@h-ai/api-client 0.1.0-alpha.13 → 0.1.0-alpha.16

package/dist/index.js

@@ -1,10 +1,16 @@
+import { IAM_AUTH_ROUTES, apiContract } from '@h-ai/api-contract';
 import { core, ok, err } from '@h-ai/core';
+import { createORPCClient, ORPCError } from '@orpc/client';
+import { OpenAPILink } from '@orpc/openapi-client/fetch';
 import { z } from 'zod';
 
-// src/api-client-auth.ts
+// src/api-client-main.ts
+var logger = core.logger.child({ module: "api-client", scope: "auth" });
+var HTTPONLY_COOKIE_SENTINEL = "__httponly_cookie__";
 var LS_ACCESS_KEY = "hai_access_token";
 var LS_REFRESH_KEY = "hai_refresh_token";
 function createLocalStorageTokenStorage() {
+  logger.warn("apiClient.tokenStorage.localStorage: storing tokens in localStorage exposes them to XSS. Prefer httpOnly cookies for production.");
   return {
     async getAccessToken() {
       return globalThis.localStorage?.getItem(LS_ACCESS_KEY) ?? null;
@@ -46,445 +52,40 @@ function createMemoryTokenStorage() {
     }
   };
 }
-
-// messages/en-US.json
-var en_US_default = {
-  apiClient_networkError: "Network request failed",
-  apiClient_timeout: "Request timeout",
-  apiClient_serverError: "Server error ({status})",
-  apiClient_unauthorized: "Unauthorized, please log in again",
-  apiClient_forbidden: "Access forbidden",
-  apiClient_notFound: "Resource not found",
-  apiClient_validationFailed: "Request validation failed",
-  apiClient_tokenRefreshFailed: "Token refresh failed, please log in again",
-  apiClient_notInitialized: "API client not initialized, please call api.init() first",
-  apiClient_configError: "API client config error: {error}",
-  apiClient_responseValidationFailed: "Response validation failed",
-  apiClient_unknown: "Unknown error"
-};
-
-// messages/zh-CN.json
-var zh_CN_default = {
-  apiClient_networkError: "\u7F51\u7EDC\u8BF7\u6C42\u5931\u8D25",
-  apiClient_timeout: "\u8BF7\u6C42\u8D85\u65F6",
-  apiClient_serverError: "\u670D\u52A1\u5668\u9519\u8BEF\uFF08{status}\uFF09",
-  apiClient_unauthorized: "\u672A\u6388\u6743\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55",
-  apiClient_forbidden: "\u65E0\u6743\u9650\u8BBF\u95EE",
-  apiClient_notFound: "\u8BF7\u6C42\u7684\u8D44\u6E90\u4E0D\u5B58\u5728",
-  apiClient_validationFailed: "\u8BF7\u6C42\u53C2\u6570\u6821\u9A8C\u5931\u8D25",
-  apiClient_tokenRefreshFailed: "Token\u5237\u65B0\u5931\u8D25\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55",
-  apiClient_notInitialized: "API \u5BA2\u6237\u7AEF\u672A\u521D\u59CB\u5316\uFF0C\u8BF7\u5148\u8C03\u7528 api.init()",
-  apiClient_configError: "API \u5BA2\u6237\u7AEF\u914D\u7F6E\u9519\u8BEF\uFF1A{error}",
-  apiClient_responseValidationFailed: "\u54CD\u5E94\u6570\u636E\u6821\u9A8C\u5931\u8D25",
-  apiClient_unknown: "\u672A\u77E5\u9519\u8BEF"
-};
-
-// src/api-client-i18n.ts
-var apiClientM = core.i18n.createMessageGetter({
-  "zh-CN": zh_CN_default,
-  "en-US": en_US_default
-});
-var ApiClientErrorInfo = {
-  NETWORK_ERROR: "001:502",
-  TIMEOUT: "002:504",
-  SERVER_ERROR: "003:502",
-  UNAUTHORIZED: "004:401",
-  FORBIDDEN: "005:403",
-  NOT_FOUND: "006:404",
-  VALIDATION_FAILED: "007:400",
-  TOKEN_REFRESH_FAILED: "008:401",
-  NOT_INITIALIZED: "010:500",
-  CONFIG_ERROR: "011:500",
-  UNKNOWN: "099:500"
-};
-var HaiApiClientError = core.error.buildHaiErrorsDef("api-client", ApiClientErrorInfo);
-function defineEndpoint(def) {
-  return def;
-}
-
-// src/api-client-contract.ts
-function createContractCaller(fetchClient) {
-  async function call(endpoint, input) {
-    const parsed = endpoint.input.safeParse(input);
-    if (!parsed.success) {
-      return err(
-        HaiApiClientError.VALIDATION_FAILED,
-        apiClientM("apiClient_validationFailed"),
-        parsed.error.issues
-      );
-    }
-    const validInput = parsed.data;
-    let result;
-    switch (endpoint.method) {
-      case "GET":
-        result = await fetchClient.get(endpoint.path, validInput);
-        break;
-      case "POST":
-        result = await fetchClient.post(endpoint.path, validInput);
-        break;
-      case "PUT":
-        result = await fetchClient.put(endpoint.path, validInput);
-        break;
-      case "PATCH":
-        result = await fetchClient.patch(endpoint.path, validInput);
-        break;
-      case "DELETE":
-        result = await fetchClient.delete(endpoint.path, validInput);
-        break;
-      default:
-        return err(
-          HaiApiClientError.UNKNOWN,
-          apiClientM("apiClient_unknown")
-        );
-    }
-    if (!result.success) {
-      return result;
