@fudanda/client 1.20261015.1-beta.1 → 2.20261024.1-beta.1

package/src/goa.ts

@@ -0,0 +1,343 @@
+import type { GoaInputOf, GoaOperation, GoaOutputOf } from '@fudanda/shared/core';
+import { readSSE, SSEProtocolError, waitForReconnect } from './goa-stream';
+
+export interface GoaClientOptions {
+  baseURL?: string;
+  credentials?: RequestCredentials;
+  transport?: typeof fetch;
+  xhrFactory?: () => XMLHttpRequest;
+  apiKey?: string;
+  csrfToken?: string;
+  onUnauthorized?: () => void;
+}
+
+export interface GoaRequestOptions {
+  signal?: AbortSignal | null;
+  headers?: HeadersInit;
+}
+
+export interface GoaUploadOptions extends GoaRequestOptions {
+  onProgress?: (percent: number) => void;
+}
+
+export type GoaConnectionState = 'connecting' | 'connected' | 'reconnecting' | 'closed';
+export interface GoaStreamOptions<Data> extends GoaRequestOptions {
+  onEvent: (event: Data) => void;
+  onConnection?: (state: GoaConnectionState) => void;
+  onError?: (error: Error) => void;
+  reconnectDelay?: number;
+}
+export interface GoaSubscription { close(): void; done: Promise<void> }
+
+export class GoaError extends Error {
+  readonly name = 'GoaError';
+  errorId?: string;
+  requestId?: string;
+  temporary = false;
+  timeout = false;
+  fault = false;
+  details?: unknown;
+
+  constructor(readonly status: number, readonly reason: string, message: string) { super(message); }
+}
+
+type Arguments<Operation extends GoaOperation> = undefined extends GoaInputOf<Operation>
+  ? [input?: GoaInputOf<Operation>, options?: GoaRequestOptions]
+  : [input: GoaInputOf<Operation>, options?: GoaRequestOptions];
+type UploadArguments<Operation extends GoaOperation> = [input: GoaInputOf<Operation>, options?: GoaUploadOptions];
+
+type Values = { params?: Record<string, unknown>; query?: Record<string, unknown>; headers?: Record<string, unknown>; body?: unknown };
+
+export interface GoaResponse<Data> { data: Data; status: number; headers: Headers }
+
+function pathFor(operation: GoaOperation, input: Values): string {
+  if (!operation.path.startsWith('/api/v1/') || /[?#\\\s]/.test(operation.path) || operation.path.split('/').some(part => part === '.' || part === '..')) throw new Error('Invalid generated API path');
+  const path = operation.path.replace(/\{(\*?\w+)\}/g, (_match, name: string) => {
+    const wildcard = name.startsWith('*');
+    const value = input.params?.[wildcard ? name.slice(1) : name];
+    if (value === undefined || value === null) throw new Error(`Missing path parameter: ${name}`);
+    if (!wildcard) return encodeURIComponent(String(value));
+    const parts = String(value).split('/');
+    if (parts.some(part => part === '.' || part === '..')) throw new Error('Invalid wildcard path');
+    return parts.map(encodeURIComponent).join('/');
+  });
+  const query = new URLSearchParams();
+  for (const [key, value] of Object.entries(input.query ?? {})) {
+    if (value === undefined || value === null) continue;
+    for (const item of Array.isArray(value) ? value : [value]) query.append(key, String(item));
+  }
+  return path + (query.size ? '?' + query.toString() : '');
+}
+
+/** Native Goa HTTP client. Generated schemas own request and response shapes. */
+export class GoaClient {
+  private csrfToken: string;
+  private sessionRevision = 0;
+  private readonly responseSessions = new WeakMap<Response, number>();
+  private readonly unauthorizedListeners = new Set<() => void>();
+
+  constructor(private readonly options: GoaClientOptions = {}) {
+    const baseURL = options.baseURL ?? '';
+    if (baseURL && (!/^https?:\/\//.test(baseURL) || new URL(baseURL).origin !== baseURL.replace(/\/$/, ''))) throw new Error('baseURL must be an HTTP origin');
+    if (options.apiKey && !/^arc_[a-f0-9]{64}$/.test(options.apiKey)) throw new Error('Invalid ArcBase API Key');
+    this.csrfToken = options.csrfToken ?? '';
+  }
+
+  setCSRFToken(token: string): void { if (token !== this.csrfToken) { this.csrfToken = token; this.sessionRevision++; } }
+  clearSession(): void { this.csrfToken = ''; this.sessionRevision++; }
+  sessionHeaders(): Record<string,string> { return this.csrfToken ? { 'X-CSRF-Token': this.csrfToken } : {}; }
+  subscribeUnauthorized(listener: () => void): () => void {
+    this.unauthorizedListeners.add(listener);
+    return () => { this.unauthorizedListeners.delete(listener); };
+  }
+  expireSession(): void {
+    this.clearSession();
