@coinlist-co/react 0.10.1 → 0.11.1-rc.22d81d4

package/README.md

@@ -5,3 +5,35 @@ This package is documented at:
 https://docs.coinlist.co/
 
 Please refer to the docs site for installation, configuration, and integration guides.
+
+## Local development
+
+The toolchain (Node 24, TypeScript) is pinned by `flake.nix` and frozen by `flake.lock`.
+
+Prerequisites:
+
+1. Nix — install with the [Determinate Systems installer](https://github.com/DeterminateSystems/nix-installer),
+   which enables flakes out of the box and supports clean uninstalls:
+
+   ```bash
+   curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install
+   ```
+
+2. [direnv](https://direnv.net/) and [nix-direnv](https://github.com/nix-community/nix-direnv)
+   (direnv on its own does not provide `use flake`).
+
+```bash
+direnv allow   # activates the dev shell on every cd into the repo
+```
+
+Without direnv, enter the same shell manually:
+
+```bash
+nix develop
+```
+
+The flake provides the toolchain, not `node_modules` — install JS dependencies as usual:
+
+```bash
+npm ci
+```

package/dist/chunk-AQIHCFW4.js

@@ -0,0 +1,279 @@
+import {
+  Attributes,
+  HEADER_IDEMPOTENCY_KEY,
+  HttpClient,
+  HttpError,
+  Request,
+  getUUIDv4
+} from "./chunk-ZVB6KWZ2.js";
+
+// src/shared/api/nabu/config.ts
+var NABU_BASE_URL = "https://asset.coinlist.co";
+
+// src/shared/core/observability/pino-logger.ts
+function toPinoRecord(event) {
+  try {
+    const record = {};
+    for (const key of ownKeys(event.fields)) {
+      record[key] = readProperty(event.fields, key, 0, /* @__PURE__ */ new WeakSet());
+    }
+    const cause = "cause" in event ? event.cause : void 0;
+    if (cause !== void 0) {
+      record.cause = sanitize(cause, 0, /* @__PURE__ */ new WeakSet());
+    }
+    return { ...record, scope: event.scope, ...event.bindings };
+  } catch (_) {
+    return { "log.render": "<unrenderable event>" };
+  }
+}
+var PINO_LEVEL = {
+  none: "silent",
+  error: "error",
+  warn: "warn",
+  info: "info",
+  debug: "debug"
+};
+var MAX_DEPTH = 8;
+function sanitize(value, depth, seen) {
+  switch (typeof value) {
+    case "string":
+    case "boolean":
+      return value;
+    case "number":
+      return Number.isFinite(value) ? value : String(value);
+    case "bigint":
+      return value.toString();
+    case "undefined":
+      return "<undefined>";
+    case "function":
+      return "<function>";
+    case "symbol":
+      return value.toString();
+    case "object":
+      return value === null ? null : sanitizeObject(value, depth, seen);
+    default:
+      return "<unrenderable>";
+  }
+}
+function sanitizeObject(value, depth, seen) {
+  if (seen.has(value)) return "<circular>";
+  if (depth >= MAX_DEPTH) return "<max depth>";
+  if (value instanceof Error) return describeError(value);
+  if (value instanceof Date) return describeDate(value);
+  seen.add(value);
+  try {
+    if (Array.isArray(value)) {
+      return value.map(
+        (_item, index) => readProperty(value, String(index), depth, seen)
+      );
+    }
+    const out = {};
+    for (const key of ownKeys(value)) {
+      out[key] = readProperty(value, key, depth, seen);
+    }
+    return out;
+  } finally {
+    seen.delete(value);
+  }
+}
+function readProperty(owner, key, depth, seen) {
+  try {
+    return sanitize(owner[key], depth + 1, seen);
+  } catch (_) {
+    return "<unreadable>";
+  }
+}
+function ownKeys(value) {
+  try {
+    return Object.keys(value);
+  } catch (_) {
+    return [];
+  }
+}
+function describeError(error) {
+  return {
+    name: safeRead(() => error.name),
+    message: safeRead(() => error.message),
+    stack: safeRead(() => error.stack)
+  };
+}
+function describeDate(date) {
+  return safeRead(() => date.toISOString());
+}
+function safeRead(read) {
+  try {
+    const value = read();
+    return typeof value === "string" ? value : "<unreadable>";
+  } catch (_) {
+    return "<unreadable>";
+  }
+}
+var SDK_LOGGER_NAME = "@coinlist-co/react";
+function loggerOverPino(sink, level) {