-    }
-    const outputParsed = endpoint.output.safeParse(result.data);
-    if (!outputParsed.success) {
-      return err(
-        HaiApiClientError.VALIDATION_FAILED,
-        apiClientM("apiClient_responseValidationFailed"),
-        outputParsed.error.issues
-      );
-    }
-    return ok(outputParsed.data);
-  }
-  return call;
-}
-async function responseToError(response) {
-  let details;
-  try {
-    const body = await response.json();
-    details = body;
-  } catch {
-  }
-  const status = response.status;
-  if (status === 401) {
-    return err(
-      HaiApiClientError.UNAUTHORIZED,
-      apiClientM("apiClient_unauthorized"),
-      details
-    );
-  }
-  if (status === 403) {
-    return err(
-      HaiApiClientError.FORBIDDEN,
-      apiClientM("apiClient_forbidden"),
-      details
-    );
-  }
-  if (status === 404) {
-    return err(
-      HaiApiClientError.NOT_FOUND,
-      apiClientM("apiClient_notFound"),
-      details
-    );
-  }
-  if (status === 400 || status === 422) {
-    return err(
-      HaiApiClientError.VALIDATION_FAILED,
-      apiClientM("apiClient_validationFailed"),
-      details
-    );
-  }
-  if (status >= 500) {
-    return err(
-      HaiApiClientError.SERVER_ERROR,
-      apiClientM("apiClient_serverError", { params: { status: String(status) } }),
-      details
-    );
-  }
-  return err(
-    HaiApiClientError.UNKNOWN,
-    apiClientM("apiClient_unknown"),
-    details
-  );
-}
-function networkErrorToResult(cause) {
-  if (cause instanceof DOMException && cause.name === "AbortError") {
-    return err(
-      HaiApiClientError.TIMEOUT,
-      apiClientM("apiClient_timeout"),
-      cause
-    );
-  }
-  return err(
-    HaiApiClientError.NETWORK_ERROR,
-    apiClientM("apiClient_networkError"),
-    cause
-  );
-}
-
-// src/api-client-fetch.ts
-var logger = core.logger.child({ module: "api-client", scope: "fetch" });
-var DEFAULT_TIMEOUT = 3e4;
-var TRAILING_SLASHES_REGEX = /\/+$/;
-function createFetchClient(config, tokenManager) {
-  const fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
-  const timeout = config.timeout ?? DEFAULT_TIMEOUT;
-  const requestInterceptors = config.interceptors?.request ?? [];
-  const responseInterceptors = config.interceptors?.response ?? [];
-  function buildUrl(path, params) {
-    const base = config.baseUrl.replace(TRAILING_SLASHES_REGEX, "");
-    const normalizedPath = path.startsWith("/") ? path : `/${path}`;
-    const url = new URL(`${base}${normalizedPath}`);
-    if (params) {
-      for (const [key, value] of Object.entries(params)) {
-        if (value !== void 0 && value !== null) {
-          url.searchParams.set(key, String(value));
-        }
-      }
-    }
-    return url.toString();
-  }
-  async function execute(requestConfig, retryOnUnauthorized = true) {
-    logger.trace("Executing request", { method: requestConfig.method, url: requestConfig.url });
-    if (tokenManager) {
-      const accessToken = await tokenManager.storage.getAccessToken();
-      if (accessToken) {
-        requestConfig.headers.Authorization = `Bearer ${accessToken}`;
-      }
-    }
-    let finalConfig = requestConfig;
-    for (const interceptor of requestInterceptors) {
-      finalConfig = await interceptor(finalConfig);
-    }
-    const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), timeout);
-    finalConfig.signal = controller.signal;
-    try {
-      let response = await fetchFn(finalConfig.url, {
-        method: finalConfig.method,
-        headers: finalConfig.headers,
-        body: finalConfig.body,
-        signal: finalConfig.signal
-      });
-      clearTimeout(timeoutId);
-      for (const interceptor of responseInterceptors) {
-        response = await interceptor(response);
-      }
-      if (response.status === 401 && retryOnUnauthorized && tokenManager) {
-        logger.trace("Received 401, attempting token refresh", { url: requestConfig.url });
-        const tokens = await tokenManager.refresh();
-        if (tokens) {
-          logger.trace("Token refreshed, retrying request", { url: requestConfig.url });
-          requestConfig.headers.Authorization = `Bearer ${tokens.accessToken}`;
-          return execute(requestConfig, false);
-        }
-        logger.warn("Token refresh failed, returning 401 error", { url: requestConfig.url });
-      }
-      if (!response.ok) {
-        return responseToError(response);
-      }
-      const contentType = response.headers.get("content-type") ?? "";
-      if (contentType.includes("application/json")) {
