@gmod/bam 8.11.1 → 9.0.0

package/dist/htsget.d.ts

@@ -12,12 +12,13 @@ export default class HtsgetFile<T extends BamRecordLike = BamRecord> extends Bam
         baseUrl: string;
         recordClass?: BamRecordClass<T>;
         /**
-         * fetch implementation used for every request, so an `Authorization: Bearer
-         * <token>` header can be added for servers that require one. It is also
-         * called with the data-block urls from the ticket, which may point at
-         * third-party hosts, so only attach credentials to hosts you trust — the
-         * spec has servers put whatever a data block needs in that url's own
-         * `headers` field, which is applied either way.
+         * fetch implementation for the **ticket request**, so an `Authorization:
+         * Bearer <token>` header can be added for endpoints that require one.
+         *
+         * The data blocks a ticket names are NOT fetched with it — they can point
+         * at any host, and the spec forbids sending the API's token to them. A
+         * block needing authorization carries it in the ticket's own `headers`
+         * field for that url, which is applied regardless.
          */
         fetch?: Fetcher;
         /**

package/dist/htsget.js

@@ -56,19 +56,28 @@ async function fetchOk(fetchFn, url, opts) {
     }
     return res;
 }
-async function fetchChunk(fetchFn, { url, headers }, opts) {
+/**
+ * Data blocks are fetched with the global fetch, never with the ticket fetcher.
+ * The spec is explicit ("HTTPS data block URLs", rule 6): a block url must
+ * carry whatever credential it needs itself, in the url or in its own `headers`,
+ * and the client "must not send the bearer token used for the API, if any, to
+ * the data block endpoint, unless copied in the required `headers`". A ticket
+ * can name any host, so honouring that is the difference between one endpoint's
+ * token going to that endpoint and it going wherever a ticket points.
+ */
+async function fetchChunk({ url, headers }, opts) {
     // pass base64 data URLs straight to fetch; otherwise apply headers (minus
     // referer, which isn't a permitted client-set header).
     // https://stackoverflow.com/a/54123275/2129219
     const { referer: _referer, ...rest } = headers ?? {};
     const res = url.startsWith('data:')
-        ? await fetchOk(fetchFn, url)
-        : await fetchOk(fetchFn, url, { ...opts, headers: rest });
+        ? await fetchOk(fetch, url)
+        : await fetchOk(fetch, url, { ...opts, headers: rest });
     return new Uint8Array(await res.arrayBuffer());
 }
-async function fetchAndConcat(fetchFn, arr, opts) {
+async function fetchAndConcat(arr, opts) {
     // Pipeline unzip after each fetch so decompression overlaps later fetches.
-    return (0, util_ts_1.concatUint8Array)(await Promise.all(arr.map(async (c) => (0, bgzf_filehandle_1.unzip)(await fetchChunk(fetchFn, c, opts)))));
+    return (0, util_ts_1.concatUint8Array)(await Promise.all(arr.map(async (c) => (0, bgzf_filehandle_1.unzip)(await fetchChunk(c, opts)))));
 }
 class HtsgetFile extends bamFile_ts_1.default {
     baseUrl;
@@ -91,12 +100,14 @@ class HtsgetFile extends bamFile_ts_1.default {
      * concatenated, which per the spec is a complete BAM stream.
      */
     async fetchTicket(query, opts) {
-        const url = `${this.baseUrl}/${this.trackId}?${query}`;
+        // Exactly one slash between the two. An id may contain "/" and the spec's
+        // own examples start with one ("/byStudy/PRJEB4019"), while an endpoint is
+        // as often written with a trailing slash as without; concatenating raw
+        // produced "//" for either.
+        const url = `${this.baseUrl.replace(/\/+$/, '')}/${this.trackId.replace(/^\/+/, '')}?${query}`;
         const res = await fetchOk(this.fetchFn, url, { signal: opts?.signal });
         const ticket = await res.json();
-        return fetchAndConcat(this.fetchFn, ticket.htsget.urls, {
-            signal: opts?.signal,
-        });
+        return fetchAndConcat(ticket.htsget.urls, { signal: opts?.signal });
     }
     async getRecordsForRange(chr, min, max, opts) {
         await this.getHeader(opts);
@@ -104,7 +115,7 @@ class HtsgetFile extends bamFile_ts_1.default {
         if (chrId === undefined) {
             return [];
         }
-        const uncba = await this.fetchTicket(`referenceName=${chr}&start=${min}&end=${max}&format=BAM`, opts);
+        const uncba = await this.fetchTicket(`referenceName=${encodeURIComponent(chr)}&start=${min}&end=${max}&format=BAM`, opts);
         const zero = new virtualOffset_ts_1.VirtualOffset(0, 0);
         const records = this.readBamFeatures(uncba.subarray(recordsOffset(uncba)), [], [], new chunk_ts_1.default(zero, zero, 0));
         const result = (0, util_ts_1.appendInRange)(records, chrId, min, max);

