@chaosity/location-client 0.6.0 → 0.8.0

package/dist/server/getClientConfig.js

@@ -3,9 +3,32 @@ import { createHash } from 'node:crypto';
 import { TokenProvider } from '../auth/TokenProvider.js';
 import { LocationServiceException } from '../errors/LocationServiceException.js';
 const log = debug('location-client:clientConfig');
-// Singleton instance to prevent race conditions
-let tokenProviderInstance = null;
-let currentConfig = null;
+/**
+ * How many applications one process keeps token providers for.
+ *
+ * A provider holds a URL, a client id, a secret and one cached JWT, so the
+ * ceiling is about memory containment rather than a tuned working set — 64 is
+ * far above what a single-tenant service needs and far below anything worth
+ * worrying about. An agency past it pays a re-mint for the least recently used
+ * application, which is exactly the behaviour this replaced, but only for the
+ * coldest one instead of for every alternation.
+ */
+export const MAX_CACHED_PROVIDERS = 64;
+/**
+ * One provider per configuration, most-recently-used last.
+ *
+ * This used to be TWO module-level variables holding a single provider, and a
+ * process serving more than one application therefore evicted the cache on
+ * every alternation: A→B→A→B took a full `/auth/token` round trip per call,
+ * each writing a jti row, all against the one shared token-endpoint throttle.
+ * The hit rate under alternating load was 0% (#39). Nothing leaked between
+ * tenants — each caller closes over the provider it asked for — so what this
+ * fixes is availability and cost, not confidentiality.
+ *
+ * A `Map` iterates in insertion order, so re-inserting on a hit makes the first
+ * key the least recently used, and an LRU needs no other bookkeeping.
+ */
+const tokenProviders = new Map();
 function getTokenProvider(apiUrl, clientId, clientSecret) {
     // The SECRET is part of the key. Without it, rotating a client secret while
     // keeping the same clientId left this process reusing a provider built on the
@@ -13,16 +36,112 @@ function getTokenProvider(apiUrl, clientId, clientSecret) {
     // rather than concatenated so the key is never a secret in its own right, and
     // never ends up in a log line (#5).
     const configKey = `${apiUrl}:${clientId}:${createHash('sha256').update(clientSecret).digest('hex').slice(0, 16)}`;
-    // Reuse existing instance if config matches
-    if (tokenProviderInstance && currentConfig === configKey) {
+    const cached = tokenProviders.get(configKey);
+    if (cached) {
         log('[getTokenProvider] Reusing existing TokenProvider instance');
-        return tokenProviderInstance;
+        // Re-insert to mark it most recently used.
+        tokenProviders.delete(configKey);
+        tokenProviders.set(configKey, cached);
+        return cached;
     }
-    // Create new instance if config changed
     log('[getTokenProvider] Creating new TokenProvider instance');
-    tokenProviderInstance = new TokenProvider({ apiUrl, clientId, clientSecret });
-    currentConfig = configKey;
-    return tokenProviderInstance;
+    const provider = new TokenProvider({ apiUrl, clientId, clientSecret });
+    tokenProviders.set(configKey, provider);
+    if (tokenProviders.size > MAX_CACHED_PROVIDERS) {
+        const leastRecentlyUsed = tokenProviders.keys().next().value;
+        /* c8 ignore next — size > 0 here, so the iterator always yields */
+        if (leastRecentlyUsed !== undefined) {
+            log('[getTokenProvider] Evicting the least recently used TokenProvider');
+            tokenProviders.delete(leastRecentlyUsed);
+        }
+    }
+    return provider;
+}
+/**
+ * Where the API lives, from the argument or the environment.
+ *
+ * Separate from the credentials because the two are independently overridable:
+ * a caller can hand `LocationServiceConnector` its own `token` and still expect
+ * `LOCATION_API_URL` to say where to send it.
