@pisti-paypiller/react 0.0.0-stage → 0.7.1

package/dist/client.js

@@ -0,0 +1,633 @@
+import { AccountResource, OrganizationResource, } from "./resources.js";
+export class PistiClientError extends Error {
+    status;
+    code;
+    constructor(message, status = 0, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = "PistiClientError";
+    }
+}
+const INITIAL = Object.freeze({
+    status: "loading",
+    isLoaded: false,
+    isSignedIn: false,
+    user: null,
+    sessionId: null,
+    sessionClaims: null,
+    error: null,
+});
+const SIGNED_OUT = Object.freeze({
+    status: "signedOut",
+    isLoaded: true,
+    isSignedIn: false,
+    user: null,
+    sessionId: null,
+    sessionClaims: null,
+    error: null,
+});
+/** Reads `VITE_<name>` or `<name>` from Vite's import.meta.env, then process.env. */
+function envValue(name) {
+    try {
+        const env = import.meta.env;
+        const value = env?.[`VITE_${name}`] ?? env?.[name];
+        if (value)
+            return value;
+    }
+    catch {
+        /* Not a Vite build. */
+    }
+    const processEnv = globalThis.process?.env;
+    return processEnv?.[`VITE_${name}`] ?? processEnv?.[name];
+}
+function withEnvironmentDefaults(options) {
+    return {
+        ...options,
+        signInUrl: options.signInUrl ?? envValue("PISTI_SIGN_IN_URL"),
+        signUpUrl: options.signUpUrl ?? envValue("PISTI_SIGN_UP_URL"),
+        signInFallbackRedirectUrl: options.signInFallbackRedirectUrl ?? envValue("PISTI_SIGN_IN_FALLBACK_REDIRECT_URL"),
+        signUpFallbackRedirectUrl: options.signUpFallbackRedirectUrl ?? envValue("PISTI_SIGN_UP_FALLBACK_REDIRECT_URL"),
+        signInForceRedirectUrl: options.signInForceRedirectUrl ?? envValue("PISTI_SIGN_IN_FORCE_REDIRECT_URL"),
+        signUpForceRedirectUrl: options.signUpForceRedirectUrl ?? envValue("PISTI_SIGN_UP_FORCE_REDIRECT_URL"),
+        afterSignOutUrl: options.afterSignOutUrl ?? envValue("PISTI_AFTER_SIGN_OUT_URL"),
+    };
+}
+/** Parses `pk_test_…`/`pk_live_…`: base64url of the Frontend API URL followed by `$`. */
+export function parsePublishableKey(key) {
+    if (!key)
+        throw new Error("Missing Pisti publishable key. Set VITE_PISTI_PUBLISHABLE_KEY in your .env file (copy it from your application's Home page in the Pisti console), or pass publishableKey to <PistiProvider>.");
+    const match = /^pk_(test|live)_([A-Za-z0-9_-]+)$/.exec(key.trim());
+    if (!match)
+        throw new Error("That isn't a Pisti publishable key. It should start with pk_test_ or pk_live_.");
+    const base64 = match[2].replace(/-/g, "+").replace(/_/g, "/");
+    const decoded = atob(base64 + "=".repeat((4 - (base64.length % 4)) % 4));
+    if (!decoded.endsWith("$"))
+        throw new Error("The publishable key is malformed.");
+    const frontendApi = new URL(decoded.slice(0, -1));
+    const frontendApiId = frontendApi.pathname.split("/").filter(Boolean).at(-1) ?? "";
+    if (!frontendApi.pathname.endsWith(`/v1/fapi/${frontendApiId}`))
+        throw new Error("The publishable key is malformed.");
+    const development = match[1] === "test";
+    const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(frontendApi.hostname);
+    if (frontendApi.protocol !== "https:" && !(development && loopback))
+        throw new Error("Pisti requires HTTPS outside local development.");
+    const issuer = new URL(frontendApi.pathname.slice(0, -`v1/fapi/${frontendApiId}`.length), frontendApi.origin);
+    return { frontendApi, frontendApiId, issuer, development };
+}
+function decodeClaims(token) {
+    try {
+        const payload = token.split(".")[1].replace(/-/g, "+").replace(/_/g, "/");
+        return JSON.parse(decodeURIComponent(Array.from(atob(payload + "=".repeat((4 - (payload.length % 4)) % 4)), (character) => "%" + character.charCodeAt(0).toString(16).padStart(2, "0")).join("")));
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Talks to the environment's Frontend API from the browser: sign-in and sign-up
+ * steps, the signed-in session, and short-lived session tokens. Keeps the
+ * `__session` cookie fresh so same-site backends can read it.