+  return {
+    level: () => level,
+    debug: (event) => emit(sink, "debug", event),
+    info: (event) => emit(sink, "info", event),
+    warn: (event) => emit(sink, "warn", event),
+    error: (event) => emit(sink, "error", event)
+  };
+}
+function emit(sink, method, event) {
+  try {
+    const value = event();
+    sink[method](toPinoRecord(value), value.msg);
+  } catch (error) {
+    reportRenderFailure(sink, error);
+  }
+}
+function reportRenderFailure(sink, error) {
+  try {
+    sink.error(
+      { "error.type": error instanceof Error ? error.name : typeof error },
+      "log event failed to render"
+    );
+  } catch (_) {
+  }
+}
+
+// src/shared/api/middleware/attach-session-middleware.ts
+function attachSessionMiddleware(fetchAccessToken) {
+  return async (request) => {
+    if (!Attributes.isProtected(request.attributes)) {
+      return request;
+    }
+    let accessToken = await fetchAccessToken(false);
+    if (!accessToken) {
+      const clientCreds = Attributes.getClientCredentials(request.attributes);
+      if (clientCreds) {
+        accessToken = clientCreds;
+      }
+    }
+    if (accessToken === null) {
+      return request;
+    }
+    return {
+      ...request,
+      headers: {
+        ...request.headers ?? {},
+        Authorization: `Bearer ${accessToken.value}`
+      }
+    };
+  };
+}
+
+// src/shared/api/middleware/idempotency-key.ts
+var idempotencyKeyMiddleware = async (request) => {
+  if (!Attributes.isIdempotent(request.attributes)) {
+    return request;
+  }
+  const existingHeaders = request.headers ?? {};
+  if (existingHeaders[HEADER_IDEMPOTENCY_KEY]) {
+    return request;
+  }
+  return {
+    ...request,
+    headers: {
+      ...existingHeaders,
+      [HEADER_IDEMPOTENCY_KEY]: getUUIDv4()
+    }
+  };
+};
+
+// src/shared/api/middleware/request-retry.ts
+var MAX_ATTEMPTS = 3;
+var INITIAL_DELAY_MS = 300;
+var MAX_DELAY_MS = 2e3;
+var RETRYABLE_4XX = /* @__PURE__ */ new Set([408, 409, 429]);
+function isRetryableStatus(status) {
+  return status >= 500 && status < 600 || RETRYABLE_4XX.has(status);
+}
+function getRetryDelayMs(attempt) {
+  return Math.min(INITIAL_DELAY_MS * 2 ** (attempt - 1), MAX_DELAY_MS);
+}
+function createRequestRetryMiddleware(options = {}) {
+  const delayFn = options.delayFn ?? defaultDelay;
+  return async ({ request, response, retry }) => {
+    if (!isRetryableStatus(response.status)) {
+      return response;
+    }
+    const currentAttempt = Attributes.getRetryAttempt(request.attributes);
+    if (currentAttempt >= MAX_ATTEMPTS - 1) {
+      return response;
+    }
+    const nextAttempt = currentAttempt + 1;
+    await delayFn(getRetryDelayMs(nextAttempt));
+    const nextRequest = Request.concatAttributes(
+      request,
+      Attributes.retryAttempt(nextAttempt)
+    );
+    return retry(nextRequest);
+  };
+}
+function defaultDelay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+var requestRetryMiddleware = createRequestRetryMiddleware();
+
+// src/shared/api/middleware/session-renewal.ts
+function renewSessionMiddleware(fetchAccessToken) {
+  return async ({ request, response, retry }) => {
+    if (response.status !== 401) {
+      return response;
+    }
+    if (!Attributes.isProtected(request.attributes)) {
+      return response;
+    }
+    if (Attributes.wasRenewAttempted(request.attributes)) {
+      return response;
+    }
+    const newToken = await fetchAccessToken(true);
+    if (newToken) {
+      const nextRequest = Request.concatAttributes(
+        request,
+        Attributes.renewAttempted(true)
+      );
+      return retry(nextRequest);
+    } else {
+      return response;
+    }
+  };
+}
+
+// src/shared/api/authenticated-api-client.ts
+var AuthenticatedApiClient = class {
+  constructor(config, fetchAccessToken, additionalBeforeRequest = [], logger = null) {
+    this.httpClient = new HttpClient(
+      config,
+      {
+        beforeRequest: [
+          attachSessionMiddleware(fetchAccessToken),
+          ...additionalBeforeRequest,
