bsuir-iis-api 0.9.1 → 0.10.1

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # Changelog
 
+## [0.10.1] - 2026-05-13
+
+### Documentation
+
+- README: clarified `defaultRaw` behavior for `schedule.getGroup()` / `schedule.getEmployee()` when per-call `raw` is omitted.
+- README: clarified retry semantics (GET retries cover retriable HTTP statuses and network/transport errors).
+- README: documented `maxResponseBytes` failure behavior (`BsuirApiError` on oversized payloads).
+- README: made usage snippets standalone by adding required imports/client initialization.
+- README: added explicit public export reference for runtime helpers, error classes, and exported domain/types surface.
+
+### Changed
+
+- Changelog restored explicit `0.8.0` section and separated `0.9.0` release-management metadata.
+- Changelog now marks `0.10.0` behavior shifts with potentially breaking downstream impact notes.
+
+## [0.10.0] - 2026-05-13
+
+### Added
+
+- `createBsuirClient` options: `allowedBaseUrlHosts`, `allowInsecureHttp`, and `maxResponseBytes`.
+- HTTP internals split into focused modules under `src/client/http/*` (`requestJson`, `response`, `cache`, `retry`, `url`).
+- Schedule internals split into `scheduleApi`, `scheduleFilter`, and `scheduleNormalize`.
+- Shared `createListModule` used by catalog modules to remove duplicated list/read logic.
+- CI/release workflows now generate CycloneDX SBOM (`sbom.cdx.json`) on Node 24.
+
+### Changed
+
+- `createBsuirClient` now validates and normalizes `baseUrl` strictly (absolute URL, no credentials/query/hash, host allowlist, HTTPS by default).
+- `validateResponses` is now enabled by default.
+- Example scripts now fail with non-zero exit code on unhandled errors.
+- GitHub Actions in CI/release workflows are pinned to commit SHAs.
+- Dev dependencies in `package.json` are now pinned to exact versions.
+
+### Potentially Breaking
+
+- `baseUrl` validation is now strict; previously accepted non-normalized/less-safe values can now throw `BsuirConfigurationError`.
+- `validateResponses` defaults to `true`; integrations that relied on unchecked payloads may now see `BsuirResponseValidationError`.
+- Response body size is now actively enforced via `maxResponseBytes`; oversized responses now fail fast with `BsuirApiError`.
+
+### Fixed
+
+- Response parser now enforces `maxResponseBytes` for both `Content-Length` pre-checks and streamed body reads.
+- `BsuirTimeoutError` now preserves upstream abort timeout cause.
+- Public API report updates for schedule typings (`FlattenedLessonsByDay` and `lessonTypeAbbrev`) and utility export documentation.
+
 ## [0.9.1] - 2026-05-10
 
 ### Fixed
@@ -16,6 +61,12 @@
 
 ## [0.9.0] - 2026-05-10
 
+### Changed
+
+- Release-management update from Changesets (`version: 0.9.0` + release metadata). Runtime API/content remained aligned with the `0.8.0` code snapshot.
+
+## [0.8.0] - 2026-05-10
+
 ### Added
 
 - Public exports for schedule utilities: `normalizeSchedule` and `filterLessons`.

package/README.md

@@ -31,8 +31,12 @@ console.log(schedule.lessons.length);
 ## Client options
 
 ```ts
+import { createBsuirClient } from "bsuir-iis-api";
+
 const client = createBsuirClient({
   baseUrl: "https://iis.bsuir.by/api/v1",
+  allowedBaseUrlHosts: ["iis.bsuir.by"],
+  allowInsecureHttp: false,
   timeoutMs: 10000,
   retries: 2,
   retryDelayMs: 300,
@@ -40,7 +44,8 @@ const client = createBsuirClient({
   retryJitter: true,
   cache: { ttlMs: 60_000, maxEntries: 200 },
   dedupeInFlight: true,
-  validateResponses: false,
+  maxResponseBytes: 5_000_000,
+  validateResponses: true,
   hooks: {
     onRetry: ({ endpoint, delayMs, reason }) => {
       console.log("retry", endpoint, delayMs, reason);
@@ -51,10 +56,14 @@ const client = createBsuirClient({
 ```
 
