@mediaviz/sdk 1.0.79 → 1.0.81

package/dist/sdk.cjs

@@ -91,8 +91,15 @@ function requireErrors () {
 	   * @returns {OAuthError}
 	   */
 	  static fromResponse(status, body) {
-	    if (body && typeof body === 'object' && typeof body.error === 'string') {
-	      return new OAuthError(body.error, body.error_description ?? '', status, body);
+	    // FastAPI wraps HTTPException payloads in a `detail` envelope, so an OAuth
+	    // error arrives as { detail: { error, error_description } }. Unwrap it
+	    // before falling back, or every server-side OAuth error reads as server_error.
+	    const payload =
+	      body && typeof body === 'object' && typeof body.error !== 'string' && body.detail
+	        ? body.detail
+	        : body;
+	    if (payload && typeof payload === 'object' && typeof payload.error === 'string') {
+	      return new OAuthError(payload.error, payload.error_description ?? '', status, body);
 	    }
 	    return new OAuthError('server_error', 'Unexpected server response', status, body);
 	  }
@@ -173,6 +180,9 @@ function requireClient () {
 	const { postForm, postJson } = requireHttp();
 	const { OAuthError } = requireErrors();
 
+	// In-flight dedup key for client_credentials re-mints (no refresh_token to key on).
+	const CLIENT_CREDENTIALS_KEY = Symbol('client_credentials');
+
 	class OAuthClient {
 	  /**
 	   * @param {import('./types').OAuthClientConfig} config
@@ -188,12 +198,22 @@ function requireClient () {
 	   */
 	  static async registerClient(params) {
 	    const baseUrl = params.baseUrl.replace(/\/+$/, '');
-	    return postJson(`${baseUrl}/oauth/clients`, {
+	    const body = {
 	      client_name: params.clientName,
 	      client_type: params.clientType,
 	      redirect_uris: params.redirectUris,
 	      is_first_party: params.isFirstParty,
-	    });
+	    };
+	    // grant_types/company_id are required to provision a confidential
+	    // client_credentials (machine-to-machine) client; omitted bodies keep the
+	    // legacy public/authorization_code shape. The endpoint is admin-gated, so a
+	    // bearer token must be supplied for the request to authenticate.
+	    if (params.grantTypes !== undefined) body.grant_types = params.grantTypes;
+	    if (params.companyId !== undefined) body.company_id = params.companyId;
+	    const headers = params.accessToken
+	      ? { Authorization: `Bearer ${params.accessToken}` }
+	      : {};
+	    return postJson(`${baseUrl}/oauth/clients`, body, headers);
 	  }
 
 	  /**
@@ -311,15 +331,27 @@ function requireClient () {
 	      return { data: json, updatedTokens: null };
 	    }
 
-	    // 401: attempt refresh — propagate OAuthError if refresh fails.
-	    // Concurrent request() callers with the same refresh_token share one in-flight
-	    // call so the server only sees one rotation (the second would get invalid_grant).
-	    let pending = this._inFlightRefreshes.get(refreshToken);
+	    // 401: re-authenticate, then retry once.
+	    // - User sessions (refresh_token present) use the refresh_token grant. The server
+	    //   rotates the token one-time, so concurrent callers share one in-flight call
+	    //   (a second rotation would get invalid_grant).
+	    // - Machine-to-machine sessions (no refresh_token, client_secret configured) re-mint
+	    //   via client_credentials, which issues no refresh token to rotate (RFC 6749 §4.4).
+	    // - With neither a refresh_token nor a client_secret there is nothing to retry with.
+	    if (!refreshToken && !this._config.clientSecret) {
+	      throw OAuthError.fromResponse(401, await firstResponse.json());
+	    }
+
+	    const reauthKey = refreshToken || CLIENT_CREDENTIALS_KEY;
+	    let pending = this._inFlightRefreshes.get(reauthKey);
 	    if (!pending) {
-	      pending = this.refreshAccessToken(refreshToken).finally(() => {
-	        this._inFlightRefreshes.delete(refreshToken);
+	      const reauth = refreshToken
+	        ? this.refreshAccessToken(refreshToken)
+	        : this.getClientCredentialsToken();
+	      pending = reauth.finally(() => {
+	        this._inFlightRefreshes.delete(reauthKey);
 	      });
-	      this._inFlightRefreshes.set(refreshToken, pending);
+	      this._inFlightRefreshes.set(reauthKey, pending);
 	    }
 	    const newTokens = await pending;
 
