@xemahq/api-client-generator 2.1.0 → 2.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/.source-stamp.json +1 -1
- package/dist/lib/custom-fetch-template.d.ts +1 -1
- package/dist/lib/custom-fetch-template.d.ts.map +1 -1
- package/dist/lib/custom-fetch-template.js +6 -1
- package/dist/lib/custom-fetch-template.js.map +1 -1
- package/dist/lib/default-stubs.d.ts.map +1 -1
- package/dist/lib/default-stubs.js +0 -3
- package/dist/lib/default-stubs.js.map +1 -1
- package/dist/lib/seed-openapi-env.d.ts.map +1 -1
- package/dist/lib/seed-openapi-env.js +0 -1
- package/dist/lib/seed-openapi-env.js.map +1 -1
- package/package.json +3 -3
package/dist/.source-stamp.json
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
export declare const CANONICAL_CUSTOM_FETCH = "/**\n * Configurable fetch wrapper for Orval-generated clients.\n *\n * AUTO-GENERATED by `@xemahq/api-client-generator` \u2014 DO NOT EDIT. Every client\n * in the fleet ships this file byte-for-byte; a hand edit is erased by the next\n * regeneration and, until then, makes this one client speak to the platform\n * differently from all of its siblings.\n *\n * Canonical source: `CANONICAL_CUSTOM_FETCH` in\n * `packages/sdks/api-client-generator/src/lib/custom-fetch-template.ts`\n * (repository `xema-kernel-sdk`). Change it there.\n *\n * Regenerate, from the root of THIS repository:\n * pnpm --filter <owning-service> run openapi\n * pnpm --filter <owning-service> run client:generate\n * A mirror of this client under `xema-host-web` is not regenerated there: it\n * is written by the frontend bridge, `tooling/frontend-bridge` in the\n * xema-monorepo aggregator.\n *\n * Consumers must call `configureClient()` before using any endpoint function.\n * The baseUrl is prepended to the relative paths generated by Orval.\n *\n * By default this transport issues exactly ONE request and adds no delay of its\n * own, so a slow call is a slow server. Retrying is opt-in, and opting in\n * requires supplying an observer \u2014 see `maxRetries` / `onRetry` below.\n */\n\n/** What {@link ClientConfig.onRetry} is told before each re-attempt. */\nexport interface RetryNotice {\n /** 1-based index of the re-attempt about to be made. */\n attempt: number;\n /** The configured budget this re-attempt is spending from. */\n maxRetries: number;\n /** The response status that made the previous attempt retryable. */\n status: number;\n /** Delay before the re-attempt, in ms \u2014 from `Retry-After` when the server sent one. */\n waitMs: number;\n /** Whether {@link waitMs} came from the server's `Retry-After` header. */\n retryAfterHonoured: boolean;\n /** Absolute URL being re-requested. */\n url: string;\n /** HTTP method being re-requested. */\n method: string;\n}\n\n/**\n * Per-request context handed to the callbacks this transport awaits BEFORE it\n * sends the request.\n *\n * `signal` is the request's own `AbortSignal` (`options.signal`). It is the\n * CALLER's cancellation: a callback may use it to stop work that is private to\n * this request, but a callback serving several requests from one shared,\n * single-flight acquisition (a token refresh) must NOT abort that shared work\n * because one caller stopped \u2014 every other caller waiting on it would fail.\n * The transport stops WAITING on its own regardless, so a callback that\n * ignores the signal still cannot hold an aborted request.\n */\nexport interface ClientCallbackOptions {\n signal?: AbortSignal;\n}\n\nexport interface ClientConfig {\n /**\n * Static base URL (e.g. 'http://localhost:3140') \u2014 no trailing slash.\n * Mutually exclusive with `baseUrlResolver`; exactly one MUST be set.\n */\n baseUrl?: string;\n /**\n * Per-request base-URL resolver. When set, the peer URL is resolved from\n * the service registry on EVERY request (boot-order-safe). Wired by\n * `configureOrvalClientResolved` from `@xemahq/platform-common`.\n */\n baseUrlResolver?: (\n options?: ClientCallbackOptions,\n ) => string | Promise<string>;\n /**\n * Optional async callback to get an auth token. Auto-sets Authorization\n * header on every request. Receives the request's signal \u2014 see\n * {@link ClientCallbackOptions} for what it may and may not abort.\n */\n getAuthToken?: (options?: ClientCallbackOptions) => Promise<string>;\n /** Optional callback returning headers to inject on every request. Per-call headers take precedence. */\n getHeaders?: () => Record<string, string> | Promise<Record<string, string>>;\n /**\n * Optional resolver for the CORRELATION ID of the request being made \u2014 the\n * handle that ties one causal chain together across every service hop.\n *\n * WHY IT IS A CALLBACK AND NOT A VALUE. `ClientConfig` is process-global\n * (`configureClient` is called once at wiring time), and a correlation id is\n * per-request. This is invoked INSIDE the request, so a server can point it\n * at whatever carries its ambient request context and get the CURRENT id\n * rather than the one that happened to be live at boot.\n *\n * WHY THE TRANSPORT DOES NOT MINT ONE. Returning `undefined` sends no header,\n * and the receiving service's `RequestContextMiddleware` mints its own \u2014 a\n * new trace, which is honest. A transport that minted per call would produce\n * a FRESH id on every hop while looking like propagation, which is strictly\n * worse than none: every row would carry a correlation id and no two rows\n * that belong together would share one. That is the exact defect this exists\n * to fix, so the transport must not reproduce it one layer down.\n *\n * A caller-supplied `X-Correlation-Id` header always wins, and so does one\n * from `getHeaders`.\n */\n getCorrelationId?: () =>\n | string\n | undefined\n | Promise<string | undefined>;\n /**\n * Optional callback invoked on a 401 before ONE re-attempt. Supplying it is\n * what opts this client into that re-attempt; without it a 401 comes back to\n * the caller as a `ClientError` like any other 4xx.\n */\n onUnauthorized?: () => Promise<void>;\n /**\n * Re-attempts for a retryable status. **Defaults to 0 \u2014 no retry.**\n *\n * Setting it above 0 REQUIRES `onRetry`; `configureClient` throws otherwise.\n * See the block above `customFetch` for why the budget is opt-in and why an\n * observer is mandatory rather than advisory.\n */\n maxRetries?: number;\n /**\n * Called immediately before every re-attempt, with the reason and the delay.\n *\n * Mandatory whenever `maxRetries` is above 0. It is the difference between a\n * retry and a hidden degradation path: without it a caller cannot tell a slow\n * server from this transport sleeping between attempts.\n */\n onRetry?: (notice: RetryNotice) => void;\n}\n\n/**\n * Cross-package identity for `ClientError`.\n *\n * \u2500\u2500 THE OUTAGE THIS IS FOR \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n *\n * PRODUCTION, 2026-09-22. A session launch aborted on\n * `HTTP 503 from http://skill-registry-api\u2026/skills`. A 503 is the archetypal\n * TRANSIENT \u2014 agent-session's launch taxonomy already listed it as retryable \u2014\n * but it was classified PERMANENT and the launch was abandoned.\n *\n * The cause was this file. Every generated client package gets its OWN copy of\n * `ClientError`, so there are as many classes as there are clients (81 at the\n * time of writing), all byte-identical and all DIFFERENT OBJECTS. A consumer\n * naturally writes `err instanceof ClientError` against the one client it\n * imported \u2014 which reads as obviously correct and is silently package-local. An\n * error from any OTHER client fails it, falls past every status check, and lands\n * on whatever the default is.\n *\n * That was not the first time: biome-host had already switched to structural\n * detection for the same reason, and canopy imports TWO `ClientError` classes\n * and tests both. Three more call sites elsewhere carry the same shape.\n *\n * \u2500\u2500 WHY A BRAND AND NOT A SHARED PACKAGE \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n *\n * The obvious fix is one shared runtime class every client imports. It was\n * rejected on measurement: the 81 generated clients are DEPENDENCY-FREE by\n * design (exactly one has any dependency at all), and a shared class would have\n * to be a PEER dependency to be safe \u2014 a normal dependency can be installed\n * twice under version skew, which reinstates this identical bug in a form that\n * is HARDER to see, because the classes then look like they ought to match.\n *\n * `Symbol.for` is a process-wide registry keyed by STRING, so every copy of\n * this template resolves the same symbol without importing anything. The brand\n * costs no dependency, cannot skew, and needs no new package.\n *\n * `Symbol.hasInstance` then makes plain `instanceof` mean the right thing\n * fleet-wide: an error from ANY generated client satisfies `instanceof\n * ClientError` in ANY other. A helper would have made the safe pattern\n * available; this makes the dangerous pattern impossible.\n *\n * Narrow on purpose \u2014 the brand is set only by this constructor, so an unrelated\n * error carrying a `status` is not admitted.\n */\nconst CLIENT_ERROR_BRAND: unique symbol = Symbol.for(\n 'xema.generatedClientError',\n) as never;\n\nexport class ClientError extends Error {\n constructor(\n public readonly status: number,\n public readonly url: string,\n public readonly body: unknown,\n ) {\n super(`HTTP ${status} from ${url}`);\n this.name = 'ClientError';\n // Non-enumerable: it must not appear in JSON, logs or snapshots \u2014 it is an\n // identity marker, not payload.\n Object.defineProperty(this, CLIENT_ERROR_BRAND, { value: true });\n }\n\n static [Symbol.hasInstance](candidate: unknown): boolean {\n return (\n typeof candidate === 'object' &&\n candidate !== null &&\n CLIENT_ERROR_BRAND in candidate\n );\n }\n}\n\nlet clientConfig: ClientConfig | null = null;\n\n/**\n * THE MOUNT SCOPE \u2014 how one process can host several services without their\n * clients speaking for each other.