 - `fetch` can be passed for custom runtime/testing.
+- `baseUrl` is normalized and validated (absolute URL, no credentials/query/hash, host allowlist).
+- `allowedBaseUrlHosts` controls which hosts are allowed for `baseUrl` (defaults to `["iis.bsuir.by"]`).
+- `allowInsecureHttp` enables `http://` only for trusted local/test endpoints.
 - `signal` in `createBsuirClient({ signal })` acts as a global cancellation signal for all requests made by that client.
 - `cache` stores successful GET responses in-memory for the configured TTL.
 - `dedupeInFlight` reuses the same in-flight GET request for concurrent callers (when no per-request signal is passed).
-- `validateResponses` enables runtime payload-shape checks for key endpoints.
+- `maxResponseBytes` limits body size per response to protect against memory spikes.
+- `validateResponses` enables runtime payload-shape checks for key endpoints (enabled by default).
 - `hooks` provides lifecycle callbacks (`onRequest`, `onRetry`, `onResponse`, `onError`) for observability.
 - `AbortSignal` is supported by all read methods.
 
@@ -92,11 +101,20 @@ const client = createBsuirClient({
 
 When IIS responds with HTTP `404` or `400` (no list, missing resource, or endpoint quirks), these methods resolve to an empty array `[]` instead of throwing `BsuirApiError`. Client-side validation still runs first (`urlId`, department `id`). If IIS later returns a meaningful `400` for bad parameters, it will also map to `[]`; other HTTP errors are unchanged.
 
+### Public exports (runtime utilities and types)
+
+- Core runtime API: `createBsuirClient`, `BsuirClient`
+- Client/runtime option types: `BsuirClientOptions`, `CacheOptions`, `ClientHooks`, `RequestOptions`, `ReadOptions`, `RequestHookContext`, `RetryHookContext`, `ResponseHookContext`, `ErrorHookContext`
+- Schedule utilities: `normalizeSchedule`, `filterLessons`, `ScheduleFilterOptions`
+- Error classes: `BsuirApiError`, `BsuirNetworkError`, `BsuirTimeoutError`, `BsuirValidationError`, `BsuirResponseValidationError`, `BsuirConfigurationError`
+- Domain types: `Announcement`, `ApiDateResponse`, `Auditory`, `AuditoryDepartment`, `AuditoryType`, `BuildingNumber`, `Department`, `EducationForm`, `Employee`, `EmployeeCatalogItem`, `Faculty`, `FlattenedLessonsByDay`, `FlattenedScheduleItem`, `LessonStudentGroup`, `Maybe`, `NormalizedScheduleResponse`, `ScheduleItem`, `ScheduleResponse`, `Speciality`, `StudentGroupCatalogItem`, `StudentGroupShort`, `Weekday`, `WeekScheduleMap`
+
 ## Errors
 
 SDK throws typed errors:
 
 - `BsuirApiError` for HTTP errors (contains `status`, `endpoint`, `body`). **Exception:** `client.announcements.byEmployee` / `byDepartment` resolve to `[]` on IIS HTTP `404` or `400` instead of throwing (see Announcements above).
+- `BsuirApiError` is also used when response body size exceeds configured `maxResponseBytes`.
 - `BsuirNetworkError` for transport errors (contains `endpoint` and standard `cause`)
 - `BsuirResponseValidationError` for invalid payload shapes when `validateResponses: true`
 - `BsuirTimeoutError` for timeouts (contains `endpoint`, `timeoutMs`)
@@ -110,7 +128,7 @@ Validation rules:
 - `id` and `subgroup` parameters must be positive integers
 Retry and abort behavior:
 
