quickbase-js 0.1.0-beta.10 → 0.1.0-beta.12

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [0.1.0-beta.12](https://github.com/DrewBradfordXYZ/quickbase-js/compare/v0.1.0-beta.11...v0.1.0-beta.12) (2025-03-23)
+
+
+### Features
+
+* enable true concurrency with throttle bucket ([8dc4dee](https://github.com/DrewBradfordXYZ/quickbase-js/commit/8dc4deeaddb4365f4f64a8bd07390c7071f739f7))
+
+## [0.1.0-beta.11](https://github.com/DrewBradfordXYZ/quickbase-js/compare/v0.1.0-beta.10...v0.1.0-beta.11) (2025-03-23)
+
+
+### Features
+
+* only fetch auth dbid once for concurrent requests. temp tokens and SSO ([12f7f31](https://github.com/DrewBradfordXYZ/quickbase-js/commit/12f7f3117b2fd6e5db35d73e945dff0a79ef0481))
+* SSO concurrency tests passes ([caf5fca](https://github.com/DrewBradfordXYZ/quickbase-js/commit/caf5fca4e86b0dda4a75c2856f9324634369f15a))
+* temp token concurrency prevents redundant token fetches. getAppConcurrency.test.ts unit test passes ([2913e7b](https://github.com/DrewBradfordXYZ/quickbase-js/commit/2913e7b38d38ca0ceaa0af21b2e872f7bafb9d99))
+
 ## [0.1.0-beta.10](https://github.com/DrewBradfordXYZ/quickbase-js/compare/v0.1.0-beta.9...v0.1.0-beta.10) (2025-03-22)
 
 

package/README.md

@@ -1,22 +1,60 @@
 # quickbase-js
 
-A Typescript library using the QuickBase OpenAPI spec and the typescipt-fetch generator. This library is designed for both browser and Node.js environments. Code pages have first class support.
+A Typescript API client for the [Quickbase JSON RESTful API](https://developer.quickbase.com/).
 
-Authentication methods: `Temporary Tokens`, `User Tokens`, `SSO`.
+Support for various authentication strategies (`user token`, `temporary tokens`, `SSO token`), `rate limiting`, `429`(rate limit) error and `401`(auth) error handling retries and automatic `date` conversion. It uses a Proxy to dynamically invoke API methods derived from the OpenAPI specification.
+
+Browser and Node.js support. ESM and UMD builds are available.
+
+Authentication methods are handled in an opinionated manner. See configuration options for details and available settings.
 
 ## API Documentation
 
-https://quickbase-js.netlify.app/
+<a href="https://quickbase-js.netlify.app/" target="_blank"> Documentation</a> for quickbase-js.
 
 ## Installation
 
+#### Node.js install
+
 ```bash
 npm install --save quickbase-js
 ```
 
-## Examples
+#### CDN install.
+
+Find and select the latest version. UMD is recommended for code pages.
+
+<a href="https://www.jsdelivr.com/package/npm/quickbase-js?tab=files" target="_blank">CDN Files</a> for quickbase-js
+
+```html
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Quickbase</title>
+    <!-- Replace xx.xx.xx with the latest version from CDN Files-->
+    <script src="https://cdn.jsdelivr.net/npm/quickbase-js@xx.xx.xx/dist/umd/quickbase.umd.min.js"></script>
+  </head>
+  <body>
+    <script>
+      const realm = ""; // Replace with your realm
+      const appId = ""; // Replace with your app ID
+
+      const qb = QuickbaseJS.quickbase({
+        realm,
+        useTempTokens: true,
+      });
+
+      qb.getApp({ appId })
+        .then((app) => console.log(app.name))
+        .catch((err) => console.log(err.message));
+    </script>
+  </body>
+</html>
+```
+
+## Authentication Examples
 
-### Auth: User Token
+### User Token
 
 ```javascript
 import { quickbase } from "quickbase-js"; // Adjust the import path as needed
@@ -45,7 +83,7 @@ const getAppDetails = async () => {
 getAppDetails();
 ```
 
-### Auth: Temporary Tokens (Code Pages)
+### Temporary Tokens (Code Pages)
 
 ```javascript
 import { quickbase } from "quickbase-js"; // Adjust the import path as needed
@@ -73,7 +111,7 @@ const getAppDetails = async () => {
 getAppDetails();
 ```
 