\n *\n * `clientConfig` below is a MODULE global, and in a single-service process\n * that is correct: one writer, one configuration. Compose two services into one\n * process and both call `configureClient` on THIS SAME module instance, so the\n * second overwrites the first and every outbound call from BOTH services leaves\n * as whichever wired itself last \u2014 wrong base URL, and, because\n * `getAuthToken` is part of the config, WRONG BEARER. That is one tenant's\n * service calling a peer holding another tenant's credential, and it is silent.\n *\n * A composing host installs a hook under this well-known symbol that answers\n * one question: WHICH MOUNT is currently on the stack. Nothing else crosses.\n * `configureClient` then files the config under that mount, and\n * `getClientConfig` reads it back out under the same key.\n *\n * Three properties make this safe rather than clever:\n *\n * - The CONFIG is still built by the mount's own wiring, exactly as today.\n * The hook never supplies one. So a mount's base URL and bearer are\n * resolved FROM THE MOUNT; the scope only decides which drawer they go in.\n * A hook that RETURNED configuration would be a mount taking its identity\n * from ambient storage a neighbour can write \u2014 the inversion to refuse.\n * - The key is an OPAQUE OBJECT and the store is a `WeakMap`, so a mount's\n * configuration becomes unreachable when the host drops the mount, and no\n * client can enumerate the mounts or reach a sibling's entry.\n * - With NO hook installed \u2014 every process in the fleet today \u2014 both\n * functions behave exactly as they did before this existed.\n *\n * `Symbol.for` is the seam because a generated client must keep its\n * dependency surface at zero and a host cannot enumerate the clients a process\n * happens to load. It is the same instrument, and the same reasoning, as the\n * `ClientError` brand above.\n */\nconst XEMA_CLIENT_CONFIG_SCOPE = Symbol.for('xema.client-config-scope');\n\ntype MountScopeHook = () => object | undefined;\n\nfunction mountScopeHook(): MountScopeHook | undefined {\n const hook = (globalThis as Record<symbol, unknown>)[\n XEMA_CLIENT_CONFIG_SCOPE\n ];\n return typeof hook === 'function' ? (hook as MountScopeHook) : undefined;\n}\n\nfunction currentMountKey(): object | undefined {\n return mountScopeHook()?.();\n}\n\nconst perMountConfig = new WeakMap<object, ClientConfig>();\n\n\nexport function configureClient(config: ClientConfig): void {\n // Fail at WIRING time, not on the request that happens to be retried. A\n // client configured to retry without an observer is the exact defect this\n // transport was rebuilt to remove, so it must not be constructible.\n if ((config.maxRetries ?? 0) > 0 && !config.onRetry) {\n throw new Error(\n 'configureClient: maxRetries above 0 requires onRetry. A retry nothing ' +\n 'reports is indistinguishable from a slow server, which is how two ' +\n 'silent re-attempts were read as a 3,312ms call.',\n );\n }\n const hook = mountScopeHook();\n if (hook !== undefined) {\n const mount = hook();\n if (mount === undefined) {\n // A composing host is installed and no member is on the stack, so this\n // configuration belongs to NO member. Filing it in the module global\n // would hand it to every member that did not configure this client \u2014\n // someone else's base URL and bearer, silently.\n throw new Error(\n 'configureClient: called in a composed process outside every member. ' +\n 'Configure the client inside the member that uses it (its providers ' +\n 'and factories already run there).',\n );\n }\n perMountConfig.set(mount, config);\n return;\n }\n clientConfig = config;\n}\n\nexport function getClientConfig(): ClientConfig {\n const mount = currentMountKey();\n if (mount !== undefined) {\n const scoped = perMountConfig.get(mount);\n if (scoped) {\n return scoped;\n }\n // A member that never configured THIS client behaves exactly like a\n // dedicated service that did not either: it is refused. It used to fall\n // through to the module global, which in a composed process can only have\n // been written by some OTHER code \u2014 so the member called peers under a\n // base URL and bearer that were never its own.\n throw new Error(\n 'Client not configured for this member. Call configureClient({ baseUrl }) ' +\n 'inside the member before using endpoint functions.',\n );\n }\n if (!clientConfig) {\n throw new Error(\n 'Client not configured. Call configureClient({ baseUrl }) before using endpoint functions.',\n );\n }\n return clientConfig;\n}\n\n/*\n * RETRYING IS OPT-IN, OBSERVED, AND NARROW. Do not widen any of the three.\n *\n * This transport used to retry up to `maxRetries` (defaulting to THREE) over\n * 429/502/503/504 AND over any thrown network error, backing off from 1000ms,\n * with no log line anywhere. Three properties were wrong:\n *\n * 1. The DEFAULT was on. ~99% of the fleet's client configurations never\n * mention `maxRetries`, so two re-attempts could add ~3s to any call with\n * nothing to distinguish that from a slow peer. Every caller that DID set\n * it set it LOWER \u2014 canopy's control plane to 1, \"so a hard outage\n * surfaces inside the turn's latency budget rather than after three\n * backoffs\"; two llm-registry callers to 1; a test to 0. Nobody ever\n * raised it. A default three separate call sites work around is not a\n * default, and `configureOrvalClientResolved` cannot express the field at\n * all, so most callers could not have opted out if they had wanted to.\n * 2. It retried AMBIGUOUS failures. 502 and 504 mean a gateway did not get a\n * timely answer from upstream \u2014 the upstream may well have APPLIED the\n * request. So did a thrown network error mid-flight. Re-sending a POST in\n * either case is a duplicate write, and no amount of logging makes that\n * safe. Only 429 and 503 state positively that the request was NOT\n * processed, so only those are retried; everything else surfaces at once.\n * 3. Nothing reported it. Now `onRetry` is mandatory whenever the budget is\n * above 0, enforced in `configureClient`.\n *\n * Also note `baseUrlResolver` is awaited ONCE, above the loop: a re-attempt\n * returns to the same resolved instance. In a registry-resolved fleet the cure\n * for an unhealthy peer is re-resolution, which lives above this file \u2014 which\n * is a further reason not to lean on retrying here.\n *\n * Retry policy a caller genuinely wants belongs in `@xemahq/managed-fetch`,\n * which has backoff, a circuit breaker, a token bucket and health reporting,\n * and reports what it did.\n *\n * Enforced fleet-wide by `check-client-transport-envelope`, which compares\n * every client's transport to this template.\n */\n\n/** The only statuses that state the request was NOT processed. See above. */\nconst RETRYABLE_STATUSES = [429, 503];\n\n/**\n * The platform's correlation header, spelled once.\n *\n * Value-identical to what `RequestContextMiddleware` reads in\n * `@xemahq/platform-common`. It is a literal here rather than an import\n * because this file has ZERO imports on purpose: it ships byte-identical into\n * browser-target clients as well as server-target ones, and a dependency on a\n * NestJS-peer package would follow it into every one of them.\n */\nconst CORRELATION_ID_HEADER = 'X-Correlation-Id';\n\n/** Backoff floor, doubling per attempt up to {@link MAX_BACKOFF_MS}. */\nconst BASE_BACKOFF_MS = 1000;\n\n/** Ceiling on a single backoff, however many attempts have elapsed. */\nconst MAX_BACKOFF_MS = 30_000;\n\n/*\n * CALLER CANCELLATION REACHES EVERY WAIT BEFORE THE REQUEST IS SENT.\n *\n * `fetch` always honoured `options.signal`, but everything this transport\n * awaits BEFORE `fetch` \u2014 base-URL resolution, the header callbacks, the auth\n * token \u2014 did not, so a caller that aborted while a token was being minted sat\n * out the mint and then, at best, had its request refused. The only way to\n * cancel that wait was a process-wide interceptor aborting every outbound\n * request, which also aborts a SHARED single-flight token refresh and so fails\n * every other caller waiting on it.\n *\n * So each pre-send wait is RACED against the signal: the caller stops waiting\n * at once, and the work it was waiting on carries on for anybody else. The\n * rejection is the signal's own reason \u2014 exactly what `fetch` rejects with \u2014\n * so a caller sees ONE abort shape whenever it aborts. An aborted request is\n * never retried. Without a signal nothing here changes.\n */\nfunction abortedReason(signal: AbortSignal): unknown {\n // `abort()` with no argument sets a DOMException reason, so this is only\n // ever `undefined` for a hand-built signal; say so rather than throw it.\n return signal.reason ?? new DOMException('This operation was aborted', 'AbortError');\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n if (signal?.aborted) {\n throw abortedReason(signal);\n }\n}\n\nfunction raceAbort<V>(\n pending: V | Promise<V>,\n signal: AbortSignal | undefined,\n): Promise<V> {\n const promise = Promise.resolve(pending);\n if (!signal) {\n return promise;\n }\n if (signal.aborted) {\n promise.catch(() => undefined);\n return Promise.reject(abortedReason(signal));\n }\n return new Promise<V>((resolve, reject) => {\n const onAbort = (): void => {\n // The pending work may be shared; it carries on, and its eventual\n // rejection must not surface as an unhandled one on this side.\n promise.catch(() => undefined);\n reject(abortedReason(signal));\n };\n signal.addEventListener('abort', onAbort, { once: true });\n promise.then(\n (value) => {\n signal.removeEventListener('abort', onAbort);\n resolve(value);\n },\n (err: unknown) => {\n signal.removeEventListener('abort', onAbort);\n reject(err);\n },\n );\n });\n}\n\nasync function buildHeaders(\n config: ClientConfig,\n callerHeaders: RequestInit['headers'],\n signal: AbortSignal | undefined,\n): Promise<Headers> {\n const headers = new Headers(callerHeaders);\n\n // Global headers from config (caller-provided headers take precedence)\n if (config.getHeaders) {\n const globalHeaders = await raceAbort(config.getHeaders(), signal);\n for (const [key, value] of Object.entries(globalHeaders)) {\n if (!headers.has(key)) {\n headers.set(key, value);\n }\n }\n }\n\n // Correlation id (caller and global headers still take precedence).