@umbraco-cms/backoffice 17.6.2 → 17.7.0-rc

package/dist-cms/packages/core/auth/umb-auth-client.d.ts

@@ -27,12 +27,18 @@ export declare class UmbAuthClient {
     get state(): string | undefined;
     /**
      * Generates PKCE parameters and builds the authorization URL.
+     * @param {string} identityProvider The provider to use for login.
+     * @param {string} [usernameHint] The username hint to use for login.
+     * @returns {Promise<string>} The authorization URL.
      */
     buildAuthorizationUrl(identityProvider: string, usernameHint?: string): Promise<string>;
     /**
      * Exchanges an authorization code for tokens.
      * Real tokens are stored in httpOnly cookies by the server.
      * We only extract session timing from the response.
+     * @param {string} code The authorization code to exchange.
+     * @param {string} codeVerifier The PKCE code verifier matching the original request.
+     * @returns {Promise<UmbTokenEndpointResponse | undefined>} The token response timing, or undefined on failure.
      */
     exchangeCode(code: string, codeVerifier: string): Promise<UmbTokenEndpointResponse | undefined>;
     /**
@@ -41,6 +47,7 @@ export declare class UmbAuthClient {
      * `HideBackOfficeTokensHandler` intercepts the request and swaps it for
      * the real token from the httpOnly cookie. The parameter must be present
      * (OpenIddict's pipeline requires it) but the value is ignored by the handler.
+     * @returns {Promise<UmbTokenRequestResult>} The token request result.
      */
     refreshToken(): Promise<UmbTokenRequestResult>;
     /**