-        const body = await response.json();
-        if (body && typeof body === "object" && "data" in body) {
-          return ok(body.data);
-        }
-        return ok(body);
-      }
-      return ok(void 0);
-    } catch (cause) {
-      clearTimeout(timeoutId);
-      logger.warn("Request failed", { url: requestConfig.url, error: cause });
-      return networkErrorToResult(cause);
-    }
-  }
-  async function get(path, params) {
-    return execute({
-      url: buildUrl(path, params),
-      method: "GET",
-      headers: { Accept: "application/json" }
-    });
-  }
-  async function post(path, body) {
-    return execute({
-      url: buildUrl(path),
-      method: "POST",
-      headers: { "Content-Type": "application/json", "Accept": "application/json" },
-      body: body !== void 0 ? JSON.stringify(body) : void 0
-    });
-  }
-  async function put(path, body) {
-    return execute({
-      url: buildUrl(path),
-      method: "PUT",
-      headers: { "Content-Type": "application/json", "Accept": "application/json" },
-      body: body !== void 0 ? JSON.stringify(body) : void 0
-    });
-  }
-  async function patch(path, body) {
-    return execute({
-      url: buildUrl(path),
-      method: "PATCH",
-      headers: { "Content-Type": "application/json", "Accept": "application/json" },
-      body: body !== void 0 ? JSON.stringify(body) : void 0
-    });
-  }
-  async function del(path, params) {
-    return execute({
-      url: buildUrl(path, params),
-      method: "DELETE",
-      headers: { Accept: "application/json" }
-    });
-  }
-  async function upload(path, file, options) {
-    const formData = new FormData();
-    formData.append(options?.fieldName ?? "file", file);
-    if (options?.extraFields) {
-      for (const [key, value] of Object.entries(options.extraFields)) {
-        formData.append(key, value);
-      }
-    }
-    return execute({
-      url: buildUrl(path),
-      method: "POST",
-      headers: { Accept: "application/json" },
-      body: formData
-    });
-  }
-  async function* stream(path, body, options) {
-    const requestConfig = {
-      url: buildUrl(path),
-      method: "POST",
-      headers: { "Content-Type": "application/json", "Accept": "text/event-stream" },
-      body: body !== void 0 ? JSON.stringify(body) : void 0
-    };
-    if (tokenManager) {
-      const accessToken = await tokenManager.storage.getAccessToken();
-      if (accessToken) {
-        requestConfig.headers.Authorization = `Bearer ${accessToken}`;
-      }
-    }
-    let finalConfig = requestConfig;
-    for (const interceptor of requestInterceptors) {
-      finalConfig = await interceptor(finalConfig);
-    }
-    const controller = new AbortController();
-    let timeoutId = null;
-    let timeoutTriggered = false;
-    const clearStreamTimeout = () => {
-      if (timeoutId) {
-        clearTimeout(timeoutId);
-        timeoutId = null;
-      }
-    };
-    const armStreamTimeout = () => {
-      clearStreamTimeout();
-      timeoutTriggered = false;
-      timeoutId = setTimeout(() => {
-        timeoutTriggered = true;
-        controller.abort();
-      }, timeout);
-    };
-    const externalSignal = options?.signal;
-    const onExternalAbort = () => {
-      controller.abort();
-    };
-    if (externalSignal) {
-      if (externalSignal.aborted) {
-        controller.abort();
-      } else {
-        externalSignal.addEventListener("abort", onExternalAbort, { once: true });
-      }
-    }
-    async function doStreamFetch() {
-      armStreamTimeout();
-      try {
-        return await fetchFn(finalConfig.url, {
-          method: finalConfig.method,
-          headers: finalConfig.headers,
-          body: finalConfig.body,
-          signal: controller.signal
-        });
-      } catch (cause) {
-        clearStreamTimeout();
-        throw cause;
-      }
-    }
-    let reader = null;
-    try {
-      let response = await doStreamFetch();
-      if (response.status === 401 && tokenManager) {
-        logger.info("Stream received 401, attempting token refresh", { url: requestConfig.url });
-        const tokens = await tokenManager.refresh();
-        if (tokens) {
-          finalConfig.headers.Authorization = `Bearer ${tokens.accessToken}`;
-          response = await doStreamFetch();
-        }
-      }
-      if (!response.ok) {
-        const errorResult = await responseToError(response);
-        if (!errorResult.success) {
-          throw new Error(errorResult.error.message, { cause: errorResult.error });
-        }
-      }