@@ -401,6 +433,9 @@ function requireTypes () {
 	 * @property {string} clientType - "public" or "confidential"
 	 * @property {string[]} redirectUris - HTTPS redirect URIs
 	 * @property {boolean} isFirstParty - Whether this is a first-party client
+	 * @property {string[]} [grantTypes] - Allowed grants, e.g. ["client_credentials"]; required for machine-to-machine clients
+	 * @property {number} [companyId] - Company to bind the client to; required for the client_credentials grant
+	 * @property {string} [accessToken] - Admin bearer token; the registration endpoint is authorization-gated
 	 */
 
 	/**
@@ -1498,7 +1533,7 @@ class Search {
     return data;
   }
 
-  async searchProjectPhotosParametrized(projectTableName, { andSearchText, orSearchText, notSearchText, city, country, state, albums, dateMin, dateMax, dateNullAnd, dateNullOr, dateOrder, bestOfSimilarSetsOnly, splitByTier, size } = {}) {
+  async searchProjectPhotosParametrized(projectTableName, { andSearchText, orSearchText, notSearchText, city, country, state, albums, dateMin, dateMax, dateNullAnd, dateNullOr, ascOrDesc, bestOfSimilarSetsOnly, splitByTier, lastId, limit } = {}) {
     this._ctx.requireTokens();
     let path = `/api/v1/search/parametrized/${encodeURIComponent(projectTableName)}/`;
     const query = new URLSearchParams();
@@ -1513,10 +1548,25 @@ class Search {
     if (dateMax !== undefined) (Array.isArray(dateMax) ? dateMax : [dateMax]).forEach(v => query.append('date_max', v));
     if (dateNullAnd !== undefined) (Array.isArray(dateNullAnd) ? dateNullAnd : [dateNullAnd]).forEach(v => query.append('date_null_and', v));
     if (dateNullOr !== undefined) (Array.isArray(dateNullOr) ? dateNullOr : [dateNullOr]).forEach(v => query.append('date_null_or', v));
-    if (dateOrder !== undefined) (Array.isArray(dateOrder) ? dateOrder : [dateOrder]).forEach(v => query.append('date_order', v));
+    if (ascOrDesc !== undefined) (Array.isArray(ascOrDesc) ? ascOrDesc : [ascOrDesc]).forEach(v => query.append('asc_or_desc', v));
     if (bestOfSimilarSetsOnly !== undefined) (Array.isArray(bestOfSimilarSetsOnly) ? bestOfSimilarSetsOnly : [bestOfSimilarSetsOnly]).forEach(v => query.append('best_of_similar_sets_only', v));
     if (splitByTier !== undefined) (Array.isArray(splitByTier) ? splitByTier : [splitByTier]).forEach(v => query.append('split_by_tier', v));
-    if (size !== undefined) (Array.isArray(size) ? size : [size]).forEach(v => query.append('size', v));
+    if (lastId !== undefined) (Array.isArray(lastId) ? lastId : [lastId]).forEach(v => query.append('last_id', v));
+    if (limit !== undefined) (Array.isArray(limit) ? limit : [limit]).forEach(v => query.append('limit', v));
+    const qs = query.toString();
+    if (qs) path += '?' + qs;
+    const { data } = await this._ctx.client.request(path, 'GET', this._ctx.accessToken, this._ctx.refreshToken);
+    return data;
+  }
+
+  async recallProjectPhotoIds(projectTableName, { ascOrDesc, bestOfSimilarSetsOnly, lastId, limit } = {}) {
+    this._ctx.requireTokens();
+    let path = `/api/v1/search/recall/${encodeURIComponent(projectTableName)}/`;
+    const query = new URLSearchParams();
+    if (ascOrDesc !== undefined) (Array.isArray(ascOrDesc) ? ascOrDesc : [ascOrDesc]).forEach(v => query.append('asc_or_desc', v));
+    if (bestOfSimilarSetsOnly !== undefined) (Array.isArray(bestOfSimilarSetsOnly) ? bestOfSimilarSetsOnly : [bestOfSimilarSetsOnly]).forEach(v => query.append('best_of_similar_sets_only', v));
+    if (lastId !== undefined) (Array.isArray(lastId) ? lastId : [lastId]).forEach(v => query.append('last_id', v));
+    if (limit !== undefined) (Array.isArray(limit) ? limit : [limit]).forEach(v => query.append('limit', v));
     const qs = query.toString();
     if (qs) path += '?' + qs;
     const { data } = await this._ctx.client.request(path, 'GET', this._ctx.accessToken, this._ctx.refreshToken);

