@webpieces/http-client-browser 0.4.607 → 0.4.608

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/http-client-browser",
-  "version": "0.4.607",
+  "version": "0.4.608",
   "description": "Browser HTTP client for webpieces: DI-free (React or Angular), app-managed context store, no AsyncLocalStorage",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -22,7 +22,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@webpieces/core-util": "0.4.607",
-    "@webpieces/http-client-core": "0.4.607"
+    "@webpieces/core-util": "0.4.608",
+    "@webpieces/http-client-core": "0.4.608"
   }
 }

package/src/BrowserProxyClient.d.ts

@@ -49,6 +49,17 @@ export declare class BrowserProxyClient extends ProxyClient {
      * Reject a contract this browser cannot satisfy, at bind time rather than on the first call.
      * Both service-to-service modes need credentials only a server has: @AuthOidc needs a runtime
      * service account to mint a token, @AuthSharedSecret needs a secret no browser may ship.
+     *
+     * @AuthLocalOnly is deliberately NOT rejected: a browser calling a dev-only endpoint on the
+     * developer's own server is the motivating case for that mode (shipping browser logs into the
+     * server log). It needs no credential — the server refuses it off-local by not having the route.
+     *
+     * An exhaustive switch with NO `default`, like {@link DestinationTrust.forAuthMode} and
+     * `AuthFilter.verifiesCaller`. This was a NEGATIVE allow-list (`kind !== 'oidc' && kind !==
+     * 'shared-secret'`), which silently WAVED THROUGH any future AuthMode kind — the browser would
+     * have bound a contract it cannot satisfy and failed on the first call instead of at bind time.
+     * Adding `local-only` is what surfaced it: the third reader of the union should fail to compile
+     * on a sixth kind for the same reason the other two do.
      */
     protected assertEndpointSupported(authMeta: AuthMeta | undefined, methodName: string): void;
 }

package/src/BrowserProxyClient.js

@@ -65,14 +65,34 @@ class BrowserProxyClient extends http_client_core_1.ProxyClient {
      * Reject a contract this browser cannot satisfy, at bind time rather than on the first call.
      * Both service-to-service modes need credentials only a server has: @AuthOidc needs a runtime
      * service account to mint a token, @AuthSharedSecret needs a secret no browser may ship.
+     *
+     * @AuthLocalOnly is deliberately NOT rejected: a browser calling a dev-only endpoint on the
+     * developer's own server is the motivating case for that mode (shipping browser logs into the
+     * server log). It needs no credential — the server refuses it off-local by not having the route.
+     *
+     * An exhaustive switch with NO `default`, like {@link DestinationTrust.forAuthMode} and
+     * `AuthFilter.verifiesCaller`. This was a NEGATIVE allow-list (`kind !== 'oidc' && kind !==
+     * 'shared-secret'`), which silently WAVED THROUGH any future AuthMode kind — the browser would
+     * have bound a contract it cannot satisfy and failed on the first call instead of at bind time.
+     * Adding `local-only` is what surfaced it: the third reader of the union should fail to compile
+     * on a sixth kind for the same reason the other two do.