+ */
+export class PistiClient {
+    publishableKey;
+    frontendApi;
+    issuer;
+    development;
+    account = new AccountResource((method, path, body) => this.withReverification(() => this.resource(method, path, body)));
+    organizations = new OrganizationResource((method, path, body) => this.withReverification(() => this.resource(method, path, body)), () => {
+        const identity = this.snapshot.sessionId;
+        return () => this.requireIdentity(identity);
+    });
+    snapshot = INITIAL;
+    environmentConfig = null;
+    environmentRequest;
+    listeners = new Set();
+    token;
+    renewing;
+    loading;
+    timer;
+    channel;
+    storageKey;
+    frontendApiId;
+    navigation;
+    modal = null;
+    modalOptions = {};
+    modalListeners = new Set();
+    reverificationListeners = new Set();
+    reverification;
+    constructor(options = {}) {
+        const publishableKey = options.publishableKey ?? envValue("PISTI_PUBLISHABLE_KEY");
+        const key = parsePublishableKey(publishableKey);
+        this.publishableKey = publishableKey;
+        this.frontendApi = key.frontendApi;
+        this.frontendApiId = key.frontendApiId;
+        this.issuer = key.issuer;
+        this.development = key.development;
+        this.storageKey = `pisti_client:${key.frontendApiId}`;
+        const { publishableKey: _key, ...navigation } = options;
+        this.navigation = withEnvironmentDefaults(navigation);
+    }
+    /** Updates redirect URLs and router functions without recreating the client. */
+    configure(navigation) {
+        this.navigation = withEnvironmentDefaults(navigation);
+    }
+    subscribe = (listener) => {
+        this.listeners.add(listener);
+        return () => {
+            this.listeners.delete(listener);
+        };
+    };
+    getSnapshot = () => this.snapshot;
+    getServerSnapshot = () => INITIAL;
+    get environment() {
+        return this.environmentConfig;
+    }
+    start() {
+        if (typeof window === "undefined")
+            return () => { };
+        void this.load();
+        void this.loadEnvironment().catch(() => { });
+        this.timer = setInterval(() => {
+            if (this.snapshot.isSignedIn && document.visibilityState === "visible")
+                void this.getToken().catch(() => { });
+        }, 15_000);
+        const focus = () => {
+            if (document.visibilityState === "visible")
+                void this.load();
+        };
+        document.addEventListener("visibilitychange", focus);
+        if (typeof BroadcastChannel !== "undefined") {
+            this.channel = new BroadcastChannel(`pisti:${this.frontendApiId}`);
+            this.channel.onmessage = () => void this.load();
+        }
+        return () => {
+            clearInterval(this.timer);
+            document.removeEventListener("visibilitychange", focus);
+            this.channel?.close();
+            this.channel = undefined;
+        };
+    }
+    /** Re-reads the browser's session from Pisti. */
+    load = () => (this.loading ??= (async () => {
+        try {
+            const state = await this.fapi("GET", "client");
+            await this.apply(state);
+        }
+        catch (error) {
+            this.setSnapshot({
+                ...SIGNED_OUT,
+                status: "error",
+                error: error instanceof Error ? error : new Error("Pisti is unavailable."),
+            });
+        }
+        finally {
+            this.loading = undefined;
+        }
+    })());
+    loadEnvironment = () => this.environmentConfig
+        ? Promise.resolve(this.environmentConfig)
+        : (this.environmentRequest ??= this.fapi("GET", "environment").then((value) => {
+            this.environmentConfig = value;
+            for (const listener of this.listeners)
+                listener();
+            return value;
+        }, (error) => {
+            this.environmentRequest = undefined;
+            throw error;
+        }));
+    signIn = {
+        password: (identifier, password) => this.complete(this.fapi("POST", "sign_in/password", { identifier, password })),
+        sendEmailCode: (identifier) => this.fapi("POST", "sign_in/email_code", { identifier }),
+        verifyEmailCode: (requestId, code) => this.complete(this.fapi("POST", "sign_in/email_code/verify", { requestId, code })),
+        secondFactorDetails: (attemptId) => this.fapi("POST", "sign_in/second_factor/details", { attemptId }),
+        completeSecondFactor: (attemptId, code, emailCode) => this.complete(this.fapi("POST", "sign_in/second_factor", { attemptId, code, ...(emailCode ? { emailCode } : {}) })),