package/dist/sdk.d.cts

@@ -455,7 +455,8 @@ export class Projects {
 
 export class Search {
   searchProjectPhotos(projectTableName: string, options?: { andParams?: any, andStringParams?: any, orParams?: any, orStringParams?: any, notParams?: any, notStringParams?: any, dateMin?: string | string[], dateMax?: string | string[], dateNullAnd?: boolean | boolean[], dateNullOr?: boolean | boolean[], dateOrder?: string | string[], customAlbumId?: number | number[], bestOfSimilarSetsOnly?: boolean | boolean[], curatedAlbumId?: number | number[], splitByTier?: boolean | boolean[] }): Promise<Record<string, any>>;
-  searchProjectPhotosParametrized(projectTableName: string, options?: { andSearchText?: any, orSearchText?: any, notSearchText?: any, city?: any, country?: any, state?: any, albums?: any, dateMin?: string | string[], dateMax?: string | string[], dateNullAnd?: boolean | boolean[], dateNullOr?: boolean | boolean[], dateOrder?: string | string[], bestOfSimilarSetsOnly?: boolean | boolean[], splitByTier?: boolean | boolean[], size?: number | number[] }): Promise<Record<string, any>>;
+  searchProjectPhotosParametrized(projectTableName: string, options?: { andSearchText?: any, orSearchText?: any, notSearchText?: any, city?: any, country?: any, state?: any, albums?: any, dateMin?: string | string[], dateMax?: string | string[], dateNullAnd?: boolean | boolean[], dateNullOr?: boolean | boolean[], ascOrDesc?: string | string[], bestOfSimilarSetsOnly?: boolean | boolean[], splitByTier?: boolean | boolean[], lastId?: number | number[], limit?: number | number[] }): Promise<Record<string, any>>;
+  recallProjectPhotoIds(projectTableName: string, options?: { ascOrDesc?: string | string[], bestOfSimilarSetsOnly?: boolean | boolean[], lastId?: number | number[], limit?: number | number[] }): Promise<any>;
   searchProjectPhotosNaturalLanguage(projectTableName: string, searchText: string, size?: number, options?: { minCosine?: number | number[], labelMinCosine?: number | number[], labelTopK?: number | number[], labelDelta?: number | number[], bestOfSimilarSetsOnly?: boolean | boolean[], splitByTier?: boolean | boolean[] }): Promise<Record<string, any>>;
   getProjectSavedSearches(projectTableName: string): Promise<any>;
   getSavedSearchById(searchId: number): Promise<SearchDisplay>;

package/dist/sdk.d.ts

@@ -455,7 +455,8 @@ export class Projects {
 
 export class Search {
   searchProjectPhotos(projectTableName: string, options?: { andParams?: any, andStringParams?: any, orParams?: any, orStringParams?: any, notParams?: any, notStringParams?: any, dateMin?: string | string[], dateMax?: string | string[], dateNullAnd?: boolean | boolean[], dateNullOr?: boolean | boolean[], dateOrder?: string | string[], customAlbumId?: number | number[], bestOfSimilarSetsOnly?: boolean | boolean[], curatedAlbumId?: number | number[], splitByTier?: boolean | boolean[] }): Promise<Record<string, any>>;
-  searchProjectPhotosParametrized(projectTableName: string, options?: { andSearchText?: any, orSearchText?: any, notSearchText?: any, city?: any, country?: any, state?: any, albums?: any, dateMin?: string | string[], dateMax?: string | string[], dateNullAnd?: boolean | boolean[], dateNullOr?: boolean | boolean[], dateOrder?: string | string[], bestOfSimilarSetsOnly?: boolean | boolean[], splitByTier?: boolean | boolean[], size?: number | number[] }): Promise<Record<string, any>>;
+  searchProjectPhotosParametrized(projectTableName: string, options?: { andSearchText?: any, orSearchText?: any, notSearchText?: any, city?: any, country?: any, state?: any, albums?: any, dateMin?: string | string[], dateMax?: string | string[], dateNullAnd?: boolean | boolean[], dateNullOr?: boolean | boolean[], ascOrDesc?: string | string[], bestOfSimilarSetsOnly?: boolean | boolean[], splitByTier?: boolean | boolean[], lastId?: number | number[], limit?: number | number[] }): Promise<Record<string, any>>;
+  recallProjectPhotoIds(projectTableName: string, options?: { ascOrDesc?: string | string[], bestOfSimilarSetsOnly?: boolean | boolean[], lastId?: number | number[], limit?: number | number[] }): Promise<any>;
   searchProjectPhotosNaturalLanguage(projectTableName: string, searchText: string, size?: number, options?: { minCosine?: number | number[], labelMinCosine?: number | number[], labelTopK?: number | number[], labelDelta?: number | number[], bestOfSimilarSetsOnly?: boolean | boolean[], splitByTier?: boolean | boolean[] }): Promise<Record<string, any>>;
   getProjectSavedSearches(projectTableName: string): Promise<any>;
   getSavedSearchById(searchId: number): Promise<SearchDisplay>;

