@qoretechnologies/reqraft 0.10.53 → 0.10.54-pr.115.gaf0d7a7

package/dist/stories/storyNetwork.js

@@ -0,0 +1,82 @@
+"use strict";
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GLOBAL_STORY_MOCK_DATA = exports.storySocketUrl = exports.storyApiUrl = exports.STORY_QORUS_INSTANCE = void 0;
+// Copyright 2026 Qore Technologies, s.r.o.
+// Where a story's network goes: the instance its Reqraft points at, the URLs
+// its mocks must intercept, and the requests every story is mocked for.
+//
+// `query()` and `ReqraftWebSocket` build absolute URLs from the configured
+// instance, and both mock layers match on the host as well as the path —
+// storybook-addon-mock keys on `host + pathname`, mock-socket on the URL minus
+// its query. A mock written against a hard-coded host stops matching the moment
+// the instance is overridden, and the request goes out to the real network
+// instead, silently. Build mock URLs with the helpers below.
+var useQorusTypes_1 = require("../hooks/useQorusTypes");
+var fetch_1 = require("../utils/fetch");
+var websocket_1 = require("../utils/websocket");
+/**
+ * The instance every story's Reqraft is initialized with. Override it with
+ * `REACT_APP_QORUS_INSTANCE` (or `QORUS_INSTANCE`) to run live stories against
+ * your own Qorus; mocks built from it follow the override.
+ */
+exports.STORY_QORUS_INSTANCE = process.env.REACT_APP_QORUS_INSTANCE || 'https://hq.qoretechnologies.com:8092/';
+/** The URL `query()` requests for `path`. */
+var storyApiUrl = function (path) {
+    return (0, fetch_1.buildReqraftApiUrl)(exports.STORY_QORUS_INSTANCE, path);
+};
+exports.storyApiUrl = storyApiUrl;
+/**
+ * The URL `ReqraftWebSocket` dials for `path`, token omitted — mock-socket
+ * matches servers without the query string.
+ */
+var storySocketUrl = function (path) {
+    return (0, websocket_1.buildReqraftSocketUrl)(exports.STORY_QORUS_INSTANCE, path);
+};
+exports.storySocketUrl = storySocketUrl;
+/** A GET of `path` answered with `response`. */
+var mockGet = function (path, response) { return [
+    { url: (0, exports.storyApiUrl)(path), method: 'GET', status: 200, response: response },
+]; };
+/**
+ * The type catalogue, pinned to the built-in list. `useQorusTypes` uses a
+ * reachable server's list *instead of* the built-in one, so an unmocked story
+ * renders whichever labels that server happens to have — and every FormEngine
+ * shows its loading skeleton until the request settles, which against an
+ * unreachable instance is never.
+ */
+var QORUS_TYPE_INFO_MOCK_DATA = mockGet('system/qorus-type-info', useQorusTypes_1.defaultQorusTypes);
+/**
+ * The system expression catalogue, empty. `useExpressions` fetches it whenever
+ * functions are allowed — even when the story passes its own list, which is
+ * merged in as extras — and TemplateField shows a skeleton in place of "Use
+ * Expression" until it arrives. Stories that need functions provide them
+ * (`expressions`, or their own `mockData` for this URL).
+ */
+var EXPRESSIONS_CATALOGUE_MOCK_DATA = mockGet('system?action=expressions&context=ui', []);
+/**
+ * `ReqraftWebSocket`'s server probe, which every reconnect attempt awaits
+ * before it dials. Unanswered, no attempt is ever made — a mock socket server
+ * that comes back is never reconnected to, and one that stays down is never
+ * given up on. The probe only needs an answer; its body is not read.
+ */
+var SERVER_STATUS_MOCK_DATA = mockGet('system/pid', {});
+/**
+ * Requests components make on their own, whatever the story is about —
+ * mounting a FormEngine fetches the type catalogue; allowing functions fetches
+ * the expression catalogue; a reconnecting socket probes the server.
+ * Registered for every story as storybook-addon-mock's `globalMockData`
+ * (`.storybook/preview.tsx`, and mirrored for the Vitest run in
+ * `.storybook/vitest.setup.ts`); a story's own `mockData` entry for the same
+ * URL takes precedence.