-- Retries are applied to `429`, `500`, `502`, `503`, `504`
+- Retries are applied to GET requests for transport/network errors and HTTP `429`, `500`, `502`, `503`, `504`
 - `Retry-After` is respected for retriable responses
 - Caller-provided aborted `AbortSignal` is re-thrown as native `AbortError`
 - Internal timeout is mapped to `BsuirTimeoutError`
@@ -124,17 +142,21 @@ For **2xx** responses the client reads the body as text, then applies `JSON.pars
 - Valid JSON is returned even when `Content-Type` does **not** include `application/json` (mislabeled responses still parse).
 - If `Content-Type` indicates **`application/json`** but the body is empty or not valid JSON, the client throws `BsuirApiError` (`Invalid JSON response payload`), same as for a truncated `{` payload.
 - If the body is **empty** and the content type does **not** indicate JSON, the result is an empty string `""` (analogous to reading plain text). Typical IIS catalog JSON endpoints return a non-empty body.
+- If response body size exceeds `maxResponseBytes`, the client throws `BsuirApiError`.
 
 ## Raw vs normalized schedule response
 
 By default, schedule methods return a **normalized** `NormalizedScheduleResponse`: `lessons` is all flattened items (weekly + exams), each tagged with `source: "schedules" | "exams"`; `scheduleLessons` / `examLessons` are the same rows split by source; `lessonsByDay` groups by weekday.
 
 ```ts
+import { createBsuirClient } from "bsuir-iis-api";
+
+const client = createBsuirClient();
 const raw = await client.schedule.getGroup("053503", { raw: true });
 ```
 
 Use `defaultRaw: true` in `createBsuirClient` to change global behavior.
-When `raw` is omitted, `getGroup()` and `getEmployee()` return normalized payload.
+When `raw` is omitted, `getGroup()` and `getEmployee()` follow client `defaultRaw` (`false` by default, so normalized unless explicitly changed to `true`).
 In raw mode API may return `schedules: null`; normalized mode always converts it to `{}`.
 In raw mode some lesson fields may also be nullable (`weekNumber`, `lessonTypeAbbrev`), so keep null checks if you consume raw payload directly.
 README examples match the installed package version; if types and docs ever diverge, rely on `NormalizedScheduleResponse` / `ScheduleResponse` from the same release.
@@ -147,6 +169,9 @@ The SDK normalizes `current-week` payloads, including plain-text responses like
 Filtering example:
 
 ```ts
+import { createBsuirClient } from "bsuir-iis-api";
+
+const client = createBsuirClient();
 const exams = await client.schedule.getGroupFiltered("053503", {
   source: "exams",
   lessonTypeAbbrev: ["Консультация", "Экзамен"]
@@ -154,6 +179,9 @@ const exams = await client.schedule.getGroupFiltered("053503", {
 ```
 
 ```ts
+import { createBsuirClient } from "bsuir-iis-api";
+
+const client = createBsuirClient();
 const subgroupLessons = await client.schedule.getEmployeeBySubgroup("s-nesterenkov", 1);
 ```
 

package/dist/_tsup-dts-rollup.d.ts

@@ -94,6 +94,22 @@ declare interface BsuirClientOptions {
      * @defaultValue "https://iis.bsuir.by/api/v1"
      */
     baseUrl?: string;
+    /**
+     * Allows using `http://` for `baseUrl`.
+     *
+     * Keep disabled unless you explicitly need local/non-TLS endpoints in tests.
+     *
+     * @defaultValue false
+     */
+    allowInsecureHttp?: boolean;
+    /**
+     * Allowed hostnames for `baseUrl`.
+     *
+     * Requests are rejected if `baseUrl` hostname is not in this list.
+     *
+     * @defaultValue ["iis.bsuir.by"]
+     */
+    allowedBaseUrlHosts?: string[];
     /**
      * Custom `fetch` implementation. Useful for environments where the global
      * `fetch` is unavailable (older Node.js versions) or when you want to wrap
@@ -196,6 +212,14 @@ declare interface BsuirClientOptions {
      * @defaultValue true
      */
     dedupeInFlight?: boolean;
+    /**
+     * Maximum allowed response body size (in bytes) for a single request.
+     *
+     * Helps prevent excessive memory usage on unexpectedly large payloads.
+     *
+     * @defaultValue 5_000_000 (5 MB)
+     */
+    maxResponseBytes?: number;
     /**
      * Enables runtime shape validation of API responses.
      *
@@ -207,7 +231,7 @@ declare interface BsuirClientOptions {
      * **Recommended to enable during development and in test environments.**
      * Can be left `false` in production for a small performance gain.
      *
-     * @defaultValue false
+     * @defaultValue true
      *
      * @example
      * ```ts
@@ -348,6 +372,11 @@ export { BuildingNumber }
 export { BuildingNumber as BuildingNumber_alias_1 }
 export { BuildingNumber as BuildingNumber_alias_2 }
 