+          idempotencyKeyMiddleware
+        ],
+        afterRequest: [
+          renewSessionMiddleware(fetchAccessToken),
+          requestRetryMiddleware
+        ]
+      },
+      logger
+    );
+  }
+  async send(request) {
+    const response = await this.httpClient.send(request);
+    if (response.status >= 200 && response.status < 300) {
+      return response.body;
+    } else {
+      throw new HttpError(response);
+    }
+  }
+};
+
+export {
+  AuthenticatedApiClient,
+  NABU_BASE_URL,
+  PINO_LEVEL,
+  SDK_LOGGER_NAME,
+  loggerOverPino
+};
+//# sourceMappingURL=chunk-AQIHCFW4.js.map

package/dist/chunk-AQIHCFW4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared/api/nabu/config.ts","../src/shared/core/observability/pino-logger.ts","../src/shared/api/middleware/attach-session-middleware.ts","../src/shared/api/middleware/idempotency-key.ts","../src/shared/api/middleware/request-retry.ts","../src/shared/api/middleware/session-renewal.ts","../src/shared/api/authenticated-api-client.ts"],"sourcesContent":["/**\n * Base URL of CoinList's public token registry (Nabu), a static CDN serving\n * token display metadata keyed by chain + contract address. Override per\n * environment via `Config.tokensBaseUrl`.\n */\nexport const NABU_BASE_URL = 'https://asset.coinlist.co';\n","import type {\n  DebugEvent,\n  Logger,\n  LogLevel,\n  SafeEvent,\n} from '@/shared/types/logger';\n\n/**\n * The SDK's logging seam expressed over pino, minus the environment.\n *\n * Imports no pino - {@link PinoSink} is a structural type - so `@/shared`\n * stays pino-free and the `./shared` entry point costs a consumer nothing.\n * Both shipped implementations\n * ({@link pinoClientLogger}, {@link pinoServerLogger}) differ only in the pino\n * instance they construct; everything worth testing lives here.\n *\n * ## Nothing here may throw\n *\n * A {@link Logger} implementation is called inline, on the codepath of the\n * work it reports, and the SDK does not catch it - so a log line that fails to\n * render would turn a successful request into an exception. That risk is real\n * rather than theoretical: `'debug'` fields carry whatever the SDK was\n * handling, and this codebase routinely handles `bigint` (every uint256 on\n * every DTO), which `JSON.stringify` throws on. Response bodies may be\n * circular, params may hold functions, and a host's object may have a getter\n * that throws.\n *\n * So {@link toPinoRecord} is total by construction: every value is rendered\n * into something a JSON serialiser cannot refuse, every property read is\n * guarded, and the whole translation has a fallback. Pino is never handed a\n * value it could fail on.\n */\n\n/**\n * Flattens an event into the object pino merges into its output line.\n *\n * Flat rather than nested, because nesting is what a host has to un-nest\n * before they can facet on it: `scope`, the {@link LogBindings} and every\n * field sit at the top level, and only `cause` stays an object because its\n * arms are a closed union a host switches on.\n *\n * `msg` is **not** included: it is pino's own second argument.\n *\n * Never throws. A value it cannot render becomes a `<tag>` string rather than\n * an exception, and a translation that fails entirely degrades to a record\n * naming the failure.\n */\nexport function toPinoRecord(event: SafeEvent | DebugEvent): PinoRecord {\n  try {\n    const record: Record<string, unknown> = {};\n\n    for (const key of ownKeys(event.fields)) {\n      record[key] = readProperty(event.fields, key, 0, new WeakSet());\n    }\n\n    const cause = 'cause' in event ? event.cause : undefined;\n    if (cause !== undefined) {\n      record.cause = sanitize(cause, 0, new WeakSet());\n    }\n\n    // Last, so the stamped keys win. `scope` and the bindings are what a host\n    // routes and filters on, and they are stamped by `internalLogger` rather\n    // than written at a call site - so a field that happened to be named\n    // `scope` or `op` must not be able to take their place.