@nexusm/sdk 5.1.0 → 5.2.0

package/dist/index.mjs

@@ -163,6 +163,12 @@ var ValidationError = class extends ApiError {
     this.details = details;
   }
 };
+var UpstreamInterceptError = class extends ApiError {
+  constructor(message, statusCode, response) {
+    super(message, statusCode, response, "NEXUS_UPSTREAM_INTERCEPT");
+    this.name = "UpstreamInterceptError";
+  }
+};
 var NotFoundError = class extends ApiError {
   constructor(message, response) {
     super(message, 404, response, "NEXUS_NOT_FOUND_ERROR");
@@ -574,6 +580,35 @@ var OfflineQueue = class {
 };
 
 // src/http/client.ts
+function redirectHost(location) {
+  if (typeof location !== "string" || location === "") return "an unknown host";
+  try {
+    return new URL(location).host;
+  } catch {
+    return "an unparseable location";
+  }
+}
+function upstreamRedirectError(response, url) {
+  const headers = response.headers ?? {};
+  const host = redirectHost(headers.location ?? headers.Location);
+  return new UpstreamInterceptError(
+    `Request to ${url ?? "the API"} was redirected (HTTP ${response.status}) to ${host} instead of being answered by Nexus. This is typically an expired or missing edge credential (e.g. a Cloudflare Access service token) \u2014 the API itself was never reached.`,
+    response.status,
+    response.data
+  );
+}
+function assertNotIntercepted(response) {
+  if (response.config?.responseType === "text") return;
+  const headers = response.headers ?? {};
+  const raw = headers["content-type"] ?? headers["Content-Type"];
+  if (typeof raw !== "string" || raw === "") return;
+  if (raw.toLowerCase().includes("json")) return;
+  throw new UpstreamInterceptError(
+    `Request to ${response.config?.url ?? "the API"} returned HTTP ${response.status} with content-type "${raw}" where JSON was expected. Something between this client and Nexus answered the request (auth edge, proxy, or captive portal); treating it as data would look like an empty result.`,
+    response.status,
+    response.data
+  );
+}
 var HttpClient = class {
   /**
    * Create a new HTTP client.
@@ -591,7 +626,14 @@ var HttpClient = class {
     }
     this.axios = axios.create({
       baseURL: config.baseUrl,
-      timeout: config.timeout
+      timeout: config.timeout,
+      // Never follow redirects (Kairos#66 / Aether#372). An auth edge such as
+      // Cloudflare Access answers an unauthenticated call with 302 → its own
+      // login page; following it yields a 200 with HTML, which is
+      // indistinguishable from an empty result to the caller. With
+      // maxRedirects: 0 the 3xx fails axios' status validation and reaches the
+      // error interceptor, which turns it into an UpstreamInterceptError.
+      maxRedirects: 0
     });
     this.setupRequestInterceptor();
     this.setupResponseInterceptor();
@@ -806,8 +848,11 @@ var HttpClient = class {
    */
   setupResponseInterceptor() {
     this.axios.interceptors.response.use(
-      // Success handler -- pass through
-      (response) => response,
+      // Success handler -- pass through, except for a 2xx that is not JSON.
+      (response) => {
+        assertNotIntercepted(response);
+        return response;
+      },
       // Error handler -- normalise into NexusError hierarchy
       (error) => {
         if (axios.isCancel(error)) {
@@ -821,6 +866,11 @@ var HttpClient = class {
             )
           );
         }
+        if (error.response && error.response.status >= 300 && error.response.status < 400) {
+          return Promise.reject(
+            upstreamRedirectError(error.response, error.config?.url)
+          );
+        }
         if (error.response) {
           const apiError = ApiError.fromResponse(error.response);
           const reqUrl = error.config?.url ?? "";
@@ -1476,6 +1526,7 @@ export {
   RateLimitError,
   TenantService,
   TimeoutError,
+  UpstreamInterceptError,
   ValidationError,
   apiKeyCreateSchema,
   contextRequestSchema,