@datalayer/core 1.2.21 → 1.2.23

package/lib/api/DatalayerApi.d.ts

@@ -1,4 +1,3 @@
-import { AxiosRequestConfig } from 'axios';
 /**
  * Error wrapper for failed HTTP responses.
  * Includes response details, warnings, errors, and tracebacks.
@@ -44,15 +43,15 @@ export declare class RunResponseError extends Error {
 }
 /**
  * Error wrapper for network failures.
- * Thrown when HTTP request fails due to connectivity issues.
+ * Thrown when `fetch` could not reach the server at all.
  */
 export declare class NetworkError extends TypeError {
     /**
-     * Creates a NetworkError from the original TypeError.
+     * Creates a NetworkError from the error `fetch` rejected with.
      *
      * @param original - The original network error
      */
-    constructor(original: TypeError);
+    constructor(original: Error);
 }
 /**
  * Thrown when a request is made with a JWT that has already expired.
@@ -85,6 +84,15 @@ export declare class TokenExpiredError extends Error {
     readonly url: string;
     constructor(url: string, expiredAt: number);
 }
+/**
+ * How the response body is read.
+ *
+ * `json` (the default) parses the body as JSON and falls back to the text
+ * when it does not parse, so an empty body or a plain-text answer still
+ * arrives as data rather than an error. `stream` hands back the body's
+ * `ReadableStream` unread.
+ */
+export type DatalayerAPIResponseType = 'json' | 'text' | 'blob' | 'arraybuffer' | 'stream';
 /**
  * Options for Datalayer API requests.
  */
@@ -93,7 +101,7 @@ export interface IRequestDatalayerAPIOptions {
     url: string;
     /** HTTP method (GET, POST, PUT, DELETE, etc.) */
     method?: string;
-    /** Request body (JSON object or FormData) */
+    /** Request body (JSON object, FormData, string, or raw bytes) */
     body?: any;
     /** Custom HTTP headers */
     headers?: Record<string, string>;
@@ -101,8 +109,8 @@ export interface IRequestDatalayerAPIOptions {
     token?: string;
     /** AbortSignal for request cancellation */
     signal?: AbortSignal;
-    /** Axios response representation for binary or streaming transports. */
-    responseType?: AxiosRequestConfig['responseType'];
+    /** How to read the body; `json` when omitted. */
+    responseType?: DatalayerAPIResponseType;
 }
 export interface IDatalayerAPIResponse<T> {
     data: T;
@@ -118,6 +126,7 @@ export interface IDatalayerAPIResponse<T> {
  * @returns Promise resolving to response data
  * @throws {NetworkError} On network failures
  * @throws {RunResponseError} On HTTP error responses
+ * @throws {TokenExpiredError} On a 401 explained by an expired token
  *
  * @example
  * ```typescript

package/lib/api/DatalayerApi.js

@@ -9,7 +9,6 @@
  * @module api/DatalayerApi
  */
 import { URLExt } from '@jupyterlab/coreutils';
-import axios from 'axios';
 import { sleep } from '../utils/Sleep.js';
 import { getJwtExpiryMs, isJwtExpired } from '../utils/Jwt.js';
 function isFormDataBody(body) {
@@ -106,11 +105,11 @@ export class RunResponseError extends Error {
 }
 /**
  * Error wrapper for network failures.
- * Thrown when HTTP request fails due to connectivity issues.
+ * Thrown when `fetch` could not reach the server at all.
  */
 export class NetworkError extends TypeError {
     /**
-     * Creates a NetworkError from the original TypeError.
+     * Creates a NetworkError from the error `fetch` rejected with.
      *
      * @param original - The original network error
      */
@@ -189,6 +188,80 @@ function throwIfTokenExpired(status, token, url) {
     }
     throw new TokenExpiredError(url, getJwtExpiryMs(token) ?? Date.now());
 }
+/**
+ * Bodies `fetch` sends as they are. Everything else is a JSON value and is
+ * stringified.