+/**
+ * Builds absolute endpoint URL from base URL, path and query params.
+ */
+export declare function buildUrl(baseUrl: string, path: string, query?: QueryParams): string;
+
 declare interface CacheOptions {
     /**
      * Cache TTL for successful GET responses, in milliseconds.
@@ -397,15 +426,10 @@ declare function createAnnouncementsModule(config: Readonly<InternalClientConfig
 export { createAnnouncementsModule }
 export { createAnnouncementsModule as createAnnouncementsModule_alias_1 }
 
+/**
+ * Creates API module for `/auditories`.
+ */
 declare function createAuditoriesModule(config: Readonly<InternalClientConfig>): {
-    /**
-     * Returns the full list of auditories from `/auditories`.
-     * If the caller aborts `options.signal`, the platform propagates `AbortError` (not wrapped by the SDK).
-     *
-     * @throws {BsuirApiError} When the API returns a non-success HTTP status
-     * @throws {BsuirNetworkError} On transport failures after retries
-     * @throws {BsuirTimeoutError} When the request exceeds `timeoutMs`
-     */
     listAll(options?: ReadOptions): Promise<Auditory[]>;
 };
 export { createAuditoriesModule }
@@ -440,57 +464,37 @@ declare function createBsuirClient(options?: BsuirClientOptions & {
 export { createBsuirClient }
 export { createBsuirClient as createBsuirClient_alias_1 }
 
+/**
+ * Creates API module for `/departments`.
+ */
 declare function createDepartmentsModule(config: Readonly<InternalClientConfig>): {
-    /**
-     * Returns the full list of departments from `/departments`.
-     * If the caller aborts `options.signal`, the platform propagates `AbortError` (not wrapped by the SDK).
-     *
-     * @throws {BsuirApiError} When the API returns a non-success HTTP status
-     * @throws {BsuirNetworkError} On transport failures after retries
-     * @throws {BsuirTimeoutError} When the request exceeds `timeoutMs`
-     */
     listAll(options?: ReadOptions): Promise<Department[]>;
 };
 export { createDepartmentsModule }
 export { createDepartmentsModule as createDepartmentsModule_alias_1 }
 
+/**
+ * Creates API module for `/employees/all`.
+ */
 declare function createEmployeesModule(config: Readonly<InternalClientConfig>): {
-    /**
-     * Returns the full list of employees from `/employees/all`.
-     * If the caller aborts `options.signal`, the platform propagates `AbortError` (not wrapped by the SDK).
-     *
-     * @throws {BsuirApiError} When the API returns a non-success HTTP status
-     * @throws {BsuirNetworkError} On transport failures after retries
-     * @throws {BsuirTimeoutError} When the request exceeds `timeoutMs`
-     */
     listAll(options?: ReadOptions): Promise<EmployeeCatalogItem[]>;
 };
 export { createEmployeesModule }
 export { createEmployeesModule as createEmployeesModule_alias_1 }
 
+/**
+ * Creates API module for `/faculties`.
+ */
 declare function createFacultiesModule(config: Readonly<InternalClientConfig>): {
-    /**
-     * Returns the full list of faculties from `/faculties`.
-     * If the caller aborts `options.signal`, the platform propagates `AbortError` (not wrapped by the SDK).
-     *
-     * @throws {BsuirApiError} When the API returns a non-success HTTP status
-     * @throws {BsuirNetworkError} On transport failures after retries
-     * @throws {BsuirTimeoutError} When the request exceeds `timeoutMs`
-     */
     listAll(options?: ReadOptions): Promise<Faculty[]>;
 };
 export { createFacultiesModule }
 export { createFacultiesModule as createFacultiesModule_alias_1 }
 