\n //\n // Without this, every server-to-server hop through a generated client started\n // a NEW trace: the id is read-or-minted per hop by the receiving service's\n // RequestContextMiddleware, and nothing carried it outbound \u2014 so an audit\n // journal could record a whole causal chain and offer no way to join it back\n // together.\n //\n // Absent resolver, or a resolver that answers `undefined`: NO header. The\n // receiver mints and a new trace begins, which is the truthful outcome when\n // there is nothing to continue.\n if (config.getCorrelationId && !headers.has(CORRELATION_ID_HEADER)) {\n const correlationId = await raceAbort(config.getCorrelationId(), signal);\n if (correlationId) {\n headers.set(CORRELATION_ID_HEADER, correlationId);\n }\n }\n\n // Auth token (caller or global headers take precedence)\n if (config.getAuthToken && !headers.has('Authorization')) {\n const token = await raceAbort(\n config.getAuthToken(signal ? { signal } : undefined),\n signal,\n );\n headers.set('Authorization', `Bearer ${token}`);\n }\n\n return headers;\n}\n\n/*\n * THE TRANSPORT RETURNS THE BODY UNCHANGED. Do not reintroduce an unwrap here.\n *\n * Xema services wrap every 2xx payload in a { data: T } envelope via the global\n * ResponseEnvelopeInterceptor (platform-common), and the generator emits types\n * that describe THAT ENVELOPE \u2014 every endpoint returns Promise<XDataEnvelope>\n * or Promise<XPaginatedEnvelope>, never a bare inner T. Consumers read the data\n * property themselves.\n *\n * This template used to peel data, justified by a comment claiming generated\n * types describe the inner T. That stopped being true when the generator moved\n * to envelope-typed returns, and the comment outlived the fact \u2014 so the peel\n * then contradicted every type in every package it seeded. Four clients shipped\n * that way (resource-governance x3, workload-runtime-api): declared\n * *DataEnvelope, returned the already-peeled inner object, so .data read\n * undefined at runtime on every non-paginated endpoint. Paginated calls hid it,\n * because the old peel deliberately preserved an envelope carrying pagination.\n *\n * Four MORE shipped it in repositories the gate could not see \u2014 license-api and\n * license-internal-api in xema-operator, plus their host-web mirrors \u2014 because\n * the gate ran in xema-base only. That is why it now runs in every repository\n * that ships a client, and why this file is generator-owned rather than seeded.\n */\n\nexport const customFetch = async <T>(\n url: string,\n options: RequestInit,\n): Promise<T> => {\n const config = getClientConfig();\n const signal = options.signal ?? undefined;\n throwIfAborted(signal);\n const base = config.baseUrlResolver\n ? await raceAbort(\n config.baseUrlResolver(signal ? { signal } : undefined),\n signal,\n )\n : config.baseUrl;\n if (base === undefined) {\n throw new Error(\n 'Client not configured: set baseUrl or baseUrlResolver via configureClient().',\n );\n }\n const fullUrl = `${base}${url}`;\n const maxRetries = config.maxRetries ?? 0;\n\n // A caller that supplied its own Authorization header owns that credential.\n // `buildHeaders` lets it win, so refreshing the CLIENT-WIDE token and\n // re-sending would replay the identical failing request with the identical\n // credential: one wasted round trip, plus a global refresh nobody asked for.\n const callerSuppliedAuth = new Headers(options.headers).has('Authorization');\n\n const headers = await buildHeaders(config, options.headers, signal);\n const requestInit: RequestInit = { ...options, headers };\n\n let delay = BASE_BACKOFF_MS;\n\n for (let attempt = 0; ; attempt++) {\n const response = await fetch(fullUrl, requestInit);\n\n if (\n response.status === 401 &&\n config.onUnauthorized &&\n !callerSuppliedAuth &&\n attempt === 0\n ) {\n await raceAbort(config.onUnauthorized(), signal);\n const refreshedHeaders = await buildHeaders(\n config,\n options.headers,\n signal,\n );\n const retryResponse = await fetch(fullUrl, {\n ...options,\n headers: refreshedHeaders,\n });\n const retryBody = await parseBody(retryResponse);\n if (retryResponse.status >= 400) {\n throw new ClientError(retryResponse.status, fullUrl, retryBody);\n }\n return retryBody as T;\n }\n\n if (\n !RETRYABLE_STATUSES.includes(response.status) ||\n attempt >= maxRetries\n ) {\n const body = await parseBody(response);\n if (response.status >= 400) {\n throw new ClientError(response.status, fullUrl, body);\n }\n return body as T;\n }\n\n const retryAfter = parseRetryAfter(response.headers.get('Retry-After'));\n const waitMs = retryAfter ?? addJitter(delay);\n // Non-null: `configureClient` refuses a budget above 0 without an observer,\n // and this line is unreachable unless `maxRetries` is above 0.\n (config.onRetry as (notice: RetryNotice) => void)({\n attempt: attempt + 1,\n maxRetries,\n status: response.status,\n waitMs,\n retryAfterHonoured: retryAfter !== undefined,\n url: fullUrl,\n method: options.method ?? 'GET',\n });\n await sleep(waitMs, signal);\n delay = Math.min(delay * 2, MAX_BACKOFF_MS);\n }\n};\n\n/**\n * Does this media type carry JSON?\n *\n * \u2500\u2500 THE OUTAGE THIS FIXES \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n *\n * This used to be `contentType?.includes('application/json')`, and EVERY error\n * this fleet returns failed that test. The platform's `GlobalExceptionFilter`\n * emits RFC 9457 problem documents and sets the media type explicitly \u2014\n * `.type(PROBLEM_DETAILS_CONTENT_TYPE)` before `.json()`, so it cannot be\n * overridden \u2014 and that constant is `application/problem+json`, which does NOT\n * contain the substring `application/json`: after `application/` comes\n * `problem+json`.\n *\n * So every non-2xx body fell through to `response.text()` and reached the\n * caller as an UNPARSED STRING. `ClientError.body` is typed `unknown`, so\n * nothing complained; every consumer that reads a machine-readable code off an\n * error \u2014 `error.body.code`, `error.body.details.code` \u2014 silently read\n * `undefined` instead, for every error, in every service.\n *\n * Measured in production on 2026-09-15: skill-registry-api's\n * `resolveOrNull()` absorbs `RELEASE_CHANNEL_NOT_FOUND` into `null` by exactly\n * that read. With the code unreadable the absorb never fired, a routine \"no\n * pointer on this channel\" 404 became a 500 on `GET /skills` and\n * `GET /describe-objects`, and agent-session-api's `apply_control_bundle` step\n * aborted EVERY session launch in the organisation \u2014 7,871 failed resolutions\n * an hour. A fix written for that exact page months earlier was present in the\n * running image and could not help, because the classifier it repaired was\n * being handed a string.\n *\n * \u2500\u2500 WHY THE STRUCTURED SUFFIX, NOT A SECOND SUBSTRING \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n *\n * Adding `|| includes('application/problem+json')` would fix this one media\n * type and leave the next one \u2014 `application/vnd.api+json`, and anything else\n * a service legitimately emits. RFC 6839 defines `+json` as the structured\n * syntax suffix meaning \"this is JSON\"; that is the actual rule, so it is the\n * rule implemented. Parameters are stripped first, because\n * `application/problem+json; charset=utf-8` is the same media type.\n */\nfunction isJsonMediaType(contentType: string | null): boolean {\n if (contentType === null) {\n return false;\n }\n const essence = contentType.split(';')[0]?.trim().toLowerCase() ?? '';\n return essence === 'application/json' || essence.endsWith('+json');\n}\n\nasync function parseBody(response: Response): Promise<unknown> {\n // 204 FIRST, and deliberately \u2014 this ORDER is carried from `develop`, which\n // fixed the same defect independently and got this half right where `main`\n // did not. A 204 carries no body, so `response.json()` on one throws\n // SyntaxError; and a 204 whose headers STILL declare a JSON content type is\n // ordinary, because the framework sets the header before the handler returns\n // nothing. With the JSON branch first, a documented `undefined` becomes a\n // thrown parse error. Pinned by a case in `transport-problem-json.test.cjs`.\n if (response.status === 204) {\n return undefined;\n }\n const contentType = response.headers.get('content-type');\n if (isJsonMediaType(contentType)) {\n return response.json();\n }\n return response.text();\n}\n\nfunction parseRetryAfter(value: string | null): number | undefined {\n if (!value) return undefined;\n const seconds = Number(value);\n if (!isNaN(seconds) && seconds >= 0) return seconds * 1000;\n const date = new Date(value);\n if (!isNaN(date.getTime())) return Math.max(0, date.getTime() - Date.now());\n return undefined;\n}\n\nfunction addJitter(delay: number): number {\n return delay + (Math.random() * 2 - 1) * delay * 0.25;\n}\n\n/** A retry backoff; the caller's signal ends it at once and is never retried. */\nfunction sleep(ms: number, signal: AbortSignal | undefined): Promise<void> {\n if (!signal) {\n return new Promise((resolve) => setTimeout(resolve, ms));\n }\n if (signal.aborted) {\n return Promise.reject(abortedReason(signal));\n }\n return new Promise((resolve, reject) => {\n const onAbort = (): void => {\n clearTimeout(timer);\n reject(abortedReason(signal));\n };\n const timer = setTimeout(() => {\n signal.removeEventListener('abort', onAbort);\n resolve();\n }, ms);\n signal.addEventListener('abort', onAbort, { once: true });\n });\n}\n\nexport default customFetch;\n";
|
|
1
|
+
