@h-ai/api-client 0.1.0-alpha.67 → 0.1.0-alpha.69

package/dist/index.js

@@ -1,5 +1,6 @@
 import { apiContract } from '@h-ai/api-contract';
 import { core, err, ok } from '@h-ai/core';
+import { TransportTimeError, TransportBodyTooLargeError } from '@h-ai/crypto';
 import { createORPCClient, ORPCError } from '@orpc/client';
 import { OpenAPILink } from '@orpc/openapi-client/fetch';
 import { z } from 'zod';
@@ -7,29 +8,6 @@ import { z } from 'zod';
 // src/api-client-main.ts
 var logger = core.logger.child({ module: "api-client", scope: "auth" });
 var HTTPONLY_COOKIE_SENTINEL = "__httponly_cookie__";
-var LS_ACCESS_KEY = "hai_access_token";
-var LS_REFRESH_KEY = "hai_refresh_token";
-function createLocalStorageTokenStorage() {
-  logger.warn("apiClient.tokenStorage.localStorage: storing tokens in localStorage exposes them to XSS. Prefer httpOnly cookies for production.");
-  return {
-    async getAccessToken() {
-      return globalThis.localStorage?.getItem(LS_ACCESS_KEY) ?? null;
-    },
-    async setAccessToken(token) {
-      globalThis.localStorage?.setItem(LS_ACCESS_KEY, token);
-    },
-    async getRefreshToken() {
-      return globalThis.localStorage?.getItem(LS_REFRESH_KEY) ?? null;
-    },
-    async setRefreshToken(token) {
-      globalThis.localStorage?.setItem(LS_REFRESH_KEY, token);
-    },
-    async clear() {
-      globalThis.localStorage?.removeItem(LS_ACCESS_KEY);
-      globalThis.localStorage?.removeItem(LS_REFRESH_KEY);
-    }
-  };
-}
 function createMemoryTokenStorage() {
   let accessToken = null;
   let refreshToken = null;
@@ -83,25 +61,61 @@ var RefreshTokenPayloadSchema = z.object({
 function createTokenManager(storage, refreshEndpointUrl, fetchFn, onRefreshFailed, refreshTimeoutMs = 1e4) {
   const callbacks = [];
   let refreshPromise = null;
+  let refreshController = null;
+  let generation = 0;
+  let storageMutation = Promise.resolve();
+  function mutateStorage(operation) {
+    const pending = storageMutation.then(operation);
+    storageMutation = pending.then(() => {
+    }, () => {
+    });
+    return pending;
+  }
+  function invalidateRefresh() {
+    const previousController = refreshController;
+    generation++;
+    refreshController = null;
+    refreshPromise = null;
+    return previousController;
+  }
+  async function failRefresh(refreshGeneration) {
+    await mutateStorage(async () => {
+      if (refreshGeneration !== generation)
+        return;
+      await storage.clear();
+      if (refreshGeneration === generation)
+        onRefreshFailed?.();
+    });
+  }
   async function refresh() {
     if (refreshPromise)
       return refreshPromise;
-    refreshPromise = doRefresh();
+    const controller = new AbortController();
+    const pending = doRefresh(generation, controller);
+    refreshController = controller;
+    refreshPromise = pending;
     try {
-      return await refreshPromise;
+      return await pending;
     } finally {
-      refreshPromise = null;
+      if (refreshPromise === pending) {
+        refreshPromise = null;
+        refreshController = null;
+      }
     }
   }
-  async function doRefresh() {
+  async function doRefresh(refreshGeneration, controller) {
+    await storageMutation;
+    if (refreshGeneration !== generation)
+      return null;
     const refreshToken = await storage.getRefreshToken();
+    if (refreshGeneration !== generation)
+      return null;
     if (!refreshToken) {
       logger.warn("Token refresh skipped, no refresh token available");
       onRefreshFailed?.();
       return null;
     }
     logger.debug("Refreshing token");
-    const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), refreshTimeoutMs);
     try {
       const useHttpOnlyCookie = refreshToken === HTTPONLY_COOKIE_SENTINEL;
@@ -115,27 +129,28 @@ function createTokenManager(storage, refreshEndpointUrl, fetchFn, onRefreshFaile
         requestInit.headers = { "Content-Type": "application/json" };
       }
