tempest-react-sdk 0.67.0 → 0.68.0

package/dist/http/api-client.js

@@ -1,30 +1,31 @@
 import { randomId as e } from "../utils/ids.js";
 import { buildApiUrl as t } from "./build-url.js";
 import { isTrustedCredentialTarget as n, reportSuppressedCredential as r } from "./credential-scope.js";
-import { decodeByContentType as i } from "./decode-response.js";
-import { TempestApiError as a, buildApiError as o, isRetriableStatus as s } from "./errors.js";
-import { retry as c } from "./retry.js";
-import { withTimeout as l } from "./timeout.js";
+import { csrfHeaders as i } from "./csrf.js";
+import { decodeByContentType as a } from "./decode-response.js";
+import { TempestApiError as o, buildApiError as s, isRetriableStatus as c } from "./errors.js";
+import { retry as l } from "./retry.js";
+import { withTimeout as u } from "./timeout.js";
 //#region src/http/api-client.ts
-var u = /* @__PURE__ */ new Set([
+var d = /* @__PURE__ */ new Set([
 	"GET",
 	"HEAD",
 	"OPTIONS"
 ]);
-function d(e, t) {
-	return !u.has(t) || !(e instanceof a) ? !1 : s(e.status);
+function f(e, t) {
+	return !d.has(t) || !(e instanceof o) ? !1 : c(e.status);
 }
-function f(e) {
+function p(e) {
 	return e ? e === !0 ? {} : e : null;
 }
-var p = 15e3, m = 3e5;
-function h(e) {
+var m = 15e3, h = 3e5;
+function g(e) {
 	return typeof FormData < "u" && e instanceof FormData;
 }
-function g(e) {
+function _(e) {
 	return Math.round(performance.now() - e);
 }
-async function _(e, t) {
+async function v(e, t) {
 	let n;
 	try {
 		n = await e.clone().json();
@@ -35,72 +36,83 @@ async function _(e, t) {
 			n = null;
 		}
 	}
-	return new a(o(e.status, n, e.headers, t));
+	return new o(s(e.status, n, e.headers, t));
 }
-function v(o) {
-	let s = o.fetcher ?? globalThis.fetch.bind(globalThis);
-	function u(e, t) {
+function y(s) {
+	let c = s.fetcher ?? globalThis.fetch.bind(globalThis);
+	function d(e, t) {
 		if (t) return {};
-		let i = o.getToken?.();
-		return i ? n(e, o.baseURL, o.trustedOrigins) ? { Authorization: `Bearer ${i}` } : (r(e, o.baseURL), {}) : {};
+		let i = s.getToken?.();
+		return i ? n(e, s.baseURL, s.trustedOrigins) ? { Authorization: `Bearer ${i}` } : (r(e, s.baseURL), {}) : {};
 	}
-	async function v(e, n, r, i) {
-		let { body: c, params: d, headers: f, signal: g, timeout: _, ...v } = n, y = h(c), b = y ? o.uploadTimeout : o.timeout, x = _ === void 0 ? b === void 0 ? y ? m : p : b : _, S = t(o.baseURL, e, {
-			prefix: o.prefix,
-			params: d
-		}), C = {
-			...y ? {} : { "Content-Type": "application/json" },
+	async function y(e, n, r, a) {
+		let { body: l, params: f, headers: p, signal: _, timeout: v, ...y } = n, b = g(l), x = b ? s.uploadTimeout : s.timeout, S = v === void 0 ? x === void 0 ? b ? h : m : x : v, C = t(s.baseURL, e, {
+			prefix: s.prefix,
+			params: f
+		}), w = p, T = {
+			...b ? {} : { "Content-Type": "application/json" },
 			...r ? { "X-Request-ID": r } : {},
-			...o.headers,
-			...u(S, i),
-			...f
-		}, w = l(g, x), T = {
-			...v,
-			signal: w.signal,
-			headers: C,
-			credentials: o.withCredentials ? "include" : v.credentials,
-			body: c == null ? void 0 : y ? c : JSON.stringify(c)
+			...s.headers,
+			...d(C, a),
+			...i({
+				method: y.method ?? "GET",
+				url: C,
+				reference: s.baseURL,
+				csrf: s.csrf,
+				trustedOrigins: s.trustedOrigins,
+				headers: {
+					...s.headers,
+					...w
+				}
+			}),
+			...w
+		}, E = u(_, S), D = {
+			...y,
+			signal: E.signal,
+			headers: T,
+			credentials: s.withCredentials ? "include" : y.credentials,
+			body: l == null ? void 0 : b ? l : JSON.stringify(l)
 		};
 		try {
-			return await s(S, T);
+			return await c(C, D);
 		} catch (e) {
-			throw w.timedOut() ? new a({
+			throw E.timedOut() ? new o({
 				status: 0,
-				detail: `A requisição excedeu ${x}ms e foi abandonada.`
+				detail: `A requisição excedeu ${S}ms e foi abandonada.`
 			}) : e;
 		} finally {
-			w.dispose();
+			E.dispose();
 		}
 	}
-	async function y(e, t, n, r, i) {
-		let a = o.logger;
-		if (!a) return v(e, t, n, i);
-		let s = performance.now();
+	async function b(e, t, n, r, i) {
+		let a = s.logger;
+		if (!a) return y(e, t, n, i);
+		let o = performance.now();
 		try {
-			let o = await v(e, t, n, i), c = {
+			let s = await y(e, t, n, i), c = {
 				requestId: n,
-				status: o.status,
-				ms: g(s)
-			}, l = `${r} ${e} → ${o.status}`;
-			return o.status >= 400 ? a.warn(l, c) : a.debug(l, c), o;
+				status: s.status,
+				ms: _(o)
+			}, l = `${r} ${e} → ${s.status}`;
+			return s.status >= 400 ? a.warn(l, c) : a.debug(l, c), s;
 		} catch (t) {
 			throw a.warn(`${r} ${e} → no response`, {
 				requestId: n,
-				ms: g(s),
+				ms: _(o),
 				error: t
 			}), t;
 		}
 	}
-	async function b(e, t) {
-		if (o.onUnauthorized) {
-			o.logger?.warn("unauthorized — calling onUnauthorized", {
+	async function x(e, t) {
+		if (s.onUnauthorized) {
+			s.logger?.warn("unauthorized — calling onUnauthorized", {
 				requestId: t,
 				status: e.status
 			});
 			try {
-				await o.onUnauthorized(e);
+				await s.onUnauthorized(e);
 			} catch (n) {
-				o.logger?.warn("onUnauthorized threw — keeping the original response error", {
+				s.logger?.warn("onUnauthorized threw — keeping the original response error", {
 					requestId: t,
 					status: e.status,
 					error: n
@@ -108,68 +120,68 @@ function v(o) {
 			}
 		}
 	}
-	async function x(t, n, r) {
-		let { skipAuth: i = !1, skipAuthRetry: a = !1, ...s } = n, c = o.requestId ? o.requestId() : e(), l = (s.method ?? "GET").toUpperCase(), u = await y(t, s, c, l, i);
+	async function S(t, n, r) {
+		let { skipAuth: i = !1, skipAuthRetry: a = !1, ...o } = n, c = s.requestId ? s.requestId() : e(), l = (o.method ?? "GET").toUpperCase(), u = await b(t, o, c, l, i);
 		if (u.status === 401 && !i && !a) {
-			if (o.refresh) {
+			if (s.refresh) {
 				try {
-					await o.refresh(), u = await y(t, s, c, l, i);
+					await s.refresh(), u = await b(t, o, c, l, i);
 				} catch {
-					throw await b(u, c), await _(u, c);
+					throw await x(u, c), await v(u, c);
 				}
-				u.status === 401 && await b(u, c);
-			} else await b(u, c);
+				u.status === 401 && await x(u, c);
+			} else await x(u, c);
 		}
-		if (!u.ok) throw await _(u, c);
+		if (!u.ok) throw await v(u, c);
 		return r(u);
 	}
-	async function S(e, t, n) {
-		let { retry: r, ...i } = t, a = f(r === void 0 ? o.retry : r);
-		if (!a) return x(e, i, n);
-		let s = (i.method ?? "GET").toUpperCase();
-		return c(() => x(e, i, n), {
+	async function C(e, t, n) {
+		let { retry: r, ...i } = t, a = p(r === void 0 ? s.retry : r);
+		if (!a) return S(e, i, n);
+		let o = (i.method ?? "GET").toUpperCase();
+		return l(() => S(e, i, n), {
 			...a,
-			shouldRetry: a.shouldRetry ?? ((e) => d(e, s))
+			shouldRetry: a.shouldRetry ?? ((e) => f(e, o))
 		});
 	}
-	async function C(e, t = {}) {
-		return S(e, t, i);
+	async function w(e, t = {}) {
+		return C(e, t, a);
 	}
-	async function w(e, t, n = "POST", r) {
-		return C(e, {
+	async function T(e, t, n = "POST", r) {
+		return w(e, {
 			...r,
 			method: n,
 			body: t
 		});
 	}
 	return {
-		request: C,
-		get: (e, t) => C(e, {
+		request: w,
+		get: (e, t) => w(e, {
 			...t,
 			method: "GET"
 		}),
-		post: (e, t) => C(e, {
+		post: (e, t) => w(e, {
 			...t,
 			method: "POST"
 		}),
-		put: (e, t) => C(e, {
+		put: (e, t) => w(e, {
 			...t,
 			method: "PUT"
 		}),
-		patch: (e, t) => C(e, {
+		patch: (e, t) => w(e, {
 			...t,
 			method: "PATCH"
 		}),
-		delete: (e, t) => C(e, {
+		delete: (e, t) => w(e, {
 			...t,
 			method: "DELETE"
 		}),
-		blob: (e, t) => S(e, { ...t }, (e) => e.blob()),
-		arrayBuffer: (e, t) => S(e, { ...t }, (e) => e.arrayBuffer()),
-		upload: w
+		blob: (e, t) => C(e, { ...t }, (e) => e.blob()),
+		arrayBuffer: (e, t) => C(e, { ...t }, (e) => e.arrayBuffer()),
+		upload: T
 	};
 }
 //#endregion
-export { v as createApiClient };
+export { y as createApiClient };
 
