@h-ai/api-client 0.1.0-alpha9 → 1.0.0-beta.1

package/dist/index.js

@@ -1,51 +1,245 @@
-import { core, ok, err } from '@h-ai/core';
+import { apiContract, IamSessionErrorCodeSchema, HaiErrorSchema } from '@h-ai/api-contract';
+import { core, err, ok } from '@h-ai/core';
+import { TransportTimeError, TransportBodyTooLargeError } from '@h-ai/crypto';
+import { createORPCClient, ORPCError } from '@orpc/client';
+import { OpenAPILink } from '@orpc/openapi-client/fetch';
 import { z } from 'zod';
 
-// src/api-client-auth.ts
-var LS_ACCESS_KEY = "hai_access_token";
-var LS_REFRESH_KEY = "hai_refresh_token";
-function createLocalStorageTokenStorage() {
+// src/api-client-main.ts
+var logger = core.logger.child({ module: "api-client", scope: "auth" });
+var HTTPONLY_COOKIE_SENTINEL = "__httponly_cookie__";
+function createMemoryTokenStorage() {
+  let accessToken = null;
+  let refreshToken = null;
   return {
     async getAccessToken() {
-      return globalThis.localStorage?.getItem(LS_ACCESS_KEY) ?? null;
+      return accessToken;
     },
     async setAccessToken(token) {
-      globalThis.localStorage?.setItem(LS_ACCESS_KEY, token);
+      accessToken = token;
     },
     async getRefreshToken() {
-      return globalThis.localStorage?.getItem(LS_REFRESH_KEY) ?? null;
+      return refreshToken;
     },
     async setRefreshToken(token) {
-      globalThis.localStorage?.setItem(LS_REFRESH_KEY, token);
+      refreshToken = token;
     },
     async clear() {
-      globalThis.localStorage?.removeItem(LS_ACCESS_KEY);
-      globalThis.localStorage?.removeItem(LS_REFRESH_KEY);
+      accessToken = null;
+      refreshToken = null;
     }
   };
 }
-function createMemoryTokenStorage() {
-  let accessToken = null;
-  let refreshToken = null;
+function createHttpOnlyCookieTokenStorage() {
+  let memoryAccessToken = null;
   return {
     async getAccessToken() {
-      return accessToken;
+      return memoryAccessToken;
     },
     async setAccessToken(token) {
-      accessToken = token;
+      memoryAccessToken = token;
     },
+    // refresh token 由服务端通过 Set-Cookie 设置为 httpOnly cookie；
+    // JS 不可见，返回哨兵值让 TokenManager 识别此模式。
     async getRefreshToken() {
-      return refreshToken;
+      return HTTPONLY_COOKIE_SENTINEL;
     },
-    async setRefreshToken(token) {
-      refreshToken = token;
+    // refresh token 由服务端管理，JS 端无法写入 httpOnly cookie，忽略此调用。
+    async setRefreshToken(_token) {
     },
     async clear() {
-      accessToken = null;
-      refreshToken = null;
+      memoryAccessToken = null;
+    }
+  };
+}
+var RefreshTokenPayloadSchema = z.object({
+  accessToken: z.string().min(1),
+  refreshToken: z.string().min(1).optional(),
+  expiresIn: z.number().optional(),
+  tokenType: z.string().optional()
+});
+function createTokenManager(storage, refreshEndpointUrl, fetchFn, onRefreshFailed, refreshTimeoutMs = 1e4) {
+  const callbacks = [];
+  let refreshPromise = null;
+  let refreshController = null;
+  let generation = 0;
+  let sessionInvalid = false;
+  let storageMutation = Promise.resolve();
+  function mutateStorage(operation) {
+    const pending = storageMutation.then(operation);
+    storageMutation = pending.then(() => {
+    }, () => {
+    });
+    return pending;
+  }
+  function invalidateRefresh() {
+    const previousController = refreshController;
+    generation++;
+    refreshController = null;
+    refreshPromise = null;
+    return previousController;
+  }
+  async function failRefresh(refreshGeneration) {
+    await mutateStorage(async () => {
+      if (refreshGeneration !== generation)
+        return;
+      await storage.clear();
+      if (refreshGeneration === generation) {
+        sessionInvalid = true;
+        onRefreshFailed?.();
+      }
+    });
+  }
+  async function refresh() {
+    if (refreshPromise)
+      return refreshPromise;
+    const controller = new AbortController();
+    const pending = doRefresh(generation, controller);
+    refreshController = controller;
+    refreshPromise = pending;
+    try {
+      return await pending;
+    } finally {
+      if (refreshPromise === pending) {
+        refreshPromise = null;
+        refreshController = null;
+      }
+    }
+  }
+  async function doRefresh(refreshGeneration, controller) {
+    await storageMutation;
+    if (refreshGeneration !== generation)
+      return null;
+    const refreshToken = await storage.getRefreshToken();
+    if (refreshGeneration !== generation)
+      return null;
+    if (!refreshToken) {
+      sessionInvalid = true;
+      logger.debug("Token refresh skipped, no refresh token available");
+      onRefreshFailed?.();
+      return null;
+    }
+    logger.debug("Refreshing token");
+    const timeoutId = setTimeout(() => controller.abort(), refreshTimeoutMs);
+    try {
+      const useHttpOnlyCookie = refreshToken === HTTPONLY_COOKIE_SENTINEL;
+      const requestInit = {
+        method: "POST",
+        body: useHttpOnlyCookie ? void 0 : JSON.stringify({ refreshToken }),
+        credentials: useHttpOnlyCookie ? "include" : "same-origin",
+        signal: controller.signal
+      };
+      if (!useHttpOnlyCookie) {
+        requestInit.headers = { "Content-Type": "application/json" };
+      }
+      const response = await fetchFn(refreshEndpointUrl, requestInit);
+      if (refreshGeneration !== generation)
+        return null;
+      if (!response.ok) {
+        if (response.status >= 400 && response.status < 500) {
+          await failRefresh(refreshGeneration);
+        } else {
+          logger.warn("Token refresh transient failure, keeping tokens", { status: response.status });
+        }
+        return null;
+      }
+      const body = await response.json();
+      if (refreshGeneration !== generation)
+        return null;
+      const parsed = RefreshTokenPayloadSchema.safeParse(readTokenPayload(body.data));
+      if (!parsed.success) {
+        logger.warn("Token refresh returned invalid data", { issues: parsed.error.issues });
+        await failRefresh(refreshGeneration);
+        return null;
+      }
+      if (!useHttpOnlyCookie && !parsed.data.refreshToken) {
+        logger.warn("Token refresh returned invalid data", { issues: [{ path: ["refreshToken"], message: "Required" }] });
+        await failRefresh(refreshGeneration);
+        return null;
+      }
+      const refreshTokenForStorage = parsed.data.refreshToken ?? HTTPONLY_COOKIE_SENTINEL;
+      const tokens = {
+        accessToken: parsed.data.accessToken,
+        refreshToken: refreshTokenForStorage,
+        expiresIn: parsed.data.expiresIn ?? 3600,
+        tokenType: "Bearer"
+      };
+      const committed = await mutateStorage(async () => {
+        if (refreshGeneration !== generation)
+          return false;
+        await storage.setAccessToken(tokens.accessToken);
+        if (refreshGeneration !== generation)