package/dist/sdk.esm.d.ts

@@ -455,7 +455,8 @@ export class Projects {
 
 export class Search {
   searchProjectPhotos(projectTableName: string, options?: { andParams?: any, andStringParams?: any, orParams?: any, orStringParams?: any, notParams?: any, notStringParams?: any, dateMin?: string | string[], dateMax?: string | string[], dateNullAnd?: boolean | boolean[], dateNullOr?: boolean | boolean[], dateOrder?: string | string[], customAlbumId?: number | number[], bestOfSimilarSetsOnly?: boolean | boolean[], curatedAlbumId?: number | number[], splitByTier?: boolean | boolean[] }): Promise<Record<string, any>>;
-  searchProjectPhotosParametrized(projectTableName: string, options?: { andSearchText?: any, orSearchText?: any, notSearchText?: any, city?: any, country?: any, state?: any, albums?: any, dateMin?: string | string[], dateMax?: string | string[], dateNullAnd?: boolean | boolean[], dateNullOr?: boolean | boolean[], dateOrder?: string | string[], bestOfSimilarSetsOnly?: boolean | boolean[], splitByTier?: boolean | boolean[], size?: number | number[] }): Promise<Record<string, any>>;
+  searchProjectPhotosParametrized(projectTableName: string, options?: { andSearchText?: any, orSearchText?: any, notSearchText?: any, city?: any, country?: any, state?: any, albums?: any, dateMin?: string | string[], dateMax?: string | string[], dateNullAnd?: boolean | boolean[], dateNullOr?: boolean | boolean[], ascOrDesc?: string | string[], bestOfSimilarSetsOnly?: boolean | boolean[], splitByTier?: boolean | boolean[], lastId?: number | number[], limit?: number | number[] }): Promise<Record<string, any>>;
+  recallProjectPhotoIds(projectTableName: string, options?: { ascOrDesc?: string | string[], bestOfSimilarSetsOnly?: boolean | boolean[], lastId?: number | number[], limit?: number | number[] }): Promise<any>;
   searchProjectPhotosNaturalLanguage(projectTableName: string, searchText: string, size?: number, options?: { minCosine?: number | number[], labelMinCosine?: number | number[], labelTopK?: number | number[], labelDelta?: number | number[], bestOfSimilarSetsOnly?: boolean | boolean[], splitByTier?: boolean | boolean[] }): Promise<Record<string, any>>;
   getProjectSavedSearches(projectTableName: string): Promise<any>;
   getSavedSearchById(searchId: number): Promise<SearchDisplay>;

package/dist/sdk.esm.js

@@ -89,8 +89,15 @@ function requireErrors () {
 	   * @returns {OAuthError}
 	   */
 	  static fromResponse(status, body) {
-	    if (body && typeof body === 'object' && typeof body.error === 'string') {
-	      return new OAuthError(body.error, body.error_description ?? '', status, body);
+	    // FastAPI wraps HTTPException payloads in a `detail` envelope, so an OAuth
+	    // error arrives as { detail: { error, error_description } }. Unwrap it
+	    // before falling back, or every server-side OAuth error reads as server_error.
+	    const payload =
+	      body && typeof body === 'object' && typeof body.error !== 'string' && body.detail
+	        ? body.detail
+	        : body;
+	    if (payload && typeof payload === 'object' && typeof payload.error === 'string') {
+	      return new OAuthError(payload.error, payload.error_description ?? '', status, body);
 	    }
 	    return new OAuthError('server_error', 'Unexpected server response', status, body);
 	  }
@@ -171,6 +178,9 @@ function requireClient () {
 	const { postForm, postJson } = requireHttp();
 	const { OAuthError } = requireErrors();
 