 //# sourceMappingURL=api-client.js.map

package/dist/http/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","names":[],"sources":["../../src/http/api-client.ts"],"sourcesContent":["/**\n * @tempest-limits function-lines — createApiClient is over the limit and every line\n * is a request-lifecycle concern the client cannot delegate: base URL joining, the\n * auth header, the 401 refresh-and-replay, the opt-in retry wrapper and the response\n * parsing that turns a failure into a typed error.\n */\nimport { randomId } from \"../utils\";\nimport { buildApiUrl } from \"./build-url\";\nimport { isTrustedCredentialTarget, reportSuppressedCredential } from \"./credential-scope\";\nimport { decodeByContentType } from \"./decode-response\";\nimport type { ResponseDecoder } from \"./decode-response\";\nimport { buildApiError, TempestApiError, isRetriableStatus } from \"./errors\";\nimport { retry as retryWithBackoff } from \"./retry\";\nimport type { RetryOptions } from \"./retry\";\nimport { withTimeout } from \"./timeout\";\nimport type { ApiClient, ApiClientConfig, RequestOptions } from \"./types\";\n\n/**\n * Methods the built-in retry policy will replay.\n *\n * `PUT` and `DELETE` are idempotent on paper but stay out: a backend that logs,\n * bills, or fires a webhook per call still sees two, so replaying them is a\n * decision the caller makes through `shouldRetry`, not a default.\n */\nconst IDEMPOTENT_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n\n/**\n * Sub-500 statuses worth a second attempt: a network failure (status `0`), a\n * request timeout, a too-early replay, and a rate limit — which usually carries\n * the `Retry-After` the backoff already honours.\n */\n\n/**\n * The built-in retry policy, used when `retry` is `true` or is options carrying\n * no `shouldRetry` of their own.\n *\n * Conservative on purpose. Replaying a write can duplicate it, and replaying a\n * `400` or a `403` cannot fix a bad payload or a permission the caller does not\n * have — it only spends the user's time before showing the same error.\n *\n * @param error - Whatever the attempt threw.\n * @param method - The upper-cased HTTP method of the request.\n * @returns Whether the client should try again.\n */\nfunction isRetriableFailure(error: unknown, method: string): boolean {\n    if (!IDEMPOTENT_METHODS.has(method)) return false;\n    if (!(error instanceof TempestApiError)) return false;\n    return isRetriableStatus(error.status);\n}\n\n/**\n * Normalize the `retry` config into options, or `null` when retrying is off.\n *\n * @param config - The `retry` field as the caller wrote it.\n * @returns Retry options to use, or `null` to run a single attempt.\n */\nfunction resolveRetry(config: boolean | RetryOptions | undefined): RetryOptions | null {\n    if (!config) return null;\n    return config === true ? {} : config;\n}\n\n/** Default milliseconds before a request is abandoned. */\nconst DEFAULT_TIMEOUT = 15_000;\n\n/** Default milliseconds before a `FormData` request is abandoned. */\nconst DEFAULT_UPLOAD_TIMEOUT = 300_000;\n\nfunction isFormData(body: unknown): body is FormData {\n    return typeof FormData !== \"undefined\" && body instanceof FormData;\n}\n\n/**\n * Milliseconds since a `performance.now()` reading, rounded.\n *\n * `performance.now()` rather than `Date.now()` because this measures a\n * duration: the wall clock can step sideways mid-request (an NTP correction, a\n * VM resuming, the user changing the clock) and turn a 40 ms call into a\n * negative number. The monotonic clock cannot.\n *\n * @param startedAt - The reading taken before the work started.\n * @returns Whole milliseconds elapsed.\n */\nfunction elapsedMs(startedAt: number): number {\n    return Math.round(performance.now() - startedAt);\n}\n\nasync function parseError(response: Response, sentRequestId?: string): Promise<TempestApiError> {\n    let body: unknown;\n    try {\n        body = await response.clone().json();\n    } catch {\n        try {\n            body = await response.text();\n        } catch {\n            body = null;\n        }\n    }\n    return new TempestApiError(\n        buildApiError(response.status, body, response.headers, sentRequestId),\n    );\n}\n\n/**\n * Create a typed HTTP client backed by `fetch`.\n *\n * Handles JSON serialization, query params, bearer auth via `getToken`, uploads\n * via `FormData`, and throws a typed `ApiError` on any non-2xx response.\n *\n * **Expired sessions.** A `401` with `refresh` configured awaits the refresh and\n * replays the request once. `onUnauthorized` fires whenever that path ends\n * unauthorized anyway — the refresh threw, or the replay came back `401` — which\n * is the signal to clear the session. Without `refresh`, the first `401` calls\n * it directly.\n *\n * **Binary bodies** have their own methods — `blob()` and `arrayBuffer()` — which\n * run the same pipeline and skip the parse. `request()` no longer decodes an\n * unknown `Content-Type` as text either: it returns a `Blob` and says so once in\n * a development build, because reading `image/jpeg` as UTF-8 destroyed the bytes\n * on the way in.\n *\n * **The bearer token is scoped to `baseURL`'s origin** since 0.66.0. A path may\n * be an absolute URL, which overrides the base entirely, so without a scope the\n * destination of a credentialed request could come from a value read off the\n * network. A request to another origin still goes out; it goes without the\n * header, and a development build says so once. Declare the exceptions in\n * {@link ApiClientConfig.trustedOrigins}.\n *\n * **Retries** are off unless you set `retry`. See {@link ApiClientConfig.retry}\n * for the built-in policy; it never replays a write. A single call overrides it\n * with {@link RequestOptions.retry}, and opts out of auth entirely with\n * {@link RequestOptions.skipAuth}.\n *\n * **Logging** is off unless you pass a `logger`. With one, every finished attempt\n * writes a line — `debug` under 400, `warn` from 400 up, plus a `warn` when\n * `onUnauthorized` fires — carrying `requestId`, `status` and elapsed `ms`, and\n * never a body, header or query string. The level and the destination belong to\n * the logger, not to a boolean here.\n *\n * @example\n * const api = createApiClient({\n *     baseURL: import.meta.env.VITE_API_URL,\n *     getToken: () => useAuthStore.getState().token,\n *     refresh,\n *     onUnauthorized: () => useAuthStore.getState().logout(),\n *     logger: createLogger({ level: import.meta.env.DEV ? \"debug\" : \"warn\" }).child(\"http\"),\n *     retry: true,\n * });\n *\n * @param config - Base URL plus the optional auth, retry and fetch hooks.\n * @returns A client with `request`/`get`/`post`/`put`/`patch`/`delete`/`blob`/\n * `arrayBuffer`/`upload`.\n */\nexport function createApiClient(config: ApiClientConfig): ApiClient {\n    const fetcher = config.fetcher ?? globalThis.fetch.bind(globalThis);\n\n    /**\n     * The `Authorization` header for a request, or nothing.\n     *\n     * Takes the resolved URL rather than reading `config.baseURL`, because an\n     * absolute path overrides the base entirely (see `buildApiUrl`) and the\n     * credential is scoped to an origin, not to a client.\n     *\n     * @param url - The absolute URL the request is going to.\n     * @param skipAuth - Whether the caller opted this request out of auth.\n     * @returns The header, or an empty object.\n     */\n    function authHeaders(url: string, skipAuth: boolean): Record<string, string> {\n        if (skipAuth) return {};\n        const token = config.getToken?.();\n        if (!token) return {};\n        if (!isTrustedCredentialTarget(url, config.baseURL, config.trustedOrigins)) {\n            reportSuppressedCredential(url, config.baseURL);\n            return {};\n        }\n        return { Authorization: `Bearer ${token}` };\n    }\n\n    async function rawRequest(\n        path: string,\n        options: RequestOptions,\n        requestId: string | undefined,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const { body, params, headers, signal, timeout, ...rest } = options;\n        const isForm = isFormData(body);\n        const configured = isForm ? config.uploadTimeout : config.timeout;\n        const fallback = isForm ? DEFAULT_UPLOAD_TIMEOUT : DEFAULT_TIMEOUT;\n        const limit =\n            timeout !== undefined ? timeout : configured !== undefined ? configured : fallback;\n\n        const url = buildApiUrl(config.baseURL, path, { prefix: config.prefix, params });\n\n        const finalHeaders: Record<string, string> = {\n            ...(isForm ? {} : { \"Content-Type\": \"application/json\" }),\n            ...(requestId ? { \"X-Request-ID\": requestId } : {}),\n            ...config.headers,\n            ...authHeaders(url, skipAuth),\n            ...(headers as Record<string, string> | undefined),\n        };\n\n        const timed = withTimeout(signal, limit);\n        const init: RequestInit = {\n            ...rest,\n            signal: timed.signal,\n            headers: finalHeaders,\n            credentials: config.withCredentials ? \"include\" : rest.credentials,\n            body:\n                body === undefined || body === null\n                    ? undefined\n                    : isForm\n                      ? (body as FormData)\n                      : JSON.stringify(body),\n        };\n\n        try {\n            return await fetcher(url, init);\n        } catch (cause) {\n            if (timed.timedOut()) {\n                throw new TempestApiError({\n                    status: 0,\n                    detail: `A requisição excedeu ${limit}ms e foi abandonada.`,\n                });\n            }\n            throw cause;\n        } finally {\n            timed.dispose();\n        }\n    }\n\n    async function send(\n        path: string,\n        options: RequestOptions,\n        requestId: string,\n        method: string,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const log = config.logger;\n        if (!log) return rawRequest(path, options, requestId, skipAuth);\n\n        const startedAt = performance.now();\n        try {\n            const response = await rawRequest(path, options, requestId, skipAuth);\n            const entry = { requestId, status: response.status, ms: elapsedMs(startedAt) };\n            const line = `${method} ${path} → ${response.status}`;\n            if (response.status >= 400) log.warn(line, entry);\n            else log.debug(line, entry);\n            return response;\n        } catch (error) {\n            log.warn(`${method} ${path} → no response`, {\n                requestId,\n                ms: elapsedMs(startedAt),\n                error,\n            });\n            throw error;\n        }\n    }\n\n    async function notifyUnauthorized(response: Response, requestId: string): Promise<void> {\n        if (!config.onUnauthorized) return;\n        config.logger?.warn(`unauthorized — calling onUnauthorized`, {\n            requestId,\n            status: response.status,\n        });\n        try {\n            await config.onUnauthorized(response);\n        } catch (error) {\n            config.logger?.warn(`onUnauthorized threw — keeping the original response error`, {\n                requestId,\n                status: response.status,\n                error,\n            });\n        }\n    }\n\n    async function attempt<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { skipAuth = false, skipAuthRetry = false, ...init } = options;\n        const requestId = config.requestId ? config.requestId() : randomId();\n        const method = (init.method ?? \"GET\").toUpperCase();\n        let response = await send(path, init, requestId, method, skipAuth);\n\n        if (response.status === 401 && !skipAuth && !skipAuthRetry) {\n            if (config.refresh) {\n                try {\n                    await config.refresh();\n                    response = await send(path, init, requestId, method, skipAuth);\n                } catch {\n                    await notifyUnauthorized(response, requestId);\n                    throw await parseError(response, requestId);\n                }\n                if (response.status === 401) {\n                    await notifyUnauthorized(response, requestId);\n                }\n            } else {\n                await notifyUnauthorized(response, requestId);\n            }\n        }\n\n        if (!response.ok) {\n            throw await parseError(response, requestId);\n        }\n\n        return decode(response);\n    }\n\n    async function run<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { retry: perRequest, ...rest } = options;\n        const retryOptions = resolveRetry(perRequest !== undefined ? perRequest : config.retry);\n        if (!retryOptions) return attempt<T>(path, rest, decode);\n\n        const method = (rest.method ?? \"GET\").toUpperCase();\n        return retryWithBackoff(() => attempt<T>(path, rest, decode), {\n            ...retryOptions,\n            shouldRetry:\n                retryOptions.shouldRetry ?? ((error: unknown) => isRetriableFailure(error, method)),\n        });\n    }\n\n    async function request<T>(path: string, options: RequestOptions = {}): Promise<T> {\n        return run<T>(path, options, decodeByContentType);\n    }\n\n    async function upload<T>(\n        path: string,\n        formData: FormData,\n        method: \"POST\" | \"PUT\" | \"PATCH\" = \"POST\",\n        options?: Omit<RequestOptions, \"body\" | \"method\">,\n    ): Promise<T> {\n        return request<T>(path, { ...options, method, body: formData });\n    }\n\n    return {\n        request,\n        get: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"GET\" }),\n        post: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"POST\" }),\n        put: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PUT\" }),\n        patch: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PATCH\" }),\n        delete: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"DELETE\" }),\n        blob: (path: string, options?: RequestOptions) =>\n            run<Blob>(path, { ...options }, (response) => response.blob()),\n        arrayBuffer: (path: string, options?: RequestOptions) =>\n            run<ArrayBuffer>(path, { ...options }, (response) => response.arrayBuffer()),\n        upload,\n    };\n}\n"],"mappings":";;;;;;;;AAwBA,IAAM,oBAA0C,IAAI,IAAI;CAAC;CAAO;CAAQ;AAAS,CAAC;AAoBlF,SAAS,EAAmB,GAAgB,GAAyB;CAGjE,OAFI,CAAC,EAAmB,IAAI,CAAM,KAC9B,EAAE,aAAiB,KAAyB,KACzC,EAAkB,EAAM,MAAM;AACzC;AAQA,SAAS,EAAa,GAAiE;CAEnF,OADK,IACE,MAAW,KAAO,CAAC,IAAI,IADV;AAExB;AAGA,IAAM,IAAkB,MAGlB,IAAyB;AAE/B,SAAS,EAAW,GAAiC;CACjD,OAAO,OAAO,WAAa,OAAe,aAAgB;AAC9D;AAaA,SAAS,EAAU,GAA2B;CAC1C,OAAO,KAAK,MAAM,YAAY,IAAI,IAAI,CAAS;AACnD;AAEA,eAAe,EAAW,GAAoB,GAAkD;CAC5F,IAAI;CACJ,IAAI;EACA,IAAO,MAAM,EAAS,MAAM,CAAC,CAAC,KAAK;CACvC,QAAQ;EACJ,IAAI;GACA,IAAO,MAAM,EAAS,KAAK;EAC/B,QAAQ;GACJ,IAAO;EACX;CACJ;CACA,OAAO,IAAI,EACP,EAAc,EAAS,QAAQ,GAAM,EAAS,SAAS,CAAa,CACxE;AACJ;AAoDA,SAAgB,EAAgB,GAAoC;CAChE,IAAM,IAAU,EAAO,WAAW,WAAW,MAAM,KAAK,UAAU;CAalE,SAAS,EAAY,GAAa,GAA2C;EACzE,IAAI,GAAU,OAAO,CAAC;EACtB,IAAM,IAAQ,EAAO,WAAW;EAMhC,OALK,IACA,EAA0B,GAAK,EAAO,SAAS,EAAO,cAAc,IAIlE,EAAE,eAAe,UAAU,IAAQ,KAHtC,EAA2B,GAAK,EAAO,OAAO,GACvC,CAAC,KAHO,CAAC;CAMxB;CAEA,eAAe,EACX,GACA,GACA,GACA,GACiB;EACjB,IAAM,EAAE,SAAM,WAAQ,YAAS,WAAQ,YAAS,GAAG,MAAS,GACtD,IAAS,EAAW,CAAI,GACxB,IAAa,IAAS,EAAO,gBAAgB,EAAO,SAEpD,IACF,MAAY,KAAA,IAAsB,MAAe,KAAA,IAFpC,IAAS,IAAyB,IAEc,IAArC,GAEtB,IAAM,EAAY,EAAO,SAAS,GAAM;GAAE,QAAQ,EAAO;GAAQ;EAAO,CAAC,GAEzE,IAAuC;GACzC,GAAI,IAAS,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;GACvD,GAAI,IAAY,EAAE,gBAAgB,EAAU,IAAI,CAAC;GACjD,GAAG,EAAO;GACV,GAAG,EAAY,GAAK,CAAQ;GAC5B,GAAI;EACR,GAEM,IAAQ,EAAY,GAAQ,CAAK,GACjC,IAAoB;GACtB,GAAG;GACH,QAAQ,EAAM;GACd,SAAS;GACT,aAAa,EAAO,kBAAkB,YAAY,EAAK;GACvD,MACI,KAA+B,OACzB,KAAA,IACA,IACG,IACD,KAAK,UAAU,CAAI;EACnC;EAEA,IAAI;GACA,OAAO,MAAM,EAAQ,GAAK,CAAI;EAClC,SAAS,GAAO;GAOZ,MANI,EAAM,SAAS,IACT,IAAI,EAAgB;IACtB,QAAQ;IACR,QAAQ,wBAAwB,EAAM;GAC1C,CAAC,IAEC;EACV,UAAU;GACN,EAAM,QAAQ;EAClB;CACJ;CAEA,eAAe,EACX,GACA,GACA,GACA,GACA,GACiB;EACjB,IAAM,IAAM,EAAO;EACnB,IAAI,CAAC,GAAK,OAAO,EAAW,GAAM,GAAS,GAAW,CAAQ;EAE9D,IAAM,IAAY,YAAY,IAAI;EAClC,IAAI;GACA,IAAM,IAAW,MAAM,EAAW,GAAM,GAAS,GAAW,CAAQ,GAC9D,IAAQ;IAAE;IAAW,QAAQ,EAAS;IAAQ,IAAI,EAAU,CAAS;GAAE,GACvE,IAAO,GAAG,EAAO,GAAG,EAAK,KAAK,EAAS;GAG7C,OAFI,EAAS,UAAU,MAAK,EAAI,KAAK,GAAM,CAAK,IAC3C,EAAI,MAAM,GAAM,CAAK,GACnB;EACX,SAAS,GAAO;GAMZ,MALA,EAAI,KAAK,GAAG,EAAO,GAAG,EAAK,iBAAiB;IACxC;IACA,IAAI,EAAU,CAAS;IACvB;GACJ,CAAC,GACK;EACV;CACJ;CAEA,eAAe,EAAmB,GAAoB,GAAkC;EAC/E,MAAO,gBACZ;KAAO,QAAQ,KAAK,yCAAyC;IACzD;IACA,QAAQ,EAAS;GACrB,CAAC;GACD,IAAI;IACA,MAAM,EAAO,eAAe,CAAQ;GACxC,SAAS,GAAO;IACZ,EAAO,QAAQ,KAAK,8DAA8D;KAC9E;KACA,QAAQ,EAAS;KACjB;IACJ,CAAC;GACL;EATC;CAUL;CAEA,eAAe,EACX,GACA,GACA,GACU;EACV,IAAM,EAAE,cAAW,IAAO,mBAAgB,IAAO,GAAG,MAAS,GACvD,IAAY,EAAO,YAAY,EAAO,UAAU,IAAI,EAAS,GAC7D,KAAU,EAAK,UAAU,MAAA,CAAO,YAAY,GAC9C,IAAW,MAAM,EAAK,GAAM,GAAM,GAAW,GAAQ,CAAQ;EAEjE,IAAI,EAAS,WAAW,OAAO,CAAC,KAAY,CAAC,GAAe;GACxD,IAAI,EAAO,SAAS;IAChB,IAAI;KAEA,AADA,MAAM,EAAO,QAAQ,GACrB,IAAW,MAAM,EAAK,GAAM,GAAM,GAAW,GAAQ,CAAQ;IACjE,QAAQ;KAEJ,MADA,MAAM,EAAmB,GAAU,CAAS,GACtC,MAAM,EAAW,GAAU,CAAS;IAC9C;IACA,AAAI,EAAS,WAAW,OACpB,MAAM,EAAmB,GAAU,CAAS;GAEpD,OACI,MAAM,EAAmB,GAAU,CAAS;EAEpD;EAEA,IAAI,CAAC,EAAS,IACV,MAAM,MAAM,EAAW,GAAU,CAAS;EAG9C,OAAO,EAAO,CAAQ;CAC1B;CAEA,eAAe,EACX,GACA,GACA,GACU;EACV,IAAM,EAAE,OAAO,GAAY,GAAG,MAAS,GACjC,IAAe,EAAa,MAAe,KAAA,IAAyB,EAAO,QAApB,CAAyB;EACtF,IAAI,CAAC,GAAc,OAAO,EAAW,GAAM,GAAM,CAAM;EAEvD,IAAM,KAAU,EAAK,UAAU,MAAA,CAAO,YAAY;EAClD,OAAO,QAAuB,EAAW,GAAM,GAAM,CAAM,GAAG;GAC1D,GAAG;GACH,aACI,EAAa,iBAAiB,MAAmB,EAAmB,GAAO,CAAM;EACzF,CAAC;CACL;CAEA,eAAe,EAAW,GAAc,IAA0B,CAAC,GAAe;EAC9E,OAAO,EAAO,GAAM,GAAS,CAAmB;CACpD;CAEA,eAAe,EACX,GACA,GACA,IAAmC,QACnC,GACU;EACV,OAAO,EAAW,GAAM;GAAE,GAAG;GAAS;GAAQ,MAAM;EAAS,CAAC;CAClE;CAEA,OAAO;EACH;EACA,MAAS,GAAc,MACnB,EAAW,GAAM;GAAE,GAAG;GAAS,QAAQ;EAAM,CAAC;EAClD,OAAU,GAAc,MACpB,EAAW,GAAM;GAAE,GAAG;GAAS,QAAQ;EAAO,CAAC;EACnD,MAAS,GAAc,MACnB,EAAW,GAAM;GAAE,GAAG;GAAS,QAAQ;EAAM,CAAC;EAClD,QAAW,GAAc,MACrB,EAAW,GAAM;GAAE,GAAG;GAAS,QAAQ;EAAQ,CAAC;EACpD,SAAY,GAAc,MACtB,EAAW,GAAM;GAAE,GAAG;GAAS,QAAQ;EAAS,CAAC;EACrD,OAAO,GAAc,MACjB,EAAU,GAAM,EAAE,GAAG,EAAQ,IAAI,MAAa,EAAS,KAAK,CAAC;EACjE,cAAc,GAAc,MACxB,EAAiB,GAAM,EAAE,GAAG,EAAQ,IAAI,MAAa,EAAS,YAAY,CAAC;EAC/E;CACJ;AACJ"}