       const response = await fetchFn(refreshEndpointUrl, requestInit);
+      if (refreshGeneration !== generation)
+        return null;
       if (!response.ok) {
         if (response.status >= 400 && response.status < 500) {
-          await storage.clear();
-          onRefreshFailed?.();
+          await failRefresh(refreshGeneration);
         } else {
           logger.warn("Token refresh transient failure, keeping tokens", { status: response.status });
         }
         return null;
       }
       const body = await response.json();
+      if (refreshGeneration !== generation)
+        return null;
       const parsed = RefreshTokenPayloadSchema.safeParse(readTokenPayload(body.data));
       if (!parsed.success) {
         logger.warn("Token refresh returned invalid data", { issues: parsed.error.issues });
-        await storage.clear();
-        onRefreshFailed?.();
+        await failRefresh(refreshGeneration);
         return null;
       }
       if (!useHttpOnlyCookie && !parsed.data.refreshToken) {
         logger.warn("Token refresh returned invalid data", { issues: [{ path: ["refreshToken"], message: "Required" }] });
-        await storage.clear();
-        onRefreshFailed?.();
+        await failRefresh(refreshGeneration);
         return null;
       }
       const refreshTokenForStorage = parsed.data.refreshToken ?? HTTPONLY_COOKIE_SENTINEL;
@@ -145,12 +160,27 @@ function createTokenManager(storage, refreshEndpointUrl, fetchFn, onRefreshFaile
         expiresIn: parsed.data.expiresIn ?? 3600,
         tokenType: "Bearer"
       };
-      await storage.setAccessToken(tokens.accessToken);
-      await storage.setRefreshToken(refreshTokenForStorage);
+      const committed = await mutateStorage(async () => {
+        if (refreshGeneration !== generation)
+          return false;
+        await storage.setAccessToken(tokens.accessToken);
+        if (refreshGeneration !== generation)
+          return false;
+        await storage.setRefreshToken(refreshTokenForStorage);
+        return refreshGeneration === generation;
+      });
+      if (!committed || refreshGeneration !== generation)
+        return null;
       logger.info("Token refreshed successfully");
-      for (const cb of callbacks) cb(tokens);
-      return tokens;
+      for (const cb of callbacks) {
+        if (refreshGeneration !== generation)
+          return null;
+        cb(tokens);
+      }
+      return refreshGeneration === generation ? tokens : null;
     } catch (error) {
+      if (refreshGeneration !== generation)
+        return null;
       logger.error("Token refresh failed (transient)", { error });
       return null;
     } finally {
@@ -161,12 +191,26 @@ function createTokenManager(storage, refreshEndpointUrl, fetchFn, onRefreshFaile
     storage,
     refresh,
     async setTokens(tokens) {
-      await storage.setAccessToken(tokens.accessToken);
-      if (tokens.refreshToken)
-        await storage.setRefreshToken(tokens.refreshToken);
+      const previousController = invalidateRefresh();
+      const mutationGeneration = generation;
+      const pending = mutateStorage(async () => {
+        if (mutationGeneration !== generation)
+          return;
+        await storage.clear();
+        if (mutationGeneration !== generation)
+          return;
+        await storage.setAccessToken(tokens.accessToken);
+        if (tokens.refreshToken && mutationGeneration === generation)
+          await storage.setRefreshToken(tokens.refreshToken);
+      });
+      previousController?.abort();
+      await pending;
     },
     async clear() {
-      await storage.clear();
+      const previousController = invalidateRefresh();
+      const pending = mutateStorage(() => storage.clear());
+      previousController?.abort();
+      await pending;
     },
     onTokenRefreshed(callback) {
       callbacks.push(callback);
@@ -202,6 +246,23 @@ var en_US_default = {
   apiClient_unknown: "Unknown error"
 };
 
