@zitadel/api 0.0.0

package/dist/runtime/config.mjs

@@ -0,0 +1,70 @@
+import { setProxyPath } from "./base-url.mjs";
+import { createApi } from "./api-factory.mjs";
+//#region src/runtime/config.ts
+let currentProject = null;
+/**
+* Per-project API client cache. Ensures `getApi(project)` returns the
+* same instance for the same project handle — no re-wrapping on every call.
+*/
+const apiCache = /* @__PURE__ */ new WeakMap();
+/**
+* Initializes app-wide SDK configuration and returns the frozen
+* {@link ZitadelProject} handle.
+*
+* Write-once — subsequent calls with the same values return the original
+* handle; calls with different values log a warning and return the
+* original. This prevents accidental overwrites while remaining safe
+* for HMR and framework double-mounts.
+*/
+function configureZitadel(config) {
+	const resolvedProxyPath = config.proxyPath ?? "/__nextgen";
+	if (currentProject !== null) {
+		if (currentProject.proxyPath === resolvedProxyPath && currentProject.projectId === config.projectId && currentProject.url === config.url) return currentProject;
+		console.warn(`[zitadel] configureZitadel() already called with different values. Ignoring: ${JSON.stringify(config)}`);
+		return currentProject;
+	}
+	currentProject = Object.freeze({
+		proxyPath: resolvedProxyPath,
+		projectId: config.projectId,
+		url: config.url
+	});
+	setProxyPath(resolvedProxyPath);
+	return currentProject;
+}
+/**
+* Returns a typed API client for the given project, with the base URL
+* pre-bound. Cached per project handle — safe to call multiple times.
+*
+* ```ts
+* const project = configureZitadel({ ... });
+* export const api = getApi(project);
+* ```
+*/
+function getApi(project) {
+	let api = apiCache.get(project);
+	if (!api) {
+		api = createApi(project.proxyPath);
+		apiCache.set(project, api);
+	}
+	return api;
+}
+/**
+* Returns the current project handle, or `null` if {@link configureZitadel}
+* has not been called yet.
+*/
+function getZitadelConfig() {
+	return currentProject;
+}
+/**
+* Reset internal state. **Test-only** — not exported from the package's
+* public API. Allows tests to call `configureZitadel()` multiple times
+* across isolated test cases without the write-once guard rejecting them.
+*/
+function _resetConfigForTesting() {
+	currentProject = null;
+	setProxyPath("");
+}
+//#endregion
+export { _resetConfigForTesting, configureZitadel, getApi, getZitadelConfig };
+
+//# sourceMappingURL=config.mjs.map