+{"version":3,"file":"api-client.js","names":[],"sources":["../../src/http/api-client.ts"],"sourcesContent":["/**\n * @tempest-limits function-lines — createApiClient is over the limit and every line\n * is a request-lifecycle concern the client cannot delegate: base URL joining, the\n * auth header, the 401 refresh-and-replay, the opt-in retry wrapper and the response\n * parsing that turns a failure into a typed error.\n */\nimport { randomId } from \"../utils\";\nimport { buildApiUrl } from \"./build-url\";\nimport { isTrustedCredentialTarget, reportSuppressedCredential } from \"./credential-scope\";\nimport { csrfHeaders } from \"./csrf\";\nimport { decodeByContentType } from \"./decode-response\";\nimport type { ResponseDecoder } from \"./decode-response\";\nimport { buildApiError, TempestApiError, isRetriableStatus } from \"./errors\";\nimport { retry as retryWithBackoff } from \"./retry\";\nimport type { RetryOptions } from \"./retry\";\nimport { withTimeout } from \"./timeout\";\nimport type { ApiClient, ApiClientConfig, RequestOptions } from \"./types\";\n\n/**\n * Methods the built-in retry policy will replay.\n *\n * `PUT` and `DELETE` are idempotent on paper but stay out: a backend that logs,\n * bills, or fires a webhook per call still sees two, so replaying them is a\n * decision the caller makes through `shouldRetry`, not a default.\n */\nconst IDEMPOTENT_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n\n/**\n * Sub-500 statuses worth a second attempt: a network failure (status `0`), a\n * request timeout, a too-early replay, and a rate limit — which usually carries\n * the `Retry-After` the backoff already honours.\n */\n\n/**\n * The built-in retry policy, used when `retry` is `true` or is options carrying\n * no `shouldRetry` of their own.\n *\n * Conservative on purpose. Replaying a write can duplicate it, and replaying a\n * `400` or a `403` cannot fix a bad payload or a permission the caller does not\n * have — it only spends the user's time before showing the same error.\n *\n * @param error - Whatever the attempt threw.\n * @param method - The upper-cased HTTP method of the request.\n * @returns Whether the client should try again.\n */\nfunction isRetriableFailure(error: unknown, method: string): boolean {\n    if (!IDEMPOTENT_METHODS.has(method)) return false;\n    if (!(error instanceof TempestApiError)) return false;\n    return isRetriableStatus(error.status);\n}\n\n/**\n * Normalize the `retry` config into options, or `null` when retrying is off.\n *\n * @param config - The `retry` field as the caller wrote it.\n * @returns Retry options to use, or `null` to run a single attempt.\n */\nfunction resolveRetry(config: boolean | RetryOptions | undefined): RetryOptions | null {\n    if (!config) return null;\n    return config === true ? {} : config;\n}\n\n/** Default milliseconds before a request is abandoned. */\nconst DEFAULT_TIMEOUT = 15_000;\n\n/** Default milliseconds before a `FormData` request is abandoned. */\nconst DEFAULT_UPLOAD_TIMEOUT = 300_000;\n\nfunction isFormData(body: unknown): body is FormData {\n    return typeof FormData !== \"undefined\" && body instanceof FormData;\n}\n\n/**\n * Milliseconds since a `performance.now()` reading, rounded.\n *\n * `performance.now()` rather than `Date.now()` because this measures a\n * duration: the wall clock can step sideways mid-request (an NTP correction, a\n * VM resuming, the user changing the clock) and turn a 40 ms call into a\n * negative number. The monotonic clock cannot.\n *\n * @param startedAt - The reading taken before the work started.\n * @returns Whole milliseconds elapsed.\n */\nfunction elapsedMs(startedAt: number): number {\n    return Math.round(performance.now() - startedAt);\n}\n\nasync function parseError(response: Response, sentRequestId?: string): Promise<TempestApiError> {\n    let body: unknown;\n    try {\n        body = await response.clone().json();\n    } catch {\n        try {\n            body = await response.text();\n        } catch {\n            body = null;\n        }\n    }\n    return new TempestApiError(\n        buildApiError(response.status, body, response.headers, sentRequestId),\n    );\n}\n\n/**\n * Create a typed HTTP client backed by `fetch`.\n *\n * Handles JSON serialization, query params, bearer auth via `getToken`, uploads\n * via `FormData`, and throws a typed `ApiError` on any non-2xx response.\n *\n * **Expired sessions.** A `401` with `refresh` configured awaits the refresh and\n * replays the request once. `onUnauthorized` fires whenever that path ends\n * unauthorized anyway — the refresh threw, or the replay came back `401` — which\n * is the signal to clear the session. Without `refresh`, the first `401` calls\n * it directly.\n *\n * **Binary bodies** have their own methods — `blob()` and `arrayBuffer()` — which\n * run the same pipeline and skip the parse. `request()` no longer decodes an\n * unknown `Content-Type` as text either: it returns a `Blob` and says so once in\n * a development build, because reading `image/jpeg` as UTF-8 destroyed the bytes\n * on the way in.\n *\n * **The bearer token is scoped to `baseURL`'s origin** since 0.66.0. A path may\n * be an absolute URL, which overrides the base entirely, so without a scope the\n * destination of a credentialed request could come from a value read off the\n * network. A request to another origin still goes out; it goes without the\n * header, and a development build says so once. Declare the exceptions in\n * {@link ApiClientConfig.trustedOrigins}.\n *\n * **CSRF** is off unless you set `csrf`. With it, every unsafe request (anything\n * but `GET`/`HEAD`/`OPTIONS`/`TRACE`) echoes the `csrf_token` cookie in an\n * `X-CSRF-Token` header — the double-submit contract of `tempest-fastapi-sdk`'s\n * `CSRFMiddleware` — scoped to the same origins as the bearer token and sent on\n * `skipAuth` requests too. See {@link ApiClientConfig.csrf}.\n *\n * **Retries** are off unless you set `retry`. See {@link ApiClientConfig.retry}\n * for the built-in policy; it never replays a write. A single call overrides it\n * with {@link RequestOptions.retry}, and opts out of auth entirely with\n * {@link RequestOptions.skipAuth}.\n *\n * **Logging** is off unless you pass a `logger`. With one, every finished attempt\n * writes a line — `debug` under 400, `warn` from 400 up, plus a `warn` when\n * `onUnauthorized` fires — carrying `requestId`, `status` and elapsed `ms`, and\n * never a body, header or query string. The level and the destination belong to\n * the logger, not to a boolean here.\n *\n * @example\n * const api = createApiClient({\n *     baseURL: import.meta.env.VITE_API_URL,\n *     getToken: () => useAuthStore.getState().token,\n *     refresh,\n *     onUnauthorized: () => useAuthStore.getState().logout(),\n *     logger: createLogger({ level: import.meta.env.DEV ? \"debug\" : \"warn\" }).child(\"http\"),\n *     retry: true,\n * });\n *\n * @param config - Base URL plus the optional auth, retry and fetch hooks.\n * @returns A client with `request`/`get`/`post`/`put`/`patch`/`delete`/`blob`/\n * `arrayBuffer`/`upload`.\n */\nexport function createApiClient(config: ApiClientConfig): ApiClient {\n    const fetcher = config.fetcher ?? globalThis.fetch.bind(globalThis);\n\n    /**\n     * The `Authorization` header for a request, or nothing.\n     *\n     * Takes the resolved URL rather than reading `config.baseURL`, because an\n     * absolute path overrides the base entirely (see `buildApiUrl`) and the\n     * credential is scoped to an origin, not to a client.\n     *\n     * @param url - The absolute URL the request is going to.\n     * @param skipAuth - Whether the caller opted this request out of auth.\n     * @returns The header, or an empty object.\n     */\n    function authHeaders(url: string, skipAuth: boolean): Record<string, string> {\n        if (skipAuth) return {};\n        const token = config.getToken?.();\n        if (!token) return {};\n        if (!isTrustedCredentialTarget(url, config.baseURL, config.trustedOrigins)) {\n            reportSuppressedCredential(url, config.baseURL);\n            return {};\n        }\n        return { Authorization: `Bearer ${token}` };\n    }\n\n    async function rawRequest(\n        path: string,\n        options: RequestOptions,\n        requestId: string | undefined,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const { body, params, headers, signal, timeout, ...rest } = options;\n        const isForm = isFormData(body);\n        const configured = isForm ? config.uploadTimeout : config.timeout;\n        const fallback = isForm ? DEFAULT_UPLOAD_TIMEOUT : DEFAULT_TIMEOUT;\n        const limit =\n            timeout !== undefined ? timeout : configured !== undefined ? configured : fallback;\n\n        const url = buildApiUrl(config.baseURL, path, { prefix: config.prefix, params });\n\n        const callerHeaders = headers as Record<string, string> | undefined;\n        const finalHeaders: Record<string, string> = {\n            ...(isForm ? {} : { \"Content-Type\": \"application/json\" }),\n            ...(requestId ? { \"X-Request-ID\": requestId } : {}),\n            ...config.headers,\n            ...authHeaders(url, skipAuth),\n            ...csrfHeaders({\n                method: rest.method ?? \"GET\",\n                url,\n                reference: config.baseURL,\n                csrf: config.csrf,\n                trustedOrigins: config.trustedOrigins,\n                headers: { ...config.headers, ...callerHeaders },\n            }),\n            ...callerHeaders,\n        };\n\n        const timed = withTimeout(signal, limit);\n        const init: RequestInit = {\n            ...rest,\n            signal: timed.signal,\n            headers: finalHeaders,\n            credentials: config.withCredentials ? \"include\" : rest.credentials,\n            body:\n                body === undefined || body === null\n                    ? undefined\n                    : isForm\n                      ? (body as FormData)\n                      : JSON.stringify(body),\n        };\n\n        try {\n            return await fetcher(url, init);\n        } catch (cause) {\n            if (timed.timedOut()) {\n                throw new TempestApiError({\n                    status: 0,\n                    detail: `A requisição excedeu ${limit}ms e foi abandonada.`,\n                });\n            }\n            throw cause;\n        } finally {\n            timed.dispose();\n        }\n    }\n\n    async function send(\n        path: string,\n        options: RequestOptions,\n        requestId: string,\n        method: string,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const log = config.logger;\n        if (!log) return rawRequest(path, options, requestId, skipAuth);\n\n        const startedAt = performance.now();\n        try {\n            const response = await rawRequest(path, options, requestId, skipAuth);\n            const entry = { requestId, status: response.status, ms: elapsedMs(startedAt) };\n            const line = `${method} ${path} → ${response.status}`;\n            if (response.status >= 400) log.warn(line, entry);\n            else log.debug(line, entry);\n            return response;\n        } catch (error) {\n            log.warn(`${method} ${path} → no response`, {\n                requestId,\n                ms: elapsedMs(startedAt),\n                error,\n            });\n            throw error;\n        }\n    }\n\n    async function notifyUnauthorized(response: Response, requestId: string): Promise<void> {\n        if (!config.onUnauthorized) return;\n        config.logger?.warn(`unauthorized — calling onUnauthorized`, {\n            requestId,\n            status: response.status,\n        });\n        try {\n            await config.onUnauthorized(response);\n        } catch (error) {\n            config.logger?.warn(`onUnauthorized threw — keeping the original response error`, {\n                requestId,\n                status: response.status,\n                error,\n            });\n        }\n    }\n\n    async function attempt<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { skipAuth = false, skipAuthRetry = false, ...init } = options;\n        const requestId = config.requestId ? config.requestId() : randomId();\n        const method = (init.method ?? \"GET\").toUpperCase();\n        let response = await send(path, init, requestId, method, skipAuth);\n\n        if (response.status === 401 && !skipAuth && !skipAuthRetry) {\n            if (config.refresh) {\n                try {\n                    await config.refresh();\n                    response = await send(path, init, requestId, method, skipAuth);\n                } catch {\n                    await notifyUnauthorized(response, requestId);\n                    throw await parseError(response, requestId);\n                }\n                if (response.status === 401) {\n                    await notifyUnauthorized(response, requestId);\n                }\n            } else {\n                await notifyUnauthorized(response, requestId);\n            }\n        }\n\n        if (!response.ok) {\n            throw await parseError(response, requestId);\n        }\n\n        return decode(response);\n    }\n\n    async function run<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { retry: perRequest, ...rest } = options;\n        const retryOptions = resolveRetry(perRequest !== undefined ? perRequest : config.retry);\n        if (!retryOptions) return attempt<T>(path, rest, decode);\n\n        const method = (rest.method ?? \"GET\").toUpperCase();\n        return retryWithBackoff(() => attempt<T>(path, rest, decode), {\n            ...retryOptions,\n            shouldRetry:\n                retryOptions.shouldRetry ?? ((error: unknown) => isRetriableFailure(error, method)),\n        });\n    }\n\n    async function request<T>(path: string, options: RequestOptions = {}): Promise<T> {\n        return run<T>(path, options, decodeByContentType);\n    }\n\n    async function upload<T>(\n        path: string,\n        formData: FormData,\n        method: \"POST\" | \"PUT\" | \"PATCH\" = \"POST\",\n        options?: Omit<RequestOptions, \"body\" | \"method\">,\n    ): Promise<T> {\n        return request<T>(path, { ...options, method, body: formData });\n    }\n\n    return {\n        request,\n        get: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"GET\" }),\n        post: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"POST\" }),\n        put: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PUT\" }),\n        patch: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PATCH\" }),\n        delete: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"DELETE\" }),\n        blob: (path: string, options?: RequestOptions) =>\n            run<Blob>(path, { ...options }, (response) => response.blob()),\n        arrayBuffer: (path: string, options?: RequestOptions) =>\n            run<ArrayBuffer>(path, { ...options }, (response) => response.arrayBuffer()),\n        upload,\n    };\n}\n"],"mappings":";;;;;;;;;AAyBA,IAAM,oBAA0C,IAAI,IAAI;CAAC;CAAO;CAAQ;AAAS,CAAC;AAoBlF,SAAS,EAAmB,GAAgB,GAAyB;CAGjE,OAFI,CAAC,EAAmB,IAAI,CAAM,KAC9B,EAAE,aAAiB,KAAyB,KACzC,EAAkB,EAAM,MAAM;AACzC;AAQA,SAAS,EAAa,GAAiE;CAEnF,OADK,IACE,MAAW,KAAO,CAAC,IAAI,IADV;AAExB;AAGA,IAAM,IAAkB,MAGlB,IAAyB;AAE/B,SAAS,EAAW,GAAiC;CACjD,OAAO,OAAO,WAAa,OAAe,aAAgB;AAC9D;AAaA,SAAS,EAAU,GAA2B;CAC1C,OAAO,KAAK,MAAM,YAAY,IAAI,IAAI,CAAS;AACnD;AAEA,eAAe,EAAW,GAAoB,GAAkD;CAC5F,IAAI;CACJ,IAAI;EACA,IAAO,MAAM,EAAS,MAAM,CAAC,CAAC,KAAK;CACvC,QAAQ;EACJ,IAAI;GACA,IAAO,MAAM,EAAS,KAAK;EAC/B,QAAQ;GACJ,IAAO;EACX;CACJ;CACA,OAAO,IAAI,EACP,EAAc,EAAS,QAAQ,GAAM,EAAS,SAAS,CAAa,CACxE;AACJ;AA0DA,SAAgB,EAAgB,GAAoC;CAChE,IAAM,IAAU,EAAO,WAAW,WAAW,MAAM,KAAK,UAAU;CAalE,SAAS,EAAY,GAAa,GAA2C;EACzE,IAAI,GAAU,OAAO,CAAC;EACtB,IAAM,IAAQ,EAAO,WAAW;EAMhC,OALK,IACA,EAA0B,GAAK,EAAO,SAAS,EAAO,cAAc,IAIlE,EAAE,eAAe,UAAU,IAAQ,KAHtC,EAA2B,GAAK,EAAO,OAAO,GACvC,CAAC,KAHO,CAAC;CAMxB;CAEA,eAAe,EACX,GACA,GACA,GACA,GACiB;EACjB,IAAM,EAAE,SAAM,WAAQ,YAAS,WAAQ,YAAS,GAAG,MAAS,GACtD,IAAS,EAAW,CAAI,GACxB,IAAa,IAAS,EAAO,gBAAgB,EAAO,SAEpD,IACF,MAAY,KAAA,IAAsB,MAAe,KAAA,IAFpC,IAAS,IAAyB,IAEc,IAArC,GAEtB,IAAM,EAAY,EAAO,SAAS,GAAM;GAAE,QAAQ,EAAO;GAAQ;EAAO,CAAC,GAEzE,IAAgB,GAChB,IAAuC;GACzC,GAAI,IAAS,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;GACvD,GAAI,IAAY,EAAE,gBAAgB,EAAU,IAAI,CAAC;GACjD,GAAG,EAAO;GACV,GAAG,EAAY,GAAK,CAAQ;GAC5B,GAAG,EAAY;IACX,QAAQ,EAAK,UAAU;IACvB;IACA,WAAW,EAAO;IAClB,MAAM,EAAO;IACb,gBAAgB,EAAO;IACvB,SAAS;KAAE,GAAG,EAAO;KAAS,GAAG;IAAc;GACnD,CAAC;GACD,GAAG;EACP,GAEM,IAAQ,EAAY,GAAQ,CAAK,GACjC,IAAoB;GACtB,GAAG;GACH,QAAQ,EAAM;GACd,SAAS;GACT,aAAa,EAAO,kBAAkB,YAAY,EAAK;GACvD,MACI,KAA+B,OACzB,KAAA,IACA,IACG,IACD,KAAK,UAAU,CAAI;EACnC;EAEA,IAAI;GACA,OAAO,MAAM,EAAQ,GAAK,CAAI;EAClC,SAAS,GAAO;GAOZ,MANI,EAAM,SAAS,IACT,IAAI,EAAgB;IACtB,QAAQ;IACR,QAAQ,wBAAwB,EAAM;GAC1C,CAAC,IAEC;EACV,UAAU;GACN,EAAM,QAAQ;EAClB;CACJ;CAEA,eAAe,EACX,GACA,GACA,GACA,GACA,GACiB;EACjB,IAAM,IAAM,EAAO;EACnB,IAAI,CAAC,GAAK,OAAO,EAAW,GAAM,GAAS,GAAW,CAAQ;EAE9D,IAAM,IAAY,YAAY,IAAI;EAClC,IAAI;GACA,IAAM,IAAW,MAAM,EAAW,GAAM,GAAS,GAAW,CAAQ,GAC9D,IAAQ;IAAE;IAAW,QAAQ,EAAS;IAAQ,IAAI,EAAU,CAAS;GAAE,GACvE,IAAO,GAAG,EAAO,GAAG,EAAK,KAAK,EAAS;GAG7C,OAFI,EAAS,UAAU,MAAK,EAAI,KAAK,GAAM,CAAK,IAC3C,EAAI,MAAM,GAAM,CAAK,GACnB;EACX,SAAS,GAAO;GAMZ,MALA,EAAI,KAAK,GAAG,EAAO,GAAG,EAAK,iBAAiB;IACxC;IACA,IAAI,EAAU,CAAS;IACvB;GACJ,CAAC,GACK;EACV;CACJ;CAEA,eAAe,EAAmB,GAAoB,GAAkC;EAC/E,MAAO,gBACZ;KAAO,QAAQ,KAAK,yCAAyC;IACzD;IACA,QAAQ,EAAS;GACrB,CAAC;GACD,IAAI;IACA,MAAM,EAAO,eAAe,CAAQ;GACxC,SAAS,GAAO;IACZ,EAAO,QAAQ,KAAK,8DAA8D;KAC9E;KACA,QAAQ,EAAS;KACjB;IACJ,CAAC;GACL;EATC;CAUL;CAEA,eAAe,EACX,GACA,GACA,GACU;EACV,IAAM,EAAE,cAAW,IAAO,mBAAgB,IAAO,GAAG,MAAS,GACvD,IAAY,EAAO,YAAY,EAAO,UAAU,IAAI,EAAS,GAC7D,KAAU,EAAK,UAAU,MAAA,CAAO,YAAY,GAC9C,IAAW,MAAM,EAAK,GAAM,GAAM,GAAW,GAAQ,CAAQ;EAEjE,IAAI,EAAS,WAAW,OAAO,CAAC,KAAY,CAAC,GAAe;GACxD,IAAI,EAAO,SAAS;IAChB,IAAI;KAEA,AADA,MAAM,EAAO,QAAQ,GACrB,IAAW,MAAM,EAAK,GAAM,GAAM,GAAW,GAAQ,CAAQ;IACjE,QAAQ;KAEJ,MADA,MAAM,EAAmB,GAAU,CAAS,GACtC,MAAM,EAAW,GAAU,CAAS;IAC9C;IACA,AAAI,EAAS,WAAW,OACpB,MAAM,EAAmB,GAAU,CAAS;GAEpD,OACI,MAAM,EAAmB,GAAU,CAAS;EAEpD;EAEA,IAAI,CAAC,EAAS,IACV,MAAM,MAAM,EAAW,GAAU,CAAS;EAG9C,OAAO,EAAO,CAAQ;CAC1B;CAEA,eAAe,EACX,GACA,GACA,GACU;EACV,IAAM,EAAE,OAAO,GAAY,GAAG,MAAS,GACjC,IAAe,EAAa,MAAe,KAAA,IAAyB,EAAO,QAApB,CAAyB;EACtF,IAAI,CAAC,GAAc,OAAO,EAAW,GAAM,GAAM,CAAM;EAEvD,IAAM,KAAU,EAAK,UAAU,MAAA,CAAO,YAAY;EAClD,OAAO,QAAuB,EAAW,GAAM,GAAM,CAAM,GAAG;GAC1D,GAAG;GACH,aACI,EAAa,iBAAiB,MAAmB,EAAmB,GAAO,CAAM;EACzF,CAAC;CACL;CAEA,eAAe,EAAW,GAAc,IAA0B,CAAC,GAAe;EAC9E,OAAO,EAAO,GAAM,GAAS,CAAmB;CACpD;CAEA,eAAe,EACX,GACA,GACA,IAAmC,QACnC,GACU;EACV,OAAO,EAAW,GAAM;GAAE,GAAG;GAAS;GAAQ,MAAM;EAAS,CAAC;CAClE;CAEA,OAAO;EACH;EACA,MAAS,GAAc,MACnB,EAAW,GAAM;GAAE,GAAG;GAAS,QAAQ;EAAM,CAAC;EAClD,OAAU,GAAc,MACpB,EAAW,GAAM;GAAE,GAAG;GAAS,QAAQ;EAAO,CAAC;EACnD,MAAS,GAAc,MACnB,EAAW,GAAM;GAAE,GAAG;GAAS,QAAQ;EAAM,CAAC;EAClD,QAAW,GAAc,MACrB,EAAW,GAAM;GAAE,GAAG;GAAS,QAAQ;EAAQ,CAAC;EACpD,SAAY,GAAc,MACtB,EAAW,GAAM;GAAE,GAAG;GAAS,QAAQ;EAAS,CAAC;EACrD,OAAO,GAAc,MACjB,EAAU,GAAM,EAAE,GAAG,EAAQ,IAAI,MAAa,EAAS,KAAK,CAAC;EACjE,cAAc,GAAc,MACxB,EAAiB,GAAM,EAAE,GAAG,EAAQ,IAAI,MAAa,EAAS,YAAY,CAAC;EAC/E;CACJ;AACJ"}

