@codewheel/jsonapi-frontend-client 1.0.1 → 1.0.3

package/README.md

@@ -12,7 +12,7 @@ npm i @codewheel/jsonapi-frontend-client
 
 ## Usage
 
-Set `DRUPAL_BASE_URL`, then:
+Set `DRUPAL_BASE_URL` (must be a full `http(s)://` URL), then:
 
 ```ts
 import { resolvePath, fetchJsonApi } from "@codewheel/jsonapi-frontend-client"
@@ -23,3 +23,72 @@ if (resolved.resolved && resolved.kind === "entity") {
   console.log(doc.data)
 }
 ```
+
+## Astro / Vite (`import.meta.env`)
+
+```ts
+import { resolvePath, fetchJsonApi } from "@codewheel/jsonapi-frontend-client"
+
+const baseUrl = import.meta.env.DRUPAL_BASE_URL
+
+const resolved = await resolvePath("/about-us", { baseUrl })
+if (resolved.resolved && resolved.kind === "entity") {
+  const doc = await fetchJsonApi(resolved.jsonapi_url, { baseUrl })
+}
+```
+
+## Authentication (optional)
+
+Keep credentials server-side. Pass headers via `options.headers`:
+
+```ts
+import { resolvePath } from "@codewheel/jsonapi-frontend-client"
+
+const baseUrl = process.env.DRUPAL_BASE_URL!
+const auth = "Basic " + Buffer.from(`${process.env.DRUPAL_BASIC_USERNAME}:${process.env.DRUPAL_BASIC_PASSWORD}`).toString("base64")
+
+await resolvePath("/about-us", {
+  baseUrl,
+  headers: { Authorization: auth },
+})
+```
+
+```ts
+import { resolvePath } from "@codewheel/jsonapi-frontend-client"
+
+await resolvePath("/about-us", {
+  headers: { Authorization: `Bearer ${process.env.DRUPAL_JWT_TOKEN}` },
+})
+```
+
+## Query building (optional)
+
+This client doesn’t require a query builder, but `drupal-jsonapi-params` works well:
+
+```ts
+import { DrupalJsonApiParams } from "drupal-jsonapi-params"
+import { fetchJsonApi } from "@codewheel/jsonapi-frontend-client"
+
+const baseUrl = process.env.DRUPAL_BASE_URL!
+
+const params = new DrupalJsonApiParams()
+  .addFilter("status", "1")
+  .addFields("node--article", ["title", "path", "body"])
+
+const url = `/jsonapi/node/article?${params.getQueryString()}`
+await fetchJsonApi(url, { baseUrl })
+```
+
+## URL safety (recommended)
+
+By default, `fetchJsonApi()` and `fetchView()` refuse to fetch absolute URLs on a different origin than your `DRUPAL_BASE_URL` (to avoid accidental SSRF in server environments).
+
+If you intentionally need to fetch a cross-origin absolute URL, pass `allowExternalUrls: true`:
+
+```ts
+import { fetchJsonApi } from "@codewheel/jsonapi-frontend-client"
+
+await fetchJsonApi("https://cms.example.com/jsonapi/node/page/...", {
+  allowExternalUrls: true,
+})
+```

package/dist/fetch.d.ts

@@ -1,5 +1,5 @@
-import { FetchInit, FetchLike } from "./transport";
-import { JsonApiDocument } from "./types";
+import { FetchInit, FetchLike } from "./transport.js";
+import { JsonApiDocument } from "./types.js";
 /**
  * Build cache tags for a JSON:API entity URL (e.g. /jsonapi/node/page/{uuid}).
  *
@@ -13,6 +13,8 @@ export declare function buildViewCacheTags(dataUrl: string): string[];
 export declare function fetchJsonApi<T = JsonApiDocument>(jsonapiPath: string, options?: {
     baseUrl?: string;
     envKey?: string;
+    /** Allow fetching absolute URLs on other origins (default: false). */
+    allowExternalUrls?: boolean;
     include?: string[];
     fields?: Record<string, string[]>;
     revalidate?: number;
@@ -25,6 +27,8 @@ export declare function fetchJsonApi<T = JsonApiDocument>(jsonapiPath: string, o
 export declare function fetchView<T = JsonApiDocument>(dataUrl: string, options?: {
     baseUrl?: string;
     envKey?: string;
+    /** Allow fetching absolute URLs on other origins (default: false). */
+    allowExternalUrls?: boolean;
     /**
      * JSON:API pagination parameters.
      *