+          return false;
+        await storage.setRefreshToken(refreshTokenForStorage);
+        return refreshGeneration === generation;
+      });
+      if (!committed || refreshGeneration !== generation)
+        return null;
+      sessionInvalid = false;
+      logger.debug("Token refreshed successfully");
+      for (const cb of callbacks) {
+        if (refreshGeneration !== generation)
+          return null;
+        cb(tokens);
+      }
+      return refreshGeneration === generation ? tokens : null;
+    } catch (error) {
+      if (refreshGeneration !== generation)
+        return null;
+      logger.error("Token refresh failed (transient)", { error });
+      return null;
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+  return {
+    storage,
+    get generation() {
+      return generation;
+    },
+    get sessionInvalid() {
+      return sessionInvalid;
+    },
+    refresh,
+    async setTokens(tokens) {
+      const previousController = invalidateRefresh();
+      sessionInvalid = false;
+      const mutationGeneration = generation;
+      const pending = mutateStorage(async () => {
+        if (mutationGeneration !== generation)
+          return;
+        await storage.clear();
+        if (mutationGeneration !== generation)
+          return;
+        await storage.setAccessToken(tokens.accessToken);
+        if (tokens.refreshToken && mutationGeneration === generation)
+          await storage.setRefreshToken(tokens.refreshToken);
+      });
+      previousController?.abort();
+      await pending;
+    },
+    async clear() {
+      const previousController = invalidateRefresh();
+      const pending = mutateStorage(() => storage.clear());
+      previousController?.abort();
+      await pending;
+    },
+    onTokenRefreshed(callback) {
+      callbacks.push(callback);
+      return () => {
+        const idx = callbacks.indexOf(callback);
+        if (idx >= 0)
+          callbacks.splice(idx, 1);
+      };
     }
   };
 }
+function readTokenPayload(data) {
+  if (typeof data === "object" && data !== null && "tokens" in data) {
+    return data.tokens;
+  }
+  return data;
+}
 
 // messages/en-US.json
 var en_US_default = {
@@ -57,12 +251,30 @@ var en_US_default = {
   apiClient_notFound: "Resource not found",
   apiClient_validationFailed: "Request validation failed",
   apiClient_tokenRefreshFailed: "Token refresh failed, please log in again",
-  apiClient_notInitialized: "API client not initialized, please call api.init() first",
+  apiClient_notInitialized: "API client not initialized, please call apiClient.init() first",
+  apiClient_alreadyInitialized: "API client is already initialized; call apiClient.close() before init()",
   apiClient_configError: "API client config error: {error}",
   apiClient_responseValidationFailed: "Response validation failed",
   apiClient_unknown: "Unknown error"
 };
 
+// messages/ja-JP.json
+var ja_JP_default = {
+  apiClient_networkError: "\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u30EA\u30AF\u30A8\u30B9\u30C8\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  apiClient_timeout: "\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30BF\u30A4\u30E0\u30A2\u30A6\u30C8\u3057\u307E\u3057\u305F",
+  apiClient_serverError: "\u30B5\u30FC\u30D0\u30FC\u30A8\u30E9\u30FC\uFF08{status}\uFF09",
+  apiClient_unauthorized: "\u8A8D\u8A3C\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002\u518D\u5EA6\u30ED\u30B0\u30A4\u30F3\u3057\u3066\u304F\u3060\u3055\u3044",
+  apiClient_forbidden: "\u30A2\u30AF\u30BB\u30B9\u304C\u62D2\u5426\u3055\u308C\u307E\u3057\u305F",
+  apiClient_notFound: "\u30EA\u30BD\u30FC\u30B9\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093",
+  apiClient_validationFailed: "\u30EA\u30AF\u30A8\u30B9\u30C8\u306E\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  apiClient_tokenRefreshFailed: "\u30C8\u30FC\u30AF\u30F3\u306E\u66F4\u65B0\u306B\u5931\u6557\u3057\u307E\u3057\u305F\u3002\u518D\u5EA6\u30ED\u30B0\u30A4\u30F3\u3057\u3066\u304F\u3060\u3055\u3044",
+  apiClient_notInitialized: "API\u30AF\u30E9\u30A4\u30A2\u30F3\u30C8\u304C\u521D\u671F\u5316\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002\u5148\u306BapiClient.init()\u3092\u547C\u3073\u51FA\u3057\u3066\u304F\u3060\u3055\u3044",
+  apiClient_alreadyInitialized: "API\u30AF\u30E9\u30A4\u30A2\u30F3\u30C8\u306F\u521D\u671F\u5316\u6E08\u307F\u3067\u3059\u3002init()\u306E\u524D\u306BapiClient.close()\u3092\u547C\u3073\u51FA\u3057\u3066\u304F\u3060\u3055\u3044",
+  apiClient_configError: "API\u30AF\u30E9\u30A4\u30A2\u30F3\u30C8\u306E\u8A2D\u5B9A\u30A8\u30E9\u30FC: {error}",
+  apiClient_responseValidationFailed: "\u30EC\u30B9\u30DD\u30F3\u30B9\u306E\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  apiClient_unknown: "\u4E0D\u660E\u306A\u30A8\u30E9\u30FC"
+};
+
 // messages/zh-CN.json
 var zh_CN_default = {
   apiClient_networkError: "\u7F51\u7EDC\u8BF7\u6C42\u5931\u8D25",
@@ -73,7 +285,8 @@ var zh_CN_default = {
   apiClient_notFound: "\u8BF7\u6C42\u7684\u8D44\u6E90\u4E0D\u5B58\u5728",
   apiClient_validationFailed: "\u8BF7\u6C42\u53C2\u6570\u6821\u9A8C\u5931\u8D25",
   apiClient_tokenRefreshFailed: "Token\u5237\u65B0\u5931\u8D25\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55",
-  apiClient_notInitialized: "API \u5BA2\u6237\u7AEF\u672A\u521D\u59CB\u5316\uFF0C\u8BF7\u5148\u8C03\u7528 api.init()",
+  apiClient_notInitialized: "API \u5BA2\u6237\u7AEF\u672A\u521D\u59CB\u5316\uFF0C\u8BF7\u5148\u8C03\u7528 apiClient.init()",
+  apiClient_alreadyInitialized: "API \u5BA2\u6237\u7AEF\u5DF2\u521D\u59CB\u5316\uFF0C\u8BF7\u5148\u8C03\u7528 apiClient.close() \u518D\u91CD\u65B0\u521D\u59CB\u5316",
   apiClient_configError: "API \u5BA2\u6237\u7AEF\u914D\u7F6E\u9519\u8BEF\uFF1A{error}",
   apiClient_responseValidationFailed: "\u54CD\u5E94\u6570\u636E\u6821\u9A8C\u5931\u8D25",
   apiClient_unknown: "\u672A\u77E5\u9519\u8BEF"
@@ -82,8 +295,63 @@ var zh_CN_default = {
 // src/api-client-i18n.ts
 var apiClientM = core.i18n.createMessageGetter({
   "zh-CN": zh_CN_default,
-  "en-US": en_US_default
+  "en-US": en_US_default,
+  "ja-JP": ja_JP_default
 });
+var pageExitBindings = /* @__PURE__ */ new WeakMap();
+function clearIamPageExitBindings(auth) {
+  for (const stop of pageExitBindings.get(auth) ?? [])
+    stop();
+  pageExitBindings.delete(auth);
+}
+function createIamAuthActions(client) {
+  async function save(result) {
+    if (result.success)
+      await client.auth.setTokens(result.data.tokens);
+    return result;
+  }
+  return {
+    bindPageExit(options = {}) {
+      if (!options.enabled || typeof window === "undefined")
+        return () => {
+        };
+      const target = window;
+      let sent = false;
+      const onPageHide = (event) => {
+        if (event.persisted || sent)
+          return;
+        sent = true;
+        void client.iam.auth.closeSession({}, { context: { keepalive: true, autoRefresh: false } }).then((result) => {