-      if (!response.body) {
-        throw new Error(apiClientM("apiClient_networkError"));
-      }
-      reader = response.body.getReader();
-      const decoder = new TextDecoder();
-      let lineBuffer = "";
-      while (true) {
-        armStreamTimeout();
-        const { done, value } = await reader.read();
-        clearStreamTimeout();
-        if (done)
-          break;
-        lineBuffer += decoder.decode(value, { stream: true });
-        const parts = lineBuffer.split("\n");
-        lineBuffer = parts.pop() ?? "";
-        for (const line of parts) {
-          if (line.startsWith("data: ")) {
-            const data = line.slice(6);
-            if (data !== "[DONE]") {
-              yield data;
-            }
-          }
-        }
-      }
-      if (lineBuffer.startsWith("data: ")) {
-        const data = lineBuffer.slice(6);
-        if (data !== "[DONE]") {
-          yield data;
-        }
-      }
-    } catch (cause) {
-      if (cause instanceof DOMException && cause.name === "AbortError") {
-        if (externalSignal?.aborted && !timeoutTriggered) {
-          throw cause;
-        }
-        throw new Error(apiClientM("apiClient_timeout"), { cause });
-      }
-      throw cause;
-    } finally {
-      clearStreamTimeout();
-      if (externalSignal) {
-        externalSignal.removeEventListener("abort", onExternalAbort);
-      }
-      if (reader) {
-        reader.releaseLock();
-      }
+function createHttpOnlyCookieTokenStorage() {
+  let memoryAccessToken = null;
+  return {
+    async getAccessToken() {
+      return memoryAccessToken;
+    },
+    async setAccessToken(token) {
+      memoryAccessToken = token;
+    },
+    // refresh token 由服务端通过 Set-Cookie 设置为 httpOnly cookie；
+    // JS 不可见，返回哨兵值让 TokenManager 识别此模式。
+    async getRefreshToken() {
+      return HTTPONLY_COOKIE_SENTINEL;
+    },
+    // refresh token 由服务端管理，JS 端无法写入 httpOnly cookie，忽略此调用。
+    async setRefreshToken(_token) {
+    },
+    async clear() {
+      memoryAccessToken = null;
     }
-  }
-  return { get, post, put, patch, delete: del, upload, stream, execute, buildUrl };
+  };
 }
-var logger2 = core.logger.child({ module: "api-client", scope: "auth" });
-var TokenPairSchema = z.object({
+var RefreshTokenPayloadSchema = z.object({
   accessToken: z.string().min(1),
-  refreshToken: z.string().min(1),
+  refreshToken: z.string().min(1).optional(),
   expiresIn: z.number().optional(),
   tokenType: z.string().optional()
 });
-function createTokenManager(storage, refreshUrl, fetchFn, onRefreshFailed) {
+function createTokenManager(storage, refreshEndpointUrl, fetchFn, onRefreshFailed, refreshTimeoutMs = 1e4) {
   const callbacks = [];
   let refreshPromise = null;
   async function refresh() {
-    if (refreshPromise) {
+    if (refreshPromise)
       return refreshPromise;
-    }
     refreshPromise = doRefresh();
     try {
       return await refreshPromise;
@@ -495,48 +96,65 @@ function createTokenManager(storage, refreshUrl, fetchFn, onRefreshFailed) {
   async function doRefresh() {
     const refreshToken = await storage.getRefreshToken();
     if (!refreshToken) {
-      logger2.warn("Token refresh skipped, no refresh token available");
+      logger.warn("Token refresh skipped, no refresh token available");
       onRefreshFailed?.();
       return null;
     }
-    logger2.debug("Refreshing token", { url: refreshUrl });
+    logger.debug("Refreshing token");
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), refreshTimeoutMs);
     try {
-      const response = await fetchFn(refreshUrl, {
+      const useHttpOnlyCookie = refreshToken === HTTPONLY_COOKIE_SENTINEL;
+      const requestInit = {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ refreshToken })
-      });
+        body: useHttpOnlyCookie ? void 0 : JSON.stringify({ refreshToken }),
+        credentials: useHttpOnlyCookie ? "include" : "same-origin",
+        signal: controller.signal
+      };
+      if (!useHttpOnlyCookie) {
+        requestInit.headers = { "Content-Type": "application/json" };
+      }
+      const response = await fetchFn(refreshEndpointUrl, requestInit);
       if (!response.ok) {
-        await storage.clear();
-        onRefreshFailed?.();
+        if (response.status >= 400 && response.status < 500) {
+          await storage.clear();
+          onRefreshFailed?.();
+        } else {
+          logger.warn("Token refresh transient failure, keeping tokens", { status: response.status });
+        }
         return null;
       }
       const body = await response.json();