+	// In-flight dedup key for client_credentials re-mints (no refresh_token to key on).
+	const CLIENT_CREDENTIALS_KEY = Symbol('client_credentials');
+
 	class OAuthClient {
 	  /**
 	   * @param {import('./types').OAuthClientConfig} config
@@ -186,12 +196,22 @@ function requireClient () {
 	   */
 	  static async registerClient(params) {
 	    const baseUrl = params.baseUrl.replace(/\/+$/, '');
-	    return postJson(`${baseUrl}/oauth/clients`, {
+	    const body = {
 	      client_name: params.clientName,
 	      client_type: params.clientType,
 	      redirect_uris: params.redirectUris,
 	      is_first_party: params.isFirstParty,
-	    });
+	    };
+	    // grant_types/company_id are required to provision a confidential
+	    // client_credentials (machine-to-machine) client; omitted bodies keep the
+	    // legacy public/authorization_code shape. The endpoint is admin-gated, so a
+	    // bearer token must be supplied for the request to authenticate.
+	    if (params.grantTypes !== undefined) body.grant_types = params.grantTypes;
+	    if (params.companyId !== undefined) body.company_id = params.companyId;
+	    const headers = params.accessToken
+	      ? { Authorization: `Bearer ${params.accessToken}` }
+	      : {};
+	    return postJson(`${baseUrl}/oauth/clients`, body, headers);
 	  }
 
 	  /**
@@ -309,15 +329,27 @@ function requireClient () {
 	      return { data: json, updatedTokens: null };
 	    }
 
-	    // 401: attempt refresh — propagate OAuthError if refresh fails.
-	    // Concurrent request() callers with the same refresh_token share one in-flight
-	    // call so the server only sees one rotation (the second would get invalid_grant).
-	    let pending = this._inFlightRefreshes.get(refreshToken);
+	    // 401: re-authenticate, then retry once.
+	    // - User sessions (refresh_token present) use the refresh_token grant. The server
+	    //   rotates the token one-time, so concurrent callers share one in-flight call
+	    //   (a second rotation would get invalid_grant).
+	    // - Machine-to-machine sessions (no refresh_token, client_secret configured) re-mint
+	    //   via client_credentials, which issues no refresh token to rotate (RFC 6749 §4.4).
+	    // - With neither a refresh_token nor a client_secret there is nothing to retry with.
+	    if (!refreshToken && !this._config.clientSecret) {
+	      throw OAuthError.fromResponse(401, await firstResponse.json());
+	    }
+
+	    const reauthKey = refreshToken || CLIENT_CREDENTIALS_KEY;
+	    let pending = this._inFlightRefreshes.get(reauthKey);
 	    if (!pending) {
-	      pending = this.refreshAccessToken(refreshToken).finally(() => {
-	        this._inFlightRefreshes.delete(refreshToken);
+	      const reauth = refreshToken
+	        ? this.refreshAccessToken(refreshToken)
+	        : this.getClientCredentialsToken();
+	      pending = reauth.finally(() => {
+	        this._inFlightRefreshes.delete(reauthKey);
 	      });
-	      this._inFlightRefreshes.set(refreshToken, pending);
+	      this._inFlightRefreshes.set(reauthKey, pending);
 	    }
 	    const newTokens = await pending;
 
@@ -399,6 +431,9 @@ function requireTypes () {
 	 * @property {string} clientType - "public" or "confidential"
 	 * @property {string[]} redirectUris - HTTPS redirect URIs
 	 * @property {boolean} isFirstParty - Whether this is a first-party client
+	 * @property {string[]} [grantTypes] - Allowed grants, e.g. ["client_credentials"]; required for machine-to-machine clients
+	 * @property {number} [companyId] - Company to bind the client to; required for the client_credentials grant
+	 * @property {string} [accessToken] - Admin bearer token; the registration endpoint is authorization-gated
 	 */
 