+          if (!result.success)
+            core.logger.warn("Page exit session revocation failed", { errorCode: result.error.code });
+        }).catch(() => core.logger.warn("Page exit session request did not complete"));
+      };
+      target.addEventListener("pagehide", onPageHide);
+      const bindings = pageExitBindings.get(client.auth) ?? /* @__PURE__ */ new Set();
+      const stop = () => {
+        target.removeEventListener("pagehide", onPageHide);
+        bindings.delete(stop);
+        if (!bindings.size)
+          pageExitBindings.delete(client.auth);
+      };
+      bindings.add(stop);
+      pageExitBindings.set(client.auth, bindings);
+      return stop;
+    },
+    publicConfig: () => client.iam.auth.publicConfig(),
+    createCaptcha: (input) => client.iam.auth.createCaptcha(input),
+    login: async (input) => {
+      const result = input.method === "ldap" ? await client.iam.auth.loginWithLdap({ username: input.identifier, password: input.password, captcha: input.captcha, expectedUserId: input.expectedUserId }) : input.method === "email" || input.method === "sms" ? await client.iam.auth.loginWithOtp({ identifier: input.identifier, code: input.code ?? "", captcha: input.captcha, expectedUserId: input.expectedUserId }) : await client.iam.auth.login({ identifier: input.identifier, password: input.password, captcha: input.captcha, expectedUserId: input.expectedUserId });
+      return save(result);
+    },
+    register: async (input) => save(await client.iam.auth.register(input)),
+    sendOtp: (identifier, options) => client.iam.auth.sendOtp({ identifier, ...options }),
+    requestPasswordReset: (identifier, options) => client.iam.auth.requestPasswordReset({ identifier, ...options }),
+    confirmPasswordReset: (token, newPassword) => client.iam.auth.confirmPasswordReset({ token, newPassword }),
+    renewPassword: (input) => client.iam.auth.renewPassword(input),
+    reauthenticate: (password, operation) => client.iam.auth.reauthenticate({ password, operation })
+  };
+}
 var ApiClientErrorInfo = {
   NETWORK_ERROR: "001:502",
   TIMEOUT: "002:504",
@@ -93,656 +361,433 @@ var ApiClientErrorInfo = {
   NOT_FOUND: "006:404",
   VALIDATION_FAILED: "007:400",
   TOKEN_REFRESH_FAILED: "008:401",
+  PAYLOAD_TOO_LARGE: "020:413",
   NOT_INITIALIZED: "010:500",
   CONFIG_ERROR: "011:500",
   UNKNOWN: "099:500"
 };
 var HaiApiClientError = core.error.buildHaiErrorsDef("api-client", ApiClientErrorInfo);
-function defineEndpoint(def) {
-  return def;
-}
 
-// src/api-client-contract.ts
-function createContractCaller(fetchClient) {
-  async function call(endpoint, input) {
-    const parsed = endpoint.input.safeParse(input);
-    if (!parsed.success) {
-      return err(
-        HaiApiClientError.VALIDATION_FAILED,
-        apiClientM("apiClient_validationFailed"),
-        parsed.error.issues
-      );
+// src/api-client-main.ts
+var DEFAULT_TIMEOUT = 3e4;
+var DEFAULT_CLIENT_NAME = "hai-api-client";
+var DEFAULT_REFRESH_PATH = apiContract.pathOf(apiContract.iam.auth.refresh);
+var AUTH_ENTRY_PATHS = [
+  apiContract.pathOf(apiContract.iam.auth.login),
+  apiContract.pathOf(apiContract.iam.auth.loginWithOtp),
+  apiContract.pathOf(apiContract.iam.auth.loginWithLdap),
+  apiContract.pathOf(apiContract.iam.auth.requestPasswordReset),
+  apiContract.pathOf(apiContract.iam.auth.confirmPasswordReset),
+  apiContract.pathOf(apiContract.iam.auth.register)
+];
+var TRAILING_SLASHES_REGEX = /\/+$/;
+var REQUEST_OBSERVATION = /* @__PURE__ */ Symbol("hai.api-client.request-observation");
+var tokenStorage = {
+  /** 内存存储——SSR / Node 测试或一次性会话使用。 */
+  memory: createMemoryTokenStorage,
+  /** httpOnly Cookie 存储——浏览器场景推荐方案。 */
+  httpOnlyCookie: createHttpOnlyCookieTokenStorage
+};
+function createApiClient(contract) {
+  const state = {
+    config: null,
+    rawClient: null,
+    tokenManager: void 0,
+    transport: void 0,
+    observers: /* @__PURE__ */ new Set()
+  };
+  const auth = {
+    async setTokens(tokens) {
+      await state.tokenManager?.setTokens(tokens);
+    },
+    async clear() {
+      await state.tokenManager?.clear();
+    },
+    onTokenRefreshed(callback) {
+      return state.tokenManager?.onTokenRefreshed(callback) ?? (() => {
+      });
     }
-    const validInput = parsed.data;
-    let result;
-    switch (endpoint.method) {
-      case "GET":
-        result = await fetchClient.get(endpoint.path, validInput);
-        break;
-      case "POST":
-        result = await fetchClient.post(endpoint.path, validInput);
-        break;
-      case "PUT":
-        result = await fetchClient.put(endpoint.path, validInput);
-        break;
-      case "PATCH":
-        result = await fetchClient.patch(endpoint.path, validInput);
-        break;
-      case "DELETE":
-        result = await fetchClient.delete(endpoint.path, validInput);
-        break;
-      default:
+  };
+  let initPromise = null;
+  const lifecycle = {
+    async init(config) {
+      if (initPromise)
+        return initPromise;
+      if (state.rawClient) {
         return err(
-          HaiApiClientError.UNKNOWN,
-          apiClientM("apiClient_unknown")
+          HaiApiClientError.CONFIG_ERROR,
+          apiClientM("apiClient_alreadyInitialized")
         );
-    }
-    if (!result.success) {
-      return result;
-    }
-    const outputParsed = endpoint.output.safeParse(result.data);
-    if (!outputParsed.success) {
-      return err(
-        HaiApiClientError.VALIDATION_FAILED,
-        apiClientM("apiClient_responseValidationFailed"),
-        outputParsed.error.issues
-      );
-    }
-    return ok(outputParsed.data);
-  }
-  return call;
-}
-async function responseToError(response) {
-  let details;
-  try {
-    const body = await response.json();
-    details = body;
-  } catch {
-  }
-  const status = response.status;
-  if (status === 401) {
-    return err(
-      HaiApiClientError.UNAUTHORIZED,
-      apiClientM("apiClient_unauthorized"),
-      details
-    );
-  }
-  if (status === 403) {
-    return err(
-      HaiApiClientError.FORBIDDEN,
-      apiClientM("apiClient_forbidden"),
-      details
-    );
-  }
-  if (status === 404) {
-    return err(
-      HaiApiClientError.NOT_FOUND,
-      apiClientM("apiClient_notFound"),
-      details
-    );
-  }
-  if (status === 400 || status === 422) {
-    return err(
-      HaiApiClientError.VALIDATION_FAILED,
-      apiClientM("apiClient_validationFailed"),
-      details
-    );
-  }
-  if (status >= 500) {
-    return err(
-      HaiApiClientError.SERVER_ERROR,
-      apiClientM("apiClient_serverError", { params: { status: String(status) } }),
-      details
-    );
-  }
-  return err(
-    HaiApiClientError.UNKNOWN,
-    apiClientM("apiClient_unknown"),
-    details
-  );
-}
-function networkErrorToResult(cause) {
