@zitadel/api 0.1.0-alpha.9 → 1.0.0-alpha.21

package/dist/runtime/config.mjs

@@ -1,5 +1,5 @@
 import { setProxyPath } from "./base-url.mjs";
-import { createApi } from "./api-factory.mjs";
+import { createZitadelClient } from "./api-factory.mjs";
 //#region src/runtime/config.ts
 /**
 * Slot for the configured project, stored on `globalThis` under a
@@ -42,7 +42,7 @@ function configureZitadel(config) {
 	const resolvedProxyPath = config.proxyPath ?? "/__nextgen";
 	const existing = readSlot();
 	if (existing !== null) {
-		if (existing.proxyPath === resolvedProxyPath && existing.projectId === config.projectId && existing.url === config.url) {
+		if (existing.proxyPath === resolvedProxyPath && existing.projectId === config.projectId && existing.url === config.url && existing.publishableKey === config.publishableKey) {
 			setProxyPath(resolvedProxyPath);
 			return existing;
 		}
@@ -53,7 +53,8 @@ function configureZitadel(config) {
 	const project = Object.freeze({
 		proxyPath: resolvedProxyPath,
 		projectId: config.projectId,
-		url: config.url
+		url: config.url,
+		publishableKey: config.publishableKey
 	});
 	writeSlot(project);
 	setProxyPath(resolvedProxyPath);
@@ -71,7 +72,10 @@ function configureZitadel(config) {
 function getApi(project) {
 	let api = apiCache.get(project);
 	if (!api) {
-		api = createApi(project.proxyPath);
+		api = createZitadelClient({
+			baseUrl: project.proxyPath,
+			token: project.publishableKey
+		});
 		apiCache.set(project, api);
 	}
 	return api;

package/dist/runtime/config.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"config.mjs","names":[],"sources":["../../src/runtime/config.ts"],"sourcesContent":["import { setProxyPath } from \"./base-url\";\nimport { createApi, type ZitadelApi } from \"./api-factory\";\n\n/**\n * Input options for {@link configureZitadel}.\n */\nexport interface ZitadelConfig {\n  /** Proxy path for API requests (e.g. `\"/__nextgen\"`). Optional — defaults to `\"/__nextgen\"`. */\n  proxyPath?: string;\n\n  /** Project ID passed to flow creation. */\n  projectId: string;\n\n  /**\n   * Full URL of the Zitadel auth backend (e.g. `\"http://localhost:8080\"`).\n   * Used by server-side middleware for proxying and JWT verification.\n   * Optional — not needed in client-only setups.\n   */\n  url?: string;\n}\n\n/**\n * The initialized project handle returned by {@link configureZitadel}.\n * Pure data — use factory functions like {@link getApi} to derive services.\n */\nexport interface ZitadelProject {\n  /** Proxy path for API requests. */\n  readonly proxyPath: string;\n\n  /** Project ID passed to flow creation. */\n  readonly projectId: string;\n\n  /** Full URL of the Zitadel auth backend. */\n  readonly url?: string;\n}\n\nexport type { ZitadelApi };\n\n/**\n * Slot for the configured project, stored on `globalThis` under a\n * {@link Symbol.for} key. Every copy of this module evaluated in the\n * same JS realm resolves the symbol through the global symbol registry\n * to the same identity, so they all read and write a single slot —\n * needed because the standalone components bundle inlines its own copy\n * of this file, and dual-package hazards / monorepo duplicates can load\n * a second copy alongside the app's. With a module-local `let` each\n * instance kept its own singleton and `configureZitadel()` calls in one\n * were invisible to `getZitadelConfig()` calls in another. Sharing is\n * realm-scoped — separate realms (iframes, Node `vm` contexts, worker\n * threads) have their own registries and are not unified by this.