+ */
+exports.GLOBAL_STORY_MOCK_DATA = __spreadArray(__spreadArray(__spreadArray([], QORUS_TYPE_INFO_MOCK_DATA, true), EXPRESSIONS_CATALOGUE_MOCK_DATA, true), SERVER_STATUS_MOCK_DATA, true);
+//# sourceMappingURL=storyNetwork.js.map

package/dist/stories/storyNetwork.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storyNetwork.js","sourceRoot":"","sources":["../../src/stories/storyNetwork.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA2C;AAC3C,6EAA6E;AAC7E,wEAAwE;AACxE,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,+EAA+E;AAC/E,gFAAgF;AAChF,2EAA2E;AAC3E,6DAA6D;AAC7D,wDAA2D;AAC3D,wCAAoD;AACpD,gDAA2D;AAgB3D;;;;GAIG;AACU,QAAA,oBAAoB,GAC/B,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,uCAAuC,CAAC;AAElF,6CAA6C;AACtC,IAAM,WAAW,GAAG,UAAC,IAAY;IACtC,OAAA,IAAA,0BAAkB,EAAC,4BAAoB,EAAE,IAAI,CAAC;AAA9C,CAA8C,CAAC;AADpC,QAAA,WAAW,eACyB;AAEjD;;;GAGG;AACI,IAAM,cAAc,GAAG,UAAC,IAAY;IACzC,OAAA,IAAA,iCAAqB,EAAC,4BAAoB,EAAE,IAAI,CAAC;AAAjD,CAAiD,CAAC;AADvC,QAAA,cAAc,kBACyB;AAEpD,gDAAgD;AAChD,IAAM,OAAO,GAAG,UAAC,IAAY,EAAE,QAA4B,IAA0B,OAAA;IACnF,EAAE,GAAG,EAAE,IAAA,mBAAW,EAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,UAAA,EAAE;CACjE,EAFoF,CAEpF,CAAC;AAEF;;;;;;GAMG;AACH,IAAM,yBAAyB,GAAG,OAAO,CAAC,wBAAwB,EAAE,iCAAiB,CAAC,CAAC;AAEvF;;;;;;GAMG;AACH,IAAM,+BAA+B,GAAG,OAAO,CAAC,sCAAsC,EAAE,EAAE,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,IAAM,uBAAuB,GAAG,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AAE1D;;;;;;;;GAQG;AACU,QAAA,sBAAsB,iDAC9B,yBAAyB,SACzB,+BAA+B,SAC/B,uBAAuB,QAC1B"}

package/dist/utils/fetch.d.ts

@@ -10,19 +10,169 @@ export interface IReqraftFetchResponse<T> {
     ok: boolean;
     code?: number;
     error?: any;
+    /**
+     * The parsed error body on a non-ok response, when the server sent JSON.
+     *
+     * Qorus errors carry `{ err, desc }`; `error` above is only the HTTP reason
+     * phrase, which is why a caller that wanted the sentence had to reach into
+     * `data`. Consumers that need the code (`err`) or the message (`desc`) should
+     * read this rather than re-parsing.
+     */
+    errorBody?: Record<string, any>;
+    /**
+     * The response text when the body was NOT valid JSON. A non-JSON error would
+     * otherwise arrive as `{}` with only a reason phrase, discarding whatever the
+     * server actually said.
+     */
+    rawText?: string;
     response: Response;
 }
 export declare const fetchConfig: IReqraftFetchConfig;
 export declare const setupFetch: ({ instance, instanceToken, instanceRbacDisabled, unauthorizedRedirect, }: IReqraftFetchConfig) => void;
+/**
+ * The API path a caller asked for, without the leading slash the prefix already
+ * carries.
+ *
+ * `doFetchData` builds `${instance}api/latest/${url}`, and that prefix ENDS in a
+ * slash — so a caller writing `/dataprovider/arg_schemas/x` produced
+ * `api/latest//dataprovider/arg_schemas/x`. Qorus serves it, which is how both
+ * spellings survived side by side (`useArgSchema` writes one, `CompactRow` and
+ * `AutoFormField` the other), but it is not harmless: the query cache is keyed
+ * on the url, so `/x` and `x` were two cache entries and two requests for one
+ * resource.
+ *
+ * Normalised here, once, rather than at each call site — the convention is
+ * invisible from a caller's point of view and the next one would get it wrong
+ * again. Only applied when the prefix is added: a caller that opts out of the
+ * prefix owns its whole path, leading slash included.
+ */
+export declare const reqraftApiPath: (url: string, noApiPrefix?: boolean) => string;
+/**
+ * The one cache key for a request, used by every caller in every downstream
+ * project so that one resource is one entry and one in-flight request.
+ *
+ * `instance` and the token take part because both change WHICH server and WHOSE
+ * data answers: a call that overrides the instance, or that carries an explicit
+ * token, is a different resource that happens to share a path.