+/**
+ * Creates API module for `/student-groups`.
+ */
 declare function createGroupsModule(config: Readonly<InternalClientConfig>): {
-    /**
-     * Returns the full list of student groups from `/student-groups`.
-     * If the caller aborts `options.signal`, the platform propagates `AbortError` (not wrapped by the SDK).
-     *
-     * @throws {BsuirApiError} When the API returns a non-success HTTP status
-     * @throws {BsuirNetworkError} On transport failures after retries
-     * @throws {BsuirTimeoutError} When the request exceeds `timeoutMs`
-     */
     listAll(options?: ReadOptions): Promise<StudentGroupCatalogItem[]>;
 };
 export { createGroupsModule }
@@ -498,6 +502,19 @@ export { createGroupsModule as createGroupsModule_alias_1 }
 
 export declare function createJsonResponse({ status, headers, body }: MockResponseInit): Response;
 
+/**
+ * Creates a simple catalog-like module exposing `listAll()` for a fixed endpoint.
+ */
+export declare function createListModule<T>(config: Readonly<InternalClientConfig>, endpoint: string): {
+    /**
+     * Returns all items from the configured endpoint.
+     */
+    listAll(options?: ReadOptions): Promise<T[]>;
+};
+
+/**
+ * Creates schedule API module with raw/normalized response support.
+ */
 declare function createScheduleModule<TRawDefault extends boolean>(config: Readonly<InternalClientConfig<TRawDefault>>): {
     getGroup: <TRaw extends boolean | undefined = undefined>(groupNumber: string, options?: ReadOptions & {
         raw?: TRaw;
@@ -507,14 +524,25 @@ declare function createScheduleModule<TRawDefault extends boolean>(config: Reado
     }) => Promise<ScheduleResponseByRawOption<TRaw, TRawDefault>>;
     getGroupFiltered: (groupNumber: string, filter: ScheduleFilterOptions, options?: ReadOptions) => Promise<FlattenedScheduleItem[]>;
     getEmployeeFiltered: (urlId: string, filter: ScheduleFilterOptions, options?: ReadOptions) => Promise<FlattenedScheduleItem[]>;
+    /**
+     * Returns exams for a group.
+     */
     getGroupExams(groupNumber: string, options?: ReadOptions): Promise<FlattenedScheduleItem[]>;
+    /**
+     * Returns exams for an employee.
+     */
     getEmployeeExams(urlId: string, options?: ReadOptions): Promise<FlattenedScheduleItem[]>;
+    /**
+     * Returns regular schedule lessons of a specific subgroup for a group.
+     */
     getGroupBySubgroup(groupNumber: string, subgroup: number, options?: ReadOptions): Promise<FlattenedScheduleItem[]>;
+    /**
+     * Returns regular schedule lessons of a specific subgroup for an employee.
+     */
     getEmployeeBySubgroup(urlId: string, subgroup: number, options?: ReadOptions): Promise<FlattenedScheduleItem[]>;
     getCurrentWeek: (options?: ReadOptions) => Promise<number>;
     /**
-     * Calls IIS `/last-update-date/student-group`. That route is legacy and unsupported on the server;
-     * it may return an error for newer group numbers (e.g. six-digit `524404`).
+     * Calls IIS `/last-update-date/student-group`.
      */
     getLastUpdateByGroup(params: {
         groupNumber: string;
@@ -522,8 +550,7 @@ declare function createScheduleModule<TRawDefault extends boolean>(config: Reado
         id: number;
     }, options?: ReadOptions): Promise<ApiDateResponse>;
     /**
-     * Calls IIS `/last-update-date/employee`. That route is legacy and unsupported on the server; prefer
-     * not relying on it for critical cache logic.
+     * Calls IIS `/last-update-date/employee`.
      */
     getLastUpdateByEmployee(params: {
         urlId: string;
@@ -533,16 +560,12 @@ declare function createScheduleModule<TRawDefault extends boolean>(config: Reado
 };
 export { createScheduleModule }
 export { createScheduleModule as createScheduleModule_alias_1 }
+export { createScheduleModule as createScheduleModule_alias_2 }
 