\n */\nconst PROJECT_SLOT = Symbol.for(\"@zitadel/api/config:currentProject\");\n\nfunction readSlot(): ZitadelProject | null {\n  const value = (globalThis as Record<symbol, unknown>)[PROJECT_SLOT];\n  return (value as ZitadelProject | null | undefined) ?? null;\n}\n\nfunction writeSlot(value: ZitadelProject | null): void {\n  (globalThis as Record<symbol, unknown>)[PROJECT_SLOT] = value;\n}\n\n/**\n * Per-project API client cache. Ensures `getApi(project)` returns the\n * same instance for the same project handle — no re-wrapping on every call.\n * Module-local on purpose: keyed by the shared frozen `ZitadelProject`\n * object identity, so cross-instance reads still resolve through the\n * same key and at worst memoize once per module instance.\n */\nconst apiCache = new WeakMap<ZitadelProject, ZitadelApi>();\n\n/**\n * Initializes app-wide SDK configuration and returns the frozen\n * {@link ZitadelProject} handle.\n *\n * Write-once — subsequent calls with the same values return the original\n * handle; calls with different values log a warning and return the\n * original. This prevents accidental overwrites while remaining safe\n * for HMR and framework double-mounts.\n */\nexport function configureZitadel(config: ZitadelConfig): ZitadelProject {\n  const resolvedProxyPath = config.proxyPath ?? \"/__nextgen\";\n  const existing = readSlot();\n\n  if (existing !== null) {\n    if (\n      existing.proxyPath === resolvedProxyPath &&\n      existing.projectId === config.projectId &&\n      existing.url === config.url\n    ) {\n      setProxyPath(resolvedProxyPath);\n      return existing;\n    }\n    console.warn(\n      `[zitadel] configureZitadel() already called with different values. ` +\n        `Ignoring: ${JSON.stringify(config)}`,\n    );\n    setProxyPath(existing.proxyPath);\n    return existing;\n  }\n\n  const project = Object.freeze({\n    proxyPath: resolvedProxyPath,\n    projectId: config.projectId,\n    url: config.url,\n  });\n  writeSlot(project);\n  setProxyPath(resolvedProxyPath);\n  return project;\n}\n\n/**\n * Returns a typed API client for the given project, with the base URL\n * pre-bound. Cached per project handle — safe to call multiple times.\n *\n * ```ts\n * const project = configureZitadel({ ... });\n * export const api = getApi(project);\n * ```\n */\nexport function getApi(project: ZitadelProject): ZitadelApi {\n  let api = apiCache.get(project);\n  if (!api) {\n    api = createApi(project.proxyPath);\n    apiCache.set(project, api);\n  }\n  return api;\n}\n\n/**\n * Returns the current project handle, or `null` if {@link configureZitadel}\n * has not been called yet.\n */\nexport function getZitadelConfig(): ZitadelProject | null {\n  return readSlot();\n}\n\n/**\n * Reset internal state. **Test-only**, and not part of the supported\n * public API even though the `./config` subpath ships every binding in\n * this module: the leading `_` marks it as private and the behaviour\n * is free to change without notice. Lets tests call `configureZitadel()`\n * multiple times across isolated cases without the write-once guard\n * rejecting them.\n */\nexport function _resetConfigForTesting(): void {\n  writeSlot(null);\n  setProxyPath(\"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAmDA,MAAM,eAAe,OAAO,IAAI,qCAAqC;AAErE,SAAS,WAAkC;AAEzC,QADe,WAAuC,iBACC;;AAGzD,SAAS,UAAU,OAAoC;AACpD,YAAuC,gBAAgB;;;;;;;;;AAU1D,MAAM,2BAAW,IAAI,SAAqC;;;;;;;;;;AAW1D,SAAgB,iBAAiB,QAAuC;CACtE,MAAM,oBAAoB,OAAO,aAAa;CAC9C,MAAM,WAAW,UAAU;AAE3B,KAAI,aAAa,MAAM;AACrB,MACE,SAAS,cAAc,qBACvB,SAAS,cAAc,OAAO,aAC9B,SAAS,QAAQ,OAAO,KACxB;AACA,gBAAa,kBAAkB;AAC/B,UAAO;;AAET,UAAQ,KACN,gFACe,KAAK,UAAU,OAAO,GACtC;AACD,eAAa,SAAS,UAAU;AAChC,SAAO;;CAGT,MAAM,UAAU,OAAO,OAAO;EAC5B,WAAW;EACX,WAAW,OAAO;EAClB,KAAK,OAAO;EACb,CAAC;AACF,WAAU,QAAQ;AAClB,cAAa,kBAAkB;AAC/B,QAAO;;;;;;;;;;;AAYT,SAAgB,OAAO,SAAqC;CAC1D,IAAI,MAAM,SAAS,IAAI,QAAQ;AAC/B,KAAI,CAAC,KAAK;AACR,QAAM,UAAU,QAAQ,UAAU;AAClC,WAAS,IAAI,SAAS,IAAI;;AAE5B,QAAO;;;;;;AAOT,SAAgB,mBAA0C;AACxD,QAAO,UAAU;;;;;;;;;;AAWnB,SAAgB,yBAA+B;AAC7C,WAAU,KAAK;AACf,cAAa,GAAG"}