package/dist-cms/packages/core/auth/umb-auth-client.js

@@ -1,4 +1,9 @@
 const CHARSET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+/**
+ * Maps random bytes to a string of characters from {@link CHARSET}.
+ * @param {Uint8Array} buffer The random bytes to map.
+ * @returns {string} The resulting string.
+ */
 function bufferToString(buffer) {
     const state = [];
     for (let i = 0; i < buffer.byteLength; i += 1) {
@@ -6,6 +11,11 @@ function bufferToString(buffer) {
     }
     return state.join('');
 }
+/**
+ * Encodes a buffer as URL-safe base64 (no `+`, `/`, or padding).
+ * @param {ArrayBuffer} buffer The buffer to encode.
+ * @returns {string} The URL-safe base64 string.
+ */
 function urlSafeBase64(buffer) {
     const bytes = new Uint8Array(buffer);
     let binary = '';
@@ -14,17 +24,119 @@ function urlSafeBase64(buffer) {
     }
     return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
 }
+/**
+ * Generates a cryptographically random string of the given length.
+ * @param {number} size The number of random bytes to generate.
+ * @returns {string} The generated random string.
+ */
 function generateRandom(size) {
     const buffer = new Uint8Array(size);
     crypto.getRandomValues(buffer);
     return bufferToString(buffer);
 }
+/**
+ * Derives the PKCE code challenge from a code verifier via SHA-256.
+ * @param {string} codeVerifier The PKCE code verifier.
+ * @returns {Promise<string>} The derived code challenge.
+ */
 async function deriveChallenge(codeVerifier) {
     const encoder = new TextEncoder();
     const data = encoder.encode(codeVerifier);
-    const hash = await crypto.subtle.digest('SHA-256', data);
+    // crypto.subtle only exists in secure contexts (https or localhost). Fall back to a local
+    // SHA-256 implementation so login still works over plain http, e.g. http://<ip> dev setups.
+    const hash = crypto.subtle ? await crypto.subtle.digest('SHA-256', data) : sha256(data);
     return urlSafeBase64(hash);
 }
+// SHA-256 (FIPS 180-4) round constants: first 32 bits of the fractional parts of the
+// cube roots of the first 64 primes.
+// prettier-ignore
+const SHA256_K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+/**
+ * Rotates a 32-bit unsigned integer right by n bits.
+ * @param {number} x The value to rotate.
+ * @param {number} n The number of bits to rotate by.
+ * @returns {number} The rotated value as an unsigned 32-bit integer.
+ */
+function rotr(x, n) {
+    return ((x >>> n) | (x << (32 - n))) >>> 0;
+}
+/**
+ * Plain-JavaScript SHA-256 (FIPS 180-4), used ONLY to derive the PKCE code challenge when
+ * `crypto.subtle` is unavailable (insecure contexts, e.g. http://<ip> dev setups).
+ * Verified byte-for-byte against `crypto.subtle.digest` in unit tests.
+ *
+ * An in-repo implementation is acceptable for this narrow case because a wrong digest fails
+ * closed: the server recomputes and compares the challenge at token exchange, so any deviation
+ * breaks login — it cannot weaken the flow. Do NOT reuse this for anything security-sensitive;
+ * use `crypto.subtle`. Removed together with the PKCE flow in V19.
+ * @param {Uint8Array} data The bytes to hash.
+ * @returns {ArrayBuffer} The 32-byte digest.
+ */
+function sha256(data) {
+    const state = new Uint32Array([
+        0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+    ]);
+    // Pad the message: append 0x80, zero-fill, then the 64-bit big-endian bit length.
+    const byteLength = data.length;
+    const paddedLength = (((byteLength + 8) >> 6) + 1) << 6;
+    const padded = new Uint8Array(paddedLength);
+    padded.set(data);
+    padded[byteLength] = 0x80;
+    const view = new DataView(padded.buffer);
+    view.setUint32(paddedLength - 8, Math.floor(byteLength / 0x20000000));
+    view.setUint32(paddedLength - 4, (byteLength << 3) >>> 0);
+    const w = new Uint32Array(64);
+    for (let offset = 0; offset < paddedLength; offset += 64) {
+        for (let i = 0; i < 16; i++) {
+            w[i] = view.getUint32(offset + i * 4);
+        }
+        for (let i = 16; i < 64; i++) {
+            const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3);
+            const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10);
+            w[i] = (w[i - 16] + s0 + w[i - 7] + s1) >>> 0;
+        }
+        let [a, b, c, d, e, f, g, h] = state;
+        for (let i = 0; i < 64; i++) {
+            const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+            const ch = (e & f) ^ (~e & g);
+            const temp1 = (h + S1 + ch + SHA256_K[i] + w[i]) >>> 0;
+            const S0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+            const maj = (a & b) ^ (a & c) ^ (b & c);
+            const temp2 = (S0 + maj) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = (d + temp1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (temp1 + temp2) >>> 0;
+        }
+        state[0] = (state[0] + a) >>> 0;
+        state[1] = (state[1] + b) >>> 0;
+        state[2] = (state[2] + c) >>> 0;
+        state[3] = (state[3] + d) >>> 0;
+        state[4] = (state[4] + e) >>> 0;
+        state[5] = (state[5] + f) >>> 0;
+        state[6] = (state[6] + g) >>> 0;
+        state[7] = (state[7] + h) >>> 0;
+    }
+    const digest = new Uint8Array(32);
+    const digestView = new DataView(digest.buffer);
+    for (let i = 0; i < 8; i++) {
+        digestView.setUint32(i * 4, state[i]);
+    }
+    return digest.buffer;
+}
 /**
  * Minimal PKCE + token endpoint client.
  * All token values are `[redacted]` with cookie auth — this client only tracks session timing.
@@ -52,6 +164,9 @@ export class UmbAuthClient {
     }
     /**
      * Generates PKCE parameters and builds the authorization URL.
+     * @param {string} identityProvider The provider to use for login.
+     * @param {string} [usernameHint] The username hint to use for login.
+     * @returns {Promise<string>} The authorization URL.
      */
     async buildAuthorizationUrl(identityProvider, usernameHint) {
         this.#codeVerifier = generateRandom(128);
@@ -83,6 +198,9 @@ export class UmbAuthClient {
      * Exchanges an authorization code for tokens.
      * Real tokens are stored in httpOnly cookies by the server.
      * We only extract session timing from the response.
+     * @param {string} code The authorization code to exchange.
+     * @param {string} codeVerifier The PKCE code verifier matching the original request.
+     * @returns {Promise<UmbTokenEndpointResponse | undefined>} The token response timing, or undefined on failure.
      */
     async exchangeCode(code, codeVerifier) {
         /* eslint-disable @typescript-eslint/naming-convention */
@@ -102,6 +220,7 @@ export class UmbAuthClient {
      * `HideBackOfficeTokensHandler` intercepts the request and swaps it for
      * the real token from the httpOnly cookie. The parameter must be present
      * (OpenIddict's pipeline requires it) but the value is ignored by the handler.
+     * @returns {Promise<UmbTokenRequestResult>} The token request result.
      */
     async refreshToken() {
         /* eslint-disable @typescript-eslint/naming-convention */