export declare const CANONICAL_CUSTOM_FETCH = "/**\n * Configurable fetch wrapper for Orval-generated clients.\n *\n * AUTO-GENERATED by `@xemahq/api-client-generator` \u2014 DO NOT EDIT. Every client\n * in the fleet ships this file byte-for-byte; a hand edit is erased by the next\n * regeneration and, until then, makes this one client speak to the platform\n * differently from all of its siblings.\n *\n * Canonical source: `CANONICAL_CUSTOM_FETCH` in\n * `packages/sdks/api-client-generator/src/lib/custom-fetch-template.ts`\n * (repository `xema-kernel-sdk`). Change it there.\n *\n * Regenerate, from the root of THIS repository:\n * pnpm --filter <owning-service> run openapi\n * pnpm --filter <owning-service> run client:generate\n * A mirror of this client under `xema-host-web` is not regenerated there: it\n * is written by the frontend bridge, `tooling/frontend-bridge` in the\n * xema-monorepo aggregator.\n *\n * Consumers must call `configureClient()` before using any endpoint function.\n * The baseUrl is prepended to the relative paths generated by Orval.\n *\n * By default this transport issues exactly ONE request and adds no delay of its\n * own, so a slow call is a slow server. Retrying is opt-in, and opting in\n * requires supplying an observer \u2014 see `maxRetries` / `onRetry` below.\n */\n\n/** What {@link ClientConfig.onRetry} is told before each re-attempt. */\nexport interface RetryNotice {\n /** 1-based index of the re-attempt about to be made. */\n attempt: number;\n /** The configured budget this re-attempt is spending from. */\n maxRetries: number;\n /** The response status that made the previous attempt retryable. */\n status: number;\n /** Delay before the re-attempt, in ms \u2014 from `Retry-After` when the server sent one. */\n waitMs: number;\n /** Whether {@link waitMs} came from the server's `Retry-After` header. */\n retryAfterHonoured: boolean;\n /** Absolute URL being re-requested. */\n url: string;\n /** HTTP method being re-requested. */\n method: string;\n}\n\n/**\n * Per-request context handed to the callbacks this transport awaits BEFORE it\n * sends the request.\n *\n * `signal` is the request's own `AbortSignal` (`options.signal`). It is the\n * CALLER's cancellation: a callback may use it to stop work that is private to\n * this request, but a callback serving several requests from one shared,\n * single-flight acquisition (a token refresh) must NOT abort that shared work\n * because one caller stopped \u2014 every other caller waiting on it would fail.\n * The transport stops WAITING on its own regardless, so a callback that\n * ignores the signal still cannot hold an aborted request.\n */\nexport interface ClientCallbackOptions {\n signal?: AbortSignal;\n}\n\nexport interface ClientConfig {\n /**\n * Static base URL (e.g. 'http://localhost:3140') \u2014 no trailing slash.\n * Mutually exclusive with `baseUrlResolver`; exactly one MUST be set.\n */\n baseUrl?: string;\n /**\n * Per-request base-URL resolver. When set, the peer URL is resolved from\n * the service registry on EVERY request (boot-order-safe). Wired by\n * `configureOrvalClientResolved` from `@xemahq/platform-common`.\n */\n baseUrlResolver?: (\n options?: ClientCallbackOptions,\n ) => string | Promise<string>;\n /**\n * Optional async callback to get an auth token. Auto-sets Authorization\n * header on every request. Receives the request's signal \u2014 see\n * {@link ClientCallbackOptions} for what it may and may not abort.\n */\n getAuthToken?: (options?: ClientCallbackOptions) => Promise<string>;\n /** Optional callback returning headers to inject on every request. Per-call headers take precedence. */\n getHeaders?: () => Record<string, string> | Promise<Record<string, string>>;\n /**\n * Optional resolver for the CORRELATION ID of the request being made \u2014 the\n * handle that ties one causal chain together across every service hop.\n *\n * WHY IT IS A CALLBACK AND NOT A VALUE. `ClientConfig` is process-global\n * (`configureClient` is called once at wiring time), and a correlation id is\n * per-request. This is invoked INSIDE the request, so a server can point it\n * at whatever carries its ambient request context and get the CURRENT id\n * rather than the one that happened to be live at boot.\n *\n * WHY THE TRANSPORT DOES NOT MINT ONE. Returning `undefined` sends no header,\n * and the receiving service's `RequestContextMiddleware` mints its own \u2014 a\n * new trace, which is honest. A transport that minted per call would produce\n * a FRESH id on every hop while looking like propagation, which is strictly\n * worse than none: every row would carry a correlation id and no two rows\n * that belong together would share one. That is the exact defect this exists\n * to fix, so the transport must not reproduce it one layer down.\n *\n * A caller-supplied `X-Correlation-Id` header always wins, and so does one\n * from `getHeaders`.\n */\n getCorrelationId?: () =>\n | string\n | undefined\n | Promise<string | undefined>;\n /**\n * Optional callback invoked on a 401 before ONE re-attempt. Supplying it is\n * what opts this client into that re-attempt; without it a 401 comes back to\n * the caller as a `ClientError` like any other 4xx.\n */\n onUnauthorized?: () => Promise<void>;\n /**\n * Re-attempts for a retryable status. **Defaults to 0 \u2014 no retry.**\n *\n * Setting it above 0 REQUIRES `onRetry`; `configureClient` throws otherwise.\n * See the block above `customFetch` for why the budget is opt-in and why an\n * observer is mandatory rather than advisory.\n */\n maxRetries?: number;\n /**\n * Called immediately before every re-attempt, with the reason and the delay.\n *\n * Mandatory whenever `maxRetries` is above 0. It is the difference between a\n * retry and a hidden degradation path: without it a caller cannot tell a slow\n * server from this transport sleeping between attempts.\n */\n onRetry?: (notice: RetryNotice) => void;\n}\n\n/**\n * Cross-package identity for `ClientError`.\n *\n * \u2500\u2500 THE OUTAGE THIS IS FOR \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n *\n * PRODUCTION, 2026-09-22. A session launch aborted on\n * `HTTP 503 from http://skill-registry-api\u2026/skills`. A 503 is the archetypal\n * TRANSIENT \u2014 agent-session's launch taxonomy already listed it as retryable \u2014\n * but it was classified PERMANENT and the launch was abandoned.\n *\n * The cause was this file. Every generated client package gets its OWN copy of\n * `ClientError`, so there are as many classes as there are clients (81 at the\n * time of writing), all byte-identical and all DIFFERENT OBJECTS. A consumer\n * naturally writes `err instanceof ClientError` against the one client it\n * imported \u2014 which reads as obviously correct and is silently package-local. An\n * error from any OTHER client fails it, falls past every status check, and lands\n * on whatever the default is.\n *\n * That was not the first time: biome-host had already switched to structural\n * detection for the same reason, and canopy imports TWO `ClientError` classes\n * and tests both. Three more call sites elsewhere carry the same shape.\n *\n * \u2500\u2500 WHY A BRAND AND NOT A SHARED PACKAGE \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n *\n * The obvious fix is one shared runtime class every client imports. It was\n * rejected on measurement: the 81 generated clients are DEPENDENCY-FREE by\n * design (exactly one has any dependency at all), and a shared class would have\n * to be a PEER dependency to be safe \u2014 a normal dependency can be installed\n * twice under version skew, which reinstates this identical bug in a form that\n * is HARDER to see, because the classes then look like they ought to match.\n *\n * `Symbol.for` is a process-wide registry keyed by STRING, so every copy of\n * this template resolves the same symbol without importing anything. The brand\n * costs no dependency, cannot skew, and needs no new package.\n *\n * `Symbol.hasInstance` then makes plain `instanceof` mean the right thing\n * fleet-wide: an error from ANY generated client satisfies `instanceof\n * ClientError` in ANY other. A helper would have made the safe pattern\n * available; this makes the dangerous pattern impossible.\n *\n * Narrow on purpose \u2014 the brand is set only by this constructor, so an unrelated\n * error carrying a `status` is not admitted.\n */\nconst CLIENT_ERROR_BRAND: unique symbol = Symbol.for(\n 'xema.generatedClientError',\n) as never;\n\nexport class ClientError extends Error {\n constructor(\n public readonly status: number,\n public readonly url: string,\n public readonly body: unknown,\n ) {\n super(`HTTP ${status} from ${url}`);\n this.name = 'ClientError';\n // Non-enumerable: it must not appear in JSON, logs or snapshots \u2014 it is an\n // identity marker, not payload.\n Object.defineProperty(this, CLIENT_ERROR_BRAND, { value: true });\n }\n\n // `override` because the member shadows `Function.prototype[Symbol.hasInstance]`,\n // which a class constructor inherits: TypeScript 5.9+ reports TS4114 without it\n // under `noImplicitOverride`. Measured to compile on 5.5.4, 5.9.3, 6.0.3 and\n // 7.0.2 with the flag on AND off \u2014 pinned by\n // tests/custom-fetch-compiles-standalone.test.cjs.\n static override [Symbol.hasInstance](candidate: unknown): boolean {\n return (\n typeof candidate === 'object' &&\n candidate !== null &&\n CLIENT_ERROR_BRAND in candidate\n );\n }\n}\n\nlet clientConfig: ClientConfig | null = null;\n\n/**\n * THE MOUNT SCOPE \u2014 how one process can host several services without their\n * clients speaking for each other.\n *\n * `clientConfig` below is a MODULE global, and in a single-service process\n * that is correct: one writer, one configuration. Compose two services into one\n * process and both call `configureClient` on THIS SAME module instance, so the\n * second overwrites the first and every outbound call from BOTH services leaves\n * as whichever wired itself last \u2014 wrong base URL, and, because\n * `getAuthToken` is part of the config, WRONG BEARER. That is one tenant's\n * service calling a peer holding another tenant's credential, and it is silent.\n *\n * A composing host installs a hook under this well-known symbol that answers\n * one question: WHICH MOUNT is currently on the stack. Nothing else crosses.\n * `configureClient` then files the config under that mount, and\n * `getClientConfig` reads it back out under the same key.