 	/**
@@ -1496,7 +1531,7 @@ class Search {
     return data;
   }
 
-  async searchProjectPhotosParametrized(projectTableName, { andSearchText, orSearchText, notSearchText, city, country, state, albums, dateMin, dateMax, dateNullAnd, dateNullOr, dateOrder, bestOfSimilarSetsOnly, splitByTier, size } = {}) {
+  async searchProjectPhotosParametrized(projectTableName, { andSearchText, orSearchText, notSearchText, city, country, state, albums, dateMin, dateMax, dateNullAnd, dateNullOr, ascOrDesc, bestOfSimilarSetsOnly, splitByTier, lastId, limit } = {}) {
     this._ctx.requireTokens();
     let path = `/api/v1/search/parametrized/${encodeURIComponent(projectTableName)}/`;
     const query = new URLSearchParams();
@@ -1511,10 +1546,25 @@ class Search {
     if (dateMax !== undefined) (Array.isArray(dateMax) ? dateMax : [dateMax]).forEach(v => query.append('date_max', v));
     if (dateNullAnd !== undefined) (Array.isArray(dateNullAnd) ? dateNullAnd : [dateNullAnd]).forEach(v => query.append('date_null_and', v));
     if (dateNullOr !== undefined) (Array.isArray(dateNullOr) ? dateNullOr : [dateNullOr]).forEach(v => query.append('date_null_or', v));
-    if (dateOrder !== undefined) (Array.isArray(dateOrder) ? dateOrder : [dateOrder]).forEach(v => query.append('date_order', v));
+    if (ascOrDesc !== undefined) (Array.isArray(ascOrDesc) ? ascOrDesc : [ascOrDesc]).forEach(v => query.append('asc_or_desc', v));
     if (bestOfSimilarSetsOnly !== undefined) (Array.isArray(bestOfSimilarSetsOnly) ? bestOfSimilarSetsOnly : [bestOfSimilarSetsOnly]).forEach(v => query.append('best_of_similar_sets_only', v));
     if (splitByTier !== undefined) (Array.isArray(splitByTier) ? splitByTier : [splitByTier]).forEach(v => query.append('split_by_tier', v));
-    if (size !== undefined) (Array.isArray(size) ? size : [size]).forEach(v => query.append('size', v));
+    if (lastId !== undefined) (Array.isArray(lastId) ? lastId : [lastId]).forEach(v => query.append('last_id', v));
+    if (limit !== undefined) (Array.isArray(limit) ? limit : [limit]).forEach(v => query.append('limit', v));
+    const qs = query.toString();
+    if (qs) path += '?' + qs;
+    const { data } = await this._ctx.client.request(path, 'GET', this._ctx.accessToken, this._ctx.refreshToken);
+    return data;
+  }
+
+  async recallProjectPhotoIds(projectTableName, { ascOrDesc, bestOfSimilarSetsOnly, lastId, limit } = {}) {
+    this._ctx.requireTokens();
+    let path = `/api/v1/search/recall/${encodeURIComponent(projectTableName)}/`;
+    const query = new URLSearchParams();
+    if (ascOrDesc !== undefined) (Array.isArray(ascOrDesc) ? ascOrDesc : [ascOrDesc]).forEach(v => query.append('asc_or_desc', v));
+    if (bestOfSimilarSetsOnly !== undefined) (Array.isArray(bestOfSimilarSetsOnly) ? bestOfSimilarSetsOnly : [bestOfSimilarSetsOnly]).forEach(v => query.append('best_of_similar_sets_only', v));
+    if (lastId !== undefined) (Array.isArray(lastId) ? lastId : [lastId]).forEach(v => query.append('last_id', v));
+    if (limit !== undefined) (Array.isArray(limit) ? limit : [limit]).forEach(v => query.append('limit', v));
     const qs = query.toString();
     if (qs) path += '?' + qs;
     const { data } = await this._ctx.client.request(path, 'GET', this._ctx.accessToken, this._ctx.refreshToken);

package/dist/sdk.umd.js

@@ -95,8 +95,15 @@
 		   * @returns {OAuthError}
 		   */
 		  static fromResponse(status, body) {
-		    if (body && typeof body === 'object' && typeof body.error === 'string') {
-		      return new OAuthError(body.error, body.error_description ?? '', status, body);
+		    // FastAPI wraps HTTPException payloads in a `detail` envelope, so an OAuth
+		    // error arrives as { detail: { error, error_description } }. Unwrap it
+		    // before falling back, or every server-side OAuth error reads as server_error.
+		    const payload =
+		      body && typeof body === 'object' && typeof body.error !== 'string' && body.detail
+		        ? body.detail
+		        : body;
+		    if (payload && typeof payload === 'object' && typeof payload.error === 'string') {
+		      return new OAuthError(payload.error, payload.error_description ?? '', status, body);
 		    }
 		    return new OAuthError('server_error', 'Unexpected server response', status, body);
 		  }
@@ -177,6 +184,9 @@
 		const { postForm, postJson } = requireHttp();
 		const { OAuthError } = requireErrors();
 