      */
     assertEndpointSupported(authMeta, methodName) {
-        const kind = authMeta?.mode.kind;
-        if (kind !== 'oidc' && kind !== 'shared-secret') {
+        const mode = authMeta?.mode;
+        if (mode === undefined) {
             return;
         }
-        throw new Error(`Endpoint ${methodName} is @${kind === 'oidc' ? 'AuthOidc' : 'AuthSharedSecret'} — a browser cannot ` +
-            `hold service credentials. Call it server-side with ClientHttpFactory from @webpieces/http-client-node.`);
+        switch (mode.kind) {
+            case 'public':
+            case 'jwt':
+            case 'local-only':
+                return;
+            case 'oidc':
+            case 'shared-secret':
+                throw new Error(`Endpoint ${methodName} is @${mode.kind === 'oidc' ? 'AuthOidc' : 'AuthSharedSecret'} — a browser ` +
+                    `cannot hold service credentials. Call it server-side with ClientHttpFactory from ` +
+                    `@webpieces/http-client-node.`);
+        }
     }
 }
 exports.BrowserProxyClient = BrowserProxyClient;

package/src/BrowserProxyClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"BrowserProxyClient.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-browser/src/BrowserProxyClient.ts"],"names":[],"mappings":";;;AAAA,oDAA6G;AAC7G,kEAAwF;AAIxF;;;;;;;;;GASG;AACH,MAAa,kBAAmB,SAAQ,8BAAW;IAI1B;IACA;IAJb,MAAM,CAAgB;IAE9B,YACqB,UAAsB,EACtB,iBAA4C;QAE7D,KAAK,EAAE,CAAC;QAHS,eAAU,GAAV,UAAU,CAAY;QACtB,sBAAiB,GAAjB,iBAAiB,CAA2B;IAGjE,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,YAAkC,EAAE,MAAoB;QACzD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;;;OAUG;IACgB,KAAK,CAAC,cAAc;QACnC,OAAO,CAAC,MAAM,0BAAc,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,CAAC;IAED;;;;;;OAMG;IACgB,sBAAsB,CAAC,WAA6B;QACnE,OAAO,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACgB,cAAc,CAAC,KAAoB;QAClD,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAEkB,YAAY,CAAC,KAAoB,EAAE,OAAuB;QACzE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED;;;;OAIG;IACgB,uBAAuB,CAAC,QAA8B,EAAE,UAAkB;QACzF,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC;QACjC,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC9C,OAAO;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CACX,YAAY,UAAU,QAAQ,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,sBAAsB;YACrG,wGAAwG,CAC3G,CAAC;IACN,CAAC;CACJ;AArED,gDAqEC","sourcesContent":["import { AuthMeta, ContextMgr, ClientRegistry, DestinationTrust, RouteMetadata } from '@webpieces/core-util';\nimport { ApiPrototype, ProxyClient, RequestOutcome } from '@webpieces/http-client-core';\nimport { ClientConfig } from './ClientConfig';\nimport { RequestLifecycleListener } from './RequestLifecycleListener';\n\n/**\n * The browser {@link ProxyClient}. Reads context from the app-held store (via {@link ContextMgr}),\n * because a browser has no ambient request scope.\n *\n * It attaches NO outbound credential and does NO recording — both inherit the base's no-ops. A\n * browser cannot mint an OIDC token and must never hold a shared secret; the user's JWT travels as\n * an ordinary transferred context key, set on the store at login.\n *\n * This is the ONLY class in webpieces that names ContextMgr.\n */\nexport class BrowserProxyClient extends ProxyClient {\n    private config!: ClientConfig;\n\n    constructor(\n        private readonly contextMgr: ContextMgr,\n        private readonly lifecycleListener?: RequestLifecycleListener,\n    ) {\n        super();\n    }\n\n    /** Bind this client to one API contract + base URL. */\n    init(apiPrototype: ApiPrototype<object>, config: ClientConfig): void {\n        this.config = config;\n        this.initRoutes(apiPrototype);\n    }\n\n    /**\n     * The same chain every client runs — a ClientRegistry mapping, else the installed deriver — but\n     * with the BROWSER's fallback: `''`, which makes the URL RELATIVE (`/auth/oauth`) and therefore\n     * same-origin, by definition. A browser app almost always calls the backend that served it, so\n     * that is the default, and an unregistered svcName must NEVER throw the way it used to — a\n     * forgotten registration silently killed sign-in, the request never leaving the page.