+ */
+function isRawBody(body) {
+    return (typeof body === 'string' ||
+        (typeof Blob !== 'undefined' && body instanceof Blob) ||
+        body instanceof ArrayBuffer ||
+        ArrayBuffer.isView(body) ||
+        (typeof URLSearchParams !== 'undefined' &&
+            body instanceof URLSearchParams) ||
+        (typeof ReadableStream !== 'undefined' && body instanceof ReadableStream));
+}
+/**
+ * The response headers as a plain record, keyed in lower case the way
+ * `Headers` reports them.
+ */
+function headersToRecord(headers) {
+    const record = {};
+    headers.forEach((value, name) => {
+        record[name] = value;
+    });
+    return record;
+}
+/**
+ * Reads the body the way `responseType` asks for.
+ */
+async function readBody(response, responseType) {
+    switch (responseType) {
+        case 'text':
+            return response.text();
+        case 'blob':
+            return response.blob();
+        case 'arraybuffer':
+            return response.arrayBuffer();
+        case 'stream':
+            return response.body;
+        default: {
+            const text = await response.text();
+            try {
+                return JSON.parse(text);
+            }
+            catch {
+                return text;
+            }
+        }
+    }
+}
+/**
+ * Sends one request and returns the response when the server accepted it.
+ *
+ * A failure to reach the server at all arrives as `NetworkError`; an abort
+ * through the caller's signal is rethrown as it came, since the caller asked
+ * for it. A non-2xx answer becomes `TokenExpiredError` when a 401 is explained
+ * by the token we sent, and `RunResponseError` otherwise.
+ */
+async function send(url, init, token) {
+    let response;
+    try {
+        response = await fetch(url, init);
+    }
+    catch (error) {
+        // By name: a DOMException is not an `Error` in every realm.
+        if (error?.name === 'AbortError') {
+            throw error;
+        }
+        throw new NetworkError(error instanceof Error ? error : new TypeError(String(error)));
+    }
+    if (!response.ok) {
+        throwIfTokenExpired(response.status, token, url);
+        throw await RunResponseError.create(response);
+    }
+    return response;
+}
 /**
  * Makes authenticated HTTP requests to Datalayer APIs.
  * Handles JSON and FormData, includes auth headers, and manages redirects.
@@ -197,6 +270,7 @@ function throwIfTokenExpired(status, token, url) {
  * @returns Promise resolving to response data
  * @throws {NetworkError} On network failures
  * @throws {RunResponseError} On HTTP error responses
+ * @throws {TokenExpiredError} On a 401 explained by an expired token
  *
  * @example
  * ```typescript
@@ -208,147 +282,109 @@ function throwIfTokenExpired(status, token, url) {
  * ```
  */
 export async function requestDatalayerAPIWithResponse({ url, method, body, token, signal, responseType, headers = {}, }) {
-    // Handle FormData differently from JSON
-    const isFormData = isFormDataBody(body);
-    // Prepare axios config
-    const axiosConfig = {
-        url,
-        method: (method ?? 'GET'),
-        headers: { ...headers },
-        withCredentials: true, // equivalent to credentials: 'include'
-        signal,
-        responseType,
-        // CORS mode is handled automatically by axios
-        // Cache control headers
-    };
-    // In Vitest+jsdom, axios may pick the XHR adapter and fail with browser-like
-    // network restrictions. Force the fetch adapter for integration reliability.
-    if (typeof process !== 'undefined' && process.env.VITEST) {
-        axiosConfig.adapter = 'fetch';
-    }
-    // Add cache control headers only for GET requests (equivalent to cache: 'no-store')
-    if (method === 'GET' || !method) {
-        if (!axiosConfig.headers['Cache-Control']) {
-            axiosConfig.headers['Cache-Control'] =
-                'no-store, no-cache, must-revalidate';
+    const requestMethod = method ?? 'GET';
+    const requestHeaders = new Headers(headers);
+    // A GET must not be answered from a cache (the equivalent of
+    // `cache: 'no-store'`, said in headers so proxies hear it too).