+		// In-flight dedup key for client_credentials re-mints (no refresh_token to key on).
+		const CLIENT_CREDENTIALS_KEY = Symbol('client_credentials');
+
 		class OAuthClient {
 		  /**
 		   * @param {import('./types').OAuthClientConfig} config
@@ -192,12 +202,22 @@
 		   */
 		  static async registerClient(params) {
 		    const baseUrl = params.baseUrl.replace(/\/+$/, '');
-		    return postJson(`${baseUrl}/oauth/clients`, {
+		    const body = {
 		      client_name: params.clientName,
 		      client_type: params.clientType,
 		      redirect_uris: params.redirectUris,
 		      is_first_party: params.isFirstParty,
-		    });
+		    };
+		    // grant_types/company_id are required to provision a confidential
+		    // client_credentials (machine-to-machine) client; omitted bodies keep the
+		    // legacy public/authorization_code shape. The endpoint is admin-gated, so a
+		    // bearer token must be supplied for the request to authenticate.
+		    if (params.grantTypes !== undefined) body.grant_types = params.grantTypes;
+		    if (params.companyId !== undefined) body.company_id = params.companyId;
+		    const headers = params.accessToken
+		      ? { Authorization: `Bearer ${params.accessToken}` }
+		      : {};
+		    return postJson(`${baseUrl}/oauth/clients`, body, headers);
 		  }
 
 		  /**
@@ -315,15 +335,27 @@
 		      return { data: json, updatedTokens: null };
 		    }
 
-		    // 401: attempt refresh — propagate OAuthError if refresh fails.
-		    // Concurrent request() callers with the same refresh_token share one in-flight
-		    // call so the server only sees one rotation (the second would get invalid_grant).
-		    let pending = this._inFlightRefreshes.get(refreshToken);
+		    // 401: re-authenticate, then retry once.
+		    // - User sessions (refresh_token present) use the refresh_token grant. The server
+		    //   rotates the token one-time, so concurrent callers share one in-flight call
+		    //   (a second rotation would get invalid_grant).
+		    // - Machine-to-machine sessions (no refresh_token, client_secret configured) re-mint
+		    //   via client_credentials, which issues no refresh token to rotate (RFC 6749 §4.4).
+		    // - With neither a refresh_token nor a client_secret there is nothing to retry with.
+		    if (!refreshToken && !this._config.clientSecret) {
+		      throw OAuthError.fromResponse(401, await firstResponse.json());
+		    }
+
+		    const reauthKey = refreshToken || CLIENT_CREDENTIALS_KEY;
+		    let pending = this._inFlightRefreshes.get(reauthKey);
 		    if (!pending) {
-		      pending = this.refreshAccessToken(refreshToken).finally(() => {
-		        this._inFlightRefreshes.delete(refreshToken);
+		      const reauth = refreshToken
+		        ? this.refreshAccessToken(refreshToken)
+		        : this.getClientCredentialsToken();
+		      pending = reauth.finally(() => {
+		        this._inFlightRefreshes.delete(reauthKey);
 		      });
-		      this._inFlightRefreshes.set(refreshToken, pending);
+		      this._inFlightRefreshes.set(reauthKey, pending);
 		    }
 		    const newTokens = await pending;
 
@@ -405,6 +437,9 @@
 		 * @property {string} clientType - "public" or "confidential"
 		 * @property {string[]} redirectUris - HTTPS redirect URIs
 		 * @property {boolean} isFirstParty - Whether this is a first-party client
+		 * @property {string[]} [grantTypes] - Allowed grants, e.g. ["client_credentials"]; required for machine-to-machine clients
+		 * @property {number} [companyId] - Company to bind the client to; required for the client_credentials grant
+		 * @property {string} [accessToken] - Admin bearer token; the registration endpoint is authorization-gated
 		 */
 