+    for (const listener of this.unauthorizedListeners) listener();
+    this.options.onUnauthorized?.();
+  }
+
+  call<Operation extends GoaOperation>(operation: Operation, ...args: Arguments<Operation>): Promise<GoaOutputOf<Operation>> {
+    return this.execute(operation, args[0], args[1]).then(response => response.data);
+  }
+
+  callWithResponse<Operation extends GoaOperation>(operation: Operation, ...args: Arguments<Operation>): Promise<GoaResponse<GoaOutputOf<Operation>>> {
+    return this.execute(operation, args[0], args[1]);
+  }
+
+  upload<Operation extends GoaOperation & { readonly kind: 'multipart' }>(operation: Operation, ...args: UploadArguments<Operation>): Promise<GoaOutputOf<Operation>> {
+    return this.execute(operation, args[0], args[1], 'multipart').then(response => response.data);
+  }
+
+  /** Observe a generated GET stream; closing it never cancels domain execution. */
+  stream<Operation extends GoaOperation & { readonly kind: 'sse' }>(operation: Operation, input: GoaInputOf<Operation>, options: GoaStreamOptions<GoaOutputOf<Operation>>): GoaSubscription {
+    if (operation.kind !== 'sse' || operation.method !== 'GET') throw new Error('Expected a GET SSE operation');
+    const values = operation.input.parse(input) as Values;
+    const controller = new AbortController();
+    const streamRevision = this.sessionRevision;
+    const abort = () => controller.abort(options.signal?.reason);
+    options.signal?.addEventListener('abort', abort, { once: true });
+    if (options.signal?.aborted) abort();
+    const close = () => controller.abort();
+    const done = (async () => {
+      const initialHeaders = new Headers();
+      for (const [key, value] of Object.entries(values.headers ?? {})) if (value !== undefined && value !== null) initialHeaders.set(key, String(value));
+      let cursor = initialHeaders.get('Last-Event-ID');
+      let delay = Math.min(15000, Math.max(250, options.reconnectDelay ?? 1000));
+      let attempts = 0;
+      try {
+        while (!controller.signal.aborted) {
+          if (operation.access.kind !== 'public' && this.sessionRevision !== streamRevision) return;
+          options.onConnection?.(attempts ? 'reconnecting' : 'connecting');
+          try {
+            const resumed = { ...values, headers: { ...values.headers } };
+            if (operation.sse?.requestIdField && cursor !== null) resumed.headers['Last-Event-ID'] = cursor;
+            if (!operation.input.safeParse(resumed).success) throw new GoaError(400, 'invalid_response', '服务端续传标识不符合契约');
+            const response = await this.fetch(operation, resumed, { ...options, signal: controller.signal });
+            if (!response.ok) throw await this.error(operation, response);
+            await this.requireCurrentSession(operation, response);
+            const schema = operation.responses[response.status];
+            if (!schema || !response.body || response.headers.get('Content-Type')?.split(';')[0].trim().toLowerCase() !== 'text/event-stream') {
+              await response.body?.cancel();
+              throw new GoaError(response.status, 'invalid_response', '服务端流式响应不符合契约');
+            }
+            options.onConnection?.('connected');
+            attempts = 0;
+            for await (const frame of readSSE(response.body, controller.signal)) {
+              if (operation.access.kind !== 'public' && this.sessionRevision !== streamRevision) return;
+              if (frame.id !== undefined) cursor = frame.id;
+              if (frame.retry !== undefined) delay = Math.min(15000, Math.max(250, frame.retry));
+              if (frame.data === undefined) continue;
+              if (frame.event === 'session-expired') {
+                if (this.responseSessions.get(response) === this.sessionRevision) this.expireSession();
+                return;
+              }
+              if (frame.event === 'denied') throw new GoaError(403, 'stream_denied', '订阅权限已失效');
+              let raw: unknown;
+              try { raw = JSON.parse(frame.data); }
+              catch { throw new GoaError(response.status, 'invalid_response', '服务端流式事件格式错误'); }
+              const wire = operation.sse;
+              if (wire?.dataField) raw = { [wire.dataField]: raw };
+              if (wire?.idField || wire?.eventField || wire?.retryField) {
+                if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new GoaError(response.status, 'invalid_response', '服务端流式事件格式错误');