+    if (requestMethod === 'GET') {
+        if (!requestHeaders.has('Cache-Control')) {
+            requestHeaders.set('Cache-Control', 'no-store, no-cache, must-revalidate');
         }
-        if (!axiosConfig.headers['Pragma']) {
-            axiosConfig.headers['Pragma'] = 'no-cache';
+        if (!requestHeaders.has('Pragma')) {
+            requestHeaders.set('Pragma', 'no-cache');
         }
     }
     if (token) {
-        axiosConfig.headers['Authorization'] = `Bearer ${token}`;
+        requestHeaders.set('Authorization', `Bearer ${token}`);
     }
-    if (isFormData) {
-        // For FormData: let axios handle Content-Type automatically
-        axiosConfig.data = body;
-        // Don't set Content-Type - axios will set multipart/form-data with boundary
-        if (!axiosConfig.headers['Accept']) {
-            axiosConfig.headers['Accept'] = 'application/json';
-        }
+    if (!requestHeaders.has('Accept')) {
+        requestHeaders.set('Accept', 'application/json');
+    }
+    let requestBody;
+    if (isFormDataBody(body)) {
+        // No Content-Type: the browser sets multipart/form-data with its
+        // boundary.
+        requestBody = body;
     }
     else {
-        // For regular JSON requests
-        if (!axiosConfig.headers['Accept']) {
-            axiosConfig.headers['Accept'] = 'application/json';
+        if (!requestHeaders.has('Content-Type')) {
+            requestHeaders.set('Content-Type', 'application/json');
         }
-        if (!axiosConfig.headers['Content-Type']) {
-            axiosConfig.headers['Content-Type'] = 'application/json';
+        if (body === undefined) {
+            requestBody = undefined;
         }
-        axiosConfig.data = body;
-    }
-    try {
-        const response = await axios(axiosConfig);
-        if (response.status < 300) {
-            // Handle redirections if needed.
-            if (response.status === 202 && response.headers.location) {
-                const data = await handleAxiosRedirection(response, axiosConfig);
-                return {
-                    data: data,
-                    status: response.status,
-                    statusText: response.statusText,
-                    headers: { ...response.headers },
-                };
-            }
+        else if (isRawBody(body)) {
+            requestBody = body;
         }
         else {
-            throwIfTokenExpired(response.status, token, url);
-            const adaptedResponse = {
-                ok: false,
-                status: response.status,
-                statusText: response.statusText,
-                json: async () => response?.data,
-                text: async () => JSON.stringify(response?.data),
-            };
-            throw await RunResponseError.create(adaptedResponse);
+            requestBody = JSON.stringify(body);
         }
-        return {
-            data: response.data,
-            status: response.status,
-            statusText: response.statusText,
-            headers: { ...response.headers },
-        };
     }
-    catch (error) {
-        if (axios.isAxiosError(error)) {
-            if (error.response) {
-                throwIfTokenExpired(error.response.status, token, url);
-                // Convert axios error to our RunResponseError format
-                const adaptedResponse = {
-                    ok: false,
-                    status: error.response.status,
-                    statusText: error.response.statusText,
-                    json: async () => error.response?.data,
-                    text: async () => JSON.stringify(error.response?.data),
-                };
-                throw await RunResponseError.create(adaptedResponse);
-            }
-            throw new NetworkError(error);
-        }
-        throw error;
+    const init = {
+        method: requestMethod,
+        headers: requestHeaders,
+        body: requestBody,
+        // Sends the browser's cookies along, cross-origin included.
+        credentials: 'include',
+        signal,
+    };
+    let response = await send(url, init, token);
+    // A 202 with a Location is the server saying the work is still running
+    // there: poll it until it is done.