package/dist/htsget.js.map

@@ -1 +1 @@
-{"version":3,"file":"htsget.js","sourceRoot":"","sources":["../src/htsget.ts"],"names":[],"mappings":";;;;;AAAA,2DAA6C;AAE7C,8DAAkC;AAClC,0DAA8B;AAC9B,uCAKkB;AAClB,yDAAkD;AA2BlD,kEAAkE;AAClE,+EAA+E;AAC/E,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,MAAmC,CAAA;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,EAAE,MAAM,CAAA;IAC1B,OAAO,GAAG,EAAE,KAAK,KAAK,SAAS;QAC7B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS;YACzB,CAAC,CAAC,GAAG,CAAC,KAAK;YACX,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,OAAO,EAAE,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,KAAiB;IACtC,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAC3B,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,CACjB,CAAA;IACD,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,mBAAS,EAAE,CAAC;QACrE,OAAO,CAAC,CAAA;IACV,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,sBAAY,EAAC,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACxE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAA;AACjB,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,OAAgB,EAAE,GAAW,EAAE,IAAkB;IACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACpC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,QAAQ,GAAG,CAAC,MAAM,aAAa,GAAG,KAAK,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAC9E,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAgB,EAChB,EAAE,GAAG,EAAE,OAAO,EAAe,EAC7B,IAAkB;IAElB,0EAA0E;IAC1E,uDAAuD;IACvD,+CAA+C;IAC/C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;IACpD,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;QACjC,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;QAC7B,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3D,OAAO,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;AAChD,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAAgB,EAChB,GAAkB,EAClB,IAAkB;IAElB,2EAA2E;IAC3E,OAAO,IAAA,0BAAgB,EACrB,MAAM,OAAO,CAAC,GAAG,CACf,GAAG,CAAC,GAAG,CAAC,KAAK,EAAC,CAAC,EAAC,EAAE,CAAC,IAAA,uBAAK,EAAC,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAC9D,CACF,CAAA;AACH,CAAC;AAED,MAAqB,UAEnB,SAAQ,oBAAU;IACV,OAAO,CAAQ;IAEf,OAAO,CAAQ;IAEf,OAAO,CAAS;IAExB,YAAY,IAiCX;QACC,KAAK,CAAC;YACJ,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;SACpD,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;IACpE,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,IAAe;QACtD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK,EAAE,CAAA;QACtD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;QACtE,MAAM,MAAM,GAAiB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YACtD,MAAM,EAAE,IAAI,EAAE,MAAM;SACrB,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,GAAW,EACX,GAAW,EACX,GAAW,EACX,IAAc;QAEd,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,CAAA;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAClC,iBAAiB,GAAG,UAAU,GAAG,QAAQ,GAAG,aAAa,EACzD,IAAI,CACL,CAAA;QACD,MAAM,IAAI,GAAG,IAAI,gCAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAClC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EACpC,EAAE,EACF,EAAE,EACF,IAAI,kBAAK,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CACzB,CAAA;QACD,MAAM,MAAM,GAAG,IAAA,uBAAa,EAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QACtD,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAC5D,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAiB,EAAE;QACpC,wEAAwE;QACxE,wDAAwD;QACxD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAA;QACrE,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;CACF;AAzGD,6BAyGC"}