+                const mapped: Record<string, unknown> = { ...raw };
+                if (wire.idField) mapped[wire.idField] = cursor ?? '';
+                if (wire.eventField) mapped[wire.eventField] = frame.event;
+                if (wire.retryField && frame.retry !== undefined) mapped[wire.retryField] = frame.retry;
+                raw = mapped;
+              }
+              const parsed = schema.safeParse(raw);
+              if (!parsed.success) throw new GoaError(response.status, 'invalid_response', '服务端流式事件不符合契约');
+              options.onEvent(parsed.data as GoaOutputOf<Operation>);
+              if (frame.event === 'done') return;
+            }
+          } catch (error) {
+            if (controller.signal.aborted || error instanceof DOMException && error.name === 'AbortError') return;
+            options.onError?.(error instanceof Error ? error : new Error('流式连接中断'));
+            if (error instanceof SSEProtocolError || error instanceof GoaError && (error.reason === 'invalid_response' || error.status < 500 && error.status !== 429)) return;
+          }
+          attempts++;
+          await waitForReconnect(Math.min(15000, delay * 2 ** Math.min(attempts - 1, 4)), controller.signal);
+        }
+      } finally {
+        options.signal?.removeEventListener('abort', abort);
+        options.onConnection?.('closed');
+      }
+    })();
+    return { close, done };
+  }
+
+  /** The caller consumes or cancels the returned body; the transport never buffers files. */
+  async download<Operation extends GoaOperation & { readonly kind: 'file' | 'csv' }>(operation: Operation, ...args: Arguments<Operation>): Promise<Response> {
+    if (operation.kind !== 'file' && operation.kind !== 'csv') throw new Error(`Operation ${operation.id} is not a download`);
+    const values = operation.input.parse(args[0]) as Values;
+    const response = await this.fetch(operation, values, args[1] ?? {});
+    if (!response.ok) throw await this.error(operation, response);
+    await this.requireCurrentSession(operation, response);
+    const declared = operation.mediaTypes?.[response.status] ?? [];
+    const contentType = response.headers.get('Content-Type')?.split(';')[0].trim().toLowerCase();
+    const matchesMediaType = declared.some(mediaType => {
+      const expected = mediaType.split(';')[0].trim().toLowerCase();
+      if (!contentType || !/^[^\s/;]+\/[^\s/;]+$/.test(contentType)) return false;
+      return expected === contentType || expected === '*/*' || expected.endsWith('/*') && contentType.startsWith(expected.slice(0, -1));
+    });
+    if (!operation.responses[response.status] || !matchesMediaType) {
+      await response.body?.cancel();
+      throw new GoaError(response.status, 'invalid_response', '文件响应不符合契约');
+    }
+    return response;
+  }
+
+  private async execute<Operation extends GoaOperation>(operation: Operation, input: unknown, options: GoaUploadOptions = {}, channel: 'json' | 'multipart' = 'json'): Promise<GoaResponse<GoaOutputOf<Operation>>> {
+    if (operation.kind !== channel) throw new Error(`Operation ${operation.id} requires the ${operation.kind} channel`);
+    const values = operation.input.parse(input) as Values;
+    const response = await this.fetch(operation, values, options);
+    if (!response.ok) throw await this.error(operation, response);
+    await this.requireCurrentSession(operation, response);
+    const schema = operation.responses[response.status];
+    if (!schema) throw new GoaError(response.status, 'unexpected_status', '服务端返回了未声明的状态');
+    let raw: unknown;
+    if (response.status !== 204) {
+      try { raw = await response.json(); } catch { throw new GoaError(response.status, 'invalid_response', '服务端响应格式错误'); }
+    }
+    const parsed = schema.safeParse(raw);
+    if (!parsed.success) throw new GoaError(response.status, 'invalid_response', '服务端响应不符合契约');
+    await this.requireCurrentSession(operation, response);
+    return { data: parsed.data as GoaOutputOf<Operation>, status: response.status, headers: response.headers };
+  }
+
+  private async requireCurrentSession(operation: GoaOperation, response: Response): Promise<void> {
+    if (operation.access.kind === 'public' || this.options.apiKey || this.responseSessions.get(response) === this.sessionRevision) return;
+    if (!response.bodyUsed) await response.body?.cancel();
+    throw new DOMException('会话已变更，已丢弃旧请求结果', 'AbortError');
+  }
+
