@markwharton/pwa-core 1.1.0 → 1.2.1

package/dist/__tests__/auth/apiKey.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/auth/apiKey.test.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const apiKey_1 = require("../../auth/apiKey");
+(0, vitest_1.describe)('API Key utilities', () => {
+    (0, vitest_1.describe)('extractApiKey', () => {
+        (0, vitest_1.it)('extracts API key from X-API-Key header', () => {
+            const request = {
+                headers: {
+                    get: (name) => name === 'X-API-Key' ? 'test-api-key' : null
+                }
+            };
+            (0, vitest_1.expect)((0, apiKey_1.extractApiKey)(request)).toBe('test-api-key');
+        });
+        (0, vitest_1.it)('returns null when header is missing', () => {
+            const request = {
+                headers: {
+                    get: () => null
+                }
+            };
+            (0, vitest_1.expect)((0, apiKey_1.extractApiKey)(request)).toBeNull();
+        });
+    });
+    (0, vitest_1.describe)('hashApiKey', () => {
+        (0, vitest_1.it)('produces consistent SHA-256 hash', () => {
+            const key = 'test-api-key';
+            const hash1 = (0, apiKey_1.hashApiKey)(key);
+            const hash2 = (0, apiKey_1.hashApiKey)(key);
+            (0, vitest_1.expect)(hash1).toBe(hash2);
+        });
+        (0, vitest_1.it)('produces 64-character hex string', () => {
+            const hash = (0, apiKey_1.hashApiKey)('any-key');
+            (0, vitest_1.expect)(hash).toHaveLength(64);
+            (0, vitest_1.expect)(hash).toMatch(/^[a-f0-9]+$/);
+        });
+        (0, vitest_1.it)('produces different hashes for different keys', () => {
+            const hash1 = (0, apiKey_1.hashApiKey)('key1');
+            const hash2 = (0, apiKey_1.hashApiKey)('key2');
+            (0, vitest_1.expect)(hash1).not.toBe(hash2);
+        });
+    });
+    (0, vitest_1.describe)('validateApiKey', () => {
+        (0, vitest_1.it)('returns ok for matching key', () => {
+            const key = 'valid-api-key';
+            const hash = (0, apiKey_1.hashApiKey)(key);
+            const result = (0, apiKey_1.validateApiKey)(key, hash);
+            (0, vitest_1.expect)(result.ok).toBe(true);
+        });
+        (0, vitest_1.it)('returns error for mismatched key', () => {
+            const hash = (0, apiKey_1.hashApiKey)('correct-key');
+            const result = (0, apiKey_1.validateApiKey)('wrong-key', hash);
+            (0, vitest_1.expect)(result.ok).toBe(false);
+            (0, vitest_1.expect)(result.error).toBe('Invalid API key');
+        });
+        (0, vitest_1.it)('returns error for empty key', () => {
+            const hash = (0, apiKey_1.hashApiKey)('some-key');
+            const result = (0, apiKey_1.validateApiKey)('', hash);
+            (0, vitest_1.expect)(result.ok).toBe(false);
+        });
+    });
+    (0, vitest_1.describe)('generateApiKey', () => {
+        (0, vitest_1.it)('generates 64-character hex string', () => {
+            const key = (0, apiKey_1.generateApiKey)();
+            (0, vitest_1.expect)(key).toHaveLength(64);
+            (0, vitest_1.expect)(key).toMatch(/^[a-f0-9]+$/);
+        });
+        (0, vitest_1.it)('generates unique keys', () => {
+            const key1 = (0, apiKey_1.generateApiKey)();
+            const key2 = (0, apiKey_1.generateApiKey)();
+            (0, vitest_1.expect)(key1).not.toBe(key2);
+        });
+        (0, vitest_1.it)('generates cryptographically random keys', () => {
+            const keys = new Set();
+            for (let i = 0; i < 100; i++) {
+                keys.add((0, apiKey_1.generateApiKey)());
+            }
+            (0, vitest_1.expect)(keys.size).toBe(100);
+        });
+    });
+});

package/dist/__tests__/auth/token.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/auth/token.test.js

@@ -0,0 +1,189 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const token_1 = require("../../auth/token");
+// Reset module state before each test
+(0, vitest_1.beforeEach)(() => {
+    // Re-import to reset module state
