pgbeam 0.4.1 → 0.4.3

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { o as operationsByPath, a as operationsByTag } from './operations-map.gen-g44nmkz5.js';
+import { o as operationsByPath, a as operationsByTag } from './operations-map.gen-g1lyg7rw.js';
 
 class ApiError extends Error {
     constructor(status, statusText, body){
@@ -144,6 +144,58 @@ function isMutatingMethod(method) {
     const upper = method.toUpperCase();
     return upper === "POST" || upper === "PATCH";
 }
+/**
+ * Resolve a lazy token, or give up once `timeoutMs` has passed without it.
+ *
+ * A token function is a network call in disguise. Both browser clients resolve
+ * a JWT from an auth endpoint (`authClient.token()`), so an auth endpoint that
+ * accepts the request and never answers is a stall like any other. It just
+ * happened before the attempt loop, where none of this module's bounds reach:
+ * `AbortSignal.timeout` is attached to the fetch, `totalBudgetMs` is measured
+ * from the first attempt, and neither exists yet. A `try`/`catch` in the token
+ * function does not cover it either, because a call that never answers never
+ * rejects. The result was a request with no ceiling of any kind, which is
+ * exactly what every other bound in this file was written to rule out.
+ *
+ * The failure is reported as a timed-out `NetworkError`, the same shape a
+ * stalled attempt produces, because it is the same event to a caller: the
+ * request never got an answer and a second try tests the same thing again.
+ * `lib/query-provider.tsx` in the dashboard already withholds its retry on
+ * `timedOut`, so it gets the right behaviour here for free.
+ *
+ * The bound is `timeoutMs`, the per-attempt ceiling, because the token round
+ * trip is an attempt. A call whose token stalls and whose request then stalls
+ * costs two of them, which is the honest cost of two sequential round trips and
+ * still finite, where before it was unbounded.
+ *
+ * `timeoutMs` of 0 disables the fetch timeout by documented contract, so it
+ * disables this one too rather than inventing a ceiling the caller turned off.
+ */ async function resolveToken(token, ctx) {
+    if (typeof token !== "function") return token;
+    if (ctx.timeoutMs <= 0) return token();
+    const stalled = Symbol("token-timeout");
+    let timer;
+    const deadline = new Promise((resolve)=>{
+        timer = setTimeout(()=>resolve(stalled), ctx.timeoutMs);
+    });
+    // A rejection from `token()` wins the race and propagates unchanged: the
+    // function decided it had failed, and relabelling that as a network timeout
+    // would lose the reason.
+    const resolved = await Promise.race([
+        token(),
+        deadline
+    ]).finally(()=>clearTimeout(timer));
+    if (resolved !== stalled) return resolved;
+    throw new NetworkError({
+        method: ctx.method,
+        url: ctx.url,
+        attempts: 0,
+        elapsedMs: Date.now() - ctx.startedAt,
+        timedOut: true,
+        timeoutMs: ctx.timeoutMs,
+        cause: new Error("token resolution did not settle")
+    });
+}
 async function fetcher(options) {
     let url = options.path;
     if (options.pathParams) {
@@ -159,19 +211,27 @@ async function fetcher(options) {
             }
         }
     }
-    const headers = {};
-    if (options.token) {
-        headers.Authorization = `Bearer ${options.token}`;
-    }
-    if (options.body !== undefined) {
-        headers["Content-Type"] = "application/json";
-    }
     const fetchFn = options.fetchImpl ?? globalThis.fetch;
     const retry = resolveRetry(options.retry);
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const startedAt = Date.now();
     const urlStr = fullUrl.toString();
     const fetchBody = options.body !== undefined ? JSON.stringify(options.body) : undefined;
+    // Resolved once, before the attempt loop, so retries reuse one token rather
+    // than paying for a fresh auth round trip each time.
+    const token = await resolveToken(options.token, {
+        method: options.method,
+        url: urlStr,
+        startedAt,
+        timeoutMs
+    });
+    const headers = {};
+    if (token) {
+        headers.Authorization = `Bearer ${token}`;
+    }
+    if (options.body !== undefined) {
+        headers["Content-Type"] = "application/json";
+    }
     // Generate idempotency key once, reused across all retry attempts.
     const idempotencyKey = retry.maxRetries > 0 && retry.idempotencyKeys && isMutatingMethod(options.method) ? generateUUID() : undefined;
     for(let attempt = 0; attempt <= retry.maxRetries; attempt++){
@@ -274,14 +334,16 @@ class PgBeamClient {
         this._timeoutMs = options.timeoutMs;
         this._operations = options.operations ?? publicRegistry;
     }
-    async _resolveToken() {
-        if (typeof this._tokenOrFn === "function") {
-            return this._tokenOrFn();
-        }
-        return this._tokenOrFn;
-    }
-    async _send(meta, params) {
-        const token = await this._resolveToken();
+    /**
+   * `token` is handed to the fetcher unresolved on purpose.
+   *
+   * Awaiting a token function here put the auth round trip outside every bound
+   * the fetcher applies, so a token endpoint that accepted the request and never
+   * answered left the call outstanding with no ceiling at all: not `timeoutMs`,
+   * not the retry budget, and with no `timedOut` signal for a caller to branch
+   * on. The fetcher resolves it under the same per-attempt timeout as the
+   * request it authenticates.
+   */ async _send(meta, params) {
         return fetcher({
             method: meta.method,
             path: meta.path,
@@ -289,7 +351,7 @@ class PgBeamClient {
             queryParams: params.queryParams,
             body: params.body,
             baseUrl: this._baseUrl,
-            token,
+            token: this._tokenOrFn,
             fetchImpl: this._fetchImpl,
             onResponse: this._onResponse,
             retry: this._retry,