package/dist/runtime/config.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.mjs","names":[],"sources":["../../src/runtime/config.ts"],"sourcesContent":["import { setProxyPath } from \"./base-url\";\nimport { createApi, type ZitadelApi } from \"./api-factory\";\n\n/**\n * Input options for {@link configureZitadel}.\n */\nexport interface ZitadelConfig {\n  /** Proxy path for API requests (e.g. `\"/__nextgen\"`). Optional — defaults to `\"/__nextgen\"`. */\n  proxyPath?: string;\n\n  /** Project ID passed to flow creation. */\n  projectId: string;\n\n  /**\n   * Full URL of the Zitadel auth backend (e.g. `\"http://localhost:8080\"`).\n   * Used by server-side middleware for proxying and JWT verification.\n   * Optional — not needed in client-only setups.\n   */\n  url?: string;\n}\n\n/**\n * The initialized project handle returned by {@link configureZitadel}.\n * Pure data — use factory functions like {@link getApi} to derive services.\n */\nexport interface ZitadelProject {\n  /** Proxy path for API requests. */\n  readonly proxyPath: string;\n\n  /** Project ID passed to flow creation. */\n  readonly projectId: string;\n\n  /** Full URL of the Zitadel auth backend. */\n  readonly url?: string;\n}\n\nexport type { ZitadelApi };\n\nlet currentProject: ZitadelProject | null = null;\n\n/**\n * Per-project API client cache. Ensures `getApi(project)` returns the\n * same instance for the same project handle — no re-wrapping on every call.\n */\nconst apiCache = new WeakMap<ZitadelProject, ZitadelApi>();\n\n/**\n * Initializes app-wide SDK configuration and returns the frozen\n * {@link ZitadelProject} handle.\n *\n * Write-once — subsequent calls with the same values return the original\n * handle; calls with different values log a warning and return the\n * original. This prevents accidental overwrites while remaining safe\n * for HMR and framework double-mounts.\n */\nexport function configureZitadel(config: ZitadelConfig): ZitadelProject {\n  const resolvedProxyPath = config.proxyPath ?? \"/__nextgen\";\n\n  if (currentProject !== null) {\n    // Same values → no-op (safe for HMR / React strict mode double-mount)\n    if (\n      currentProject.proxyPath === resolvedProxyPath &&\n      currentProject.projectId === config.projectId &&\n      currentProject.url === config.url\n    ) {\n      return currentProject;\n    }\n    console.warn(\n      `[zitadel] configureZitadel() already called with different values. ` +\n        `Ignoring: ${JSON.stringify(config)}`,\n    );\n    return currentProject;\n  }\n\n  currentProject = Object.freeze({\n    proxyPath: resolvedProxyPath,\n    projectId: config.projectId,\n    url: config.url,\n  });\n\n  // Keep the global in sync for the generated code's internal use\n  setProxyPath(resolvedProxyPath);\n\n  return currentProject;\n}\n\n/**\n * Returns a typed API client for the given project, with the base URL\n * pre-bound. Cached per project handle — safe to call multiple times.\n *\n * ```ts\n * const project = configureZitadel({ ... });\n * export const api = getApi(project);\n * ```\n */\nexport function getApi(project: ZitadelProject): ZitadelApi {\n  let api = apiCache.get(project);\n  if (!api) {\n    api = createApi(project.proxyPath);\n    apiCache.set(project, api);\n  }\n  return api;\n}\n\n/**\n * Returns the current project handle, or `null` if {@link configureZitadel}\n * has not been called yet.\n */\nexport function getZitadelConfig(): ZitadelProject | null {\n  return currentProject;\n}\n\n/**\n * Reset internal state. **Test-only** — not exported from the package's\n * public API. Allows tests to call `configureZitadel()` multiple times\n * across isolated test cases without the write-once guard rejecting them.\n */\nexport function _resetConfigForTesting(): void {\n  currentProject = null;\n  setProxyPath(\"\");\n}\n"],"mappings":";;;AAsCA,IAAI,iBAAwC;;;;;AAM5C,MAAM,2BAAW,IAAI,SAAqC;;;;;;;;;;AAW1D,SAAgB,iBAAiB,QAAuC;CACtE,MAAM,oBAAoB,OAAO,aAAa;AAE9C,KAAI,mBAAmB,MAAM;AAE3B,MACE,eAAe,cAAc,qBAC7B,eAAe,cAAc,OAAO,aACpC,eAAe,QAAQ,OAAO,IAE9B,QAAO;AAET,UAAQ,KACN,gFACe,KAAK,UAAU,OAAO,GACtC;AACD,SAAO;;AAGT,kBAAiB,OAAO,OAAO;EAC7B,WAAW;EACX,WAAW,OAAO;EAClB,KAAK,OAAO;EACb,CAAC;AAGF,cAAa,kBAAkB;AAE/B,QAAO;;;;;;;;;;;AAYT,SAAgB,OAAO,SAAqC;CAC1D,IAAI,MAAM,SAAS,IAAI,QAAQ;AAC/B,KAAI,CAAC,KAAK;AACR,QAAM,UAAU,QAAQ,UAAU;AAClC,WAAS,IAAI,SAAS,IAAI;;AAE5B,QAAO;;;;;;AAOT,SAAgB,mBAA0C;AACxD,QAAO;;;;;;;AAQT,SAAgB,yBAA+B;AAC7C,kBAAiB;AACjB,cAAa,GAAG"}