+    };
+    signUp = {
+        sendEmailCode: (email) => this.fapi("POST", "sign_up", { identifier: email }),
+        verify: (input) => this.complete(this.fapi("POST", "sign_up/verify", input)),
+    };
+    passwordReset = {
+        sendEmailCode: (identifier) => this.fapi("POST", "password_reset", { identifier }),
+        complete: (input) => this.fapi("POST", "password_reset/complete", input),
+    };
+    /** Restores a self-deactivated account during its 30-day grace period. The user then signs in again. */
+    reactivation = {
+        sendEmailCode: (identifier) => this.fapi("POST", "reactivation", { identifier }),
+        complete: (input) => this.fapi("POST", "reactivation/complete", input),
+    };
+    signOut = async () => {
+        await this.apply(await this.fapi("POST", "sign_out"));
+        this.channel?.postMessage("changed");
+    };
+    setActiveOrganization = async (organizationId) => {
+        const sessionId = this.requireSession();
+        await this.apply(await this.fapi("POST", `sessions/${sessionId}/touch`, { organizationId }));
+        await this.getToken({ skipCache: true });
+        this.channel?.postMessage("changed");
+    };
+    /** A fresh session token for your backend, or null when signed out. Tokens last about a minute. */
+    getToken = (options = {}) => {
+        const sessionId = this.snapshot.sessionId;
+        if (!sessionId)
+            return Promise.resolve(null);
+        if (!options.skipCache &&
+            this.token?.sessionId === sessionId &&
+            this.token.expiresAt - Date.now() > 20_000)
+            return Promise.resolve(this.token.value);
+        return (this.renewing ??= (async () => {
+            try {
+                const result = await this.fapi("POST", `sessions/${sessionId}/tokens`);
+                if (this.snapshot.sessionId !== sessionId)
+                    return null;
+                this.token = { value: result.jwt, expiresAt: Date.parse(result.expiresAt), sessionId };
+                this.writeCookie(result.jwt);
+                this.applyClaims(decodeClaims(result.jwt));
+                return result.jwt;
+            }
+            catch (error) {
+                if (error instanceof PistiClientError && error.status === 401)
+                    await this.load();
+                throw error;
+            }
+            finally {
+                this.renewing = undefined;
+            }
+        })());
+    };
+    has = (check) => {
+        const user = this.snapshot.user;
+        return Boolean(user &&
+            (check.permission || check.role) &&
+            (!check.permission || user.organizationPermissions.includes(check.permission)) &&
+            (!check.role || user.organizationRole === check.role));
+    };
+    /** `fetch` with the session token attached as a bearer credential. */
+    authenticatedFetch = async (input, init = {}) => {
+        const token = await this.getToken();
+        const headers = new Headers(init.headers);
+        if (token)
+            headers.set("Authorization", "Bearer " + token);
+        const response = await fetch(input, { ...init, headers });
+        if (response.status !== 401 || !token)
+            return response;
+        const renewed = await this.getToken({ skipCache: true });
+        if (!renewed)
+            return response;
+        headers.set("Authorization", "Bearer " + renewed);
+        return fetch(input, { ...init, headers });
+    };
+    get signInUrl() {
+        return this.navigation.signInUrl ?? this.environmentConfig?.paths.signInUrl ?? null;
+    }
+    get signUpUrl() {
+        return this.navigation.signUpUrl ?? this.environmentConfig?.paths.signUpUrl ?? null;
+    }
+    /** Goes to your sign-in page (remembering the current page), or opens sign-in in a modal when you have none. */
+    redirectToSignIn = () => {
+        const target = this.signInUrl;
+        if (target)
+            this.navigate(this.withReturn(target));
+        else
+            this.openSignIn();
+    };
+    redirectToSignUp = () => {
+        const target = this.signUpUrl;
+        if (target)
+            this.navigate(this.withReturn(target));
+        else
+            this.openSignUp();
+    };
+    /** Force redirect, then `redirect_url`, then the fallback, then the console setting, then "/". */
+    redirectAfterSignIn = (options = {}) => this.navigate(options.forceRedirectUrl ??
+        this.navigation.signInForceRedirectUrl ??
+        this.returnUrl() ??
+        options.fallbackRedirectUrl ??
