bsuir-iis-api 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## [0.11.0] - 2026-05-24
+
+### Added
+
+- `schedule.getGroupBySubgroup()` and `schedule.getEmployeeBySubgroup()` accept `rawEnvelope: true` for envelope-preserving raw subgroup output.
+- `announcements.byEmployee()` / `byDepartment()` accept `treat404AsEmpty` (default `true`) to opt out of mapping IIS `404`/`400` empty-announcement responses to `[]`.
+- Optional `onInvalidTime` hook for `sortLessonsByTime()`, `getCurrentLesson()`, `getNextLesson()`, and `buildScheduleDays()`.
+
+### Changed
+
+- `schedule.getGroup()` / `getEmployee()` now always return normalized payloads; use `getGroupRaw()`, `getEmployeeRaw()`, `getGroupEnvelope()`, or `getEmployeeEnvelope()` for raw API envelopes.
+- Response cache stores deep-frozen JSON values, returns the cached frozen reference on hits, and rejects non-JSON cache writes with `BsuirConfigurationError`.
+- `requestJson` keeps response caching enabled for non-aborted `AbortSignal`s; in-flight deduplication remains disabled for per-call signals to avoid cross-caller cancellation semantics.
+- Query keys are sorted deterministically for stable cache keys, query key validation is relaxed for safe non-structural characters, and private-header detection now uses an explicit denylist.
+- Request bodies pass through native `BodyInit` shapes (`FormData`, `URLSearchParams`, `Blob`, `ArrayBuffer`, `ReadableStream`) instead of being JSON-stringified.
+- `Retry-After` numeric values now use the same internal cap as date-based values.
+- `allowInsecureHttp: true` rejects non-loopback hosts in `allowedBaseUrlHosts`.
+- `normalizeSchedule` clones lessons once, always performs a minimal envelope check, and delegates full validation to `assertScheduleResponse`.
+- `mergeSignalsManual` cleanup is idempotent and records listeners before registration to avoid leaks.
+
+### Documentation
+
+- README now documents explicit raw schedule helpers, `validateResponses` as opt-in, `BsuirResponsePayloadTooLargeError` for oversized payloads, and the Changesets release flow.
+
+### Potentially Breaking
+
+- Removed `defaultRaw` and per-call `raw` selection from `schedule.getGroup()` / `getEmployee()`; callers should use explicit raw helpers instead.
+- Cached responses are frozen shared references; callers that need mutation should clone returned values first.
+- Native `BodyInit` request bodies are no longer JSON-stringified.
+- `allowInsecureHttp: true` is limited to loopback hosts.
+
+## [0.10.1] - 2026-05-13
+
+### Documentation
+
+- README: clarified `defaultRaw` behavior for `schedule.getGroup()` / `schedule.getEmployee()` when per-call `raw` is omitted.
+- README: clarified retry semantics (GET retries cover retriable HTTP statuses and network/transport errors).
+- README: documented `maxResponseBytes` failure behavior (`BsuirApiError` on oversized payloads).
+- README: made usage snippets standalone by adding required imports/client initialization.
+- README: added explicit public export reference for runtime helpers, error classes, and exported domain/types surface.
+
+### Changed
+
+- Changelog restored explicit `0.8.0` section and separated `0.9.0` release-management metadata.
+- Changelog now marks `0.10.0` behavior shifts with potentially breaking downstream impact notes.
+
 ## [0.10.0] - 2026-05-13
 
 ### Added
@@ -18,6 +64,12 @@
 - GitHub Actions in CI/release workflows are pinned to commit SHAs.
 - Dev dependencies in `package.json` are now pinned to exact versions.
 
+### Potentially Breaking
+
+- `baseUrl` validation is now strict; previously accepted non-normalized/less-safe values can now throw `BsuirConfigurationError`.
+- `validateResponses` defaults to `true`; integrations that relied on unchecked payloads may now see `BsuirResponseValidationError`.
+- Response body size is now actively enforced via `maxResponseBytes`; oversized responses now fail fast with `BsuirApiError`.
+
 ### Fixed
 
 - Response parser now enforces `maxResponseBytes` for both `Content-Length` pre-checks and streamed body reads.
@@ -40,6 +92,12 @@
 
 ## [0.9.0] - 2026-05-10
 
+### Changed
+
+- Release-management update from Changesets (`version: 0.9.0` + release metadata). Runtime API/content remained aligned with the `0.8.0` code snapshot.
+
+## [0.8.0] - 2026-05-10
+
 ### Added
 
 - Public exports for schedule utilities: `normalizeSchedule` and `filterLessons`.

package/README.md

@@ -16,7 +16,7 @@ npm install bsuir-iis-api
 
 ## Quick start
 
-Default schedule calls return a **normalized** payload (`defaultRaw: false`). That shape includes `lessons`, `lessonsByDay`, `scheduleLessons`, and `examLessons` (see types). With `{ raw: true }` you get the API’s raw `ScheduleResponse` instead—no `lessons` field; use `schedules` / `exams` and match examples to the option you use.
+Default schedule calls return a **normalized** payload. That shape includes `lessons`, `lessonsByDay`, `scheduleLessons`, and `examLessons` (see types). Use explicit raw helpers such as `client.schedule.getGroupRaw()` / `getEmployeeRaw()` to obtain the API’s raw `ScheduleResponse` (which has `schedules` / `exams` and may omit `lessons`).
 
 ```ts
 import { createBsuirClient } from "bsuir-iis-api";
@@ -31,6 +31,8 @@ console.log(schedule.lessons.length);
 ## Client options
 