+{"version":3,"file":"config.mjs","names":[],"sources":["../../src/runtime/config.ts"],"sourcesContent":["import { setProxyPath } from \"./base-url\";\nimport { createZitadelClient, type ZitadelApi } from \"./api-factory\";\n\n/**\n * Input options for {@link configureZitadel}.\n */\nexport interface ZitadelConfig {\n  /** Proxy path for API requests (e.g. `\"/__nextgen\"`). Optional — defaults to `\"/__nextgen\"`. */\n  proxyPath?: string;\n\n  /** Project ID passed to flow creation. */\n  projectId: string;\n\n  /**\n   * Full URL of the Zitadel auth backend (e.g. `\"http://localhost:8080\"`).\n   * Used by server-side middleware for proxying and JWT verification.\n   * Optional — not needed in client-only setups.\n   */\n  url?: string;\n\n  /**\n   * The project's **publishable key** (ADR 036): an origin-scoped,\n   * browser-safe bearer sent on public-plane calls (flow operations and the\n   * body-delivered handoff exchange). Safe to ship in client bundles and\n   * committed config by construction — never put a project secret\n   * (`sk_proj_…`) here. Optional — omitted, requests carry no bearer and\n   * secret-requiring operations must be authenticated by a server-side\n   * proxy instead.\n   */\n  publishableKey?: string;\n}\n\n/**\n * The initialized project handle returned by {@link configureZitadel}.\n * Pure data — use factory functions like {@link getApi} to derive services.\n */\nexport interface ZitadelProject {\n  /** Proxy path for API requests. */\n  readonly proxyPath: string;\n\n  /** Project ID passed to flow creation. */\n  readonly projectId: string;\n\n  /** Full URL of the Zitadel auth backend. */\n  readonly url?: string;\n\n  /** The project's publishable key (ADR 036), sent as the bearer when set. */\n  readonly publishableKey?: string;\n}\n\nexport type { ZitadelApi };\n\n/**\n * Slot for the configured project, stored on `globalThis` under a\n * {@link Symbol.for} key. Every copy of this module evaluated in the\n * same JS realm resolves the symbol through the global symbol registry\n * to the same identity, so they all read and write a single slot —\n * needed because the standalone components bundle inlines its own copy\n * of this file, and dual-package hazards / monorepo duplicates can load\n * a second copy alongside the app's. With a module-local `let` each\n * instance kept its own singleton and `configureZitadel()` calls in one\n * were invisible to `getZitadelConfig()` calls in another. Sharing is\n * realm-scoped — separate realms (iframes, Node `vm` contexts, worker\n * threads) have their own registries and are not unified by this.\n */\nconst PROJECT_SLOT = Symbol.for(\"@zitadel/api/config:currentProject\");\n\nfunction readSlot(): ZitadelProject | null {\n  const value = (globalThis as Record<symbol, unknown>)[PROJECT_SLOT];\n  return (value as ZitadelProject | null | undefined) ?? null;\n}\n\nfunction writeSlot(value: ZitadelProject | null): void {\n  (globalThis as Record<symbol, unknown>)[PROJECT_SLOT] = value;\n}\n\n/**\n * Per-project API client cache. Ensures `getApi(project)` returns the\n * same instance for the same project handle — no re-wrapping on every call.\n * Module-local on purpose: keyed by the shared frozen `ZitadelProject`\n * object identity, so cross-instance reads still resolve through the\n * same key and at worst memoize once per module instance.\n */\nconst apiCache = new WeakMap<ZitadelProject, ZitadelApi>();\n\n/**\n * Initializes app-wide SDK configuration and returns the frozen\n * {@link ZitadelProject} handle.