package/dist/http/credential-scope.cjs

@@ -1,2 +1,2 @@
-const e=require("../utils/dev-mode.cjs");var t=new Set;function n(e){try{return new URL(e,globalThis.location?.href).origin}catch{return null}}function r(e,t,r=[]){let i=n(e);return i===null||i===n(t)||r.some(e=>n(e)===i)}function i(r,i){if(!e.isDevBuild())return;let a=n(r);a===null||t.has(a)||(t.add(a),console.warn(`[tempest-react-sdk] Authorization was not sent to ${a}: the credential is scoped to ${n(i)??i}. Add the origin to trustedOrigins if it should receive the token.`))}exports.isTrustedCredentialTarget=r,exports.reportSuppressedCredential=i;
+const e=require("../utils/dev-mode.cjs");var t=new Set;function n(e){try{return new URL(e,globalThis.location?.href).origin}catch{return null}}function r(e,t,r=[]){let i=n(e);return i===null||i===n(t)||r.some(e=>n(e)===i)}function i(r,i,a=`Authorization`){if(!e.isDevBuild())return;let o=n(r);if(o===null)return;let s=`${a} ${o}`;t.has(s)||(t.add(s),console.warn(`[tempest-react-sdk] ${a} was not sent to ${o}: the credential is scoped to ${n(i)??i}. Add the origin to trustedOrigins if it should receive the token.`))}exports.isTrustedCredentialTarget=r,exports.reportSuppressedCredential=i;
 //# sourceMappingURL=credential-scope.cjs.map