+  private async fetch(operation: GoaOperation, input: Values, options: GoaUploadOptions): Promise<Response> {
+    options.signal?.throwIfAborted();
+    const sessionRevision = this.sessionRevision;
+    const headers = new Headers(options.headers);
+    for (const [key, value] of Object.entries(input.headers ?? {})) if (value !== undefined && value !== null) headers.set(key, String(value));
+    headers.delete('Authorization');
+    headers.delete('Cookie');
+    headers.delete('X-CSRF-Token');
+    headers.set('Accept', operation.kind === 'file' || operation.kind === 'csv'
+      ? [...new Set(Object.values(operation.mediaTypes ?? {}).flat())].join(', ')
+      : operation.kind === 'sse' ? 'text/event-stream' : 'application/json');
+    if (this.options.apiKey) {
+      if (!operation.apiKey.allowed) throw new GoaError(403, 'key_route_denied', '此接口需要浏览器会话');
+      headers.set('Authorization', 'Bearer ' + this.options.apiKey);
+    } else if (!['GET', 'HEAD', 'OPTIONS'].includes(operation.method) && operation.access.kind !== 'public') {
+      if (!this.csrfToken) throw new GoaError(401, 'session_missing', '登录状态尚未恢复');
+      headers.set('X-CSRF-Token', this.csrfToken);
+    }
+    let body: BodyInit | undefined;
+    if (input.body !== undefined) {
+      if (operation.kind === 'multipart') {
+        headers.delete('Content-Type');
+        const form = new FormData();
+        for (const [name, value] of Object.entries(input.body as Record<string, unknown>)) {
+          if (value === undefined) continue;
+          for (const item of Array.isArray(value) ? value : [value]) {
+            if (item instanceof Blob) form.append(name, item);
+            else if (typeof item === 'string' || typeof item === 'number' || typeof item === 'boolean') form.append(name, String(item));
+            else throw new Error(`Unsupported multipart field: ${name}`);
+          }
+        }
+        body = form;
+      }
+      else { headers.set('Content-Type', 'application/json'); body = JSON.stringify(input.body); }
+    }
+    const url = (this.options.baseURL ?? '').replace(/\/$/, '') + pathFor(operation, input);
+    const init: RequestInit = { method: operation.method, credentials: this.options.credentials ?? (this.options.apiKey ? 'omit' : 'include'), headers, body, signal: options.signal, cache: 'no-store' };
+    const response = operation.kind === 'multipart' && options.onProgress
+      ? await this.sendUpload(url, init, options.onProgress)
+      : await (this.options.transport ?? globalThis.fetch)(url, init);
+    this.responseSessions.set(response, sessionRevision);
+    if (options.signal?.aborted) {
+      await response.body?.cancel();
+      options.signal.throwIfAborted();
+    }
+    return response;
+  }
+
+  private sendUpload(url: string, init: RequestInit, progress: (percent: number) => void): Promise<Response> {
+    const xhr = this.options.xhrFactory?.() ?? new XMLHttpRequest();
+    return new Promise((resolve, reject) => {
+      xhr.open(init.method!, url);
+      const target = new URL(url, globalThis.location?.href ?? 'http://localhost');
+      xhr.withCredentials = init.credentials === 'include' || init.credentials === 'same-origin' && target.origin === globalThis.location?.origin;
+      new Headers(init.headers).forEach((value, name) => xhr.setRequestHeader(name, value));
+      const cleanup = () => {
+        init.signal?.removeEventListener('abort', abort);
+        xhr.upload.removeEventListener('progress', report);
+        xhr.removeEventListener('load', load);
+        xhr.removeEventListener('error', failed);
+        xhr.removeEventListener('abort', aborted);
+        xhr.removeEventListener('timeout', timeout);
+      };
+      const report = (event: ProgressEvent) => { if (event.lengthComputable && event.total > 0) progress(Math.min(100, Math.round(event.loaded / event.total * 100))); };
+      const aborted = () => { cleanup(); reject(init.signal?.reason ?? new DOMException('已取消', 'AbortError')); };
+      const abort = () => { cleanup(); xhr.abort(); aborted(); };
+      const failed = () => { cleanup(); reject(new GoaError(0, 'network_error', '上传失败，请检查网络连接')); };
+      const timeout = () => { cleanup(); reject(new GoaError(0, 'timeout', '上传超时')); };
+      const load = () => {
+        cleanup();
+        const headers = new Headers();
+        for (const name of ['Content-Type', 'X-Request-Id', 'Retry-After']) {
+          const value = xhr.getResponseHeader(name);