package/dist-cms/packages/core/backend-api/client/client.gen.js

@@ -19,10 +19,7 @@ export const createClient = (config = {}) => {
             serializedBody: undefined,
         };
         if (opts.security) {
-            await setAuthParams({
-                ...opts,
-                security: opts.security,
-            });
+            await setAuthParams(opts);
         }
         if (opts.requestValidator) {
             await opts.requestValidator(opts);
@@ -34,125 +31,139 @@ export const createClient = (config = {}) => {
         if (opts.body === undefined || opts.serializedBody === '') {
             opts.headers.delete('Content-Type');
         }
-        const url = buildUrl(opts);
-        return { opts, url };
+        const resolvedOpts = opts;
+        const url = buildUrl(resolvedOpts);
+        return { opts: resolvedOpts, url };
     };
     const request = async (options) => {
-        // @ts-expect-error
-        const { opts, url } = await beforeRequest(options);
-        const requestInit = {
-            redirect: 'follow',
-            ...opts,
-            body: getValidRequestBody(opts),
-        };
-        let request = new Request(url, requestInit);
-        for (const fn of interceptors.request.fns) {
-            if (fn) {
-                request = await fn(request, opts);
+        const throwOnError = options.throwOnError ?? _config.throwOnError;
+        const responseStyle = options.responseStyle ?? _config.responseStyle;
+        let request;
+        let response;
+        try {
+            const { opts, url } = await beforeRequest(options);
+            const requestInit = {
+                redirect: 'follow',
+                ...opts,
+                body: getValidRequestBody(opts),
+            };
+            request = new Request(url, requestInit);
+            for (const fn of interceptors.request.fns) {
+                if (fn) {
+                    request = await fn(request, opts);
+                }
             }
-        }
-        // fetch must be assigned here, otherwise it would throw the error:
-        // TypeError: Failed to execute 'fetch' on 'Window': Illegal invocation
-        const _fetch = opts.fetch;
-        let response = await _fetch(request);
-        for (const fn of interceptors.response.fns) {
-            if (fn) {
-                response = await fn(response, request, opts);
+            // fetch must be assigned here, otherwise it would throw the error:
+            // TypeError: Failed to execute 'fetch' on 'Window': Illegal invocation
+            const _fetch = opts.fetch;
+            response = await _fetch(request);
+            for (const fn of interceptors.response.fns) {
+                if (fn) {
+                    response = await fn(response, request, opts);
+                }
             }
-        }
-        const result = {
-            request,
-            response,
-        };
-        if (response.ok) {
-            const parseAs = (opts.parseAs === 'auto'
-                ? getParseAs(response.headers.get('Content-Type'))
-                : opts.parseAs) ?? 'json';
-            if (response.status === 204 ||
-                response.headers.get('Content-Length') === '0') {
-                let emptyData;
+            const result = {
+                request,
+                response,
+            };
+            if (response.ok) {
+                const parseAs = (opts.parseAs === 'auto'
+                    ? getParseAs(response.headers.get('Content-Type'))
+                    : opts.parseAs) ?? 'json';
+                if (response.status === 204 || response.headers.get('Content-Length') === '0') {
+                    let emptyData;
+                    switch (parseAs) {
+                        case 'arrayBuffer':
+                        case 'blob':
+                        case 'text':
+                            emptyData = await response[parseAs]();
+                            break;
+                        case 'formData':
+                            emptyData = new FormData();
+                            break;
+                        case 'stream':
+                            emptyData = response.body;
+                            break;
+                        case 'json':
+                        default:
+                            emptyData = {};
+                            break;
+                    }
+                    return opts.responseStyle === 'data'
+                        ? emptyData
+                        : {
+                            data: emptyData,
+                            ...result,
+                        };
+                }
+                let data;
                 switch (parseAs) {
                     case 'arrayBuffer':
                     case 'blob':
+                    case 'formData':
                     case 'text':
-                        emptyData = await response[parseAs]();
+                        data = await response[parseAs]();
                         break;
-                    case 'formData':
-                        emptyData = new FormData();
+                    case 'json': {