+{"version":3,"file":"htsget.js","sourceRoot":"","sources":["../src/htsget.ts"],"names":[],"mappings":";;;;;AAAA,2DAA6C;AAE7C,8DAAkC;AAClC,0DAA8B;AAC9B,uCAKkB;AAClB,yDAAkD;AA2BlD,kEAAkE;AAClE,+EAA+E;AAC/E,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,MAAmC,CAAA;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,EAAE,MAAM,CAAA;IAC1B,OAAO,GAAG,EAAE,KAAK,KAAK,SAAS;QAC7B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS;YACzB,CAAC,CAAC,GAAG,CAAC,KAAK;YACX,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,OAAO,EAAE,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,KAAiB;IACtC,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAC3B,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,CACjB,CAAA;IACD,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,mBAAS,EAAE,CAAC;QACrE,OAAO,CAAC,CAAA;IACV,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,sBAAY,EAAC,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACxE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAA;AACjB,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,OAAgB,EAAE,GAAW,EAAE,IAAkB;IACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACpC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,QAAQ,GAAG,CAAC,MAAM,aAAa,GAAG,KAAK,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAC9E,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,UAAU,CAAC,EAAE,GAAG,EAAE,OAAO,EAAe,EAAE,IAAkB;IACzE,0EAA0E;IAC1E,uDAAuD;IACvD,+CAA+C;IAC/C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;IACpD,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;QACjC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;QAC3B,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,OAAO,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;AAChD,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAkB,EAAE,IAAkB;IAClE,2EAA2E;IAC3E,OAAO,IAAA,0BAAgB,EACrB,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAC,CAAC,EAAC,EAAE,CAAC,IAAA,uBAAK,EAAC,MAAM,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CACxE,CAAA;AACH,CAAC;AAED,MAAqB,UAEnB,SAAQ,oBAAU;IACV,OAAO,CAAQ;IAEf,OAAO,CAAQ;IAEf,OAAO,CAAS;IAExB,YAAY,IAkCX;QACC,KAAK,CAAC;YACJ,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;SACpD,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;IACpE,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,IAAe;QACtD,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,4BAA4B;QAC5B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAA;QAC9F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;QACtE,MAAM,MAAM,GAAiB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7C,OAAO,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACrE,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,GAAW,EACX,GAAW,EACX,GAAW,EACX,IAAc;QAEd,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,CAAA;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAClC,iBAAiB,kBAAkB,CAAC,GAAG,CAAC,UAAU,GAAG,QAAQ,GAAG,aAAa,EAC7E,IAAI,CACL,CAAA;QACD,MAAM,IAAI,GAAG,IAAI,gCAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAClC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EACpC,EAAE,EACF,EAAE,EACF,IAAI,kBAAK,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CACzB,CAAA;QACD,MAAM,MAAM,GAAG,IAAA,uBAAa,EAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QACtD,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAC5D,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAiB,EAAE;QACpC,wEAAwE;QACxE,wDAAwD;QACxD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAA;QACrE,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;CACF;AA5GD,6BA4GC"}