+ */
+export declare const reqraftCacheKey: ({ url, method, body, noApiPrefix, instance, token, }: Pick<IReqraftQueryConfig, 'url' | 'method' | 'body' | 'noApiPrefix' | 'instance' | 'token'>) => string;
+/**
+ * The URL `query()` requests for `url` on `instance` — the single definition.
+ * Story mocks build their URLs with it too, so they cannot drift from what the
+ * code actually dials.
+ *
+ * `noApiPrefix` means the caller owns the WHOLE url — an absolute address for
+ * another service, which is the only thing reqraft itself uses it for
+ * (`useExpressions` sets it exactly when `expressionsUrl` is `http(s)://…`).
+ * Prepending the instance there built `https://instance:8011/https://other/…`.
+ */
+export declare const buildReqraftApiUrl: (instance: string, url: string, noApiPrefix?: boolean) => string;
 export interface IReqraftQueryConfig {
     url: string;
     method?: 'GET' | 'POST' | 'PUT' | 'DELETE';
     body?: Record<string | number, any>;
     cache?: boolean;
     queryClient?: QueryClient;
+    /**
+     * The `url` is a complete address and is used verbatim — neither the instance
+     * nor `api/latest/` is prepended, and its leading slash is left alone. For
+     * reaching a service that is not this Qorus instance.
+     */
     noApiPrefix?: boolean;
     /** Override the global instance URL for this single call (e.g. to target a different port). */
     instance?: string;
+    /** Extra request headers, merged over the default `Content-Type`. */
+    headers?: Record<string, string>;
+    /**
+     * A bearer token for THIS call, instead of the configured instance token —
+     * for a route that is authenticated as somebody other than the current app
+     * session. Takes part in the cache key.
+     */
+    token?: string;
+    /**
+     * An explicit cache key, for a caller that must group or separate requests
+     * differently from the default `path:method:body` identity.
+     */
+    cacheKey?: string;
+    /**
+     * How long a cached response counts as fresh, in ms. Defaults to 5 minutes
+     * when `cache` is on. `Infinity` keeps it for the life of the page — what a
+     * caller wants for a catalogue that cannot change without a server restart.
+     */
+    staleTime?: number;
+    /**
+     * Whether a 401 on this request should send the page to
+     * `fetchConfig.unauthorizedRedirect`. Defaults to `true`.
+     *
+     * A 401 only means "this app's session expired" when the request actually
+     * carried this app's credential. A call that targets another service, or that
+     * hands over an explicit token, proves nothing about the session — signing the
+     * user out because an unrelated credential was refused is wrong. Callers that
+     * own their own auth policy (or that must never navigate, such as a test
+     * runner or a Storybook preview) pass `false`.
+     */
+    redirectOnUnauthorized?: boolean;
 }
-export declare function query<T>({ url, method, body, cache, queryClient, noApiPrefix, instance, }: IReqraftQueryConfig): Promise<IReqraftFetchResponse<T>>;
+/**
+ * The single request mechanism.
+ *
+ * Every request in reqraft AND in the projects built on it goes through here,
+ * so that one resource has one cache entry and one in-flight request no matter
+ * which library, hook or component asked for it. A downstream project that
+ * keeps its own fetch helper (qorus-ide's `fetchData` is the one this was
+ * written for) should adapt onto this rather than hold a second cache: two
+ * caches over one API cannot see each other's in-flight requests, so any
+ * resource both libraries want is fetched twice by construction.
+ */
+/**
+ * Put a resource the HOST already has into the cache `query` reads.
+ *
+ * The comment on `query` states the problem: two caches over one API cannot see
+ * each other's in-flight requests, so any resource both libraries want is
+ * fetched twice by construction. This is the seam that lets a host settle it
+ * without either side giving up its own loader.
+ *
+ * The case it was written for: the Qorus IDE warm-starts
+ * `/system/qorus-type-info` from `index.html`, before the bundle has even
+ * parsed, because its whole boot gates on it — and then reqraft's own
+ * `useQorusTypes` asked for it again on the first form's mount. Measured on the
+ * live IDE at 419ms and 2777ms, the same URL, the same answer.
+ *
+ * Seeding is enough to stop the second request: `query` goes through
+ * `fetchQuery` with a `staleTime`, and a fresh entry is returned without the
+ * query function ever running. `useFetch` reads the same cache directly, so it
+ * also skips its loading state and renders the answer on its first paint.
+ *
+ * Only for a resource the host has genuinely FETCHED. Seeding a guess would
+ * make every consumer believe a request had succeeded.