\n     *\n     * A mapping still wins, which is exactly how an Angular dev server on :4201 reaches its backend\n     * on :8201, while the same bundle served BY that backend in prod registers nothing and goes\n     * relative. No `window` access, so this stays SSR-safe and testable.\n     */\n    protected override async resolveBaseUrl(): Promise<string> {\n        return (await ClientRegistry.tryResolve(this.config.svcName)) ?? '';\n    }\n\n    /**\n     * `destination` is always the un-verifying kind here — {@link assertEndpointSupported} below\n     * refuses to bind an @AuthOidc / @AuthSharedSecret contract, so every browser destination is\n     * @AuthJwt or @Public — which means a browser never puts a trusted context key on the wire. It is\n     * still threaded rather than short-circuited: the rule lives in ContextMgr, one place, for both\n     * environments.\n     */\n    protected override outboundContextHeaders(destination: DestinationTrust): Map<string, string> {\n        return this.contextMgr.buildOutboundHeaders(destination);\n    }\n\n    /**\n     * Forward the call's lifecycle to the app's listener, if one was registered on the factory. The\n     * optional chain makes both a no-op when no listener is present — the default browser case.\n     */\n    protected override onRequestStart(route: RouteMetadata): void {\n        this.lifecycleListener?.onRequestStart(route);\n    }\n\n    protected override onRequestEnd(route: RouteMetadata, outcome: RequestOutcome): void {\n        this.lifecycleListener?.onRequestEnd(route, outcome);\n    }\n\n    /**\n     * Reject a contract this browser cannot satisfy, at bind time rather than on the first call.\n     * Both service-to-service modes need credentials only a server has: @AuthOidc needs a runtime\n     * service account to mint a token, @AuthSharedSecret needs a secret no browser may ship.\n     */\n    protected override assertEndpointSupported(authMeta: AuthMeta | undefined, methodName: string): void {\n        const kind = authMeta?.mode.kind;\n        if (kind !== 'oidc' && kind !== 'shared-secret') {\n            return;\n        }\n        throw new Error(\n            `Endpoint ${methodName} is @${kind === 'oidc' ? 'AuthOidc' : 'AuthSharedSecret'} — a browser cannot ` +\n            `hold service credentials. Call it server-side with ClientHttpFactory from @webpieces/http-client-node.`,\n        );\n    }\n}\n"]}
+{"version":3,"file":"BrowserProxyClient.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-browser/src/BrowserProxyClient.ts"],"names":[],"mappings":";;;AAAA,oDAA6G;AAC7G,kEAAwF;AAIxF;;;;;;;;;GASG;AACH,MAAa,kBAAmB,SAAQ,8BAAW;IAI1B;IACA;IAJb,MAAM,CAAgB;IAE9B,YACqB,UAAsB,EACtB,iBAA4C;QAE7D,KAAK,EAAE,CAAC;QAHS,eAAU,GAAV,UAAU,CAAY;QACtB,sBAAiB,GAAjB,iBAAiB,CAA2B;IAGjE,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,YAAkC,EAAE,MAAoB;QACzD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;;;OAUG;IACgB,KAAK,CAAC,cAAc;QACnC,OAAO,CAAC,MAAM,0BAAc,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,CAAC;IAED;;;;;;OAMG;IACgB,sBAAsB,CAAC,WAA6B;QACnE,OAAO,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACgB,cAAc,CAAC,KAAoB;QAClD,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAEkB,YAAY,CAAC,KAAoB,EAAE,OAAuB;QACzE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACgB,uBAAuB,CAAC,QAA8B,EAAE,UAAkB;QACzF,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,OAAO;QACX,CAAC;QACD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,KAAK,QAAQ,CAAC;YACd,KAAK,KAAK,CAAC;YACX,KAAK,YAAY;gBACb,OAAO;YACX,KAAK,MAAM,CAAC;YACZ,KAAK,eAAe;gBAChB,MAAM,IAAI,KAAK,CACX,YAAY,UAAU,QAAQ,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,eAAe;oBACnG,mFAAmF;oBACnF,8BAA8B,CACjC,CAAC;QACV,CAAC;IACL,CAAC;CACJ;AAzFD,gDAyFC","sourcesContent":["import { AuthMeta, ContextMgr, ClientRegistry, DestinationTrust, RouteMetadata } from '@webpieces/core-util';\nimport { ApiPrototype, ProxyClient, RequestOutcome } from '@webpieces/http-client-core';\nimport { ClientConfig } from './ClientConfig';\nimport { RequestLifecycleListener } from './RequestLifecycleListener';\n\n/**\n * The browser {@link ProxyClient}. Reads context from the app-held store (via {@link ContextMgr}),\n * because a browser has no ambient request scope.