+    vitest_1.vi.resetModules();
+});
+(0, vitest_1.describe)('JWT utilities', () => {
+    const validSecret = 'a'.repeat(32); // 32 character secret
+    (0, vitest_1.describe)('initAuth', () => {
+        (0, vitest_1.it)('initializes with valid secret', async () => {
+            const { initAuth, getJwtSecret } = await Promise.resolve().then(() => __importStar(require('../../auth/token')));
+            initAuth(validSecret);
+            (0, vitest_1.expect)(getJwtSecret()).toBe(validSecret);
+        });
+        (0, vitest_1.it)('throws if secret is undefined', async () => {
+            const { initAuth } = await Promise.resolve().then(() => __importStar(require('../../auth/token')));
+            (0, vitest_1.expect)(() => initAuth(undefined)).toThrow('JWT_SECRET must be at least 32 characters');
+        });
+        (0, vitest_1.it)('throws if secret is too short', async () => {
+            const { initAuth } = await Promise.resolve().then(() => __importStar(require('../../auth/token')));
+            (0, vitest_1.expect)(() => initAuth('short')).toThrow('JWT_SECRET must be at least 32 characters');
+        });
+        (0, vitest_1.it)('accepts custom minimum length', async () => {
+            const { initAuth, getJwtSecret } = await Promise.resolve().then(() => __importStar(require('../../auth/token')));
+            const shortSecret = 'a'.repeat(16);
+            initAuth(shortSecret, 16);
+            (0, vitest_1.expect)(getJwtSecret()).toBe(shortSecret);
+        });
+        (0, vitest_1.it)('throws if secret shorter than custom minimum', async () => {
+            const { initAuth } = await Promise.resolve().then(() => __importStar(require('../../auth/token')));
+            (0, vitest_1.expect)(() => initAuth('a'.repeat(15), 16)).toThrow('JWT_SECRET must be at least 16 characters');
+        });
+    });
+    (0, vitest_1.describe)('getJwtSecret', () => {
+        (0, vitest_1.it)('throws if not initialized', async () => {
+            const { getJwtSecret } = await Promise.resolve().then(() => __importStar(require('../../auth/token')));
+            (0, vitest_1.expect)(() => getJwtSecret()).toThrow('Auth not initialized. Call initAuth() first.');
+        });
+        (0, vitest_1.it)('returns secret after initialization', async () => {
+            const { initAuth, getJwtSecret } = await Promise.resolve().then(() => __importStar(require('../../auth/token')));
+            initAuth(validSecret);
+            (0, vitest_1.expect)(getJwtSecret()).toBe(validSecret);
+        });
+    });
+    (0, vitest_1.describe)('extractToken', () => {
+        (0, vitest_1.it)('extracts token from Bearer header', () => {
+            (0, vitest_1.expect)((0, token_1.extractToken)('Bearer mytoken123')).toBe('mytoken123');
+        });
+        (0, vitest_1.it)('returns null for null header', () => {
+            (0, vitest_1.expect)((0, token_1.extractToken)(null)).toBeNull();
+        });
+        (0, vitest_1.it)('returns null for empty header', () => {
+            (0, vitest_1.expect)((0, token_1.extractToken)('')).toBeNull();
+        });
+        (0, vitest_1.it)('returns null for non-Bearer header', () => {
+            (0, vitest_1.expect)((0, token_1.extractToken)('Basic abc123')).toBeNull();
+        });
+        (0, vitest_1.it)('returns null for malformed Bearer header', () => {
+            (0, vitest_1.expect)((0, token_1.extractToken)('Bearertoken')).toBeNull();
+        });
+        (0, vitest_1.it)('handles token with spaces', () => {
+            (0, vitest_1.expect)((0, token_1.extractToken)('Bearer token with spaces')).toBe('token with spaces');
+        });
+    });
+    (0, vitest_1.describe)('validateToken', () => {
+        (0, vitest_1.it)('returns ok result for valid token', async () => {
+            const { initAuth, validateToken, generateToken } = await Promise.resolve().then(() => __importStar(require('../../auth/token')));
+            initAuth(validSecret);
+            const payload = { userId: '123' };
+            const token = generateToken(payload);