+ */
+export declare const seedQueryCache: <T>({ url, method, body, noApiPrefix, instance, token, data, queryClient, }: Pick<IReqraftQueryConfig, 'url' | 'method' | 'body' | 'noApiPrefix' | 'instance' | 'token' | 'queryClient'> & {
+    data: T;
+}) => void;
+export declare function query<T>({ url, method, body, cache, queryClient, noApiPrefix, instance, headers, token, cacheKey, staleTime, redirectOnUnauthorized, }: IReqraftQueryConfig): Promise<IReqraftFetchResponse<T>>;
+export interface IReqraftRawResponse {
+    ok: boolean;
+    code?: number;
+    error?: string;
+    /** The response bytes. Undefined on a non-ok response. */
+    blob?: Blob;
+    /** The `Content-Type` the bytes were served with, without parameters. */
+    mime?: string;
+}
+/**
+ * Fetch a resource whose body is NOT JSON — a file, an export, a log.
+ *
+ * Shares `doFetchData` with `query`, which owns the API prefix, the bearer token
+ * and `credentials: 'include'`. The point is that raw responses do not become a
+ * second, drifting copy of that auth handling.
+ *
+ * Nothing is cached: these payloads are large and read once.
+ *
+ * @param accept the `Accept` header. Endpoints that negotiate on the file's own
+ *   MIME type answer **406** unless the caller accepts that type, and the caller
+ *   usually cannot know it ahead of time, so this accepts anything by default.
+ */
+export declare function queryRaw({ url, method, body, noApiPrefix, instance, headers, token, accept, redirectOnUnauthorized, }: Omit<IReqraftQueryConfig, 'cache' | 'queryClient' | 'cacheKey' | 'staleTime'> & {
+    accept?: string;
+}): Promise<IReqraftRawResponse>;
 //# sourceMappingURL=fetch.d.ts.map

package/dist/utils/fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/utils/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGpD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC;CACjE;AAED,MAAM,WAAW,qBAAqB,CAAC,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC;IACR,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,GAAG,CAAC;IACZ,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,eAAO,MAAM,WAAW,EAAE,mBAIzB,CAAC;AAIF,eAAO,MAAM,UAAU,6EAKpB,mBAAmB,SAQrB,CAAC;AAgCF,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,KAAK,CAAC,CAAC,EAAE,EAC7B,GAAG,EACH,MAAc,EACd,IAAI,EACJ,KAAY,EACZ,WAAgC,EAChC,WAAmB,EACnB,QAAQ,GACT,EAAE,mBAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAmDzD"}
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/utils/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGpD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC;CACjE;AAED,MAAM,WAAW,qBAAqB,CAAC,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC;IACR,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,GAAG,CAAC;IACZ;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,eAAO,MAAM,WAAW,EAAE,mBAIzB,CAAC;AAIF,eAAO,MAAM,UAAU,6EAKpB,mBAAmB,SAQrB,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,cAAc,QAAS,MAAM,gBAAe,OAAO,KAAW,MAC9B,CAAC;AAqB9C;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,yDAOzB,KAAK,mBAAmB,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,OAAO,CAAC,WAGrE,CAAC;AAE1B;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,aAAc,MAAM,OAAO,MAAM,4BAAwB,MACpB,CAAC;AAsCrE,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;OAUG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAoBD;;;;;;;;;;GAUG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,cAAc,+EASxB,KACD,mBAAmB,EACnB,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,OAAO,GAAG,aAAa,CACjF,GAAG;IAAE,IAAI,EAAE,CAAC,CAAA;CAAE,KAAG,IAWjB,CAAC;AAEF,wBAAsB,KAAK,CAAC,CAAC,EAAE,EAC7B,GAAG,EACH,MAAc,EACd,IAAI,EACJ,KAAY,EACZ,WAAgC,EAChC,WAAmB,EACnB,QAAQ,EACR,OAAO,EACP,KAAK,EACL,QAAQ,EACR,SAAS,EACT,sBAA6B,GAC9B,EAAE,mBAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAsDzD;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,QAAQ,CAAC,EAC7B,GAAG,EACH,MAAc,EACd,IAAI,EACJ,WAAmB,EACnB,QAAQ,EACR,OAAO,EACP,KAAK,EACL,MAAc,EACd,sBAA6B,GAC9B,EAAE,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,aAAa,GAAG,UAAU,GAAG,WAAW,CAAC,GAAG;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAwC/B"}

package/dist/utils/fetch.js

@@ -1,4 +1,15 @@
 "use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -36,7 +47,7 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
     }
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.query = exports.setupFetch = exports.fetchConfig = void 0;
+exports.queryRaw = exports.query = exports.seedQueryCache = exports.buildReqraftApiUrl = exports.reqraftCacheKey = exports.reqraftApiPath = exports.setupFetch = exports.fetchConfig = void 0;
 var ReqraftProvider_1 = require("../providers/ReqraftProvider");
 exports.fetchConfig = {
     instance: window.location.origin + '/',
@@ -54,22 +65,89 @@ var setupFetch = function (_a) {
     }
 };
 exports.setupFetch = setupFetch;
+/**
+ * The API path a caller asked for, without the leading slash the prefix already
+ * carries.