package/dist/runtime/fetch.d.mts

@@ -0,0 +1,36 @@
+//#region src/runtime/fetch.d.ts
+/**
+ * Framework-neutral failure type the orval-generated client throws on
+ * any non-2xx response. Carries the HTTP status, the parsed error body
+ * (the spec's `{code, message, details?}` envelope when the server
+ * returned one), and the request URL — enough for callers to map to
+ * their own error taxonomy without re-implementing the fetch layer.
+ *
+ * Callers that don't care about the distinction can catch `ApiError`
+ * generically; callers that do (the CLI's `toZitadelError`) read
+ * `status` and decide.
+ */
+declare class ApiError extends Error {
+  readonly status: number;
+  readonly url: string;
+  readonly body: unknown;
+  constructor(status: number, url: string, body: unknown, message: string);
+}
+/**
+ * The orval `mutator` for the fetch client. Every generated operation
+ * routes its request through this function instead of the global
+ * `fetch`. We pin three concerns here so generated call sites stay
+ * focused on the shape of one HTTP call:
+ *
+ * - bearer auth — read from `runtime/auth.ts` and attached automatically;
+ * - non-2xx → throw — orval's stock client parses the body regardless
+ *   of status, so callers would have to inspect every response. Throw
+ *   `ApiError` on `!res.ok` so failures interrupt control flow;
+ * - body parsing — return the parsed JSON typed as `T` (the operation's
+ *   return type, threaded through by orval), or `undefined` for the
+ *   spec's `204`/`205`/`304` no-body responses.
+ */
+declare function customFetch<T>(url: string, options: RequestInit): Promise<T>;
+//#endregion
+export { ApiError, customFetch };
+//# sourceMappingURL=fetch.d.mts.map

package/dist/runtime/fetch.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.mts","names":[],"sources":["../../src/runtime/fetch.ts"],"mappings":";;AAaA;;;;;;;;;;cAAa,QAAA,SAAiB,KAAA;EAAA,SACnB,MAAA;EAAA,SACA,GAAA;EAAA,SACA,IAAA;cAEG,MAAA,UAAgB,GAAA,UAAa,IAAA,WAAe,OAAA;AAAA;;;;;;;;;;;;;;;iBAuBpC,WAAA,GAAA,CAAe,GAAA,UAAa,OAAA,EAAS,WAAA,GAAc,OAAA,CAAQ,CAAA"}

package/dist/runtime/fetch.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Framework-neutral failure type the orval-generated client throws on
+ * any non-2xx response. Carries the HTTP status, the parsed error body
+ * (the spec's `{code, message, details?}` envelope when the server
+ * returned one), and the request URL — enough for callers to map to
+ * their own error taxonomy without re-implementing the fetch layer.
+ *
+ * Callers that don't care about the distinction can catch `ApiError`
+ * generically; callers that do (the CLI's `toZitadelError`) read
+ * `status` and decide.
+ */
+export declare class ApiError extends Error {
+    readonly status: number;
+    readonly url: string;
+    readonly body: unknown;
+    constructor(status: number, url: string, body: unknown, message: string);
+}
+/**
+ * The orval `mutator` for the fetch client. Every generated operation
+ * routes its request through this function instead of the global
+ * `fetch`. We pin three concerns here so generated call sites stay
+ * focused on the shape of one HTTP call:
+ *
+ * - bearer auth — read from `runtime/auth.ts` and attached automatically;
+ * - non-2xx → throw — orval's stock client parses the body regardless
+ *   of status, so callers would have to inspect every response. Throw
+ *   `ApiError` on `!res.ok` so failures interrupt control flow;
+ * - body parsing — return the parsed JSON typed as `T` (the operation's
+ *   return type, threaded through by orval), or `undefined` for the
+ *   spec's `204`/`205`/`304` no-body responses.
+ */
+export declare function customFetch<T>(url: string, options: RequestInit): Promise<T>;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/runtime/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/runtime/fetch.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAEvB,YAAY,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAMtE;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,WAAW,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAmBlF"}