+            const result = validateToken(token);
+            (0, vitest_1.expect)(result.ok).toBe(true);
+            (0, vitest_1.expect)(result.data?.userId).toBe('123');
+        });
+        (0, vitest_1.it)('returns error for invalid token', async () => {
+            const { initAuth, validateToken } = await Promise.resolve().then(() => __importStar(require('../../auth/token')));
+            initAuth(validSecret);
+            const result = validateToken('invalid-token');
+            (0, vitest_1.expect)(result.ok).toBe(false);
+            (0, vitest_1.expect)(result.error).toBeDefined();
+        });
+        (0, vitest_1.it)('returns error for expired token', async () => {
+            const { initAuth, validateToken } = await Promise.resolve().then(() => __importStar(require('../../auth/token')));
+            initAuth(validSecret);
+            const expiredToken = jsonwebtoken_1.default.sign({ userId: '123' }, validSecret, { expiresIn: '-1s' });
+            const result = validateToken(expiredToken);
+            (0, vitest_1.expect)(result.ok).toBe(false);
+            (0, vitest_1.expect)(result.error).toContain('expired');
+        });
+        (0, vitest_1.it)('returns error for token signed with different secret', async () => {
+            const { initAuth, validateToken } = await Promise.resolve().then(() => __importStar(require('../../auth/token')));
+            initAuth(validSecret);
+            const wrongToken = jsonwebtoken_1.default.sign({ userId: '123' }, 'different-secret-that-is-32-chars');
+            const result = validateToken(wrongToken);
+            (0, vitest_1.expect)(result.ok).toBe(false);
+        });
+    });
+    (0, vitest_1.describe)('generateToken', () => {
+        (0, vitest_1.it)('generates valid JWT', async () => {
+            const { initAuth, generateToken } = await Promise.resolve().then(() => __importStar(require('../../auth/token')));
+            initAuth(validSecret);
+            const token = generateToken({ userId: '123' });
+            (0, vitest_1.expect)(token).toBeTruthy();
+            (0, vitest_1.expect)(token.split('.')).toHaveLength(3);
+        });
+        (0, vitest_1.it)('includes payload in token', async () => {
+            const { initAuth, generateToken } = await Promise.resolve().then(() => __importStar(require('../../auth/token')));
+            initAuth(validSecret);
+            const token = generateToken({ userId: '123', role: 'admin' });
+            const decoded = jsonwebtoken_1.default.verify(token, validSecret);
+            (0, vitest_1.expect)(decoded.userId).toBe('123');
+            (0, vitest_1.expect)(decoded.role).toBe('admin');
+        });
+        (0, vitest_1.it)('uses default 7d expiration', async () => {
+            const { initAuth, generateToken } = await Promise.resolve().then(() => __importStar(require('../../auth/token')));
+            initAuth(validSecret);
+            const token = generateToken({ userId: '123' });
+            const decoded = jsonwebtoken_1.default.verify(token, validSecret);
+            const expiresInSeconds = decoded.exp - decoded.iat;
+            (0, vitest_1.expect)(expiresInSeconds).toBe(7 * 24 * 60 * 60); // 7 days
+        });
+        (0, vitest_1.it)('accepts custom expiration', async () => {
+            const { initAuth, generateToken } = await Promise.resolve().then(() => __importStar(require('../../auth/token')));
+            initAuth(validSecret);
+            const token = generateToken({ userId: '123' }, '1h');
+            const decoded = jsonwebtoken_1.default.verify(token, validSecret);
+            const expiresInSeconds = decoded.exp - decoded.iat;
+            (0, vitest_1.expect)(expiresInSeconds).toBe(60 * 60); // 1 hour
+        });
+    });
+    (0, vitest_1.describe)('generateLongLivedToken', () => {
+        (0, vitest_1.it)('generates token with 10-year default expiration', async () => {
+            const { initAuth, generateLongLivedToken } = await Promise.resolve().then(() => __importStar(require('../../auth/token')));
+            initAuth(validSecret);