+ *
+ * `doFetchData` builds `${instance}api/latest/${url}`, and that prefix ENDS in a
+ * slash — so a caller writing `/dataprovider/arg_schemas/x` produced
+ * `api/latest//dataprovider/arg_schemas/x`. Qorus serves it, which is how both
+ * spellings survived side by side (`useArgSchema` writes one, `CompactRow` and
+ * `AutoFormField` the other), but it is not harmless: the query cache is keyed
+ * on the url, so `/x` and `x` were two cache entries and two requests for one
+ * resource.
+ *
+ * Normalised here, once, rather than at each call site — the convention is
+ * invisible from a caller's point of view and the next one would get it wrong
+ * again. Only applied when the prefix is added: a caller that opts out of the
+ * prefix owns its whole path, leading slash included.
+ */
+var reqraftApiPath = function (url, noApiPrefix) {
+    if (noApiPrefix === void 0) { noApiPrefix = false; }
+    return noApiPrefix ? url : url.replace(/^\/+/, '');
+};
+exports.reqraftApiPath = reqraftApiPath;
+/**
+ * A cheap, stable, non-reversible marker for a bearer token.
+ *
+ * Two callers holding DIFFERENT tokens are two identities and must not share a
+ * cached response, so the token has to take part in the cache key — but a raw
+ * token in a key is a credential sitting in devtools' query inspector. djb2 is
+ * enough to tell two tokens apart, which is all the key needs.
+ */
+var tokenMarker = function (token) {
+    if (!token) {
+        return '';
+    }
+    var hash = 5381;
+    for (var index = 0; index < token.length; index++) {
+        hash = ((hash << 5) + hash + token.charCodeAt(index)) | 0;
+    }
+    return ":t".concat((hash >>> 0).toString(36));
+};
+/**
+ * The one cache key for a request, used by every caller in every downstream
+ * project so that one resource is one entry and one in-flight request.
+ *
+ * `instance` and the token take part because both change WHICH server and WHOSE
+ * data answers: a call that overrides the instance, or that carries an explicit
+ * token, is a different resource that happens to share a path.
+ */
+var reqraftCacheKey = function (_a) {
+    var url = _a.url, _b = _a.method, method = _b === void 0 ? 'GET' : _b, body = _a.body, noApiPrefix = _a.noApiPrefix, instance = _a.instance, token = _a.token;
+    return "".concat((0, exports.reqraftApiPath)(url, noApiPrefix), ":").concat(method, ":").concat(JSON.stringify(body || {})).concat(instance && instance !== exports.fetchConfig.instance ? ":@".concat(instance) : '').concat(tokenMarker(token));
+};
+exports.reqraftCacheKey = reqraftCacheKey;
+/**
+ * The URL `query()` requests for `url` on `instance` — the single definition.
+ * Story mocks build their URLs with it too, so they cannot drift from what the
+ * code actually dials.
+ *
+ * `noApiPrefix` means the caller owns the WHOLE url — an absolute address for
+ * another service, which is the only thing reqraft itself uses it for
+ * (`useExpressions` sets it exactly when `expressionsUrl` is `http(s)://…`).
+ * Prepending the instance there built `https://instance:8011/https://other/…`.