\n *\n * Write-once — subsequent calls with the same values return the original\n * handle; calls with different values log a warning and return the\n * original. This prevents accidental overwrites while remaining safe\n * for HMR and framework double-mounts.\n */\nexport function configureZitadel(config: ZitadelConfig): ZitadelProject {\n  const resolvedProxyPath = config.proxyPath ?? \"/__nextgen\";\n  const existing = readSlot();\n\n  if (existing !== null) {\n    if (\n      existing.proxyPath === resolvedProxyPath &&\n      existing.projectId === config.projectId &&\n      existing.url === config.url &&\n      existing.publishableKey === config.publishableKey\n    ) {\n      setProxyPath(resolvedProxyPath);\n      return existing;\n    }\n    console.warn(\n      `[zitadel] configureZitadel() already called with different values. ` +\n        `Ignoring: ${JSON.stringify(config)}`,\n    );\n    setProxyPath(existing.proxyPath);\n    return existing;\n  }\n\n  const project = Object.freeze({\n    proxyPath: resolvedProxyPath,\n    projectId: config.projectId,\n    url: config.url,\n    publishableKey: config.publishableKey,\n  });\n  writeSlot(project);\n  setProxyPath(resolvedProxyPath);\n  return project;\n}\n\n/**\n * Returns a typed API client for the given project, with the base URL\n * pre-bound. Cached per project handle — safe to call multiple times.\n *\n * ```ts\n * const project = configureZitadel({ ... });\n * export const api = getApi(project);\n * ```\n */\nexport function getApi(project: ZitadelProject): ZitadelApi {\n  let api = apiCache.get(project);\n  if (!api) {\n    // The publishable key (when the handle carries one) rides as the bearer\n    // on every call from this client — the ADR 036 public-plane credential.\n    // Handles without a key produce a token-less client, exactly as before.\n    api = createZitadelClient({ baseUrl: project.proxyPath, token: project.publishableKey });\n    apiCache.set(project, api);\n  }\n  return api;\n}\n\n/**\n * Returns the current project handle, or `null` if {@link configureZitadel}\n * has not been called yet.\n */\nexport function getZitadelConfig(): ZitadelProject | null {\n  return readSlot();\n}\n\n/**\n * Reset internal state. **Test-only**, and not part of the supported\n * public API even though the `./config` subpath ships every binding in\n * this module: the leading `_` marks it as private and the behaviour\n * is free to change without notice. Lets tests call `configureZitadel()`\n * multiple times across isolated cases without the write-once guard\n * rejecting them.\n */\nexport function _resetConfigForTesting(): void {\n  writeSlot(null);\n  setProxyPath(\"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiEA,MAAM,eAAe,OAAO,IAAI,qCAAqC;AAErE,SAAS,WAAkC;AAEzC,QADe,WAAuC,iBACC;;AAGzD,SAAS,UAAU,OAAoC;AACpD,YAAuC,gBAAgB;;;;;;;;;AAU1D,MAAM,2BAAW,IAAI,SAAqC;;;;;;;;;;AAW1D,SAAgB,iBAAiB,QAAuC;CACtE,MAAM,oBAAoB,OAAO,aAAa;CAC9C,MAAM,WAAW,UAAU;AAE3B,KAAI,aAAa,MAAM;AACrB,MACE,SAAS,cAAc,qBACvB,SAAS,cAAc,OAAO,aAC9B,SAAS,QAAQ,OAAO,OACxB,SAAS,mBAAmB,OAAO,gBACnC;AACA,gBAAa,kBAAkB;AAC/B,UAAO;;AAET,UAAQ,KACN,gFACe,KAAK,UAAU,OAAO,GACtC;AACD,eAAa,SAAS,UAAU;AAChC,SAAO;;CAGT,MAAM,UAAU,OAAO,OAAO;EAC5B,WAAW;EACX,WAAW,OAAO;EAClB,KAAK,OAAO;EACZ,gBAAgB,OAAO;EACxB,CAAC;AACF,WAAU,QAAQ;AAClB,cAAa,kBAAkB;AAC/B,QAAO;;;;;;;;;;;AAYT,SAAgB,OAAO,SAAqC;CAC1D,IAAI,MAAM,SAAS,IAAI,QAAQ;AAC/B,KAAI,CAAC,KAAK;AAIR,QAAM,oBAAoB;GAAE,SAAS,QAAQ;GAAW,OAAO,QAAQ;GAAgB,CAAC;AACxF,WAAS,IAAI,SAAS,IAAI;;AAE5B,QAAO;;;;;;AAOT,SAAgB,mBAA0C;AACxD,QAAO,UAAU;;;;;;;;;;AAWnB,SAAgB,yBAA+B;AAC7C,WAAU,KAAK;AACf,cAAa,GAAG"}

package/dist/runtime/fetch.d.mts

@@ -31,6 +31,14 @@ declare class ApiError extends Error {
  *   spec's `204`/`205`/`304` no-body responses.