-### Auth: SSO
+### SSO Token
 
 ```javascript
 import { quickbase } from "quickbase-js"; // Adjust the import path as needed
@@ -117,37 +155,31 @@ _User options:_
 
 _Advanced user options:_
 
-- **`tempTokenLifespan`** (`number`, optional): The lifespan (in milliseconds) of temporary tokens in the cache. Defaults to 4 minutes 50 seconds (290000 ms).
-
-- **`throttle`** (`{ rate: number; burst: number }`, optional): Configures rate limiting, where `rate` is requests per second and `burst` is the maximum burst of requests. Defaults to `{ rate: 10, burst: 10 }`.
-
+- **`throttle`** (`{ rate: number; burst: number }`, optional): Configures rate limiting to manage how many API requests are sent at once and how quickly additional requests follow. Defaults to `{ rate: 5, burst: 3 }`.
+  - **`burst`**: The number of requests that can start immediately (concurrent calls). Default is `3`, meaning up to 3 requests run at the same time.
+  - **`rate`**: The number of requests allowed per second after the initial burst. Default is `5`, pacing extra requests at one every ~200ms.
+  - **How It Works**: Taking the default setting for example: requests in general take ~500ms to finish. Imagine having 6 requests, 3 start right away finishing at ~500ms. Because the rate is set to 200ms, 2 request tokens have built up during this time, so the next 2 requests are sent out immediately when the first 3 finnish, leaving 1 burst spot available. The third request waits the extra 100ms to be dispatched starting at ~600ms using up the remaining burst spot, which takes another ~500ms to finish. All requests finishing around ~1100ms total. This keeps you safely under Quickbase’s 10 requests/sec limit while maximizing speed. A more liberal setting of `{ rate: 10, burst: 5 }` allows 5 requests at once, with request tokens building up every ~100ms, finishing 6 requests in ~1000ms.
 - **`maxRetries`** (`number`, optional): The maximum number of retries for failed requests. Defaults to `3`.
-
 - **`retryDelay`** (`number`, optional): The base delay (in milliseconds) between retries, which increases exponentially. Defaults to `1000`.
-
+- **`tempTokenLifespan`** (`number`, optional): The lifespan (in milliseconds) of temporary tokens in the cache. Defaults to 4 minutes 50 seconds (290000 ms).
 - **`convertDates`** (`boolean`, optional): Converts ISO date strings to `Date` objects in responses. Defaults to `true`.
 
 _Overrides and development options:_
 
-- **`fetchApi`** (`typeof fetch`, optional): For browser environments, this defaults to the built-in `fetch`. In Node.js, you are able to use `node-fetch` or another compatible library.
-
+- **`fetchApi`** (`typeof fetch`, optional): For browser environments, this defaults to the built-in `fetch`. In Node.js, you can use `node-fetch` or another compatible library.
 - **`baseUrl`** (`string`, optional): The base URL for the QuickBase API. Defaults to `"https://api.quickbase.com/v1"`.
-
 - **`debug`** (`boolean`, optional): Enables debug logging to the console. Defaults to `false`.
-
-- **`tempToken`** (`string`, optional): If you would like to override the default behavior of tempTokens you can provide your own tempToken.
-
-- **`tokenCache`** (`TokenCache`, optional): If you would like to use your own token cache, you can provide an instance of `TokenCache`.
+- **`tempToken`** (`string`, optional): Overrides the default behavior of tempTokens by providing your own tempToken.
+- **`tokenCache`** (`TokenCache`, optional): Allows you to use your own token cache instance.
 
 ---
 
 #### Configuration Notes
 
-- **Authentication**: There are three mutually exclusive authentication methods: `userToken`, `useTempTokens` and `useSso` with `samlToken`. Only one auth method may be active at a time.
+- **Authentication**: There are three mutually exclusive authentication methods: `userToken`, `useTempTokens`, and `useSso` with `samlToken`. Only one auth method may be active at a time.
+- **`tokenCache`**: Temporary tokens are cached with their dbid and `tempTokenLifespan`. This is automatically set up when `useTempTokens` is enabled.
 
-- **`throttle`**: Adjust this to handle 429 Too Many Requests errors. Controls API request pacing to avoid hitting rate limits. For example, `{ rate: 5, burst: 20 }` allows 5 requests per second with a burst capacity of 20.
-
-- **`tokenCache`**: Temporary tokens are cached with their dbid with a `tempTokenLifespan`. This is automatically setup for you when `useTempTokens` is enabled.
+---
 
 ### Development workflow
 

package/dist/esm/quickbase.d.ts

@@ -8051,6 +8051,7 @@ declare class TokenCache {