+/**
+ * Creates API module for `/specialities`.
+ */
 declare function createSpecialitiesModule(config: Readonly<InternalClientConfig>): {
-    /**
-     * Returns the full list of specialities from `/specialities`.
-     * If the caller aborts `options.signal`, the platform propagates `AbortError` (not wrapped by the SDK).
-     *
-     * @throws {BsuirApiError} When the API returns a non-success HTTP status
-     * @throws {BsuirNetworkError} On transport failures after retries
-     * @throws {BsuirTimeoutError} When the request exceeds `timeoutMs`
-     */
     listAll(options?: ReadOptions): Promise<Speciality[]>;
 };
 export { createSpecialitiesModule }
@@ -621,24 +644,12 @@ export { Faculty as Faculty_alias_1 }
 export { Faculty as Faculty_alias_2 }
 
 /**
- * Filters normalized schedule lessons by specified criteria.
- *
- * @param response - Normalized schedule response containing lessons
- * @param filter - Filter options with optional fields: source, weekday, weekNumber, subgroup,
- *                 lessonTypeAbbrev, subjectQuery, employeeUrlId, auditory
- * @returns Array of lessons matching all provided filter criteria
- *
- * @example
- * ```ts
- * const schedule = await client.schedule.getGroup("053503");
- * const mondayLessons = filterLessons(schedule, { weekday: "Понедельник" });
- * const practiceLessons = filterLessons(schedule, { lessonTypeAbbrev: "пр" });
- * const lectureLessons = filterLessons(schedule, { lessonTypeAbbrev: ["лк", "лекция"] });
- * ```
+ * Filters normalized schedule lessons by criteria.
  */
 declare function filterLessons(response: NormalizedScheduleResponse, filter: ScheduleFilterOptions): FlattenedScheduleItem[];
 export { filterLessons }
 export { filterLessons as filterLessons_alias_1 }
+export { filterLessons as filterLessons_alias_2 }
 
 declare type FlattenedLessonsByDay = Record<Weekday, FlattenedScheduleItem[]>;
 export { FlattenedLessonsByDay }
@@ -653,6 +664,11 @@ export { FlattenedScheduleItem }
 export { FlattenedScheduleItem as FlattenedScheduleItem_alias_1 }
 export { FlattenedScheduleItem as FlattenedScheduleItem_alias_2 }
 
+/**
+ * Calculates retry delay using `Retry-After` when present, otherwise exponential backoff.
+ */
+export declare function getRetryDelayMs(config: Readonly<InternalClientConfig>, attempt: number, retryAfterHeader?: string | null): number;
+
 export declare interface InternalClientConfig<TRawDefault extends boolean = boolean> {
     baseUrl: string;
     fetchImpl: typeof globalThis.fetch;
@@ -666,6 +682,7 @@ export declare interface InternalClientConfig<TRawDefault extends boolean = bool
     cacheTtlMs: number | undefined;
     cacheMaxEntries: number;
     dedupeInFlight: boolean;
+    maxResponseBytes: number;
     validateResponses: boolean;
     hooks: ClientHooks;
     responseCache: Map<string, {
@@ -733,29 +750,18 @@ export { NormalizedScheduleResponse as NormalizedScheduleResponse_alias_1 }
 export { NormalizedScheduleResponse as NormalizedScheduleResponse_alias_2 }
 