+          if (value) headers.set(name, value);
+        }
+        try { resolve(new Response(xhr.status === 204 ? null : xhr.responseText, { status: xhr.status, headers })); }
+        catch (error) { reject(error); }
+      };
+      init.signal?.addEventListener('abort', abort, { once: true });
+      xhr.upload.addEventListener('progress', report);
+      xhr.addEventListener('load', load);
+      xhr.addEventListener('error', failed);
+      xhr.addEventListener('abort', aborted);
+      xhr.addEventListener('timeout', timeout);
+      if (init.signal?.aborted) { abort(); return; }
+      try { xhr.send(init.body as FormData); } catch { failed(); }
+    });
+  }
+
+  private async error(operation: GoaOperation, response: Response): Promise<GoaError> {
+    if (response.status === 401 && operation.access.kind !== 'public' && this.responseSessions.get(response) === this.sessionRevision) this.expireSession();
+    let value: unknown;
+    try { value = await response.json(); } catch { return new GoaError(response.status, 'invalid_response', '服务端错误响应格式错误'); }
+    const schema = operation.errors[response.status];
+    if (schema) {
+      const parsed = schema.safeParse(value);
+      if (!parsed.success) return new GoaError(response.status, 'invalid_response', '服务端错误响应不符合契约');
+      value = parsed.data;
+    }
+    if (!value || typeof value !== 'object' || !('name' in value) || typeof value.name !== 'string' || !('message' in value) || typeof value.message !== 'string') return new GoaError(response.status, 'invalid_response', '服务端错误响应格式错误');
+    const error = new GoaError(response.status, value.name, value.message);
+    error.requestId = response.headers.get('X-Request-Id') ?? undefined;
+    if ('id' in value && typeof value.id === 'string') error.errorId = value.id;
+    if ('temporary' in value && typeof value.temporary === 'boolean') error.temporary = value.temporary;
+    if ('timeout' in value && typeof value.timeout === 'boolean') error.timeout = value.timeout;
+    if ('fault' in value && typeof value.fault === 'boolean') error.fault = value.fault;
+    error.details = value;
+    return error;
+  }
+}

package/src/index.ts

@@ -1,9 +1,2 @@
-export { Client, validateGoPath } from './client';
-export type { ClientOptions, RequestOptions, ApiEnvelope, Method } from './client';
-export { ClientError, ApiError } from './errors';
-export { subscribe } from './subscriptions';
-export {subscribeOperation} from './event-stream';
-export type {EventStreamOptions} from './event-stream';
-export type { ChangeEvent, SubscriptionOptions, Subscription } from './subscriptions';
-export { call, callRaw, operationURL, foundationPath, foundationRequestBody, isFoundationOperation, toQueryString, unwrap } from './contracts';
-export type { JsonClient, UrlInputOf } from './contracts';
+export { GoaClient, GoaError } from './goa';
+export type { GoaClientOptions, GoaRequestOptions, GoaUploadOptions, GoaResponse, GoaStreamOptions, GoaSubscription, GoaConnectionState } from './goa';

package/dist/client.d.ts

@@ -1,63 +0,0 @@
-import type { ApiResponse } from '@fudanda/shared/core';
-import type { AnyOperation } from '@fudanda/shared/core';
-export type Method = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
-export type ApiEnvelope<T> = ApiResponse<T> & {
-    error?: string;
-    requestId?: string;
-    retryAfterSeconds?: number;
-};
-export interface RequestOptions {
-    signal?: AbortSignal | null;
-    headers?: HeadersInit;
-    anonymousWrite?: boolean;
-}
-export interface ClientOptions {
-    baseURL?: string;
-    credentials?: RequestCredentials;
-    transport?: typeof fetch;
-    xhrFactory?: () => XMLHttpRequest;
-    onUnauthorized?: () => void;
-    /** For scripts/server integrations. Never persist or expose keys in browser storage. */
-    apiKey?: string;
-    /** Explicit host contracts; built-in operations remain restricted to the release catalog. */
-    operations?: readonly AnyOperation[];
-}
-export declare function validateGoPath(path: string): void;
-/** Cookie/CSRF transport. UI, user state and query caches belong to the host. */
-export declare class Client {
-    private readonly options;
-    private csrfToken;
-    private readonly unauthorizedListeners;
-    private readonly baseURL;
-    private readonly send;
-    private readonly credentials;
-    private readonly operations;
-    constructor(options?: ClientOptions);