     constructor(tempTokenLifespan?: number);
     get(dbid: string): string | undefined;
     set(dbid: string, token: string, lifespan?: number): void;
+    delete(dbid: string): void;
     clear(): void;
 }
 

package/dist/esm/quickbase.js

@@ -7348,6 +7348,9 @@ class TokenCache {
             expiresAt: now + (lifespan || this.tempTokenLifespan),
         });
     }
+    delete(dbid) {
+        this.cache.delete(dbid);
+    }
     clear() {
         this.cache.clear();
     }
@@ -7402,14 +7405,13 @@ function extractHttpMethod(method) {
     return match ? match[1].toUpperCase() : "GET"; // Fallback to GET if no match
 }
 
-// src/authorizationStrategy.ts
-// src/authorizationStrategy.ts (partial update)
 class TempTokenStrategy {
     tokenCache;
     initialTempToken;
     fetchApi;
     realm;
     baseUrl;
+    pendingFetches = new Map();
     constructor(tokenCache, initialTempToken, fetchApi, realm, baseUrl = "https://api.quickbase.com/v1") {
         this.tokenCache = tokenCache;
         this.initialTempToken = initialTempToken;
@@ -7444,7 +7446,13 @@ class TempTokenStrategy {
     async getToken(dbid) {
         let token = this.tokenCache.get(dbid) || this.initialTempToken;
         if (!token && dbid) {
-            token = await this.fetchTempToken(dbid);
+            if (this.pendingFetches.has(dbid)) {
+                console.log(`[getToken] Waiting for existing fetch for dbid: ${dbid}`);
+                return this.pendingFetches.get(dbid);
+            }
+            const fetchPromise = this.fetchTempToken(dbid).finally(() => this.pendingFetches.delete(dbid));
+            this.pendingFetches.set(dbid, fetchPromise);
+            token = await fetchPromise;
         }
         return token;
     }
@@ -7464,15 +7472,29 @@ class TempTokenStrategy {
         }
         if (debug)
             console.log(`Refreshing temp token for dbid: ${dbid}`);
-        const newToken = await this.fetchTempToken(dbid);
-        this.tokenCache.set(dbid, newToken);
-        return newToken;
+        // Invalidate the cache for this dbid to force a fresh fetch
+        this.tokenCache.delete(dbid);
+        try {
+            const newToken = await this.getToken(dbid);
+            if (newToken) {
+                this.tokenCache.set(dbid, newToken);
+                return newToken;
+            }
+            return null;
+        }
+        catch (error) {
+            if (debug)
+                console.log(`[${methodName || "method"}] Failed to refresh token:`, error);
+            throw error;
+        }
     }
 }
 class UserTokenStrategy {
     userToken;
-    constructor(userToken) {
+    baseUrl;
+    constructor(userToken, baseUrl = "https://api.quickbase.com/v1") {
         this.userToken = userToken;
+        this.baseUrl = baseUrl;
     }
     async getToken(_dbid) {
         return this.userToken;
@@ -7493,21 +7515,31 @@ class SsoTokenStrategy {
     realm;
     fetchApi;
     debug;
+    baseUrl;
     currentToken;
-    constructor(samlToken, realm, fetchApi, debug = false) {
+    pendingFetches = new Map();
+    constructor(samlToken, realm, fetchApi, debug = false, baseUrl = "https://api.quickbase.com/v1") {
         this.samlToken = samlToken;
         this.realm = realm;
         this.fetchApi = fetchApi;
         this.debug = debug;
+        this.baseUrl = baseUrl;
     }
     async getToken(_dbid) {
         if (!this.currentToken) {
-            this.currentToken = await this.fetchSsoToken({
+            if (this.pendingFetches.has("sso")) {
+                if (this.debug)
+                    console.log("[getToken] Waiting for existing SSO fetch");
+                return this.pendingFetches.get("sso");
+            }
+            const fetchPromise = this.fetchSsoToken({
                 grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
                 requested_token_type: "urn:quickbase:params:oauth:token-type:temp_token",
                 subject_token: this.samlToken,
                 subject_token_type: "urn:ietf:params:oauth:token-type:saml2",
-            });
+            }).finally(() => this.pendingFetches.delete("sso"));
+            this.pendingFetches.set("sso", fetchPromise);
+            this.currentToken = await fetchPromise;
         }
         return this.currentToken;
     }
@@ -7534,7 +7566,7 @@ class SsoTokenStrategy {
             subject_token: this.samlToken,
             subject_token_type: "urn:ietf:params:oauth:token-type:saml2",
         };
-        const response = await this.fetchApi(`https://api.quickbase.com/v1/auth/oauth/token`, {
+        const response = await this.fetchApi(`${this.baseUrl}/auth/oauth/token`, {