 /**
- * Transforms raw API schedule response into a normalized structure with flattened lessons.
- *
- * Raw API response contains lessons grouped by weekday (`schedules` object with day keys)
- * and exams in a separate array. This function flattens them into a single `lessons` array
- * for easier filtering and iteration, while preserving day-grouped view in `lessonsByDay`.
- *
- * @param response - Raw schedule response from API
- * @returns Normalized schedule with additional computed fields: `lessons` (flattened array),
- *          `lessonsByDay` (grouped by weekday), `scheduleLessons`, and `examLessons`
- *
- * @example
- * ```ts
- * const rawSchedule = await client.schedule.getGroup("053503", { raw: true });
- * const normalized = normalizeSchedule(rawSchedule);
- * console.log(normalized.lessons.length); // All lessons + exams flattened
- * console.log(normalized.lessonsByDay["Понедельник"]); // Monday-only lessons
- * console.log(normalized.scheduleLessons.length); // Only regular schedule
- * console.log(normalized.examLessons.length); // Only exams
- * ```
+ * Transforms raw schedule response into normalized structure with flattened lessons.
  */
 declare function normalizeSchedule(response: ScheduleResponse): NormalizedScheduleResponse;
 export { normalizeSchedule }
 export { normalizeSchedule as normalizeSchedule_alias_1 }
+export { normalizeSchedule as normalizeSchedule_alias_2 }
+
+/**
+ * Parses response body as JSON when possible, otherwise returns text.
+ * Throws `BsuirApiError` for declared JSON payloads that are empty/invalid.
+ */
+export declare function parseBody(response: Response, maxResponseBytes: number): Promise<unknown>;
 
 /**
  * Normalizes current week payload from API to a positive integer.
@@ -796,7 +802,12 @@ declare interface RequestHookContext {
 export { RequestHookContext }
 export { RequestHookContext as RequestHookContext_alias_1 }
 
-export declare function requestJson<T>(config: Readonly<InternalClientConfig>, path: string, options?: RequestOptions): Promise<T>;
+/**
+ * Executes JSON HTTP request with timeout, retry/backoff, deduplication and cache support.
+ */
+declare function requestJson<T>(config: Readonly<InternalClientConfig>, path: string, options?: RequestOptions): Promise<T>;
+export { requestJson }
+export { requestJson as requestJson_alias_1 }
 
 export declare type RequestMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
 
@@ -836,6 +847,9 @@ declare interface ResponseHookContext extends RequestHookContext {
 export { ResponseHookContext }
 export { ResponseHookContext as ResponseHookContext_alias_1 }
 
+/** HTTP status codes retriable by the request pipeline. */
+export declare const RETRIABLE_STATUS_CODES: Set<number>;
+
 declare interface RetryHookContext extends RequestHookContext {
     delayMs: number;
     reason: "http_status" | "network_error";
@@ -896,6 +910,14 @@ export { ScheduleResponse as ScheduleResponse_alias_2 }
 
 declare type ScheduleResponseByRawOption<TRaw extends boolean | undefined, TRawDefault extends boolean> = TRaw extends true ? ScheduleResponse : TRaw extends false ? NormalizedScheduleResponse : TRawDefault extends true ? ScheduleResponse : NormalizedScheduleResponse;
 
+/**
+ * Writes response value to cache and performs eviction when size approaches capacity.
+ */
+export declare function setCache(config: Readonly<InternalClientConfig>, key: string, value: unknown): void;
+
+/** Delays execution for a specified number of milliseconds. */
+export declare function sleep(ms: number): Promise<void>;
+
 declare interface Speciality {
     id: number;
     name: string;
@@ -933,6 +955,11 @@ export { StudentGroupShort }
 export { StudentGroupShort as StudentGroupShort_alias_1 }
 export { StudentGroupShort as StudentGroupShort_alias_2 }
 
+/**
+ * Reads a cached response value by key, applying TTL validation and LRU touch update.
+ */
+export declare function tryReadCache(config: Readonly<InternalClientConfig>, key: string): unknown;
+
 declare type Weekday = "Понедельник" | "Вторник" | "Среда" | "Четверг" | "Пятница" | "Суббота";
 export { Weekday }
 export { Weekday as Weekday_alias_1 }