package/dist/http/credential-scope.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"credential-scope.cjs","names":[],"sources":["../../src/http/credential-scope.ts"],"sourcesContent":["import { isDevBuild } from \"../utils/dev-mode\";\n\n/**\n * Origins already reported by {@link reportSuppressedCredential}, so a chunked\n * upload warns once instead of once per chunk.\n */\nconst reported = new Set<string>();\n\n/**\n * The origin a URL resolves to, or `null` when it has none to compare.\n *\n * Relative values resolve against the document, because that is what they mean\n * everywhere else in the SDK: an `endpoint` of `\"/api/uploads\"` and a `baseURL`\n * of `\"/api\"` are the shape you get behind a dev-server or a reverse proxy, and\n * both name the page's own origin. Comparing a resolved absolute target against\n * an unresolved relative reference is how the first draft of this function\n * withheld the credential from every client configured that way.\n *\n * `null` is reserved for the case with genuinely nothing to compare: a relative\n * URL outside a browsing context, where there is no document to resolve against.\n *\n * @param url - Absolute or relative URL.\n * @returns The origin, or `null` when it cannot be resolved.\n */\nfunction originOf(url: string): string | null {\n    try {\n        return new URL(url, globalThis.location?.href).origin;\n    } catch {\n        return null;\n    }\n}\n\n/**\n * Whether a request to `target` may carry the caller's credential.\n *\n * The SDK writes `Authorization: Bearer` in three places, and until 0.66.0 none\n * of them looked at where the request was going. That is only safe while every\n * target URL is written by the app: a resumable upload takes its URL from the\n * server's `Location` header, and `createApiClient` lets an absolute path\n * override `baseURL` entirely, so a URL arriving over the network could decide\n * which origin received the token — and the file bytes with it.\n *\n * Handing an upload off to object storage on another host is ordinary `tus`\n * deployment, not an attack, which is exactly why the credential must be scoped\n * rather than the request blocked: the upload still goes through, it just goes\n * without the API's bearer token.\n *\n * Both sides are resolved against the document first, so a relative `baseURL`\n * or `endpoint` — the shape behind a dev-server or reverse proxy — compares\n * equal to the absolute URL the request actually goes to. Outside a browsing\n * context a relative target resolves to nothing and is allowed: there is no\n * origin for it to cross.\n *\n * @param target - The URL the request is about to go to.\n * @param reference - The origin the credential belongs to, normally the\n *     client's `baseURL` or the upload `endpoint`.\n * @param trustedOrigins - Extra origins the app declared, for the legitimate\n *     second host: a CDN, a signed upload endpoint.\n * @returns Whether the credential may be attached.\n *\n * @example\n * isTrustedCredentialTarget(\"https://api.acme.com/me\", \"https://api.acme.com\");\n * // true\n * isTrustedCredentialTarget(\"https://cdn.other/u/1\", \"https://api.acme.com\");\n * // false\n */\nexport function isTrustedCredentialTarget(\n    target: string,\n    reference: string,\n    trustedOrigins: readonly string[] = [],\n): boolean {\n    const targetOrigin = originOf(target);\n    if (targetOrigin === null) return true;\n    if (targetOrigin === originOf(reference)) return true;\n    return trustedOrigins.some((origin) => originOf(origin) === targetOrigin);\n}\n\n/**\n * Say once, in a development build, that a credential was withheld.\n *\n * Without it the symptom is a `401` from a host the developer never typed, and\n * nothing in the app's code mentions the origin that produced it. Keyed by\n * target origin so a hundred-chunk upload reports one line.\n *\n * Silent in production for the same reason {@link parseResponse} is: the origin\n * an app talks to is not something to print into a user's console or ship to an\n * error tracker.\n *\n * @param target - The URL whose request went out unauthenticated.\n * @param reference - The origin the credential was scoped to.\n */\nexport function reportSuppressedCredential(target: string, reference: string): void {\n    if (!isDevBuild()) return;\n    const targetOrigin = originOf(target);\n    if (targetOrigin === null || reported.has(targetOrigin)) return;\n    reported.add(targetOrigin);\n    console.warn(\n        `[tempest-react-sdk] Authorization was not sent to ${targetOrigin}: the credential is scoped to ${originOf(reference) ?? reference}. Add the origin to trustedOrigins if it should receive the token.`,\n    );\n}\n\n/**\n * Forget which origins were already reported.\n *\n * Exported for tests, which assert the once-per-origin behaviour and would\n * otherwise leak state between cases.\n */\nexport function resetSuppressedCredentialReports(): void {\n    reported.clear();\n}\n"],"mappings":"yCAMA,IAAM,EAAW,IAAI,IAkBrB,SAAS,EAAS,EAA4B,CAC1C,GAAI,CACA,OAAO,IAAI,IAAI,EAAK,WAAW,UAAU,IAAI,CAAC,CAAC,MACnD,MAAQ,CACJ,OAAO,IACX,CACJ,CAoCA,SAAgB,EACZ,EACA,EACA,EAAoC,CAAC,EAC9B,CACP,IAAM,EAAe,EAAS,CAAM,EAGpC,OAFI,IAAiB,MACjB,IAAiB,EAAS,CAAS,GAChC,EAAe,KAAM,GAAW,EAAS,CAAM,IAAM,CAAY,CAC5E,CAgBA,SAAgB,EAA2B,EAAgB,EAAyB,CAChF,GAAI,CAAC,EAAA,WAAW,EAAG,OACnB,IAAM,EAAe,EAAS,CAAM,EAChC,IAAiB,MAAQ,EAAS,IAAI,CAAY,IACtD,EAAS,IAAI,CAAY,EACzB,QAAQ,KACJ,qDAAqD,EAAa,gCAAgC,EAAS,CAAS,GAAK,EAAU,mEACvI,EACJ"}
+{"version":3,"file":"credential-scope.cjs","names":[],"sources":["../../src/http/credential-scope.ts"],"sourcesContent":["import { isDevBuild } from \"../utils/dev-mode\";\n\n/**\n * Origins already reported by {@link reportSuppressedCredential}, so a chunked\n * upload warns once instead of once per chunk.\n */\nconst reported = new Set<string>();\n\n/**\n * The origin a URL resolves to, or `null` when it has none to compare.\n *\n * Relative values resolve against the document, because that is what they mean\n * everywhere else in the SDK: an `endpoint` of `\"/api/uploads\"` and a `baseURL`\n * of `\"/api\"` are the shape you get behind a dev-server or a reverse proxy, and\n * both name the page's own origin. Comparing a resolved absolute target against\n * an unresolved relative reference is how the first draft of this function\n * withheld the credential from every client configured that way.\n *\n * `null` is reserved for the case with genuinely nothing to compare: a relative\n * URL outside a browsing context, where there is no document to resolve against.\n *\n * @param url - Absolute or relative URL.\n * @returns The origin, or `null` when it cannot be resolved.\n */\nfunction originOf(url: string): string | null {\n    try {\n        return new URL(url, globalThis.location?.href).origin;\n    } catch {\n        return null;\n    }\n}\n\n/**\n * Whether a request to `target` may carry the caller's credential.\n *\n * The SDK writes `Authorization: Bearer` in three places, and until 0.66.0 none\n * of them looked at where the request was going. That is only safe while every\n * target URL is written by the app: a resumable upload takes its URL from the\n * server's `Location` header, and `createApiClient` lets an absolute path\n * override `baseURL` entirely, so a URL arriving over the network could decide\n * which origin received the token — and the file bytes with it.\n *\n * Handing an upload off to object storage on another host is ordinary `tus`\n * deployment, not an attack, which is exactly why the credential must be scoped\n * rather than the request blocked: the upload still goes through, it just goes\n * without the API's bearer token.\n *\n * Both sides are resolved against the document first, so a relative `baseURL`\n * or `endpoint` — the shape behind a dev-server or reverse proxy — compares\n * equal to the absolute URL the request actually goes to. Outside a browsing\n * context a relative target resolves to nothing and is allowed: there is no\n * origin for it to cross.\n *\n * @param target - The URL the request is about to go to.\n * @param reference - The origin the credential belongs to, normally the\n *     client's `baseURL` or the upload `endpoint`.\n * @param trustedOrigins - Extra origins the app declared, for the legitimate\n *     second host: a CDN, a signed upload endpoint.\n * @returns Whether the credential may be attached.\n *\n * @example\n * isTrustedCredentialTarget(\"https://api.acme.com/me\", \"https://api.acme.com\");\n * // true\n * isTrustedCredentialTarget(\"https://cdn.other/u/1\", \"https://api.acme.com\");\n * // false\n */\nexport function isTrustedCredentialTarget(\n    target: string,\n    reference: string,\n    trustedOrigins: readonly string[] = [],\n): boolean {\n    const targetOrigin = originOf(target);\n    if (targetOrigin === null) return true;\n    if (targetOrigin === originOf(reference)) return true;\n    return trustedOrigins.some((origin) => originOf(origin) === targetOrigin);\n}\n\n/**\n * Say once, in a development build, that a credential was withheld.\n *\n * Without it the symptom is a `401` (or, for the CSRF header, a `403`) from a\n * host the developer never typed, and nothing in the app's code mentions the\n * origin that produced it. Keyed by credential and target origin, so a\n * hundred-chunk upload reports one line per header it withheld.\n *\n * Silent in production for the same reason {@link parseResponse} is: the origin\n * an app talks to is not something to print into a user's console or ship to an\n * error tracker.\n *\n * @param target - The URL whose request went out unauthenticated.\n * @param reference - The origin the credential was scoped to.\n * @param header - The header that was withheld. Default `\"Authorization\"`.\n */\nexport function reportSuppressedCredential(\n    target: string,\n    reference: string,\n    header = \"Authorization\",\n): void {\n    if (!isDevBuild()) return;\n    const targetOrigin = originOf(target);\n    if (targetOrigin === null) return;\n    const key = `${header} ${targetOrigin}`;\n    if (reported.has(key)) return;\n    reported.add(key);\n    console.warn(\n        `[tempest-react-sdk] ${header} was not sent to ${targetOrigin}: the credential is scoped to ${originOf(reference) ?? reference}. Add the origin to trustedOrigins if it should receive the token.`,\n    );\n}\n\n/**\n * Forget which origins were already reported.\n *\n * Exported for tests, which assert the once-per-origin behaviour and would\n * otherwise leak state between cases.\n */\nexport function resetSuppressedCredentialReports(): void {\n    reported.clear();\n}\n"],"mappings":"yCAMA,IAAM,EAAW,IAAI,IAkBrB,SAAS,EAAS,EAA4B,CAC1C,GAAI,CACA,OAAO,IAAI,IAAI,EAAK,WAAW,UAAU,IAAI,CAAC,CAAC,MACnD,MAAQ,CACJ,OAAO,IACX,CACJ,CAoCA,SAAgB,EACZ,EACA,EACA,EAAoC,CAAC,EAC9B,CACP,IAAM,EAAe,EAAS,CAAM,EAGpC,OAFI,IAAiB,MACjB,IAAiB,EAAS,CAAS,GAChC,EAAe,KAAM,GAAW,EAAS,CAAM,IAAM,CAAY,CAC5E,CAkBA,SAAgB,EACZ,EACA,EACA,EAAS,gBACL,CACJ,GAAI,CAAC,EAAA,WAAW,EAAG,OACnB,IAAM,EAAe,EAAS,CAAM,EACpC,GAAI,IAAiB,KAAM,OAC3B,IAAM,EAAM,GAAG,EAAO,GAAG,IACrB,EAAS,IAAI,CAAG,IACpB,EAAS,IAAI,CAAG,EAChB,QAAQ,KACJ,uBAAuB,EAAO,mBAAmB,EAAa,gCAAgC,EAAS,CAAS,GAAK,EAAU,mEACnI,EACJ"}

package/dist/http/credential-scope.js

@@ -12,10 +12,12 @@ function r(e, t, r = []) {
 	let i = n(e);
 	return i === null || i === n(t) || r.some((e) => n(e) === i);
 }
-function i(r, i) {
+function i(r, i, a = "Authorization") {
 	if (!e()) return;
-	let a = n(r);
-	a === null || t.has(a) || (t.add(a), console.warn(`[tempest-react-sdk] Authorization was not sent to ${a}: the credential is scoped to ${n(i) ?? i}. Add the origin to trustedOrigins if it should receive the token.`));
+	let o = n(r);
+	if (o === null) return;
+	let s = `${a} ${o}`;
+	t.has(s) || (t.add(s), console.warn(`[tempest-react-sdk] ${a} was not sent to ${o}: the credential is scoped to ${n(i) ?? i}. Add the origin to trustedOrigins if it should receive the token.`));
 }
 //#endregion
 export { r as isTrustedCredentialTarget, i as reportSuppressedCredential };

package/dist/http/credential-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-scope.js","names":[],"sources":["../../src/http/credential-scope.ts"],"sourcesContent":["import { isDevBuild } from \"../utils/dev-mode\";\n\n/**\n * Origins already reported by {@link reportSuppressedCredential}, so a chunked\n * upload warns once instead of once per chunk.\n */\nconst reported = new Set<string>();\n\n/**\n * The origin a URL resolves to, or `null` when it has none to compare.\n *\n * Relative values resolve against the document, because that is what they mean\n * everywhere else in the SDK: an `endpoint` of `\"/api/uploads\"` and a `baseURL`\n * of `\"/api\"` are the shape you get behind a dev-server or a reverse proxy, and\n * both name the page's own origin. Comparing a resolved absolute target against\n * an unresolved relative reference is how the first draft of this function\n * withheld the credential from every client configured that way.\n *\n * `null` is reserved for the case with genuinely nothing to compare: a relative\n * URL outside a browsing context, where there is no document to resolve against.\n *\n * @param url - Absolute or relative URL.\n * @returns The origin, or `null` when it cannot be resolved.\n */\nfunction originOf(url: string): string | null {\n    try {\n        return new URL(url, globalThis.location?.href).origin;\n    } catch {\n        return null;\n    }\n}\n\n/**\n * Whether a request to `target` may carry the caller's credential.\n *\n * The SDK writes `Authorization: Bearer` in three places, and until 0.66.0 none\n * of them looked at where the request was going. That is only safe while every\n * target URL is written by the app: a resumable upload takes its URL from the\n * server's `Location` header, and `createApiClient` lets an absolute path\n * override `baseURL` entirely, so a URL arriving over the network could decide\n * which origin received the token — and the file bytes with it.\n *\n * Handing an upload off to object storage on another host is ordinary `tus`\n * deployment, not an attack, which is exactly why the credential must be scoped\n * rather than the request blocked: the upload still goes through, it just goes\n * without the API's bearer token.\n *\n * Both sides are resolved against the document first, so a relative `baseURL`\n * or `endpoint` — the shape behind a dev-server or reverse proxy — compares\n * equal to the absolute URL the request actually goes to. Outside a browsing\n * context a relative target resolves to nothing and is allowed: there is no\n * origin for it to cross.\n *\n * @param target - The URL the request is about to go to.\n * @param reference - The origin the credential belongs to, normally the\n *     client's `baseURL` or the upload `endpoint`.\n * @param trustedOrigins - Extra origins the app declared, for the legitimate\n *     second host: a CDN, a signed upload endpoint.\n * @returns Whether the credential may be attached.\n *\n * @example\n * isTrustedCredentialTarget(\"https://api.acme.com/me\", \"https://api.acme.com\");\n * // true\n * isTrustedCredentialTarget(\"https://cdn.other/u/1\", \"https://api.acme.com\");\n * // false\n */\nexport function isTrustedCredentialTarget(\n    target: string,\n    reference: string,\n    trustedOrigins: readonly string[] = [],\n): boolean {\n    const targetOrigin = originOf(target);\n    if (targetOrigin === null) return true;\n    if (targetOrigin === originOf(reference)) return true;\n    return trustedOrigins.some((origin) => originOf(origin) === targetOrigin);\n}\n\n/**\n * Say once, in a development build, that a credential was withheld.\n *\n * Without it the symptom is a `401` from a host the developer never typed, and\n * nothing in the app's code mentions the origin that produced it. Keyed by\n * target origin so a hundred-chunk upload reports one line.\n *\n * Silent in production for the same reason {@link parseResponse} is: the origin\n * an app talks to is not something to print into a user's console or ship to an\n * error tracker.\n *\n * @param target - The URL whose request went out unauthenticated.\n * @param reference - The origin the credential was scoped to.\n */\nexport function reportSuppressedCredential(target: string, reference: string): void {\n    if (!isDevBuild()) return;\n    const targetOrigin = originOf(target);\n    if (targetOrigin === null || reported.has(targetOrigin)) return;\n    reported.add(targetOrigin);\n    console.warn(\n        `[tempest-react-sdk] Authorization was not sent to ${targetOrigin}: the credential is scoped to ${originOf(reference) ?? reference}. Add the origin to trustedOrigins if it should receive the token.`,\n    );\n}\n\n/**\n * Forget which origins were already reported.\n *\n * Exported for tests, which assert the once-per-origin behaviour and would\n * otherwise leak state between cases.\n */\nexport function resetSuppressedCredentialReports(): void {\n    reported.clear();\n}\n"],"mappings":";;AAMA,IAAM,oBAAW,IAAI,IAAY;AAkBjC,SAAS,EAAS,GAA4B;CAC1C,IAAI;EACA,OAAO,IAAI,IAAI,GAAK,WAAW,UAAU,IAAI,CAAC,CAAC;CACnD,QAAQ;EACJ,OAAO;CACX;AACJ;AAoCA,SAAgB,EACZ,GACA,GACA,IAAoC,CAAC,GAC9B;CACP,IAAM,IAAe,EAAS,CAAM;CAGpC,OAFI,MAAiB,QACjB,MAAiB,EAAS,CAAS,KAChC,EAAe,MAAM,MAAW,EAAS,CAAM,MAAM,CAAY;AAC5E;AAgBA,SAAgB,EAA2B,GAAgB,GAAyB;CAChF,IAAI,CAAC,EAAW,GAAG;CACnB,IAAM,IAAe,EAAS,CAAM;CAChC,MAAiB,QAAQ,EAAS,IAAI,CAAY,MACtD,EAAS,IAAI,CAAY,GACzB,QAAQ,KACJ,qDAAqD,EAAa,gCAAgC,EAAS,CAAS,KAAK,EAAU,mEACvI;AACJ"}
+{"version":3,"file":"credential-scope.js","names":[],"sources":["../../src/http/credential-scope.ts"],"sourcesContent":["import { isDevBuild } from \"../utils/dev-mode\";\n\n/**\n * Origins already reported by {@link reportSuppressedCredential}, so a chunked\n * upload warns once instead of once per chunk.\n */\nconst reported = new Set<string>();\n\n/**\n * The origin a URL resolves to, or `null` when it has none to compare.\n *\n * Relative values resolve against the document, because that is what they mean\n * everywhere else in the SDK: an `endpoint` of `\"/api/uploads\"` and a `baseURL`\n * of `\"/api\"` are the shape you get behind a dev-server or a reverse proxy, and\n * both name the page's own origin. Comparing a resolved absolute target against\n * an unresolved relative reference is how the first draft of this function\n * withheld the credential from every client configured that way.\n *\n * `null` is reserved for the case with genuinely nothing to compare: a relative\n * URL outside a browsing context, where there is no document to resolve against.\n *\n * @param url - Absolute or relative URL.\n * @returns The origin, or `null` when it cannot be resolved.\n */\nfunction originOf(url: string): string | null {\n    try {\n        return new URL(url, globalThis.location?.href).origin;\n    } catch {\n        return null;\n    }\n}\n\n/**\n * Whether a request to `target` may carry the caller's credential.\n *\n * The SDK writes `Authorization: Bearer` in three places, and until 0.66.0 none\n * of them looked at where the request was going. That is only safe while every\n * target URL is written by the app: a resumable upload takes its URL from the\n * server's `Location` header, and `createApiClient` lets an absolute path\n * override `baseURL` entirely, so a URL arriving over the network could decide\n * which origin received the token — and the file bytes with it.\n *\n * Handing an upload off to object storage on another host is ordinary `tus`\n * deployment, not an attack, which is exactly why the credential must be scoped\n * rather than the request blocked: the upload still goes through, it just goes\n * without the API's bearer token.\n *\n * Both sides are resolved against the document first, so a relative `baseURL`\n * or `endpoint` — the shape behind a dev-server or reverse proxy — compares\n * equal to the absolute URL the request actually goes to. Outside a browsing\n * context a relative target resolves to nothing and is allowed: there is no\n * origin for it to cross.\n *\n * @param target - The URL the request is about to go to.\n * @param reference - The origin the credential belongs to, normally the\n *     client's `baseURL` or the upload `endpoint`.\n * @param trustedOrigins - Extra origins the app declared, for the legitimate\n *     second host: a CDN, a signed upload endpoint.\n * @returns Whether the credential may be attached.\n *\n * @example\n * isTrustedCredentialTarget(\"https://api.acme.com/me\", \"https://api.acme.com\");\n * // true\n * isTrustedCredentialTarget(\"https://cdn.other/u/1\", \"https://api.acme.com\");\n * // false\n */\nexport function isTrustedCredentialTarget(\n    target: string,\n    reference: string,\n    trustedOrigins: readonly string[] = [],\n): boolean {\n    const targetOrigin = originOf(target);\n    if (targetOrigin === null) return true;\n    if (targetOrigin === originOf(reference)) return true;\n    return trustedOrigins.some((origin) => originOf(origin) === targetOrigin);\n}\n\n/**\n * Say once, in a development build, that a credential was withheld.\n *\n * Without it the symptom is a `401` (or, for the CSRF header, a `403`) from a\n * host the developer never typed, and nothing in the app's code mentions the\n * origin that produced it. Keyed by credential and target origin, so a\n * hundred-chunk upload reports one line per header it withheld.\n *\n * Silent in production for the same reason {@link parseResponse} is: the origin\n * an app talks to is not something to print into a user's console or ship to an\n * error tracker.\n *\n * @param target - The URL whose request went out unauthenticated.\n * @param reference - The origin the credential was scoped to.\n * @param header - The header that was withheld. Default `\"Authorization\"`.\n */\nexport function reportSuppressedCredential(\n    target: string,\n    reference: string,\n    header = \"Authorization\",\n): void {\n    if (!isDevBuild()) return;\n    const targetOrigin = originOf(target);\n    if (targetOrigin === null) return;\n    const key = `${header} ${targetOrigin}`;\n    if (reported.has(key)) return;\n    reported.add(key);\n    console.warn(\n        `[tempest-react-sdk] ${header} was not sent to ${targetOrigin}: the credential is scoped to ${originOf(reference) ?? reference}. Add the origin to trustedOrigins if it should receive the token.`,\n    );\n}\n\n/**\n * Forget which origins were already reported.\n *\n * Exported for tests, which assert the once-per-origin behaviour and would\n * otherwise leak state between cases.\n */\nexport function resetSuppressedCredentialReports(): void {\n    reported.clear();\n}\n"],"mappings":";;AAMA,IAAM,oBAAW,IAAI,IAAY;AAkBjC,SAAS,EAAS,GAA4B;CAC1C,IAAI;EACA,OAAO,IAAI,IAAI,GAAK,WAAW,UAAU,IAAI,CAAC,CAAC;CACnD,QAAQ;EACJ,OAAO;CACX;AACJ;AAoCA,SAAgB,EACZ,GACA,GACA,IAAoC,CAAC,GAC9B;CACP,IAAM,IAAe,EAAS,CAAM;CAGpC,OAFI,MAAiB,QACjB,MAAiB,EAAS,CAAS,KAChC,EAAe,MAAM,MAAW,EAAS,CAAM,MAAM,CAAY;AAC5E;AAkBA,SAAgB,EACZ,GACA,GACA,IAAS,iBACL;CACJ,IAAI,CAAC,EAAW,GAAG;CACnB,IAAM,IAAe,EAAS,CAAM;CACpC,IAAI,MAAiB,MAAM;CAC3B,IAAM,IAAM,GAAG,EAAO,GAAG;CACrB,EAAS,IAAI,CAAG,MACpB,EAAS,IAAI,CAAG,GAChB,QAAQ,KACJ,uBAAuB,EAAO,mBAAmB,EAAa,gCAAgC,EAAS,CAAS,KAAK,EAAU,mEACnI;AACJ"}