+ */
+var buildReqraftApiUrl = function (instance, url, noApiPrefix) {
+    if (noApiPrefix === void 0) { noApiPrefix = false; }
+    return noApiPrefix ? url : "".concat(instance, "api/latest/").concat((0, exports.reqraftApiPath)(url));
+};
+exports.buildReqraftApiUrl = buildReqraftApiUrl;
 function doFetchData(url_1) {
-    return __awaiter(this, arguments, void 0, function (url, method, body, noApiPrefix, instance) {
-        var headers;
+    return __awaiter(this, arguments, void 0, function (url, method, body, noApiPrefix, instance, headers, token) {
+        var finalHeaders, finalToken;
         if (method === void 0) { method = 'GET'; }
         if (noApiPrefix === void 0) { noApiPrefix = false; }
         if (instance === void 0) { instance = exports.fetchConfig.instance; }
         return __generator(this, function (_a) {
-            headers = {
-                'Content-Type': 'application/json',
-            };
-            if (exports.fetchConfig.instanceToken && !exports.fetchConfig.instanceRbacDisabled) {
-                headers['Authorization'] = "Bearer ".concat(exports.fetchConfig.instanceToken);
+            finalHeaders = __assign({ 'Content-Type': 'application/json' }, (headers !== null && headers !== void 0 ? headers : {}));
+            finalToken = token !== null && token !== void 0 ? token : (exports.fetchConfig.instanceRbacDisabled ? undefined : exports.fetchConfig.instanceToken);
+            if (finalToken && !finalHeaders['Authorization']) {
+                finalHeaders['Authorization'] = "Bearer ".concat(finalToken);
             }
-            return [2 /*return*/, fetch("".concat(instance).concat(noApiPrefix ? '' : 'api/latest/').concat(url), {
+            return [2 /*return*/, fetch((0, exports.buildReqraftApiUrl)(instance, url, noApiPrefix), {
                     method: method,
-                    headers: headers,
+                    headers: finalHeaders,
                     body: JSON.stringify(body),
                     credentials: 'include',
                 }).catch(function (error) {
@@ -81,61 +159,132 @@ function doFetchData(url_1) {
         });
     });
 }
+/**
+ * Reads a response body without consuming it, and says whether it was JSON.
+ *
+ * `data` stays `{}` for a body that is empty or not JSON, which is the contract
+ * reqraft's consumers have always been given. The text is handed back separately
+ * as `rawText` so an error that was not JSON still carries whatever the server
+ * said, instead of being flattened to a bare reason phrase.
+ */
+var readBody = function (response) { return __awaiter(void 0, void 0, void 0, function () {
+    var rawText;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0: return [4 /*yield*/, response.clone().text()];
+            case 1:
+                rawText = _a.sent();
+                try {
+                    return [2 /*return*/, { data: JSON.parse(rawText) }];
+                }
+                catch (_error) {
+                    return [2 /*return*/, { data: {}, rawText: rawText }];
+                }
+                return [2 /*return*/];
+        }
+    });
+}); };
+/**
+ * The single request mechanism.
+ *
+ * Every request in reqraft AND in the projects built on it goes through here,
+ * so that one resource has one cache entry and one in-flight request no matter
+ * which library, hook or component asked for it. A downstream project that
+ * keeps its own fetch helper (qorus-ide's `fetchData` is the one this was
+ * written for) should adapt onto this rather than hold a second cache: two
+ * caches over one API cannot see each other's in-flight requests, so any
+ * resource both libraries want is fetched twice by construction.
+ */
+/**
+ * Put a resource the HOST already has into the cache `query` reads.
+ *
+ * The comment on `query` states the problem: two caches over one API cannot see
+ * each other's in-flight requests, so any resource both libraries want is
+ * fetched twice by construction. This is the seam that lets a host settle it
+ * without either side giving up its own loader.
+ *
+ * The case it was written for: the Qorus IDE warm-starts
+ * `/system/qorus-type-info` from `index.html`, before the bundle has even
+ * parsed, because its whole boot gates on it — and then reqraft's own
+ * `useQorusTypes` asked for it again on the first form's mount. Measured on the
+ * live IDE at 419ms and 2777ms, the same URL, the same answer.
+ *
+ * Seeding is enough to stop the second request: `query` goes through
+ * `fetchQuery` with a `staleTime`, and a fresh entry is returned without the
+ * query function ever running. `useFetch` reads the same cache directly, so it
+ * also skips its loading state and renders the answer on its first paint.
+ *
+ * Only for a resource the host has genuinely FETCHED. Seeding a guess would
+ * make every consumer believe a request had succeeded.