+            const token = generateLongLivedToken({ userId: '123' });
+            const decoded = jsonwebtoken_1.default.verify(token, validSecret);
+            const expiresInDays = (decoded.exp - decoded.iat) / (24 * 60 * 60);
+            (0, vitest_1.expect)(expiresInDays).toBe(3650);
+        });
+        (0, vitest_1.it)('accepts custom expiration in days', async () => {
+            const { initAuth, generateLongLivedToken } = await Promise.resolve().then(() => __importStar(require('../../auth/token')));
+            initAuth(validSecret);
+            const token = generateLongLivedToken({ userId: '123' }, 365);
+            const decoded = jsonwebtoken_1.default.verify(token, validSecret);
+            const expiresInDays = (decoded.exp - decoded.iat) / (24 * 60 * 60);
+            (0, vitest_1.expect)(expiresInDays).toBe(365);
+        });
+    });
+});

package/dist/__tests__/auth/types.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/auth/types.test.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const types_1 = require("../../auth/types");
+(0, vitest_1.describe)('Auth type guards', () => {
+    const basePayload = {
+        iat: 1234567890,
+        exp: 1234567890 + 3600
+    };
+    (0, vitest_1.describe)('hasUsername', () => {
+        (0, vitest_1.it)('returns true for payload with username', () => {
+            const payload = { ...basePayload, username: 'testuser' };
+            (0, vitest_1.expect)((0, types_1.hasUsername)(payload)).toBe(true);
+        });
+        (0, vitest_1.it)('returns false for payload without username', () => {
+            (0, vitest_1.expect)((0, types_1.hasUsername)(basePayload)).toBe(false);
+        });
+        (0, vitest_1.it)('returns false for payload with non-string username', () => {
+            const payload = { ...basePayload, username: 123 };
+            (0, vitest_1.expect)((0, types_1.hasUsername)(payload)).toBe(false);
+        });
+        (0, vitest_1.it)('returns false for payload with empty string username', () => {
+            const payload = { ...basePayload, username: '' };
+            (0, vitest_1.expect)((0, types_1.hasUsername)(payload)).toBe(true); // Empty string is still a string
+        });
+    });
+    (0, vitest_1.describe)('hasRole', () => {
+        (0, vitest_1.it)('returns true for payload with role', () => {
+            const payload = {
+                ...basePayload,
+                authenticated: true,
+                tokenType: 'user',
+                role: 'admin'
+            };
+            (0, vitest_1.expect)((0, types_1.hasRole)(payload)).toBe(true);
+        });
+        (0, vitest_1.it)('returns false for payload without role', () => {
+            (0, vitest_1.expect)((0, types_1.hasRole)(basePayload)).toBe(false);
+        });
+        (0, vitest_1.it)('returns true for viewer role', () => {
+            const payload = {
+                ...basePayload,
+                authenticated: true,
+                tokenType: 'user',
+                role: 'viewer'
+            };
+            (0, vitest_1.expect)((0, types_1.hasRole)(payload)).toBe(true);
+        });
+    });
+    (0, vitest_1.describe)('isAdmin', () => {
+        (0, vitest_1.it)('returns true for admin role', () => {
+            const payload = {
+                ...basePayload,
+                authenticated: true,
+                tokenType: 'user',
+                role: 'admin'
+            };
+            (0, vitest_1.expect)((0, types_1.isAdmin)(payload)).toBe(true);
+        });
+        (0, vitest_1.it)('returns false for viewer role', () => {
+            const payload = {
+                ...basePayload,
+                authenticated: true,
+                tokenType: 'user',
+                role: 'viewer'
+            };
+            (0, vitest_1.expect)((0, types_1.isAdmin)(payload)).toBe(false);
+        });
+        (0, vitest_1.it)('returns false for payload without role', () => {
+            (0, vitest_1.expect)((0, types_1.isAdmin)(basePayload)).toBe(false);
+        });
+        (0, vitest_1.it)('returns false for payload with username but no role', () => {