package/dist/fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAuD,MAAM,aAAa,CAAA;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAEzC;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAmBlE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAa5D;AAED,wBAAsB,YAAY,CAAC,CAAC,GAAG,eAAe,EACpD,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB,GACA,OAAO,CAAC,CAAC,CAAC,CAsCZ;AAED,wBAAsB,SAAS,CAAC,CAAC,GAAG,eAAe,EACjD,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACnD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB,GACA,OAAO,CAAC,CAAC,CAAC,CAyCZ"}
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAuD,MAAM,gBAAgB,CAAA;AAC1G,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE5C;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAmBlE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAa5D;AAoBD,wBAAsB,YAAY,CAAC,CAAC,GAAG,eAAe,EACpD,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB,GACA,OAAO,CAAC,CAAC,CAAC,CAsCZ;AAED,wBAAsB,SAAS,CAAC,CAAC,GAAG,eAAe,EACjD,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACnD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB,GACA,OAAO,CAAC,CAAC,CAAC,CAyCZ"}

package/dist/fetch.js

@@ -1,4 +1,4 @@
-import { getDrupalBaseUrlFromOptions, getFetch, mergeHeaders } from "./transport";
+import { getDrupalBaseUrlFromOptions, getFetch, mergeHeaders } from "./transport.js";
 /**
  * Build cache tags for a JSON:API entity URL (e.g. /jsonapi/node/page/{uuid}).
  *
@@ -34,10 +34,22 @@ export function buildViewCacheTags(dataUrl) {
     tags.push(`view:${viewId}--${displayId}`);
     return tags;
 }
+function buildSafeUrl(input, base, options) {
+    const baseUrl = new URL(base);
+    const url = new URL(input, baseUrl);
+    if (!options?.allowExternalUrls && url.origin !== baseUrl.origin) {
+        throw new Error(`Refusing to fetch a URL from a different origin (${url.origin}) than base (${baseUrl.origin}). ` +
+            "Pass allowExternalUrls: true to override.");
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new Error(`Unsupported URL protocol "${url.protocol}" (expected http/https)`);
+    }
+    return url;
+}
 export async function fetchJsonApi(jsonapiPath, options) {
     const base = getDrupalBaseUrlFromOptions({ baseUrl: options?.baseUrl, envKey: options?.envKey });
     const fetcher = getFetch(options?.fetch);
-    const url = new URL(jsonapiPath, base);
+    const url = buildSafeUrl(jsonapiPath, base, { allowExternalUrls: options?.allowExternalUrls });
     if (options?.include?.length) {
         url.searchParams.set("include", options.include.join(","));
     }
@@ -68,7 +80,7 @@ export async function fetchJsonApi(jsonapiPath, options) {
 export async function fetchView(dataUrl, options) {
     const base = getDrupalBaseUrlFromOptions({ baseUrl: options?.baseUrl, envKey: options?.envKey });
     const fetcher = getFetch(options?.fetch);
-    const url = new URL(dataUrl, base);
+    const url = buildSafeUrl(dataUrl, base, { allowExternalUrls: options?.allowExternalUrls });
     if (options?.page !== undefined) {
         if (typeof options.page === "number") {
             url.searchParams.set("page[offset]", String(options.page));

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-export { resolvePath } from "./resolve";
-export { fetchJsonApi, fetchView } from "./fetch";
-export { getDrupalBaseUrl, resolveFileUrl, getFileUrl, getImageStyleUrl } from "./url";
-export { findIncluded, findIncludedByRelationship, findIncludedByRelationshipMultiple, extractImageFromFile, extractMedia, extractMediaField, extractPrimaryImage, extractEmbeddedMediaUuids, parseDrupalMediaTag, } from "./media";
-export type { ResolveResponse, JsonApiDocument, JsonApiResource, JsonApiRelationship, JsonApiLinks, NodeAttributes, } from "./types";
-export type { DrupalImageData, DrupalMediaData } from "./media";
-export type { FetchInit, FetchLike } from "./transport";
+export { resolvePath } from "./resolve.js";
+export { fetchJsonApi, fetchView } from "./fetch.js";
+export { getDrupalBaseUrl, resolveFileUrl, getFileUrl, getImageStyleUrl } from "./url.js";
+export { findIncluded, findIncludedByRelationship, findIncludedByRelationshipMultiple, extractImageFromFile, extractMedia, extractMediaField, extractPrimaryImage, extractEmbeddedMediaUuids, parseDrupalMediaTag, } from "./media.js";
+export type { ResolveResponse, JsonApiDocument, JsonApiResource, JsonApiRelationship, JsonApiLinks, NodeAttributes, } from "./types.js";
+export type { DrupalImageData, DrupalMediaData } from "./media.js";
+export type { FetchInit, FetchLike } from "./transport.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAEjD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAA;AAEtF,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,kCAAkC,EAClC,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,SAAS,CAAA;AAEhB,YAAY,EACV,eAAe,EACf,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,YAAY,EACZ,cAAc,GACf,MAAM,SAAS,CAAA;AAEhB,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAE/D,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAEpD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAEzF,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,kCAAkC,EAClC,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,YAAY,CAAA;AAEnB,YAAY,EACV,eAAe,EACf,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,YAAY,EACZ,cAAc,GACf,MAAM,YAAY,CAAA;AAEnB,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAElE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/index.js