-    /** Registration is instance-local and requires the exact declared operation. */
-    resolveOperationPath(op: AnyOperation): string | undefined;
-    setCsrfToken(value: string | null): void;
-    clearSession(): void;
-    /** Long-lived authenticated transports use the same expiry notifications as HTTP 401. */
-    expireSession(): void;
-    sessionHeaders(): Record<string, string>;
-    /** Hosts can observe expiry without replacing the caller's callback. */
-    subscribeUnauthorized(listener: () => void): () => void;
-    private headers;
-    private received;
-    fetchRaw(path: string, options?: RequestInit & RequestOptions): Promise<Response>;
-    private envelope;
-    request<T>(method: Method, path: string, options?: RequestOptions & {
-        body?: unknown;
-    }): Promise<ApiEnvelope<T>>;
-    requestRaw<T>(path: string, options?: RequestInit & RequestOptions): Promise<ApiEnvelope<T>>;
-    get<T>(path: string, options?: RequestOptions): Promise<ApiEnvelope<T>>;
-    post<T>(path: string, body?: unknown, options?: RequestOptions): Promise<ApiEnvelope<T>>;
-    put<T>(path: string, body?: unknown, options?: RequestOptions): Promise<ApiEnvelope<T>>;
-    patch<T>(path: string, body?: unknown, options?: RequestOptions): Promise<ApiEnvelope<T>>;
-    delete<T>(path: string, body?: unknown, options?: RequestOptions): Promise<ApiEnvelope<T>>;
-    readBlob(path: string, options?: RequestInit & RequestOptions): Promise<Blob>;
-    postForm<T>(path: string, body: FormData, options?: RequestOptions & {
-        onProgress?: (percent: number) => void;
-    }): Promise<ApiEnvelope<T>>;
-}
-//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,MAAM,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AACjE,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACjH,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AACD,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,cAAc,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;CACtC;AAID,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAQjD;AAED,iFAAiF;AACjF,qBAAa,MAAM;IAQL,OAAO,CAAC,QAAQ,CAAC,OAAO;IAPpC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAyB;IAC/D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmC;IAE9D,YAA6B,OAAO,GAAE,aAAkB,EAcvD;IAED,gFAAgF;IAChF,oBAAoB,CAAC,EAAE,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAAoC;IAE9F,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAA4B;IACpE,YAAY,IAAI,IAAI,CAA2B;IAC/C,yFAAyF;IACzF,aAAa,IAAI,IAAI,CAAwB;IAC7C,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAqE;IAE7G,wEAAwE;IACxE,qBAAqB,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAGtD;IAED,OAAO,CAAC,OAAO;IAiBf,OAAO,CAAC,QAAQ;IAUV,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,WAAW,GAAG,cAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAc1F;YAEa,QAAQ;IAahB,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,cAAc,GAAG;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAIzH;IAEK,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,WAAW,GAAG,cAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAErG;IAED,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,2BAAmD;IAChG,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,2BAA4G;IAC1K,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,2BAAgE;IAC7H,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,2BAAkE;IACjI,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,2BAAmE;IAE7H,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,WAAW,GAAG,cAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtF;IAEK,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE,cAAc,GAAG;QAAE,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;KAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CA4ClJ;CACF"}

package/dist/client.js

@@ -1,205 +0,0 @@
-import { ClientError } from './errors.js';
-const loginPaths = ['/api/v1/auth/login', '/api/v1/auth/session-conflict/resolve', '/api/v1/auth/external/start', '/api/v1/auth/external/complete'];
-export function validateGoPath(path) {
-    if (!/^\/api\/v1\/[a-zA-Z0-9][a-zA-Z0-9_%./-]*(?:\?[a-zA-Z0-9%=&_.+-]*)?$/.test(path)
-        || path.includes('//')
-        || decodeURIComponent(path.split('?')[0]).includes('//')
-        || /(?:^|\/)\.{1,2}(?:\/|$)/.test(decodeURIComponent(path.split('?')[0]))
-        || !new URL(path, 'http://localhost').pathname.startsWith('/api/v1/')) {
-        throw new Error('Invalid Go API path');
-    }
-}
-/** Cookie/CSRF transport. UI, user state and query caches belong to the host. */