+ */
+export function resolveApiUrl(explicit) {
+    return (explicit ||
+        process.env.LOCATION_API_URL ||
+        process.env.LOCATION_SERVICE_API_URL);
+}
+export function serverTokenSource(config = {}) {
+    log('[serverTokenSource] Starting with config:', {
+        hasApiUrl: !!config.apiUrl,
+        hasClientId: !!config.clientId,
+    });
+    // Auto-detect from environment with fallbacks
+    const apiUrl = resolveApiUrl(config.apiUrl);
+    const clientId = config.clientId ||
+        process.env.LOCATION_CLIENT_ID ||
+        process.env.LOCATION_SERVICE_CLIENT_ID;
+    const clientSecret = config.clientSecret ||
+        process.env.LOCATION_CLIENT_SECRET ||
+        process.env.LOCATION_SERVICE_CLIENT_SECRET;
+    log('[serverTokenSource] Resolved config:', {
+        apiUrl,
+        clientId: clientId?.substring(0, 10) + '...',
+    });
+    // Validate required values. A LocationServiceException like everything else
+    // this package throws — it used to be a bare `Error`, which was survivable
+    // while only `getClientConfig` could raise it and is not now that the
+    // connector reaches this path too.
+    if (!apiUrl || !clientId || !clientSecret) {
+        console.error('[location-client] Missing required configuration');
+        throw new LocationServiceException({
+            code: 'ValidationException',
+            message: 'Missing required configuration. Set environment variables: ' +
+                'LOCATION_API_URL, LOCATION_CLIENT_ID, LOCATION_CLIENT_SECRET',
+            details: { source: 'client' },
+        });
+    }
+    log('[serverTokenSource] Getting TokenProvider instance');
+    const provider = getTokenProvider(apiUrl, clientId, clientSecret);
+    return {
+        apiUrl,
+        async getToken(forceRefresh = false) {
+            log('[serverTokenSource] Fetching token (forceRefresh=%s)', forceRefresh);
+            let result;
+            try {
+                result = await provider.getToken(forceRefresh);
+            }
+            catch (error) {
+                // The provider now rejects rather than resolving with success:false, and
+                // the rejection is typed — so a store outage (503) can be reported as a
+                // store outage instead of as bad credentials.
+                if (error instanceof LocationServiceException) {
+                    if (error.isAuth) {
+                        throw new LocationServiceException({
+                            code: 'InvalidCredentialsException',
+                            message: `Authentication failed for client ID "${clientId}". ` +
+                                `Verify LOCATION_CLIENT_ID and LOCATION_CLIENT_SECRET match your application in the developer portal.`,
+                            statusCode: error.statusCode,
+                            requestId: error.requestId,
+                            cause: error,
+                        });
+                    }
+                    throw error;
+                }
+                throw error;
+            }
+            // TokenProvider rejects rather than returning a tokenless success, so this
+            // is unreachable in practice — it is here to keep the contract explicit at
+            // the type level rather than asserting non-null.
+            const token = result.token;
+            if (!token) {
+                throw new LocationServiceException({
+                    code: 'InvalidCredentialsException',
+                    message: 'Token provider returned no token',
+                    details: { source: 'client' },
+                });
+            }
+            return { ...result, token };
+        },
+    };
 }
 /**
  * Get client configuration with OAuth2 authentication.
@@ -43,6 +162,21 @@ function getTokenProvider(apiUrl, clientId, clientSecret) {
  * NEVER call from browser/client code as it exposes credentials.
  * For SPA projects, create your own backend endpoint that calls this.
  *
+ * ## The return value is PLAIN DATA, and has to stay that way
+ *
+ * `{ apiUrl, token, expiresAt }` — no methods, no closures. The reason is not
+ * style: the shape every sample uses is a Next.js Server Action that returns
+ * this straight to a Client Component (every `src/lib/actions/location.ts`
+ * under `location-service-samples/web`), and the RSC boundary
+ * serialises it. A function on this object is not serialisable and throws at
+ * the boundary, so "make getClientConfig return getToken" — which #36 proposed
+ * and this JSDoc used to promise two lines below — would break every Next.js
+ * consumer of the library.
+ *
+ * A caller that needs a token which REFRESHES wants one of:
+ * - `LocationServiceConnector`, which holds a live source internally (#36), or
+ * - `TokenProvider` directly, if it is managing its own lifecycle.