-  if (cause instanceof DOMException && cause.name === "AbortError") {
-    return err(
-      HaiApiClientError.TIMEOUT,
-      apiClientM("apiClient_timeout"),
-      cause
-    );
-  }
-  return err(
-    HaiApiClientError.NETWORK_ERROR,
-    apiClientM("apiClient_networkError"),
-    cause
-  );
-}
-
-// src/api-client-fetch.ts
-var logger = core.logger.child({ module: "api-client", scope: "fetch" });
-var DEFAULT_TIMEOUT = 3e4;
-function createFetchClient(config, tokenManager) {
-  const fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
-  const timeout = config.timeout ?? DEFAULT_TIMEOUT;
-  const requestInterceptors = config.interceptors?.request ?? [];
-  const responseInterceptors = config.interceptors?.response ?? [];
-  function buildUrl(path, params) {
-    const base = config.baseUrl.replace(/\/+$/, "");
-    const normalizedPath = path.startsWith("/") ? path : `/${path}`;
-    const url = new URL(`${base}${normalizedPath}`);
-    if (params) {
-      for (const [key, value] of Object.entries(params)) {
-        if (value !== void 0 && value !== null) {
-          url.searchParams.set(key, String(value));
-        }
-      }
-    }
-    return url.toString();
-  }
-  async function execute(requestConfig, retryOnUnauthorized = true) {
-    logger.trace("Executing request", { method: requestConfig.method, url: requestConfig.url });
-    if (tokenManager) {
-      const accessToken = await tokenManager.storage.getAccessToken();
-      if (accessToken) {
-        requestConfig.headers.Authorization = `Bearer ${accessToken}`;
-      }
-    }
-    let finalConfig = requestConfig;
-    for (const interceptor of requestInterceptors) {
-      finalConfig = await interceptor(finalConfig);
-    }
-    const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), timeout);
-    finalConfig.signal = controller.signal;
-    try {
-      let response = await fetchFn(finalConfig.url, {
-        method: finalConfig.method,
-        headers: finalConfig.headers,
-        body: finalConfig.body,
-        signal: finalConfig.signal
-      });
-      clearTimeout(timeoutId);
-      for (const interceptor of responseInterceptors) {
-        response = await interceptor(response);
       }
-      if (response.status === 401 && retryOnUnauthorized && tokenManager) {
-        logger.trace("Received 401, attempting token refresh", { url: requestConfig.url });
-        const tokens = await tokenManager.refresh();
-        if (tokens) {
-          logger.trace("Token refreshed, retrying request", { url: requestConfig.url });
-          requestConfig.headers.Authorization = `Bearer ${tokens.accessToken}`;
-          return execute(requestConfig, false);
+      initPromise = (async () => {
+        let nextTransport;
+        try {
+          nextTransport = buildTransportSession(config);
+          const nextTokenManager = buildTokenManager(config, nextTransport);
+          const nextRawClient = buildRawClient(contract, config, nextTokenManager, nextTransport);
+          state.config = config;
+          state.transport = nextTransport;
+          state.tokenManager = nextTokenManager;
+          state.rawClient = nextRawClient;
+          return ok(void 0);
+        } catch (error) {
+          nextTransport?.destroy();
+          state.config = null;
+          state.rawClient = null;
+          state.tokenManager = void 0;
+          state.transport = void 0;
+          return err(
+            HaiApiClientError.CONFIG_ERROR,
+            apiClientM("apiClient_configError", { params: { error: String(error) } }),
+            error
+          );
         }
-        logger.warn("Token refresh failed, returning 401 error", { url: requestConfig.url });
-      }
-      if (!response.ok) {
-        return responseToError(response);
-      }
-      const contentType = response.headers.get("content-type") ?? "";
-      if (contentType.includes("application/json")) {
-        const body = await response.json();
-        if (body && typeof body === "object" && "data" in body) {
-          return ok(body.data);
-        }
-        return ok(body);
+      })();
+      try {
+        return await initPromise;
+      } finally {
+        initPromise = null;
       }
-      return ok(void 0);
-    } catch (cause) {
-      clearTimeout(timeoutId);
-      logger.warn("Request failed", { url: requestConfig.url, error: cause });
-      return networkErrorToResult(cause);
+    },
+    async close() {
+      clearIamPageExitBindings(auth);
+      state.observers.clear();
+      state.transport?.destroy();
+      state.config = null;
+      state.rawClient = null;
+      state.tokenManager = void 0;
+      state.transport = void 0;
+    },
+    get config() {
+      return state.config ? core.sanitize.sanitizeSensitiveFields(state.config) : null;
+    },
+    get isInitialized() {
+      return state.rawClient !== null;
+    },
+    auth,
+    observeRequests(observer) {
+      state.observers.add(observer);
+      return () => {
+        state.observers.delete(observer);
+      };
     }
-  }
-  async function get(path, params) {
-    return execute({
-      url: buildUrl(path, params),
-      method: "GET",
-      headers: { Accept: "application/json" }
-    });
-  }
-  async function post(path, body) {
-    return execute({
-      url: buildUrl(path),
-      method: "POST",
-      headers: { "Content-Type": "application/json", "Accept": "application/json" },
-      body: body !== void 0 ? JSON.stringify(body) : void 0
-    });
-  }
-  async function put(path, body) {
-    return execute({
-      url: buildUrl(path),
-      method: "PUT",
-      headers: { "Content-Type": "application/json", "Accept": "application/json" },
-      body: body !== void 0 ? JSON.stringify(body) : void 0
-    });
-  }
-  async function patch(path, body) {
-    return execute({
-      url: buildUrl(path),
-      method: "PATCH",
-      headers: { "Content-Type": "application/json", "Accept": "application/json" },
-      body: body !== void 0 ? JSON.stringify(body) : void 0
-    });
-  }
-  async function del(path, params) {
-    return execute({
-      url: buildUrl(path, params),
-      method: "DELETE",
-      headers: { Accept: "application/json" }
-    });
-  }
-  async function upload(path, file, options) {
-    const formData = new FormData();
-    formData.append(options?.fieldName ?? "file", file);
-    if (options?.extraFields) {
-      for (const [key, value] of Object.entries(options.extraFields)) {
-        formData.append(key, value);
+  };
+  return new Proxy({}, {
+    get(_target, property) {
+      if (typeof property !== "string")
+        return void 0;
+      if (property in lifecycle) {
+        return Reflect.get(lifecycle, property);
       }
+      return createProcedureProxy(state, [property]);
     }
-    return execute({
-      url: buildUrl(path),
-      method: "POST",
-      headers: { Accept: "application/json" },