package/esm/htsget.d.ts

@@ -12,12 +12,13 @@ export default class HtsgetFile<T extends BamRecordLike = BamRecord> extends Bam
         baseUrl: string;
         recordClass?: BamRecordClass<T>;
         /**
-         * fetch implementation used for every request, so an `Authorization: Bearer
-         * <token>` header can be added for servers that require one. It is also
-         * called with the data-block urls from the ticket, which may point at
-         * third-party hosts, so only attach credentials to hosts you trust — the
-         * spec has servers put whatever a data block needs in that url's own
-         * `headers` field, which is applied either way.
+         * fetch implementation for the **ticket request**, so an `Authorization:
+         * Bearer <token>` header can be added for endpoints that require one.
+         *
+         * The data blocks a ticket names are NOT fetched with it — they can point
+         * at any host, and the spec forbids sending the API's token to them. A
+         * block needing authorization carries it in the ticket's own `headers`
+         * field for that url, which is applied regardless.
          */
         fetch?: Fetcher;
         /**

package/esm/htsget.js

@@ -51,19 +51,28 @@ async function fetchOk(fetchFn, url, opts) {
     }
     return res;
 }
-async function fetchChunk(fetchFn, { url, headers }, opts) {
+/**
+ * Data blocks are fetched with the global fetch, never with the ticket fetcher.
+ * The spec is explicit ("HTTPS data block URLs", rule 6): a block url must
+ * carry whatever credential it needs itself, in the url or in its own `headers`,
+ * and the client "must not send the bearer token used for the API, if any, to
+ * the data block endpoint, unless copied in the required `headers`". A ticket
+ * can name any host, so honouring that is the difference between one endpoint's
+ * token going to that endpoint and it going wherever a ticket points.
+ */
+async function fetchChunk({ url, headers }, opts) {
     // pass base64 data URLs straight to fetch; otherwise apply headers (minus
     // referer, which isn't a permitted client-set header).
     // https://stackoverflow.com/a/54123275/2129219
     const { referer: _referer, ...rest } = headers ?? {};
     const res = url.startsWith('data:')
-        ? await fetchOk(fetchFn, url)
-        : await fetchOk(fetchFn, url, { ...opts, headers: rest });
+        ? await fetchOk(fetch, url)
+        : await fetchOk(fetch, url, { ...opts, headers: rest });
     return new Uint8Array(await res.arrayBuffer());
 }
-async function fetchAndConcat(fetchFn, arr, opts) {
+async function fetchAndConcat(arr, opts) {
     // Pipeline unzip after each fetch so decompression overlaps later fetches.
-    return concatUint8Array(await Promise.all(arr.map(async (c) => unzip(await fetchChunk(fetchFn, c, opts)))));
+    return concatUint8Array(await Promise.all(arr.map(async (c) => unzip(await fetchChunk(c, opts)))));
 }
 export default class HtsgetFile extends BamFile {
     baseUrl;
@@ -86,12 +95,14 @@ export default class HtsgetFile extends BamFile {
      * concatenated, which per the spec is a complete BAM stream.
      */
     async fetchTicket(query, opts) {
-        const url = `${this.baseUrl}/${this.trackId}?${query}`;
+        // Exactly one slash between the two. An id may contain "/" and the spec's
+        // own examples start with one ("/byStudy/PRJEB4019"), while an endpoint is
+        // as often written with a trailing slash as without; concatenating raw
+        // produced "//" for either.
+        const url = `${this.baseUrl.replace(/\/+$/, '')}/${this.trackId.replace(/^\/+/, '')}?${query}`;
         const res = await fetchOk(this.fetchFn, url, { signal: opts?.signal });
         const ticket = await res.json();
-        return fetchAndConcat(this.fetchFn, ticket.htsget.urls, {
-            signal: opts?.signal,
-        });
+        return fetchAndConcat(ticket.htsget.urls, { signal: opts?.signal });
     }
     async getRecordsForRange(chr, min, max, opts) {
         await this.getHeader(opts);
@@ -99,7 +110,7 @@ export default class HtsgetFile extends BamFile {
         if (chrId === undefined) {
             return [];
         }
-        const uncba = await this.fetchTicket(`referenceName=${chr}&start=${min}&end=${max}&format=BAM`, opts);
+        const uncba = await this.fetchTicket(`referenceName=${encodeURIComponent(chr)}&start=${min}&end=${max}&format=BAM`, opts);
         const zero = new VirtualOffset(0, 0);
         const records = this.readBamFeatures(uncba.subarray(recordsOffset(uncba)), [], [], new Chunk(zero, zero, 0));
         const result = appendInRange(records, chrId, min, max);