+ */
+var seedQueryCache = function (_a) {
+    var url = _a.url, _b = _a.method, method = _b === void 0 ? 'GET' : _b, body = _a.body, noApiPrefix = _a.noApiPrefix, instance = _a.instance, token = _a.token, data = _a.data, _c = _a.queryClient, queryClient = _c === void 0 ? ReqraftProvider_1.ReqraftQueryClient : _c;
+    var key = (0, exports.reqraftCacheKey)({ url: url, method: method, body: body, noApiPrefix: noApiPrefix, instance: instance, token: token });
+    queryClient.setQueryData([key], {
+        data: data,
+        rawText: undefined,
+        ok: true,
+        status: 200,
+        statusText: 'OK',
+        response: undefined,
+    });
+};
+exports.seedQueryCache = seedQueryCache;
 function query(_a) {
     return __awaiter(this, arguments, void 0, function (_b) {
-        var shouldCache, cacheKey, requestData;
+        var shouldCache, key, requestData;
         var _this = this;
-        var url = _b.url, _c = _b.method, method = _c === void 0 ? 'GET' : _c, body = _b.body, _d = _b.cache, cache = _d === void 0 ? true : _d, _e = _b.queryClient, queryClient = _e === void 0 ? ReqraftProvider_1.ReqraftQueryClient : _e, _f = _b.noApiPrefix, noApiPrefix = _f === void 0 ? false : _f, instance = _b.instance;
-        return __generator(this, function (_g) {
-            switch (_g.label) {
+        var url = _b.url, _c = _b.method, method = _c === void 0 ? 'GET' : _c, body = _b.body, _d = _b.cache, cache = _d === void 0 ? true : _d, _e = _b.queryClient, queryClient = _e === void 0 ? ReqraftProvider_1.ReqraftQueryClient : _e, _f = _b.noApiPrefix, noApiPrefix = _f === void 0 ? false : _f, instance = _b.instance, headers = _b.headers, token = _b.token, cacheKey = _b.cacheKey, staleTime = _b.staleTime, _g = _b.redirectOnUnauthorized, redirectOnUnauthorized = _g === void 0 ? true : _g;
+        return __generator(this, function (_h) {
+            switch (_h.label) {
                 case 0:
                     shouldCache = method === 'DELETE' || method === 'POST' ? false : cache;
-                    cacheKey = "".concat(url, ":").concat(method, ":").concat(JSON.stringify(body || {}));
+                    key = cacheKey !== null && cacheKey !== void 0 ? cacheKey : (0, exports.reqraftCacheKey)({ url: url, method: method, body: body, noApiPrefix: noApiPrefix, instance: instance, token: token });
                     return [4 /*yield*/, queryClient.fetchQuery({
-                            queryKey: [cacheKey],
+                            queryKey: [key],
                             queryFn: function () { return __awaiter(_this, void 0, void 0, function () {
-                                var response, clone, data, error_1;
-                                return __generator(this, function (_a) {
-                                    switch (_a.label) {
-                                        case 0: return [4 /*yield*/, doFetchData(url, method, body, noApiPrefix, instance)];
+                                var response, _a, data, rawText;
+                                return __generator(this, function (_b) {
+                                    switch (_b.label) {
+                                        case 0: return [4 /*yield*/, doFetchData(url, method, body, noApiPrefix, instance, headers, token)];
                                         case 1:
-                                            response = _a.sent();
-                                            if (response.status === 401 && exports.fetchConfig.unauthorizedRedirect) {
-                                                window.location.href = exports.fetchConfig.unauthorizedRedirect(window.location);
+                                            response = _b.sent();
+                                            if (response.status === 401 && redirectOnUnauthorized && exports.fetchConfig.unauthorizedRedirect) {
+                                                // `replace`, not an assignment: the page being left is dead, and a
+                                                // history entry for it means Back lands on a view that can only 401
+                                                // again.
+                                                window.location.replace(exports.fetchConfig.unauthorizedRedirect(window.location));
                                             }
-                                            clone = response.clone();
-                                            _a.label = 2;
+                                            return [4 /*yield*/, readBody(response)];
                                         case 2:
-                                            _a.trys.push([2, 4, , 5]);
-                                            return [4 /*yield*/, clone.json()];
-                                        case 3:
-                                            data = _a.sent();
-                                            return [3 /*break*/, 5];
-                                        case 4:
-                                            error_1 = _a.sent();
-                                            data = {};
-                                            return [3 /*break*/, 5];
-                                        case 5: return [2 /*return*/, {
-                                                data: data,
-                                                ok: response.ok,
-                                                status: response.status,
-                                                statusText: response.statusText,
-                                                response: response,
-                                            }];
+                                            _a = _b.sent(), data = _a.data, rawText = _a.rawText;
+                                            return [2 /*return*/, {
+                                                    data: data,
+                                                    rawText: rawText,
+                                                    ok: response.ok,
+                                                    status: response.status,
+                                                    statusText: response.statusText,
+                                                    response: response,
+                                                }];
                                     }
                                 });
                             }); },
-                            staleTime: shouldCache ? CACHE_EXPIRATION_TIME : 0,
+                            staleTime: shouldCache ? (staleTime !== null && staleTime !== void 0 ? staleTime : CACHE_EXPIRATION_TIME) : 0,
                         })];
                 case 1:
-                    requestData = _g.sent();
+                    requestData = _h.sent();
                     if (!requestData.ok) {
-                        queryClient.invalidateQueries({ queryKey: [cacheKey] });
+                        queryClient.invalidateQueries({ queryKey: [key] });
                         return [2 /*return*/, {
                                 data: requestData.data,
                                 ok: false,
                                 code: requestData.status,
                                 error: requestData.statusText,
+                                // Only when the body really was JSON: `data` is `{}` for a non-JSON body,
+                                // and an empty object masquerading as a parsed error tells a caller
+                                // nothing while looking like it did.