  */
 declare function customFetch<T>(url: string, options: RequestInit): Promise<T>;
+/**
+ * Extracts the server's `{code, message, details}` envelope from an
+ * {@link ApiError} into a display string. Falls back to the fetch layer's
+ * `"METHOD url returned N"` when the body isn't shaped like an envelope, so
+ * transport-level failures (HTML from a proxy, empty 5xx) still say
+ * something.
+ */
+declare function apiErrorMessage(error: ApiError): string;
 //#endregion
-export { ApiError, customFetch };
+export { ApiError, apiErrorMessage, customFetch };
 //# sourceMappingURL=fetch.d.mts.map

package/dist/runtime/fetch.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.d.mts","names":[],"sources":["../../src/runtime/fetch.ts"],"mappings":";;AAaA;;;;;;;;;;cAAa,QAAA,SAAiB,KAAA;EAAA,SACnB,MAAA;EAAA,SACA,GAAA;EAAA,SACA,IAAA;cAEG,MAAA,UAAgB,GAAA,UAAa,IAAA,WAAe,OAAA;AAAA;;;;;;;;;;;;;;;iBAuBpC,WAAA,GAAA,CAAe,GAAA,UAAa,OAAA,EAAS,WAAA,GAAc,OAAA,CAAQ,CAAA"}
+{"version":3,"file":"fetch.d.mts","names":[],"sources":["../../src/runtime/fetch.ts"],"mappings":";;AAaA;;;;;;;;;;cAAa,QAAA,SAAiB,KAAA;EAAA,SACnB,MAAA;EAAA,SACA,GAAA;EAAA,SACA,IAAA;cAEG,MAAA,UAAgB,GAAA,UAAa,IAAA,WAAe,OAAA;AAAA;;;;;;;;;;;;;;;iBAuBpC,WAAA,GAAA,CAAe,GAAA,UAAa,OAAA,EAAS,WAAA,GAAc,OAAA,CAAQ,CAAA;AA0CjF;;;;;;;AAAA,iBAAgB,eAAA,CAAgB,KAAA,EAAO,QAAA"}

package/dist/runtime/fetch.mjs

@@ -70,7 +70,38 @@ function safeJsonParse(text) {
 		return { raw: text };
 	}
 }
+/**
+* Extracts the server's `{code, message, details}` envelope from an
+* {@link ApiError} into a display string. Falls back to the fetch layer's
+* `"METHOD url returned N"` when the body isn't shaped like an envelope, so
+* transport-level failures (HTML from a proxy, empty 5xx) still say
+* something.
+*/
+function apiErrorMessage(error) {
+	const body = error.body;
+	if (!isRecord(body)) return error.message;
+	const serverMessage = typeof body.message === "string" ? body.message : void 0;
+	const detail = pickDetailString(body.details);
+	if (!serverMessage) return error.message;
+	return detail ? `${serverMessage}: ${detail}` : serverMessage;
+}
+/**
+* Reads the innermost human-readable string out of the spec's error
+* `details` field. Handles both `details: "..."` and the nested
+* `details: { details: "..." }` shape the platform emits for validation
+* failures.