-      body: formData
-    });
+    // 这里的返回值在运行时是一个 Proxy，但从“可用能力”上看，它符合 `ApiClient<TContract>`：
+    // - 一部分成员来自 lifecycle
+    // - 另一部分成员来自 contract 推导出的 procedure 层级
+    // 因此使用类型断言把这个动态对象声明为最终对外的 typed client。
+  });
+}
+var defaultApiContract = apiContract.create({ iam: apiContract.iam, storage: apiContract.storage, ai: apiContract.ai });
+var apiClient = new Proxy(createApiClient(defaultApiContract), {
+  get(target, property, receiver) {
+    if (property === "create")
+      return createApiClient;
+    if (property === "tokenStorage")
+      return tokenStorage;
+    if (property === "createAuthActions")
+      return createIamAuthActions;
+    return Reflect.get(target, property, receiver);
   }
-  async function* stream(path, body, options) {
-    const requestConfig = {
-      url: buildUrl(path),
-      method: "POST",
-      headers: { "Content-Type": "application/json", "Accept": "text/event-stream" },
-      body: body !== void 0 ? JSON.stringify(body) : void 0
-    };
-    if (tokenManager) {
-      const accessToken = await tokenManager.storage.getAccessToken();
-      if (accessToken) {
-        requestConfig.headers.Authorization = `Bearer ${accessToken}`;
-      }
-    }
-    let finalConfig = requestConfig;
-    for (const interceptor of requestInterceptors) {
-      finalConfig = await interceptor(finalConfig);
-    }
-    const controller = new AbortController();
-    let timeoutId = null;
-    let timeoutTriggered = false;
-    const clearStreamTimeout = () => {
-      if (timeoutId) {
-        clearTimeout(timeoutId);
-        timeoutId = null;
-      }
-    };
-    const armStreamTimeout = () => {
-      clearStreamTimeout();
-      timeoutTriggered = false;
-      timeoutId = setTimeout(() => {
-        timeoutTriggered = true;
-        controller.abort();
-      }, timeout);
-    };
-    const externalSignal = options?.signal;
-    const onExternalAbort = () => {
-      controller.abort();
-    };
-    if (externalSignal) {
-      if (externalSignal.aborted) {
-        controller.abort();
-      } else {
-        externalSignal.addEventListener("abort", onExternalAbort, { once: true });
-      }
-    }
-    async function doStreamFetch() {
-      armStreamTimeout();
-      try {
-        return await fetchFn(finalConfig.url, {
-          method: finalConfig.method,
-          headers: finalConfig.headers,
-          body: finalConfig.body,
-          signal: controller.signal
-        });
-      } catch (cause) {
-        clearStreamTimeout();
-        throw cause;
-      }
+});
+function createProcedureProxy(state, path) {
+  return new Proxy(() => void 0, {
+    get(_t, property) {
+      if (typeof property !== "string")
+        return void 0;
+      return createProcedureProxy(state, [...path, property]);
+    },
+    apply(_t, _thisArg, args) {
+      return callObservedProcedure(state.rawClient, path, args, state.observers);
     }
-    let reader = null;
-    try {
-      let response = await doStreamFetch();
-      if (response.status === 401 && tokenManager) {
-        logger.info("Stream received 401, attempting token refresh", { url: requestConfig.url });
-        const tokens = await tokenManager.refresh();
-        if (tokens) {
-          finalConfig.headers.Authorization = `Bearer ${tokens.accessToken}`;
-          response = await doStreamFetch();
-        }
-      }
-      if (!response.ok) {
-        const errorResult = await responseToError(response);
-        if (!errorResult.success) {
-          throw new Error(errorResult.error.message, { cause: errorResult.error });
-        }
-      }
-      if (!response.body) {
-        throw new Error(apiClientM("apiClient_networkError"));
-      }
-      reader = response.body.getReader();
-      const decoder = new TextDecoder();
-      let lineBuffer = "";
-      while (true) {
-        armStreamTimeout();
-        const { done, value } = await reader.read();
-        clearStreamTimeout();
-        if (done)
-          break;
-        lineBuffer += decoder.decode(value, { stream: true });
-        const parts = lineBuffer.split("\n");
-        lineBuffer = parts.pop() ?? "";
-        for (const line of parts) {
-          if (line.startsWith("data: ")) {
-            const data = line.slice(6);
-            if (data !== "[DONE]") {
-              yield data;
-            }
-          }
-        }
-      }
-      if (lineBuffer.startsWith("data: ")) {
-        const data = lineBuffer.slice(6);
-        if (data !== "[DONE]") {
-          yield data;
-        }
-      }
-    } catch (cause) {
-      if (cause instanceof DOMException && cause.name === "AbortError") {
-        if (externalSignal?.aborted && !timeoutTriggered) {
-          throw cause;
+  });
+}
+async function callObservedProcedure(rawClient, path, args, observers) {
+  const record = { requestId: core.context.get().requestId ?? core.id.uuid(), procedure: path.join("."), timestamp: Date.now(), duration: 0, success: false, attempts: 0 };
+  const provided = args[1] && typeof args[1] === "object" ? args[1] : {};
+  const providedContext = provided.context && typeof provided.context === "object" ? provided.context : {};
+  const options = { ...provided, context: { ...providedContext, [REQUEST_OBSERVATION]: record } };
+  let result = await callProcedure(rawClient, path, [args[0], options]);
+  record.duration = Math.max(0, Date.now() - record.timestamp);
+  record.success = !(result && typeof result === "object" && "success" in result && result.success === false);
+  if (result && typeof result === "object" && "error" in result && result.error && typeof result.error === "object" && "code" in result.error) {
+    record.errorCode = String(result.error.code);
+    if ("message" in result.error && typeof result.error.message === "string") {
+      const error = result.error;
+      const receivedId = error.traceId && /^[\w.:-]{1,128}$/.test(error.traceId) ? error.traceId : record.requestId;
+      record.requestId = receivedId;
+      const safe = core.error.toPublic({ ...error, publicExt: error.ext }, receivedId);
+      if (error.cause && typeof error.cause === "object" && !Array.isArray(error.cause)) {
+        const metadata = {};
+        for (const key of ["orpcCode", "status", "transportCode", "direction", "stage", "limitBytes", "actualBytes"]) {
+          const value = Reflect.get(error.cause, key);
+          if (typeof value === "number" || typeof value === "string")
+            metadata[key] = core.sanitize.sanitizeSensitiveValue(value, key);
         }
-        throw new Error(apiClientM("apiClient_timeout"), { cause });
-      }
-      throw cause;
-    } finally {
-      clearStreamTimeout();
-      if (externalSignal) {
-        externalSignal.removeEventListener("abort", onExternalAbort);
-      }
-      if (reader) {
-        reader.releaseLock();