+        this.navigation.signInFallbackRedirectUrl ??
+        this.environmentConfig?.paths.afterSignInUrl ??
+        "/", true);
+    redirectAfterSignUp = (options = {}) => this.navigate(options.forceRedirectUrl ??
+        this.navigation.signUpForceRedirectUrl ??
+        this.returnUrl() ??
+        options.fallbackRedirectUrl ??
+        this.navigation.signUpFallbackRedirectUrl ??
+        this.environmentConfig?.paths.afterSignUpUrl ??
+        this.navigation.signInFallbackRedirectUrl ??
+        this.environmentConfig?.paths.afterSignInUrl ??
+        "/", true);
+    redirectAfterSignOut = () => this.navigate(this.navigation.afterSignOutUrl ?? this.environmentConfig?.paths.afterSignOutUrl ?? "/");
+    /** Navigates with your router when you passed routerPush, otherwise with a normal page load. */
+    navigate = (to, replace = false) => {
+        if (typeof window === "undefined")
+            return;
+        const url = new URL(to, window.location.href);
+        const router = replace ? (this.navigation.routerReplace ?? this.navigation.routerPush) : this.navigation.routerPush;
+        if (url.origin === window.location.origin && router)
+            void router(url.pathname + url.search + url.hash);
+        else if (replace)
+            window.location.replace(url.href);
+        else
+            window.location.assign(url.href);
+    };
+    // ----- Modals -----
+    subscribeModal = (listener) => {
+        this.modalListeners.add(listener);
+        return () => {
+            this.modalListeners.delete(listener);
+        };
+    };
+    getModal = () => this.modal;
+    getServerModal = () => null;
+    /** Redirect options the open modal was given, for example by a sign-in button. */
+    getModalOptions = () => this.modalOptions;
+    openSignIn = (options = {}) => this.setModal("sign-in", options);
+    openSignUp = (options = {}) => this.setModal("sign-up", options);
+    openUserProfile = () => this.setModal("user-profile");
+    closeModal = () => this.setModal(null);
+    // ----- Reverification (sensitive account changes) -----
+    subscribeReverification = (listener) => {
+        this.reverificationListeners.add(listener);
+        return () => {
+            this.reverificationListeners.delete(listener);
+            if (this.reverificationListeners.size === 0)
+                this.cancelReverification();
+        };
+    };
+    getReverificationSnapshot = () => this.reverification !== undefined;
+    getServerReverificationSnapshot = () => false;
+    requestReverification = () => {
+        if (!this.snapshot.isSignedIn)
+            return Promise.reject(new PistiClientError("Sign in before verifying your identity.", 401));
+        if (this.reverification)
+            return this.reverification.promise;
+        if (this.reverificationListeners.size === 0)
+            return Promise.reject(new PistiClientError("Confirm your identity to continue.", 403, "reauthentication_required"));
+        let resolve;
+        let reject;
+        const promise = new Promise((complete, fail) => {
+            resolve = complete;
+            reject = fail;
+        });
+        this.reverification = { promise, resolve, reject };
+        for (const listener of this.reverificationListeners)
+            listener();
+        return promise;
+    };
+    completeReverification = async (proof) => {
+        const pending = this.reverification;
+        if (!pending)
+            throw new PistiClientError("Start identity verification again.", 400);
+        await this.account.reauthenticate(proof);
+        if (this.reverification !== pending)
+            return;
+        this.reverification = undefined;
+        pending.resolve();
+        for (const listener of this.reverificationListeners)
+            listener();
+    };
+    cancelReverification = () => {
+        const pending = this.reverification;
+        if (!pending)
+            return;
+        this.reverification = undefined;
+        pending.reject(new PistiClientError("Identity verification was canceled.", 403, "reauthentication_cancelled"));
+        for (const listener of this.reverificationListeners)
+            listener();
+    };
+    /** Signs out so the user can sign in again, for example to prove who they are. */
+    reauthenticate = async () => {
+        this.cancelReverification();
+        await this.signOut();
+        this.redirectToSignIn();
+    };
+    withReverification = async (operation) => {
+        const identity = this.snapshot.sessionId;
+        try {
+            return await operation();
+        }
+        catch (error) {
+            if (!(error instanceof PistiClientError) || error.code !== "reauthentication_required")
+                throw error;
+            this.requireIdentity(identity);
+            await this.requestReverification();
+            this.requireIdentity(identity);
+            return operation();
+        }
+    };
+    // ----- Internals -----
+    async complete(request) {
+        const outcome = await request;
+        if (outcome.status !== "complete")
+            return outcome;
+        await this.apply(outcome.client, outcome.sessionId);
+        await this.getToken({ skipCache: true }).catch(() => { });
+        this.channel?.postMessage("changed");
+        return { status: "complete", recoveryCodes: outcome.recoveryCodes ?? null };
+    }
+    async apply(state, preferred) {
+        if (state.clientToken && this.development) {
+            try {
+                localStorage.setItem(this.storageKey, state.clientToken);
+            }
+            catch {
+                /* The HttpOnly cookie still works when storage is unavailable. */
+            }
+        }
+        const session = state.sessions.find((item) => item.id === preferred) ??
