@flowdrop/flowdrop 2.0.0-beta.1 → 2.0.0-beta.3

package/dist/utils/fetchWithAuth.d.ts

@@ -1,25 +1,46 @@
 /**
- * Fetch authentication utilities
+ * Authenticated fetch
  *
- * Shared logic for building HTTP headers with authentication.
- * Used by components that make authenticated API requests (e.g., FormAutocomplete).
+ * The single fetch path for FlowDrop's per-instance services. It builds request
+ * headers (static endpoint headers + the {@link AuthProvider}'s headers + any
+ * caller headers) and uniformly applies the auth lifecycle: on `401` it invokes
+ * `onUnauthorized()` and — if that reports a successful refresh — retries the
+ * request once with freshly fetched headers; on `403` it invokes
+ * `onForbidden()`. Callers receive the raw {@link Response} and keep their own
+ * status/parse handling.
+ *
+ * Routing every service through this helper means a configured `AuthProvider`
+ * authenticates *and* refreshes consistently — matching the behaviour the typed
+ * workflow/node API gets from {@link EnhancedFlowDropApiClient}.
  *
  * @module utils/fetchWithAuth
  */
+import type { EndpointConfig } from '../config/endpoints.js';
 import type { AuthProvider } from '../types/auth.js';
 /**
- * Build fetch headers with optional authentication
- *
- * Constructs standard JSON request headers and merges in authentication
- * headers from the provided AuthProvider, if available.
+ * Options describing how to authenticate and where the base headers come from.
  *
- * @param authProvider - Optional auth provider to get headers from
- * @returns Promise resolving to a complete headers object
+ * Provide `config` + `endpointKey` to source static endpoint headers (the usual
+ * case for endpoint-keyed services), or `baseHeaders` for ad-hoc requests that
+ * are not tied to a configured endpoint (e.g. a user-configured autocomplete
+ * URL). When neither is given the request carries only JSON defaults plus auth.
+ */
+export interface AuthenticatedFetchOptions {
+    /** Auth provider supplying `Authorization` etc. and 401/403 lifecycle hooks. */
+    authProvider?: AuthProvider;
+    /** Endpoint configuration, used with `endpointKey` to look up static headers. */
+    config?: EndpointConfig;
+    /** Endpoint key identifying which static headers to apply. */
+    endpointKey?: string;
+    /** Base headers for requests not tied to a configured endpoint. */
+    baseHeaders?: Record<string, string>;
+}
+/**
+ * Perform an authenticated fetch with consistent 401/403 handling.
  *
- * @example
- * ```typescript
- * const headers = await buildFetchHeaders(authProvider);
- * const response = await fetch(url, { headers });
- * ```
+ * @param url - The fully-resolved request URL
+ * @param init - Standard fetch options (method, body, signal, headers, …)
+ * @param opts - Auth provider and header source
+ * @returns The raw {@link Response}; callers handle `.ok`/parsing themselves
  */
-export declare function buildFetchHeaders(authProvider?: AuthProvider): Promise<Record<string, string>>;
+export declare function authenticatedFetch(url: string, init?: RequestInit, opts?: AuthenticatedFetchOptions): Promise<Response>;