+*/
+function pickDetailString(details) {
+	if (typeof details === "string") return details;
+	if (isRecord(details)) {
+		if (typeof details.details === "string") return details.details;
+		if (typeof details.message === "string") return details.message;
+	}
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 //#endregion
-export { ApiError, customFetch };
+export { ApiError, apiErrorMessage, customFetch };
 
 //# sourceMappingURL=fetch.mjs.map

package/dist/runtime/fetch.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.mjs","names":[],"sources":["../../src/runtime/fetch.ts"],"sourcesContent":["import { getApiAuthToken } from \"./auth\";\n\n/**\n * Framework-neutral failure type the orval-generated client throws on\n * any non-2xx response. Carries the HTTP status, the parsed error body\n * (the spec's `{code, message, details?}` envelope when the server\n * returned one), and the request URL — enough for callers to map to\n * their own error taxonomy without re-implementing the fetch layer.\n *\n * Callers that don't care about the distinction can catch `ApiError`\n * generically; callers that do (the CLI's `toZitadelError`) read\n * `status` and decide.\n */\nexport class ApiError extends Error {\n  readonly status: number;\n  readonly url: string;\n  readonly body: unknown;\n\n  constructor(status: number, url: string, body: unknown, message: string) {\n    super(message);\n    this.name = \"ApiError\";\n    this.status = status;\n    this.url = url;\n    this.body = body;\n  }\n}\n\n/**\n * The orval `mutator` for the fetch client. Every generated operation\n * routes its request through this function instead of the global\n * `fetch`. We pin three concerns here so generated call sites stay\n * focused on the shape of one HTTP call:\n *\n * - bearer auth — read from `runtime/auth.ts` and attached automatically;\n * - non-2xx → throw — orval's stock client parses the body regardless\n *   of status, so callers would have to inspect every response. Throw\n *   `ApiError` on `!res.ok` so failures interrupt control flow;\n * - body parsing — return the parsed JSON typed as `T` (the operation's\n *   return type, threaded through by orval), or `undefined` for the\n *   spec's `204`/`205`/`304` no-body responses.\n */\nexport async function customFetch<T>(url: string, options: RequestInit): Promise<T> {\n  const token = getApiAuthToken();\n  const headers = new Headers(options.headers);\n  if (token && !headers.has(\"authorization\")) {\n    headers.set(\"authorization\", `Bearer ${token}`);\n  }\n\n  const res = await fetch(url, { ...options, headers });\n\n  const noBody = [204, 205, 304].includes(res.status);\n  const rawBody = noBody ? \"\" : await res.text();\n  const parsed = rawBody ? (safeJsonParse(rawBody) as unknown) : undefined;\n\n  if (!res.ok) {\n    const message = `${options.method ?? \"GET\"} ${url} returned ${res.status}`;\n    throw new ApiError(res.status, url, parsed, message);\n  }\n\n  return parsed as T;\n}\n\n/**\n * `JSON.parse` wrapped so a non-JSON body (e.g. an HTML 502 from a\n * proxy) becomes `{ raw: \"<text>\" }` instead of throwing inside\n * `customFetch`. The thrown `ApiError` then carries something useful\n * for the user to see.