+    if (response.status === 202 && response.headers.get('location')) {
+        response = await followAsyncRedirect(response, init, url, token);
     }
+    return {
+        data: (await readBody(response, responseType)),
+        status: response.status,
+        statusText: response.statusText,
+        headers: headersToRecord(response.headers),
+    };
 }
 export async function requestDatalayerAPI(options) {
     return (await requestDatalayerAPIWithResponse(options)).data;
 }
-async function handleAxiosRedirection(response, originalConfig) {
-    let redirect = response.headers.location;
-    if (redirect) {
-        const baseUrl = originalConfig.url ?? '';
-        const normalizedRedirect = String(redirect).replace(/^([a-z][a-z0-9+.-]*):\/(?!\/)/i, '$1://');
-        try {
-            const resolved = new URL(normalizedRedirect, baseUrl);
-            const base = new URL(baseUrl, typeof window !== 'undefined' ? window.location.origin : undefined);
-            // If a proxy emits an http Location for the same host while the
-            // original request is https, force https to avoid mixed-content errors
-            // that browsers often report as CORS/network failures.
-            if (base.protocol === 'https:' &&
-                resolved.protocol === 'http:' &&
-                resolved.hostname === base.hostname) {
-                resolved.protocol = 'https:';
-                if (resolved.port === '80') {
-                    resolved.port = '';
-                }
+/**
+ * Resolves the Location of a 202 against the request's URL.
+ *
+ * A proxy that emits an http Location for the same host while the original
+ * request was https gets it forced back to https, since the browser would
+ * refuse the mixed content and report it as a CORS or network failure.
+ */
+function resolveLocation(location, baseUrl) {
+    const normalized = location.replace(/^([a-z][a-z0-9+.-]*):\/(?!\/)/i, '$1://');
+    try {
+        const resolved = new URL(normalized, baseUrl);
+        const base = new URL(baseUrl, typeof window !== 'undefined' ? window.location.origin : undefined);
+        if (base.protocol === 'https:' &&
+            resolved.protocol === 'http:' &&
+            resolved.hostname === base.hostname) {
+            resolved.protocol = 'https:';
+            if (resolved.port === '80') {
+                resolved.port = '';
             }
-            redirect = resolved.toString();
-        }
-        catch {
-            const parsedURL = URLExt.parse(baseUrl);
-            const fallbackBase = parsedURL.protocol + '//' + parsedURL.hostname;
-            redirect = URLExt.join(fallbackBase, normalizedRedirect);
         }
+        return resolved.toString();
+    }
+    catch {
+        const parsedURL = URLExt.parse(baseUrl);
+        const fallbackBase = parsedURL.protocol + '//' + parsedURL.hostname;
+        return URLExt.join(fallbackBase, normalized);
     }
+}
+/**
+ * Polls the Location of a 202 with GETs, backing off from a second and
+ * doubling, until the answer is no longer a 202. The polls carry the
+ * original headers and credentials, never the body.
+ */
+async function followAsyncRedirect(response, init, url, token) {
+    const location = resolveLocation(response.headers.get('location'), url);
+    const pollInit = { ...init, method: 'GET', body: undefined };
     let sleepTimeout = 1000;
-    while (response.status === 202 && redirect) {
+    while (response.status === 202) {
         await sleep(sleepTimeout);
         sleepTimeout *= 2;
-        const redirectConfig = {
-            ...originalConfig,
-            url: redirect,
-            method: 'GET',
-            data: undefined, // Don't send body on redirect
-        };
-        response = await axios(redirectConfig);
+        response = await send(location, pollInit, token);
     }
-    return response.data;
+    return response;
 }

package/lib/api/index.d.ts

@@ -8,7 +8,7 @@
  */
 export { requestDatalayerAPI, requestDatalayerAPIWithResponse, RunResponseError, NetworkError, TokenExpiredError, } from './DatalayerApi';
 export type { IRequestDatalayerAPIOptions } from './DatalayerApi';
-export type { IDatalayerAPIResponse } from './DatalayerApi';
+export type { IDatalayerAPIResponse, DatalayerAPIResponseType, } from './DatalayerApi';
 export * as iam from './iam';
 export * as contents from './contents';
 export * as evals from './evals';

package/lib/client/mixins/IAMMixin.js

@@ -46,7 +46,7 @@ export function IAMMixin(Base) {
                     email_s: response.profile.email_s || response.profile.email,
                     first_name_t: response.profile.first_name_t || response.profile.first_name || '',
                     last_name_t: response.profile.last_name_t || response.profile.last_name || '',
-                    // Use avatar_url_s if available, otherwise leave undefined for fallback
+                    // The avatar's URL when the profile has one; without, the user's avatarUrl is ''.