             method: "POST",
             headers: {
                 "QB-Realm-Hostname": `${this.realm}.quickbase.com`,
@@ -7561,7 +7593,7 @@ class SsoTokenStrategy {
         return newToken;
     }
     async fetchSsoToken(params) {
-        const response = await this.fetchApi(`https://api.quickbase.com/v1/auth/oauth/token`, {
+        const response = await this.fetchApi(`${this.baseUrl}/auth/oauth/token`, {
             method: "POST",
             headers: {
                 "QB-Realm-Hostname": `${this.realm}.quickbase.com`,
@@ -7609,16 +7641,15 @@ class RateLimitError extends Error {
 }
 
 // src/invokeMethod.ts
-async function invokeMethod(methodName, params, methodMap, baseHeaders, authStrategy, rateLimiter, transformDates, debug, convertDates) {
-    console.log("[invokeMethod] Starting for method:", methodName);
+async function invokeMethod(methodName, params, methodMap, baseHeaders, authStrategy, rateLimiter, transformDates, debug, convertDates, attempt = 0, maxAttempts = rateLimiter.maxRetries + 1) {
     const methodInfo = methodMap[methodName];
     if (!methodInfo)
         throw new Error(`Method ${methodName} not found`);
     const hasBody = "body" in params && params.body !== undefined;
     const body = hasBody ? params.body : undefined;
     const restParams = hasBody
-        ? Object.fromEntries(Object.entries(params).filter(([key]) => key !== "body"))
-        : { ...params };
+        ? Object.fromEntries(Object.entries(params).filter(([key]) => key !== "body" && key !== "startTime"))
+        : { ...params, startTime: undefined };
     const requestParameters = {
         ...restParams,
         ...(hasBody ? { generated: body } : {}),
@@ -7628,33 +7659,21 @@ async function invokeMethod(methodName, params, methodMap, baseHeaders, authStra
         method: methodInfo.httpMethod,
     };
     let dbid = extractDbid(params);
-    console.log("[invokeMethod] Extracted dbid:", dbid);
     let token = dbid
         ? await authStrategy.getToken(dbid)
         : await authStrategy.getToken("");
-    console.log("[invokeMethod] Initial token:", token);
     if (token) {
         authStrategy.applyHeaders(baseHeaders, token);
         requestOptions.headers = { ...baseHeaders };
-        console.log("[invokeMethod] Token found, headers set:", requestOptions.headers);
         if (methodName === "getTempTokenDBID") {
-            console.log("[invokeMethod] Using cached token:", token);
             return { temporaryAuthorization: token };
         }
     }
-    if (debug) {
-        console.log(`[${methodName}] requestParameters:`, requestParameters);
-        console.log(`[${methodName}] requestOptions:`, requestOptions);
-    }
     async function processResponse(rawResponse) {
-        if (debug)
-            console.log(`[${methodName}] rawResponse:`, rawResponse);
         if (rawResponse instanceof Response) {
             const contentType = rawResponse.headers
                 .get("Content-Type")
                 ?.toLowerCase();
-            if (debug)
-                console.log(`[${methodName}] contentType:`, contentType);
             if (contentType?.includes("application/json")) {
                 const jsonResponse = await rawResponse.json();
                 return transformDates(jsonResponse, convertDates);
@@ -7663,8 +7682,6 @@ async function invokeMethod(methodName, params, methodMap, baseHeaders, authStra
         }
         if (rawResponse && typeof rawResponse.value === "function") {
             const response = await rawResponse.value();
-            if (debug)
-                console.log(`[${methodName}] Resolved JSONApiResponse:`, response);
             return transformDates(response, convertDates);
         }
         return transformDates(rawResponse, convertDates);
@@ -7692,28 +7709,26 @@ async function invokeMethod(methodName, params, methodMap, baseHeaders, authStra
             }
         }
         catch (e) {
-            if (debug)
-                console.log(`[${methodName}] Error parsing response body:`, e);
             message = "Failed to parse error response";
         }
-        if (debug)
-            console.log("[invokeMethod] Parsed error - status:", status, "message:", message);
         return { message, status };
     }
-    let attempt = 0;
-    const maxAttempts = rateLimiter.maxRetries + 1;
     while (attempt < maxAttempts) {
-        console.log("[invokeMethod] Attempt:", attempt + 1, "of", maxAttempts);
+        let acquired = false;
         try {
             await rateLimiter.throttle();
-            console.log("[invokeMethod] About to call API for method:", methodName);