+ *
  * @example
  * // Auto-detect from environment
  * const config = await getClientConfig()
@@ -50,74 +184,15 @@ function getTokenProvider(apiUrl, clientId, clientSecret) {
  * // Or override specific values
  * const config = await getClientConfig({ apiUrl: 'https://custom.api.com' })
  *
- * // Use getToken() for automatic caching and refresh
- * const { token } = await config.getToken()
- * const connector = new LocationServiceConnector({ apiUrl: config.apiUrl, token })
+ * // The API rejected the token before its exp — revoked, or secret rotated
+ * const fresh = await getClientConfig({ forceRefresh: true })
  */
 export async function getClientConfig(config = {}) {
-    log('[getClientConfig] Starting with config:', {
-        hasApiUrl: !!config.apiUrl,
-        hasClientId: !!config.clientId,
-    });
-    // Auto-detect from environment with fallbacks
-    const apiUrl = config.apiUrl ||
-        process.env.LOCATION_API_URL ||
-        process.env.LOCATION_SERVICE_API_URL;
-    const clientId = config.clientId ||
-        process.env.LOCATION_CLIENT_ID ||
-        process.env.LOCATION_SERVICE_CLIENT_ID;
-    const clientSecret = config.clientSecret ||
-        process.env.LOCATION_CLIENT_SECRET ||
-        process.env.LOCATION_SERVICE_CLIENT_SECRET;
-    log('[getClientConfig] Resolved config:', {
-        apiUrl,
-        clientId: clientId?.substring(0, 10) + '...',
-    });
-    // Validate required values
-    if (!apiUrl || !clientId || !clientSecret) {
-        console.error('[getClientConfig] Missing required configuration');
-        throw new Error('Missing required configuration. Set environment variables: ' +
-            'LOCATION_API_URL, LOCATION_CLIENT_ID, LOCATION_CLIENT_SECRET');
-    }
-    log('[getClientConfig] Getting TokenProvider instance');
-    const provider = getTokenProvider(apiUrl, clientId, clientSecret);
-    log('[getClientConfig] Fetching token');
-    let result;
-    try {
-        result = await provider.getToken();
-    }
-    catch (error) {
-        // The provider now rejects rather than resolving with success:false, and the
-        // rejection is typed — so a store outage (503) can be reported as a store
-        // outage instead of as bad credentials.
-        if (error instanceof LocationServiceException) {
-            if (error.isAuth) {
-                throw new LocationServiceException({
-                    code: 'InvalidCredentialsException',
-                    message: `Authentication failed for client ID "${clientId}". ` +
-                        `Verify LOCATION_CLIENT_ID and LOCATION_CLIENT_SECRET match your application in the developer portal.`,
-                    statusCode: error.statusCode,
-                    requestId: error.requestId,
-                    cause: error,
-                });
-            }
-            throw error;
-        }
-        throw error;
-    }
-    // TokenProvider rejects rather than returning a tokenless success, so this is
-    // unreachable in practice — it is here to keep the contract explicit at the
-    // type level rather than asserting non-null.
-    if (!result.token) {
-        throw new LocationServiceException({
-            code: 'InvalidCredentialsException',
-            message: 'Token provider returned no token',
-            details: { source: 'client' },
-        });
-    }
+    const source = serverTokenSource(config);
+    const result = await source.getToken(config.forceRefresh);
     log('[getClientConfig] Token fetched successfully, length:', result.token.length);
     return {
-        apiUrl,
+        apiUrl: source.apiUrl,
         token: result.token,
         expiresAt: result.expiresAt,
     };

package/dist/transport/errors.d.ts

@@ -12,8 +12,38 @@ import { LocationServiceException } from '../errors/LocationServiceException.js'
  *   { message: "Unauthorized" }          API Gateway's own responses
  */
 export declare function parseErrorResponse(status: number, statusText: string, body: string, headers?: Headers): LocationServiceException;
+/**
+ * The API has rejected this token: a 401, and only a 401.
+ *
+ * The authorizer throws `Unauthorized` for a token it cannot verify or that has
+ * expired, and API Gateway turns that into a 401. Its other refusals — no
+ * domain configured for the application, an Origin the application does not
+ * allow — are a Deny policy or a service 403, and a fresh token changes
+ * neither. Retrying those sends the same doomed request twice, for the same
+ * answer — which is the whole cost, since the service meters successful
+ * requests and no error response is billed whatever its status.
+ *
+ * Shared by both send paths so the browser client and the server connector
+ * cannot come to different conclusions about the same response.