\n    return { ...record, scope: event.scope, ...event.bindings };\n  } catch (_) {\n    // The event itself is malformed - a Proxy for `fields`, a frozen exotic\n    // object. Report that rather than losing the line, and never rethrow.\n    return { 'log.render': '<unrenderable event>' };\n  }\n}\n\n/** What pino merges into one output line. */\nexport type PinoRecord = Readonly<Record<string, unknown>>;\n\n/**\n * The SDK's five levels in pino's vocabulary.\n *\n * `'none'` is pino's `'silent'`; the other four are the same word in both, and\n * deliberately so. The SDK does not adopt pino's seven because `'trace'` would\n * sit below `'debug'`, and the guarantee \"`debug` is unredacted and every\n * other level is not\" only closes while `'debug'` is the bottom.\n */\nexport const PINO_LEVEL = {\n  none: 'silent',\n  error: 'error',\n  warn: 'warn',\n  info: 'info',\n  debug: 'debug',\n} as const satisfies Record<LogLevel, string>;\n\n/**\n * How deep a `'debug'` field is followed before it is summarised.\n *\n * A bound rather than a guess at what is deep enough: a self-referential\n * structure is already caught by the cycle check, but a legitimately deep DTO\n * would otherwise cost real time inside a log line.\n */\nconst MAX_DEPTH = 8;\n\n/**\n * Renders any value into something a JSON serialiser cannot refuse.\n *\n * `bigint` is the one that matters in practice - every uint256 the SDK handles\n * is one - but the rest are all reachable from a `'debug'` field: `undefined`\n * and functions from an operation's params, `NaN` from arithmetic, symbols\n * from a host's object.\n */\nfunction sanitize(\n  value: unknown,\n  depth: number,\n  seen: WeakSet<object>\n): unknown {\n  switch (typeof value) {\n    case 'string':\n    case 'boolean':\n      return value;\n    case 'number':\n      // `NaN` and the infinities serialise to `null`, which reads as \"absent\"\n      // rather than \"not a number\". Name them instead.\n      return Number.isFinite(value) ? value : String(value);\n    case 'bigint':\n      return value.toString();\n    case 'undefined':\n      return '<undefined>';\n    case 'function':\n      return '<function>';\n    case 'symbol':\n      return value.toString();\n    case 'object':\n      return value === null ? null : sanitizeObject(value, depth, seen);\n    default:\n      return '<unrenderable>';\n  }\n}\n\nfunction sanitizeObject(\n  value: object,\n  depth: number,\n  seen: WeakSet<object>\n): unknown {\n  if (seen.has(value)) return '<circular>';\n  if (depth >= MAX_DEPTH) return '<max depth>';\n\n  // `name`, `message` and `stack` are all non-enumerable, so an `Error` handed\n  // to a structured sink as an object serialises to `{}`.\n  if (value instanceof Error) return describeError(value);\n  if (value instanceof Date) return describeDate(value);\n\n  seen.add(value);\n  try {\n    if (Array.isArray(value)) {\n      return value.map((_item, index) =>\n        readProperty(value, String(index), depth, seen)\n      );\n    }\n\n    const out: Record<string, unknown> = {};\n    for (const key of ownKeys(value)) {\n      out[key] = readProperty(value, key, depth, seen);\n    }\n    return out;\n  } finally {\n    // Removed on the way out, so a value referenced twice in a tree renders\n    // twice. Only a genuine cycle is `<circular>`.\n    seen.delete(value);\n  }\n}\n\n/**\n * One property read, guarded. A getter may throw, and a log line is not\n * allowed to be the reason a request fails.\n */\nfunction readProperty(\n  owner: object,\n  key: string,\n  depth: number,\n  seen: WeakSet<object>\n): unknown {\n  try {\n    return sanitize((owner as Record<string, unknown>)[key], depth + 1, seen);\n  } catch (_) {\n    return '<unreadable>';\n  }\n}\n\n/** Own enumerable keys, guarded: an exotic object may refuse to be enumerated. */\nfunction ownKeys(value: object): readonly string[] {\n  try {\n    return Object.keys(value);\n  } catch (_) {\n    return [];\n  }\n}\n\nfunction describeError(error: Error): Record<string, unknown> {\n  return {\n    name: safeRead(() => error.name),\n    message: safeRead(() => error.message),\n    stack: safeRead(() => error.stack),\n  };\n}\n\nfunction describeDate(date: Date): unknown {\n  // An invalid `Date` throws from `toISOString`.