+// messages/ja-JP.json
+var ja_JP_default = {
+  apiClient_networkError: "\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u30EA\u30AF\u30A8\u30B9\u30C8\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  apiClient_timeout: "\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30BF\u30A4\u30E0\u30A2\u30A6\u30C8\u3057\u307E\u3057\u305F",
+  apiClient_serverError: "\u30B5\u30FC\u30D0\u30FC\u30A8\u30E9\u30FC\uFF08{status}\uFF09",
+  apiClient_unauthorized: "\u8A8D\u8A3C\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002\u518D\u5EA6\u30ED\u30B0\u30A4\u30F3\u3057\u3066\u304F\u3060\u3055\u3044",
+  apiClient_forbidden: "\u30A2\u30AF\u30BB\u30B9\u304C\u62D2\u5426\u3055\u308C\u307E\u3057\u305F",
+  apiClient_notFound: "\u30EA\u30BD\u30FC\u30B9\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093",
+  apiClient_validationFailed: "\u30EA\u30AF\u30A8\u30B9\u30C8\u306E\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  apiClient_tokenRefreshFailed: "\u30C8\u30FC\u30AF\u30F3\u306E\u66F4\u65B0\u306B\u5931\u6557\u3057\u307E\u3057\u305F\u3002\u518D\u5EA6\u30ED\u30B0\u30A4\u30F3\u3057\u3066\u304F\u3060\u3055\u3044",
+  apiClient_notInitialized: "API\u30AF\u30E9\u30A4\u30A2\u30F3\u30C8\u304C\u521D\u671F\u5316\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002\u5148\u306BapiClient.init()\u3092\u547C\u3073\u51FA\u3057\u3066\u304F\u3060\u3055\u3044",
+  apiClient_alreadyInitialized: "API\u30AF\u30E9\u30A4\u30A2\u30F3\u30C8\u306F\u521D\u671F\u5316\u6E08\u307F\u3067\u3059\u3002init()\u306E\u524D\u306BapiClient.close()\u3092\u547C\u3073\u51FA\u3057\u3066\u304F\u3060\u3055\u3044",
+  apiClient_configError: "API\u30AF\u30E9\u30A4\u30A2\u30F3\u30C8\u306E\u8A2D\u5B9A\u30A8\u30E9\u30FC: {error}",
+  apiClient_responseValidationFailed: "\u30EC\u30B9\u30DD\u30F3\u30B9\u306E\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  apiClient_unknown: "\u4E0D\u660E\u306A\u30A8\u30E9\u30FC"
+};
+
 // messages/zh-CN.json
 var zh_CN_default = {
   apiClient_networkError: "\u7F51\u7EDC\u8BF7\u6C42\u5931\u8D25",
@@ -222,7 +283,8 @@ var zh_CN_default = {
 // src/api-client-i18n.ts
 var apiClientM = core.i18n.createMessageGetter({
   "zh-CN": zh_CN_default,
-  "en-US": en_US_default
+  "en-US": en_US_default,
+  "ja-JP": ja_JP_default
 });
 
 // src/api-client-iam.ts
@@ -235,7 +297,7 @@ function createIamAuthActions(client) {
   return {
     publicConfig: () => client.iam.auth.publicConfig(),
     login: async (input) => {
-      const result = input.method === "ldap" ? await client.iam.auth.loginWithLdap({ username: input.identifier, password: input.password }) : input.method === "email" || input.method === "sms" ? await client.iam.auth.loginWithOtp({ identifier: input.identifier, code: input.code ?? "" }) : await client.iam.auth.login({ identifier: input.identifier, password: input.password, rememberMe: input.rememberMe });
+      const result = input.method === "ldap" ? await client.iam.auth.loginWithLdap({ username: input.identifier, password: input.password }) : input.method === "email" || input.method === "sms" ? await client.iam.auth.loginWithOtp({ identifier: input.identifier, code: input.code ?? "" }) : await client.iam.auth.login({ identifier: input.identifier, password: input.password });
       return save(result);
     },
     register: async (input) => save(await client.iam.auth.register(input)),
@@ -253,6 +315,7 @@ var ApiClientErrorInfo = {
   NOT_FOUND: "006:404",
   VALIDATION_FAILED: "007:400",
   TOKEN_REFRESH_FAILED: "008:401",
+  PAYLOAD_TOO_LARGE: "020:413",
   NOT_INITIALIZED: "010:500",
   CONFIG_ERROR: "011:500",
   UNKNOWN: "099:500"
@@ -272,11 +335,10 @@ var AUTH_ENTRY_PATHS = [
   apiContract.pathOf(apiContract.iam.auth.register)
 ];
 var TRAILING_SLASHES_REGEX = /\/+$/;
+var REQUEST_OBSERVATION = /* @__PURE__ */ Symbol("hai.api-client.request-observation");
 var tokenStorage = {
   /** 内存存储——SSR / Node 测试或一次性会话使用。 */
   memory: createMemoryTokenStorage,
-  /** 浏览器 `localStorage` 存储——单页应用便捷选项；注意 XSS 风险。 */