-      const parsed = TokenPairSchema.safeParse(body.data);
+      const parsed = RefreshTokenPayloadSchema.safeParse(readTokenPayload(body.data));
       if (!parsed.success) {
-        logger2.warn("Token refresh returned invalid data", { issues: parsed.error.issues });
+        logger.warn("Token refresh returned invalid data", { issues: parsed.error.issues });
+        await storage.clear();
+        onRefreshFailed?.();
+        return null;
+      }
+      if (!useHttpOnlyCookie && !parsed.data.refreshToken) {
+        logger.warn("Token refresh returned invalid data", { issues: [{ path: ["refreshToken"], message: "Required" }] });
         await storage.clear();
         onRefreshFailed?.();
         return null;
       }
+      const refreshTokenForStorage = parsed.data.refreshToken ?? HTTPONLY_COOKIE_SENTINEL;
       const tokens = {
         accessToken: parsed.data.accessToken,
-        refreshToken: parsed.data.refreshToken,
+        refreshToken: refreshTokenForStorage,
         expiresIn: parsed.data.expiresIn ?? 3600,
         tokenType: "Bearer"
       };
       await storage.setAccessToken(tokens.accessToken);
-      await storage.setRefreshToken(tokens.refreshToken);
-      logger2.info("Token refreshed successfully");
-      for (const cb of callbacks) {
-        cb(tokens);
-      }
+      await storage.setRefreshToken(refreshTokenForStorage);
+      logger.info("Token refreshed successfully");
+      for (const cb of callbacks) cb(tokens);
       return tokens;
     } catch (error) {
-      logger2.error("Token refresh failed", { error });
-      await storage.clear();
-      onRefreshFailed?.();
+      logger.error("Token refresh failed (transient)", { error });
       return null;
+    } finally {
+      clearTimeout(timeoutId);
     }
   }
   return {
@@ -544,7 +162,8 @@ function createTokenManager(storage, refreshUrl, fetchFn, onRefreshFailed) {
     refresh,
     async setTokens(tokens) {
       await storage.setAccessToken(tokens.accessToken);
-      await storage.setRefreshToken(tokens.refreshToken);
+      if (tokens.refreshToken)
+        await storage.setRefreshToken(tokens.refreshToken);
     },
     async clear() {
       await storage.clear();
@@ -559,192 +178,283 @@ function createTokenManager(storage, refreshUrl, fetchFn, onRefreshFailed) {
     }
   };
 }
+function readTokenPayload(data) {
+  if (typeof data === "object" && data !== null && "tokens" in data) {
+    return data.tokens;
+  }
+  return data;
+}
+
+// messages/en-US.json
+var en_US_default = {
+  apiClient_networkError: "Network request failed",
+  apiClient_timeout: "Request timeout",
+  apiClient_serverError: "Server error ({status})",
+  apiClient_unauthorized: "Unauthorized, please log in again",
+  apiClient_forbidden: "Access forbidden",
+  apiClient_notFound: "Resource not found",
+  apiClient_validationFailed: "Request validation failed",
+  apiClient_tokenRefreshFailed: "Token refresh failed, please log in again",
+  apiClient_notInitialized: "API client not initialized, please call api.init() first",
+  apiClient_configError: "API client config error: {error}",
+  apiClient_responseValidationFailed: "Response validation failed",
+  apiClient_unknown: "Unknown error"
+};
+
+// messages/zh-CN.json
+var zh_CN_default = {
+  apiClient_networkError: "\u7F51\u7EDC\u8BF7\u6C42\u5931\u8D25",
+  apiClient_timeout: "\u8BF7\u6C42\u8D85\u65F6",
+  apiClient_serverError: "\u670D\u52A1\u5668\u9519\u8BEF\uFF08{status}\uFF09",
+  apiClient_unauthorized: "\u672A\u6388\u6743\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55",
+  apiClient_forbidden: "\u65E0\u6743\u9650\u8BBF\u95EE",
+  apiClient_notFound: "\u8BF7\u6C42\u7684\u8D44\u6E90\u4E0D\u5B58\u5728",
+  apiClient_validationFailed: "\u8BF7\u6C42\u53C2\u6570\u6821\u9A8C\u5931\u8D25",
+  apiClient_tokenRefreshFailed: "Token\u5237\u65B0\u5931\u8D25\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55",
+  apiClient_notInitialized: "API \u5BA2\u6237\u7AEF\u672A\u521D\u59CB\u5316\uFF0C\u8BF7\u5148\u8C03\u7528 api.init()",
+  apiClient_configError: "API \u5BA2\u6237\u7AEF\u914D\u7F6E\u9519\u8BEF\uFF1A{error}",
+  apiClient_responseValidationFailed: "\u54CD\u5E94\u6570\u636E\u6821\u9A8C\u5931\u8D25",
+  apiClient_unknown: "\u672A\u77E5\u9519\u8BEF"
+};
+
+// src/api-client-i18n.ts
+var apiClientM = core.i18n.createMessageGetter({
+  "zh-CN": zh_CN_default,
+  "en-US": en_US_default
+});
+var ApiClientErrorInfo = {
+  NETWORK_ERROR: "001:502",
+  TIMEOUT: "002:504",
+  SERVER_ERROR: "003:502",
+  UNAUTHORIZED: "004:401",