package/dist/{operations-map.gen-c7vqzfzd.cjs → operations-map.gen-fpzclg56.cjs}

@@ -53,6 +53,10 @@
             method: "GET",
             path: "/v1/projects/{project_id}/audit-logs/export"
         },
+        getAuditSessionSummary: {
+            method: "GET",
+            path: "/v1/projects/{project_id}/audit-logs/sessions/{session_id}"
+        },
         verifyAuditChain: {
             method: "GET",
             path: "/v1/projects/{project_id}/audit-logs/verify"
@@ -455,6 +459,11 @@ const operationsByPath = {
         path: "/v1/projects/{project_id}/audit-logs/export",
         operationId: "exportAuditLogs"
     },
+    "GET /v1/projects/{project_id}/audit-logs/sessions/{session_id}": {
+        method: "GET",
+        path: "/v1/projects/{project_id}/audit-logs/sessions/{session_id}",
+        operationId: "getAuditSessionSummary"
+    },
     "GET /v1/projects/{project_id}/audit-logs/verify": {
         method: "GET",
         path: "/v1/projects/{project_id}/audit-logs/verify",

package/dist/{operations-map.gen-g44nmkz5.js → operations-map.gen-g1lyg7rw.js}

@@ -53,6 +53,10 @@
             method: "GET",
             path: "/v1/projects/{project_id}/audit-logs/export"
         },
+        getAuditSessionSummary: {
+            method: "GET",
+            path: "/v1/projects/{project_id}/audit-logs/sessions/{session_id}"
+        },
         verifyAuditChain: {
             method: "GET",
             path: "/v1/projects/{project_id}/audit-logs/verify"
@@ -455,6 +459,11 @@ const operationsByPath = {
         path: "/v1/projects/{project_id}/audit-logs/export",
         operationId: "exportAuditLogs"
     },
+    "GET /v1/projects/{project_id}/audit-logs/sessions/{session_id}": {
+        method: "GET",
+        path: "/v1/projects/{project_id}/audit-logs/sessions/{session_id}",
+        operationId: "getAuditSessionSummary"
+    },
     "GET /v1/projects/{project_id}/audit-logs/verify": {
         method: "GET",
         path: "/v1/projects/{project_id}/audit-logs/verify",