+                        // Some servers return 200 with no Content-Length and empty body.
+                        // response.json() would throw; read as text and parse if non-empty.
+                        const text = await response.text();
+                        data = text ? JSON.parse(text) : {};
                         break;
+                    }
                     case 'stream':
-                        emptyData = response.body;
-                        break;
-                    case 'json':
-                    default:
-                        emptyData = {};
-                        break;
+                        return opts.responseStyle === 'data'
+                            ? response.body
+                            : {
+                                data: response.body,
+                                ...result,
+                            };
+                }
+                if (parseAs === 'json') {
+                    if (opts.responseValidator) {
+                        await opts.responseValidator(data);
+                    }
+                    if (opts.responseTransformer) {
+                        data = await opts.responseTransformer(data);
+                    }
                 }
                 return opts.responseStyle === 'data'
-                    ? emptyData
+                    ? data
                     : {
-                        data: emptyData,
+                        data,
                         ...result,
                     };
             }
-            let data;
-            switch (parseAs) {
-                case 'arrayBuffer':
-                case 'blob':
-                case 'formData':
-                case 'json':
-                case 'text':
-                    data = await response[parseAs]();
-                    break;
-                case 'stream':
-                    return opts.responseStyle === 'data'
-                        ? response.body
-                        : {
-                            data: response.body,
-                            ...result,
-                        };
+            const textError = await response.text();
+            let jsonError;
+            try {
+                jsonError = JSON.parse(textError);
             }
-            if (parseAs === 'json') {
-                if (opts.responseValidator) {
-                    await opts.responseValidator(data);
-                }
-                if (opts.responseTransformer) {
-                    data = await opts.responseTransformer(data);
+            catch {
+                // noop
+            }
+            throw jsonError ?? textError;
+        }
+        catch (error) {
+            let finalError = error;
+            for (const fn of interceptors.error.fns) {
+                if (fn) {
+                    finalError = await fn(finalError, response, request, options);
                 }
             }
-            return opts.responseStyle === 'data'
-                ? data
+            finalError = finalError || {};
+            if (throwOnError) {
+                throw finalError;
+            }
+            // TODO: we probably want to return error and improve types
+            return responseStyle === 'data'
+                ? undefined
                 : {
-                    data,
-                    ...result,
+                    error: finalError,
+                    request,
+                    response,
                 };
         }
-        const textError = await response.text();
-        let jsonError;
-        try {
-            jsonError = JSON.parse(textError);
-        }
-        catch {
-            // noop
-        }
-        const error = jsonError ?? textError;
-        let finalError = error;
-        for (const fn of interceptors.error.fns) {
-            if (fn) {
-                finalError = (await fn(error, response, request, opts));
-            }
-        }
-        finalError = finalError || {};
-        if (opts.throwOnError) {
-            throw finalError;
-        }
-        // TODO: we probably want to return error and improve types
-        return opts.responseStyle === 'data'
-            ? undefined
-            : {
-                error: finalError,
-                ...result,
-            };
     };
     const makeMethodFn = (method) => (options) => request({ ...options, method });
     const makeSseFn = (method) => async (options) => {
@@ -160,7 +171,6 @@ export const createClient = (config = {}) => {
         return createSseClient({
             ...opts,
             body: opts.body,
-            headers: opts.headers,
             method,
             onRequest: async (url, init) => {
                 let request = new Request(url, init);
@@ -171,11 +181,13 @@ export const createClient = (config = {}) => {
                 }
                 return request;
             },
+            serializedBody: getValidRequestBody(opts),
             url,
         });
     };
+    const _buildUrl = (options) => buildUrl({ ..._config, ...options });
     return {
-        buildUrl,
+        buildUrl: _buildUrl,
         connect: makeMethodFn('CONNECT'),
         delete: makeMethodFn('DELETE'),
         get: makeMethodFn('GET'),