\n *\n * It attaches NO outbound credential and does NO recording — both inherit the base's no-ops. A\n * browser cannot mint an OIDC token and must never hold a shared secret; the user's JWT travels as\n * an ordinary transferred context key, set on the store at login.\n *\n * This is the ONLY class in webpieces that names ContextMgr.\n */\nexport class BrowserProxyClient extends ProxyClient {\n    private config!: ClientConfig;\n\n    constructor(\n        private readonly contextMgr: ContextMgr,\n        private readonly lifecycleListener?: RequestLifecycleListener,\n    ) {\n        super();\n    }\n\n    /** Bind this client to one API contract + base URL. */\n    init(apiPrototype: ApiPrototype<object>, config: ClientConfig): void {\n        this.config = config;\n        this.initRoutes(apiPrototype);\n    }\n\n    /**\n     * The same chain every client runs — a ClientRegistry mapping, else the installed deriver — but\n     * with the BROWSER's fallback: `''`, which makes the URL RELATIVE (`/auth/oauth`) and therefore\n     * same-origin, by definition. A browser app almost always calls the backend that served it, so\n     * that is the default, and an unregistered svcName must NEVER throw the way it used to — a\n     * forgotten registration silently killed sign-in, the request never leaving the page.\n     *\n     * A mapping still wins, which is exactly how an Angular dev server on :4201 reaches its backend\n     * on :8201, while the same bundle served BY that backend in prod registers nothing and goes\n     * relative. No `window` access, so this stays SSR-safe and testable.\n     */\n    protected override async resolveBaseUrl(): Promise<string> {\n        return (await ClientRegistry.tryResolve(this.config.svcName)) ?? '';\n    }\n\n    /**\n     * `destination` is always the un-verifying kind here — {@link assertEndpointSupported} below\n     * refuses to bind an @AuthOidc / @AuthSharedSecret contract, so every browser destination is\n     * @AuthJwt or @Public — which means a browser never puts a trusted context key on the wire. It is\n     * still threaded rather than short-circuited: the rule lives in ContextMgr, one place, for both\n     * environments.\n     */\n    protected override outboundContextHeaders(destination: DestinationTrust): Map<string, string> {\n        return this.contextMgr.buildOutboundHeaders(destination);\n    }\n\n    /**\n     * Forward the call's lifecycle to the app's listener, if one was registered on the factory. The\n     * optional chain makes both a no-op when no listener is present — the default browser case.\n     */\n    protected override onRequestStart(route: RouteMetadata): void {\n        this.lifecycleListener?.onRequestStart(route);\n    }\n\n    protected override onRequestEnd(route: RouteMetadata, outcome: RequestOutcome): void {\n        this.lifecycleListener?.onRequestEnd(route, outcome);\n    }\n\n    /**\n     * Reject a contract this browser cannot satisfy, at bind time rather than on the first call.\n     * Both service-to-service modes need credentials only a server has: @AuthOidc needs a runtime\n     * service account to mint a token, @AuthSharedSecret needs a secret no browser may ship.\n     *\n     * @AuthLocalOnly is deliberately NOT rejected: a browser calling a dev-only endpoint on the\n     * developer's own server is the motivating case for that mode (shipping browser logs into the\n     * server log). It needs no credential — the server refuses it off-local by not having the route.