\n */\nfunction safeJsonParse(text: string): unknown {\n  try {\n    return JSON.parse(text);\n  } catch {\n    return { raw: text };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAaA,IAAa,WAAb,cAA8B,MAAM;CAClC;CACA;CACA;CAEA,YAAY,QAAgB,KAAa,MAAe,SAAiB;AACvE,QAAM,QAAQ;AACd,OAAK,OAAO;AACZ,OAAK,SAAS;AACd,OAAK,MAAM;AACX,OAAK,OAAO;;;;;;;;;;;;;;;;;AAkBhB,eAAsB,YAAe,KAAa,SAAkC;CAClF,MAAM,QAAQ,iBAAiB;CAC/B,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,KAAI,SAAS,CAAC,QAAQ,IAAI,gBAAgB,CACxC,SAAQ,IAAI,iBAAiB,UAAU,QAAQ;CAGjD,MAAM,MAAM,MAAM,MAAM,KAAK;EAAE,GAAG;EAAS;EAAS,CAAC;CAGrD,MAAM,UADS;EAAC;EAAK;EAAK;EAAI,CAAC,SAAS,IAAI,OACtB,GAAG,KAAK,MAAM,IAAI,MAAM;CAC9C,MAAM,SAAS,UAAW,cAAc,QAAQ,GAAe,KAAA;AAE/D,KAAI,CAAC,IAAI,IAAI;EACX,MAAM,UAAU,GAAG,QAAQ,UAAU,MAAM,GAAG,IAAI,YAAY,IAAI;AAClE,QAAM,IAAI,SAAS,IAAI,QAAQ,KAAK,QAAQ,QAAQ;;AAGtD,QAAO;;;;;;;;AAST,SAAS,cAAc,MAAuB;AAC5C,KAAI;AACF,SAAO,KAAK,MAAM,KAAK;SACjB;AACN,SAAO,EAAE,KAAK,MAAM"}
+{"version":3,"file":"fetch.mjs","names":[],"sources":["../../src/runtime/fetch.ts"],"sourcesContent":["import { getApiAuthToken } from \"./auth\";\n\n/**\n * Framework-neutral failure type the orval-generated client throws on\n * any non-2xx response. Carries the HTTP status, the parsed error body\n * (the spec's `{code, message, details?}` envelope when the server\n * returned one), and the request URL — enough for callers to map to\n * their own error taxonomy without re-implementing the fetch layer.\n *\n * Callers that don't care about the distinction can catch `ApiError`\n * generically; callers that do (the CLI's `toZitadelError`) read\n * `status` and decide.\n */\nexport class ApiError extends Error {\n  readonly status: number;\n  readonly url: string;\n  readonly body: unknown;\n\n  constructor(status: number, url: string, body: unknown, message: string) {\n    super(message);\n    this.name = \"ApiError\";\n    this.status = status;\n    this.url = url;\n    this.body = body;\n  }\n}\n\n/**\n * The orval `mutator` for the fetch client. Every generated operation\n * routes its request through this function instead of the global\n * `fetch`. We pin three concerns here so generated call sites stay\n * focused on the shape of one HTTP call:\n *\n * - bearer auth — read from `runtime/auth.ts` and attached automatically;\n * - non-2xx → throw — orval's stock client parses the body regardless\n *   of status, so callers would have to inspect every response. Throw\n *   `ApiError` on `!res.ok` so failures interrupt control flow;\n * - body parsing — return the parsed JSON typed as `T` (the operation's\n *   return type, threaded through by orval), or `undefined` for the\n *   spec's `204`/`205`/`304` no-body responses.\n */\nexport async function customFetch<T>(url: string, options: RequestInit): Promise<T> {\n  const token = getApiAuthToken();\n  const headers = new Headers(options.headers);\n  if (token && !headers.has(\"authorization\")) {\n    headers.set(\"authorization\", `Bearer ${token}`);\n  }\n\n  const res = await fetch(url, { ...options, headers });\n\n  const noBody = [204, 205, 304].includes(res.status);\n  const rawBody = noBody ? \"\" : await res.text();\n  const parsed = rawBody ? (safeJsonParse(rawBody) as unknown) : undefined;\n\n  if (!res.ok) {\n    const message = `${options.method ?? \"GET\"} ${url} returned ${res.status}`;\n    throw new ApiError(res.status, url, parsed, message);\n  }\n\n  return parsed as T;\n}\n\n/**\n * `JSON.parse` wrapped so a non-JSON body (e.g. an HTML 502 from a\n * proxy) becomes `{ raw: \"<text>\" }` instead of throwing inside\n * `customFetch`. The thrown `ApiError` then carries something useful\n * for the user to see.