+                                errorBody: requestData.rawText === undefined ? requestData.data : undefined,
+                                rawText: requestData.rawText,
                                 response: requestData.response,
                             }];
                     }
@@ -143,6 +292,7 @@ function query(_a) {
                             data: requestData.data,
                             ok: true,
                             code: requestData.status,
+                            rawText: requestData.rawText,
                             response: requestData.response,
                         }];
             }
@@ -150,4 +300,66 @@ function query(_a) {
     });
 }
 exports.query = query;
+/**
+ * Fetch a resource whose body is NOT JSON — a file, an export, a log.
+ *
+ * Shares `doFetchData` with `query`, which owns the API prefix, the bearer token
+ * and `credentials: 'include'`. The point is that raw responses do not become a
+ * second, drifting copy of that auth handling.
+ *
+ * Nothing is cached: these payloads are large and read once.
+ *
+ * @param accept the `Accept` header. Endpoints that negotiate on the file's own
+ *   MIME type answer **406** unless the caller accepts that type, and the caller
+ *   usually cannot know it ahead of time, so this accepts anything by default.
+ */
+function queryRaw(_a) {
+    return __awaiter(this, arguments, void 0, function (_b) {
+        var response, error, _error_1, error_1;
+        var _c;
+        var _d, _e;
+        var url = _b.url, _f = _b.method, method = _f === void 0 ? 'GET' : _f, body = _b.body, _g = _b.noApiPrefix, noApiPrefix = _g === void 0 ? false : _g, instance = _b.instance, headers = _b.headers, token = _b.token, _h = _b.accept, accept = _h === void 0 ? '*/*' : _h, _j = _b.redirectOnUnauthorized, redirectOnUnauthorized = _j === void 0 ? true : _j;
+        return __generator(this, function (_k) {
+            switch (_k.label) {
+                case 0:
+                    _k.trys.push([0, 8, , 9]);
+                    return [4 /*yield*/, doFetchData(url, method, body, noApiPrefix, instance, __assign({ Accept: accept }, (headers !== null && headers !== void 0 ? headers : {})), token)];
+                case 1:
+                    response = _k.sent();
+                    if (response.status === 401 && redirectOnUnauthorized && exports.fetchConfig.unauthorizedRedirect) {
+                        window.location.replace(exports.fetchConfig.unauthorizedRedirect(window.location));
+                    }
+                    if (!!response.ok) return [3 /*break*/, 6];
+                    error = void 0;
+                    _k.label = 2;
+                case 2:
+                    _k.trys.push([2, 4, , 5]);
+                    return [4 /*yield*/, response.json()];
+                case 3:
+                    // an error body is still JSON even when the success body is not
+                    error = (_d = (_k.sent()).desc) !== null && _d !== void 0 ? _d : response.statusText;
+                    return [3 /*break*/, 5];
+                case 4:
+                    _error_1 = _k.sent();
+                    error = response.statusText;
+                    return [3 /*break*/, 5];
+                case 5: return [2 /*return*/, { ok: false, code: response.status, error: error }];
+                case 6:
+                    _c = {
+                        ok: true,
+                        code: response.status
+                    };
+                    return [4 /*yield*/, response.blob()];
+                case 7: return [2 /*return*/, (_c.blob = _k.sent(),
+                        _c.mime = ((_e = response.headers.get('content-type')) !== null && _e !== void 0 ? _e : '').split(';')[0].trim() || undefined,
+                        _c)];
+                case 8:
+                    error_1 = _k.sent();
+                    return [2 /*return*/, { ok: false, error: error_1 instanceof Error ? error_1.message : String(error_1) }];
+                case 9: return [2 /*return*/];
+            }
+        });
+    });
+}
+exports.queryRaw = queryRaw;
 //# sourceMappingURL=fetch.js.map