-            const response = await methodInfo.method(requestParameters, requestOptions);
-            console.log("[invokeMethod] API call completed for method:", methodName);
+            acquired = true;
+            const postThrottleTime = Date.now(); // Capture post-throttle time
+            if (params.startTime !== undefined)
+                params.startTime = postThrottleTime; // Update startTime for testing
+            const responsePromise = methodInfo.method(requestParameters, requestOptions);
+            rateLimiter.release(); // Release slot immediately after starting fetch
+            const response = await responsePromise;
             return await processResponse(response);
         }
         catch (error) {
-            if (debug)
-                console.log("[invokeMethod] Caught error:", error);
+            if (acquired)
+                rateLimiter.release();
             let status;
             let message;
             let response;
@@ -7726,31 +7741,13 @@ async function invokeMethod(methodName, params, methodMap, baseHeaders, authStra
                 ({ message, status } = await parseErrorResponse(response));
             }
             else {
-                if (debug)
-                    console.log(`[${methodName}] Unexpected error:`, error);
-                // Attempt to handle as a fetch error with a response
-                if (error instanceof Error && "response" in error) {
-                    response = error.response;
-                    if (response instanceof Response) {
-                        ({ message, status } = await parseErrorResponse(response));
-                    }
-                    else {
-                        throw error; // Rethrow if no response
-                    }
-                }
-                else {
-                    throw error; // Rethrow truly unexpected errors
-                }
+                throw error;
             }
-            if (debug)
-                console.log("[invokeMethod] Handling error with status:", status);
             if (status === 429) {
                 if (!(error instanceof ResponseError)) {
                     throw new Error("Expected ResponseError for 429 handling");
                 }
                 const delay = await rateLimiter.handle429(error, attempt + 1);
-                if (debug)
-                    console.log(`[${methodName}] 429 delay: ${delay}ms`);
                 if (attempt + 1 === maxAttempts) {
                     throw new RateLimitError(`API Error: ${message} (Status: ${status})`, status, response?.headers.get("Retry-After")
                         ? parseInt(response.headers.get("Retry-After"), 10)
@@ -7760,14 +7757,20 @@ async function invokeMethod(methodName, params, methodMap, baseHeaders, authStra
                 attempt++;
                 continue;
             }
-            const newToken = await authStrategy.handleError(status, params, attempt, maxAttempts, debug, methodName);
-            if (newToken) {
+            let newToken;
+            try {
+                newToken = await authStrategy.handleError(status, params, attempt, maxAttempts, debug, methodName);
+            }
+            catch (authError) {
+                throw authError;
+            }
+            if (newToken !== null) {
                 token = newToken;
                 authStrategy.applyHeaders(baseHeaders, token);
                 requestOptions.headers = { ...baseHeaders };
-                attempt++;
                 if (debug)
                     console.log(`[${methodName}] Retrying with token: ${token.substring(0, 10)}...`);
+                attempt++;
                 continue;
             }
             throw new Error(`API Error: ${message} (Status: ${status})`);
@@ -7777,41 +7780,71 @@ async function invokeMethod(methodName, params, methodMap, baseHeaders, authStra
 }
 
 // src/ThrottleBucket.ts
-class ThrottleBucket {
+class ConcurrentThrottleBucket {
     tokens;
     maxTokens;
-    refillRate; // Tokens per second
+    refillRate;
     lastRefill;
-    pending = Promise.resolve(); // Queue for sequential execution
+    semaphore;
     constructor(rate, burst) {
         this.tokens = burst;
         this.maxTokens = burst;
         this.refillRate = rate;
         this.lastRefill = Date.now();
+        this.semaphore = new Semaphore(burst);
     }
     refill() {
         const now = Date.now();
-        const elapsed = (now - this.lastRefill) / 1000; // Seconds elapsed
+        const elapsed = (now - this.lastRefill) / 1000;
         const newTokens = elapsed * this.refillRate;