                     avatar_url_s: response.profile.avatar_url_s || response.profile.avatar_url,
                 };
             }

package/lib/hooks/useUpload.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Posts a form to `url` through the API transport.
+ *
+ * `progress` is 0 while the upload is in flight and 100 once the server has
+ * answered: `fetch` reports no upload progress, so there is nothing in
+ * between to show.
+ */
 export declare const useUploadForm: (url: string) => {
     uploadAndSubmit: (formData: FormData) => Promise<any>;
     isSuccess: boolean;

package/lib/hooks/useUpload.js

@@ -3,16 +3,20 @@
  * Distributed under the terms of the Modified BSD License.
  */
 import { useState } from 'react';
-import axios from 'axios';
-// import useRun from "./useRun.js";
+import { requestDatalayerAPI } from '../api/DatalayerApi.js';
 import { useIAMStore } from '../state/index.js';
-// TODO reuse useRun hook.
+/**
+ * Posts a form to `url` through the API transport.
+ *
+ * `progress` is 0 while the upload is in flight and 100 once the server has
+ * answered: `fetch` reports no upload progress, so there is nothing in
+ * between to show.
+ */
 export const useUploadForm = (url) => {
     const [isSuccess, setIsSuccess] = useState(false);
     const [isLoading, setIsLoading] = useState(false);
     const [progress, setProgress] = useState(0);
     const { token } = useIAMStore();
-    //  const { requestRun } = useRun();
     const reset = () => {
         setIsSuccess(false);
         setIsLoading(false);
@@ -21,19 +25,11 @@ export const useUploadForm = (url) => {
     const uploadAndSubmit = async (formData) => {
         setIsLoading(true);
         try {
-            const { data } = await axios.post(url, formData, {
-                headers: {
-                    'Content-Type': 'multipart/form-data',
-                    Authorization: `Bearer ${token}`,
-                },
-                onUploadProgress: progressEvent => {
-                    const progress = (progressEvent.loaded / progressEvent.total) * 50;
-                    setProgress(progress);
-                },
-                onDownloadProgress: progressEvent => {
-                    const progress = 50 + (progressEvent.loaded / progressEvent.total) * 50;
-                    setProgress(progress);
-                },
+            const data = await requestDatalayerAPI({
+                url,
+                method: 'POST',
+                body: formData,
+                token,
             });
             setProgress(100);
             await new Promise(resolve => {

package/lib/index.d.ts

@@ -5,7 +5,7 @@ export * from './navigation';
 export * from './hooks';
 export { requestDatalayerAPI, requestDatalayerAPIWithResponse, RunResponseError, NetworkError, } from './api/DatalayerApi';
 export type { IRequestDatalayerAPIOptions } from './api/DatalayerApi';
-export type { IDatalayerAPIResponse } from './api/DatalayerApi';
+export type { IDatalayerAPIResponse, DatalayerAPIResponseType, } from './api/DatalayerApi';
 export { API_BASE_PATHS } from './api/constants';
 export * as iamApi from './api/iam';
 export * as contentsApi from './api/contents';

package/lib/models/UserDTO.d.ts

@@ -68,6 +68,7 @@ export declare class UserDTO {
     get firstName(): string;
     get lastName(): string;
     get displayName(): string;
+    /** The avatar's URL, or `''` when the profile has none: a person without a picture is still a user. */
     get avatarUrl(): string;
     get avatarIcon(): string | undefined;
     get banner(): string | undefined;

package/lib/models/UserDTO.js

@@ -40,8 +40,9 @@ export class UserDTO {
     get displayName() {
         return `${this.firstName} ${this.lastName}`.trim();
     }
+    /** The avatar's URL, or `''` when the profile has none: a person without a picture is still a user. */
     get avatarUrl() {
-        return this._data.avatar_url_s;
+        return this._data.avatar_url_s ?? '';
     }
     get avatarIcon() {
         return this._data.avatar_icon_s;

package/lib/otel/hooks/index.js

@@ -30,7 +30,7 @@ export function setOtelOnUnauthorized(cb) {
 }
 /**
  * Lightweight fetch helper for OTEL API calls.