+        if (Object.keys(metadata).length)
+          safe.cause = metadata;
       }
+      core.logger.error("API request failed", { traceId: safe.traceId, requestId: record.requestId, procedure: record.procedure, status: record.status, error: result.error });
+      result = { ...result, error: safe };
     }
   }
-  return { get, post, put, patch, delete: del, upload, stream, execute, buildUrl };
-}
-var logger2 = core.logger.child({ module: "api-client", scope: "auth" });
-var TokenPairSchema = z.object({
-  accessToken: z.string().min(1),
-  refreshToken: z.string().min(1),
-  expiresIn: z.number().optional(),
-  tokenType: z.string().optional()
-});
-function createTokenManager(storage, refreshUrl, fetchFn, onRefreshFailed) {
-  const callbacks = [];
-  let refreshPromise = null;
-  async function refresh() {
-    if (refreshPromise) {
-      return refreshPromise;
-    }
-    refreshPromise = doRefresh();
+  for (const observer of observers ?? []) {
     try {
-      return await refreshPromise;
-    } finally {
-      refreshPromise = null;
+      const observed = observer(Object.freeze({ ...record }));
+      if (observed instanceof Promise)
+        void observed.catch(() => {
+        });
+    } catch {
     }
   }
-  async function doRefresh() {
-    const refreshToken = await storage.getRefreshToken();
-    if (!refreshToken) {
-      logger2.warn("Token refresh skipped, no refresh token available");
-      onRefreshFailed?.();
-      return null;
-    }
-    logger2.debug("Refreshing token", { url: refreshUrl });
-    try {
-      const response = await fetchFn(refreshUrl, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ refreshToken })
-      });
-      if (!response.ok) {
-        await storage.clear();
-        onRefreshFailed?.();
-        return null;
-      }
-      const body = await response.json();
-      const parsed = TokenPairSchema.safeParse(body.data);
-      if (!parsed.success) {
-        logger2.warn("Token refresh returned invalid data", { issues: parsed.error.issues });
-        await storage.clear();
-        onRefreshFailed?.();
-        return null;
-      }
-      const tokens = {
-        accessToken: parsed.data.accessToken,
-        refreshToken: parsed.data.refreshToken,
-        expiresIn: parsed.data.expiresIn ?? 3600,
-        tokenType: "Bearer"
-      };
-      await storage.setAccessToken(tokens.accessToken);
-      await storage.setRefreshToken(tokens.refreshToken);
-      logger2.info("Token refreshed successfully");
-      for (const cb of callbacks) {
-        cb(tokens);
-      }
-      return tokens;
-    } catch (error) {
-      logger2.error("Token refresh failed", { error });
-      await storage.clear();
-      onRefreshFailed?.();
-      return null;
-    }
+  return result;
+}
+async function callProcedure(rawClient, path, args) {
+  if (!rawClient) {
+    return err(HaiApiClientError.NOT_INITIALIZED, apiClientM("apiClient_notInitialized"));
   }
-  return {
-    storage,
-    refresh,
-    async setTokens(tokens) {
-      await storage.setAccessToken(tokens.accessToken);
-      await storage.setRefreshToken(tokens.refreshToken);
-    },
-    async clear() {
-      await storage.clear();
-    },
-    onTokenRefreshed(callback) {
-      callbacks.push(callback);
-      return () => {
-        const idx = callbacks.indexOf(callback);
-        if (idx >= 0)
-          callbacks.splice(idx, 1);
-      };
+  let target = rawClient;
+  for (const segment of path) {
+    if ((typeof target !== "object" || target === null) && typeof target !== "function") {
+      return err(HaiApiClientError.UNKNOWN, apiClientM("apiClient_unknown"));
     }
-  };
+    target = Reflect.get(target, segment);
+  }
+  if (typeof target !== "function") {
+    return err(HaiApiClientError.UNKNOWN, apiClientM("apiClient_unknown"));
+  }
+  try {
+    return await target(...args);
+  } catch (error) {
+    return mapClientError(error);
+  }
 }
-
-// src/api-client-main.ts
-var logger3 = core.logger.child({ module: "api-client", scope: "main" });
-var currentClient = null;
-var currentConfig = null;
-var initInProgress = false;
-function createClient(config) {
-  const fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
-  const tokenStorage = config.auth?.storage ?? createLocalStorageTokenStorage();
-  const tokenManager = config.auth ? createTokenManager(
-    tokenStorage,
-    `${config.baseUrl.replace(/\/+$/, "")}${config.auth.refreshUrl}`,
-    fetchFn,
-    config.auth.onRefreshFailed
-  ) : void 0;
-  if (config.auth?.onTokenRefreshed && tokenManager) {
-    tokenManager.onTokenRefreshed(config.auth.onTokenRefreshed);
+function buildTokenManager(config, transport) {
+  if (!config.auth)
+    return void 0;
+  const fetchFn = transport?.encryptedFetch ?? config.fetch ?? globalThis.fetch.bind(globalThis);
+  const storage = config.auth.storage ?? createHttpOnlyCookieTokenStorage();
+  const baseUrl = config.baseUrl.replace(TRAILING_SLASHES_REGEX, "");
+  const refreshPath = config.auth.refreshPath ?? DEFAULT_REFRESH_PATH;
+  const refreshUrl = `${baseUrl}${refreshPath.startsWith("/") ? refreshPath : `/${refreshPath}`}`;
+  const refreshFetch = async (input, init) => {
+    const configured = typeof config.headers === "function" ? await config.headers() : config.headers ?? {};
+    const headers = new Headers(configured);
+    if (!headers.has("accept-language"))
+      headers.set("accept-language", core.i18n.getGlobalLocale());
+    headers.set("x-request-client", config.clientName ?? DEFAULT_CLIENT_NAME);
+    new Headers(init?.headers).forEach((value, name) => headers.set(name, value));
+    return fetchFn(input, { ...init, headers });
+  };
+  const manager = createTokenManager(storage, refreshUrl, refreshFetch, config.auth.recoverSession ? void 0 : config.auth.onRefreshFailed, config.auth.refreshTimeoutMs);
+  if (config.auth.onTokenRefreshed) {
+    manager.onTokenRefreshed(config.auth.onTokenRefreshed);
   }
-  const fetchClient = createFetchClient(config, tokenManager);
-  const call = createContractCaller(fetchClient);
-  const auth = {
-    async setTokens(tokens) {
-      if (tokenManager) {
-        await tokenManager.setTokens(tokens);
-      }
+  return manager;
+}
+function buildTransportSession(config) {
+  if (!config.transport)
+    return void 0;
+  const baseFetch = config.fetch ?? globalThis.fetch.bind(globalThis);
+  const baseUrl = config.baseUrl.replace(TRAILING_SLASHES_REGEX, "");
+  const path = config.transport.keyExchangePath ?? "/_hai/key-exchange";
+  const keyExchangeUrl = `${baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
+  return config.transport.crypto.transport.createClient({ keyExchangeUrl, fetch: baseFetch, maxPlaintextBytes: config.transport.maxPlaintextBytes });
+}
+function buildRawClient(contract, config, tokenManager, transport) {
+  const link = new OpenAPILink(contract, {
