@itm-studio/partner-sdk 0.4.1 → 0.5.0

package/dist/index.mjs

@@ -5380,24 +5380,46 @@ assertNodeServerRuntime();
 var DEFAULT_API_URL = "https://itm-backend-production.up.railway.app/graphql";
 var RESERVED_AGENT_HEADERS = /* @__PURE__ */ new Set([
   "authorization",
+  "x-itm-integration-access-token",
   "x-itm-agent-session-id",
   "x-itm-agent-bootstrap-token",
   "x-itm-agent-access-token",
   "x-partner-api-key"
 ]);
 function createITMPartnerClient(config) {
-  const { baseUrl, headers: extraHeaders } = config;
+  const { baseUrl, headers: extraHeaders, signal } = config;
   const token = "token" in config ? config.token : void 0;
   const agentSession = "agentSession" in config ? config.agentSession : void 0;
   const agentAccess = "agentAccess" in config ? config.agentAccess : void 0;
-  const providedModes = [token, agentSession, agentAccess].filter(
+  const integration = "integration" in config ? config.integration : void 0;
+  const providedModes = [token, agentSession, agentAccess, integration].filter(
     (mode) => mode !== void 0
   );
   if (providedModes.length > 1) {
     throw new Error(
-      "ITM Partner SDK: provide exactly one of token, agentSession, or agentAccess authentication."
+      "ITM Partner SDK: provide exactly one of token, agentSession, agentAccess, or integration authentication."
     );
   }
+  if (integration !== void 0) {
+    if (typeof integration.accessToken !== "function" && (typeof integration.accessToken !== "string" || !integration.accessToken.trim())) {
+      throw new Error("ITM Partner SDK: integration.accessToken is required.");
+    }
+    return createSafeClient({
+      url: baseUrl ?? DEFAULT_API_URL,
+      signal,
+      headers: async () => {
+        const extra = typeof extraHeaders === "function" ? await extraHeaders() : extraHeaders;
+        let credential;
+        try {
+          credential = typeof integration.accessToken === "function" ? await integration.accessToken() : integration.accessToken;
+        } catch {
+          throw new Error("ITM Partner SDK: integration credential is unavailable.");
+        }
+        if (typeof credential !== "string" || !credential.trim()) throw new Error("ITM Partner SDK: integration credential is unavailable.");
+        return { ...sanitizeHeaders(extra), "x-itm-integration-access-token": credential, "Content-Type": "application/json" };
+      }
+    });
+  }
   if (agentAccess !== void 0) {
     if (typeof agentAccess.workloadToken !== "function") {
       throw new Error(
@@ -5407,8 +5429,9 @@ function createITMPartnerClient(config) {
     if (!agentAccess.accessToken) {
       throw new Error("ITM Partner SDK: agentAccess.accessToken is required.");
     }
-    return createClient2({
+    return createSafeClient({
       url: baseUrl ?? DEFAULT_API_URL,
+      signal,
       headers: async () => {
         const resolvedExtraHeaders = typeof extraHeaders === "function" ? await extraHeaders() : extraHeaders;
         const sanitizedExtraHeaders = Object.fromEntries(
@@ -5440,8 +5463,9 @@ function createITMPartnerClient(config) {
     if (!agentSession.sessionUid) {
       throw new Error("ITM Partner SDK: agentSession.sessionUid is required.");
     }
-    return createClient2({
+    return createSafeClient({
       url: baseUrl ?? DEFAULT_API_URL,
+      signal,
       headers: async () => {
         const resolvedExtraHeaders = typeof extraHeaders === "function" ? await extraHeaders() : extraHeaders;
         const sanitizedExtraHeaders = Object.fromEntries(
@@ -5470,19 +5494,77 @@ function createITMPartnerClient(config) {
       "ITM Partner SDK: token is required. Get one from backstage: Settings > Partner API."
     );
   }
-  return createClient2({
+  return createSafeClient({
     url: baseUrl ?? DEFAULT_API_URL,
+    signal,
     headers: async () => {
       const resolvedExtraHeaders = typeof extraHeaders === "function" ? await extraHeaders() : extraHeaders;
       return {
-        ...resolvedExtraHeaders ?? {},
+        ...sanitizeHeaders(resolvedExtraHeaders),
         "x-partner-api-key": token,
         "Content-Type": "application/json"
       };
     }
   });
 }
+function sanitizeHeaders(headers) {
+  return Object.fromEntries(Object.entries(headers ?? {}).filter(([name]) => !RESERVED_AGENT_HEADERS.has(name.toLowerCase())));
+}
+var ITMPartnerTransportError = class extends Error {
+  constructor(status, requestId) {
+    super(status ? `ITM Partner API request failed (HTTP ${status}).` : "ITM Partner API request failed.");
+    this.status = status;
+    this.requestId = requestId;
+  }
+  name = "ITMPartnerTransportError";
+};
+function createSafeClient(options) {
+  return createClient2({ fetcher: async (operation) => {
+    options.signal?.throwIfAborted();
+    const headers = await withCancellation(options.headers, options.signal);
+    options.signal?.throwIfAborted();
+    let response;
+    try {
+      response = await fetch(options.url, { method: "POST", headers, body: JSON.stringify(operation), signal: options.signal, redirect: "error" });
+    } catch {
+      options.signal?.throwIfAborted();
+      throw new ITMPartnerTransportError(void 0);
+    }
+    if (!response.ok) throw new ITMPartnerTransportError(response.status, response.headers.get("x-request-id") ?? void 0);
+    let value;
+    try {
+      value = await response.json();
+    } catch {
+      options.signal?.throwIfAborted();
+      throw new ITMPartnerTransportError(response.status);
+    }
+    if (!value || typeof value !== "object" || !("data" in value || "errors" in value)) throw new ITMPartnerTransportError(response.status);
+    const result = value;
+    const secrets = Object.entries(headers).filter(([key]) => RESERVED_AGENT_HEADERS.has(key.toLowerCase())).flatMap(([, v]) => [v, v.replace(/^Bearer /i, "")]).filter(Boolean);
+    const redact = (message) => secrets.reduce((text, secret) => text.split(secret).join("[redacted]"), message);
+    if (result.errors) result.errors = result.errors.map((error) => ({ name: "GraphQLError", message: redact(typeof error.message === "string" ? error.message : "GraphQL request failed"), extensions: typeof error.extensions?.code === "string" ? { code: redact(error.extensions.code) } : void 0 }));
+    return result;
+  } });
+}
+async function withCancellation(operation, signal) {
+  signal?.throwIfAborted();
+  if (!signal) return operation();
+  let abort = () => {
+  };
+  try {
+    return await Promise.race([
+      operation(),
+      new Promise((_resolve, reject) => {
+        abort = () => reject(signal.reason);
+        signal.addEventListener("abort", abort, { once: true });
+        if (signal.aborted) abort();
+      })
+    ]);
+  } finally {
+    signal.removeEventListener("abort", abort);
+  }
+}
 
-export { DEFAULT_API_URL, GenqlError, createITMPartnerClient, everything, generateMutationOp, generateQueryOp };
+export { DEFAULT_API_URL, GenqlError, ITMPartnerTransportError, createITMPartnerClient, everything, generateMutationOp, generateQueryOp };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map