\n     *\n     * An exhaustive switch with NO `default`, like {@link DestinationTrust.forAuthMode} and\n     * `AuthFilter.verifiesCaller`. This was a NEGATIVE allow-list (`kind !== 'oidc' && kind !==\n     * 'shared-secret'`), which silently WAVED THROUGH any future AuthMode kind — the browser would\n     * have bound a contract it cannot satisfy and failed on the first call instead of at bind time.\n     * Adding `local-only` is what surfaced it: the third reader of the union should fail to compile\n     * on a sixth kind for the same reason the other two do.\n     */\n    protected override assertEndpointSupported(authMeta: AuthMeta | undefined, methodName: string): void {\n        const mode = authMeta?.mode;\n        if (mode === undefined) {\n            return;\n        }\n        switch (mode.kind) {\n            case 'public':\n            case 'jwt':\n            case 'local-only':\n                return;\n            case 'oidc':\n            case 'shared-secret':\n                throw new Error(\n                    `Endpoint ${methodName} is @${mode.kind === 'oidc' ? 'AuthOidc' : 'AuthSharedSecret'} — a browser ` +\n                    `cannot hold service credentials. Call it server-side with ClientHttpFactory from ` +\n                    `@webpieces/http-client-node.`,\n                );\n        }\n    }\n}\n"]}

package/src/index.d.ts

@@ -34,4 +34,4 @@ export type { ApiPrototype } from '@webpieces/http-client-core';
 export { ContextMgr } from '@webpieces/core-util';
 export { ContextReader, ContextKey, HeaderRegistry, ClientRegistry, templateDeriver, WebpiecesCoreHeaders, } from '@webpieces/core-util';
 export type { ServiceUrlDeriver } from '@webpieces/core-util';
-export { ApiPath, Endpoint, Public, AuthJwt, AuthOidc, AuthSharedSecret, Rpc, PubSub, Queue, ValidateImplementation, } from '@webpieces/core-util';
+export { ApiPath, Endpoint, Public, AuthJwt, AuthOidc, AuthSharedSecret, AuthLocalOnly, Rpc, PubSub, Queue, ValidateImplementation, } from '@webpieces/core-util';

package/src/index.js

@@ -25,7 +25,7 @@
  * The server twin is @webpieces/http-client-node.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Queue = exports.PubSub = exports.Rpc = exports.AuthSharedSecret = exports.AuthOidc = exports.AuthJwt = exports.Public = exports.Endpoint = exports.ApiPath = exports.WebpiecesCoreHeaders = exports.templateDeriver = exports.ClientRegistry = exports.HeaderRegistry = exports.ContextKey = exports.ContextMgr = exports.RequestOutcome = exports.ClientErrorTranslator = exports.ProxyClient = exports.MutableContextStore = exports.ClientConfig = exports.BrowserApiCallContext = exports.BrowserProxyClient = exports.ClientHttpBrowserFactory = void 0;
+exports.Queue = exports.PubSub = exports.Rpc = exports.AuthLocalOnly = exports.AuthSharedSecret = exports.AuthOidc = exports.AuthJwt = exports.Public = exports.Endpoint = exports.ApiPath = exports.WebpiecesCoreHeaders = exports.templateDeriver = exports.ClientRegistry = exports.HeaderRegistry = exports.ContextKey = exports.ContextMgr = exports.RequestOutcome = exports.ClientErrorTranslator = exports.ProxyClient = exports.MutableContextStore = exports.ClientConfig = exports.BrowserApiCallContext = exports.BrowserProxyClient = exports.ClientHttpBrowserFactory = void 0;
 var ClientHttpBrowserFactory_1 = require("./ClientHttpBrowserFactory");
 Object.defineProperty(exports, "ClientHttpBrowserFactory", { enumerable: true, get: function () { return ClientHttpBrowserFactory_1.ClientHttpBrowserFactory; } });
 var BrowserProxyClient_1 = require("./BrowserProxyClient");
@@ -62,6 +62,7 @@ Object.defineProperty(exports, "Public", { enumerable: true, get: function () {
 Object.defineProperty(exports, "AuthJwt", { enumerable: true, get: function () { return core_util_3.AuthJwt; } });
 Object.defineProperty(exports, "AuthOidc", { enumerable: true, get: function () { return core_util_3.AuthOidc; } });