-export class Client {
-    options;
-    csrfToken = null;
-    unauthorizedListeners = new Set();
-    baseURL;
-    send;
-    credentials;
-    operations = new Map();
-    constructor(options = {}) {
-        this.options = options;
-        this.baseURL = (options.baseURL ?? '').replace(/\/$/, '');
-        if (this.baseURL && (!/^https?:\/\//.test(this.baseURL) || new URL(this.baseURL).origin !== this.baseURL))
-            throw new Error('baseURL must be an HTTP origin');
-        this.send = options.transport ?? ((...args) => globalThis.fetch(...args));
-        if (options.apiKey && !/^arc_[a-f0-9]{64}$/.test(options.apiKey))
-            throw new Error('Invalid ArcBase API Key');
-        this.credentials = options.credentials ?? (options.apiKey ? 'omit' : 'same-origin');
-        const routes = new Set();
-        for (const op of options.operations ?? []) {
-            validateGoPath(op.fullPath.replaceAll(/\{[a-zA-Z][a-zA-Z0-9_]*\}/g, '1'));
-            if (!op.fullPath.startsWith('/api/v1/extensions/'))
-                throw new Error('Host operations must use /api/v1/extensions/');
-            const key = `${op.method} ${op.fullPath}`;
-            if (routes.has(key))
-                throw new Error('Duplicate host operation');
-            routes.add(key);
-            this.operations.set(op, op.fullPath);
-        }
-    }
-    /** Registration is instance-local and requires the exact declared operation. */
-    resolveOperationPath(op) { return this.operations.get(op); }
-    setCsrfToken(value) { this.csrfToken = value; }
-    clearSession() { this.csrfToken = null; }
-    /** Long-lived authenticated transports use the same expiry notifications as HTTP 401. */
-    expireSession() { this.received(401); }
-    sessionHeaders() { return this.csrfToken ? { 'X-CSRF-Token': this.csrfToken } : {}; }
-    /** Hosts can observe expiry without replacing the caller's callback. */
-    subscribeUnauthorized(listener) {
-        this.unauthorizedListeners.add(listener);
-        return () => { this.unauthorizedListeners.delete(listener); };
-    }
-    headers(method, path, body, options) {
-        validateGoPath(path);
-        if (options.anonymousWrite && (method !== 'POST' || !loginPaths.includes(path)))
-            throw new Error('Only origin-checked login actions may write without CSRF');
-        const write = !['GET', 'HEAD', 'OPTIONS'].includes(method);
-        if (write && !options.anonymousWrite && !this.csrfToken && !this.options.apiKey)
-            throw new ClientError(401, 'session_missing', '登录状态尚未恢复');
-        const headers = new Headers(options.headers);
-        // Caller headers cannot supply a different identity or stale CSRF secret.
-        headers.delete('authorization');
-        headers.delete('cookie');
-        headers.delete('x-csrf-token');
-        if (this.options.apiKey)
-            headers.set('Authorization', `Bearer ${this.options.apiKey}`);
-        if (body instanceof FormData)
-            headers.delete('content-type');
-        else if (body !== undefined && body !== null && !headers.has('content-type'))
-            headers.set('Content-Type', 'application/json');
-        if (write && !options.anonymousWrite && !this.options.apiKey)
-            headers.set('X-CSRF-Token', this.csrfToken);
-        return headers;
-    }
-    received(status, anonymousWrite = false) {
-        if (status === 401) {
-            this.clearSession();
-            if (!anonymousWrite) {
-                for (const listener of this.unauthorizedListeners)
-                    listener();
-                this.options.onUnauthorized?.();
-            }
-        }
-    }
-    async fetchRaw(path, options = {}) {
-        const { anonymousWrite, ...init } = options;
-        const method = (init.method ?? 'GET').toUpperCase();
-        const headers = this.headers(method, path, init.body, { ...options, anonymousWrite });
-        let response;
-        try {
-            response = await this.send(this.baseURL + path, { ...init, method, headers, credentials: this.credentials, cache: 'no-store' });
-        }
-        catch (error) {
-            if (error && typeof error === 'object' && 'name' in error && error.name === 'AbortError')
-                throw error;
-            throw new ClientError(0, 'network_error', '网络请求失败，请检查网络连接');
-        }
-        // A host transport may resolve after cancellation; ignore that stale result.