+ */
+export declare function isTokenRejected(err: unknown): boolean;
 /**
  * `Retry-After` is either delta-seconds or an HTTP date. Both are legal and the
  * API sends the first; a date is handled so a proxy or gateway cannot surprise us.
  */
 export declare function parseRetryAfter(value: string | null | undefined): number | undefined;
+/**
+ * No token to send, so nothing is sent.
+ *
+ * Every send path resolves a token before it builds a request, and every one of
+ * them can come up empty — a provider that has not initialised, a server action
+ * that returned nothing, credentials that are not configured. Sending anyway
+ * puts the literal string `Bearer undefined` on the wire, which the API answers
+ * with a 401 the caller then has to work backwards from — a whole round trip,
+ * paid for out of the caller's own deadline, to be told what it already knew.
+ * The map fetches did exactly that until #37.
+ *
+ * `advice` says what to check, because that differs by path: a server connector
+ * wants its client credentials looked at, a browser map wants its token source.
+ */
+export declare function noTokenAvailable(advice: string): LocationServiceException;

package/dist/transport/errors.js

@@ -83,6 +83,23 @@ function statusCode(status) {
             return status >= 500 ? 'InternalException' : 'ServiceException';
     }
 }
+/**
+ * The API has rejected this token: a 401, and only a 401.
+ *
+ * The authorizer throws `Unauthorized` for a token it cannot verify or that has
+ * expired, and API Gateway turns that into a 401. Its other refusals — no
+ * domain configured for the application, an Origin the application does not
+ * allow — are a Deny policy or a service 403, and a fresh token changes
+ * neither. Retrying those sends the same doomed request twice, for the same
+ * answer — which is the whole cost, since the service meters successful
+ * requests and no error response is billed whatever its status.
+ *
+ * Shared by both send paths so the browser client and the server connector
+ * cannot come to different conclusions about the same response.
+ */
+export function isTokenRejected(err) {
+    return err instanceof LocationServiceException && err.statusCode === 401;
+}
 /**
  * `Retry-After` is either delta-seconds or an HTTP date. Both are legal and the
  * API sends the first; a date is handled so a proxy or gateway cannot surprise us.
@@ -98,3 +115,24 @@ export function parseRetryAfter(value) {
         return Math.max(0, date - Date.now());
     return undefined;
 }
+/**
+ * No token to send, so nothing is sent.
+ *
+ * Every send path resolves a token before it builds a request, and every one of
+ * them can come up empty — a provider that has not initialised, a server action
+ * that returned nothing, credentials that are not configured. Sending anyway
+ * puts the literal string `Bearer undefined` on the wire, which the API answers
+ * with a 401 the caller then has to work backwards from — a whole round trip,
+ * paid for out of the caller's own deadline, to be told what it already knew.
+ * The map fetches did exactly that until #37.
+ *
+ * `advice` says what to check, because that differs by path: a server connector
+ * wants its client credentials looked at, a browser map wants its token source.
+ */
+export function noTokenAvailable(advice) {
+    return new LocationServiceException({
+        code: 'InvalidCredentialsException',
+        message: `No token available — ${advice}`,
+        details: { source: 'client' },
+    });
+}

package/dist/transport/http.d.ts

@@ -1,11 +1,38 @@
 /** Per-attempt timeout. Sits well under the API's own 25 s Lambda ceiling. */
 export declare const DEFAULT_TIMEOUT_MS = 10000;
+/**
+ * Ceiling for the WHOLE call — every attempt plus every wait between them.
+ *
+ * `timeoutMs` bounds an attempt, not a call, and the gap between those two is
+ * where the caller's own deadline disappears. The API answers a spent quota
+ * with `Retry-After: 60`, which the retry loop honoured literally: two waits of
+ * a minute each, so one call could sit for ~120 s — past any Lambda budget,
+ * past any HTTP gateway, and until now uncancellable (#37).
+ *
+ * 30 s is picked to sit just under the old worst case: three default attempts
+ * that all time out, plus their backoff, came to ~30.75 s. The overlap is not
+ * quite nothing — when both earlier attempts burn their full 10 s, the third is
+ * clamped to the ~9.25 s that remain, so a response arriving in its final
+ * ~0.75 s used to succeed and now times out. That window is why this ships in a
+ * MINOR rather than a patch. What it buys is that no call can be made to sit
+ * out a retry hint longer than the caller has.