\n */\nfunction safeJsonParse(text: string): unknown {\n  try {\n    return JSON.parse(text);\n  } catch {\n    return { raw: text };\n  }\n}\n\n/**\n * Extracts the server's `{code, message, details}` envelope from an\n * {@link ApiError} into a display string. Falls back to the fetch layer's\n * `\"METHOD url returned N\"` when the body isn't shaped like an envelope, so\n * transport-level failures (HTML from a proxy, empty 5xx) still say\n * something.\n */\nexport function apiErrorMessage(error: ApiError): string {\n  const body = error.body;\n  if (!isRecord(body)) {\n    return error.message;\n  }\n  const serverMessage = typeof body.message === \"string\" ? body.message : undefined;\n  const detail = pickDetailString(body.details);\n  if (!serverMessage) {\n    return error.message;\n  }\n  return detail ? `${serverMessage}: ${detail}` : serverMessage;\n}\n\n/**\n * Reads the innermost human-readable string out of the spec's error\n * `details` field. Handles both `details: \"...\"` and the nested\n * `details: { details: \"...\" }` shape the platform emits for validation\n * failures.\n */\nfunction pickDetailString(details: unknown): string | undefined {\n  if (typeof details === \"string\") {\n    return details;\n  }\n  if (isRecord(details)) {\n    if (typeof details.details === \"string\") {\n      return details.details;\n    }\n    if (typeof details.message === \"string\") {\n      return details.message;\n    }\n  }\n  return undefined;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n"],"mappings":";;;;;;;;;;;;;AAaA,IAAa,WAAb,cAA8B,MAAM;CAClC;CACA;CACA;CAEA,YAAY,QAAgB,KAAa,MAAe,SAAiB;AACvE,QAAM,QAAQ;AACd,OAAK,OAAO;AACZ,OAAK,SAAS;AACd,OAAK,MAAM;AACX,OAAK,OAAO;;;;;;;;;;;;;;;;;AAkBhB,eAAsB,YAAe,KAAa,SAAkC;CAClF,MAAM,QAAQ,iBAAiB;CAC/B,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,KAAI,SAAS,CAAC,QAAQ,IAAI,gBAAgB,CACxC,SAAQ,IAAI,iBAAiB,UAAU,QAAQ;CAGjD,MAAM,MAAM,MAAM,MAAM,KAAK;EAAE,GAAG;EAAS;EAAS,CAAC;CAGrD,MAAM,UADS;EAAC;EAAK;EAAK;EAAI,CAAC,SAAS,IAAI,OACtB,GAAG,KAAK,MAAM,IAAI,MAAM;CAC9C,MAAM,SAAS,UAAW,cAAc,QAAQ,GAAe,KAAA;AAE/D,KAAI,CAAC,IAAI,IAAI;EACX,MAAM,UAAU,GAAG,QAAQ,UAAU,MAAM,GAAG,IAAI,YAAY,IAAI;AAClE,QAAM,IAAI,SAAS,IAAI,QAAQ,KAAK,QAAQ,QAAQ;;AAGtD,QAAO;;;;;;;;AAST,SAAS,cAAc,MAAuB;AAC5C,KAAI;AACF,SAAO,KAAK,MAAM,KAAK;SACjB;AACN,SAAO,EAAE,KAAK,MAAM;;;;;;;;;;AAWxB,SAAgB,gBAAgB,OAAyB;CACvD,MAAM,OAAO,MAAM;AACnB,KAAI,CAAC,SAAS,KAAK,CACjB,QAAO,MAAM;CAEf,MAAM,gBAAgB,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,KAAA;CACxE,MAAM,SAAS,iBAAiB,KAAK,QAAQ;AAC7C,KAAI,CAAC,cACH,QAAO,MAAM;AAEf,QAAO,SAAS,GAAG,cAAc,IAAI,WAAW;;;;;;;;AASlD,SAAS,iBAAiB,SAAsC;AAC9D,KAAI,OAAO,YAAY,SACrB,QAAO;AAET,KAAI,SAAS,QAAQ,EAAE;AACrB,MAAI,OAAO,QAAQ,YAAY,SAC7B,QAAO,QAAQ;AAEjB,MAAI,OAAO,QAAQ,YAAY,SAC7B,QAAO,QAAQ;;;AAMrB,SAAS,SAAS,OAAkD;AAClE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM"}