-  localStorage: createLocalStorageTokenStorage,
   /** httpOnly Cookie 存储——浏览器场景推荐方案。 */
   httpOnlyCookie: createHttpOnlyCookieTokenStorage
 };
@@ -285,7 +347,8 @@ function createApiClient(contract) {
     config: null,
     rawClient: null,
     tokenManager: void 0,
-    transport: void 0
+    transport: void 0,
+    observers: /* @__PURE__ */ new Set()
   };
   const auth = {
     async setTokens(tokens) {
@@ -341,6 +404,7 @@ function createApiClient(contract) {
       }
     },
     async close() {
+      state.observers.clear();
       state.transport?.destroy();
       state.config = null;
       state.rawClient = null;
@@ -353,7 +417,13 @@ function createApiClient(contract) {
     get isInitialized() {
       return state.rawClient !== null;
     },
-    auth
+    auth,
+    observeRequests(observer) {
+      state.observers.add(observer);
+      return () => {
+        state.observers.delete(observer);
+      };
+    }
   };
   return new Proxy({}, {
     get(_target, property) {
@@ -390,10 +460,31 @@ function createProcedureProxy(state, path) {
       return createProcedureProxy(state, [...path, property]);
     },
     apply(_t, _thisArg, args) {
-      return callProcedure(state.rawClient, path, args);
+      return callObservedProcedure(state.rawClient, path, args, state.observers);
     }
   });
 }
+async function callObservedProcedure(rawClient, path, args, observers) {
+  const record = { requestId: core.context.get().requestId ?? core.id.uuid(), procedure: path.join("."), timestamp: Date.now(), duration: 0, success: false, attempts: 0 };
+  const provided = args[1] && typeof args[1] === "object" ? args[1] : {};
+  const providedContext = provided.context && typeof provided.context === "object" ? provided.context : {};
+  const options = { ...provided, context: { ...providedContext, [REQUEST_OBSERVATION]: record } };
+  const result = await callProcedure(rawClient, path, [args[0], options]);
+  record.duration = Math.max(0, Date.now() - record.timestamp);
+  record.success = !(result && typeof result === "object" && "success" in result && result.success === false);
+  if (result && typeof result === "object" && "error" in result && result.error && typeof result.error === "object" && "code" in result.error)
+    record.errorCode = String(result.error.code);
+  for (const observer of observers ?? []) {
+    try {
+      const observed = observer(Object.freeze({ ...record }));
+      if (observed instanceof Promise)
+        void observed.catch(() => {
+        });
+    } catch {
+    }
+  }
+  return result;
+}
 async function callProcedure(rawClient, path, args) {
   if (!rawClient) {
     return err(HaiApiClientError.NOT_INITIALIZED, apiClientM("apiClient_notInitialized"));
@@ -425,6 +516,8 @@ function buildTokenManager(config, transport) {
   const refreshFetch = async (input, init) => {
     const configured = typeof config.headers === "function" ? await config.headers() : config.headers ?? {};
     const headers = new Headers(configured);
+    if (!headers.has("accept-language"))
+      headers.set("accept-language", core.i18n.getGlobalLocale());
     headers.set("x-request-client", config.clientName ?? DEFAULT_CLIENT_NAME);
     new Headers(init?.headers).forEach((value, name) => headers.set(name, value));
     return fetchFn(input, { ...init, headers });
@@ -442,27 +535,50 @@ function buildTransportSession(config) {
   const baseUrl = config.baseUrl.replace(TRAILING_SLASHES_REGEX, "");
   const path = config.transport.keyExchangePath ?? "/_hai/key-exchange";
   const keyExchangeUrl = `${baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
-  return config.transport.crypto.transport.createClient({ keyExchangeUrl, fetch: baseFetch });
+  return config.transport.crypto.transport.createClient({ keyExchangeUrl, fetch: baseFetch, maxPlaintextBytes: config.transport.maxPlaintextBytes });
 }
 function buildRawClient(contract, config, tokenManager, transport) {