+ */
+export declare const DEFAULT_OVERALL_TIMEOUT_MS = 30000;
 export declare const DEFAULT_MAX_ATTEMPTS = 3;
 export interface RequestOptions {
     /** Caller cancellation. Aborting rejects with code `AbortedException`. */
     signal?: AbortSignal;
     /** Per ATTEMPT, not for the whole call. Default 10 s. */
     timeoutMs?: number;
+    /**
+     * The whole call — attempts and the waits between them. Default 30 s.
+     *
+     * No attempt is given more than what is left of it, and a retry that would
+     * have to wait longer than what is left is not made at all: the API's own
+     * error comes back instead, `retryAfterMs` intact, so the caller can decide
+     * whether to queue the work or drop it.
+     */
+    overallTimeoutMs?: number;
     /** `false` disables retries entirely. Default 3 attempts = 2 retries. */
     retry?: false | {
         maxAttempts?: number;
@@ -22,3 +49,12 @@ export declare function backoffMs(attempt: number, random?: () => number): numbe
  * `details.source = 'client'` so it is distinguishable from the API's own 504.
  */
 export declare function requestJson<T>(url: string, init: RequestInit, options?: RequestOptions): Promise<T>;
+/**
+ * One request answered as a Blob — the static map path.
+ *
+ * Exists so the two map fetches are not the only calls in the package without
+ * a timeout, a retry or a signal: they used their own bare `fetch`, so a
+ * network fault there escaped as a raw `TypeError` while the identical fault on
+ * any other call arrived as `NetworkException` (#37).
+ */
+export declare function requestBlob(url: string, init: RequestInit, options?: RequestOptions): Promise<Blob>;

package/dist/transport/http.js

@@ -4,6 +4,24 @@ import { parseErrorResponse, parseRetryAfter } from './errors.js';
 const log = debug('location-client:transport');
 /** Per-attempt timeout. Sits well under the API's own 25 s Lambda ceiling. */
 export const DEFAULT_TIMEOUT_MS = 10000;
+/**
+ * Ceiling for the WHOLE call — every attempt plus every wait between them.
+ *
+ * `timeoutMs` bounds an attempt, not a call, and the gap between those two is
+ * where the caller's own deadline disappears. The API answers a spent quota
+ * with `Retry-After: 60`, which the retry loop honoured literally: two waits of
+ * a minute each, so one call could sit for ~120 s — past any Lambda budget,
+ * past any HTTP gateway, and until now uncancellable (#37).
+ *
+ * 30 s is picked to sit just under the old worst case: three default attempts
+ * that all time out, plus their backoff, came to ~30.75 s. The overlap is not
+ * quite nothing — when both earlier attempts burn their full 10 s, the third is
+ * clamped to the ~9.25 s that remain, so a response arriving in its final
+ * ~0.75 s used to succeed and now times out. That window is why this ships in a
+ * MINOR rather than a patch. What it buys is that no call can be made to sit
+ * out a retry hint longer than the caller has.
+ */
+export const DEFAULT_OVERALL_TIMEOUT_MS = 30000;
 export const DEFAULT_MAX_ATTEMPTS = 3;
 const BACKOFF_BASE_MS = 250;
 const BACKOFF_CAP_MS = 4000;
@@ -40,38 +58,86 @@ export function backoffMs(attempt, random = Math.random) {
     const ceiling = Math.min(BACKOFF_CAP_MS, BACKOFF_BASE_MS * 2 ** attempt);
     return Math.floor(random() * ceiling);
 }
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /**
- * One JSON request, with timeout, cancellation and retry.
+ * Sleep, unless the caller aborts first.
  *
- * Every failure leaves as a LocationServiceException — a fetch rejection
- * becomes `NetworkException` with the original as `cause`, an abort becomes
- * `AbortedException`, a timeout becomes `TimeoutException` with
- * `details.source = 'client'` so it is distinguishable from the API's own 504.
+ * The timer used to be uncancellable, so an `abort()` during backoff was
+ * ignored until it elapsed — up to a whole `Retry-After` — and the loop only
+ * noticed at the top of the next attempt (#37). Resolving early is all that is
+ * needed: the loop's own pre-attempt check is what raises `AbortedException`,
+ * so exactly one place decides what an abort means.