 Object.defineProperty(exports, "AuthSharedSecret", { enumerable: true, get: function () { return core_util_3.AuthSharedSecret; } });
+Object.defineProperty(exports, "AuthLocalOnly", { enumerable: true, get: function () { return core_util_3.AuthLocalOnly; } });
 Object.defineProperty(exports, "Rpc", { enumerable: true, get: function () { return core_util_3.Rpc; } });
 Object.defineProperty(exports, "PubSub", { enumerable: true, get: function () { return core_util_3.PubSub; } });
 Object.defineProperty(exports, "Queue", { enumerable: true, get: function () { return core_util_3.Queue; } });

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-browser/src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;;AAEH,uEAAsE;AAA7D,oIAAA,wBAAwB,OAAA;AACjC,2DAA0D;AAAjD,wHAAA,kBAAkB,OAAA;AAC3B,oGAAoG;AACpG,oGAAoG;AACpG,iEAAgE;AAAvD,8HAAA,qBAAqB,OAAA;AAC9B,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AACrB,6DAA4D;AAAnD,0HAAA,mBAAmB,OAAA;AAG5B,wEAAwE;AACxE,gEAAiG;AAAxF,+GAAA,WAAW,OAAA;AAAE,yHAAA,qBAAqB,OAAA;AAAE,kHAAA,cAAc,OAAA;AAG3D,iGAAiG;AACjG,mGAAmG;AACnG,kDAAkD;AAAzC,uGAAA,UAAU,OAAA;AAEnB,yFAAyF;AACzF,kDAO8B;AAL1B,uGAAA,UAAU,OAAA;AACV,2GAAA,cAAc,OAAA;AACd,2GAAA,cAAc,OAAA;AACd,4GAAA,eAAe,OAAA;AACf,iHAAA,oBAAoB,OAAA;AAIxB,uEAAuE;AACvE,kDAW8B;AAV1B,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,mGAAA,MAAM,OAAA;AACN,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,6GAAA,gBAAgB,OAAA;AAChB,gGAAA,GAAG,OAAA;AACH,mGAAA,MAAM,OAAA;AACN,kGAAA,KAAK,OAAA","sourcesContent":["/**\n * @webpieces/http-client-browser\n *\n * The BROWSER HTTP client. Reads an API contract's decorators and generates type-safe HTTP\n * clients from it — the same contract the server implements.\n *\n * DI-free on purpose: this may be bundled by React or Angular, so it ships no inversify and no\n * @webpieces/core-context (which is AsyncLocalStorage-backed and Node-only). Browsers have no\n * ambient request scope, so the app holds a {@link MutableContextStore} and sets context values\n * as they become known; every outbound call then transfers them as headers.\n *\n * Usage:\n * ```typescript\n * import { ClientHttpBrowserFactory, ClientConfig, MutableContextStore } from '@webpieces/http-client-browser';\n *\n * HeaderRegistry.configure(CompanyHeaders.ALL_HEADERS, true);\n * const store = new MutableContextStore();\n * const factory = new ClientHttpBrowserFactory(store);\n *\n * const client = factory.createRpcClient(SaveApi, new ClientConfig('save-svc'));\n * const response = await client.save({ query: 'test' });\n * ```\n *\n * The server twin is @webpieces/http-client-node.\n */\n\nexport { ClientHttpBrowserFactory } from './ClientHttpBrowserFactory';\nexport { BrowserProxyClient } from './BrowserProxyClient';\n// Browser impl of the ApiCallContext seam (installed by the factory). Exported so a browser/Angular\n// logger can read the current tag via ApiCallContextHolder.get().peek() and fold it into log lines.\nexport { BrowserApiCallContext } from './BrowserApiCallContext';\nexport { ClientConfig } from './ClientConfig';\nexport { MutableContextStore } from './MutableContextStore';\nexport type { RequestLifecycleListener } from './RequestLifecycleListener';\n\n// The isomorphic engine, re-exported so a browser app needs one import.\nexport { ProxyClient, ClientErrorTranslator, RequestOutcome } from '@webpieces/http-client-core';\nexport type { ApiPrototype } from '@webpieces/http-client-core';\n\n// ContextMgr is the BROWSER's outbound-header propagation. This is the only package that may use\n// it; the server reads RequestContext directly (RequestContextHeaders in @webpieces/core-context).