package/dist-cms/packages/core/backend-api/client/index.d.ts

@@ -3,6 +3,8 @@ export type { QuerySerializerOptions } from '../core/bodySerializer.gen.js';
 export { formDataBodySerializer, jsonBodySerializer, urlSearchParamsBodySerializer, } from '../core/bodySerializer.gen.js';
 export { buildClientParams } from '../core/params.gen.js';
 export { serializeQueryKeyValue } from '../core/queryKeySerializer.gen.js';
+export type { ServerSentEventsResult } from '../core/serverSentEvents.gen.js';
+export type { ClientMeta } from '../core/types.gen.js';
 export { createClient } from './client.gen.js';
-export type { Client, ClientOptions, Config, CreateClientConfig, Options, OptionsLegacyParser, RequestOptions, RequestResult, ResolvedRequestOptions, ResponseStyle, TDataShape, } from './types.gen.js';
+export type { Client, ClientOptions, Config, CreateClientConfig, Options, RequestOptions, RequestResult, ResolvedRequestOptions, ResponseStyle, TDataShape, } from './types.gen.js';
 export { createConfig, mergeHeaders } from './utils.gen.js';

package/dist-cms/packages/core/backend-api/client/types.gen.d.ts

@@ -47,7 +47,7 @@ export interface Config<T extends ClientOptions = ClientOptions> extends Omit<Re
 export interface RequestOptions<TData = unknown, TResponseStyle extends ResponseStyle = 'fields', ThrowOnError extends boolean = boolean, Url extends string = string> extends Config<{
     responseStyle: TResponseStyle;
     throwOnError: ThrowOnError;
-}>, Pick<ServerSentEventsOptions<TData>, 'onSseError' | 'onSseEvent' | 'sseDefaultRetryDelay' | 'sseMaxRetryAttempts' | 'sseMaxRetryDelay'> {
+}>, Pick<ServerSentEventsOptions<TData>, 'onRequest' | 'onSseError' | 'onSseEvent' | 'sseDefaultRetryDelay' | 'sseMaxRetryAttempts' | 'sseMaxRetryDelay'> {
     /**
      * Any body that you want to add to your request.
      *
@@ -63,6 +63,7 @@ export interface RequestOptions<TData = unknown, TResponseStyle extends Response
     url: Url;
 }
 export interface ResolvedRequestOptions<TResponseStyle extends ResponseStyle = 'fields', ThrowOnError extends boolean = boolean, Url extends string = string> extends RequestOptions<unknown, TResponseStyle, ThrowOnError, Url> {
+    headers: Headers;
     serializedBody?: string;
 }
 export type RequestResult<TData = unknown, TError = unknown, ThrowOnError extends boolean = boolean, TResponseStyle extends ResponseStyle = 'fields'> = ThrowOnError extends true ? Promise<TResponseStyle extends 'data' ? TData extends Record<string, unknown> ? TData[keyof TData] : TData : {
@@ -76,8 +77,10 @@ export type RequestResult<TData = unknown, TError = unknown, ThrowOnError extend
     data: undefined;
     error: TError extends Record<string, unknown> ? TError[keyof TError] : TError;
 }) & {
-    request: Request;
-    response: Response;
+    /** request may be undefined, because error may be from building the request object itself */
+    request?: Request;
+    /** response may be undefined, because error may be from building the request object itself or from a network error */
+    response?: Response;
 }>;
 export interface ClientOptions {
     baseUrl?: string;
@@ -85,14 +88,14 @@ export interface ClientOptions {
     throwOnError?: boolean;
 }
 type MethodFn = <TData = unknown, TError = unknown, ThrowOnError extends boolean = false, TResponseStyle extends ResponseStyle = 'fields'>(options: Omit<RequestOptions<TData, TResponseStyle, ThrowOnError>, 'method'>) => RequestResult<TData, TError, ThrowOnError, TResponseStyle>;
-type SseFn = <TData = unknown, TError = unknown, ThrowOnError extends boolean = false, TResponseStyle extends ResponseStyle = 'fields'>(options: Omit<RequestOptions<TData, TResponseStyle, ThrowOnError>, 'method'>) => Promise<ServerSentEventsResult<TData, TError>>;
+type SseFn = <TData = unknown, _TError = unknown, ThrowOnError extends boolean = false, TResponseStyle extends ResponseStyle = 'fields'>(options: Omit<RequestOptions<never, TResponseStyle, ThrowOnError>, 'method'>) => Promise<ServerSentEventsResult<TData>>;
 type RequestFn = <TData = unknown, TError = unknown, ThrowOnError extends boolean = false, TResponseStyle extends ResponseStyle = 'fields'>(options: Omit<RequestOptions<TData, TResponseStyle, ThrowOnError>, 'method'> & Pick<Required<RequestOptions<TData, TResponseStyle, ThrowOnError>>, 'method'>) => RequestResult<TData, TError, ThrowOnError, TResponseStyle>;
 type BuildUrlFn = <TData extends {
     body?: unknown;
     path?: Record<string, unknown>;
     query?: Record<string, unknown>;
     url: string;
-}>(options: Pick<TData, 'url'> & Options<TData>) => string;
+}>(options: TData & Options<TData>) => string;
 export type Client = CoreClient<RequestFn, Config, MethodFn, BuildUrlFn, SseFn> & {
     interceptors: Middleware<Request, Response, unknown, ResolvedRequestOptions>;
 };
@@ -113,12 +116,5 @@ export interface TDataShape {
     url: string;
 }
 type OmitKeys<T, K> = Pick<T, Exclude<keyof T, K>>;
-export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean, TResponse = unknown, TResponseStyle extends ResponseStyle = 'fields'> = OmitKeys<RequestOptions<TResponse, TResponseStyle, ThrowOnError>, 'body' | 'path' | 'query' | 'url'> & Omit<TData, 'url'>;
-export type OptionsLegacyParser<TData = unknown, ThrowOnError extends boolean = boolean, TResponseStyle extends ResponseStyle = 'fields'> = TData extends {
-    body?: any;
-} ? TData extends {
-    headers?: any;
-} ? OmitKeys<RequestOptions<unknown, TResponseStyle, ThrowOnError>, 'body' | 'headers' | 'url'> & TData : OmitKeys<RequestOptions<unknown, TResponseStyle, ThrowOnError>, 'body' | 'url'> & TData & Pick<RequestOptions<unknown, TResponseStyle, ThrowOnError>, 'headers'> : TData extends {
-    headers?: any;
-} ? OmitKeys<RequestOptions<unknown, TResponseStyle, ThrowOnError>, 'headers' | 'url'> & TData & Pick<RequestOptions<unknown, TResponseStyle, ThrowOnError>, 'body'> : OmitKeys<RequestOptions<unknown, TResponseStyle, ThrowOnError>, 'url'> & TData;
+export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean, TResponse = unknown, TResponseStyle extends ResponseStyle = 'fields'> = OmitKeys<RequestOptions<TResponse, TResponseStyle, ThrowOnError>, 'body' | 'path' | 'query' | 'url'> & ([TData] extends [never] ? unknown : Omit<TData, 'url'>);
 export {};