+  FORBIDDEN: "005:403",
+  NOT_FOUND: "006:404",
+  VALIDATION_FAILED: "007:400",
+  TOKEN_REFRESH_FAILED: "008:401",
+  NOT_INITIALIZED: "010:500",
+  CONFIG_ERROR: "011:500",
+  UNKNOWN: "099:500"
+};
+var HaiApiClientError = core.error.buildHaiErrorsDef("api-client", ApiClientErrorInfo);
 
 // src/api-client-main.ts
-var logger3 = core.logger.child({ module: "api-client", scope: "main" });
-var TRAILING_SLASHES_REGEX2 = /\/+$/;
-var currentClient = null;
-var currentConfig = null;
-var initInProgress = false;
-function createClient(config) {
-  const fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
-  const tokenStorage = config.auth?.storage ?? createLocalStorageTokenStorage();
-  const tokenManager = config.auth ? createTokenManager(
-    tokenStorage,
-    `${config.baseUrl.replace(TRAILING_SLASHES_REGEX2, "")}${config.auth.refreshUrl}`,
-    fetchFn,
-    config.auth.onRefreshFailed
-  ) : void 0;
-  if (config.auth?.onTokenRefreshed && tokenManager) {
-    tokenManager.onTokenRefreshed(config.auth.onTokenRefreshed);
-  }
-  const fetchClient = createFetchClient(config, tokenManager);
-  const call = createContractCaller(fetchClient);
+var DEFAULT_TIMEOUT = 3e4;
+var DEFAULT_CLIENT_NAME = "hai-api-client";
+var DEFAULT_REFRESH_PATH = IAM_AUTH_ROUTES.refresh;
+var TRAILING_SLASHES_REGEX = /\/+$/;
+var tokenStorage = {
+  /** 内存存储——SSR / Node 测试或一次性会话使用。 */
+  memory: createMemoryTokenStorage,
+  /** 浏览器 `localStorage` 存储——单页应用便捷选项；注意 XSS 风险。 */
+  localStorage: createLocalStorageTokenStorage,
+  /** httpOnly Cookie 存储——浏览器场景推荐方案。 */
+  httpOnlyCookie: createHttpOnlyCookieTokenStorage
+};
+function createApiClient(contract) {
+  const state = {
+    config: null,
+    rawClient: null,
+    tokenManager: void 0,
+    transport: void 0
+  };
   const auth = {
     async setTokens(tokens) {
-      if (tokenManager) {
-        await tokenManager.setTokens(tokens);
-      }
+      await state.tokenManager?.setTokens(tokens);
     },
     async clear() {
-      if (tokenManager) {
-        await tokenManager.clear();
-      }
+      await state.tokenManager?.clear();
     },
     onTokenRefreshed(callback) {
-      if (tokenManager) {
-        return tokenManager.onTokenRefreshed(callback);
-      }
-      return () => {
-      };
+      return state.tokenManager?.onTokenRefreshed(callback) ?? (() => {
+      });
     }
   };
-  return {
-    get: fetchClient.get,
-    post: fetchClient.post,
-    put: fetchClient.put,
-    patch: fetchClient.patch,
-    delete: fetchClient.delete,
-    upload: fetchClient.upload,
-    stream: fetchClient.stream,
-    call,
+  let initPromise = null;
+  const lifecycle = {
+    async init(config) {
+      if (initPromise)
+        return initPromise;
+      initPromise = (async () => {
+        try {
+          state.config = config;
+          state.transport = buildTransportSession(config);
+          state.tokenManager = buildTokenManager(config, state.transport);
+          state.rawClient = buildRawClient(contract, config, state.tokenManager, state.transport);
+          return ok(void 0);
+        } catch (error) {
+          return err(
+            HaiApiClientError.CONFIG_ERROR,
+            apiClientM("apiClient_configError", { params: { error: String(error) } }),
+            error
+          );
+        }
+      })();
+      try {
+        return await initPromise;
+      } finally {
+        initPromise = null;
+      }
+    },
+    async close() {
+      state.transport?.destroy();
+      state.config = null;
+      state.rawClient = null;
+      state.tokenManager = void 0;
+      state.transport = void 0;
+    },
+    get config() {
+      return state.config;
+    },
+    get isInitialized() {
+      return state.rawClient !== null;
+    },
     auth
   };
+  return new Proxy({}, {
+    get(_target, property) {
+      if (typeof property !== "string")
+        return void 0;
+      if (property in lifecycle) {
+        return Reflect.get(lifecycle, property);
+      }
+      return createProcedureProxy(state, [property]);
+    }
+    // 这里的返回值在运行时是一个 Proxy，但从“可用能力”上看，它符合 `ApiClient<TContract>`：
+    // - 一部分成员来自 lifecycle
+    // - 另一部分成员来自 contract 推导出的 procedure 层级
+    // 因此使用类型断言把这个动态对象声明为最终对外的 typed client。
+  });
 }
-var notInitialized = core.module.createNotInitializedKit(
-  HaiApiClientError.NOT_INITIALIZED,
-  () => apiClientM("apiClient_notInitialized")
-);
-var notInitializedOps = notInitialized.proxy();
-var notInitializedAuth = {
-  async setTokens() {
-    logger3.warn("api.auth.setTokens called before initialization, ignored");