+    url: config.baseUrl,
+    headers: async (options) => {
+      const headers = await buildHeaders(config, tokenManager, getObservation(options.context)?.requestId);
+      if (typeof options.context.reauthentication === "string")
+        headers["x-hai-reauthentication"] = options.context.reauthentication;
+      return headers;
     },
-    async clear() {
-      if (tokenManager) {
-        await tokenManager.clear();
+    fetch: async (request, init, options) => {
+      const record = getObservation(options.context);
+      if (record) {
+        record.method = request.method;
+        const url = new URL(request.url);
+        url.search = "";
+        url.hash = "";
+        record.url = core.sanitize.sanitizeUrl(url.toString());
       }
-    },
-    onTokenRefreshed(callback) {
-      if (tokenManager) {
-        return tokenManager.onTokenRefreshed(callback);
+      const requestInit = options.context.keepalive === true ? { ...init, keepalive: true } : init;
+      const confirm = options.context.reauthorize;
+      const reauthorize = typeof confirm === "function" ? async () => {
+        const value = await confirm();
+        return typeof value === "string" || value === void 0 ? value : null;
+      } : void 0;
+      const response = await fetchWithRefresh(request, requestInit, config, options.context.autoRefresh === false ? void 0 : tokenManager, transport, record, reauthorize);
+      if (record) {
+        record.status = response.status;
+        const traceId = response.headers.get("x-trace-id") ?? response.headers.get("x-request-id");
+        if (traceId && /^[\w.:-]{1,128}$/.test(traceId))
+          record.requestId = traceId;
       }
-      return () => {
-      };
+      return response;
     }
-  };
+  });
+  return createORPCClient(link);
+}
+function getObservation(context) {
+  const record = context[REQUEST_OBSERVATION];
+  return record && typeof record === "object" && "requestId" in record ? record : void 0;
+}
+async function buildHeaders(config, tokenManager, requestId) {
+  const configured = typeof config.headers === "function" ? await config.headers() : config.headers ?? {};
+  const headers = new Headers(configured);
+  headers.set("x-hai-terminal", config.auth?.terminalType ?? "web");
+  if (!headers.has("accept-language"))
+    headers.set("accept-language", core.i18n.getGlobalLocale());
+  const accessToken = await tokenManager?.storage.getAccessToken();
   return {
-    get: fetchClient.get,
-    post: fetchClient.post,
-    put: fetchClient.put,
-    patch: fetchClient.patch,
-    delete: fetchClient.delete,
-    upload: fetchClient.upload,
-    stream: fetchClient.stream,
-    call,
-    auth
+    ...Object.fromEntries(headers),
+    "x-request-client": config.clientName ?? DEFAULT_CLIENT_NAME,
+    "x-request-id": requestId ?? core.context.get().requestId ?? core.id.uuid(),
+    ...accessToken ? { authorization: `Bearer ${accessToken}` } : {}
   };
 }
-var notInitialized = core.module.createNotInitializedKit(
-  HaiApiClientError.NOT_INITIALIZED,
-  () => apiClientM("apiClient_notInitialized")
-);
-var notInitializedOps = notInitialized.proxy();
-var notInitializedAuth = {
-  async setTokens() {
-    logger3.warn("api.auth.setTokens called before initialization, ignored");
-  },
-  async clear() {
-    logger3.warn("api.auth.clear called before initialization, ignored");
-  },
-  onTokenRefreshed() {
-    logger3.warn("api.auth.onTokenRefreshed called before initialization, ignored");
-    return () => {
-    };
+async function fetchWithRefresh(request, init, config, tokenManager, transport, observation, reauthorize) {
+  const retryRequest = tokenManager || reauthorize ? request.clone() : void 0;
+  const identityGeneration = tokenManager?.generation;
+  if (observation)
+    observation.attempts++;
+  const response = await fetchWithTimeout(request, init, config, transport);
+  if (!retryRequest)
+    return response;
+  async function retryAuthorized(accessToken2) {
+    if (!retryRequest || retryRequest.signal.aborted)
+      return response;
+    const generation = tokenManager?.generation;
+    const headers = new Headers(retryRequest.headers);
+    if (headers.has("x-hai-reauthentication") || reauthorize) {
+      if (!reauthorize)
+        return response;
+      const ticket = await reauthorize();
+      if (ticket === null || retryRequest.signal.aborted || tokenManager?.generation !== generation)
+        return response;
+      headers.delete("x-hai-reauthentication");
+      if (ticket)
+        headers.set("x-hai-reauthentication", ticket);
+    }
+    const currentToken = accessToken2 ?? await tokenManager?.storage.getAccessToken();
+    if (tokenManager?.generation !== generation)
+      return response;
+    if (currentToken)
+      headers.set("authorization", `Bearer ${currentToken}`);
+    if (observation)
+      observation.attempts++;
+    return fetchWithTimeout(new Request(retryRequest, { headers }), init, config, transport);
   }
-};
-function notInitializedStreamFn(_path, _body, _options) {
-  return {
-    [Symbol.asyncIterator]() {
-      return {
-        async next() {
-          throw new Error(apiClientM("apiClient_notInitialized"));
-        }
-      };
+  const baseUrl = config.baseUrl.replace(TRAILING_SLASHES_REGEX, "");
+  const refreshPath = config.auth?.refreshPath ?? DEFAULT_REFRESH_PATH;
+  const excludedPaths = [...AUTH_ENTRY_PATHS, refreshPath];
+  if (excludedPaths.some((path) => new URL(`${baseUrl}${path.startsWith("/") ? path : `/${path}`}`).pathname === new URL(request.url).pathname))
+    return response;
+  const failure = response.status === 401 || response.headers.get("content-type")?.includes("application/json") ? await response.clone().json().catch(() => void 0) : void 0;
+  const code = failure && typeof failure === "object" && "success" in failure && failure.success === false && "error" in failure && failure.error && typeof failure.error === "object" && "code" in failure.error ? failure.error.code : void 0;
+  if (code === "hai:iam:027" && reauthorize)
+    return retryAuthorized();
+  if (!tokenManager)
+    return response;
+  if (response.status !== 401 && !await isUnauthorizedResult(response))
+    return response;
+  if (failure && typeof failure === "object" && "error" in failure && failure.error && typeof failure.error === "object" && "code" in failure.error && typeof failure.error.code === "string" && failure.error.code.startsWith("hai:iam:") && !IamSessionErrorCodeSchema.safeParse(failure.error.code).success) {
+    return response;
+  }
+  if (tokenManager.generation !== identityGeneration)
+    return response;
+  const tokens = await tokenManager.refresh();
+  if (tokenManager.generation !== identityGeneration)
+    return response;
+  let accessToken = tokens?.accessToken;
+  if (!accessToken && config.auth?.recoverSession && tokenManager.sessionInvalid) {