@@ -1,4 +1,4 @@
-export { resolvePath } from "./resolve";
-export { fetchJsonApi, fetchView } from "./fetch";
-export { getDrupalBaseUrl, resolveFileUrl, getFileUrl, getImageStyleUrl } from "./url";
-export { findIncluded, findIncludedByRelationship, findIncludedByRelationshipMultiple, extractImageFromFile, extractMedia, extractMediaField, extractPrimaryImage, extractEmbeddedMediaUuids, parseDrupalMediaTag, } from "./media";
+export { resolvePath } from "./resolve.js";
+export { fetchJsonApi, fetchView } from "./fetch.js";
+export { getDrupalBaseUrl, resolveFileUrl, getFileUrl, getImageStyleUrl } from "./url.js";
+export { findIncluded, findIncludedByRelationship, findIncludedByRelationshipMultiple, extractImageFromFile, extractMedia, extractMediaField, extractPrimaryImage, extractEmbeddedMediaUuids, parseDrupalMediaTag, } from "./media.js";

package/dist/media.d.ts

@@ -1,4 +1,4 @@
-import { JsonApiResource, JsonApiRelationship } from "./types";
+import { JsonApiResource, JsonApiRelationship } from "./types.js";
 export interface DrupalImageData {
     src: string;
     alt: string;

package/dist/media.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../src/media.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AAG9D,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,cAAc,GAAG,OAAO,GAAG,SAAS,CAAA;IACvE,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,KAAK,CAAC,EAAE,eAAe,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,eAAe,CAAA;CAC1B;AAED,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,eAAe,EAAE,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,GACT,eAAe,GAAG,SAAS,CAE7B;AAED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,eAAe,EAAE,GAAG,SAAS,EACvC,YAAY,EAAE,mBAAmB,GAAG,SAAS,GAC5C,eAAe,GAAG,SAAS,CAK7B;AAED,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,eAAe,EAAE,GAAG,SAAS,EACvC,YAAY,EAAE,mBAAmB,GAAG,SAAS,GAC5C,eAAe,EAAE,CAUnB;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,IAAI,CAkB9F;AAcD,wBAAgB,YAAY,CAC1B,KAAK,EAAE,eAAe,GAAG,SAAS,EAClC,QAAQ,EAAE,eAAe,EAAE,GAAG,SAAS,GACtC,eAAe,GAAG,IAAI,CAgGxB;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,eAAe,EAAE,GAAG,SAAS,GACtC,eAAe,EAAE,CAanB;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,SAAS,GAAG,eAAe,GAAG,IAAI,CAY5H;AAgBD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG/D;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAUhE"}
+{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../src/media.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGjE,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,cAAc,GAAG,OAAO,GAAG,SAAS,CAAA;IACvE,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,KAAK,CAAC,EAAE,eAAe,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,eAAe,CAAA;CAC1B;AAED,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,eAAe,EAAE,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,GACT,eAAe,GAAG,SAAS,CAE7B;AAED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,eAAe,EAAE,GAAG,SAAS,EACvC,YAAY,EAAE,mBAAmB,GAAG,SAAS,GAC5C,eAAe,GAAG,SAAS,CAK7B;AAED,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,eAAe,EAAE,GAAG,SAAS,EACvC,YAAY,EAAE,mBAAmB,GAAG,SAAS,GAC5C,eAAe,EAAE,CAUnB;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,IAAI,CAkB9F;AAcD,wBAAgB,YAAY,CAC1B,KAAK,EAAE,eAAe,GAAG,SAAS,EAClC,QAAQ,EAAE,eAAe,EAAE,GAAG,SAAS,GACtC,eAAe,GAAG,IAAI,CAgGxB;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,eAAe,EAAE,GAAG,SAAS,GACtC,eAAe,EAAE,CAanB;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,SAAS,GAAG,eAAe,GAAG,IAAI,CAY5H;AAgBD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG/D;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAUhE"}