-  },
-  async clear() {
-    logger3.warn("api.auth.clear called before initialization, ignored");
-  },
-  onTokenRefreshed() {
-    logger3.warn("api.auth.onTokenRefreshed called before initialization, ignored");
-    return () => {
-    };
+var defaultApiContract = apiContract.create({ iam: apiContract.iam, storage: apiContract.storage, ai: apiContract.ai });
+var apiClient = new Proxy(createApiClient(defaultApiContract), {
+  get(target, property, receiver) {
+    if (property === "create")
+      return createApiClient;
+    if (property === "tokenStorage")
+      return tokenStorage;
+    return Reflect.get(target, property, receiver);
   }
-};
-function notInitializedStreamFn(_path, _body, _options) {
-  return {
-    [Symbol.asyncIterator]() {
-      return {
-        async next() {
-          throw new Error(apiClientM("apiClient_notInitialized"));
-        }
-      };
+});
+function createProcedureProxy(state, path) {
+  return new Proxy(() => void 0, {
+    get(_t, property) {
+      if (typeof property !== "string")
+        return void 0;
+      return createProcedureProxy(state, [...path, property]);
+    },
+    apply(_t, _thisArg, args) {
+      return callProcedure(state.rawClient, path, args);
     }
-  };
+  });
 }
-var api = {
-  /**
-   * 初始化 API 客户端
-   *
-   * 如果当前已有活跃实例，会先自动 close 再重新初始化。
-   * 创建异常时返回 CONFIG_ERROR 错误。
-   *
-   * @param config 客户端配置（baseUrl、auth 等）
-   * @returns 成功时返回 ok(undefined)；失败时返回包含错误码和消息的 err。
-   */
-  async init(config) {
-    if (initInProgress) {
-      return err(
-        HaiApiClientError.CONFIG_ERROR,
-        apiClientM("apiClient_configError", { params: { error: "initialization already in progress" } })
-      );
-    }
-    initInProgress = true;
-    try {
-      if (currentClient) {
-        logger3.warn("Api-client module is already initialized, reinitializing");
-        await api.close();
-      }
-      logger3.info("Initializing api-client module");
-      currentClient = createClient(config);
-      currentConfig = config;
-      logger3.info("Api-client module initialized");
-      return ok(void 0);
-    } catch (error) {
-      logger3.error("Api-client module initialization failed", { error });
-      return err(
-        HaiApiClientError.CONFIG_ERROR,
-        apiClientM("apiClient_configError", { params: { error: error instanceof Error ? error.message : String(error) } }),
-        error
-      );
-    } finally {
-      initInProgress = false;
+async function callProcedure(rawClient, path, args) {
+  if (!rawClient) {
+    return err(HaiApiClientError.NOT_INITIALIZED, apiClientM("apiClient_notInitialized"));
+  }
+  let target = rawClient;
+  for (const segment of path) {
+    if ((typeof target !== "object" || target === null) && typeof target !== "function") {
+      return err(HaiApiClientError.UNKNOWN, apiClientM("apiClient_unknown"));
     }
-  },
-  /** GET 请求。未初始化时返回 NOT_INITIALIZED 错误 */
-  get get() {
-    return currentClient?.get ?? notInitializedOps.get;
-  },
-  /** POST 请求。未初始化时返回 NOT_INITIALIZED 错误 */
-  get post() {
-    return currentClient?.post ?? notInitializedOps.post;
-  },
-  /** PUT 请求。未初始化时返回 NOT_INITIALIZED 错误 */
-  get put() {
-    return currentClient?.put ?? notInitializedOps.put;
-  },
-  /** PATCH 请求。未初始化时返回 NOT_INITIALIZED 错误 */
-  get patch() {
-    return currentClient?.patch ?? notInitializedOps.patch;
-  },
-  /** DELETE 请求。未初始化时返回 NOT_INITIALIZED 错误 */
-  get delete() {
-    return currentClient?.delete ?? notInitializedOps.delete;
-  },
-  /** 文件上传。未初始化时返回 NOT_INITIALIZED 错误 */
-  get upload() {
-    return currentClient?.upload ?? notInitializedOps.upload;
-  },
-  /** 契约调用。未初始化时返回 NOT_INITIALIZED 错误 */
-  get call() {
-    return currentClient?.call ?? notInitializedOps.call;
-  },
-  /**
-   * 流式请求。未初始化时迭代抛出异常。
-   *
-   * @throws 未初始化时抛出 Error
-   */
-  get stream() {
-    return currentClient?.stream ?? notInitializedStreamFn;
-  },
-  /** Token 管理接口。未初始化时为空操作 */
-  get auth() {
-    return currentClient?.auth ?? notInitializedAuth;
-  },
-  /** 当前客户端配置；未初始化或已关闭时为 null */
-  get config() {
-    return currentConfig;
-  },
-  /** 是否已完成初始化 */
-  get isInitialized() {
-    return currentClient !== null;
-  },
-  /**
-   * 关闭 API 客户端并释放资源
-   *
-   * 关闭后所有 HTTP 操作将返回 NOT_INITIALIZED 错误。
-   * 重复调用不会报错。
-   */
-  async close() {
-    if (!currentClient) {
-      currentConfig = null;
-      return;
+    target = Reflect.get(target, segment);
+  }
+  if (typeof target !== "function") {
+    return err(HaiApiClientError.UNKNOWN, apiClientM("apiClient_unknown"));