\nexport { ContextMgr } from '@webpieces/core-util';\n\n// Re-export the context-key contract from core-util for convenience (browser one-import)\nexport {\n    ContextReader,\n    ContextKey,\n    HeaderRegistry,\n    ClientRegistry,\n    templateDeriver,\n    WebpiecesCoreHeaders,\n} from '@webpieces/core-util';\nexport type { ServiceUrlDeriver } from '@webpieces/core-util';\n\n// Re-export API decorators for convenience (same as http-routing does)\nexport {\n    ApiPath,\n    Endpoint,\n    Public,\n    AuthJwt,\n    AuthOidc,\n    AuthSharedSecret,\n    Rpc,\n    PubSub,\n    Queue,\n    ValidateImplementation,\n} from '@webpieces/core-util';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-browser/src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;;AAEH,uEAAsE;AAA7D,oIAAA,wBAAwB,OAAA;AACjC,2DAA0D;AAAjD,wHAAA,kBAAkB,OAAA;AAC3B,oGAAoG;AACpG,oGAAoG;AACpG,iEAAgE;AAAvD,8HAAA,qBAAqB,OAAA;AAC9B,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AACrB,6DAA4D;AAAnD,0HAAA,mBAAmB,OAAA;AAG5B,wEAAwE;AACxE,gEAAiG;AAAxF,+GAAA,WAAW,OAAA;AAAE,yHAAA,qBAAqB,OAAA;AAAE,kHAAA,cAAc,OAAA;AAG3D,iGAAiG;AACjG,mGAAmG;AACnG,kDAAkD;AAAzC,uGAAA,UAAU,OAAA;AAEnB,yFAAyF;AACzF,kDAO8B;AAL1B,uGAAA,UAAU,OAAA;AACV,2GAAA,cAAc,OAAA;AACd,2GAAA,cAAc,OAAA;AACd,4GAAA,eAAe,OAAA;AACf,iHAAA,oBAAoB,OAAA;AAIxB,uEAAuE;AACvE,kDAY8B;AAX1B,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,mGAAA,MAAM,OAAA;AACN,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,6GAAA,gBAAgB,OAAA;AAChB,0GAAA,aAAa,OAAA;AACb,gGAAA,GAAG,OAAA;AACH,mGAAA,MAAM,OAAA;AACN,kGAAA,KAAK,OAAA","sourcesContent":["/**\n * @webpieces/http-client-browser\n *\n * The BROWSER HTTP client. Reads an API contract's decorators and generates type-safe HTTP\n * clients from it — the same contract the server implements.\n *\n * DI-free on purpose: this may be bundled by React or Angular, so it ships no inversify and no\n * @webpieces/core-context (which is AsyncLocalStorage-backed and Node-only). Browsers have no\n * ambient request scope, so the app holds a {@link MutableContextStore} and sets context values\n * as they become known; every outbound call then transfers them as headers.\n *\n * Usage:\n * ```typescript\n * import { ClientHttpBrowserFactory, ClientConfig, MutableContextStore } from '@webpieces/http-client-browser';\n *\n * HeaderRegistry.configure(CompanyHeaders.ALL_HEADERS, true);\n * const store = new MutableContextStore();\n * const factory = new ClientHttpBrowserFactory(store);\n *\n * const client = factory.createRpcClient(SaveApi, new ClientConfig('save-svc'));\n * const response = await client.save({ query: 'test' });\n * ```\n *\n * The server twin is @webpieces/http-client-node.\n */\n\nexport { ClientHttpBrowserFactory } from './ClientHttpBrowserFactory';\nexport { BrowserProxyClient } from './BrowserProxyClient';\n// Browser impl of the ApiCallContext seam (installed by the factory). Exported so a browser/Angular\n// logger can read the current tag via ApiCallContextHolder.get().peek() and fold it into log lines.\nexport { BrowserApiCallContext } from './BrowserApiCallContext';\nexport { ClientConfig } from './ClientConfig';\nexport { MutableContextStore } from './MutableContextStore';\nexport type { RequestLifecycleListener } from './RequestLifecycleListener';\n\n// The isomorphic engine, re-exported so a browser app needs one import.\nexport { ProxyClient, ClientErrorTranslator, RequestOutcome } from '@webpieces/http-client-core';\nexport type { ApiPrototype } from '@webpieces/http-client-core';\n\n// ContextMgr is the BROWSER's outbound-header propagation. This is the only package that may use\n// it; the server reads RequestContext directly (RequestContextHeaders in @webpieces/core-context).\nexport { ContextMgr } from '@webpieces/core-util';\n\n// Re-export the context-key contract from core-util for convenience (browser one-import)\nexport {\n    ContextReader,\n    ContextKey,\n    HeaderRegistry,\n    ClientRegistry,\n    templateDeriver,\n    WebpiecesCoreHeaders,\n} from '@webpieces/core-util';\nexport type { ServiceUrlDeriver } from '@webpieces/core-util';\n\n// Re-export API decorators for convenience (same as http-routing does)\nexport {\n    ApiPath,\n    Endpoint,\n    Public,\n    AuthJwt,\n    AuthOidc,\n    AuthSharedSecret,\n    AuthLocalOnly,\n    Rpc,\n    PubSub,\n    Queue,\n    ValidateImplementation,\n} from '@webpieces/core-util';\n"]}