package/dist-cms/packages/core/backend-api/client/utils.gen.d.ts

@@ -1,17 +1,21 @@
 import type { QuerySerializerOptions } from '../core/bodySerializer.gen.js';
 import type { Client, ClientOptions, Config, RequestOptions } from './types.gen.js';
-export declare const createQuerySerializer: <T = unknown>({ allowReserved, array, object, }?: QuerySerializerOptions) => (queryParams: T) => string;
+export declare const createQuerySerializer: <T = unknown>({ parameters, ...args }?: QuerySerializerOptions) => ((queryParams: T) => string);
 /**
  * Infers parseAs value from provided Content-Type header.
  */
 export declare const getParseAs: (contentType: string | null) => Exclude<Config["parseAs"], "auto">;
-export declare const setAuthParams: ({ security, ...options }: Pick<Required<RequestOptions>, "security"> & Pick<RequestOptions, "auth" | "query"> & {
+export declare function setAuthParams(options: Pick<RequestOptions, 'auth' | 'query' | 'security'> & {
     headers: Headers;
-}) => Promise<void>;
+}): Promise<void>;
 export declare const buildUrl: Client['buildUrl'];
 export declare const mergeConfigs: (a: Config, b: Config) => Config;
 export declare const mergeHeaders: (...headers: Array<Required<Config>["headers"] | undefined>) => Headers;
-type ErrInterceptor<Err, Res, Req, Options> = (error: Err, response: Res, request: Req, options: Options) => Err | Promise<Err>;
+type ErrInterceptor<Err, Res, Req, Options> = (error: Err, 
+/** response may be undefined due to a network error where no response object is produced */
+response: Res | undefined, 
+/** request may be undefined, because error may be from building the request object itself */
+request: Req | undefined, options: Options) => Err | Promise<Err>;
 type ReqInterceptor<Req, Options> = (request: Req, options: Options) => Req | Promise<Req>;
 type ResInterceptor<Res, Req, Options> = (response: Res, request: Req, options: Options) => Res | Promise<Res>;
 declare class Interceptors<Interceptor> {