+  }
+  try {
+    return await target(...args);
+  } catch (error) {
+    return mapClientError(error);
+  }
+}
+function buildTokenManager(config, transport) {
+  if (!config.auth)
+    return void 0;
+  const fetchFn = transport?.encryptedFetch ?? config.fetch ?? globalThis.fetch.bind(globalThis);
+  const storage = config.auth.storage ?? createHttpOnlyCookieTokenStorage();
+  const baseUrl = config.baseUrl.replace(TRAILING_SLASHES_REGEX, "");
+  const refreshPath = config.auth.refreshPath ?? DEFAULT_REFRESH_PATH;
+  const refreshUrl = `${baseUrl}${refreshPath.startsWith("/") ? refreshPath : `/${refreshPath}`}`;
+  const manager = createTokenManager(storage, refreshUrl, fetchFn, config.auth.onRefreshFailed, config.auth.refreshTimeoutMs);
+  if (config.auth.onTokenRefreshed) {
+    manager.onTokenRefreshed(config.auth.onTokenRefreshed);
+  }
+  return manager;
+}
+function buildTransportSession(config) {
+  if (!config.transport)
+    return void 0;
+  const baseFetch = config.fetch ?? globalThis.fetch.bind(globalThis);
+  const baseUrl = config.baseUrl.replace(TRAILING_SLASHES_REGEX, "");
+  const path = config.transport.keyExchangePath ?? "/_hai/key-exchange";
+  const keyExchangeUrl = `${baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
+  return config.transport.crypto.transport.createClient({ keyExchangeUrl, fetch: baseFetch });
+}
+function buildRawClient(contract, config, tokenManager, transport) {
+  const link = new OpenAPILink(contract, {
+    url: config.baseUrl,
+    headers: async () => buildHeaders(config, tokenManager),
+    fetch: async (request, init) => fetchWithRefresh(request, init, config, tokenManager, transport)
+  });
+  return createORPCClient(link);
+}
+async function buildHeaders(config, tokenManager) {
+  const configured = typeof config.headers === "function" ? await config.headers() : config.headers ?? {};
+  const accessToken = await tokenManager?.storage.getAccessToken();
+  return {
+    ...configured,
+    "x-request-client": config.clientName ?? DEFAULT_CLIENT_NAME,
+    ...accessToken ? { authorization: `Bearer ${accessToken}` } : {}
+  };
+}
+async function fetchWithRefresh(request, init, config, tokenManager, transport) {
+  const retryRequest = tokenManager ? request.clone() : void 0;
+  const response = await fetchWithTimeout(request, init, config, transport);
+  if (response.status !== 401 || !tokenManager || !retryRequest)
+    return response;
+  const tokens = await tokenManager.refresh();
+  if (!tokens)
+    return response;
+  const headers = new Headers(retryRequest.headers);
+  headers.set("authorization", `Bearer ${tokens.accessToken}`);
+  return fetchWithTimeout(new Request(retryRequest, { headers }), init, config, transport);
+}
+async function fetchWithTimeout(request, init, config, transport) {
+  const fetchFn = transport?.encryptedFetch ?? config.fetch ?? globalThis.fetch.bind(globalThis);
+  const timeout = config.timeout ?? DEFAULT_TIMEOUT;
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), timeout);
+  const userSignal = request.signal;
+  if (userSignal) {
+    if (userSignal.aborted) {
+      controller.abort();
+    } else {
+      userSignal.addEventListener("abort", () => controller.abort(), { once: true });
     }
-    logger3.info("Closing api-client module");
-    currentClient = null;
-    currentConfig = null;
-    logger3.info("Api-client module closed");
   }
-};
+  try {
+    return await fetchFn(new Request(request, { signal: controller.signal }), init);
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
+function mapClientError(error) {
+  if (error instanceof ORPCError) {
+    const detail = { orpcCode: error.code, status: error.status, data: error.data };
+    if (error.status === 401)
+      return err(HaiApiClientError.UNAUTHORIZED, error.message, detail);
+    if (error.status === 403)
+      return err(HaiApiClientError.FORBIDDEN, error.message, detail);
+    if (error.status === 404)
+      return err(HaiApiClientError.NOT_FOUND, error.message, detail);
+    return err(HaiApiClientError.SERVER_ERROR, error.message, detail);
+  }
+  if (error instanceof DOMException && error.name === "AbortError") {
+    return err(HaiApiClientError.TIMEOUT, apiClientM("apiClient_timeout"), error);
+  }
+  return err(HaiApiClientError.NETWORK_ERROR, apiClientM("apiClient_networkError"), error);
+}
 
-export { HaiApiClientError, api, createLocalStorageTokenStorage, createMemoryTokenStorage, defineEndpoint };
+export { HaiApiClientError, apiClient };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map