   const link = new OpenAPILink(contract, {
     url: config.baseUrl,
-    headers: async () => buildHeaders(config, tokenManager),
-    fetch: async (request, init) => fetchWithRefresh(request, init, config, tokenManager, transport)
+    headers: async (options) => buildHeaders(config, tokenManager, getObservation(options.context)?.requestId),
+    fetch: async (request, init, options) => {
+      const record = getObservation(options.context);
+      if (record) {
+        record.method = request.method;
+        const url = new URL(request.url);
+        url.search = "";
+        url.hash = "";
+        record.url = core.sanitize.sanitizeUrl(url.toString());
+      }
+      const response = await fetchWithRefresh(request, init, config, tokenManager, transport, record);
+      if (record)
+        record.status = response.status;
+      return response;
+    }
   });
   return createORPCClient(link);
 }
-async function buildHeaders(config, tokenManager) {
+function getObservation(context) {
+  const record = context[REQUEST_OBSERVATION];
+  return record && typeof record === "object" && "requestId" in record ? record : void 0;
+}
+async function buildHeaders(config, tokenManager, requestId) {
   const configured = typeof config.headers === "function" ? await config.headers() : config.headers ?? {};
+  const headers = new Headers(configured);
+  if (!headers.has("accept-language"))
+    headers.set("accept-language", core.i18n.getGlobalLocale());
   const accessToken = await tokenManager?.storage.getAccessToken();
   return {
-    ...configured,
+    ...Object.fromEntries(headers),
     "x-request-client": config.clientName ?? DEFAULT_CLIENT_NAME,
+    "x-request-id": requestId ?? core.context.get().requestId ?? core.id.uuid(),
     ...accessToken ? { authorization: `Bearer ${accessToken}` } : {}
   };
 }
-async function fetchWithRefresh(request, init, config, tokenManager, transport) {
+async function fetchWithRefresh(request, init, config, tokenManager, transport, observation) {
   const retryRequest = tokenManager ? request.clone() : void 0;
+  if (observation)
+    observation.attempts++;
   const response = await fetchWithTimeout(request, init, config, transport);
   if (!tokenManager || !retryRequest)
     return response;
@@ -478,6 +594,8 @@ async function fetchWithRefresh(request, init, config, tokenManager, transport)
     return response;
   const headers = new Headers(retryRequest.headers);
   headers.set("authorization", `Bearer ${tokens.accessToken}`);
+  if (observation)
+    observation.attempts++;
   return fetchWithTimeout(new Request(retryRequest, { headers }), init, config, transport);
 }
 async function isUnauthorizedResult(response) {
@@ -513,8 +631,18 @@ async function fetchWithTimeout(request, init, config, transport) {
   }
 }
 function mapClientError(error) {
+  const time = error instanceof TransportTimeError ? error : error instanceof Error && error.cause instanceof TransportTimeError ? error.cause : void 0;
+  if (time)
+    return err(HaiApiClientError.VALIDATION_FAILED, time.message, { transportCode: time.code });
+  const capacity = error instanceof TransportBodyTooLargeError ? error : error instanceof Error && error.cause instanceof TransportBodyTooLargeError ? error.cause : void 0;
+  if (capacity)
+    return err(HaiApiClientError.PAYLOAD_TOO_LARGE, capacity.message, { direction: capacity.direction, stage: capacity.stage, limitBytes: capacity.limitBytes, actualBytes: capacity.actualBytes });
   if (error instanceof ORPCError) {
     const detail = { orpcCode: error.code, status: error.status, data: error.data };
+    if (error.status === 413)
+      return err(HaiApiClientError.PAYLOAD_TOO_LARGE, error.message, detail);
+    if (error.status === 400 || error.status === 422)
+      return err(HaiApiClientError.VALIDATION_FAILED, error.message, detail);
     if (error.status === 401)
       return err(HaiApiClientError.UNAUTHORIZED, error.message, detail);
     if (error.status === 403)