\n  return safeRead(() => date.toISOString());\n}\n\nfunction safeRead(read: () => unknown): unknown {\n  try {\n    const value = read();\n    return typeof value === 'string' ? value : '<unreadable>';\n  } catch (_) {\n    return '<unreadable>';\n  }\n}\n\n/**\n * The part of a pino logger this adapter uses.\n *\n * Structural rather than `import type { Logger } from 'pino'`, so that\n * `@/shared` takes no dependency on pino at all. A real pino instance - node\n * or browser build - satisfies it.\n */\nexport type PinoSink = {\n  debug(record: PinoRecord, msg: string): void;\n  info(record: PinoRecord, msg: string): void;\n  warn(record: PinoRecord, msg: string): void;\n  error(record: PinoRecord, msg: string): void;\n};\n\n/**\n * The `name` binding every SDK line carries, so a partner can separate the\n * SDK's output from their own in a shared aggregator without matching on\n * `scope`.\n *\n * Applied through `pino.child({ name })` rather than pino's `name` *option*,\n * which its browser build ignores. The browser lane's spec is what caught\n * that, and is what keeps it caught.\n */\nexport const SDK_LOGGER_NAME = '@coinlist-co/react';\n\n/**\n * Adapts a pino instance into the {@link Logger} the SDK consumes.\n *\n * **Total, and that is the point.** The SDK calls a `Logger` inline and does\n * not catch it, so an exception raised while reporting a successful request\n * would fail that request. Three things could raise one - the event lambda\n * itself, rendering the event, and the sink - and all three are caught here.\n * A render failure is reported through the sink rather than swallowed, since a\n * log line that silently vanishes is a bug nobody finds; if the sink is what\n * broke, there is nowhere left to report it and the error stops here.\n *\n * **The level is fixed here, and that is this adapter's choice rather than the\n * seam's.** {@link InternalLogger} calls {@link Logger.level} before *every*\n * log call and caches nothing, so a host-implemented `Logger` reading a mutable\n * field has a level they can change at runtime. This adapter captures `level`\n * instead, and the pino instance it wraps is built with a fixed one - so\n * `Logger.level` is a constant lookup and two loggers never interfere. A host\n * who wants to turn `'debug'` on without rebuilding implements {@link Logger}\n * directly over their own pino instance; the port is four methods and this\n * function is the worked example.\n */\nexport function loggerOverPino(sink: PinoSink, level: LogLevel): Logger {\n  return {\n    level: () => level,\n    debug: (event) => emit(sink, 'debug', event),\n    info: (event) => emit(sink, 'info', event),\n    warn: (event) => emit(sink, 'warn', event),\n    error: (event) => emit(sink, 'error', event),\n  };\n}\n\nfunction emit(\n  sink: PinoSink,\n  method: keyof PinoSink,\n  event: () => SafeEvent | DebugEvent\n): void {\n  try {\n    const value = event();\n    sink[method](toPinoRecord(value), value.msg);\n  } catch (error) {\n    reportRenderFailure(sink, error);\n  }\n}\n\nfunction reportRenderFailure(sink: PinoSink, error: unknown): void {\n  try {\n    sink.error(\n      { 'error.type': error instanceof Error ? error.name : typeof error },\n      'log event failed to render'\n    );\n  } catch (_) {\n    // The sink itself threw. There is nowhere left to report this, and the SDK\n    // is on the other side of the call that got us here.