package/dist/utils/fetchWithAuth.js

@@ -1,34 +1,64 @@
 /**
- * Fetch authentication utilities
+ * Authenticated fetch
  *
- * Shared logic for building HTTP headers with authentication.
- * Used by components that make authenticated API requests (e.g., FormAutocomplete).
+ * The single fetch path for FlowDrop's per-instance services. It builds request
+ * headers (static endpoint headers + the {@link AuthProvider}'s headers + any
+ * caller headers) and uniformly applies the auth lifecycle: on `401` it invokes
+ * `onUnauthorized()` and — if that reports a successful refresh — retries the
+ * request once with freshly fetched headers; on `403` it invokes
+ * `onForbidden()`. Callers receive the raw {@link Response} and keep their own
+ * status/parse handling.
+ *
+ * Routing every service through this helper means a configured `AuthProvider`
+ * authenticates *and* refreshes consistently — matching the behaviour the typed
+ * workflow/node API gets from {@link EnhancedFlowDropApiClient}.
  *
  * @module utils/fetchWithAuth
  */
+import { getEndpointHeaders } from '../config/endpoints.js';
+const DEFAULT_HEADERS = {
+    Accept: 'application/json',
+    'Content-Type': 'application/json'
+};
 /**
- * Build fetch headers with optional authentication
- *
- * Constructs standard JSON request headers and merges in authentication
- * headers from the provided AuthProvider, if available.
- *
- * @param authProvider - Optional auth provider to get headers from
- * @returns Promise resolving to a complete headers object
+ * Build the merged header set: base headers < auth headers < per-request headers.
  *
- * @example
- * ```typescript
- * const headers = await buildFetchHeaders(authProvider);
- * const response = await fetch(url, { headers });
- * ```
+ * Re-invoked for the retry so a refreshed token is picked up.
  */
-export async function buildFetchHeaders(authProvider) {
-    const headers = {
-        Accept: 'application/json',
-        'Content-Type': 'application/json'
-    };
-    if (authProvider) {
-        const authHeaders = await authProvider.getAuthHeaders();
-        Object.assign(headers, authHeaders);
+async function buildHeaders(init, opts) {
+    const headers = opts.config && opts.endpointKey
+        ? getEndpointHeaders(opts.config, opts.endpointKey)
+        : { ...DEFAULT_HEADERS, ...opts.baseHeaders };
+    if (opts.authProvider) {
+        Object.assign(headers, await opts.authProvider.getAuthHeaders());
+    }
+    if (init.headers) {
+        Object.assign(headers, init.headers);
     }
     return headers;
 }
+/**
+ * Perform an authenticated fetch with consistent 401/403 handling.
+ *
+ * @param url - The fully-resolved request URL
+ * @param init - Standard fetch options (method, body, signal, headers, …)
+ * @param opts - Auth provider and header source
+ * @returns The raw {@link Response}; callers handle `.ok`/parsing themselves
+ */
+export async function authenticatedFetch(url, init = {}, opts = {}) {
+    const headers = await buildHeaders(init, opts);
+    let response = await fetch(url, { ...init, headers });
+    // 401 → let the provider refresh, then retry once with fresh headers.
+    if (response.status === 401 && opts.authProvider?.onUnauthorized) {
+        const refreshed = await opts.authProvider.onUnauthorized();
+        if (refreshed) {
+            const retryHeaders = await buildHeaders(init, opts);
+            response = await fetch(url, { ...init, headers: retryHeaders });
+        }
+    }
+    // 403 → notify the provider (e.g. surface a permission error).
+    if (response.status === 403 && opts.authProvider?.onForbidden) {
+        await opts.authProvider.onForbidden();
+    }
+    return response;
+}

package/dist/utils/nodeTypes.js

@@ -9,7 +9,7 @@
  *
  * Works with both built-in types and custom registered types.
  */
-import { resolveBuiltinAlias, isBuiltinType } from '../registry/builtinNodes.js';
+import { resolveBuiltinAlias, isBuiltinType } from '../registry/builtinNodeTypes.js';
 /**
  * Display names for built-in node types.
  */

package/package.json

@@ -3,7 +3,7 @@
   "description": "A drop-in visual workflow editor for any web application. You own the backend. You own the data. You own the orchestration.",
   "license": "MIT",
   "private": false,
-  "version": "2.0.0-beta.1",
+  "version": "2.0.0-beta.3",
   "author": "Shibin Das (D34dMan)",
   "bugs": {
     "url": "https://github.com/flowdrop-io/flowdrop/issues"
@@ -289,6 +289,7 @@
     "watch:build": "npm-watch build",
     "preview": "vite preview",
     "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+    "check:bundle": "node scripts/check-bundle.mjs",
     "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
     "lint": "eslint . && prettier --check .",
     "test": "vitest run",