\n *\n * Three properties make this safe rather than clever:\n *\n * - The CONFIG is still built by the mount's own wiring, exactly as today.\n * The hook never supplies one. So a mount's base URL and bearer are\n * resolved FROM THE MOUNT; the scope only decides which drawer they go in.\n * A hook that RETURNED configuration would be a mount taking its identity\n * from ambient storage a neighbour can write \u2014 the inversion to refuse.\n * - The key is an OPAQUE OBJECT and the store is a `WeakMap`, so a mount's\n * configuration becomes unreachable when the host drops the mount, and no\n * client can enumerate the mounts or reach a sibling's entry.\n * - With NO hook installed \u2014 every process in the fleet today \u2014 both\n * functions behave exactly as they did before this existed.\n *\n * `Symbol.for` is the seam because a generated client must keep its\n * dependency surface at zero and a host cannot enumerate the clients a process\n * happens to load. It is the same instrument, and the same reasoning, as the\n * `ClientError` brand above.\n */\nconst XEMA_CLIENT_CONFIG_SCOPE = Symbol.for('xema.client-config-scope');\n\ntype MountScopeHook = () => object | undefined;\n\nfunction mountScopeHook(): MountScopeHook | undefined {\n const hook = (globalThis as Record<symbol, unknown>)[\n XEMA_CLIENT_CONFIG_SCOPE\n ];\n return typeof hook === 'function' ? (hook as MountScopeHook) : undefined;\n}\n\nfunction currentMountKey(): object | undefined {\n return mountScopeHook()?.();\n}\n\nconst perMountConfig = new WeakMap<object, ClientConfig>();\n\n\nexport function configureClient(config: ClientConfig): void {\n // Fail at WIRING time, not on the request that happens to be retried. A\n // client configured to retry without an observer is the exact defect this\n // transport was rebuilt to remove, so it must not be constructible.\n if ((config.maxRetries ?? 0) > 0 && !config.onRetry) {\n throw new Error(\n 'configureClient: maxRetries above 0 requires onRetry. A retry nothing ' +\n 'reports is indistinguishable from a slow server, which is how two ' +\n 'silent re-attempts were read as a 3,312ms call.',\n );\n }\n const hook = mountScopeHook();\n if (hook !== undefined) {\n const mount = hook();\n if (mount === undefined) {\n // A composing host is installed and no member is on the stack, so this\n // configuration belongs to NO member. Filing it in the module global\n // would hand it to every member that did not configure this client \u2014\n // someone else's base URL and bearer, silently.\n throw new Error(\n 'configureClient: called in a composed process outside every member. ' +\n 'Configure the client inside the member that uses it (its providers ' +\n 'and factories already run there).',\n );\n }\n perMountConfig.set(mount, config);\n return;\n }\n clientConfig = config;\n}\n\nexport function getClientConfig(): ClientConfig {\n const mount = currentMountKey();\n if (mount !== undefined) {\n const scoped = perMountConfig.get(mount);\n if (scoped) {\n return scoped;\n }\n // A member that never configured THIS client behaves exactly like a\n // dedicated service that did not either: it is refused. It used to fall\n // through to the module global, which in a composed process can only have\n // been written by some OTHER code \u2014 so the member called peers under a\n // base URL and bearer that were never its own.\n throw new Error(\n 'Client not configured for this member. Call configureClient({ baseUrl }) ' +\n 'inside the member before using endpoint functions.',\n );\n }\n if (!clientConfig) {\n throw new Error(\n 'Client not configured. Call configureClient({ baseUrl }) before using endpoint functions.',\n );\n }\n return clientConfig;\n}\n\n/*\n * RETRYING IS OPT-IN, OBSERVED, AND NARROW. Do not widen any of the three.\n *\n * This transport used to retry up to `maxRetries` (defaulting to THREE) over\n * 429/502/503/504 AND over any thrown network error, backing off from 1000ms,\n * with no log line anywhere. Three properties were wrong:\n *\n * 1. The DEFAULT was on. ~99% of the fleet's client configurations never\n * mention `maxRetries`, so two re-attempts could add ~3s to any call with\n * nothing to distinguish that from a slow peer. Every caller that DID set\n * it set it LOWER \u2014 canopy's control plane to 1, \"so a hard outage\n * surfaces inside the turn's latency budget rather than after three\n * backoffs\"; two llm-registry callers to 1; a test to 0. Nobody ever\n * raised it. A default three separate call sites work around is not a\n * default, and `configureOrvalClientResolved` cannot express the field at\n * all, so most callers could not have opted out if they had wanted to.\n * 2. It retried AMBIGUOUS failures. 502 and 504 mean a gateway did not get a\n * timely answer from upstream \u2014 the upstream may well have APPLIED the\n * request. So did a thrown network error mid-flight. Re-sending a POST in\n * either case is a duplicate write, and no amount of logging makes that\n * safe. Only 429 and 503 state positively that the request was NOT\n * processed, so only those are retried; everything else surfaces at once.\n * 3. Nothing reported it. Now `onRetry` is mandatory whenever the budget is\n * above 0, enforced in `configureClient`.\n *\n * Also note `baseUrlResolver` is awaited ONCE, above the loop: a re-attempt\n * returns to the same resolved instance. In a registry-resolved fleet the cure\n * for an unhealthy peer is re-resolution, which lives above this file \u2014 which\n * is a further reason not to lean on retrying here.\n *\n * Retry policy a caller genuinely wants belongs in `@xemahq/managed-fetch`,\n * which has backoff, a circuit breaker, a token bucket and health reporting,\n * and reports what it did.\n *\n * Enforced fleet-wide by `check-client-transport-envelope`, which compares\n * every client's transport to this template.\n */\n\n/** The only statuses that state the request was NOT processed. See above. */\nconst RETRYABLE_STATUSES = [429, 503];\n\n/**\n * The platform's correlation header, spelled once.\n *\n * Value-identical to what `RequestContextMiddleware` reads in\n * `@xemahq/platform-common`. It is a literal here rather than an import\n * because this file has ZERO imports on purpose: it ships byte-identical into\n * browser-target clients as well as server-target ones, and a dependency on a\n * NestJS-peer package would follow it into every one of them.\n */\nconst CORRELATION_ID_HEADER = 'X-Correlation-Id';\n\n/** Backoff floor, doubling per attempt up to {@link MAX_BACKOFF_MS}. */\nconst BASE_BACKOFF_MS = 1000;\n\n/** Ceiling on a single backoff, however many attempts have elapsed. */\nconst MAX_BACKOFF_MS = 30_000;\n\n/*\n * CALLER CANCELLATION REACHES EVERY WAIT BEFORE THE REQUEST IS SENT.\n *\n * `fetch` always honoured `options.signal`, but everything this transport\n * awaits BEFORE `fetch` \u2014 base-URL resolution, the header callbacks, the auth\n * token \u2014 did not, so a caller that aborted while a token was being minted sat\n * out the mint and then, at best, had its request refused. The only way to\n * cancel that wait was a process-wide interceptor aborting every outbound\n * request, which also aborts a SHARED single-flight token refresh and so fails\n * every other caller waiting on it.\n *\n * So each pre-send wait is RACED against the signal: the caller stops waiting\n * at once, and the work it was waiting on carries on for anybody else. The\n * rejection is the signal's own reason \u2014 exactly what `fetch` rejects with \u2014\n * so a caller sees ONE abort shape whenever it aborts. An aborted request is\n * never retried. Without a signal nothing here changes.\n */\nfunction abortedReason(signal: AbortSignal): unknown {\n // `abort()` with no argument sets a DOMException reason, so this is only\n // ever `undefined` for a hand-built signal; say so rather than throw it.\n return signal.reason ?? new DOMException('This operation was aborted', 'AbortError');\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n if (signal?.aborted) {\n throw abortedReason(signal);\n }\n}\n\nfunction raceAbort<V>(\n pending: V | Promise<V>,\n signal: AbortSignal | undefined,\n): Promise<V> {\n const promise = Promise.resolve(pending);\n if (!signal) {\n return promise;\n }\n if (signal.aborted) {\n promise.catch(() => undefined);\n return Promise.reject(abortedReason(signal));\n }\n return new Promise<V>((resolve, reject) => {\n const onAbort = (): void => {\n // The pending work may be shared; it carries on, and its eventual\n // rejection must not surface as an unhandled one on this side.\n promise.catch(() => undefined);\n reject(abortedReason(signal));\n };\n signal.addEventListener('abort', onAbort, { once: true });\n promise.then(\n (value) => {\n signal.removeEventListener('abort', onAbort);\n resolve(value);\n },\n (err: unknown) => {\n signal.removeEventListener('abort', onAbort);\n reject(err);\n },\n );\n });\n}\n\nasync function buildHeaders(\n config: ClientConfig,\n callerHeaders: RequestInit['headers'],\n signal: AbortSignal | undefined,\n): Promise<Headers> {\n const headers = new Headers(callerHeaders);\n\n // Global headers from config (caller-provided headers take precedence)\n if (config.getHeaders) {\n const globalHeaders = await raceAbort(config.getHeaders(), signal);\n for (const [key, value] of Object.entries(globalHeaders)) {\n if (!headers.has(key)) {\n headers.set(key, value);\n }\n }\n }\n\n // Correlation id (caller and global headers still take precedence).\n //\n // Without this, every server-to-server hop through a generated client started\n // a NEW trace: the id is read-or-minted per hop by the receiving service's\n // RequestContextMiddleware, and nothing carried it outbound \u2014 so an audit\n // journal could record a whole causal chain and offer no way to join it back\n // together.\n //\n // Absent resolver, or a resolver that answers `undefined`: NO header. The\n // receiver mints and a new trace begins, which is the truthful outcome when\n // there is nothing to continue.