package/esm/htsget.js.map

@@ -1 +1 @@
-{"version":3,"file":"htsget.js","sourceRoot":"","sources":["../src/htsget.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAA;AAE7C,OAAO,OAAO,MAAM,cAAc,CAAA;AAClC,OAAO,KAAK,MAAM,YAAY,CAAA;AAC9B,OAAO,EACL,SAAS,EACT,aAAa,EACb,gBAAgB,EAChB,YAAY,GACb,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AA2BlD,kEAAkE;AAClE,+EAA+E;AAC/E,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,MAAmC,CAAA;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,EAAE,MAAM,CAAA;IAC1B,OAAO,GAAG,EAAE,KAAK,KAAK,SAAS;QAC7B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS;YACzB,CAAC,CAAC,GAAG,CAAC,KAAK;YACX,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,OAAO,EAAE,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,KAAiB;IACtC,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAC3B,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,CACjB,CAAA;IACD,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACrE,OAAO,CAAC,CAAA;IACV,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACxE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAA;AACjB,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,OAAgB,EAAE,GAAW,EAAE,IAAkB;IACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACpC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,QAAQ,GAAG,CAAC,MAAM,aAAa,GAAG,KAAK,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAC9E,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAgB,EAChB,EAAE,GAAG,EAAE,OAAO,EAAe,EAC7B,IAAkB;IAElB,0EAA0E;IAC1E,uDAAuD;IACvD,+CAA+C;IAC/C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;IACpD,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;QACjC,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;QAC7B,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3D,OAAO,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;AAChD,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAAgB,EAChB,GAAkB,EAClB,IAAkB;IAElB,2EAA2E;IAC3E,OAAO,gBAAgB,CACrB,MAAM,OAAO,CAAC,GAAG,CACf,GAAG,CAAC,GAAG,CAAC,KAAK,EAAC,CAAC,EAAC,EAAE,CAAC,KAAK,CAAC,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAC9D,CACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,UAEnB,SAAQ,OAAU;IACV,OAAO,CAAQ;IAEf,OAAO,CAAQ;IAEf,OAAO,CAAS;IAExB,YAAY,IAiCX;QACC,KAAK,CAAC;YACJ,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;SACpD,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;IACpE,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,IAAe;QACtD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK,EAAE,CAAA;QACtD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;QACtE,MAAM,MAAM,GAAiB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YACtD,MAAM,EAAE,IAAI,EAAE,MAAM;SACrB,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,GAAW,EACX,GAAW,EACX,GAAW,EACX,IAAc;QAEd,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,CAAA;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAClC,iBAAiB,GAAG,UAAU,GAAG,QAAQ,GAAG,aAAa,EACzD,IAAI,CACL,CAAA;QACD,MAAM,IAAI,GAAG,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAClC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EACpC,EAAE,EACF,EAAE,EACF,IAAI,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CACzB,CAAA;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QACtD,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAC5D,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAiB,EAAE;QACpC,wEAAwE;QACxE,wDAAwD;QACxD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAA;QACrE,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;CACF"}
+{"version":3,"file":"htsget.js","sourceRoot":"","sources":["../src/htsget.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAA;AAE7C,OAAO,OAAO,MAAM,cAAc,CAAA;AAClC,OAAO,KAAK,MAAM,YAAY,CAAA;AAC9B,OAAO,EACL,SAAS,EACT,aAAa,EACb,gBAAgB,EAChB,YAAY,GACb,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AA2BlD,kEAAkE;AAClE,+EAA+E;AAC/E,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,MAAmC,CAAA;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,EAAE,MAAM,CAAA;IAC1B,OAAO,GAAG,EAAE,KAAK,KAAK,SAAS;QAC7B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS;YACzB,CAAC,CAAC,GAAG,CAAC,KAAK;YACX,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,OAAO,EAAE,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,KAAiB;IACtC,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAC3B,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,CACjB,CAAA;IACD,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACrE,OAAO,CAAC,CAAA;IACV,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACxE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAA;AACjB,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,OAAgB,EAAE,GAAW,EAAE,IAAkB;IACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACpC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,QAAQ,GAAG,CAAC,MAAM,aAAa,GAAG,KAAK,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAC9E,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,UAAU,CAAC,EAAE,GAAG,EAAE,OAAO,EAAe,EAAE,IAAkB;IACzE,0EAA0E;IAC1E,uDAAuD;IACvD,+CAA+C;IAC/C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;IACpD,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;QACjC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;QAC3B,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,OAAO,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;AAChD,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAkB,EAAE,IAAkB;IAClE,2EAA2E;IAC3E,OAAO,gBAAgB,CACrB,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAC,CAAC,EAAC,EAAE,CAAC,KAAK,CAAC,MAAM,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CACxE,CAAA;AACH,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,UAEnB,SAAQ,OAAU;IACV,OAAO,CAAQ;IAEf,OAAO,CAAQ;IAEf,OAAO,CAAS;IAExB,YAAY,IAkCX;QACC,KAAK,CAAC;YACJ,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;SACpD,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;IACpE,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,IAAe;QACtD,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,4BAA4B;QAC5B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAA;QAC9F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;QACtE,MAAM,MAAM,GAAiB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7C,OAAO,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACrE,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,GAAW,EACX,GAAW,EACX,GAAW,EACX,IAAc;QAEd,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,CAAA;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAClC,iBAAiB,kBAAkB,CAAC,GAAG,CAAC,UAAU,GAAG,QAAQ,GAAG,aAAa,EAC7E,IAAI,CACL,CAAA;QACD,MAAM,IAAI,GAAG,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAClC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EACpC,EAAE,EACF,EAAE,EACF,IAAI,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CACzB,CAAA;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QACtD,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAC5D,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAiB,EAAE;QACpC,wEAAwE;QACxE,wDAAwD;QACxD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAA;QACrE,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gmod/bam",
-  "version": "8.11.1",
+  "version": "9.0.0",
   "packageManager": "pnpm@11.15.1",
   "description": "Parser for BAM and BAM index (bai) files",
   "license": "MIT",

package/src/htsget.ts

@@ -91,31 +91,30 @@ async function fetchOk(fetchFn: Fetcher, url: string, opts?: RequestInit) {
   return res
 }
 