+            state.sessions.find((item) => item.id === state.lastActiveSessionId) ??
+            state.sessions[0];
+        if (!session) {
+            this.token = undefined;
+            this.writeCookie(null);
+            this.setSnapshot(SIGNED_OUT);
+            return;
+        }
+        const previous = this.snapshot.user?.id === session.user.id ? this.snapshot.user : null;
+        const fullName = `${session.user.firstName} ${session.user.lastName}`.trim();
+        const sameOrganization = previous?.organizationId === session.organizationId;
+        this.setSnapshot({
+            status: "signedIn",
+            isLoaded: true,
+            isSignedIn: true,
+            sessionId: session.id,
+            sessionClaims: this.snapshot.sessionId === session.id ? this.snapshot.sessionClaims : null,
+            error: null,
+            user: Object.freeze({
+                id: session.user.id,
+                issuer: this.issuer.href,
+                fullName: fullName || null,
+                firstName: session.user.firstName,
+                lastName: session.user.lastName,
+                primaryEmailAddress: session.user.email ? { emailAddress: session.user.email } : null,
+                imageUrl: session.user.imageUrl,
+                hasImage: Boolean(session.user.imageUrl),
+                authenticatedAt: previous?.authenticatedAt ?? null,
+                mfaAuthenticatedAt: previous?.mfaAuthenticatedAt ?? null,
+                instanceId: previous?.instanceId ?? "",
+                organizationId: session.organizationId,
+                organizationSlug: sameOrganization ? (previous?.organizationSlug ?? null) : null,
+                organizationRole: sameOrganization ? (previous?.organizationRole ?? null) : null,
+                organizationPermissions: sameOrganization ? (previous?.organizationPermissions ?? []) : [],
+            }),
+        });
+        if (this.token?.sessionId !== session.id || !sameOrganization)
+            await this.getToken({ skipCache: true }).catch(() => { });
+    }
+    applyClaims(claims) {
+        const user = this.snapshot.user;
+        if (!user)
+            return;
+        const permissions = Array.isArray(claims.org_permissions)
+            ? claims.org_permissions.filter((value) => typeof value === "string")
+            : typeof claims.org_permissions === "string"
+                ? [claims.org_permissions]
+                : [];
+        const next = Object.freeze({
+            ...user,
+            instanceId: typeof claims.instance_id === "string" ? claims.instance_id : user.instanceId,
+            authenticatedAt: typeof claims.auth_time === "number" ? claims.auth_time : null,
+            mfaAuthenticatedAt: typeof claims.mfa_authenticated_at === "number" ? claims.mfa_authenticated_at : null,
+            organizationId: typeof claims.org_id === "string" ? claims.org_id : null,
+            organizationSlug: typeof claims.org_slug === "string" ? claims.org_slug : null,
+            organizationRole: typeof claims.org_role === "string" ? claims.org_role : null,
+            organizationPermissions: Object.freeze(permissions),
+        });
+        this.setSnapshot({ ...this.snapshot, user: next, sessionClaims: Object.freeze({ ...claims }) });
+    }
+    /**
+     * Writes `__session` and `__client_uat` (the session's sign-in time, or 0 when signed out) on the
+     * app's origin. Backend SDKs use `__client_uat` to tell an expired cookie that needs a handshake
+     * from a visitor who is simply signed out.