package/dist/runtime/fetch.mjs

@@ -0,0 +1,76 @@
+import { getApiAuthToken } from "./auth.mjs";
+//#region src/runtime/fetch.ts
+/**
+* Framework-neutral failure type the orval-generated client throws on
+* any non-2xx response. Carries the HTTP status, the parsed error body
+* (the spec's `{code, message, details?}` envelope when the server
+* returned one), and the request URL — enough for callers to map to
+* their own error taxonomy without re-implementing the fetch layer.
+*
+* Callers that don't care about the distinction can catch `ApiError`
+* generically; callers that do (the CLI's `toZitadelError`) read
+* `status` and decide.
+*/
+var ApiError = class extends Error {
+	status;
+	url;
+	body;
+	constructor(status, url, body, message) {
+		super(message);
+		this.name = "ApiError";
+		this.status = status;
+		this.url = url;
+		this.body = body;
+	}
+};
+/**
+* The orval `mutator` for the fetch client. Every generated operation
+* routes its request through this function instead of the global
+* `fetch`. We pin three concerns here so generated call sites stay
+* focused on the shape of one HTTP call:
+*
+* - bearer auth — read from `runtime/auth.ts` and attached automatically;
+* - non-2xx → throw — orval's stock client parses the body regardless
+*   of status, so callers would have to inspect every response. Throw
+*   `ApiError` on `!res.ok` so failures interrupt control flow;
+* - body parsing — return the parsed JSON typed as `T` (the operation's
+*   return type, threaded through by orval), or `undefined` for the
+*   spec's `204`/`205`/`304` no-body responses.
+*/
+async function customFetch(url, options) {
+	const token = getApiAuthToken();
+	const headers = new Headers(options.headers);
+	if (token && !headers.has("authorization")) headers.set("authorization", `Bearer ${token}`);
+	const res = await fetch(url, {
+		...options,
+		headers
+	});
+	const rawBody = [
+		204,
+		205,
+		304
+	].includes(res.status) ? "" : await res.text();
+	const parsed = rawBody ? safeJsonParse(rawBody) : void 0;
+	if (!res.ok) {
+		const message = `${options.method ?? "GET"} ${url} returned ${res.status}`;
+		throw new ApiError(res.status, url, parsed, message);
+	}
+	return parsed;
+}
+/**
+* `JSON.parse` wrapped so a non-JSON body (e.g. an HTML 502 from a
+* proxy) becomes `{ raw: "<text>" }` instead of throwing inside
+* `customFetch`. The thrown `ApiError` then carries something useful
+* for the user to see.
+*/
+function safeJsonParse(text) {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return { raw: text };
+	}
+}
+//#endregion
+export { ApiError, customFetch };
+
+//# sourceMappingURL=fetch.mjs.map