package/dist/http/csrf.cjs

@@ -0,0 +1,2 @@
+const e=require("../utils/dev-mode.cjs"),t=require("./credential-scope.cjs");var n=`csrf_token`,r=`X-CSRF-Token`,i=new Set([`GET`,`HEAD`,`OPTIONS`,`TRACE`]),a=new Set;function o(e){if(typeof document>`u`)return null;let t=`${e}=`;for(let e of document.cookie.split(`;`)){let n=e.trim();if(!n.startsWith(t))continue;let r=n.slice(t.length);try{return decodeURIComponent(r)}catch{return r}}return null}function s(t){if(!e.isDevBuild()||a.has(t))return;a.add(t);let n=t===`getToken`?`csrf.getToken() returned nothing`:`no readable "${t}" cookie on this page`;console.warn(`[tempest-react-sdk] CSRF is enabled but ${n}, so the write went without the token. The cookie must be issued before the first write and must not be HttpOnly.`)}function c(e,t){return e?new Headers(e).has(t):!1}function l(e){let{method:n,url:r,reference:a,csrf:l,trustedOrigins:u,headers:d}=e;if(!l||i.has(n.toUpperCase()))return{};let f=l===!0?{}:l,p=f.headerName??`X-CSRF-Token`;if(c(d,p))return{};if(!t.isTrustedCredentialTarget(r,a,u))return t.reportSuppressedCredential(r,a,p),{};let m=f.cookieName??`csrf_token`,h=f.getToken?f.getToken():o(m);return h?{[p]:h}:(s(f.getToken?`getToken`:m),{})}exports.DEFAULT_CSRF_COOKIE_NAME=n,exports.DEFAULT_CSRF_HEADER_NAME=r,exports.csrfHeaders=l;
+//# sourceMappingURL=csrf.cjs.map

package/dist/http/csrf.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.cjs","names":[],"sources":["../../src/http/csrf.ts"],"sourcesContent":["import { isDevBuild } from \"../utils/dev-mode\";\nimport { isTrustedCredentialTarget, reportSuppressedCredential } from \"./credential-scope\";\n\n/**\n * Default cookie the CSRF token is read from.\n *\n * Ported from `tempest-fastapi-sdk`'s `CSRF_COOKIE_NAME`\n * (`tempest_fastapi_sdk/api/middlewares/csrf.py`), which is the cookie its\n * `make_csrf_token_dependency()` sets and its `CSRFMiddleware` compares against.\n * Matching it is what lets `csrf: true` work against that backend with no\n * configuration on either side.\n */\nexport const DEFAULT_CSRF_COOKIE_NAME = \"csrf_token\";\n\n/**\n * Default header the CSRF token is echoed in.\n *\n * Ported from `tempest-fastapi-sdk`'s `CSRF_HEADER_NAME`, the header its\n * `CSRFMiddleware` reads on every unsafe request.\n */\nexport const DEFAULT_CSRF_HEADER_NAME = \"X-CSRF-Token\";\n\n/**\n * Where the CSRF token comes from and which header carries it.\n *\n * The default is the **double-submit cookie**: the server sets a cookie that is\n * deliberately not `HttpOnly`, the client reads it and echoes the value in a\n * header, and the server rejects a write whose header does not match the\n * cookie. A page on another site can make the browser *send* the cookie, but\n * cannot *read* it, so it cannot write the header.\n *\n * The token is read again on every request, so a server that rotates the\n * cookie is followed without any capture step: the browser's cookie jar is the\n * store. That is also why there is no \"read the token from a response header\"\n * mode — it would depend on `Access-Control-Expose-Headers`, and a missing\n * expose header fails silently, as a `403` on the second write.\n */\nexport interface CsrfOptions {\n    /** Cookie to read the token from. Default {@link DEFAULT_CSRF_COOKIE_NAME}. */\n    cookieName?: string;\n    /** Header to send the token in. Default {@link DEFAULT_CSRF_HEADER_NAME}. */\n    headerName?: string;\n    /**\n     * Supply the token yourself instead of reading `cookieName`.\n     *\n     * For the cases the cookie cannot serve: an API on another **site**, whose\n     * cookie `document.cookie` cannot see, or a backend that hands the token\n     * out in a response body. Called per request, like `getToken`.\n     */\n    getToken?: () => string | null | undefined;\n}\n\n/**\n * Methods that must not change state, and so never carry the token.\n *\n * A deny list rather than an allow list of the four write verbs: RFC 9110\n * names the safe methods, and a custom method (`PROPFIND`, a tus extension)\n * is a write until proven otherwise. Sending the token to its own origin on\n * an unexpected verb costs nothing; omitting it costs a `403`.\n */\nconst SAFE_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\", \"OPTIONS\", \"TRACE\"]);\n\n/** Token sources already reported empty, so a burst of writes warns once. */\nconst reportedMissing = new Set<string>();\n\n/**\n * Read one cookie from `document.cookie`, or `null` when it is absent.\n *\n * Returns `null` outside a document (a worker, a test without jsdom), where\n * there is no cookie jar to read. The value is URI-decoded when it can be,\n * and returned raw when it is not valid percent-encoding.\n *\n * @param name - The cookie name.\n * @returns The value, or `null`.\n */\nfunction readCookie(name: string): string | null {\n    if (typeof document === \"undefined\") return null;\n    const prefix = `${name}=`;\n    for (const part of document.cookie.split(\";\")) {\n        const entry = part.trim();\n        if (!entry.startsWith(prefix)) continue;\n        const raw = entry.slice(prefix.length);\n        try {\n            return decodeURIComponent(raw);\n        } catch {\n            return raw;\n        }\n    }\n    return null;\n}\n\n/**\n * Say once, in a development build, that CSRF is on but there is no token.\n *\n * The request still goes out, because the SDK cannot know whether this path\n * is guarded — `CSRFMiddleware` is commonly mounted with `exclude_paths`. When\n * it is guarded, the symptom is a `403 CSRF_VALIDATION_FAILED` with nothing\n * in the app's code pointing at the cause, and the three usual causes are all\n * on the server: the cookie was never issued, was issued `HttpOnly`, or was\n * issued for a domain this page cannot read.\n *\n * @param source - What was read: the cookie name, or `\"getToken\"`.\n */\nfunction reportMissingToken(source: string): void {\n    if (!isDevBuild() || reportedMissing.has(source)) return;\n    reportedMissing.add(source);\n    const where =\n        source === \"getToken\"\n            ? \"csrf.getToken() returned nothing\"\n            : `no readable \"${source}\" cookie on this page`;\n    console.warn(\n        `[tempest-react-sdk] CSRF is enabled but ${where}, so the write went without the token. The cookie must be issued before the first write and must not be HttpOnly.`,\n    );\n}\n\n/**\n * Whether a header is already present, compared case-insensitively.\n *\n * Header names are case-insensitive, but object keys are not: a caller's\n * `\"x-csrf-token\"` next to the SDK's `\"X-CSRF-Token\"` would reach `fetch` as\n * two entries and be joined into `\"a, b\"`, which matches neither.\n *\n * @param headers - The headers the caller already set.\n * @param name - The header to look for.\n * @returns Whether it is set.\n */\nfunction hasHeader(headers: HeadersInit | undefined, name: string): boolean {\n    if (!headers) return false;\n    return new Headers(headers).has(name);\n}\n\n/** What {@link csrfHeaders} needs to decide. */\nexport interface CsrfHeadersInput {\n    /** The HTTP method of the request. Case-insensitive. */\n    method: string;\n    /** The URL the request is going to. */\n    url: string;\n    /**\n     * The origin the token belongs to, normally the API's `baseURL`. The token\n     * is only sent to this origin or to one listed in `trustedOrigins`.\n     */\n    reference: string;\n    /** The CSRF config. `undefined` or `false` turns the header off. */\n    csrf: boolean | CsrfOptions | undefined;\n    /** Extra origins allowed to receive the token. */\n    trustedOrigins?: readonly string[];\n    /** Headers the caller already set. A CSRF header among them is never replaced. */\n    headers?: HeadersInit;\n}\n\n/**\n * The CSRF header a request should carry, or an empty object.\n *\n * Every request path in the SDK — `createApiClient`, `uploadWithProgress`,\n * `createResumableUpload` — asks this function, so the rules are one rule:\n *\n * - **Off unless configured.** Without `csrf`, nothing changes.\n * - **Unsafe methods only.** `GET`, `HEAD`, `OPTIONS` and `TRACE` never carry\n *   it; they must not change state, and a token in a `GET` ends up in logs\n *   and caches for nothing.\n * - **Never across an origin.** The token follows the same scope as the bearer\n *   credential ({@link isTrustedCredentialTarget}), because a URL can come off\n *   the network — a tus `Location`, a pagination link — and a CSRF token sent\n *   to a third party is a token that third party can replay. Withheld tokens\n *   are reported once per origin in a development build.\n * - **Your header wins.** A CSRF header you set by hand, in any casing, is\n *   left alone.\n * - **Independent of auth.** It is sent on `skipAuth` requests too: login and\n *   refresh are exactly the writes a cookie session exposes to forgery.\n *\n * Exported for the request you build by hand, so it follows the same rules.\n *\n * @example\n * const headers = csrfHeaders({\n *     method: \"POST\",\n *     url: \"https://api.acme.com/orders\",\n *     reference: \"https://api.acme.com\",\n *     csrf: true,\n * });\n * // { \"X-CSRF-Token\": \"<value of the csrf_token cookie>\" }\n *\n * @param input - The request and the CSRF config.\n * @returns A header record to spread into the request's headers.\n */\nexport function csrfHeaders(input: CsrfHeadersInput): Record<string, string> {\n    const { method, url, reference, csrf, trustedOrigins, headers } = input;\n    if (!csrf) return {};\n    if (SAFE_METHODS.has(method.toUpperCase())) return {};\n    const options: CsrfOptions = csrf === true ? {} : csrf;\n    const headerName = options.headerName ?? DEFAULT_CSRF_HEADER_NAME;\n    if (hasHeader(headers, headerName)) return {};\n    if (!isTrustedCredentialTarget(url, reference, trustedOrigins)) {\n        reportSuppressedCredential(url, reference, headerName);\n        return {};\n    }\n    const cookieName = options.cookieName ?? DEFAULT_CSRF_COOKIE_NAME;\n    const token = options.getToken ? options.getToken() : readCookie(cookieName);\n    if (!token) {\n        reportMissingToken(options.getToken ? \"getToken\" : cookieName);\n        return {};\n    }\n    return { [headerName]: token };\n}\n\n/**\n * Forget which token sources were already reported empty.\n *\n * Exported for tests, which assert the once-per-source behaviour and would\n * otherwise leak state between cases.\n */\nexport function resetCsrfReports(): void {\n    reportedMissing.clear();\n}\n"],"mappings":"6EAYA,IAAa,EAA2B,aAQ3B,EAA2B,eAwClC,EAAoC,IAAI,IAAI,CAAC,MAAO,OAAQ,UAAW,OAAO,CAAC,EAG/E,EAAkB,IAAI,IAY5B,SAAS,EAAW,EAA6B,CAC7C,GAAI,OAAO,SAAa,IAAa,OAAO,KAC5C,IAAM,EAAS,GAAG,EAAK,GACvB,IAAK,IAAM,KAAQ,SAAS,OAAO,MAAM,GAAG,EAAG,CAC3C,IAAM,EAAQ,EAAK,KAAK,EACxB,GAAI,CAAC,EAAM,WAAW,CAAM,EAAG,SAC/B,IAAM,EAAM,EAAM,MAAM,EAAO,MAAM,EACrC,GAAI,CACA,OAAO,mBAAmB,CAAG,CACjC,MAAQ,CACJ,OAAO,CACX,CACJ,CACA,OAAO,IACX,CAcA,SAAS,EAAmB,EAAsB,CAC9C,GAAI,CAAC,EAAA,WAAW,GAAK,EAAgB,IAAI,CAAM,EAAG,OAClD,EAAgB,IAAI,CAAM,EAC1B,IAAM,EACF,IAAW,WACL,mCACA,gBAAgB,EAAO,uBACjC,QAAQ,KACJ,2CAA2C,EAAM,kHACrD,CACJ,CAaA,SAAS,EAAU,EAAkC,EAAuB,CAExE,OADK,EACE,IAAI,QAAQ,CAAO,CAAC,CAAC,IAAI,CAAI,EADf,EAEzB,CAuDA,SAAgB,EAAY,EAAiD,CACzE,GAAM,CAAE,SAAQ,MAAK,YAAW,OAAM,iBAAgB,WAAY,EAElE,GADI,CAAC,GACD,EAAa,IAAI,EAAO,YAAY,CAAC,EAAG,MAAO,CAAC,EACpD,IAAM,EAAuB,IAAS,GAAO,CAAC,EAAI,EAC5C,EAAa,EAAQ,YAAA,eAC3B,GAAI,EAAU,EAAS,CAAU,EAAG,MAAO,CAAC,EAC5C,GAAI,CAAC,EAAA,0BAA0B,EAAK,EAAW,CAAc,EAEzD,OADA,EAAA,2BAA2B,EAAK,EAAW,CAAU,EAC9C,CAAC,EAEZ,IAAM,EAAa,EAAQ,YAAA,aACrB,EAAQ,EAAQ,SAAW,EAAQ,SAAS,EAAI,EAAW,CAAU,EAK3E,OAJK,EAIE,EAAG,GAAa,CAAM,GAHzB,EAAmB,EAAQ,SAAW,WAAa,CAAU,EACtD,CAAC,EAGhB"}