 		/**
@@ -1502,7 +1537,7 @@
 	    return data;
 	  }
 
-	  async searchProjectPhotosParametrized(projectTableName, { andSearchText, orSearchText, notSearchText, city, country, state, albums, dateMin, dateMax, dateNullAnd, dateNullOr, dateOrder, bestOfSimilarSetsOnly, splitByTier, size } = {}) {
+	  async searchProjectPhotosParametrized(projectTableName, { andSearchText, orSearchText, notSearchText, city, country, state, albums, dateMin, dateMax, dateNullAnd, dateNullOr, ascOrDesc, bestOfSimilarSetsOnly, splitByTier, lastId, limit } = {}) {
 	    this._ctx.requireTokens();
 	    let path = `/api/v1/search/parametrized/${encodeURIComponent(projectTableName)}/`;
 	    const query = new URLSearchParams();
@@ -1517,10 +1552,25 @@
 	    if (dateMax !== undefined) (Array.isArray(dateMax) ? dateMax : [dateMax]).forEach(v => query.append('date_max', v));
 	    if (dateNullAnd !== undefined) (Array.isArray(dateNullAnd) ? dateNullAnd : [dateNullAnd]).forEach(v => query.append('date_null_and', v));
 	    if (dateNullOr !== undefined) (Array.isArray(dateNullOr) ? dateNullOr : [dateNullOr]).forEach(v => query.append('date_null_or', v));
-	    if (dateOrder !== undefined) (Array.isArray(dateOrder) ? dateOrder : [dateOrder]).forEach(v => query.append('date_order', v));
+	    if (ascOrDesc !== undefined) (Array.isArray(ascOrDesc) ? ascOrDesc : [ascOrDesc]).forEach(v => query.append('asc_or_desc', v));
 	    if (bestOfSimilarSetsOnly !== undefined) (Array.isArray(bestOfSimilarSetsOnly) ? bestOfSimilarSetsOnly : [bestOfSimilarSetsOnly]).forEach(v => query.append('best_of_similar_sets_only', v));
 	    if (splitByTier !== undefined) (Array.isArray(splitByTier) ? splitByTier : [splitByTier]).forEach(v => query.append('split_by_tier', v));
-	    if (size !== undefined) (Array.isArray(size) ? size : [size]).forEach(v => query.append('size', v));
+	    if (lastId !== undefined) (Array.isArray(lastId) ? lastId : [lastId]).forEach(v => query.append('last_id', v));
+	    if (limit !== undefined) (Array.isArray(limit) ? limit : [limit]).forEach(v => query.append('limit', v));
+	    const qs = query.toString();
+	    if (qs) path += '?' + qs;
+	    const { data } = await this._ctx.client.request(path, 'GET', this._ctx.accessToken, this._ctx.refreshToken);
+	    return data;
+	  }
+
+	  async recallProjectPhotoIds(projectTableName, { ascOrDesc, bestOfSimilarSetsOnly, lastId, limit } = {}) {
+	    this._ctx.requireTokens();
+	    let path = `/api/v1/search/recall/${encodeURIComponent(projectTableName)}/`;
+	    const query = new URLSearchParams();
+	    if (ascOrDesc !== undefined) (Array.isArray(ascOrDesc) ? ascOrDesc : [ascOrDesc]).forEach(v => query.append('asc_or_desc', v));
+	    if (bestOfSimilarSetsOnly !== undefined) (Array.isArray(bestOfSimilarSetsOnly) ? bestOfSimilarSetsOnly : [bestOfSimilarSetsOnly]).forEach(v => query.append('best_of_similar_sets_only', v));
+	    if (lastId !== undefined) (Array.isArray(lastId) ? lastId : [lastId]).forEach(v => query.append('last_id', v));
+	    if (limit !== undefined) (Array.isArray(limit) ? limit : [limit]).forEach(v => query.append('limit', v));
 	    const qs = query.toString();
 	    if (qs) path += '?' + qs;
 	    const { data } = await this._ctx.client.request(path, 'GET', this._ctx.accessToken, this._ctx.refreshToken);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediaviz/sdk",
-  "version": "1.0.79",
+  "version": "1.0.81",
   "description": "MediaViz JavaScript SDK \u2014 auto-generated public endpoint client.",
   "license": "MIT",
   "repository": {