-async function fetchChunk(
-  fetchFn: Fetcher,
-  { url, headers }: HtsgetChunk,
-  opts?: RequestInit,
-) {
+/**
+ * Data blocks are fetched with the global fetch, never with the ticket fetcher.
+ * The spec is explicit ("HTTPS data block URLs", rule 6): a block url must
+ * carry whatever credential it needs itself, in the url or in its own `headers`,
+ * and the client "must not send the bearer token used for the API, if any, to
+ * the data block endpoint, unless copied in the required `headers`". A ticket
+ * can name any host, so honouring that is the difference between one endpoint's
+ * token going to that endpoint and it going wherever a ticket points.
+ */
+async function fetchChunk({ url, headers }: HtsgetChunk, opts?: RequestInit) {
   // pass base64 data URLs straight to fetch; otherwise apply headers (minus
   // referer, which isn't a permitted client-set header).
   // https://stackoverflow.com/a/54123275/2129219
   const { referer: _referer, ...rest } = headers ?? {}
   const res = url.startsWith('data:')
-    ? await fetchOk(fetchFn, url)
-    : await fetchOk(fetchFn, url, { ...opts, headers: rest })
+    ? await fetchOk(fetch, url)
+    : await fetchOk(fetch, url, { ...opts, headers: rest })
   return new Uint8Array(await res.arrayBuffer())
 }
 
-async function fetchAndConcat(
-  fetchFn: Fetcher,
-  arr: HtsgetChunk[],
-  opts?: RequestInit,
-) {
+async function fetchAndConcat(arr: HtsgetChunk[], opts?: RequestInit) {
   // Pipeline unzip after each fetch so decompression overlaps later fetches.
   return concatUint8Array(
-    await Promise.all(
-      arr.map(async c => unzip(await fetchChunk(fetchFn, c, opts))),
-    ),
+    await Promise.all(arr.map(async c => unzip(await fetchChunk(c, opts)))),
   )
 }
 
@@ -133,12 +132,13 @@ export default class HtsgetFile<
     baseUrl: string
     recordClass?: BamRecordClass<T>
     /**
-     * fetch implementation used for every request, so an `Authorization: Bearer
-     * <token>` header can be added for servers that require one. It is also
-     * called with the data-block urls from the ticket, which may point at
-     * third-party hosts, so only attach credentials to hosts you trust — the
-     * spec has servers put whatever a data block needs in that url's own
-     * `headers` field, which is applied either way.
+     * fetch implementation for the **ticket request**, so an `Authorization:
+     * Bearer <token>` header can be added for endpoints that require one.
+     *
+     * The data blocks a ticket names are NOT fetched with it — they can point
+     * at any host, and the spec forbids sending the API's token to them. A
+     * block needing authorization carries it in the ticket's own `headers`
+     * field for that url, which is applied regardless.
      */
     fetch?: Fetcher
     /**
@@ -179,12 +179,14 @@ export default class HtsgetFile<
    * concatenated, which per the spec is a complete BAM stream.
    */
   private async fetchTicket(query: string, opts?: BaseOpts) {
-    const url = `${this.baseUrl}/${this.trackId}?${query}`
+    // Exactly one slash between the two. An id may contain "/" and the spec's
+    // own examples start with one ("/byStudy/PRJEB4019"), while an endpoint is
+    // as often written with a trailing slash as without; concatenating raw
+    // produced "//" for either.
+    const url = `${this.baseUrl.replace(/\/+$/, '')}/${this.trackId.replace(/^\/+/, '')}?${query}`
     const res = await fetchOk(this.fetchFn, url, { signal: opts?.signal })
     const ticket: HtsgetTicket = await res.json()
-    return fetchAndConcat(this.fetchFn, ticket.htsget.urls, {
-      signal: opts?.signal,
-    })
+    return fetchAndConcat(ticket.htsget.urls, { signal: opts?.signal })
   }
 
   async getRecordsForRange(
@@ -199,7 +201,7 @@ export default class HtsgetFile<
       return []
     }
     const uncba = await this.fetchTicket(
-      `referenceName=${chr}&start=${min}&end=${max}&format=BAM`,
+      `referenceName=${encodeURIComponent(chr)}&start=${min}&end=${max}&format=BAM`,
       opts,
     )
     const zero = new VirtualOffset(0, 0)