package/dist/http/csrf.js

@@ -0,0 +1,46 @@
+import { isDevBuild as e } from "../utils/dev-mode.js";
+import { isTrustedCredentialTarget as t, reportSuppressedCredential as n } from "./credential-scope.js";
+//#region src/http/csrf.ts
+var r = "csrf_token", i = "X-CSRF-Token", a = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS",
+	"TRACE"
+]), o = /* @__PURE__ */ new Set();
+function s(e) {
+	if (typeof document > "u") return null;
+	let t = `${e}=`;
+	for (let e of document.cookie.split(";")) {
+		let n = e.trim();
+		if (!n.startsWith(t)) continue;
+		let r = n.slice(t.length);
+		try {
+			return decodeURIComponent(r);
+		} catch {
+			return r;
+		}
+	}
+	return null;
+}
+function c(t) {
+	if (!e() || o.has(t)) return;
+	o.add(t);
+	let n = t === "getToken" ? "csrf.getToken() returned nothing" : `no readable "${t}" cookie on this page`;
+	console.warn(`[tempest-react-sdk] CSRF is enabled but ${n}, so the write went without the token. The cookie must be issued before the first write and must not be HttpOnly.`);
+}
+function l(e, t) {
+	return e ? new Headers(e).has(t) : !1;
+}
+function u(e) {
+	let { method: r, url: i, reference: o, csrf: u, trustedOrigins: d, headers: f } = e;
+	if (!u || a.has(r.toUpperCase())) return {};
+	let p = u === !0 ? {} : u, m = p.headerName ?? "X-CSRF-Token";
+	if (l(f, m)) return {};
+	if (!t(i, o, d)) return n(i, o, m), {};
+	let h = p.cookieName ?? "csrf_token", g = p.getToken ? p.getToken() : s(h);
+	return g ? { [m]: g } : (c(p.getToken ? "getToken" : h), {});
+}
+//#endregion
+export { r as DEFAULT_CSRF_COOKIE_NAME, i as DEFAULT_CSRF_HEADER_NAME, u as csrfHeaders };
+
+//# sourceMappingURL=csrf.js.map

package/dist/http/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","names":[],"sources":["../../src/http/csrf.ts"],"sourcesContent":["import { isDevBuild } from \"../utils/dev-mode\";\nimport { isTrustedCredentialTarget, reportSuppressedCredential } from \"./credential-scope\";\n\n/**\n * Default cookie the CSRF token is read from.\n *\n * Ported from `tempest-fastapi-sdk`'s `CSRF_COOKIE_NAME`\n * (`tempest_fastapi_sdk/api/middlewares/csrf.py`), which is the cookie its\n * `make_csrf_token_dependency()` sets and its `CSRFMiddleware` compares against.\n * Matching it is what lets `csrf: true` work against that backend with no\n * configuration on either side.\n */\nexport const DEFAULT_CSRF_COOKIE_NAME = \"csrf_token\";\n\n/**\n * Default header the CSRF token is echoed in.\n *\n * Ported from `tempest-fastapi-sdk`'s `CSRF_HEADER_NAME`, the header its\n * `CSRFMiddleware` reads on every unsafe request.\n */\nexport const DEFAULT_CSRF_HEADER_NAME = \"X-CSRF-Token\";\n\n/**\n * Where the CSRF token comes from and which header carries it.\n *\n * The default is the **double-submit cookie**: the server sets a cookie that is\n * deliberately not `HttpOnly`, the client reads it and echoes the value in a\n * header, and the server rejects a write whose header does not match the\n * cookie. A page on another site can make the browser *send* the cookie, but\n * cannot *read* it, so it cannot write the header.\n *\n * The token is read again on every request, so a server that rotates the\n * cookie is followed without any capture step: the browser's cookie jar is the\n * store. That is also why there is no \"read the token from a response header\"\n * mode — it would depend on `Access-Control-Expose-Headers`, and a missing\n * expose header fails silently, as a `403` on the second write.\n */\nexport interface CsrfOptions {\n    /** Cookie to read the token from. Default {@link DEFAULT_CSRF_COOKIE_NAME}. */\n    cookieName?: string;\n    /** Header to send the token in. Default {@link DEFAULT_CSRF_HEADER_NAME}. */\n    headerName?: string;\n    /**\n     * Supply the token yourself instead of reading `cookieName`.\n     *\n     * For the cases the cookie cannot serve: an API on another **site**, whose\n     * cookie `document.cookie` cannot see, or a backend that hands the token\n     * out in a response body. Called per request, like `getToken`.\n     */\n    getToken?: () => string | null | undefined;\n}\n\n/**\n * Methods that must not change state, and so never carry the token.\n *\n * A deny list rather than an allow list of the four write verbs: RFC 9110\n * names the safe methods, and a custom method (`PROPFIND`, a tus extension)\n * is a write until proven otherwise. Sending the token to its own origin on\n * an unexpected verb costs nothing; omitting it costs a `403`.\n */\nconst SAFE_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\", \"OPTIONS\", \"TRACE\"]);\n\n/** Token sources already reported empty, so a burst of writes warns once. */\nconst reportedMissing = new Set<string>();\n\n/**\n * Read one cookie from `document.cookie`, or `null` when it is absent.\n *\n * Returns `null` outside a document (a worker, a test without jsdom), where\n * there is no cookie jar to read. The value is URI-decoded when it can be,\n * and returned raw when it is not valid percent-encoding.\n *\n * @param name - The cookie name.\n * @returns The value, or `null`.\n */\nfunction readCookie(name: string): string | null {\n    if (typeof document === \"undefined\") return null;\n    const prefix = `${name}=`;\n    for (const part of document.cookie.split(\";\")) {\n        const entry = part.trim();\n        if (!entry.startsWith(prefix)) continue;\n        const raw = entry.slice(prefix.length);\n        try {\n            return decodeURIComponent(raw);\n        } catch {\n            return raw;\n        }\n    }\n    return null;\n}\n\n/**\n * Say once, in a development build, that CSRF is on but there is no token.\n *\n * The request still goes out, because the SDK cannot know whether this path\n * is guarded — `CSRFMiddleware` is commonly mounted with `exclude_paths`. When\n * it is guarded, the symptom is a `403 CSRF_VALIDATION_FAILED` with nothing\n * in the app's code pointing at the cause, and the three usual causes are all\n * on the server: the cookie was never issued, was issued `HttpOnly`, or was\n * issued for a domain this page cannot read.\n *\n * @param source - What was read: the cookie name, or `\"getToken\"`.\n */\nfunction reportMissingToken(source: string): void {\n    if (!isDevBuild() || reportedMissing.has(source)) return;\n    reportedMissing.add(source);\n    const where =\n        source === \"getToken\"\n            ? \"csrf.getToken() returned nothing\"\n            : `no readable \"${source}\" cookie on this page`;\n    console.warn(\n        `[tempest-react-sdk] CSRF is enabled but ${where}, so the write went without the token. The cookie must be issued before the first write and must not be HttpOnly.`,\n    );\n}\n\n/**\n * Whether a header is already present, compared case-insensitively.\n *\n * Header names are case-insensitive, but object keys are not: a caller's\n * `\"x-csrf-token\"` next to the SDK's `\"X-CSRF-Token\"` would reach `fetch` as\n * two entries and be joined into `\"a, b\"`, which matches neither.\n *\n * @param headers - The headers the caller already set.\n * @param name - The header to look for.\n * @returns Whether it is set.\n */\nfunction hasHeader(headers: HeadersInit | undefined, name: string): boolean {\n    if (!headers) return false;\n    return new Headers(headers).has(name);\n}\n\n/** What {@link csrfHeaders} needs to decide. */\nexport interface CsrfHeadersInput {\n    /** The HTTP method of the request. Case-insensitive. */\n    method: string;\n    /** The URL the request is going to. */\n    url: string;\n    /**\n     * The origin the token belongs to, normally the API's `baseURL`. The token\n     * is only sent to this origin or to one listed in `trustedOrigins`.\n     */\n    reference: string;\n    /** The CSRF config. `undefined` or `false` turns the header off. */\n    csrf: boolean | CsrfOptions | undefined;\n    /** Extra origins allowed to receive the token. */\n    trustedOrigins?: readonly string[];\n    /** Headers the caller already set. A CSRF header among them is never replaced. */\n    headers?: HeadersInit;\n}\n\n/**\n * The CSRF header a request should carry, or an empty object.\n *\n * Every request path in the SDK — `createApiClient`, `uploadWithProgress`,\n * `createResumableUpload` — asks this function, so the rules are one rule:\n *\n * - **Off unless configured.** Without `csrf`, nothing changes.\n * - **Unsafe methods only.** `GET`, `HEAD`, `OPTIONS` and `TRACE` never carry\n *   it; they must not change state, and a token in a `GET` ends up in logs\n *   and caches for nothing.\n * - **Never across an origin.** The token follows the same scope as the bearer\n *   credential ({@link isTrustedCredentialTarget}), because a URL can come off\n *   the network — a tus `Location`, a pagination link — and a CSRF token sent\n *   to a third party is a token that third party can replay. Withheld tokens\n *   are reported once per origin in a development build.\n * - **Your header wins.** A CSRF header you set by hand, in any casing, is\n *   left alone.\n * - **Independent of auth.** It is sent on `skipAuth` requests too: login and\n *   refresh are exactly the writes a cookie session exposes to forgery.\n *\n * Exported for the request you build by hand, so it follows the same rules.\n *\n * @example\n * const headers = csrfHeaders({\n *     method: \"POST\",\n *     url: \"https://api.acme.com/orders\",\n *     reference: \"https://api.acme.com\",\n *     csrf: true,\n * });\n * // { \"X-CSRF-Token\": \"<value of the csrf_token cookie>\" }\n *\n * @param input - The request and the CSRF config.\n * @returns A header record to spread into the request's headers.\n */\nexport function csrfHeaders(input: CsrfHeadersInput): Record<string, string> {\n    const { method, url, reference, csrf, trustedOrigins, headers } = input;\n    if (!csrf) return {};\n    if (SAFE_METHODS.has(method.toUpperCase())) return {};\n    const options: CsrfOptions = csrf === true ? {} : csrf;\n    const headerName = options.headerName ?? DEFAULT_CSRF_HEADER_NAME;\n    if (hasHeader(headers, headerName)) return {};\n    if (!isTrustedCredentialTarget(url, reference, trustedOrigins)) {\n        reportSuppressedCredential(url, reference, headerName);\n        return {};\n    }\n    const cookieName = options.cookieName ?? DEFAULT_CSRF_COOKIE_NAME;\n    const token = options.getToken ? options.getToken() : readCookie(cookieName);\n    if (!token) {\n        reportMissingToken(options.getToken ? \"getToken\" : cookieName);\n        return {};\n    }\n    return { [headerName]: token };\n}\n\n/**\n * Forget which token sources were already reported empty.\n *\n * Exported for tests, which assert the once-per-source behaviour and would\n * otherwise leak state between cases.\n */\nexport function resetCsrfReports(): void {\n    reportedMissing.clear();\n}\n"],"mappings":";;;AAYA,IAAa,IAA2B,cAQ3B,IAA2B,gBAwClC,oBAAoC,IAAI,IAAI;CAAC;CAAO;CAAQ;CAAW;AAAO,CAAC,GAG/E,oBAAkB,IAAI,IAAY;AAYxC,SAAS,EAAW,GAA6B;CAC7C,IAAI,OAAO,WAAa,KAAa,OAAO;CAC5C,IAAM,IAAS,GAAG,EAAK;CACvB,KAAK,IAAM,KAAQ,SAAS,OAAO,MAAM,GAAG,GAAG;EAC3C,IAAM,IAAQ,EAAK,KAAK;EACxB,IAAI,CAAC,EAAM,WAAW,CAAM,GAAG;EAC/B,IAAM,IAAM,EAAM,MAAM,EAAO,MAAM;EACrC,IAAI;GACA,OAAO,mBAAmB,CAAG;EACjC,QAAQ;GACJ,OAAO;EACX;CACJ;CACA,OAAO;AACX;AAcA,SAAS,EAAmB,GAAsB;CAC9C,IAAI,CAAC,EAAW,KAAK,EAAgB,IAAI,CAAM,GAAG;CAClD,EAAgB,IAAI,CAAM;CAC1B,IAAM,IACF,MAAW,aACL,qCACA,gBAAgB,EAAO;CACjC,QAAQ,KACJ,2CAA2C,EAAM,kHACrD;AACJ;AAaA,SAAS,EAAU,GAAkC,GAAuB;CAExE,OADK,IACE,IAAI,QAAQ,CAAO,CAAC,CAAC,IAAI,CAAI,IADf;AAEzB;AAuDA,SAAgB,EAAY,GAAiD;CACzE,IAAM,EAAE,WAAQ,QAAK,cAAW,SAAM,mBAAgB,eAAY;CAElE,IADI,CAAC,KACD,EAAa,IAAI,EAAO,YAAY,CAAC,GAAG,OAAO,CAAC;CACpD,IAAM,IAAuB,MAAS,KAAO,CAAC,IAAI,GAC5C,IAAa,EAAQ,cAAA;CAC3B,IAAI,EAAU,GAAS,CAAU,GAAG,OAAO,CAAC;CAC5C,IAAI,CAAC,EAA0B,GAAK,GAAW,CAAc,GAEzD,OADA,EAA2B,GAAK,GAAW,CAAU,GAC9C,CAAC;CAEZ,IAAM,IAAa,EAAQ,cAAA,cACrB,IAAQ,EAAQ,WAAW,EAAQ,SAAS,IAAI,EAAW,CAAU;CAK3E,OAJK,IAIE,GAAG,IAAa,EAAM,KAHzB,EAAmB,EAAQ,WAAW,aAAa,CAAU,GACtD,CAAC;AAGhB"}