+            const payload = { ...basePayload, username: 'testuser' };
+            (0, vitest_1.expect)((0, types_1.isAdmin)(payload)).toBe(false);
+        });
+    });
+});

package/dist/__tests__/client/api.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/client/api.test.js

@@ -0,0 +1,269 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+// Mock fetch globally
+const mockFetch = vitest_1.vi.fn();
+global.fetch = mockFetch;
+(0, vitest_1.describe)('API client', () => {
+    (0, vitest_1.beforeEach)(() => {
+        vitest_1.vi.resetModules();
+        mockFetch.mockReset();
+    });
+    (0, vitest_1.describe)('initApiClient', () => {
+        (0, vitest_1.it)('sets token getter', async () => {
+            const { initApiClient, apiCall } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            initApiClient({ getToken: () => 'test-token' });
+            mockFetch.mockResolvedValue({
+                ok: true,
+                text: () => Promise.resolve('{"data": "test"}')
+            });
+            await apiCall('/api/test');
+            (0, vitest_1.expect)(mockFetch).toHaveBeenCalledWith('/api/test', vitest_1.expect.objectContaining({
+                headers: vitest_1.expect.objectContaining({
+                    Authorization: 'Bearer test-token'
+                })
+            }));
+        });
+        (0, vitest_1.it)('sets onUnauthorized callback', async () => {
+            const onUnauthorized = vitest_1.vi.fn();
+            const { initApiClient, apiCall } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            initApiClient({ getToken: () => 'token', onUnauthorized });
+            mockFetch.mockResolvedValue({
+                ok: false,
+                status: 401,
+                json: () => Promise.resolve({ error: 'Unauthorized' })
+            });
+            await (0, vitest_1.expect)(apiCall('/api/test')).rejects.toThrow();
+            (0, vitest_1.expect)(onUnauthorized).toHaveBeenCalled();
+        });
+    });
+    (0, vitest_1.describe)('apiCall', () => {
+        (0, vitest_1.it)('makes authenticated request', async () => {
+            const { initApiClient, apiCall } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            initApiClient({ getToken: () => 'my-token' });
+            mockFetch.mockResolvedValue({
+                ok: true,
+                text: () => Promise.resolve('{"result": "success"}')
+            });
+            const result = await apiCall('/api/endpoint');
+            (0, vitest_1.expect)(result).toEqual({ result: 'success' });
+            (0, vitest_1.expect)(mockFetch).toHaveBeenCalledWith('/api/endpoint', vitest_1.expect.objectContaining({
+                headers: vitest_1.expect.objectContaining({
+                    'Content-Type': 'application/json',
+                    Authorization: 'Bearer my-token'
+                })
+            }));
+        });
+        (0, vitest_1.it)('handles request without token', async () => {
+            const { initApiClient, apiCall } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            initApiClient({ getToken: () => null });
+            mockFetch.mockResolvedValue({
+                ok: true,
+                text: () => Promise.resolve('{}')
+            });
+            await apiCall('/api/public');
+            const headers = mockFetch.mock.calls[0][1].headers;
+            (0, vitest_1.expect)(headers.Authorization).toBeUndefined();
+        });
+        (0, vitest_1.it)('throws ApiError on non-ok response', async () => {
+            const { initApiClient, apiCall } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            const { ApiError: LocalApiError } = await Promise.resolve().then(() => __importStar(require('../../client/apiError')));
+            initApiClient({ getToken: () => 'token' });
+            mockFetch.mockResolvedValue({
+                ok: false,
+                status: 400,
+                json: () => Promise.resolve({ error: 'Invalid input' })
+            });
+            await (0, vitest_1.expect)(apiCall('/api/test')).rejects.toThrow(LocalApiError);