+     */
+    writeCookie(token) {
+        if (typeof document === "undefined")
+            return;
+        const secure = window.location.protocol === "https:" ? "; Secure" : "";
+        const authTime = token ? decodeClaims(token).auth_time : 0;
+        document.cookie = token
+            ? `__session=${token}; Path=/; Max-Age=60; SameSite=Lax${secure}`
+            : `__session=; Path=/; Max-Age=0; SameSite=Lax${secure}`;
+        document.cookie = `__client_uat=${typeof authTime === "number" ? authTime : 0}; Path=/; Max-Age=31536000; SameSite=Lax${secure}`;
+    }
+    setSnapshot(next) {
+        this.snapshot = next;
+        for (const listener of this.listeners)
+            listener();
+    }
+    setModal(modal, options = this.modalOptions) {
+        this.modalOptions = modal ? options : {};
+        if (this.modal === modal)
+            return;
+        this.modal = modal;
+        for (const listener of this.modalListeners)
+            listener();
+    }
+    /** Adds the current page as `redirect_url`, so sign-in returns here. */
+    withReturn(target) {
+        if (typeof window === "undefined")
+            return target;
+        const url = new URL(target, window.location.href);
+        if (url.origin === window.location.origin && url.pathname === window.location.pathname)
+            return target;
+        url.searchParams.set("redirect_url", window.location.pathname + window.location.search + window.location.hash);
+        return url.origin === window.location.origin ? url.pathname + url.search + url.hash : url.href;
+    }
+    /** A same-origin `redirect_url` from the address bar, if any. Other origins are ignored to avoid open redirects. */
+    returnUrl() {
+        if (typeof window === "undefined")
+            return null;
+        const value = new URL(window.location.href).searchParams.get("redirect_url");
+        if (!value)
+            return null;
+        try {
+            const url = new URL(value, window.location.href);
+            if (url.origin === window.location.origin)
+                return url.pathname + url.search + url.hash;
+            const allowed = this.navigation.allowedRedirectOrigins ?? [];
+            return allowed.some((origin) => (typeof origin === "string" ? origin === url.origin : origin.test(url.origin)))
+                ? url.href
+                : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    requireSession() {
+        if (!this.snapshot.sessionId)
+            throw new PistiClientError("Sign in to continue.", 401, "signed_out");
+        return this.snapshot.sessionId;
+    }
+    requireIdentity(identity) {
+        if (identity !== this.snapshot.sessionId)
+            throw new PistiClientError("The signed-in account changed. Try again.", 409, "identity_changed");
+    }
+    async fapi(method, path, body) {
+        const headers = new Headers({ Accept: "application/json" });
+        if (body !== undefined)
+            headers.set("Content-Type", "application/json");
+        if (this.development) {
+            try {
+                const stored = localStorage.getItem(this.storageKey);
+                if (stored)
+                    headers.set("X-Pisti-Client", stored);
+            }
+            catch {
+                /* Fall back to the cookie. */
+            }
+        }
+        let response;
+        try {
+            response = await fetch(new URL(this.frontendApi.pathname.replace(/\/?$/, "/") + path, this.frontendApi.origin), {
+                method,
+                headers,
+                credentials: "include",
+                cache: "no-store",
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            });
+        }
+        catch {
+            throw new PistiClientError("Pisti can’t be reached. Check your connection and try again.");
+        }
+        if (!response.ok)
+            throw await this.error(response);
+        if (response.status === 204)
+            return undefined;
+        return (await response.json()).data;
+    }
+    async resource(method, path, body) {
+        const identity = this.snapshot.sessionId;
+        if (!identity)
+            throw new PistiClientError("Sign in before managing your account.", 401);
+        const response = await this.authenticatedFetch(new URL(path, this.issuer), {
+            method,
+            headers: {
+                Accept: "application/json",
+                ...(body === undefined ? {} : { "Content-Type": "application/json" }),
+            },
+            ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+        });
+        this.requireIdentity(identity);
+        if (!response.ok) {
+            if (response.status === 401)
+                await this.load();
+            throw await this.error(response);
+        }
+        const result = response.status === 204 ? undefined : (await response.json()).data;
+        if (method !== "GET") {
+            await this.load();
+            await this.getToken({ skipCache: true }).catch(() => { });
+        }
+        return result;
+    }
+    async error(response) {
+        try {
+            const problem = (await response.json());
+            const validation = problem.errors ? Object.values(problem.errors).flat().join(" ") : "";
+            return new PistiClientError(validation || problem.detail || problem.title || "The request could not be completed.", response.status, problem.code);
+        }
+        catch {
+            return new PistiClientError(response.status === 429 ? "Too many attempts. Wait a moment and try again." : "The request could not be completed.", response.status);
+        }
+    }
+}
+//# sourceMappingURL=client.js.map