package/dist/runtime/fetch.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.mjs","names":[],"sources":["../../src/runtime/fetch.ts"],"sourcesContent":["import { getApiAuthToken } from \"./auth\";\n\n/**\n * Framework-neutral failure type the orval-generated client throws on\n * any non-2xx response. Carries the HTTP status, the parsed error body\n * (the spec's `{code, message, details?}` envelope when the server\n * returned one), and the request URL — enough for callers to map to\n * their own error taxonomy without re-implementing the fetch layer.\n *\n * Callers that don't care about the distinction can catch `ApiError`\n * generically; callers that do (the CLI's `toZitadelError`) read\n * `status` and decide.\n */\nexport class ApiError extends Error {\n  readonly status: number;\n  readonly url: string;\n  readonly body: unknown;\n\n  constructor(status: number, url: string, body: unknown, message: string) {\n    super(message);\n    this.name = \"ApiError\";\n    this.status = status;\n    this.url = url;\n    this.body = body;\n  }\n}\n\n/**\n * The orval `mutator` for the fetch client. Every generated operation\n * routes its request through this function instead of the global\n * `fetch`. We pin three concerns here so generated call sites stay\n * focused on the shape of one HTTP call:\n *\n * - bearer auth — read from `runtime/auth.ts` and attached automatically;\n * - non-2xx → throw — orval's stock client parses the body regardless\n *   of status, so callers would have to inspect every response. Throw\n *   `ApiError` on `!res.ok` so failures interrupt control flow;\n * - body parsing — return the parsed JSON typed as `T` (the operation's\n *   return type, threaded through by orval), or `undefined` for the\n *   spec's `204`/`205`/`304` no-body responses.\n */\nexport async function customFetch<T>(url: string, options: RequestInit): Promise<T> {\n  const token = getApiAuthToken();\n  const headers = new Headers(options.headers);\n  if (token && !headers.has(\"authorization\")) {\n    headers.set(\"authorization\", `Bearer ${token}`);\n  }\n\n  const res = await fetch(url, { ...options, headers });\n\n  const noBody = [204, 205, 304].includes(res.status);\n  const rawBody = noBody ? \"\" : await res.text();\n  const parsed = rawBody ? (safeJsonParse(rawBody) as unknown) : undefined;\n\n  if (!res.ok) {\n    const message = `${options.method ?? \"GET\"} ${url} returned ${res.status}`;\n    throw new ApiError(res.status, url, parsed, message);\n  }\n\n  return parsed as T;\n}\n\n/**\n * `JSON.parse` wrapped so a non-JSON body (e.g. an HTML 502 from a\n * proxy) becomes `{ raw: \"<text>\" }` instead of throwing inside\n * `customFetch`. The thrown `ApiError` then carries something useful\n * for the user to see.\n */\nfunction safeJsonParse(text: string): unknown {\n  try {\n    return JSON.parse(text);\n  } catch {\n    return { raw: text };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAaA,IAAa,WAAb,cAA8B,MAAM;CAClC;CACA;CACA;CAEA,YAAY,QAAgB,KAAa,MAAe,SAAiB;AACvE,QAAM,QAAQ;AACd,OAAK,OAAO;AACZ,OAAK,SAAS;AACd,OAAK,MAAM;AACX,OAAK,OAAO;;;;;;;;;;;;;;;;;AAkBhB,eAAsB,YAAe,KAAa,SAAkC;CAClF,MAAM,QAAQ,iBAAiB;CAC/B,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,KAAI,SAAS,CAAC,QAAQ,IAAI,gBAAgB,CACxC,SAAQ,IAAI,iBAAiB,UAAU,QAAQ;CAGjD,MAAM,MAAM,MAAM,MAAM,KAAK;EAAE,GAAG;EAAS;EAAS,CAAC;CAGrD,MAAM,UADS;EAAC;EAAK;EAAK;EAAI,CAAC,SAAS,IAAI,OACtB,GAAG,KAAK,MAAM,IAAI,MAAM;CAC9C,MAAM,SAAS,UAAW,cAAc,QAAQ,GAAe,KAAA;AAE/D,KAAI,CAAC,IAAI,IAAI;EACX,MAAM,UAAU,GAAG,QAAQ,UAAU,MAAM,GAAG,IAAI,YAAY,IAAI;AAClE,QAAM,IAAI,SAAS,IAAI,QAAQ,KAAK,QAAQ,QAAQ;;AAGtD,QAAO;;;;;;;;AAST,SAAS,cAAc,MAAuB;AAC5C,KAAI;AACF,SAAO,KAAK,MAAM,KAAK;SACjB;AACN,SAAO,EAAE,KAAK,MAAM"}