+            await (0, vitest_1.expect)(apiCall('/api/test')).rejects.toMatchObject({
+                status: 400,
+                message: 'Invalid input'
+            });
+        });
+        (0, vitest_1.it)('handles empty response body', async () => {
+            const { initApiClient, apiCall } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            initApiClient({ getToken: () => 'token' });
+            mockFetch.mockResolvedValue({
+                ok: true,
+                text: () => Promise.resolve('')
+            });
+            const result = await apiCall('/api/delete');
+            (0, vitest_1.expect)(result).toEqual({});
+        });
+        (0, vitest_1.it)('handles JSON parse error in error response', async () => {
+            const { initApiClient, apiCall } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            initApiClient({ getToken: () => 'token' });
+            mockFetch.mockResolvedValue({
+                ok: false,
+                status: 500,
+                json: () => Promise.reject(new Error('Invalid JSON'))
+            });
+            await (0, vitest_1.expect)(apiCall('/api/test')).rejects.toMatchObject({
+                status: 500,
+                message: 'Request failed'
+            });
+        });
+    });
+    (0, vitest_1.describe)('HTTP method helpers', () => {
+        (0, vitest_1.beforeEach)(async () => {
+            const { initApiClient } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            initApiClient({ getToken: () => 'token' });
+            mockFetch.mockResolvedValue({
+                ok: true,
+                text: () => Promise.resolve('{"data": "test"}')
+            });
+        });
+        (0, vitest_1.it)('apiGet uses GET method', async () => {
+            const { apiGet } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            await apiGet('/api/resource');
+            (0, vitest_1.expect)(mockFetch).toHaveBeenCalledWith('/api/resource', vitest_1.expect.objectContaining({
+                method: 'GET'
+            }));
+        });
+        (0, vitest_1.it)('apiPost uses POST method with body', async () => {
+            const { apiPost } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            await apiPost('/api/resource', { name: 'test' });
+            (0, vitest_1.expect)(mockFetch).toHaveBeenCalledWith('/api/resource', vitest_1.expect.objectContaining({
+                method: 'POST',
+                body: '{"name":"test"}'
+            }));
+        });
+        (0, vitest_1.it)('apiPost works without body', async () => {
+            const { apiPost } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            await apiPost('/api/resource');
+            (0, vitest_1.expect)(mockFetch).toHaveBeenCalledWith('/api/resource', vitest_1.expect.objectContaining({
+                method: 'POST',
+                body: undefined
+            }));
+        });
+        (0, vitest_1.it)('apiPut uses PUT method with body', async () => {
+            const { apiPut } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            await apiPut('/api/resource', { name: 'updated' });
+            (0, vitest_1.expect)(mockFetch).toHaveBeenCalledWith('/api/resource', vitest_1.expect.objectContaining({
+                method: 'PUT',
+                body: '{"name":"updated"}'
+            }));
+        });
+        (0, vitest_1.it)('apiPatch uses PATCH method with body', async () => {
+            const { apiPatch } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            await apiPatch('/api/resource', { field: 'value' });
+            (0, vitest_1.expect)(mockFetch).toHaveBeenCalledWith('/api/resource', vitest_1.expect.objectContaining({
+                method: 'PATCH',
+                body: '{"field":"value"}'
+            }));
+        });
+        (0, vitest_1.it)('apiDelete uses DELETE method', async () => {
+            const { apiDelete } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            await apiDelete('/api/resource');