package/dist/http/resumable-upload.cjs

@@ -1,2 +1,2 @@
-const e=require("../utils/base64.cjs"),t=require("./credential-scope.cjs"),n=require("./errors.cjs"),r=require("./retry.cjs"),i=require("./idempotency.cjs");var a=`1.0.0`,o=5242880;function s(t){return e.bytesToBase64(new TextEncoder().encode(t))}function c(e){if(!e)return null;let t=Object.entries(e).map(([e,t])=>`${e} ${s(t)}`);return t.length>0?t.join(`,`):null}function l(e,t){let n=t,r=typeof n.name==`string`?n.name:`blob`,i=typeof n.lastModified==`number`?n.lastModified:0;return`${e}|${r}|${t.size}|${t.type}|${i}`}function u(e=`tempest-upload:`){function t(){try{return typeof localStorage>`u`?null:localStorage}catch{return null}}return{get(n){let r=t()?.getItem(e+n);if(!r)return null;try{return JSON.parse(r)}catch{return null}},set(n,r){t()?.setItem(e+n,JSON.stringify(r))},delete(n){t()?.removeItem(e+n)}}}function d(e){return new Promise((t,r)=>{let i=new XMLHttpRequest;i.open(e.method,e.url),i.withCredentials=e.withCredentials;for(let[t,n]of Object.entries(e.headers))i.setRequestHeader(t,n);if(e.onProgress){let t=e.onProgress;i.upload.onprogress=e=>t(e.loaded)}i.onload=()=>t({status:i.status,text:i.responseText,header:e=>i.getResponseHeader(e)}),i.onerror=()=>r(new n.TempestApiError({status:0,detail:`Falha de rede no upload resumível.`})),i.onabort=()=>r(new DOMException(`Aborted`,`AbortError`)),e.register(i),i.send(e.body)})}function f(e){let t=e.header(`Upload-Offset`);if(t===null)return null;let n=Number(t);return Number.isFinite(n)&&n>=0?n:null}function p(e){if(!e)return null;try{return JSON.parse(e)}catch{return e}}var m=new Set([409,412]);function h(e){return!n.isApiError(e)||m.has(e.status)?!0:n.isRetriableStatus(e.status)}function g(e,t){let r=p(e.text),i=n.buildApiError(e.status,r,{get:e.header}),a=typeof r==`object`&&!!r&&(`detail`in r||`message`in r);return new n.TempestApiError({...i,detail:a?i.detail:t})}function _(e){let t=typeof window>`u`?void 0:window.location.href;try{return new URL(e,t).href}catch{return e}}function v(e){let{endpoint:s,file:p,chunkSize:m=o,metadata:v,headers:y={},getToken:b,trustedOrigins:x,withCredentials:S=!1,key:C=l(s,p),storage:w=u(),retry:T,onProgress:E,onStateChange:D}=e,O=`idle`,k=0,A=null,j=null,M=null,N=null,P=0;function F(e){O!==e&&(O=e,D?.(e))}function I(e){E?.({loaded:e,total:p.size,fraction:p.size===0?1:e/p.size,resumedFrom:P})}function L(e){let n={...y,"Tus-Resumable":a},r=b?.();return r&&!(`Authorization`in n)&&(t.isTrustedCredentialTarget(e,s,x)?n.Authorization=`Bearer ${r}`:t.reportSuppressedCredential(e,s)),n}function R(e){N=e}async function z(){w&&A&&j&&await w.set(C,{url:A,offset:k,size:p.size,idempotencyKey:j,updatedAt:Date.now()})}async function B(e){let t=await d({method:`HEAD`,url:e,headers:L(e),withCredentials:S,register:R});if(t.status===404||t.status===410)throw new n.TempestApiError({status:t.status,detail:`O upload expirou no servidor. Comece de novo.`});let r=f(t);if(r===null)throw g(t,`HEAD sem Upload-Offset.`);return r}async function V(){let e=w?await w.get(C):null;if(e&&e.size===p.size&&(j=e.idempotencyKey,e.url))try{return k=await B(e.url),A=e.url,e.url}catch{k=0}F(`creating`),j??=i.generateIdempotencyKey(),A=null,k=0,w&&await w.set(C,{url:``,offset:0,size:p.size,idempotencyKey:j,updatedAt:Date.now()});let t={...L(s),"Upload-Length":String(p.size),"Idempotency-Key":j},n=c(v);n&&(t[`Upload-Metadata`]=n);let r=await d({method:`POST`,url:s,headers:t,withCredentials:S,register:R});if(r.status!==201)throw g(r,`Criação do upload recusada.`);let a=r.header(`Location`);if(!a)throw g(r,`Criação do upload sem cabeçalho Location.`);return A=_(a),await z(),A}async function H(e,t){if(t.needed&&(k=await B(e),t.needed=!1,I(k),await z(),k>=p.size))return;let n=Math.min(k+m,p.size),r=k,i=await d({method:`PATCH`,url:e,headers:{...L(e),"Content-Type":`application/offset+octet-stream`,"Upload-Offset":String(r)},body:p.slice(r,n),withCredentials:S,onProgress:e=>I(Math.min(r+e,p.size)),register:R});if(i.status===409||i.status===412)throw t.needed=!0,g(i,`Offset divergente — o servidor já tinha esses bytes.`);if(i.status!==204&&i.status!==200)throw g(i,`Chunk recusado pelo servidor.`);k=f(i)??n,I(k),await z()}async function U(){M=null;let e=await V();P=k,F(`uploading`),I(k);let t={needed:!1};for(;k<p.size&&!M;)await r.retry(()=>H(e,t),{retries:5,...T,shouldRetry:(e,n)=>{if(M||e instanceof DOMException&&e.name===`AbortError`)return!1;let r=T?.shouldRetry?.(e,n)??h(e);return r&&(t.needed=!0),r}});return M===`pause`?(F(`paused`),null):M===`abort`?(F(`aborted`),null):(F(`done`),w&&await w.delete(C),{url:e,size:p.size})}async function W(){try{return await U()}catch(e){if(M!==null||e instanceof DOMException&&e.name===`AbortError`)return F(M===`abort`?`aborted`:`paused`),null;throw F(`error`),e}finally{N=null}}function G(e){M=e,N?.abort(),N=null}return{start:W,resume:W,pause:()=>G(`pause`),abort:async({discard:e=!1}={})=>{G(`abort`),F(`aborted`),e&&(A&&await d({method:`DELETE`,url:A,headers:L(A),withCredentials:S,register:()=>void 0}).catch(()=>void 0),w&&await w.delete(C))},get state(){return O},get offset(){return k},get url(){return A},key:C}}exports.DEFAULT_CHUNK_SIZE=o,exports.TUS_VERSION=a,exports.createLocalUploadStorage=u,exports.createResumableUpload=v,exports.uploadFingerprint=l;
+const e=require("../utils/base64.cjs"),t=require("./credential-scope.cjs"),n=require("./csrf.cjs"),r=require("./errors.cjs"),i=require("./retry.cjs"),a=require("./idempotency.cjs");var o=`1.0.0`,s=5242880;function c(t){return e.bytesToBase64(new TextEncoder().encode(t))}function l(e){if(!e)return null;let t=Object.entries(e).map(([e,t])=>`${e} ${c(t)}`);return t.length>0?t.join(`,`):null}function u(e,t){let n=t,r=typeof n.name==`string`?n.name:`blob`,i=typeof n.lastModified==`number`?n.lastModified:0;return`${e}|${r}|${t.size}|${t.type}|${i}`}function d(e=`tempest-upload:`){function t(){try{return typeof localStorage>`u`?null:localStorage}catch{return null}}return{get(n){let r=t()?.getItem(e+n);if(!r)return null;try{return JSON.parse(r)}catch{return null}},set(n,r){t()?.setItem(e+n,JSON.stringify(r))},delete(n){t()?.removeItem(e+n)}}}function f(e){return new Promise((t,n)=>{let i=new XMLHttpRequest;i.open(e.method,e.url),i.withCredentials=e.withCredentials;for(let[t,n]of Object.entries(e.headers))i.setRequestHeader(t,n);if(e.onProgress){let t=e.onProgress;i.upload.onprogress=e=>t(e.loaded)}i.onload=()=>t({status:i.status,text:i.responseText,header:e=>i.getResponseHeader(e)}),i.onerror=()=>n(new r.TempestApiError({status:0,detail:`Falha de rede no upload resumível.`})),i.onabort=()=>n(new DOMException(`Aborted`,`AbortError`)),e.register(i),i.send(e.body)})}function p(e){let t=e.header(`Upload-Offset`);if(t===null)return null;let n=Number(t);return Number.isFinite(n)&&n>=0?n:null}function m(e){if(!e)return null;try{return JSON.parse(e)}catch{return e}}var h=new Set([409,412]);function g(e){return!r.isApiError(e)||h.has(e.status)?!0:r.isRetriableStatus(e.status)}function _(e,t){let n=m(e.text),i=r.buildApiError(e.status,n,{get:e.header}),a=typeof n==`object`&&!!n&&(`detail`in n||`message`in n);return new r.TempestApiError({...i,detail:a?i.detail:t})}function v(e){let t=typeof window>`u`?void 0:window.location.href;try{return new URL(e,t).href}catch{return e}}function y(e){let{endpoint:c,file:m,chunkSize:h=s,metadata:y,headers:b={},getToken:x,trustedOrigins:S,withCredentials:C=!1,csrf:w,key:T=u(c,m),storage:E=d(),retry:D,onProgress:O,onStateChange:k}=e,A=`idle`,j=0,M=null,N=null,P=null,F=null,I=0;function L(e){A!==e&&(A=e,k?.(e))}function R(e){O?.({loaded:e,total:m.size,fraction:m.size===0?1:e/m.size,resumedFrom:I})}function z(e,r){let i={...b,"Tus-Resumable":o},a=x?.();return a&&!(`Authorization`in i)&&(t.isTrustedCredentialTarget(e,c,S)?i.Authorization=`Bearer ${a}`:t.reportSuppressedCredential(e,c)),Object.assign(i,n.csrfHeaders({method:r,url:e,reference:c,csrf:w,trustedOrigins:S,headers:b})),i}function B(e){F=e}async function V(){E&&M&&N&&await E.set(T,{url:M,offset:j,size:m.size,idempotencyKey:N,updatedAt:Date.now()})}async function H(e){let t=await f({method:`HEAD`,url:e,headers:z(e,`HEAD`),withCredentials:C,register:B});if(t.status===404||t.status===410)throw new r.TempestApiError({status:t.status,detail:`O upload expirou no servidor. Comece de novo.`});let n=p(t);if(n===null)throw _(t,`HEAD sem Upload-Offset.`);return n}async function U(){let e=E?await E.get(T):null;if(e&&e.size===m.size&&(N=e.idempotencyKey,e.url))try{return j=await H(e.url),M=e.url,e.url}catch{j=0}L(`creating`),N??=a.generateIdempotencyKey(),M=null,j=0,E&&await E.set(T,{url:``,offset:0,size:m.size,idempotencyKey:N,updatedAt:Date.now()});let t={...z(c,`POST`),"Upload-Length":String(m.size),"Idempotency-Key":N},n=l(y);n&&(t[`Upload-Metadata`]=n);let r=await f({method:`POST`,url:c,headers:t,withCredentials:C,register:B});if(r.status!==201)throw _(r,`Criação do upload recusada.`);let i=r.header(`Location`);if(!i)throw _(r,`Criação do upload sem cabeçalho Location.`);return M=v(i),await V(),M}async function W(e,t){if(t.needed&&(j=await H(e),t.needed=!1,R(j),await V(),j>=m.size))return;let n=Math.min(j+h,m.size),r=j,i=await f({method:`PATCH`,url:e,headers:{...z(e,`PATCH`),"Content-Type":`application/offset+octet-stream`,"Upload-Offset":String(r)},body:m.slice(r,n),withCredentials:C,onProgress:e=>R(Math.min(r+e,m.size)),register:B});if(i.status===409||i.status===412)throw t.needed=!0,_(i,`Offset divergente — o servidor já tinha esses bytes.`);if(i.status!==204&&i.status!==200)throw _(i,`Chunk recusado pelo servidor.`);j=p(i)??n,R(j),await V()}async function G(){P=null;let e=await U();I=j,L(`uploading`),R(j);let t={needed:!1};for(;j<m.size&&!P;)await i.retry(()=>W(e,t),{retries:5,...D,shouldRetry:(e,n)=>{if(P||e instanceof DOMException&&e.name===`AbortError`)return!1;let r=D?.shouldRetry?.(e,n)??g(e);return r&&(t.needed=!0),r}});return P===`pause`?(L(`paused`),null):P===`abort`?(L(`aborted`),null):(L(`done`),E&&await E.delete(T),{url:e,size:m.size})}async function K(){try{return await G()}catch(e){if(P!==null||e instanceof DOMException&&e.name===`AbortError`)return L(P===`abort`?`aborted`:`paused`),null;throw L(`error`),e}finally{F=null}}function q(e){P=e,F?.abort(),F=null}return{start:K,resume:K,pause:()=>q(`pause`),abort:async({discard:e=!1}={})=>{q(`abort`),L(`aborted`),e&&(M&&await f({method:`DELETE`,url:M,headers:z(M,`DELETE`),withCredentials:C,register:()=>void 0}).catch(()=>void 0),E&&await E.delete(T))},get state(){return A},get offset(){return j},get url(){return M},key:T}}exports.DEFAULT_CHUNK_SIZE=s,exports.TUS_VERSION=o,exports.createLocalUploadStorage=d,exports.createResumableUpload=y,exports.uploadFingerprint=u;
 //# sourceMappingURL=resumable-upload.cjs.map