  */
-export async function requestJson(url, init, options = {}) {
+function sleep(ms, signal) {
+    if (ms <= 0 || signal?.aborted)
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        const done = () => {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', done);
+            resolve();
+        };
+        const timer = setTimeout(done, ms);
+        signal?.addEventListener('abort', done, { once: true });
+    });
+}
+/**
+ * One request, with timeout, cancellation and retry.
+ *
+ * The body is read INSIDE the attempt loop deliberately: a truncated or
+ * malformed body is a failed attempt like any other and earns the same
+ * wrapping and the same retry as a dropped socket. Handing the `Response` back
+ * for the caller to read would move that outside the loop, where a bare
+ * `SyntaxError` escapes as itself.
+ */
+async function request(url, init, options, read) {
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const overallTimeoutMs = options.overallTimeoutMs ?? DEFAULT_OVERALL_TIMEOUT_MS;
     const maxAttempts = options.retry === false
         ? 1
         : (options.retry?.maxAttempts ?? DEFAULT_MAX_ATTEMPTS);
+    // A request budget of zero attempts is a caller mistake, not a policy. It
+    // used to fall straight through the loop and raise `InternalException` for a
+    // request that was never made — an error about our own internals, for their
+    // typo (#37).
+    if (!Number.isInteger(maxAttempts) || maxAttempts < 1) {
+        throw new LocationServiceException({
+            code: 'ValidationException',
+            message: `retry.maxAttempts must be a whole number of at least 1; received ${maxAttempts}`,
+            details: { source: 'client' },
+        });
+    }
+    const deadline = Date.now() + overallTimeoutMs;
     let lastError;
     for (let attempt = 0; attempt < maxAttempts; attempt++) {
         // Checked before every attempt: a signal aborted during backoff must not fire one more.
         if (options.signal?.aborted)
             throw abortedException(options.signal);
-        const { signal, cleanup } = attemptSignal(options.signal, timeoutMs);
+        const budget = deadline - Date.now();
+        if (budget <= 0)
+            throw lastError ?? overallTimeoutException(overallTimeoutMs);
+        // Never longer than what is left of the call, so the per-attempt timeout
+        // cannot overrun the budget it sits inside.
+        const { signal, cleanup } = attemptSignal(options.signal, Math.min(timeoutMs, budget));
         try {
             const response = await fetch(url, { ...init, signal });
             if (response.ok)
-                return (await response.json());
+                return await read(response);
             const error = parseErrorResponse(response.status, response.statusText, await response.text(), response.headers);
             lastError = error;
             if (!error.isRetryable || attempt === maxAttempts - 1)
                 throw error;
-            log('attempt %d failed (%s), retrying', attempt + 1, error.code);
-            await sleep(error.retryAfterMs ??
+            const wait = error.retryAfterMs ??
                 parseRetryAfter(response.headers.get('retry-after')) ??
-                backoffMs(attempt));
+                backoffMs(attempt);
+            // Sitting out a 60 s `Retry-After` inside a 30 s budget only delivers the
+            // same failure after the caller has already given up. Stop now and hand
+            // back what the API said, `retryAfterMs` and all.
+            if (wait >= deadline - Date.now()) {
+                log('not retrying: a %d ms wait outlasts the remaining budget', wait);
+                break;
+            }
+            log('attempt %d failed (%s), retrying', attempt + 1, error.code);
+            await sleep(wait, options.signal);
         }
         catch (err) {
             if (err instanceof LocationServiceException) {
@@ -85,20 +151,48 @@ export async function requestJson(url, init, options = {}) {
             lastError = wrapped;
             if (!wrapped.isRetryable || attempt === maxAttempts - 1)
                 throw wrapped;
+            const wait = backoffMs(attempt);
+            if (wait >= deadline - Date.now()) {
+                log('not retrying: a %d ms wait outlasts the remaining budget', wait);
+                break;
+            }
             log('attempt %d failed (%s), retrying', attempt + 1, wrapped.code);
-            await sleep(backoffMs(attempt));
+            await sleep(wait, options.signal);
         }
         finally {
             cleanup();
         }
     }
-    /* c8 ignore next */
+    // Reached when the budget ran out before another attempt could be made, so
+    // `lastError` is the API's own answer and is the useful thing to throw.
     throw (lastError ??
         new LocationServiceException({
             code: 'InternalException',
             message: 'Request failed',
         }));
 }
+/**
+ * One JSON request, with timeout, cancellation and retry.