package/dist/media.js

@@ -1,4 +1,4 @@
-import { getFileUrl } from "./url";
+import { getFileUrl } from "./url.js";
 export function findIncluded(included, type, id) {
     return included?.find((item) => item.type === type && item.id === id);
 }

package/dist/resolve.d.ts

@@ -1,5 +1,5 @@
-import { ResolveResponse } from "./types";
-import { FetchInit, FetchLike } from "./transport";
+import { ResolveResponse } from "./types.js";
+import { FetchInit, FetchLike } from "./transport.js";
 /**
  * Resolve a frontend path to a Drupal resource.
  */

package/dist/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAuD,MAAM,aAAa,CAAA;AAEvG;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB,GACA,OAAO,CAAC,eAAe,CAAC,CA8B1B"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAuD,MAAM,gBAAgB,CAAA;AAE1G;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB,GACA,OAAO,CAAC,eAAe,CAAC,CA8B1B"}

package/dist/resolve.js

@@ -1,4 +1,4 @@
-import { getDrupalBaseUrlFromOptions, getFetch, mergeHeaders } from "./transport";
+import { getDrupalBaseUrlFromOptions, getFetch, mergeHeaders } from "./transport.js";
 /**
  * Resolve a frontend path to a Drupal resource.
  */

package/dist/transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAChB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG;IACpC,IAAI,CAAC,EAAE,gBAAgB,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAOzF,wBAAgB,2BAA2B,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAMnG;AAED,wBAAgB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAMzD;AAED,wBAAgB,YAAY,CAAC,GAAG,WAAW,EAAE,KAAK,CAAC,WAAW,GAAG,SAAS,CAAC,GAAG,OAAO,CAOpF"}
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAChB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG;IACpC,IAAI,CAAC,EAAE,gBAAgB,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAOzF,wBAAgB,2BAA2B,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAkBnG;AAED,wBAAgB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAMzD;AAED,wBAAgB,YAAY,CAAC,GAAG,WAAW,EAAE,KAAK,CAAC,WAAW,GAAG,SAAS,CAAC,GAAG,OAAO,CAOpF"}

package/dist/transport.js

@@ -3,11 +3,21 @@ function getEnvString(key) {
     return typeof value === "string" && value.trim() !== "" ? value : undefined;
 }
 export function getDrupalBaseUrlFromOptions(options) {
-    const baseUrl = options?.baseUrl ?? getEnvString(options?.envKey ?? "DRUPAL_BASE_URL");
-    if (!baseUrl) {
+    const rawBaseUrl = options?.baseUrl ?? getEnvString(options?.envKey ?? "DRUPAL_BASE_URL");
+    if (!rawBaseUrl) {
         throw new Error(`Missing Drupal base URL (pass baseUrl or set ${options?.envKey ?? "DRUPAL_BASE_URL"})`);
     }
-    return baseUrl.replace(/\/$/, "");
+    let parsed;
+    try {
+        parsed = new URL(rawBaseUrl);
+    }
+    catch {
+        throw new Error(`Invalid Drupal base URL "${rawBaseUrl}" (expected http(s) URL)`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new Error(`Invalid Drupal base URL protocol "${parsed.protocol}" (expected http/https)`);
+    }
+    return parsed.toString().replace(/\/$/, "");
 }
 export function getFetch(fetchLike) {
     const f = fetchLike ?? globalThis.fetch;

package/dist/url.js

@@ -1,4 +1,4 @@
-import { getDrupalBaseUrlFromOptions } from "./transport";
+import { getDrupalBaseUrlFromOptions } from "./transport.js";
 /**
  * Get the Drupal base URL.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codewheel/jsonapi-frontend-client",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "TypeScript client helpers for Drupal drupal/jsonapi_frontend",
   "homepage": "https://github.com/code-wheel/jsonapi-frontend-client#readme",
   "repository": {