+            (0, vitest_1.expect)(mockFetch).toHaveBeenCalledWith('/api/resource', vitest_1.expect.objectContaining({
+                method: 'DELETE'
+            }));
+        });
+    });
+    (0, vitest_1.describe)('apiCallSafe', () => {
+        (0, vitest_1.it)('returns ok response with data', async () => {
+            const { initApiClient, apiCallSafe } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            initApiClient({ getToken: () => 'token' });
+            mockFetch.mockResolvedValue({
+                ok: true,
+                status: 200,
+                text: () => Promise.resolve('{"user": "john"}')
+            });
+            const result = await apiCallSafe('/api/user');
+            (0, vitest_1.expect)(result.ok).toBe(true);
+            (0, vitest_1.expect)(result.status).toBe(200);
+            (0, vitest_1.expect)(result.data).toEqual({ user: 'john' });
+        });
+        (0, vitest_1.it)('preserves actual status code', async () => {
+            const { initApiClient, apiCallSafe } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            initApiClient({ getToken: () => 'token' });
+            mockFetch.mockResolvedValue({
+                ok: true,
+                status: 201,
+                text: () => Promise.resolve('{"id": "123"}')
+            });
+            const result = await apiCallSafe('/api/create');
+            (0, vitest_1.expect)(result.status).toBe(201);
+        });
+        (0, vitest_1.it)('returns error response for non-ok status', async () => {
+            const { initApiClient, apiCallSafe } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            initApiClient({ getToken: () => 'token' });
+            mockFetch.mockResolvedValue({
+                ok: false,
+                status: 404,
+                json: () => Promise.resolve({ error: 'Not found' })
+            });
+            const result = await apiCallSafe('/api/missing');
+            (0, vitest_1.expect)(result.ok).toBe(false);
+            (0, vitest_1.expect)(result.status).toBe(404);
+            (0, vitest_1.expect)(result.error).toBe('Not found');
+        });
+        (0, vitest_1.it)('handles network errors', async () => {
+            const { initApiClient, apiCallSafe } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            initApiClient({ getToken: () => 'token' });
+            mockFetch.mockRejectedValue(new Error('Network failure'));
+            const result = await apiCallSafe('/api/test');
+            (0, vitest_1.expect)(result.ok).toBe(false);
+            (0, vitest_1.expect)(result.status).toBe(0);
+            (0, vitest_1.expect)(result.error).toBe('Network error');
+        });
+        (0, vitest_1.it)('calls onUnauthorized for 401', async () => {
+            const onUnauthorized = vitest_1.vi.fn();
+            const { initApiClient, apiCallSafe } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            initApiClient({ getToken: () => 'token', onUnauthorized });
+            mockFetch.mockResolvedValue({
+                ok: false,
+                status: 401,
+                json: () => Promise.resolve({ error: 'Token expired' })
+            });
+            await apiCallSafe('/api/protected');
+            (0, vitest_1.expect)(onUnauthorized).toHaveBeenCalled();
+        });
+        (0, vitest_1.it)('handles empty success response', async () => {
+            const { initApiClient, apiCallSafe } = await Promise.resolve().then(() => __importStar(require('../../client/api')));
+            initApiClient({ getToken: () => 'token' });
+            mockFetch.mockResolvedValue({
+                ok: true,
+                status: 204,
+                text: () => Promise.resolve('')
+            });
+            const result = await apiCallSafe('/api/delete');
+            (0, vitest_1.expect)(result.ok).toBe(true);
+            (0, vitest_1.expect)(result.status).toBe(204);
+            (0, vitest_1.expect)(result.data).toBeUndefined();
+        });
+    });
+});

package/dist/__tests__/client/apiError.test.d.ts

@@ -0,0 +1 @@
+export {};