+ *
+ * Every failure leaves as a LocationServiceException — a fetch rejection
+ * becomes `NetworkException` with the original as `cause`, an abort becomes
+ * `AbortedException`, a timeout becomes `TimeoutException` with
+ * `details.source = 'client'` so it is distinguishable from the API's own 504.
+ */
+export function requestJson(url, init, options = {}) {
+    return request(url, init, options, (response) => response.json());
+}
+/**
+ * One request answered as a Blob — the static map path.
+ *
+ * Exists so the two map fetches are not the only calls in the package without
+ * a timeout, a retry or a signal: they used their own bare `fetch`, so a
+ * network fault there escaped as a raw `TypeError` while the identical fault on
+ * any other call arrived as `NetworkException` (#37).
+ */
+export function requestBlob(url, init, options = {}) {
+    return request(url, init, options, (response) => response.blob());
+}
 function abortedException(signal) {
     return new LocationServiceException({
         code: 'AbortedException',
@@ -107,6 +201,14 @@ function abortedException(signal) {
         cause: signal?.reason,
     });
 }
+/** The call's own budget elapsed, rather than one attempt's timeout. */
+function overallTimeoutException(overallTimeoutMs) {
+    return new LocationServiceException({
+        code: 'TimeoutException',
+        message: `Request exceeded its overall timeout of ${overallTimeoutMs} ms`,
+        details: { source: 'client' },
+    });
+}
 /**
  * fetch rejects with a raw `TypeError` for a network fault and a `DOMException`
  * named AbortError for both cancellation and timeout — indistinguishable from

package/dist/types/index.d.ts

@@ -1,9 +1,45 @@
+/**
+ * At least one of `token`, `getToken` or `refreshToken` must supply a token, or
+ * `send` refuses locally with `InvalidCredentialsException` rather than putting
+ * `Bearer undefined` on the wire (#37).
+ *
+ * `token` is optional because a client driven purely by a provider — the shape
+ * `@chaosity/location-client-react` uses — has nothing to put there at
+ * construction time, and was previously forced to invent a placeholder. It is
+ * still required on `ServerClientConfig`, which is a RESULT rather than a
+ * configuration: `getClientConfig` always resolves one.
+ */
 export interface ClientConfig {
     apiUrl: string;
-    token: string;
+    token?: string;
     /** Optional callback to get the current token dynamically. When provided,
      *  called on every request so token updates are reflected without recreating the client. */
     getToken?: () => string | undefined;
+    /**
+     * Asked for a replacement AFTER the API has rejected the current token with a
+     * 401, so the request can be retried once instead of failing — and, since
+     * #37, asked once BEFORE the first send when neither `getToken` nor `token`
+     * yields anything, so a client whose token has not arrived yet does not spend
+     * a round trip on `Bearer undefined` to learn that. Both calls mean the same
+     * thing to an implementor — "give me a usable token" — so a `refreshToken`
+     * that mints or awaits one needs no change; only one that assumes every
+     * invocation follows a 401 does.
+     *
+     * Separate from `getToken` because that one is synchronous by contract — it
+     * is read while a request is being built and cannot await anything, so it can
+     * only ever return the token already in hand. Nothing in this library could
+     * therefore recover from a token revoked, or a secret rotated, before its
+     * `exp`: every request failed until the refresh buffer elapsed on its own
+     * (#36).
+     *
+     * Returning `undefined` is not "no replacement": the client then re-reads
+     * `getToken`, because a provider refreshing in the background may have landed
+     * a new token while the failed request was in flight. What actually decides
+     * is the token that comes out of those two — if it is the one just rejected,
+     * or there is none, the retry is skipped rather than repeating a request that
+     * is going to fail again.
+     */
+    refreshToken?: () => Promise<string | undefined>;
 }
 /**
  * Minimal interface for AWS SDK command objects.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chaosity/location-client",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Client library for Chaosity Location Service with AWS Location Service compatibility",
   "type": "module",
   "main": "dist/cjs/index.js",