}) {
-    return this.client.post(path, data, {
-      headers: options.headers,
-      params: options.params
-    });
+    return this.request("POST", path, { ...options, body: data });
   }
   async put(path, data, options = {}) {
-    return this.client.put(path, data, {
-      headers: options.headers,
-      params: options.params
-    });
+    return this.request("PUT", path, { ...options, body: data });
   }
   async patch(path, data, options = {}) {
-    return this.client.patch(path, data, {
-      headers: options.headers,
-      params: options.params
-    });
+    return this.request("PATCH", path, { ...options, body: data });
   }
   async delete(path, options = {}) {
-    return this.client.delete(path, {
-      headers: options.headers,
-      params: options.params
-    });
+    return this.request("DELETE", path, options);
   }
 };
 var MAX_PAGE_SIZE = 250;

package/dist/react/index.d.mts

@@ -2,7 +2,6 @@ import { UseQueryOptions, useQuery, UseInfiniteQueryOptions, QueryKey, useInfini
 import { VinDecodeResponse, VinImageResponse, MarketAnalysis, MarketOverview, MarketPricing, BreakdownResponse, MarketOdometer, MarketGeography, MarketTrends, MarketPosition, MarketPulse, LocalMarketResponse, FuelTypeString, FuelStationResponse, ChargingParams, ChargingStationResponse, LineupResponse, Variant, ResearchImage, ColorData, RecallSearchParams, RecallResponse } from '@cardog/contracts';
 import CardogClient, { ListingsSearchParams, ListingsResponse, ListingsCountResponse, Listing, ListingsFacetsResponse, LocationsSearchParams, LocationsSearchResponse, LocationDetailResponse, ComplaintsSearchParams, ComplaintsResponse } from '../index.mjs';
 export { queryKeys } from '../index.mjs';
-import 'axios';
 import 'zod';
 
 /**

package/dist/react/index.d.ts

@@ -2,7 +2,6 @@ import { UseQueryOptions, useQuery, UseInfiniteQueryOptions, QueryKey, useInfini
 import { VinDecodeResponse, VinImageResponse, MarketAnalysis, MarketOverview, MarketPricing, BreakdownResponse, MarketOdometer, MarketGeography, MarketTrends, MarketPosition, MarketPulse, LocalMarketResponse, FuelTypeString, FuelStationResponse, ChargingParams, ChargingStationResponse, LineupResponse, Variant, ResearchImage, ColorData, RecallSearchParams, RecallResponse } from '@cardog/contracts';
 import CardogClient, { ListingsSearchParams, ListingsResponse, ListingsCountResponse, Listing, ListingsFacetsResponse, LocationsSearchParams, LocationsSearchResponse, LocationDetailResponse, ComplaintsSearchParams, ComplaintsResponse } from '../index.js';
 export { queryKeys } from '../index.js';
-import 'axios';
 import 'zod';
 
 /**

package/dist/react/index.js

@@ -1,7 +1,6 @@
 'use strict';
 
 var reactQuery = require('@tanstack/react-query');
-require('axios');
 var zod = require('zod');
 
 // src/react/hooks.ts

package/dist/react/index.mjs

@@ -1,5 +1,4 @@
 import { useQuery, useInfiniteQuery } from '@tanstack/react-query';
-import 'axios';
 import { z } from 'zod';
 
 // src/react/hooks.ts

package/package.json

@@ -1,16 +1,9 @@
 {
   "name": "@cardog/api",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Official Cardog API client library for vehicle data, market analysis, and VIN decoding",
   "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/cardog-ai/cardog-api"
-  },
   "homepage": "https://docs.cardog.app",
-  "bugs": {
-    "url": "https://github.com/cardog-ai/cardog-api/issues"
-  },
   "keywords": [
     "cardog",
     "api",
@@ -47,10 +40,19 @@
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.ts",
   "files": [
-    "dist"
+    "dist",
+    "CHANGELOG.md"
   ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "clean": "rm -rf dist",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "pnpm build"
+  },
   "dependencies": {
-    "axios": "^1.6.7",
     "zod": "^3.24.3"
   },
   "peerDependencies": {
@@ -70,24 +72,16 @@
     }
   },
   "devDependencies": {
+    "@cardog/contracts": "workspace:*",
     "@tanstack/react-query": "^5.0.0",
     "@types/node": "^20.11.24",
     "@types/react": "^18.2.0",
     "react": "^18.2.0",
     "tsup": "^8.0.2",
     "typescript": "^5.3.3",
-    "vitest": "^1.3.1",
-    "@cardog/contracts": "0.1.0"
+    "vitest": "^1.3.1"
   },
   "publishConfig": {
     "access": "public"
-  },
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "clean": "rm -rf dist",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "typecheck": "tsc --noEmit"
   }
-}
+}