         this.tokens = Math.min(this.maxTokens, this.tokens + newTokens);
         this.lastRefill = now;
     }
     async acquire() {
-        // Chain the new acquisition onto the pending queue
-        const previous = this.pending;
-        this.pending = (async () => {
-            await previous; // Wait for prior calls to complete
+        await this.semaphore.acquire();
+        try {
             this.refill();
-            if (this.tokens >= 1) {
-                this.tokens -= 1;
-                return;
+            while (this.tokens < 1) {
+                const waitTime = ((1 - this.tokens) / this.refillRate) * 1000;
+                await new Promise((resolve) => setTimeout(resolve, waitTime));
+                this.refill();
             }
-            const waitTime = ((1 - this.tokens) / this.refillRate) * 1000; // ms until next token
-            await new Promise((resolve) => setTimeout(resolve, waitTime));
-            this.refill();
             this.tokens -= 1;
-        })();
-        await this.pending;
+        }
+        catch (error) {
+            this.semaphore.release();
+            throw error;
+        }
+    }
+    release() {
+        this.semaphore.release();
+    }
+}
+class Semaphore {
+    permits;
+    waiting = [];
+    constructor(maxPermits) {
+        this.permits = maxPermits;
+    }
+    async acquire() {
+        if (this.permits > 0) {
+            this.permits -= 1;
+            return;
+        }
+        return new Promise((resolve, reject) => {
+            this.waiting.push({ resolve, reject });
+        });
+    }
+    release() {
+        this.permits += 1;
+        if (this.waiting.length > 0 && this.permits > 0) {
+            const { resolve } = this.waiting.shift();
+            this.permits -= 1;
+            resolve();
+        }
+    }
+    available() {
+        return this.permits;
     }
 }
 
@@ -7819,7 +7852,8 @@ class RateLimiter {
     throttleBucket;
     maxRetries;
     retryDelay;
-    constructor(throttleBucket, maxRetries = 3, retryDelay = 1000) {
+    constructor(throttleBucket, // Updated type
+    maxRetries = 3, retryDelay = 1000) {
         this.throttleBucket = throttleBucket;
         this.maxRetries = maxRetries;
         this.retryDelay = retryDelay;
@@ -7829,8 +7863,12 @@ class RateLimiter {
             await this.throttleBucket.acquire();
         }
     }
+    release() {
+        if (this.throttleBucket) {
+            this.throttleBucket.release();
+        }
+    }
     async handle429(error, attempt) {
-        // Remove the throw here; let invokeMethod handle exhaustion
         const retryAfter = error.response.headers.get("Retry-After");
         return retryAfter
             ? parseInt(retryAfter, 10) * 1000
@@ -7838,12 +7876,12 @@ class RateLimiter {
     }
 }
 
-// src/quickbaseClient.ts
 function quickbase(config) {
-    const { realm, userToken, tempToken, useTempTokens, useSso, samlToken, fetchApi, debug, convertDates = true, tempTokenLifespan = 290000, throttle = { rate: 10, burst: 10 }, maxRetries = 3, retryDelay = 1000, tokenCache: providedTokenCache, baseUrl = "https://api.quickbase.com/v1", } = config;
+    const { realm, userToken, tempToken, useTempTokens, useSso, samlToken, fetchApi, debug, convertDates = true, tempTokenLifespan = 290000, throttle = { rate: 5, burst: 3 }, // Updated default to match passing test
+    maxRetries = 3, retryDelay = 1000, tokenCache: providedTokenCache, baseUrl = "https://api.quickbase.com/v1", } = config;
     const tokenCache = providedTokenCache || new TokenCache(tempTokenLifespan);
     const throttleBucket = throttle
-        ? new ThrottleBucket(throttle.rate, throttle.burst)
+        ? new ConcurrentThrottleBucket(throttle.rate, throttle.burst)
         : null;
     const rateLimiter = new RateLimiter(throttleBucket, maxRetries, retryDelay);
     const defaultFetch = typeof globalThis.window !== "undefined"
@@ -7854,10 +7892,10 @@ function quickbase(config) {
         throw new Error("No fetch implementation available");
     }
     const authStrategy = useSso
-        ? new SsoTokenStrategy(samlToken || "", realm, effectiveFetch, debug)
+        ? new SsoTokenStrategy(samlToken || "", realm, effectiveFetch, debug, baseUrl)
         : useTempTokens
             ? new TempTokenStrategy(tokenCache, tempToken, effectiveFetch, realm, baseUrl)
-            : new UserTokenStrategy(userToken || "");
+            : new UserTokenStrategy(userToken || "", baseUrl);
     const baseHeaders = {
         "QB-Realm-Hostname": `${realm}.quickbase.com`,
         "Content-Type": "application/json",