- * Uses plain `fetch` to avoid pulling in `@jupyterlab/coreutils` / axios.
+ * Uses plain `fetch` to avoid pulling in `@jupyterlab/coreutils`.
  *
  * If the response is **401 Unauthorized** and a global `onUnauthorized`
  * handler has been registered via {@link setOtelOnUnauthorized}, the

package/lib/state/substates/NavigationState.d.ts

@@ -70,6 +70,12 @@ export type NavigationState = {
  * through or on a page that belongs to no shell.
  */
 export declare function isRememberableRoute(route: string): boolean;
+/**
+ * Whether a page is a hosted application, run at its address, rather than a
+ * page of the Apps shell. It is visited, not returned to: the Apps shell
+ * never reopens on one, and one remembered before is dropped on load.
+ */
+export declare function isHostedAppRoute(route: string): boolean;
 /**
  * Whether a page belongs to no shell: the settings, the documentation and
  * the decks.

package/lib/state/substates/NavigationState.js

@@ -199,7 +199,48 @@ export function isRememberableRoute(route) {
         '/oauth',
         '/join',
     ].some(prefix => path === prefix || path.startsWith(`${prefix}/`)) &&
-        !isShellNeutralRoute(route));
+        !isShellNeutralRoute(route) &&
+        !isHostedAppRoute(route));
+}
+/**
+ * The Apps shell's own pages under `/apps/<section>`. Any other first segment
+ * is an application's hosted address (`/apps/<slug>`, its preview at
+ * `/apps/<slug>/preview/<version>`).
+ */
+const APPS_SHELL_SECTIONS = new Set([
+    'activity',
+    'agents',
+    'apps',
+    'components',
+    'connections',
+    'contents',
+    'context',
+    'deployments',
+    'evalsets',
+    'examples',
+    'home',
+    'models',
+    'readiness',
+    'reports',
+    'rules',
+    'runs',
+    'shared',
+    'skills',
+    'usage',
+    'workspace',
+]);
+/**
+ * Whether a page is a hosted application, run at its address, rather than a
+ * page of the Apps shell. It is visited, not returned to: the Apps shell
+ * never reopens on one, and one remembered before is dropped on load.
+ */
+export function isHostedAppRoute(route) {
+    const segments = pathOf(route).split('/').filter(Boolean);
+    return (segments[0] === 'apps' &&
+        segments.length >= 2 &&
+        !APPS_SHELL_SECTIONS.has(segments[1]) &&
+        (segments.length === 2 ||
+            (segments.length === 4 && segments[2] === 'preview')));
 }
 /**
  * Whether a page belongs to no shell: the settings, the documentation and

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@datalayer/core",
-    "version": "1.2.21",
+    "version": "1.2.23",
     "type": "module",
     "workspaces": [
         ".",
@@ -148,7 +148,6 @@
         "@tanstack/react-query": "^5.90.6",
         "@toon-format/toon": "^1.3.0",
         "ansi-to-html": "^0.7.2",
-        "axios": "^1.7.7",
         "boring-avatars": "^2.0.1",
         "date-fns": "^2.29.3",
         "deepmerge": "^4.3.1",