\n if (config.getCorrelationId && !headers.has(CORRELATION_ID_HEADER)) {\n const correlationId = await raceAbort(config.getCorrelationId(), signal);\n if (correlationId) {\n headers.set(CORRELATION_ID_HEADER, correlationId);\n }\n }\n\n // Auth token (caller or global headers take precedence)\n if (config.getAuthToken && !headers.has('Authorization')) {\n const token = await raceAbort(\n config.getAuthToken(signal ? { signal } : undefined),\n signal,\n );\n headers.set('Authorization', `Bearer ${token}`);\n }\n\n return headers;\n}\n\n/*\n * THE TRANSPORT RETURNS THE BODY UNCHANGED. Do not reintroduce an unwrap here.\n *\n * Xema services wrap every 2xx payload in a { data: T } envelope via the global\n * ResponseEnvelopeInterceptor (platform-common), and the generator emits types\n * that describe THAT ENVELOPE \u2014 every endpoint returns Promise<XDataEnvelope>\n * or Promise<XPaginatedEnvelope>, never a bare inner T. Consumers read the data\n * property themselves.\n *\n * This template used to peel data, justified by a comment claiming generated\n * types describe the inner T. That stopped being true when the generator moved\n * to envelope-typed returns, and the comment outlived the fact \u2014 so the peel\n * then contradicted every type in every package it seeded. Four clients shipped\n * that way (resource-governance x3, workload-runtime-api): declared\n * *DataEnvelope, returned the already-peeled inner object, so .data read\n * undefined at runtime on every non-paginated endpoint. Paginated calls hid it,\n * because the old peel deliberately preserved an envelope carrying pagination.\n *\n * Four MORE shipped it in repositories the gate could not see \u2014 license-api and\n * license-internal-api in xema-operator, plus their host-web mirrors \u2014 because\n * the gate ran in xema-base only. That is why it now runs in every repository\n * that ships a client, and why this file is generator-owned rather than seeded.\n */\n\nexport const customFetch = async <T>(\n url: string,\n options: RequestInit,\n): Promise<T> => {\n const config = getClientConfig();\n const signal = options.signal ?? undefined;\n throwIfAborted(signal);\n const base = config.baseUrlResolver\n ? await raceAbort(\n config.baseUrlResolver(signal ? { signal } : undefined),\n signal,\n )\n : config.baseUrl;\n if (base === undefined) {\n throw new Error(\n 'Client not configured: set baseUrl or baseUrlResolver via configureClient().',\n );\n }\n const fullUrl = `${base}${url}`;\n const maxRetries = config.maxRetries ?? 0;\n\n // A caller that supplied its own Authorization header owns that credential.\n // `buildHeaders` lets it win, so refreshing the CLIENT-WIDE token and\n // re-sending would replay the identical failing request with the identical\n // credential: one wasted round trip, plus a global refresh nobody asked for.\n const callerSuppliedAuth = new Headers(options.headers).has('Authorization');\n\n const headers = await buildHeaders(config, options.headers, signal);\n const requestInit: RequestInit = { ...options, headers };\n\n let delay = BASE_BACKOFF_MS;\n\n for (let attempt = 0; ; attempt++) {\n const response = await fetch(fullUrl, requestInit);\n\n if (\n response.status === 401 &&\n config.onUnauthorized &&\n !callerSuppliedAuth &&\n attempt === 0\n ) {\n await raceAbort(config.onUnauthorized(), signal);\n const refreshedHeaders = await buildHeaders(\n config,\n options.headers,\n signal,\n );\n const retryResponse = await fetch(fullUrl, {\n ...options,\n headers: refreshedHeaders,\n });\n const retryBody = await parseBody(retryResponse);\n if (retryResponse.status >= 400) {\n throw new ClientError(retryResponse.status, fullUrl, retryBody);\n }\n return retryBody as T;\n }\n\n if (\n !RETRYABLE_STATUSES.includes(response.status) ||\n attempt >= maxRetries\n ) {\n const body = await parseBody(response);\n if (response.status >= 400) {\n throw new ClientError(response.status, fullUrl, body);\n }\n return body as T;\n }\n\n const retryAfter = parseRetryAfter(response.headers.get('Retry-After'));\n const waitMs = retryAfter ?? addJitter(delay);\n // Non-null: `configureClient` refuses a budget above 0 without an observer,\n // and this line is unreachable unless `maxRetries` is above 0.\n (config.onRetry as (notice: RetryNotice) => void)({\n attempt: attempt + 1,\n maxRetries,\n status: response.status,\n waitMs,\n retryAfterHonoured: retryAfter !== undefined,\n url: fullUrl,\n method: options.method ?? 'GET',\n });\n await sleep(waitMs, signal);\n delay = Math.min(delay * 2, MAX_BACKOFF_MS);\n }\n};\n\n/**\n * Does this media type carry JSON?\n *\n * \u2500\u2500 THE OUTAGE THIS FIXES \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n *\n * This used to be `contentType?.includes('application/json')`, and EVERY error\n * this fleet returns failed that test. The platform's `GlobalExceptionFilter`\n * emits RFC 9457 problem documents and sets the media type explicitly \u2014\n * `.type(PROBLEM_DETAILS_CONTENT_TYPE)` before `.json()`, so it cannot be\n * overridden \u2014 and that constant is `application/problem+json`, which does NOT\n * contain the substring `application/json`: after `application/` comes\n * `problem+json`.\n *\n * So every non-2xx body fell through to `response.text()` and reached the\n * caller as an UNPARSED STRING. `ClientError.body` is typed `unknown`, so\n * nothing complained; every consumer that reads a machine-readable code off an\n * error \u2014 `error.body.code`, `error.body.details.code` \u2014 silently read\n * `undefined` instead, for every error, in every service.\n *\n * Measured in production on 2026-09-15: skill-registry-api's\n * `resolveOrNull()` absorbs `RELEASE_CHANNEL_NOT_FOUND` into `null` by exactly\n * that read. With the code unreadable the absorb never fired, a routine \"no\n * pointer on this channel\" 404 became a 500 on `GET /skills` and\n * `GET /describe-objects`, and agent-session-api's `apply_control_bundle` step\n * aborted EVERY session launch in the organisation \u2014 7,871 failed resolutions\n * an hour. A fix written for that exact page months earlier was present in the\n * running image and could not help, because the classifier it repaired was\n * being handed a string.\n *\n * \u2500\u2500 WHY THE STRUCTURED SUFFIX, NOT A SECOND SUBSTRING \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n *\n * Adding `|| includes('application/problem+json')` would fix this one media\n * type and leave the next one \u2014 `application/vnd.api+json`, and anything else\n * a service legitimately emits. RFC 6839 defines `+json` as the structured\n * syntax suffix meaning \"this is JSON\"; that is the actual rule, so it is the\n * rule implemented. Parameters are stripped first, because\n * `application/problem+json; charset=utf-8` is the same media type.\n */\nfunction isJsonMediaType(contentType: string | null): boolean {\n if (contentType === null) {\n return false;\n }\n const essence = contentType.split(';')[0]?.trim().toLowerCase() ?? '';\n return essence === 'application/json' || essence.endsWith('+json');\n}\n\nasync function parseBody(response: Response): Promise<unknown> {\n // 204 FIRST, and deliberately \u2014 this ORDER is carried from `develop`, which\n // fixed the same defect independently and got this half right where `main`\n // did not. A 204 carries no body, so `response.json()` on one throws\n // SyntaxError; and a 204 whose headers STILL declare a JSON content type is\n // ordinary, because the framework sets the header before the handler returns\n // nothing. With the JSON branch first, a documented `undefined` becomes a\n // thrown parse error. Pinned by a case in `transport-problem-json.test.cjs`.\n if (response.status === 204) {\n return undefined;\n }\n const contentType = response.headers.get('content-type');\n if (isJsonMediaType(contentType)) {\n return response.json();\n }\n return response.text();\n}\n\nfunction parseRetryAfter(value: string | null): number | undefined {\n if (!value) return undefined;\n const seconds = Number(value);\n if (!isNaN(seconds) && seconds >= 0) return seconds * 1000;\n const date = new Date(value);\n if (!isNaN(date.getTime())) return Math.max(0, date.getTime() - Date.now());\n return undefined;\n}\n\nfunction addJitter(delay: number): number {\n return delay + (Math.random() * 2 - 1) * delay * 0.25;\n}\n\n/** A retry backoff; the caller's signal ends it at once and is never retried. */\nfunction sleep(ms: number, signal: AbortSignal | undefined): Promise<void> {\n if (!signal) {\n return new Promise((resolve) => setTimeout(resolve, ms));\n }\n if (signal.aborted) {\n return Promise.reject(abortedReason(signal));\n }\n return new Promise((resolve, reject) => {\n const onAbort = (): void => {\n clearTimeout(timer);\n reject(abortedReason(signal));\n };\n const timer = setTimeout(() => {\n signal.removeEventListener('abort', onAbort);\n resolve();\n }, ms);\n signal.addEventListener('abort', onAbort, { once: true });\n });\n}\n\nexport default customFetch;\n";
|
|
2
2
|
//# sourceMappingURL=custom-fetch-template.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"custom-fetch-template.d.ts","sourceRoot":"","sources":["../../src/lib/custom-fetch-template.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,sBAAsB,
|
|
1
|
+
{"version":3,"file":"custom-fetch-template.d.ts","sourceRoot":"","sources":["../../src/lib/custom-fetch-template.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,sBAAsB,sk9BAsrBlC,CAAC"}
|
|
@@ -193,7 +193,12 @@ export class ClientError extends Error {
|
|
|
193
193
|
Object.defineProperty(this, CLIENT_ERROR_BRAND, { value: true });
|
|
194
194
|
}
|
|
195
195
|
|
|
196
|
-
|
|
196
|
+
// \`override\` because the member shadows \`Function.prototype[Symbol.hasInstance]\`,
|
|
197
|
+
// which a class constructor inherits: TypeScript 5.9+ reports TS4114 without it
|
|
198
|
+
// under \`noImplicitOverride\`. Measured to compile on 5.5.4, 5.9.3, 6.0.3 and
|
|
199
|
+
// 7.0.2 with the flag on AND off — pinned by
|
|
200
|
+
// tests/custom-fetch-compiles-standalone.test.cjs.