 ```ts
+import { createBsuirClient } from "bsuir-iis-api";
+
 const client = createBsuirClient({
   baseUrl: "https://iis.bsuir.by/api/v1",
   allowedBaseUrlHosts: ["iis.bsuir.by"],
@@ -48,8 +50,7 @@ const client = createBsuirClient({
     onRetry: ({ endpoint, delayMs, reason }) => {
       console.log("retry", endpoint, delayMs, reason);
     }
-  },
-  defaultRaw: false
+  }
 });
 ```
 
@@ -58,10 +59,10 @@ const client = createBsuirClient({
 - `allowedBaseUrlHosts` controls which hosts are allowed for `baseUrl` (defaults to `["iis.bsuir.by"]`).
 - `allowInsecureHttp` enables `http://` only for trusted local/test endpoints.
 - `signal` in `createBsuirClient({ signal })` acts as a global cancellation signal for all requests made by that client.
-- `cache` stores successful GET responses in-memory for the configured TTL.
-- `dedupeInFlight` reuses the same in-flight GET request for concurrent callers (when no per-request signal is passed).
+- `cache` stores successful GET responses in-memory for the configured TTL. A live `AbortSignal` can still use cache; an already-aborted signal skips cache.
+- `dedupeInFlight` reuses the same in-flight GET request for concurrent callers. It is disabled for per-request signals, non-default cache modes, private credential headers, and already-aborted signals.
 - `maxResponseBytes` limits body size per response to protect against memory spikes.
-- `validateResponses` enables runtime payload-shape checks for key endpoints (enabled by default).
+- `validateResponses` enables opt-in runtime payload-shape checks for key endpoints.
 - `hooks` provides lifecycle callbacks (`onRequest`, `onRetry`, `onResponse`, `onError`) for observability.
 - `AbortSignal` is supported by all read methods.
 
@@ -99,11 +100,20 @@ const client = createBsuirClient({
 
 When IIS responds with HTTP `404` or `400` (no list, missing resource, or endpoint quirks), these methods resolve to an empty array `[]` instead of throwing `BsuirApiError`. Client-side validation still runs first (`urlId`, department `id`). If IIS later returns a meaningful `400` for bad parameters, it will also map to `[]`; other HTTP errors are unchanged.
 
+### Public exports (runtime utilities and types)
+
+- Core runtime API: `createBsuirClient`, `BsuirClient`
+- Client/runtime option types: `BsuirClientOptions`, `CacheOptions`, `ClientHooks`, `RequestOptions`, `ReadOptions`, `RequestHookContext`, `RetryHookContext`, `ResponseHookContext`, `ErrorHookContext`
+- Schedule utilities: `normalizeSchedule`, `filterLessons`, `getLessonsForDate`, `getTodayLessons`, `getTomorrowLessons`, `getLessonsForWeek`, `sortLessonsByTime`, `groupLessonsByDay`, `getCurrentLesson`, `getNextLesson`, `buildScheduleDays`, `ScheduleFilterOptions`
+- Error classes: `BsuirApiError`, `BsuirNetworkError`, `BsuirTimeoutError`, `BsuirValidationError`, `BsuirResponseValidationError`, `BsuirResponsePayloadTooLargeError`, `BsuirConfigurationError`
+- Domain types: `Announcement`, `ApiDateResponse`, `Auditory`, `AuditoryDepartment`, `AuditoryType`, `BuildingNumber`, `Department`, `EducationForm`, `Employee`, `EmployeeCatalogItem`, `Faculty`, `FlattenedLessonsByDay`, `FlattenedScheduleItem`, `LessonStudentGroup`, `Maybe`, `NormalizedScheduleResponse`, `ScheduleItem`, `ScheduleResponse`, `Speciality`, `StudentGroupCatalogItem`, `StudentGroupShort`, `Weekday`, `WeekScheduleMap`
+
 ## Errors
 
 SDK throws typed errors:
 
 - `BsuirApiError` for HTTP errors (contains `status`, `endpoint`, `body`). **Exception:** `client.announcements.byEmployee` / `byDepartment` resolve to `[]` on IIS HTTP `404` or `400` instead of throwing (see Announcements above).
+- `BsuirResponsePayloadTooLargeError` when response body size exceeds configured `maxResponseBytes`.
 - `BsuirNetworkError` for transport errors (contains `endpoint` and standard `cause`)
 - `BsuirResponseValidationError` for invalid payload shapes when `validateResponses: true`
 - `BsuirTimeoutError` for timeouts (contains `endpoint`, `timeoutMs`)
@@ -115,9 +125,9 @@ Validation rules:
 - `groupNumber` must contain digits only
 - `urlId` must be a slug with letters/digits/hyphens (for example `s-nesterenkov`)
 - `id` and `subgroup` parameters must be positive integers
-Retry and abort behavior:
+  Retry and abort behavior:
 
-- Retries are applied to `429`, `500`, `502`, `503`, `504`
+- Retries are applied to GET requests for transport/network errors and HTTP `429`, `500`, `502`, `503`, `504`
 - `Retry-After` is respected for retriable responses
 - Caller-provided aborted `AbortSignal` is re-thrown as native `AbortError`
 - Internal timeout is mapped to `BsuirTimeoutError`
@@ -131,17 +141,20 @@ For **2xx** responses the client reads the body as text, then applies `JSON.pars
 - Valid JSON is returned even when `Content-Type` does **not** include `application/json` (mislabeled responses still parse).
 - If `Content-Type` indicates **`application/json`** but the body is empty or not valid JSON, the client throws `BsuirApiError` (`Invalid JSON response payload`), same as for a truncated `{` payload.
 - If the body is **empty** and the content type does **not** indicate JSON, the result is an empty string `""` (analogous to reading plain text). Typical IIS catalog JSON endpoints return a non-empty body.
+- If response body size exceeds `maxResponseBytes`, the client throws `BsuirResponsePayloadTooLargeError`.
 
 ## Raw vs normalized schedule response
 
 By default, schedule methods return a **normalized** `NormalizedScheduleResponse`: `lessons` is all flattened items (weekly + exams), each tagged with `source: "schedules" | "exams"`; `scheduleLessons` / `examLessons` are the same rows split by source; `lessonsByDay` groups by weekday.
 