\n  }\n}\n","import type { HttpRequest } from '@/shared/api/http';\nimport { Attributes } from '@/shared/api/http-attributes';\nimport type { BeforeRequestMiddleware } from '@/shared/api/http-client';\nimport type { OAuthAccessToken } from '@/shared/types/oauth-session';\n\nexport function attachSessionMiddleware(\n  fetchAccessToken: (refresh: boolean) => Promise<OAuthAccessToken | null>\n): BeforeRequestMiddleware {\n  return async (request: HttpRequest): Promise<HttpRequest> => {\n    if (!Attributes.isProtected(request.attributes)) {\n      return request;\n    }\n\n    let accessToken = await fetchAccessToken(false);\n    if (!accessToken) {\n      const clientCreds = Attributes.getClientCredentials(request.attributes);\n      if (clientCreds) {\n        accessToken = clientCreds;\n      }\n    }\n\n    if (accessToken === null) {\n      return request;\n    }\n\n    return {\n      ...request,\n      headers: {\n        ...(request.headers ?? {}),\n        Authorization: `Bearer ${accessToken.value}`,\n      },\n    };\n  };\n}\n","import { HEADER_IDEMPOTENCY_KEY } from '@/shared/api/frontline/config';\nimport type { HttpRequest } from '@/shared/api/http';\nimport { Attributes } from '@/shared/api/http-attributes';\nimport type { BeforeRequestMiddleware } from '@/shared/api/http-client';\nimport { getUUIDv4 } from '@/shared/core/utils/crypto';\n\nexport const idempotencyKeyMiddleware: BeforeRequestMiddleware = async (\n  request: HttpRequest\n): Promise<HttpRequest> => {\n  if (!Attributes.isIdempotent(request.attributes)) {\n    return request;\n  }\n\n  const existingHeaders = request.headers ?? {};\n  if (existingHeaders[HEADER_IDEMPOTENCY_KEY]) {\n    return request;\n  }\n\n  return {\n    ...request,\n    headers: {\n      ...existingHeaders,\n      [HEADER_IDEMPOTENCY_KEY]: getUUIDv4(),\n    },\n  };\n};\n","import { Request } from '@/shared/api/http';\nimport { Attributes } from '@/shared/api/http-attributes';\nimport type { AfterRequestMiddleware } from '@/shared/api/http-client';\n\nconst MAX_ATTEMPTS = 3;\nconst INITIAL_DELAY_MS = 300;\nconst MAX_DELAY_MS = 2000;\n\nconst RETRYABLE_4XX = new Set([408, 409, 429]);\n\nexport function isRetryableStatus(status: number): boolean {\n  return (status >= 500 && status < 600) || RETRYABLE_4XX.has(status);\n}\n\nfunction getRetryDelayMs(attempt: number): number {\n  return Math.min(INITIAL_DELAY_MS * 2 ** (attempt - 1), MAX_DELAY_MS);\n}\n\nexport type RequestRetryMiddlewareOptions = {\n  /**\n   * Optional delay function. Defaults to real setTimeout-based delay.\n   * Use a no-op (e.g. () => Promise.resolve()) in tests to avoid slow tests.\n   */\n  delayFn?: (ms: number) => Promise<void>;\n};\n\n/**\n * Creates the request retry after-request middleware. Inject a no-op delayFn\n * in tests to avoid real delays (unit testing best practice).\n */\nexport function createRequestRetryMiddleware(\n  options: RequestRetryMiddlewareOptions = {}\n): AfterRequestMiddleware {\n  const delayFn = options.delayFn ?? defaultDelay;\n\n  return async ({ request, response, retry }) => {\n    if (!isRetryableStatus(response.status)) {\n      return response;\n    }\n\n    const currentAttempt = Attributes.getRetryAttempt(request.attributes);\n    if (currentAttempt >= MAX_ATTEMPTS - 1) {\n      return response;\n    }\n\n    const nextAttempt = currentAttempt + 1;\n    await delayFn(getRetryDelayMs(nextAttempt));\n\n    const nextRequest = Request.concatAttributes(\n      request,\n      Attributes.retryAttempt(nextAttempt)\n    );\n    return retry(nextRequest);\n  };\n}\n\nfunction defaultDelay(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n/**\n * Retries the request up to 3 times with exponential backoff when the response\n * has a retryable status (5xx server errors). Uses request.attributes.retryAttempt\n * to decide delay and whether to retry, so the middleware does not loop when\n * retry() runs the full HTTP middleware chain again.\n */\nexport const requestRetryMiddleware: AfterRequestMiddleware =\n  createRequestRetryMiddleware();\n","import { Request } from '@/shared/api/http';\nimport { Attributes } from '@/shared/api/http-attributes';\nimport type { AfterRequestMiddleware } from '@/shared/api/http-client';\nimport type { OAuthAccessToken } from '@/shared/types/oauth-session';\n\nexport function renewSessionMiddleware(\n  fetchAccessToken: (refresh: boolean) => Promise<OAuthAccessToken | null>\n): AfterRequestMiddleware {\n  return async ({ request, response, retry }) => {\n    if (response.status !