-        if (init.signal?.aborted)
-            throw new DOMException('已取消', 'AbortError');
-        this.received(response.status, anonymousWrite);
-        return response;
-    }
-    async envelope(response) {
-        const requestId = response.headers.get('X-Request-Id') ?? undefined;
-        let payload;
-        try {
-            payload = await response.json();
-        }
-        catch {
-            throw new ClientError(response.status, 'invalid_response', '服务端响应格式错误', requestId);
-        }
-        if (!payload || typeof payload !== 'object' || !('code' in payload) || typeof payload.code !== 'number'
-            || !('message' in payload) || typeof payload.message !== 'string' || !('data' in payload))
-            throw new ClientError(response.status, 'invalid_response', '服务端响应格式错误', requestId);
-        const result = payload;
-        if (!response.ok && result.code === 0)
-            throw new ClientError(response.status, 'invalid_response', 'HTTP 状态与响应结果不一致', requestId);
-        const retryAfterSeconds = Number(response.headers.get('Retry-After'));
-        return { ...result, ...(requestId ? { requestId } : {}), ...(retryAfterSeconds > 0 ? { retryAfterSeconds } : {}) };
-    }
-    async request(method, path, options = {}) {
-        const { body, ...rest } = options;
-        const raw = body === undefined ? undefined : body instanceof FormData ? body : JSON.stringify(body);
-        return this.requestRaw(path, { ...rest, method, body: raw });
-    }
-    async requestRaw(path, options = {}) {
-        return this.envelope(await this.fetchRaw(path, options));
-    }
-    get(path, options) { return this.request('GET', path, options); }
-    post(path, body, options) { return this.request('POST', path, { ...options, body, anonymousWrite: loginPaths.includes(path) }); }
-    put(path, body, options) { return this.request('PUT', path, { ...options, body }); }
-    patch(path, body, options) { return this.request('PATCH', path, { ...options, body }); }
-    delete(path, body, options) { return this.request('DELETE', path, { ...options, body }); }
-    async readBlob(path, options = {}) {
-        const response = await this.fetchRaw(path, options);
-        if (!response.ok) {
-            const result = await this.envelope(response);
-            throw new ClientError(response.status, result.error ?? 'download_failed', result.message || '下载失败', result.requestId);
-        }
-        if (response.headers.get('Content-Type')?.includes('application/json') && !response.headers.has('Content-Disposition'))
-            throw new ClientError(response.status, 'invalid_response', '文件响应格式错误');
-        return response.blob();
-    }
-    async postForm(path, body, options = {}) {
-        if (!options.onProgress)
-            return this.request('POST', path, { ...options, body });
-        const headers = this.headers('POST', path, body, options);
-        if (options.signal?.aborted)
-            throw new DOMException('已取消', 'AbortError');
-        const xhr = this.options.xhrFactory?.() ?? new XMLHttpRequest();
-        return new Promise((resolve, reject) => {
-            xhr.open('POST', this.baseURL + path);
-            xhr.withCredentials = this.credentials === 'include';
-            headers.forEach((value, name) => xhr.setRequestHeader(name, value));
-            const onProgress = (event) => {
-                if (event.lengthComputable)
-                    options.onProgress?.(Math.round(event.loaded / event.total * 100));
-            };
-            const onAbort = () => { xhr.abort(); reject(new DOMException('已取消', 'AbortError')); };
-            options.signal?.addEventListener('abort', onAbort, { once: true });
-            const cleanup = () => {
-                options.signal?.removeEventListener('abort', onAbort);
-                xhr.upload.removeEventListener('progress', onProgress);
-                xhr.removeEventListener('load', onLoad);
-                xhr.removeEventListener('error', onError);
-                xhr.removeEventListener('abort', onAborted);
-                xhr.removeEventListener('timeout', onTimeout);
-            };
-            const onLoad = () => {
-                cleanup();
-                this.received(xhr.status);
-                const responseHeaders = new Headers();
-                for (const name of ['Content-Type', 'X-Request-Id', 'Retry-After']) {
-                    const value = xhr.getResponseHeader(name);
-                    if (value)
-                        responseHeaders.set(name, value);
-                }
-                try {
-                    void this.envelope(new Response(xhr.responseText, { status: xhr.status, headers: responseHeaders })).then(resolve, reject);
-                }
-                catch (error) {
-                    reject(error);
-                }
-            };
-            const onError = () => { cleanup(); reject(new ClientError(0, 'network_error', '网络请求失败，请检查网络连接')); };
-            const onAborted = () => { cleanup(); reject(new DOMException('已取消', 'AbortError')); };
-            const onTimeout = () => { cleanup(); reject(new ClientError(0, 'timeout', '上传超时')); };
-            xhr.upload.addEventListener('progress', onProgress);
-            xhr.addEventListener('load', onLoad);
-            xhr.addEventListener('error', onError);
-            xhr.addEventListener('abort', onAborted);
-            xhr.addEventListener('timeout', onTimeout);
-            try {
-                xhr.send(body);
-            }
-            catch {
-                cleanup();
-                reject(new ClientError(0, 'network_error', '网络请求失败，请检查网络连接'));
-            }
-        });
-    }
-}
-//# sourceMappingURL=client.js.map