 ```ts
-const raw = await client.schedule.getGroup("053503", { raw: true });
+import { createBsuirClient } from "bsuir-iis-api";
+
+const client = createBsuirClient();
+const raw = await client.schedule.getGroupRaw("053503");
 ```
 
-Use `defaultRaw: true` in `createBsuirClient` to change global behavior.
-When `raw` is omitted, `getGroup()` and `getEmployee()` return normalized payload.
+Use explicit helpers `getGroupRaw` / `getEmployeeRaw` to obtain raw envelopes. `getGroup()` / `getEmployee()` return normalized payloads by default.
 In raw mode API may return `schedules: null`; normalized mode always converts it to `{}`.
 In raw mode some lesson fields may also be nullable (`weekNumber`, `lessonTypeAbbrev`), so keep null checks if you consume raw payload directly.
 README examples match the installed package version; if types and docs ever diverge, rely on `NormalizedScheduleResponse` / `ScheduleResponse` from the same release.
@@ -154,6 +167,9 @@ The SDK normalizes `current-week` payloads, including plain-text responses like
 Filtering example:
 
 ```ts
+import { createBsuirClient } from "bsuir-iis-api";
+
+const client = createBsuirClient();
 const exams = await client.schedule.getGroupFiltered("053503", {
   source: "exams",
   lessonTypeAbbrev: ["Консультация", "Экзамен"]
@@ -161,9 +177,23 @@ const exams = await client.schedule.getGroupFiltered("053503", {
 ```
 
 ```ts
+import { createBsuirClient } from "bsuir-iis-api";
+
+const client = createBsuirClient();
 const subgroupLessons = await client.schedule.getEmployeeBySubgroup("s-nesterenkov", 1);
 ```
 
+## Schedule helpers for UI
+
+```ts
+import { buildScheduleDays, getTodayLessons } from "bsuir-iis-api";
+
+const todayLessons = getTodayLessons(schedule, new Date());
+const days = buildScheduleDays(schedule, { days: 7, includeEmptyDays: false });
+```
+
+Use `getCurrentLesson(days[0].lessons)` / `getNextLesson(days[0].lessons)` for in-day progress indicators.
+
 ## Development
 
 ```bash
@@ -197,9 +227,11 @@ CI has a manual `workflow_dispatch` path that also runs live contracts (`live-co
 ## Release checklist
 
 1. Run `npm run check:full`.
-2. Update version and `CHANGELOG.md` in the same release commit.
-3. Push to `main` to trigger GitHub Actions release workflow.
-4. Verify published package in a clean project:
+2. Add or update a `.changeset/*.md` entry for user-visible changes.
+3. Run `npx changeset version` to bump `package.json`, update `CHANGELOG.md`, and consume changesets.
+4. Run `npm run api:report:check` and `npm run release:dry`.
+5. Push to `main` to trigger GitHub Actions release workflow.
+6. Verify published package in a clean project:
 
 ```bash
 mkdir bsuir-iis-smoke && cd bsuir-iis-smoke
@@ -208,7 +240,7 @@ npm install bsuir-iis-api@latest
 node -e "import('bsuir-iis-api').then(m=>console.log(typeof m.createBsuirClient))"
 ```
 
-The project keeps `CHANGELOG.md` manually curated for stable release notes.
+The project uses Changesets for version bumps and changelog generation; edit pending changeset text before versioning when release notes need refinement.
 
 ## License