== 401) {\n      return response;\n    }\n    if (!Attributes.isProtected(request.attributes)) {\n      return response;\n    }\n    if (Attributes.wasRenewAttempted(request.attributes)) {\n      return response;\n    }\n\n    const newToken = await fetchAccessToken(true);\n    if (newToken) {\n      const nextRequest = Request.concatAttributes(\n        request,\n        Attributes.renewAttempted(true)\n      );\n      return retry(nextRequest);\n    } else {\n      return response;\n    }\n  };\n}\n","import type { HttpClientConfig, HttpRequest } from '@/shared/api/http';\nimport { HttpError } from '@/shared/api/http';\nimport type { BeforeRequestMiddleware } from '@/shared/api/http-client';\nimport { HttpClient } from '@/shared/api/http-client';\nimport { attachSessionMiddleware } from '@/shared/api/middleware/attach-session-middleware';\nimport { idempotencyKeyMiddleware } from '@/shared/api/middleware/idempotency-key';\nimport { requestRetryMiddleware } from '@/shared/api/middleware/request-retry';\nimport { renewSessionMiddleware } from '@/shared/api/middleware/session-renewal';\nimport type { Logger } from '@/shared/types/logger';\nimport type { OAuthAccessToken } from '@/shared/types/oauth-session';\n\n/**\n * Isomorphic HTTP client with session attachment, session renewal on 401,\n * idempotency key injection, and request retry. Works in both browser and\n * Node/server environments. Pass `additionalBeforeRequest` to inject\n * environment-specific middleware (e.g. `userAgentMiddleware` on the client).\n *\n * Pass `logger` through to have every request reported; the client logs\n * nothing without one.\n */\nexport class AuthenticatedApiClient {\n  private readonly httpClient: HttpClient;\n\n  constructor(\n    config: HttpClientConfig,\n    fetchAccessToken: (refresh: boolean) => Promise<OAuthAccessToken | null>,\n    additionalBeforeRequest: BeforeRequestMiddleware[] = [],\n    logger: Logger | null = null\n  ) {\n    this.httpClient = new HttpClient(\n      config,\n      {\n        beforeRequest: [\n          attachSessionMiddleware(fetchAccessToken),\n          ...additionalBeforeRequest,\n          idempotencyKeyMiddleware,\n        ],\n        afterRequest: [\n          renewSessionMiddleware(fetchAccessToken),\n          requestRetryMiddleware,\n        ],\n      },\n      logger\n    );\n  }\n\n  async send<TResponse>(request: HttpRequest): Promise<TResponse> {\n    const response = await this.httpClient.send<TResponse>(request);\n    if (response.status >= 200 && response.status < 300) {\n      return response.body as TResponse;\n    } else {\n      throw new HttpError(response);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;AAKO,IAAM,gBAAgB;;;AC0CtB,SAAS,aAAa,OAA2C;AACtE,MAAI;AACF,UAAM,SAAkC,CAAC;AAEzC,eAAW,OAAO,QAAQ,MAAM,MAAM,GAAG;AACvC,aAAO,GAAG,IAAI,aAAa,MAAM,QAAQ,KAAK,GAAG,oBAAI,QAAQ,CAAC;AAAA,IAChE;AAEA,UAAM,QAAQ,WAAW,QAAQ,MAAM,QAAQ;AAC/C,QAAI,UAAU,QAAW;AACvB,aAAO,QAAQ,SAAS,OAAO,GAAG,oBAAI,QAAQ,CAAC;AAAA,IACjD;AAMA,WAAO,EAAE,GAAG,QAAQ,OAAO,MAAM,OAAO,GAAG,MAAM,SAAS;AAAA,EAC5D,SAAS,GAAG;AAGV,WAAO,EAAE,cAAc,uBAAuB;AAAA,EAChD;AACF;AAaO,IAAM,aAAa;AAAA,EACxB,MAAM;AAAA,EACN,OAAO;AAAA,EACP,MAAM;AAAA,EACN,MAAM;AAAA,EACN,OAAO;AACT;AASA,IAAM,YAAY;AAUlB,SAAS,SACP,OACA,OACA,MACS;AACT,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAGH,aAAO,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK;AAAA,IACtD,KAAK;AACH,aAAO,MAAM,SAAS;AAAA,IACxB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,MAAM,SAAS;AAAA,IACxB,KAAK;AACH,aAAO,UAAU,OAAO,OAAO,eAAe,OAAO,OAAO,IAAI;AAAA,IAClE;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,eACP,OACA,OACA,MACS;AACT,MAAI,KAAK,IAAI,KAAK,EAAG,QAAO;AAC5B,MAAI,SAAS,UAAW,QAAO;AAI/B,MAAI,iBAAiB,MAAO,QAAO,cAAc,KAAK;AACtD,MAAI,iBAAiB,KAAM,QAAO,aAAa,KAAK;AAEpD,OAAK,IAAI,KAAK;AACd,MAAI;AACF,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,aAAO,MAAM;AAAA,QAAI,CAAC,OAAO,UACvB,aAAa,OAAO,OAAO,KAAK,GAAG,OAAO,IAAI;AAAA,MAChD;AAAA,IACF;AAEA,UAAM,MAA+B,CAAC;AACtC,eAAW,OAAO,QAAQ,KAAK,GAAG;AAChC,UAAI,GAAG,IAAI,aAAa,OAAO,KAAK,OAAO,IAAI;AAAA,IACjD;AACA,WAAO;AAAA,EACT,UAAE;AAGA,SAAK,OAAO,KAAK;AAAA,EACnB;AACF;AAMA,SAAS,aACP,OACA,KACA,OACA,MACS;AACT,MAAI;AACF,WAAO,SAAU,MAAkC,GAAG,GAAG,QAAQ,GAAG,IAAI;AAAA,EAC1E,SAAS,GAAG;AACV,WAAO;AAAA,EACT;AACF;AAGA,SAAS,QAAQ,OAAkC;AACjD,MAAI;AACF,WAAO,OAAO,KAAK,KAAK;AAAA,EAC1B,SAAS,GAAG;AACV,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,cAAc,OAAuC;AAC5D,SAAO;AAAA,IACL,MAAM,SAAS,MAAM,MAAM,IAAI;AAAA,IAC/B,SAAS,SAAS,MAAM,MAAM,OAAO;AAAA,IACrC,OAAO,SAAS,MAAM,MAAM,KAAK;AAAA,EACnC;AACF;AAEA,SAAS,aAAa,MAAqB;AAEzC,SAAO,SAAS,MAAM,KAAK,YAAY,CAAC;AAC1C;AAEA,SAAS,SAAS,MAA8B;AAC9C,MAAI;AACF,UAAM,QAAQ,KAAK;AACnB,WAAO,OAAO,UAAU,WAAW,QAAQ;AAAA,EAC7C,SAAS,GAAG;AACV,WAAO;AAAA,EACT;AACF;AAyBO,IAAM,kBAAkB;AAuBxB,SAAS,eAAe,MAAgB,OAAyB;AACtE,SAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,OAAO,CAAC,UAAU,KAAK,MAAM,SAAS,KAAK;AAAA,IAC3C,MAAM,CAAC,UAAU,KAAK,MAAM,QAAQ,KAAK;AAAA,IACzC,MAAM,CAAC,UAAU,KAAK,MAAM,QAAQ,KAAK;AAAA,IACzC,OAAO,CAAC,UAAU,KAAK,MAAM,SAAS,KAAK;AAAA,EAC7C;AACF;AAEA,SAAS,KACP,MACA,QACA,OACM;AACN,MAAI;AACF,UAAM,QAAQ,MAAM;AACpB,SAAK,MAAM,EAAE,aAAa,KAAK,GAAG,MAAM,GAAG;AAAA,EAC7C,SAAS,OAAO;AACd,wBAAoB,MAAM,KAAK;AAAA,EACjC;AACF;AAEA,SAAS,oBAAoB,MAAgB,OAAsB;AACjE,MAAI;AACF,SAAK;AAAA,MACH,EAAE,cAAc,iBAAiB,QAAQ,MAAM,OAAO,OAAO,MAAM;AAAA,MACnE;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AAAA,EAGZ;AACF;;;ACnSO,SAAS,wBACd,kBACyB;AACzB,SAAO,OAAO,YAA+C;AAC3D,QAAI,CAAC,WAAW,YAAY,QAAQ,UAAU,GAAG;AAC/C,aAAO;AAAA,IACT;AAEA,QAAI,cAAc,MAAM,iBAAiB,KAAK;AAC9C,QAAI,CAAC,aAAa;AAChB,YAAM,cAAc,WAAW,qBAAqB,QAAQ,UAAU;AACtE,UAAI,aAAa;AACf,sBAAc;AAAA,MAChB;AAAA,IACF;AAEA,QAAI,gBAAgB,MAAM;AACxB,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACP,GAAI,QAAQ,WAAW,CAAC;AAAA,QACxB,eAAe,UAAU,YAAY,KAAK;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;;;AC3BO,IAAM,2BAAoD,OAC/D,YACyB;AACzB,MAAI,CAAC,WAAW,aAAa,QAAQ,UAAU,GAAG;AAChD,WAAO;AAAA,EACT;AAEA,QAAM,kBAAkB,QAAQ,WAAW,CAAC;AAC5C,MAAI,gBAAgB,sBAAsB,GAAG;AAC3C,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS;AAAA,MACP,GAAG;AAAA,MACH,CAAC,sBAAsB,GAAG,UAAU;AAAA,IACtC;AAAA,EACF;AACF;;;ACrBA,IAAM,eAAe;AACrB,IAAM,mBAAmB;AACzB,IAAM,eAAe;AAErB,IAAM,gBAAgB,oBAAI,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC;AAEtC,SAAS,kBAAkB,QAAyB;AACzD,SAAQ,UAAU,OAAO,SAAS,OAAQ,cAAc,IAAI,MAAM;AACpE;AAEA,SAAS,gBAAgB,SAAyB;AAChD,SAAO,KAAK,IAAI,mBAAmB,MAAM,UAAU,IAAI,YAAY;AACrE;AAcO,SAAS,6BACd,UAAyC,CAAC,GAClB;AACxB,QAAM,UAAU,QAAQ,WAAW;AAEnC,SAAO,OAAO,EAAE,SAAS,UAAU,MAAM,MAAM;AAC7C,QAAI,CAAC,kBAAkB,SAAS,MAAM,GAAG;AACvC,aAAO;AAAA,IACT;AAEA,UAAM,iBAAiB,WAAW,gBAAgB,QAAQ,UAAU;AACpE,QAAI,kBAAkB,eAAe,GAAG;AACtC,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,iBAAiB;AACrC,UAAM,QAAQ,gBAAgB,WAAW,CAAC;AAE1C,UAAM,cAAc,QAAQ;AAAA,MAC1B;AAAA,MACA,WAAW,aAAa,WAAW;AAAA,IACrC;AACA,WAAO,MAAM,WAAW;AAAA,EAC1B;AACF;AAEA,SAAS,aAAa,IAA2B;AAC/C,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;AAQO,IAAM,yBACX,6BAA6B;;;AC9DxB,SAAS,uBACd,kBACwB;AACxB,SAAO,OAAO,EAAE,SAAS,UAAU,MAAM,MAAM;AAC7C,QAAI,SAAS,WAAW,KAAK;AAC3B,aAAO;AAAA,IACT;AACA,QAAI,CAAC,WAAW,YAAY,QAAQ,UAAU,GAAG;AAC/C,aAAO;AAAA,IACT;AACA,QAAI,WAAW,kBAAkB,QAAQ,UAAU,GAAG;AACpD,aAAO;AAAA,IACT;AAEA,UAAM,WAAW,MAAM,iBAAiB,IAAI;AAC5C,QAAI,UAAU;AACZ,YAAM,cAAc,QAAQ;AAAA,QAC1B;AAAA,QACA,WAAW,eAAe,IAAI;AAAA,MAChC;AACA,aAAO,MAAM,WAAW;AAAA,IAC1B,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACVO,IAAM,yBAAN,MAA6B;AAAA,EAGlC,YACE,QACA,kBACA,0BAAqD,CAAC,GACtD,SAAwB,MACxB;AACA,SAAK,aAAa,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,QACE,eAAe;AAAA,UACb,wBAAwB,gBAAgB;AAAA,UACxC,GAAG;AAAA,UACH;AAAA,QACF;AAAA,QACA,cAAc;AAAA,UACZ,uBAAuB,gBAAgB;AAAA,UACvC;AAAA,QACF;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,KAAgB,SAA0C;AAC9D,UAAM,WAAW,MAAM,KAAK,WAAW,KAAgB,OAAO;AAC9D,QAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;AACnD,aAAO,SAAS;AAAA,IAClB,OAAO;AACL,YAAM,IAAI,UAAU,QAAQ;AAAA,IAC9B;AAAA,EACF;AACF;","names":[]}