|
|
201
|
+
static override [Symbol.hasInstance](candidate: unknown): boolean {
|
|
197
202
|
return (
|
|
198
203
|
typeof candidate === 'object' &&
|
|
199
204
|
candidate !== null &&
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"custom-fetch-template.js","sourceRoot":"","sources":["../../src/lib/custom-fetch-template.ts"],"names":[],"mappings":";;;AAoBa,QAAA,sBAAsB,GAAG
|
|
1
|
+
{"version":3,"file":"custom-fetch-template.js","sourceRoot":"","sources":["../../src/lib/custom-fetch-template.ts"],"names":[],"mappings":";;;AAoBa,QAAA,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsrBrC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"default-stubs.d.ts","sourceRoot":"","sources":["../../src/lib/default-stubs.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAsL5D,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,oBAAoB,EAC7B,UAAU,EAAE,MAAM,GACjB,oBAAoB,
|
|
1
|
+
{"version":3,"file":"default-stubs.d.ts","sourceRoot":"","sources":["../../src/lib/default-stubs.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAsL5D,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,oBAAoB,EAC7B,UAAU,EAAE,MAAM,GACjB,oBAAoB,CAyKtB"}
|
|
@@ -101,10 +101,7 @@ function applyDefaultOpenApiStubs(builder, serviceDir) {
|
|
|
101
101
|
const IDENTITY_BOOTSTRAP_CONFIG = tryResolveExport(serviceDir, '@xemahq/identity-client', 'IDENTITY_BOOTSTRAP_CONFIG');
|
|
102
102
|
if (IDENTITY_BOOTSTRAP_CONFIG) {
|
|
103
103
|
builder.overrideProvider(IDENTITY_BOOTSTRAP_CONFIG).useValue({
|
|
104
|
-
identityApiUrl: 'http://localhost:3053',
|
|
105
|
-
identityApiInternalToken: 'dummy-token',
|
|
106
104
|
serviceName: readServiceName(serviceDir),
|
|
107
|
-
serviceDisplayName: readServiceName(serviceDir),
|
|
108
105
|
});
|
|
109
106
|
}
|
|
110
107
|
const EventHubBootstrapService = tryResolveExport(serviceDir, '@xemahq/event-hub-client', 'EventHubBootstrapService');
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"default-stubs.js","sourceRoot":"","sources":["../../src/lib/default-stubs.ts"],"names":[],"mappings":";;AAwLA,
|
|
1
|
+
{"version":3,"file":"default-stubs.js","sourceRoot":"","sources":["../../src/lib/default-stubs.ts"],"names":[],"mappings":";;AAwLA,4DA4KC;AApWD,yCAA0C;AAqB1C,SAAS,gBAAgB,CACvB,OAAe,EACf,OAAe,EACf,UAAkB;IAElB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAEhE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAA4B,CAAC;QACzD,OAAO,GAAG,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAID,SAAS,eAAe,CAAC,UAAkB;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,IAAA,gBAAI,EAAC,UAAU,EAAE,cAAc,CAAC,CAAsB,CAAC;QAC3E,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;IAET,CAAC;IACD,OAAO,CACL,IAAA,mBAAO,EAAC,IAAA,gBAAI,EAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,iBAAiB,CACzE,CAAC;AACJ,CAAC;AAiBD,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AAa9E,SAAS,mBAAmB,CAC1B,UAAkB;IAElB,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,EAAE,gBAAgB,EAAE,QAAQ,CAEzD,CAAC;IACd,MAAM,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC;IAC/C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,mBAAmB,UAAU,yCAAyC;YACpE,wEAAwE;YACxE,wEAAwE;YACxE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAQD,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,MAAM,gBAAgB,GAAG,EAAE,MAAM,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;IACrE,MAAM,OAAO,GAAkD;QAC7D,GAAG,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE;YAChB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACjC,OAAO,gBAAgB,CAAC;YAC1B,CAAC;YACD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACpE,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACjC,CAAC;YACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3D,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;YACpB,CAAC;YACD,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;KACjC,CAAC;IACF,MAAM,IAAI,GAAY,IAAI,KAAK,CAAC,EAAW,EAAE,OAAO,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,aAAa,GAAG;IACpB,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IACpD,kBAAkB,EAAE,GAAG,EAAE,CAAC,uBAAuB;IACjD,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC;IAClC,WAAW,EAAE,GAAG,EAAE,CAAC,oBAAoB;CACxC,CAAC;AAEF,MAAM,wBAAwB,GAAG;IAC/B,YAAY,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;IAC5B,eAAe,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;IAC/B,oBAAoB,EAAE,GAAG,EAAE,CAAC,IAAI;IAChC,mBAAmB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;CACjD,CAAC;AAEF,MAAM,qBAAqB,GAAG;IAC5B,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QAClB,OAAO,EAAE,kEAAkE;QAC3E,MAAM,EAAE,oCAAoC;KAC7C,CAAC;CACH,CAAC;AAkBF,MAAM,sBAAsB,GAAG,CAAC,WAAW,EAAE,WAAW,CAAU,CAAC;AAQnE,MAAM,sBAAsB,GAAG;IAC7B,2BAA2B;IAC3B,+BAA+B;IAC/B,kBAAkB;CACnB,CAAC;AAMF,SAAgB,wBAAwB,CACtC,OAA6B,EAC7B,UAAkB;IAElB,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAoB,CAAC;IAGzD,MAAM,aAAa,GAAG,gBAAgB,CACpC,UAAU,EACV,IAAA,gBAAI,EAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,CAAC,EACnD,eAAe,CAChB,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO;aACJ,gBAAgB,CAAC,aAAsB,CAAC;aACxC,QAAQ,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5C,CAAC;IAGD,MAAM,wBAAwB,GAAG,gBAAgB,CAC/C,UAAU,EACV,yBAAyB,EACzB,0BAA0B,CAC3B,CAAC;IACF,IAAI,wBAAwB,EAAE,CAAC;QAC7B,OAAO;aACJ,gBAAgB,CAAC,wBAAiC,CAAC;aACnD,QAAQ,CAAC,aAAa,CAAC,CAAC;QAS3B,oBAAoB,CAAC,GAAG,CAAC,wBAAwB,EAAE,aAAa,CAAC,CAAC;IACpE,CAAC;IAQD,MAAM,yBAAyB,GAAG,gBAAgB,CAChD,UAAU,EACV,yBAAyB,EACzB,2BAA2B,CAC5B,CAAC;IACF,IAAI,yBAAyB,EAAE,CAAC;QAC9B,OAAO,CAAC,gBAAgB,CAAC,yBAAkC,CAAC,CAAC,QAAQ,CAAC;YACpE,WAAW,EAAE,eAAe,CAAC,UAAU,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IAGD,MAAM,wBAAwB,GAAG,gBAAgB,CAC/C,UAAU,EACV,0BAA0B,EAC1B,0BAA0B,CAC3B,CAAC;IACF,IAAI,wBAAwB,EAAE,CAAC;QAC7B,OAAO;aACJ,gBAAgB,CAAC,wBAAiC,CAAC;aACnD,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,cAAc,GAAG,gBAAgB,CACrC,UAAU,EACV,0BAA0B,EAC1B,gBAAgB,CACjB,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO;aACJ,gBAAgB,CAAC,cAAuB,CAAC;aACzC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;IAGD,MAAM,iBAAiB,GAAG,gBAAgB,CACxC,UAAU,EACV,yBAAyB,EACzB,mBAAmB,CACpB,CAAC;IACF,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO;aACJ,aAAa,CAAC,iBAA0B,CAAC;aACzC,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAID,MAAM,kBAAkB,GAAG,gBAAgB,CACzC,UAAU,EACV,yBAAyB,EACzB,oBAAoB,CACrB,CAAC;IACF,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,CAAC,gBAAgB,CAAC,kBAA2B,CAAC,CAAC,QAAQ,CAAC;YAC7D,sBAAsB,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAuBD,MAAM,aAAa,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IAC3E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,CAAC,yBAAyB,EAAE,GAAG,sBAAsB,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC;YACH,SAAS,CAAC,GAAG,CAAC,IAAA,mBAAO,EAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAW,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,gBAAgB,GAAG,gBAAgB,CACvC,IAAI,EACJ,cAAc,EACd,kBAAkB,CACnB,CAAC;QACF,IAAI,gBAAgB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC7D,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACpC,OAAO;iBACJ,gBAAgB,CAAC,gBAAyB,CAAC;iBAC3C,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAGD,MAAM,sBAAsB,GAAG,gBAAgB,CAC7C,UAAU,EACV,+BAA+B,EAC/B,wBAAwB,CACzB,CAAC;IACF,MAAM,yBAAyB,GAAG,gBAAgB,CAChD,UAAU,EACV,+BAA+B,EAC/B,2BAA2B,CACG,CAAC;IACjC,IAAI,sBAAsB,IAAI,yBAAyB,EAAE,CAAC;QACxD,OAAO;aACJ,gBAAgB,CAAC,sBAA+B,CAAC;aACjD,QAAQ,CAAC,yBAAyB,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,gCAAgC,CAC9B,OAAO,EACP,UAAU,EACV,oBAAoB,CACrB,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC;AA+BD,SAAS,gCAAgC,CACvC,OAA6B,EAC7B,UAAkB,EAClB,oBAAmD;IAEnD,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3D,gBAAgB,CAAC,UAAU,EAAE,cAAc,EAAE,IAAI,CAAC,CACnD,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAW,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,sBAAsB,EAAE,CAAC;QACzC,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAA,mBAAO,EAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,sBAAsB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YACzC,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;YAG/D,IAAI,OAAO,IAAI,OAAO,KAAK,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,IAAI,oBAAoB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC7D,OAAO;IACT,CAAC;IAID,MAAM,QAAQ,GAAG,GAAU,EAAE;QAC3B,MAAM,IAAI,KAAK,CACb,6EAA6E;YAC3E,8EAA8E;YAC9E,8EAA8E,CACjF,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,EAAE,EACF;QACE,GAAG,CAAC,OAAO,EAAE,IAAI;YACf,IAAI,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAChD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CACF,CAAC;IACF,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1B,IAAI,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"seed-openapi-env.d.ts","sourceRoot":"","sources":["../../src/lib/seed-openapi-env.ts"],"names":[],"mappings":"AA0CA,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAI9D;AAMD,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,
|
|
1
|
+
{"version":3,"file":"seed-openapi-env.d.ts","sourceRoot":"","sources":["../../src/lib/seed-openapi-env.ts"],"names":[],"mappings":"AA0CA,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAI9D;AAMD,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAiFtD"}
|
|
@@ -31,7 +31,6 @@ function seedOpenApiEnv(serviceId) {
|
|
|
31
31
|
DB_PASSWORD: 'dummy',
|
|
32
32
|
REDIS_URL: 'redis://localhost:6379',
|
|
33
33
|
IDENTITY_API_URL: 'http://localhost:3053',
|
|
34
|
-
IDENTITY_API_INTERNAL_TOKEN: 'dummy-token',
|
|
35
34
|
JWT_PUBLIC_KEY_URL: 'http://localhost:8180/realms/dummy/protocol/openid-connect/certs',
|
|
36
35
|
JWT_ISSUER: 'http://localhost:8180/realms/dummy',
|
|
37
36
|
GATEWAY_JWT_SECRET: 'dummy-gateway-jwt-secret-for-openapi-extraction',
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"seed-openapi-env.js","sourceRoot":"","sources":["../../src/lib/seed-openapi-env.ts"],"names":[],"mappings":";;AA0CA,oDAIC;AAMD,
|
|
1
|
+
{"version":3,"file":"seed-openapi-env.js","sourceRoot":"","sources":["../../src/lib/seed-openapi-env.ts"],"names":[],"mappings":";;AA0CA,oDAIC;AAMD,wCAiFC;AArHD,MAAM,wBAAwB,GAC5B,kEAAkE,CAAC;AACrE,MAAM,gBAAgB,GAAG,8CAA8C,CAAC;AAGxE,SAAS,IAAI,CAAC,IAA4B;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;AACH,CAAC;AAGD,MAAM,eAAe,GAAG,eAAe,CAAC;AAYxC,SAAgB,oBAAoB,CAAC,SAAiB;IACpD,OAAO,WAAW,SAAS,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE;SACzD,WAAW,EAAE;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAMD,SAAgB,cAAc,CAAC,SAAiB;IAC9C,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,QAAQ,EAAE,aAAa;QASvB,uBAAuB,EAAE,GAAG;QAO5B,YAAY,EAAE,2CAA2C,eAAe,WAAW,MAAM,EAAE;QAC3F,OAAO,EAAE,WAAW;QACpB,OAAO,EAAE,MAAM;QACf,OAAO,EAAE,eAAe;QACxB,SAAS,EAAE,MAAM;QACjB,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,OAAO;QACpB,SAAS,EAAE,wBAAwB;QAGnC,gBAAgB,EAAE,uBAAuB;QACzC,kBAAkB,EAChB,kEAAkE;QACpE,UAAU,EAAE,oCAAoC;QAChD,kBAAkB,EAAE,iDAAiD;QACrE,wBAAwB,EAAE,uBAAuB;QAKjD,mBAAmB,EAAE,gBAAgB;QAMrC,aAAa,EAAE,uBAAuB;QACtC,WAAW,EAAE,uCAAuC;QAGpD,eAAe,EAAE,uBAAuB;QACxC,cAAc,EAAE,uBAAuB;QACvC,oBAAoB,EAAE,uBAAuB;QAC7C,mBAAmB,EAAE,uBAAuB;QAC5C,sBAAsB,EAAE,uBAAuB;QAC/C,sBAAsB,EAAE,uBAAuB;QAC/C,wBAAwB,EAAE,uBAAuB;QACjD,yBAAyB,EAAE,uBAAuB;QAClD,6BAA6B,EAAE,uBAAuB;QACtD,cAAc,EAAE,uBAAuB;QACvC,eAAe,EAAE,uBAAuB;QACxC,2BAA2B,EAAE,uBAAuB;QAGpD,kBAAkB,EAAE,sBAAsB;QAC1C,oBAAoB,EAAE,gCAAgC;QACtD,SAAS,EAAE,uBAAuB;QAClC,gBAAgB,EAAE,aAAa;QAC/B,gBAAgB,EAAE,kBAAkB;QAGpC,qBAAqB,EAAE,wBAAwB;QAC/C,qBAAqB,EAAE,gBAAgB;QACvC,2BAA2B,EACzB,kEAAkE;QACpE,uBAAuB,EACrB,kEAAkE;QAGpE,yBAAyB,EAAE,+BAA+B;QAC1D,uBAAuB,EAAE,6BAA6B;KACvD,CAAC,CAAC;AACL,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/api-client-generator",
|
|
3
|
-
"version": "2.1.
|
|
3
|
+
"version": "2.1.2",
|
|
4
4
|
"description": "Layer 1 — the single, central OpenAPI + ORVAL client generator for every Xema NestJS service. Replaces the per-service orval.config.ts / scripts/extract-openapi.ts / scripts/build-client-index.js trio with two bins (xema-openapi, xema-client-generate). Extracts one OpenAPI document per ApiSurface (public/internal/operator) using the @XemaApiSurface decorator metadata, generates one ORVAL client package per non-empty surface (every surface of a service landing on ONE derived version — the highest its clients already carry, advanced a patch when the generated output changes), and stamps deterministic `xema` provenance metadata into each generated client package.json. No heuristics: a route ships in a surface only if it (or its controller) is explicitly classified, and no client version is ever typed by hand.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"xema",
|
|
@@ -62,8 +62,8 @@
|
|
|
62
62
|
"prettier": "3.6.2",
|
|
63
63
|
"reflect-metadata": "0.2.2",
|
|
64
64
|
"typescript": "5.9.3",
|
|
65
|
-
"@xemahq/eslint-config": "0.
|
|
66
|
-
"@xemahq/xema-decorators": "0.
|
|
65
|
+
"@xemahq/eslint-config": "0.10.0",
|
|
66
|
+
"@xemahq/xema-decorators": "0.21.0"
|
|
67
67
|
},
|
|
68
68
|
"exports": {
|
|
69
69
|
".": {
|