+    if (await config.auth.recoverSession()) {
+      const restoredGeneration = tokenManager.generation;
+      accessToken = await tokenManager.storage.getAccessToken() ?? void 0;
+      if (tokenManager.generation !== restoredGeneration)
+        return response;
     }
-  };
+  }
+  if (!accessToken)
+    return response;
+  return retryAuthorized(accessToken);
 }
-var api = {
-  /**
-   * 初始化 API 客户端
-   *
-   * 如果当前已有活跃实例，会先自动 close 再重新初始化。
-   * 创建异常时返回 CONFIG_ERROR 错误。
-   *
-   * @param config 客户端配置（baseUrl、auth 等）
-   * @returns 成功时返回 ok(undefined)；失败时返回包含错误码和消息的 err。
-   */
-  async init(config) {
-    if (initInProgress) {
-      return err(
-        HaiApiClientError.CONFIG_ERROR,
-        apiClientM("apiClient_configError", { params: { error: "initialization already in progress" } })
-      );
+async function isUnauthorizedResult(response) {
+  if (response.status !== 200 || !response.headers.get("content-type")?.includes("application/json"))
+    return false;
+  try {
+    const body = await response.clone().json();
+    if (!body || typeof body !== "object" || !("success" in body) || body.success !== false || !("error" in body) || !body.error || typeof body.error !== "object") {
+      return false;
     }
-    initInProgress = true;
-    try {
-      if (currentClient) {
-        logger3.warn("Api-client module is already initialized, reinitializing");
-        await api.close();
-      }
-      logger3.info("Initializing api-client module");
-      currentClient = createClient(config);
-      currentConfig = config;
-      logger3.info("Api-client module initialized");
-      return ok(void 0);
-    } catch (error) {
-      logger3.error("Api-client module initialization failed", { error });
-      return err(
-        HaiApiClientError.CONFIG_ERROR,
-        apiClientM("apiClient_configError", { params: { error: error instanceof Error ? error.message : String(error) } }),
-        error
-      );
-    } finally {
-      initInProgress = false;
+    return "httpStatus" in body.error && body.error.httpStatus === 401 && "code" in body.error && typeof body.error.code === "string" && "message" in body.error && typeof body.error.message === "string";
+  } catch {
+    return false;
+  }
+}
+async function fetchWithTimeout(request, init, config, transport) {
+  const fetchFn = transport?.encryptedFetch ?? config.fetch ?? globalThis.fetch.bind(globalThis);
+  const timeout = config.timeout ?? DEFAULT_TIMEOUT;
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), timeout);
+  const userSignal = request.signal;
+  if (userSignal) {
+    if (userSignal.aborted) {
+      controller.abort();
+    } else {
+      userSignal.addEventListener("abort", () => controller.abort(), { once: true });
     }
-  },
-  /** GET 请求。未初始化时返回 NOT_INITIALIZED 错误 */
-  get get() {
-    return currentClient?.get ?? notInitializedOps.get;
-  },
-  /** POST 请求。未初始化时返回 NOT_INITIALIZED 错误 */
-  get post() {
-    return currentClient?.post ?? notInitializedOps.post;
-  },
-  /** PUT 请求。未初始化时返回 NOT_INITIALIZED 错误 */
-  get put() {
-    return currentClient?.put ?? notInitializedOps.put;
-  },
-  /** PATCH 请求。未初始化时返回 NOT_INITIALIZED 错误 */
-  get patch() {
-    return currentClient?.patch ?? notInitializedOps.patch;
-  },
-  /** DELETE 请求。未初始化时返回 NOT_INITIALIZED 错误 */
-  get delete() {
-    return currentClient?.delete ?? notInitializedOps.delete;
-  },
-  /** 文件上传。未初始化时返回 NOT_INITIALIZED 错误 */
-  get upload() {
-    return currentClient?.upload ?? notInitializedOps.upload;
-  },
-  /** 契约调用。未初始化时返回 NOT_INITIALIZED 错误 */
-  get call() {
-    return currentClient?.call ?? notInitializedOps.call;
-  },
-  /**
-   * 流式请求。未初始化时迭代抛出异常。
-   *
-   * @throws 未初始化时抛出 Error
-   */
-  get stream() {
-    return currentClient?.stream ?? notInitializedStreamFn;
-  },
-  /** Token 管理接口。未初始化时为空操作 */
-  get auth() {
-    return currentClient?.auth ?? notInitializedAuth;
-  },
-  /** 当前客户端配置；未初始化或已关闭时为 null */
-  get config() {
-    return currentConfig;
-  },
-  /** 是否已完成初始化 */
-  get isInitialized() {
-    return currentClient !== null;
-  },
-  /**
-   * 关闭 API 客户端并释放资源
-   *
-   * 关闭后所有 HTTP 操作将返回 NOT_INITIALIZED 错误。
-   * 重复调用不会报错。
-   */
-  async close() {
-    if (!currentClient) {
-      currentConfig = null;
-      return;
+  }
+  try {
+    return await fetchFn(new Request(request, { signal: controller.signal }), init);
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
+function mapClientError(error) {
+  const time = error instanceof TransportTimeError ? error : error instanceof Error && error.cause instanceof TransportTimeError ? error.cause : void 0;
+  if (time)
+    return err(HaiApiClientError.VALIDATION_FAILED, time.message, { transportCode: time.code });
+  const capacity = error instanceof TransportBodyTooLargeError ? error : error instanceof Error && error.cause instanceof TransportBodyTooLargeError ? error.cause : void 0;
+  if (capacity)
+    return err(HaiApiClientError.PAYLOAD_TOO_LARGE, capacity.message, { direction: capacity.direction, stage: capacity.stage, limitBytes: capacity.limitBytes, actualBytes: capacity.actualBytes });
+  if (error instanceof ORPCError) {
+    const body = error.data && typeof error.data === "object" && "body" in error.data ? error.data.body : void 0;
+    if (body && typeof body === "object" && "success" in body && body.success === false && "error" in body) {
+      const parsed = HaiErrorSchema.safeParse(body.error);
+      if (parsed.success)
+        return err({ ...parsed.data, httpStatus: error.status });
     }
-    logger3.info("Closing api-client module");
-    currentClient = null;
-    currentConfig = null;
-    logger3.info("Api-client module closed");
+    const detail = { orpcCode: error.code, status: error.status, data: error.data };
+    if (error.status === 413)
+      return err(HaiApiClientError.PAYLOAD_TOO_LARGE, error.message, detail);
+    if (error.status === 400 || error.status === 422)
+      return err(HaiApiClientError.VALIDATION_FAILED, error.message, detail);
+    if (error.status === 401)
+      return err(HaiApiClientError.UNAUTHORIZED, error.message, detail);
+    if (error.status === 403)
+      return err(HaiApiClientError.FORBIDDEN, error.message, detail);
+    if (error.status === 404)
+      return err(HaiApiClientError.NOT_FOUND, error.message, detail);
+    return err(HaiApiClientError.SERVER_ERROR, error.message, detail);
   }
-};
+  if (error instanceof DOMException && error.name === "AbortError") {
+    return err(HaiApiClientError.TIMEOUT, apiClientM("apiClient_timeout"), error);
+  }
+  return err(HaiApiClientError.NETWORK_ERROR, apiClientM("apiClient_networkError"), error);
+}
 
-export { HaiApiClientError, api, createLocalStorageTokenStorage, createMemoryTokenStorage, defineEndpoint };
+export { HaiApiClientError, apiClient };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map